riskrails 3.0.0 → 3.1.0

package/bin/riskrails.js

@@ -2,6 +2,7 @@
 // RiskRails installer (Claude Code and/or Codex). Node 18+, stdlib only.
 //   npx riskrails [--target auto|claude|codex|both] [--plan pro|team-pro|team-max|max|max20|balanced-max]
 //                 [--fable auto|yes|no] [--codex-plan plus|pro|balanced-max] [--dry-run]
+//                 [--context default|economy] [--statusline-context yes|no]
 //                 [--home DIR] [--codex-home DIR] [--yes] [--version]
 // --target defaults to auto: each runtime is installed only if its executable is on PATH.
 // --plan   Claude only: pro, team-pro (Team Standard seat), team-max (Team Premium seat), max
@@ -16,6 +17,14 @@
 // --fable  Claude only. auto = yes on max, max20 and team-max, no on pro and team-pro.
 // --codex-plan  Codex only: plus, pro or balanced-max. Defaults to auto-detect from the ChatGPT
 //          login in ~/.codex/auth.json (chatgpt_plan_type); assumes pro when it cannot tell.
+// --context  default leaves each runtime its own context window and compaction, and
+//          context-guard only warns. economy writes the plan's autoCompactWindow (800 000 on
+//          Max, 300 000 on Pro) and the guard also holds a prompt back past 120% of it.
+//          Without economy, an autoCompactWindow equal to the plan's is removed; any other
+//          value is the user's and stays. Recorded in riskrails/profile.json as `context`.
+// --statusline-context  yes (default) shows the model and the context use in the
+//          statusline: a line before the user's own in Claude Code, `model-with-reasoning`
+//          and `context-used` in Codex's [tui] status_line. no adds nothing and removes nothing.
 // --home / --codex-home  the runtime homes (default ~/.claude and ~/.codex; the environment
 //          variables CLAUDE_DIR and CODEX_DIR mean the same). Naming exactly one of them under
 //          --target auto installs that runtime alone.
@@ -47,6 +56,7 @@ let CODEX_DIR = env.CODEX_DIR || path.join(os.homedir(), '.codex');
 const HOME = env.HOME || os.homedir();
 let PLAN = '', FABLE = 'auto', DRY = false, TARGET = 'auto', PLAN_GIVEN = false;
 let CODEX_PLAN = '', CODEX_PLAN_GIVEN = false, YES = false;
+let CONTEXT = 'default', STATUSLINE_CONTEXT = 'yes';
 
 function version() {
   try { return JSON.parse(fs.readFileSync(path.join(SRC, 'package.json'), 'utf8')).version || 'unknown'; }
@@ -76,6 +86,8 @@ function usage() {
       case '--plan': PLAN = take(); PLAN_GIVEN = true; break;
       case '--fable': FABLE = take(); PLAN_GIVEN = true; break;
       case '--codex-plan': CODEX_PLAN = take(); CODEX_PLAN_GIVEN = true; break;
+      case '--context': CONTEXT = take(); break;
+      case '--statusline-context': STATUSLINE_CONTEXT = take(); break;
       case '--home': CLAUDE_DIR = path.resolve(take()); CLAUDE_DIR_GIVEN = true; break;
       case '--codex-home': CODEX_DIR = path.resolve(take()); CODEX_DIR_GIVEN = true; break;
       case '--dry-run': DRY = true; break;
@@ -89,6 +101,10 @@ function usage() {
 if (!['auto', 'claude', 'codex', 'both'].includes(TARGET)) {
   die(`--target must be auto|claude|codex|both (got '${TARGET}')`, 2);
 }
+if (!['default', 'economy'].includes(CONTEXT)) die(`--context must be default|economy (got '${CONTEXT}')`, 2);
+if (!['yes', 'no'].includes(STATUSLINE_CONTEXT)) {
+  die(`--statusline-context must be yes|no (got '${STATUSLINE_CONTEXT}')`, 2);
+}
 const major = Number(process.versions.node.split('.')[0]);
 if (major < 18) die('riskrails needs Node 18 or newer (this is ' + process.versions.node + ')', 1);
 
@@ -281,7 +297,7 @@ let PLUGIN_VERSION = 'unknown';
 try { PLUGIN_VERSION = readJSON(path.join(SRC, '.codex-plugin/plugin.json')).version || 'unknown'; } catch (e) { /* unknown */ }
 function agenticProfile(runtime, profile, plan, label, fable) {
   const p = JSON.parse(python([path.join(SRC, 'scripts/resolve-profile.py'), profile, '--src', SRC, '--plan', plan,
-    '--label', label, '--fable', fable, '--print', 'agentic']));
+    '--label', label, '--fable', fable, '--context', CONTEXT, '--print', 'agentic']));
   p.runtime = runtime; p.plugin_version = PLUGIN_VERSION; p.written_at = utcStamp();
   p.dialog = { tool: runtime === 'claude' ? 'AskUserQuestion' : codexDialogTool() };
   p.set_by = { via: 'installer', at: p.written_at };
@@ -391,7 +407,9 @@ function claudeRender() {
 
   // The profile's riskrails tables are the plugin's, not Claude Code's: the resolver
   // prints the settings half alone, so they never reach settings.json.
-  const profile = JSON.parse(python([path.join(SRC, 'scripts/resolve-profile.py'), PROFILE_NAME, '--src', SRC, '--print', 'settings']));
+  // --context economy puts the plan's autoCompactWindow into that half; default leaves it out.
+  const profile = JSON.parse(python([path.join(SRC, 'scripts/resolve-profile.py'), PROFILE_NAME, '--src', SRC,
+    '--context', CONTEXT, '--print', 'settings']));
   if (TIER === 'max' && FABLE === 'no') {
     profile.availableModels = (profile.availableModels || []).filter((m) => !String(m).startsWith('fable'));
     if (isObj(profile.modelSettings)) delete profile.modelSettings['claude-fable-5-1'];
@@ -404,18 +422,26 @@ function claudeRender() {
   const fallbacks = Array.isArray(snippet.fallbackModel) ? snippet.fallbackModel : [snippet.fallbackModel];
   const FALLBACK = fallbacks.join(', then ');
   const EFFORT = String(snippet.effortLevel);
-  const COMPACT = Number(snippet.autoCompactWindow);
-  // Auto-compaction fires about 33k under the window; context-guard.py derives its
-  // thresholds from the same point. Claude Code caps autoCompactWindow at the model's
-  // own window, so print the number that matches the session this install configures.
+  // The plan's own window (riskrails.economy), written only with --context economy; in
+  // default the runtime compacts against the model's window. Auto-compaction fires about
+  // 33k under the window; context-guard.py derives its thresholds from the same point and
+  // holds a prompt back only when a window is configured. Claude Code caps
+  // autoCompactWindow at the model's own window, so print the number that matches the
+  // session this install configures.
+  const COMPACT = CONTEXT === 'economy' ? Number(snippet.autoCompactWindow) || 0 : 0;
   const MODEL_WINDOW = SESSION_MODEL.includes('[1m]') ? 1000000 : 200000;
-  const COMPACT_AT = Math.min(COMPACT, MODEL_WINDOW) - 33000;
-  const oneM = read(path.join(SRC, 'bin/claude-1m')).match(/^WINDOW="\$\{CLAUDE_1M_COMPACT_WINDOW:-([0-9]*)\}"$/m);
-  const ONE_M_AT = Number(oneM ? oneM[1] : 0) - 33000;
+  const fires = (window) => (COMPACT ? Math.min(COMPACT, window) : window) - 33000;
+  const COMPACT_AT = fires(MODEL_WINDOW);
+  const ONE_M_AT = fires(1000000);
+  const COMPACT_NOTE = COMPACT ? `\`autoCompactWindow\` ${COMPACT}` : 'the runtime default, `--context economy` sets a window';
   const ONE_M_FABLE = FABLE === 'yes' ? ' and `claude-1m fable` for Fable 5.1 [1m]' : '';
-  let ONE_M_RULE = `One \`autoCompactWindow\` of ${COMPACT} serves every model: Claude Code caps it at the model's own window, so this session compacts near ${COMPACT_AT} and a \`[1m]\` one near ${ONE_M_AT}, whether it was started with \`claude-1m\` (\`~/.claude/bin/claude-1m\`) for \`opus[1m]\`${ONE_M_FABLE} or switched to with \`/model\`. \`claude-1m\` pins the model at launch and \`CLAUDE_1M_COMPACT_WINDOW\` lowers the window for that one process; it is no longer what grants the large window. When a task inside an ordinary session needs one large-context read, say so and, once the user agrees, run \`claude-1m -p '<brief>'\` from Bash — its own process, only the answer comes back.`;
+  let ONE_M_RULE = COMPACT
+    ? `One \`autoCompactWindow\` of ${COMPACT} serves every model: Claude Code caps it at the model's own window, so this session compacts near ${COMPACT_AT} and a \`[1m]\` one near ${ONE_M_AT}, whether it was started with \`claude-1m\` (\`~/.claude/bin/claude-1m\`) for \`opus[1m]\`${ONE_M_FABLE} or switched to with \`/model\`. \`claude-1m\` pins the model at launch and \`CLAUDE_1M_COMPACT_WINDOW\` lowers the window for that one process; it is no longer what grants the large window. When a task inside an ordinary session needs one large-context read, say so and, once the user agrees, run \`claude-1m -p '<brief>'\` from Bash — its own process, only the answer comes back.`
+    : `Compaction is at the runtime default: each model compacts against its own window, so this session near ${COMPACT_AT} and a \`[1m]\` one near ${ONE_M_AT}, whether it was started with \`claude-1m\` (\`~/.claude/bin/claude-1m\`) for \`opus[1m]\`${ONE_M_FABLE} or switched to with \`/model\`. \`claude-1m\` pins the model at launch and \`CLAUDE_1M_COMPACT_WINDOW\` sets an earlier window for that one process. When a task inside an ordinary session needs one large-context read, say so and, once the user agrees, run \`claude-1m -p '<brief>'\` from Bash — its own process, only the answer comes back.`;
   if (MODEL_WINDOW > 200000) {
-    ONE_M_RULE = `\`autoCompactWindow\` ${COMPACT} applies uncapped to this 1M session, so it compacts near ${COMPACT_AT}; a 200k model picked with \`/model opus\` is capped at its own window and compacts near 167000. For a small task a 200k session is cheaper per turn — say so and let the user switch. \`claude-1m\` (\`~/.claude/bin/claude-1m\`) still pins the model at launch${ONE_M_FABLE}, and \`CLAUDE_1M_COMPACT_WINDOW\` lowers the window for that one process.`;
+    ONE_M_RULE = COMPACT
+      ? `\`autoCompactWindow\` ${COMPACT} applies uncapped to this 1M session, so it compacts near ${COMPACT_AT}; a 200k model picked with \`/model opus\` is capped at its own window and compacts near 167000. For a small task a 200k session is cheaper per turn — say so and let the user switch. \`claude-1m\` (\`~/.claude/bin/claude-1m\`) still pins the model at launch${ONE_M_FABLE}, and \`CLAUDE_1M_COMPACT_WINDOW\` lowers the window for that one process.`
+      : `Compaction is at the runtime default, so this 1M session compacts near ${COMPACT_AT} and context-guard only warns; a 200k model picked with \`/model opus\` compacts near 167000. For a small task a 200k session is cheaper per turn — say so and let the user switch. \`claude-1m\` (\`~/.claude/bin/claude-1m\`) still pins the model at launch${ONE_M_FABLE}, and \`CLAUDE_1M_COMPACT_WINDOW\` sets an earlier window for that one process.`;
   }
   const READ_LINES = String(snippet.env.CLAUDE_READ_MAX_LINES);
   const READ_BYTES = String(snippet.env.CLAUDE_READ_MAX_BYTES);
@@ -442,17 +468,17 @@ function claudeRender() {
       ARCHITECT_MODEL_LINE = 'model: fable[1m]';
       ARCHITECT_EFFORT = 'xhigh';
       EXPERT_ROW = '`fable[1m]` / `xhigh`, pinned on `architect`';
-      PLAN_SPECIFIC = `- Session model is ${SESSION_HUMAN} by default, compaction near ${COMPACT_AT} tokens (\`autoCompactWindow\` ${COMPACT}). A large context is not free: every turn re-reads it, so keep \`/clear\` between tasks. ${ONE_M_RULE} Fable 5.1 [1m] is pinned on \`architect\` (\`model: fable[1m]\`, \`xhigh\`) and is the session only when the user starts one with \`claude-1m fable\` — never pick it for a reader or a reviewer. \`max\` stays off.
+      PLAN_SPECIFIC = `- Session model is ${SESSION_HUMAN} by default, compaction near ${COMPACT_AT} tokens (${COMPACT_NOTE}). A large context is not free: every turn re-reads it, so keep \`/clear\` between tasks. ${ONE_M_RULE} Fable 5.1 [1m] is pinned on \`architect\` (\`model: fable[1m]\`, \`xhigh\`) and is the session only when the user starts one with \`claude-1m fable\` — never pick it for a reader or a reviewer. \`max\` stays off.
 - \`runtime-gate\` checks Fable at run time. \`fallbackModel\` covers an overload; after a rate-limit or model-not-found failure, and while the weekly limit is ${WEEKLY}% or more used, the gate sends every \`model: fable\` agent to Opus until the reset, and says so in the agent's context. If a Fable agent still returns such an error, re-run the same brief once with \`model: opus\` — an availability switch, not a downgrade. \`~/.claude/hooks/runtime-gate.py status\` shows the gate; \`clear\` re-enables Fable early.`;
     } else {
       ARCHITECT_MODEL_LINE = `# model: intentionally omitted — inherits the session model (${SESSION_HUMAN}, Fable disabled in this install)`;
       ARCHITECT_EFFORT = 'high';
       EXPERT_ROW = `the session model at \`${ARCHITECT_EFFORT}\` — \`architect\` inherits it`;
-      PLAN_SPECIFIC = `- Session model is ${SESSION_HUMAN} by default, compaction near ${COMPACT_AT} tokens (\`autoCompactWindow\` ${COMPACT}). ${ONE_M_RULE} Fable is disabled in this install (\`--fable no\`). Do not request \`model: fable\` anywhere. \`xhigh\` and \`max\` stay off.`;
+      PLAN_SPECIFIC = `- Session model is ${SESSION_HUMAN} by default, compaction near ${COMPACT_AT} tokens (${COMPACT_NOTE}). ${ONE_M_RULE} Fable is disabled in this install (\`--fable no\`). Do not request \`model: fable\` anywhere. \`xhigh\` and \`max\` stay off.`;
     }
     if (PLAN === 'balanced-max') {
       ARCHITECT_MODEL_LINE = '# model: intentionally omitted — inherits the session model (Opus 5.5; no Fable on BalancedMax)';
-      PLAN_SPECIFIC = `- BalancedMax: only the session runs the strong model. Session model is Opus 5.5 with the 200k window and compaction near ${COMPACT_AT} tokens (\`autoCompactWindow\` ${COMPACT}); it plans and implements. Agents keep their cheap tiers — readers (\`Explore\`, \`log-reader\`) on \`${tier('FAST', 'model')}\` / \`${tier('FAST', 'effort')}\`, judgement (\`ai-discovery\`) on \`${tier('BALANCED', 'model')}\`, \`ai-reviewer\` on \`${tier('STRONG', 'model')}\`, and \`architect\` inherits the session. \`opus[1m]\` is a per-task choice, never the default. ${ONE_M_RULE} Fable is off on this plan; never request \`model: fable\`. \`xhigh\` and \`max\` stay off.`;
+      PLAN_SPECIFIC = `- BalancedMax: only the session runs the strong model. Session model is Opus 5.5 with the 200k window and compaction near ${COMPACT_AT} tokens (${COMPACT_NOTE}); it plans and implements. Agents keep their cheap tiers — readers (\`Explore\`, \`log-reader\`) on \`${tier('FAST', 'model')}\` / \`${tier('FAST', 'effort')}\`, judgement (\`ai-discovery\`) on \`${tier('BALANCED', 'model')}\`, \`ai-reviewer\` on \`${tier('STRONG', 'model')}\`, and \`architect\` inherits the session. \`opus[1m]\` is a per-task choice, never the default. ${ONE_M_RULE} Fable is off on this plan; never request \`model: fable\`. \`xhigh\` and \`max\` stay off.`;
     }
     EFFORT_RULE = 'Raise to `high` for architecture, root-cause analysis and adversarial verification, and say that you are raising it; readers stay at `low`.';
   }
@@ -467,7 +493,10 @@ function claudeRender() {
   const vars = {
     PLAN: PLAN_LABEL, PLAN_LABEL, SESSION_MODEL: SESSION_HUMAN, FALLBACK_MODEL: FALLBACK_HUMAN,
     DEFAULT_EFFORT: EFFORT, COMPACT_WINDOW: spaced(COMPACT_AT),
-    CONTEXT_WARN: `${Math.trunc(COMPACT_AT * 80 / 100000)}k`, CONTEXT_BLOCK: `${Math.trunc(COMPACT_AT * 120 / 100000)}k`,
+    CONTEXT_WARN: `${Math.trunc(COMPACT_AT * 80 / 100000)}k`,
+    CONTEXT_BLOCK: COMPACT
+      ? `and from ${Math.trunc(COMPACT_AT * 120 / 100000)}k the prompt is held back once — sending it again goes through`
+      : 'and the prompt is never held back (only `--context economy` sets a block threshold)',
     READ_LINES, PLAN_SPECIFIC_ROUTING: PLAN_SPECIFIC, EFFORT_RULE, EXPERT_EFFORT, EXPERT_MODEL_LINE, EXPERT_ROW,
     ARCHITECT_MODEL_LINE, ARCHITECT_EFFORT,
     FAST_MODEL: tier('FAST', 'model'), FAST_EFFORT: tier('FAST', 'effort'),
@@ -524,8 +553,11 @@ function shSplit(s) {                                            // shlex.split,
   return words;
 }
 
+// The wrapper is `<PREFIX> [--context] [--then '<the user's command>']`; --context
+// (--statusline-context yes) adds a line with the model and the context use.
 function statuslineGate(file, gate, mode) {
   const PREFIX = '"$HOME/.claude/hooks/runtime-gate.py" statusline';
+  const WANT = STATUSLINE_CONTEXT === 'yes' ? `${PREFIX} --context` : PREFIX;
   const OLD_PREFIX = '"$HOME/.claude/hooks/fable-gate.py" statusline';
   let settings = {};
   if (exists(file)) {
@@ -538,23 +570,35 @@ function statuslineGate(file, gate, mode) {
     line.command = PREFIX + cmd.slice(OLD_PREFIX.length);
     ours = true; gate = 'moved';
   }
+  // What follows the prefix and an optional --context: the user's --then, byte for byte.
+  const tail = () => line.command.slice(PREFIX.length).trim().replace(/^--context(\s+|$)/, '');
+  const shown = STATUSLINE_CONTEXT === 'yes' ? ' with the model and the context use' : '';
   let action = null;
   if (gate === 'moved') {
+    const rest = tail();
+    line.command = rest ? `${WANT} ${rest}` : WANT;
     action = 'moved the fable-gate statusline wrapper to runtime-gate (your command is unchanged)';
   } else if (gate === 'on') {
-    if (ours) return ['statusline: already records the quota'];
-    if (line === undefined || line === null) {
-      settings.statusLine = { type: 'command', command: PREFIX };
-      action = 'added a silent statusline that records the quota (and the Fable weekly limit)';
+    if (ours) {
+      const rest = tail();
+      const want = rest ? `${WANT} ${rest}` : WANT;
+      if (want === cmd) return ['statusline: already records the quota'];
+      line.command = want;
+      action = STATUSLINE_CONTEXT === 'yes'
+        ? 'added the model and the context use to the statusline wrapper (your command is unchanged)'
+        : 'removed the model and context line from the statusline wrapper (your command is unchanged)';
+    } else if (line === undefined || line === null) {
+      settings.statusLine = { type: 'command', command: WANT };
+      action = `added a statusline that records the quota (and the Fable weekly limit)${shown}`;
     } else if (isObj(line) && line.type === 'command' && typeof cmd === 'string' && cmd.trim()) {
-      line.command = `${PREFIX} --then ${shQuote(cmd)}`;
-      action = 'wrapped your statusline command with the quota check (its output is unchanged)';
+      line.command = `${WANT} --then ${shQuote(cmd)}`;
+      action = `wrapped your statusline command with the quota check${shown} (its output is unchanged)`;
     } else {
       return ['statusline: not a command statusline; the weekly-limit check is not wired'];
     }
   } else {
     if (!ours) return [];
-    const rest = cmd.slice(PREFIX.length).trim();
+    const rest = tail();
     if (rest.startsWith('--then')) {
       const parts = shSplit(rest);
       line.command = parts.length > 1 ? parts[1] : '';
@@ -579,12 +623,26 @@ const claudeHookFiles = () => [...glob(path.join(SRC, 'hooks'), '.sh'), ...glob(
   .filter((f) => !path.basename(f).startsWith('codex-'));
 const skillsLine = (plugin) => out(`   skills:  ${ls(path.join(SRC, 'skills')).filter((n) => isDir(path.join(SRC, 'skills', n))).join(',')}${plugin ? ' (without SKILL.md: the plugin loads them)' : ''}`);
 
+// Without --context economy, an autoCompactWindow equal to a shipped plan's economy window
+// (800000 Max, 300000 Pro — the one an earlier install wrote, whichever plan it was for)
+// goes; any other value is the user's own and stays. Returns the value to remove, or 0.
+function ownCompactWindow(doc) {
+  if (CONTEXT === 'economy' || !isObj(doc)) return 0;
+  const shipped = glob(path.join(SRC, 'profiles'), '.json').map((f) => {
+    try { return Number(((readJSON(f).riskrails || {}).economy || {}).autoCompactWindow) || 0; } catch (e) { return 0; }
+  });
+  return shipped.includes(doc.autoCompactWindow) ? doc.autoCompactWindow : 0;
+}
+
 function claudeDryRun() {
   out(`== claude: plan=${PLAN} (${C.PLAN_LABEL}, ${C.TIER} profile) fable=${FABLE} fable-gate=${C.GATE} runtime-gate=on (dry run, nothing written)`);
   out(`== claude: target directory ${CLAUDE_DIR}`);
   for (const l of statuslineGate(path.join(CLAUDE_DIR, 'settings.json'), 'on', 'dry')) out('== ' + l);
   out(`== settings snippet (merged into ${CLAUDE_DIR}/settings.json):`);
   out(pretty(C.snippet));
+  let current = {};
+  try { current = readJSON(path.join(CLAUDE_DIR, 'settings.json')); } catch (e) { /* nothing installed yet */ }
+  if (ownCompactWindow(current)) out(`== would remove autoCompactWindow ${current.autoCompactWindow} (economy off)`);
   out('== agents/architect.md (rendered head):');
   out(read(path.join(TMP, 'agents/architect.md')).split('\n').slice(0, 10).join('\n'));
   out('== CLAUDE.md managed block:');
@@ -1045,6 +1103,11 @@ function claudeApply() {
     if (dropPluginDuplicates(doc, keys)) out('removed: the hook entries the riskrails plugin now runs');
     if (isObj(doc.env) && doc.env.CLAUDE_CODE_SUBAGENT_MODEL === 'sonnet') delete doc.env.CLAUDE_CODE_SUBAGENT_MODEL;
     doc = mergeHooks(deepMerge(doc, snippet), newHooks, true);
+    const own = ownCompactWindow(doc);
+    if (own) {
+      delete doc.autoCompactWindow;
+      out(`removed: autoCompactWindow ${own} (economy off)`);
+    }
     writeJSONFile(SETTINGS, doc);
   }
   out('merged: settings.json');
@@ -1119,11 +1182,16 @@ function claudeSummary() {
     `  session model   ${C.SESSION_MODEL} (${C.SESSION_HUMAN}), effort ${C.EFFORT}`,
     `  fallback        ${C.FALLBACK}`,
     `  EXPERT tier     architect on ${expert} at effort ${C.ARCHITECT_EFFORT}`,
-    `  compaction      near ${C.COMPACT_AT} tokens on this ${Math.trunc(C.MODEL_WINDOW / 1000)}k session (autoCompactWindow ${C.COMPACT},`,
-    "                  capped at the model's window); context-guard warns from",
-    `                  ${Math.trunc(C.COMPACT_AT * 80 / 100)} and holds a prompt back once from ${Math.trunc(C.COMPACT_AT * 120 / 100)}`,
+    ...(C.COMPACT ? [
+      `  compaction      near ${C.COMPACT_AT} tokens on this ${Math.trunc(C.MODEL_WINDOW / 1000)}k session (autoCompactWindow ${C.COMPACT},`,
+      "                  capped at the model's window, --context economy); context-guard warns from",
+      `                  ${Math.trunc(C.COMPACT_AT * 80 / 100)} and holds a prompt back once from ${Math.trunc(C.COMPACT_AT * 120 / 100)}`,
+    ] : [
+      `  compaction      the runtime default: near ${C.COMPACT_AT} tokens on this ${Math.trunc(C.MODEL_WINDOW / 1000)}k session;`,
+      `                  context-guard warns from ${Math.trunc(C.COMPACT_AT * 80 / 100)} and never holds a prompt back (economy only)`,
+    ]),
     C.TIER === 'max'
-      ? `  large context   claude-1m${FABLE === 'yes' ? ' [opus|fable]' : ''} starts one session on opus[1m]${FABLE === 'yes' ? ' or fable[1m] (Fable 5.1)' : ''} that compacts near ${C.ONE_M_AT}\n                  (the same autoCompactWindow, uncapped on a 1M model)`
+      ? `  large context   claude-1m${FABLE === 'yes' ? ' [opus|fable]' : ''} starts one session on opus[1m]${FABLE === 'yes' ? ' or fable[1m] (Fable 5.1)' : ''} that compacts near ${C.ONE_M_AT}\n                  (${C.COMPACT ? 'the same autoCompactWindow, uncapped on a 1M model' : 'the runtime default'})`
       : '',
     `  read guard      an unbounded Read is refused above ${C.READ_LINES} lines / ${C.READ_BYTES} bytes`,
     `  agents          ${agentNames(' ')}`,
@@ -1137,9 +1205,9 @@ function claudeSummary() {
     'Restart Claude Code, then:',
     '  /config        model and effort match the profile',
     `  /hooks         lists cap-large-read, ai-guard, project-scaffold and context-guard, plus runtime-gate on PreToolUse, PostToolUse, SubagentStart, SubagentStop${C.GATE === 'on' ? ' and StopFailure' : ''}`,
-    '  /skills        lists ai-init, ai-audit, ai-task, ai-status, project-init, sdlc-*, usage-report',
-    '  /ai-init       in a project, to survey it and build .ai/',
-    '  /project-update in a project that already has .ai/ or docs/sdlc/, to pull in these rules',
+    '  /skills        lists rr-setup, rr-spec, rr-plan, rr-build, rr-build-all, rr-review, rr-ship, rr-status',
+    '  /rr-setup      in a project, to survey it and build .ai/',
+    '  /rr-setup --update in a project that already has .ai/ or docs/sdlc/, to pull in these rules',
   ];
   out(lines.join('\n'));
 }
@@ -1210,14 +1278,15 @@ function codexRender() {
 }
 
 // The guard scripts Codex can use. cap-large-read.py is absent: Codex has no hookable Read
-// tool. context-guard.py serves both runtimes: it reads its own location to know which.
-const codexHookFiles = () => ['ai-guard.py', 'runtime-gate.py', 'context-guard.py'].map((n) => path.join(SRC, 'hooks', n));
+// tool. context-guard.py serves both runtimes: it reads its own location to know which;
+// dialog-gate.py reads the payload's envelope (R36.19).
+const codexHookFiles = () => ['ai-guard.py', 'runtime-gate.py', 'context-guard.py', 'dialog-gate.py', 'update_notice.py'].map((n) => path.join(SRC, 'hooks', n));
 
 function codexDryRun() {
   out(`== codex: plan=${CODEX_PLAN} (${X.label}) session ${X.s(X.P.session.model)} at ${X.s(X.P.session.model_reasoning_effort)} (dry run, nothing written)`);
   out(`== codex: target directory ${CODEX_DIR}`);
   const merged = python([path.join(SRC, 'scripts/merge-codex-config.py'), path.join(CODEX_DIR, 'config.toml'),
-    '--profile', X.profileFile, '--dry-run'], { allowFail: true });
+    '--profile', X.profileFile, '--status-context', STATUSLINE_CONTEXT, '--dry-run'], { allowFail: true });
   for (const l of merged.replace(/\n$/, '').split('\n')) if (merged) out('== ' + l);
   out('== AGENTS.md managed block:');
   fs.writeSync(1, read(path.join(TMP, 'AGENTS.block.md')));
@@ -1274,7 +1343,9 @@ function codexApply() {
   // codex-model-gate entries from before WP5 and runtime-gate ones from an earlier run go
   // first, so the merge adds exactly one gate per event. Codex runs only hooks the user has
   // reviewed (config.toml keeps a trusted_hash per entry): a changed entry is skipped until
-  // it is reviewed once in /hooks.
+  // it is reviewed once in /hooks. A group whose commands are exactly a new group's is
+  // replaced by it, as on Claude, so a reinstall carries a widened matcher (R36 7d2); an
+  // unchanged group is written back as it was and keeps its trust.
   const HOOKS = path.join(CODEX_DIR, 'hooks.json');
   if (isFile(HOOKS)) backupFile(HOOKS, CODEX_DIR); else fs.writeFileSync(HOOKS, '{}\n');
   let hadShim = false, hadGuardShims = false;
@@ -1286,7 +1357,11 @@ function codexApply() {
     dropHooks(doc, SHIM_RE);
     const keys = pluginHookKeys(plugin, 'codex-hooks.json');
     if (dropPluginDuplicates(doc, keys)) out('removed: the hook entries the riskrails plugin now runs');
-    writeJSONFile(HOOKS, mergeHooks(doc, withoutPluginHooks(readJSON(path.join(SRC, 'codex/hooks.json')).hooks, keys), false));
+    const fresh = withoutPluginHooks(readJSON(path.join(SRC, 'codex/hooks.json')).hooks, keys);
+    const changed = Object.entries(fresh).some(([ev, entries]) => ((isObj(doc.hooks) && doc.hooks[ev]) || []).some(
+      (old) => entries.some((e) => sameList(commands(e), commands(old)) && !sameList(e, old))));
+    writeJSONFile(HOOKS, mergeHooks(doc, fresh, true));
+    if (changed) out('changed: riskrails hook entries in hooks.json — review them once in /hooks, or Codex skips them');
   }
   out('merged: hooks.json');
   if (hadShim) out('replaced: codex-model-gate.py hooks with runtime-gate.py — review the changed gate entries once in /hooks, or Codex skips them');
@@ -1300,7 +1375,8 @@ function codexApply() {
   const config = path.join(CODEX_DIR, 'config.toml'), before = path.join(TMP, 'config.toml.before');
   rmrf(before);
   if (exists(config) && fs.statSync(config).size > 0) fs.copyFileSync(fs.realpathSync(config), before);
-  python([path.join(SRC, 'scripts/merge-codex-config.py'), config, '--profile', X.profileFile, '--no-backup'], { capture: false });
+  python([path.join(SRC, 'scripts/merge-codex-config.py'), config, '--profile', X.profileFile,
+    '--status-context', STATUSLINE_CONTEXT, '--no-backup'], { capture: false });
   if (exists(before) && fs.statSync(before).size > 0 && !sameFile(before, config)) backupFile(config, CODEX_DIR, before);
 
   // -------------------------------------------------------------- 6. AGENTS.md
@@ -1335,8 +1411,8 @@ function codexSummary() {
     '',
     'Restart Codex, then:',
     '  /hooks         review and trust the guard, gate and context hooks — until you do, Codex skips them',
-    '  /skills        lists ai-init, ai-audit, ai-task, ai-status, project-init, sdlc-*, usage-report',
-    '  /ai-init       in a project, to survey it and build .ai/',
+    '  /skills        lists rr-setup, rr-spec, rr-plan, rr-build, rr-build-all, rr-review, rr-ship, rr-status',
+    '  /rr-setup      in a project, to survey it and build .ai/',
     '',
     `Your previous default model was replaced. backups/${BACKUP_DATE}/config.toml holds the old one.`,
   ].join('\n'));

package/codex/hooks.json

@@ -3,13 +3,13 @@
   "hooks": {
     "PreToolUse": [
       {
-        "matcher": "Bash|apply_patch|Edit|Write",
+        "matcher": ".*",
         "hooks": [
           {
             "type": "command",
             "command": "python3 -I -S \"$HOME/.codex/hooks/ai-guard.py\"",
             "timeout": 15,
-            "statusMessage": "Checking git, paths and scope"
+            "statusMessage": "Checking git, paths, scope and open decisions"
           }
         ]
       },
@@ -36,6 +36,17 @@
             "statusMessage": "Recording expert-model availability"
           }
         ]
+      },
+      {
+        "matcher": "^request_user_input$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 -I -S \"$HOME/.codex/hooks/dialog-gate.py\"",
+            "timeout": 5,
+            "statusMessage": "Recording the dialog's answer"
+          }
+        ]
       }
     ],
     "SubagentStart": [
@@ -98,6 +109,18 @@
           }
         ]
       }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 -I -S \"$HOME/.codex/hooks/dialog-gate.py\"",
+            "timeout": 5,
+            "statusMessage": "Checking for an open decision"
+          }
+        ]
+      }
     ]
   }
 }

package/hooks/AGENTS.md

@@ -1,6 +1,6 @@
-<!-- claude-agentic:rule:hooks:start -->
+<!-- riskrails:rule:hooks:start -->
 # Hooks rules
 - Weigh a change by what it does to a user project's decisions, never by the hook being a process every call runs through (constitution C6). The mode is what W gives (`state.py weight`); the rows below set the behaviour axis.
 - behaviour 0: no guard decision moves, golden byte-identical. behaviour 1: adds a deny or changes a deny's text, golden re-recorded. behaviour 2: allows what was denied or weakens a refusal — declare it, `--declare behaviour=2:"<the effect>"`. Start such a task with `start --mode full --by <name>`: its weight lands in guarded, and these effects keep a STRONG review and the gate.
 - The guards defend against an agent's mistakes, not a constructed command: such a finding is accepted in `known-risks.md` under the threat model in `.ai/policies/safety.md`.
-<!-- claude-agentic:rule:hooks:end -->
+<!-- riskrails:rule:hooks:end -->

package/hooks/CLAUDE.md

@@ -1,6 +1,6 @@
-<!-- claude-agentic:rule:hooks:start -->
+<!-- riskrails:rule:hooks:start -->
 # Hooks rules
 - Weigh a change by what it does to a user project's decisions, never by the hook being a process every call runs through (constitution C6). The mode is what W gives (`state.py weight`); the rows below set the behaviour axis.
 - behaviour 0: no guard decision moves, golden byte-identical. behaviour 1: adds a deny or changes a deny's text, golden re-recorded. behaviour 2: allows what was denied or weakens a refusal — declare it, `--declare behaviour=2:"<the effect>"`. Start such a task with `start --mode full --by <name>`: its weight lands in guarded, and these effects keep a STRONG review and the gate.
 - The guards defend against an agent's mistakes, not a constructed command: such a finding is accepted in `known-risks.md` under the threat model in `.ai/policies/safety.md`.
-<!-- claude-agentic:rule:hooks:end -->
+<!-- riskrails:rule:hooks:end -->

package/hooks/ai-guard.py

@@ -3,8 +3,12 @@
 
 Reads the hook payload from stdin and either exits 0 silently (allow) or prints
 the deny object and exits 0, the contract of every guard. The checks are the
-three shell guards this replaces, in the order a runtime ran them:
+open-decision gate, then the three shell guards this replaces, in the order a
+runtime ran them:
 
+  decision  the gate while a dialog decision is open, on every tool
+            (guard/decision.py): deny all but the dialog, the picked command
+            and `state.py decision show|settle|fallback`
   git    git and deployment safety, on Bash (guard/git.py)
   paths  sensitive paths, control files, the runtime lock, dependency
          instruction files (guard/paths.py)
@@ -12,20 +16,24 @@ three shell guards this replaces, in the order a runtime ran them:
 
 `--only <check>` runs one of them; that is what each hooks/ai-*-guard.sh shim
 passes, so a registration made for the shell guards keeps its meaning. With no
-flag all three run and the first refusal wins.
+flag all of them run and the first refusal wins.
 
 Fail-open: anything unexpected — a payload that is not JSON, a missing file,
 an exception — allows, with no output. A guard is defence-in-depth against an
 agent's mistakes, not a security boundary, and must never make a tool unusable.
+Two exceptions, both with the dialog on (R36): the git check's consent rule
+denies a commit or push when the consent ledger cannot be read (R36.9), and
+state.py's own approve refuses without a pick or a terminal (R36.10).
 Run as `python3 -I -S`: no site packages, no environment-driven imports.
 """
 import os
 import sys
 
-CHECKS = ("git", "paths", "scope")
+CHECKS = ("decision", "git", "paths", "scope")
 # The tools each check reads; any other tool is allowed by its first line, so
-# the module is not even imported for it.
+# the module is not even imported for it. None: every tool.
 TOOLS = {
+    "decision": None,
     "git": ("Bash",),
     "paths": ("Read", "Edit", "Write", "MultiEdit", "NotebookEdit", "Bash"),
     "scope": ("Edit", "Write", "MultiEdit", "NotebookEdit"),
@@ -52,16 +60,28 @@ def main(argv):
             return 0
         ctx = Context(payload, loc, pwd, common.bytes_b(os.fsencode(hook_dir)))
         for name in (only,) if only else CHECKS:
-            if payload.tool not in TOOLS[name]:
+            if TOOLS[name] is not None and payload.tool not in TOOLS[name]:
                 continue
-            module = __import__("guard." + name, fromlist=["check"])
             # Each shell guard was its own process with its own SECONDS: the
-            # first check's clock started with the process, a later one's now.
-            ctx.clock = common.Clock(common.START if name == ((only,) if only else CHECKS)[0] else None)
+            # first shell guard's clock started with the process, a later one's
+            # now. The decision check, new, does not move that.
+            ctx.clock = common.Clock(common.START if name == (only or "git") else None)
             try:
+                module = __import__("guard." + name, fromlist=["check"])
                 module.check(ctx)
             except common.Allow:
                 continue
+            except Exception as exc:        # pylint: disable=broad-exception-caught
+                # The decision gate fails open on its own (R36.12): a missing or
+                # broken module — a half-done install — must not end the run
+                # before git, paths and scope.
+                if name != "decision" or isinstance(exc, common.Deny):
+                    # A git pick the gate spent on this call is gone even
+                    # though a later rule refuses the command (review focus 1).
+                    if isinstance(exc, common.Deny) and name != "decision" and ctx.consent:
+                        from guard import dialog    # pylint: disable=import-outside-toplevel
+                        exc.reason += common.text_to_b(dialog.used_note(ctx.consent))  # pylint: disable=no-member  # exc is a common.Deny by the isinstance above
+                    raise
     except Exception as exc:                # pylint: disable=broad-exception-caught
         common = sys.modules.get("guard.common")
         if common is not None and isinstance(exc, common.Deny):
@@ -86,6 +106,7 @@ class Context:                              # pylint: disable=too-few-public-met
         self.pwd = pwd
         self.hook_dir = hook_dir
         self.clock = common.Clock()
+        self.consent = None                 # the git pick the decision gate spent on this call
 
 
 if __name__ == "__main__":

package/hooks/ai-path-guard-defaults.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "Shipped defaults for ai-path-guard. Do not edit this file; a project overrides it in .ai/policies/path-guard.json (patterns are unioned, allow wins over every other list). Patterns are POSIX extended regular expressions matched against the absolute path. deny_patterns are secrets: refused for read and write. protected_config_patterns are always on and refuse writes: the task's state and journal, task.md, and the guards' own configuration, engine and state.py under .claude/ or .codex/, in a project or in the user's home, and the riskrails plugin's cache folder, which carries the same code on the plugin route. A project's dependency_instruction_patterns, from before 3.4, are read as deny_patterns. task_protected_patterns are on only while a task is in flight (.ai/state/state.json, or else current.json, exists and has not reached \"done\"): the runtime's settings, Claude's record of installed plugins and the pipeline's policies, so a run cannot change the rules it is being judged by. Reading anything but a secret is allowed.",
+  "_comment": "Shipped defaults for ai-path-guard. Do not edit this file; a project overrides it in .ai/policies/path-guard.json (patterns are unioned, allow wins over every other list). Patterns are POSIX extended regular expressions matched against the absolute path. deny_patterns are secrets: refused for read and write. protected_config_patterns are always on and refuse writes: the task's state and journal, task.md, the compact record (.ai/memory/, .ai/local/memory/), and the guards' own configuration, engine and state.py under .claude/ or .codex/, in a project or in the user's home, and the riskrails plugin's cache folder, which carries the same code on the plugin route. A project's dependency_instruction_patterns, from before 3.4, are read as deny_patterns. task_protected_patterns are on only while a task is in flight (.ai/state/state.json, or else current.json, exists and has not reached \"done\"): the runtime's settings, Claude's record of installed plugins and the pipeline's policies, so a run cannot change the rules it is being judged by. Reading anything but a secret is allowed.",
   "deny_patterns": [
     "(^|/)\\.env$",
     "(^|/)\\.env\\.(local|prod|production|staging|live)$",
@@ -29,6 +29,8 @@
     "(^|/)\\.ai/reports/[^/]+/events\\.jsonl$",
     "(^|/)\\.ai/reports/[^/]+/(adopt|migration)\\.json$",
     "(^|/)\\.ai/policies/[^/]*\\.json$",
+    "(^|/)\\.ai/memory/",
+    "(^|/)\\.ai/local/memory/",
     "(^|/)\\.claude/hooks/ai-[^/]*$",
     "/\\.claude/hooks/ai-[^/]*$",
     "(^|/)\\.codex/hooks/ai-[^/]*$",

package/hooks/codex-hooks.json

@@ -3,13 +3,13 @@
   "hooks": {
     "PreToolUse": [
       {
-        "matcher": "Bash|apply_patch|Edit|Write",
+        "matcher": ".*",
         "hooks": [
           {
             "type": "command",
             "command": "python3 -I -S \"${CLAUDE_PLUGIN_ROOT}/hooks/ai-guard.py\"",
             "timeout": 15,
-            "statusMessage": "Checking git, paths and scope"
+            "statusMessage": "Checking git, paths, scope and open decisions"
           }
         ]
       },
@@ -36,6 +36,17 @@
             "statusMessage": "Recording expert-model availability"
           }
         ]
+      },
+      {
+        "matcher": "^request_user_input$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 -I -S \"${CLAUDE_PLUGIN_ROOT}/hooks/dialog-gate.py\"",
+            "timeout": 5,
+            "statusMessage": "Recording the dialog's answer"
+          }
+        ]
       }
     ],
     "SubagentStart": [
@@ -98,6 +109,18 @@
           }
         ]
       }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 -I -S \"${CLAUDE_PLUGIN_ROOT}/hooks/dialog-gate.py\"",
+            "timeout": 5,
+            "statusMessage": "Checking for an open decision"
+          }
+        ]
+      }
     ]
   }
 }