riskrails 3.0.1 → 3.2.1

package/.claude-plugin/marketplace.json

@@ -5,7 +5,7 @@
   },
   "metadata": {
     "description": "A weight-based engineering pipeline for Claude Code and Codex: each change is weighed on six axes, runs light, guarded or full, edits only the files its plan names, and ends at human approval — enforced by hooks, reviewed adversarially, routed to the cheap model tier by default.",
-    "version": "3.0.1"
+    "version": "3.2.1"
   },
   "plugins": [
     {
@@ -14,7 +14,7 @@
         "source": "url",
         "url": "https://github.com/vanssata/claude-agentic-sdlc-module.git"
       },
-      "version": "3.0.1",
+      "version": "3.2.1",
       "strict": true
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "riskrails",
-  "version": "3.0.1",
+  "version": "3.2.1",
   "description": "A weight-based engineering pipeline for Claude Code and Codex: each change is weighed on six axes, runs light, guarded or full, edits only the files its plan names, and ends at human approval — enforced by hooks, reviewed adversarially, routed to the cheap model tier by default.",
   "author": {
     "name": "Ivan Kakurov"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "riskrails",
-  "version": "3.0.1",
+  "version": "3.2.1",
   "description": "A weight-based engineering pipeline for Claude Code and Codex: each change is weighed on six axes, runs light, guarded or full, edits only the files its plan names, and ends at human approval — enforced by hooks, reviewed adversarially, routed to the cheap model tier by default.",
   "author": {
     "name": "Ivan Kakurov"

package/README.md

@@ -1,6 +1,6 @@
 # RiskRails
 
-[![Version](https://img.shields.io/badge/version-3.0.1-d2f878?labelColor=101210)](https://github.com/vanssata/claude-agentic-sdlc-module/releases/tag/v3.0.1)
+[![Version](https://img.shields.io/badge/version-3.2.1-d2f878?labelColor=101210)](https://github.com/vanssata/claude-agentic-sdlc-module/releases/tag/v3.2.1)
 [![Runtimes](https://img.shields.io/badge/runtimes-Claude%20Code%20%7C%20Codex-d2f878?labelColor=101210)](docs/routing.md)
 [![Known risks](https://img.shields.io/badge/known%20risks-documented-d2f878?labelColor=101210)](docs/known-risks.md)
 [![License: MIT](https://img.shields.io/badge/license-MIT-d2f878?labelColor=101210)](LICENSE)
@@ -18,7 +18,7 @@ approval. Risky actions are stopped by a hook, not by a polite request in a
 prompt.
 
 ```bash
-npx riskrails@3.0.1   # detects Claude Code, Codex or both (Node 18+, python3)
+npx riskrails@3.2.1   # detects Claude Code, Codex or both (Node 18+, Python 3.11+)
 ```
 
 Then, in any project: `/rr-setup` once, and `/rr-build <what you want>` for
@@ -50,9 +50,21 @@ Tuned for **one developer who knows the codebase**, on a Claude Pro, Max or
 Team plan, or a ChatGPT Plus or Pro plan, following the
 [AI-native SDLC playbook](https://claude.com/blog/the-ai-native-sdlc-playbook).
 
-**Version 3.0.1.** The guards have limits: read [Known risks](docs/known-risks.md)
+**Version 3.2.1.** The guards have limits: read [Known risks](docs/known-risks.md)
 before relying on them. What is decided but not built is in [ROADMAP.md](ROADMAP.md).
 
+## Upgrade to 3.1
+
+From 3.0.x: update the home (`npx riskrails@3.2.1`, restart the runtime), then
+in each project `/rr-setup --update` (dry run first, then `--apply`). Schema 10
+becomes **11**: migration `0011` proposes deleting `.ai/policies/risk-tiers.json`
+and `risk-tiers.md`, which `weight.json` and `weight.md` replaced; confirm with
+`--apply --confirm-delete <name>` in a terminal of your own. The update now
+renders `weight.md` from `weight.json` instead of merging it, reads the
+`docs/sdlc/*/TEMPLATE.md` files from the plugin (an unedited project copy is
+offered for deletion), and proposes cleanup of old run logs and stale tasks.
+See [CHANGELOG.md](CHANGELOG.md).
+
 ## Upgrade to 3.0
 
 3.0 renames the plugin from `claude-agentic` to `riskrails`, replaces the risk
@@ -70,7 +82,7 @@ version. Step by step, in this order:
 3. **Update the home** on every machine, for every runtime:
 
    ```bash
-   npx riskrails@3.0.1              # or: npx -y riskrails@latest --yes
+   npx riskrails@3.2.1              # or: npx -y riskrails@latest --yes
    ```
 
    It moves `<home>/claude-agentic/` to `<home>/riskrails/` and leaves a
@@ -85,22 +97,22 @@ version. Step by step, in this order:
    /rr-setup --update               # dry run first; read it; then --apply
    ```
 
-   Four migrations run inside the dry run, in order, before the merge:
+   Migrations `0007` to `0010` (and `0011`, see Upgrade to 3.1) run inside the dry run, in order, before the merge:
    `0007` creates `.ai/policies/weight.json`, carrying over the project's
    edits to its risk-tier table; `0008` renames the managed-block markers and
    the router's routes; `0009` moves `current.json` to `state.json`; `0010`
    creates `.ai/policies/dialog.json` with the dialog on. Edited markdown is
    three-way merged, JSON policies key by key with a confirmation per key;
-   `delete?` proposals are left for you to confirm. The schema becomes 10.
+   `delete?` proposals are left for you to confirm. The schema becomes 10 with a 3.0 plugin, 11 with 3.1.
 5. **Decide two things the migrations cannot.** Keep the dialog (then amend
    constitution C5 as `0010` hints) or set `"enabled": false`; and tune the
    weight table — `domain.modules`, `customer_visible`, `hot_paths`,
    `needs_step`, `irreversible` — then `state.py weight --mirror`.
-6. **Verify**: `/rr-status` shows schema 10 and no task in flight; a
+6. **Verify**: `/rr-status` shows schema 11 and no task in flight; a
    `/rr-build` on a small change runs light and closes on the two facts.
    Commit `.ai/`.
 
-Every machine of a team upgrades the plugin before a project at schema 10 is
+Every machine of a team upgrades the plugin before a project at schema 11 is
 committed; an older plugin refuses such a project. Rollback and the full
 migration table are in [docs/project-update.md](docs/project-update.md); the
 home-side details in [docs/installation.md](docs/installation.md).
@@ -108,12 +120,13 @@ home-side details in [docs/installation.md](docs/installation.md).
 ## Install
 
 ```bash
-npx riskrails@3.0.1                       # detects Claude Code, Codex, or both; proposes the detected plan
-npx riskrails@3.0.1 --target codex        # auto | claude | codex | both
-npx riskrails@3.0.1 --plan max --fable no # pro | team-pro | team-max | max | max20 | balanced-max
-npx riskrails@3.0.1 --codex-plan plus     # plus | pro | balanced-max
-npx riskrails@3.0.1 --context economy     # the plan's compaction window; the context guard also blocks
-npx riskrails@3.0.1 --dry-run             # print what would be written, write nothing
+npx riskrails@3.2.1                       # detects Claude Code, Codex, or both; proposes the detected plan
+npx riskrails@3.2.1 --target codex        # auto | claude | codex | both
+npx riskrails@3.2.1 --plan max --fable no # pro | team-pro | team-max | max | max20 | balanced-max
+npx riskrails@3.2.1 --codex-plan plus     # plus | pro | balanced-max
+npx riskrails@3.2.1 --context economy     # the plan's compaction window; the context guard also blocks
+npx riskrails@3.2.1 --statusline own      # keep your own statusline command (from 3.2.1; default: the plugin's two-line statusline)
+npx riskrails@3.2.1 --dry-run             # print what would be written, write nothing
 npx -y riskrails@latest --yes             # update in place, keeping the recorded plan
 ```
 
@@ -263,7 +276,7 @@ python3 -I -m unittest discover -s tests -p 'test_*.py'      # CI's serial oracl
 AI_E2E=1 python3 -I -m unittest discover -s tests -p test_end_to_end.py
 ```
 
-Fifty-six suites, 979 tests, about 75 seconds in parallel. The guards against JSON fixtures for both runtimes and a
+Fifty-nine suites, 1045 tests, about 75 seconds in parallel. The guards against JSON fixtures for both runtimes and a
 golden of 1 341 recorded decisions, byte for byte, with timed cases that hold
 the hot path under its budget; the state machine, the weight, the batch loop,
 the dialog contract and the documents rule; the compact record and its
@@ -293,6 +306,7 @@ the developer's real `~/.claude` or `~/.codex`.
 | [docs/local-memory.md](docs/local-memory.md) | the compact record: task ids, packages, recall, the pre-push check, migration |
 | [docs/known-risks.md](docs/known-risks.md) | what the guards do not protect against, and what to do about it |
 | [docs/faq.md](docs/faq.md) | why something was blocked, and how to change it |
+| [CHANGELOG.md](CHANGELOG.md) | what changed in each release, and the upgrade notes |
 | [docs/sdlc/README.md](docs/sdlc/README.md) | the spec → plan → build artefacts in a project |
 | [ROADMAP.md](ROADMAP.md) | what is decided but not built; the open rows |
 

package/ai/policies/model-routing.md

@@ -19,16 +19,16 @@ not settle — never for fact collection.
 
 Which model a tier is depends on the plan and the runtime: the installed profile
 decides it, `state.py profile --tier <TIER>` prints it for the runtime you are in,
-and `/ai-status` shows all four. This file names tiers only, so it is true on
+and `/rr-status` shows the plan's budget. This file names tiers only, so it is true on
 every plan.
 
 The main session runs the model the installed profile sets and does the
 implementation itself. Planning, the weight, the test run and the release are
 its work too, not an agent's: `/rr-plan`, `state.py weight`, `state.py verify`,
 `/rr-ship`. Which stages spawn an agent at all
-is decided by `pipeline_profile` in `risk-tiers.json`: in `solo`, T0–T4 run in
-direct mode — nothing on STRONG below T4, a BALANCED review at T2/T3 only when
-a sensor is red, one STRONG review at T4 — and tests run once
+is decided by the mode `state.py weight` gives: light runs direct — no review
+unless `close` reports a red fact — guarded has one BALANCED review, full one
+STRONG review, and nothing runs on STRONG below full — and tests run once
 after the last step, to the end, with every failure fixed as one batch.
 
 **Reading by difficulty.** A lookup — where X is, one route, service id, config
@@ -65,12 +65,12 @@ depends on a local model; if one becomes available it slots in at the FAST tier.
 
 ## EXPERT triggers
 
-1. The task is T6: migration, infrastructure, production architecture.
+1. The task is full and irreversible: migration, infrastructure, production architecture.
 2. STRONG could not settle it: `confidence: uncertain`, or two STRONG results
    contradict each other.
 3. An irreversible design with several viable options — core data model, public
    API or event contract, service split.
-4. The final check of a T6 plan or of a production-incident root cause before a
+4. The final check of a full-and-irreversible plan or of a production-incident root cause before a
    human acts on it.
 
 ## Escalation
@@ -104,7 +104,7 @@ the model `state.py profile --tier STRONG` printed — because a tier alone does
 cost or how much weight to give it. Report the model that **ran**, not the one
 that was requested: a gate may have sent an EXPERT agent down one tier during a
 rate limit, and a Codex agent file may have overridden the spawn-time model. Both
-runtimes expose the current state through `/ai-status`.
+runtimes expose the current state through `/rr-status`.
 
 ## What never gets delegated
 

package/ai/policies/production.md

@@ -7,8 +7,8 @@ is reached by a real customer until you have evidence it is not.
 
 1. Find the callers. `grep`/`rg` for the method, the service id, the route, the
    event name, the template.
-2. Find the tests that pin the current behaviour. If none exist and the tier is
-   T3 or above, write a characterization test **first** — one that passes against
+2. Find the tests that pin the current behaviour. If none exist and the mode is
+   guarded or full, write a characterization test **first** — one that passes against
    the code as it is today.
 3. Check the history for why it looks like this: `git log -L`, `git log -S`,
    `git blame`. A workaround with a ticket number in the message is a constraint,
@@ -37,6 +37,6 @@ named in the release report. "It worked locally" is not observability.
 
 ## Rollback
 
-Every T3+ change states how to undo it. If undoing it is impossible — a data
+Every guarded or full change states how to undo it. If undoing it is impossible — a data
 migration, an external system call, a fiscal record — say so plainly in the
 release report, because that changes who has to approve it.

package/ai/policies/release.md

@@ -29,7 +29,7 @@ It exists so that the human approving the change can see, in one page, what
 changed, what deliberately did not, what was tested, what was reviewed, what
 could go wrong, and how to undo it.
 
-A report that says "no known risks" for a T4 change is a report that was not
+A report that says "no known risks" for a guarded or full change is a report that was not
 written carefully.
 
 ## What blocks a release
@@ -38,7 +38,7 @@ written carefully.
   `focus: security` pass;
 - a new regression in the last `state.py verify` run;
 - a destructive database operation without its own named approval;
-- a T3+ change with no rollback section;
+- a guarded or full change with no rollback section;
 - an unanswered blocking question in the plan.
 
 ## Project specifics

package/ai/policies/review-economy.md

@@ -72,8 +72,8 @@ The ledger is what replaces agent memory. Without it, every pass is pass one.
 ## 3. Findings are fixed as one batch, and re-review is scoped, not repeated
 
 A review returns all its findings at once, and they are fixed at once: one
-`state.py remediate` step whose scope is the finished steps plus what the
-findings name, every BLOCKER and HIGH addressed in it, then the verification
+fix batch (`state.py start --amend` widens the task to the finished steps plus
+what the findings name), every BLOCKER and HIGH addressed in it, then the verification
 command once. Never one fix, one run, one re-review per finding — that is the
 serial loop the measurements below describe, and the remediation of one finding
 is where the next regression comes from.
@@ -98,13 +98,12 @@ shipped), each after a fix batch — before the same stop: the pass past that
 number is the human's. The reviewer's verdict says which closing rule applies:
 `blockers_open` (a BLOCKER) takes the remediation and the scoped re-review;
 `pass_with_findings` (a HIGH, no BLOCKER) takes the remediation and a green
-verification run, no re-review; `pass` closes. `state.py` has no value of its
-own for `pass_with_findings` yet: it is recorded as `blockers_open`, stays so
-after the green run, and the close summary names the labels that run closed.
+verification run, no re-review; `pass` closes. `state.py review --verdict`
+takes all three values.
 
-## 3a. The boundary of a direct-mode review
+## 3a. The boundary of a light or guarded review
 
-Below T5 the review is bounded. Its inputs are the task goal, the diff, the
+In light and guarded the review is bounded. Its inputs are the task goal, the diff, the
 tests the step names, and the project's own fixture corpus and threat model —
 `.ai/policies/safety.md`, the guards' `*-defaults.json`, the test fixtures.
 The reviewer works its whole list inside that corpus; what it may not do is
@@ -117,8 +116,8 @@ it only towards `yes`.
 
 A guard whose input is any shell line is a bottomless well for an unbounded
 reviewer: every pass finds a new input nobody will type, and every fix for one
-is the next pass's target. The boundary is what lets a review end. At T5 and
-T6 there is none — the reviewer's list applies unbounded, as the cost of being
+is the next pass's target. The boundary is what lets a review end. In full
+mode there is none — the reviewer's list applies unbounded, as the cost of being
 wrong there warrants.
 
 ## 4. Split one pass into parallel dimensions, not serial rounds
@@ -174,37 +173,35 @@ script, or run it yourself:
 A review pass spent on a self-contradictory risk register is a pass not spent on
 the code. When a task closes a gap that a register entry calls open, the entry is
 corrected **in the same step as the fix**, not later. When the plan gains a
-remediation, the plan gains a section — at T4 and above the artefact a human
+remediation, the plan gains a section — in guarded and full the artefact a human
 approves must describe the change that exists, and a diff wider than the plan is
 invisible to the path guard, because the file set never changed.
 
 ## 8. The one thing the sensors may replace
 
-At T3 and below, when every sensor in `risk-tiers.json` `required_for_skip` is
-green or explicitly not applicable **on the tree as it is now**, the model
-review is replaced by the sensor set and `state.py review-gate` records
-`review_status: skipped_green`. This is the intent's decision 6, and it is an
-exception to the rule below, written here so the two do not contradict each
-other.
+In light mode, when the two facts `close` measures are green **on the tree as
+it is now** — a green whole-suite `verify` and every changed file inside the
+task's files — the model review is replaced by the sensor set and the task
+closes without one. This is the intent's decision 6, and it is an exception to
+the rule below, written here so the two do not contradict each other.
 
 It is narrow on purpose. The skip requires that the suite passed on this exact
-tree, that the tests the plan named **fail without the change** (`bite` — a
-green suite that never reaches the diff is not evidence), that the diff is
-inside its budget — the budget is advisory for the tier, never for the skip —
-and that the tier re-scored from the real diff is still T3 or lower. A missing
-linter is not green: `unavailable` keeps the review, and only a human writing
-`lint_command: none` says the project has no linter. No
-sensor writes `skipped_green` by asserting it — `review-gate` reaches it from
-measurements, and `state.py set review_status skipped_green` is refused.
-
-From T4 the review always runs. What the sensors change there is where it
-starts: their rows are in the ledger, CONFIRMED, before the reviewer plans its
-work.
+tree, and that the tests the plan named **fail without the change** (`bite` — a
+green suite that never reaches the diff is not evidence). The mode is the one
+re-scored from the real diff: a diff that raises it to guarded or full keeps the
+review. A missing linter is not green: `unavailable` keeps the review, and only
+a human writing `lint_command: none` says the project has no linter. No
+sensor skips the review by asserting it — `close` reaches it from
+measurements.
+
+In guarded and full the review always runs. What the sensors change there is
+where it starts: their rows are in the ledger, CONFIRMED, before the reviewer
+plans its work.
 
 ## What this policy will not trade away
 
-- No review stage the tier requires is skipped, shortened, or merged — except
-  the T2/T3 model review, and only under §8's measured conditions.
+- No review stage the mode requires is skipped, shortened, or merged — except
+  the light-mode model review, and only under §8's measured conditions.
 - No reviewer is moved to a cheaper model to go faster. Narrow the surface, never
   the mind.
 - A blocker still returns to implementation, however late it arrives. Past the

package/bin/riskrails.js

@@ -3,7 +3,7 @@
 //   npx riskrails [--target auto|claude|codex|both] [--plan pro|team-pro|team-max|max|max20|balanced-max]
 //                 [--fable auto|yes|no] [--codex-plan plus|pro|balanced-max] [--dry-run]
 //                 [--context default|economy] [--statusline-context yes|no]
-//                 [--home DIR] [--codex-home DIR] [--yes] [--version]
+//                 [--statusline riskrails|own] [--home DIR] [--codex-home DIR] [--yes] [--version]
 // --target defaults to auto: each runtime is installed only if its executable is on PATH.
 // --plan   Claude only: pro, team-pro (Team Standard seat), team-max (Team Premium seat), max
 //          or max20 (Max 20x: max's settings, larger budgets). Defaults to auto-detect from
@@ -22,9 +22,17 @@
 //          Max, 300 000 on Pro) and the guard also holds a prompt back past 120% of it.
 //          Without economy, an autoCompactWindow equal to the plan's is removed; any other
 //          value is the user's and stays. Recorded in riskrails/profile.json as `context`.
-// --statusline-context  yes (default) shows the model and the context use in the
-//          statusline: a line before the user's own in Claude Code, `model-with-reasoning`
-//          and `context-used` in Codex's [tui] status_line. no adds nothing and removes nothing.
+// --statusline-context  yes (default) shows the model, effort and context use in the
+//          statusline: the first line in Claude Code (`--context`), `model-with-reasoning`
+//          and `context-used` in Codex's [tui] status_line. no leaves that line out (Claude:
+//          removes `--context`; Codex: adds nothing and removes nothing); not recorded.
+// --statusline  Claude only. riskrails (default) writes the plugin's statusline on every
+//          install and update: the model, effort and context line and the prompt line
+//          (user@host:cwd | branch | 5h/7d limits | cost), over a statusline command of your
+//          own (the old command is printed and kept in riskrails/statusline.json). own keeps
+//          your command behind the quota check, as before 3.2, and brings a replaced one
+//          back. The choice is recorded in riskrails/statusline.json; a later install
+//          without --statusline keeps it.
 // --home / --codex-home  the runtime homes (default ~/.claude and ~/.codex; the environment
 //          variables CLAUDE_DIR and CODEX_DIR mean the same). Naming exactly one of them under
 //          --target auto installs that runtime alone.
@@ -56,7 +64,7 @@ let CODEX_DIR = env.CODEX_DIR || path.join(os.homedir(), '.codex');
 const HOME = env.HOME || os.homedir();
 let PLAN = '', FABLE = 'auto', DRY = false, TARGET = 'auto', PLAN_GIVEN = false;
 let CODEX_PLAN = '', CODEX_PLAN_GIVEN = false, YES = false;
-let CONTEXT = 'default', STATUSLINE_CONTEXT = 'yes';
+let CONTEXT = 'default', STATUSLINE_CONTEXT = 'yes', STATUSLINE = 'riskrails', STATUSLINE_GIVEN = false;
 
 function version() {
   try { return JSON.parse(fs.readFileSync(path.join(SRC, 'package.json'), 'utf8')).version || 'unknown'; }
@@ -88,6 +96,7 @@ function usage() {
       case '--codex-plan': CODEX_PLAN = take(); CODEX_PLAN_GIVEN = true; break;
       case '--context': CONTEXT = take(); break;
       case '--statusline-context': STATUSLINE_CONTEXT = take(); break;
+      case '--statusline': STATUSLINE = take(); STATUSLINE_GIVEN = true; break;
       case '--home': CLAUDE_DIR = path.resolve(take()); CLAUDE_DIR_GIVEN = true; break;
       case '--codex-home': CODEX_DIR = path.resolve(take()); CODEX_DIR_GIVEN = true; break;
       case '--dry-run': DRY = true; break;
@@ -105,6 +114,7 @@ if (!['default', 'economy'].includes(CONTEXT)) die(`--context must be default|ec
 if (!['yes', 'no'].includes(STATUSLINE_CONTEXT)) {
   die(`--statusline-context must be yes|no (got '${STATUSLINE_CONTEXT}')`, 2);
 }
+if (!['riskrails', 'own'].includes(STATUSLINE)) die(`--statusline must be riskrails|own (got '${STATUSLINE}')`, 2);
 const major = Number(process.versions.node.split('.')[0]);
 if (major < 18) die('riskrails needs Node 18 or newer (this is ' + process.versions.node + ')', 1);
 
@@ -117,6 +127,25 @@ function onPath(cmd) {
   return false;
 }
 if (!onPath('python3')) die('python3 is required', 1);
+{
+  const pv = spawnSync('python3', ['-c', "import sys; print('%d.%d' % sys.version_info[:2])"],
+    { env, encoding: 'utf8', timeout: 10000, stdio: ['ignore', 'pipe', 'pipe'] });
+  const lines = (pv.stdout || '').split('\n').map((l) => l.trim()).filter(Boolean);
+  const found = (lines.length ? lines[lines.length - 1] : '').match(/^(\d+)\.(\d+)$/) || [];
+  if (!found.length || Number(found[1]) < 3 || (Number(found[1]) === 3 && Number(found[2]) < 11)) {
+    let why = '';
+    if (!found.length) {
+      const errLine = ((pv.stderr || '').split('\n').map((l) => l.trim()).find(Boolean)) || '';
+      const parts = [];
+      if (pv.error) parts.push(`error ${pv.error.code || pv.error.message}`);
+      if (pv.status !== null && pv.status !== undefined && pv.status !== 0) parts.push(`exit status ${pv.status}`);
+      if (pv.signal) parts.push(`signal ${pv.signal}`);
+      if (errLine) parts.push(`stderr: ${errLine}`);
+      why = parts.length ? ` - ${parts.join(', ')}` : ' - no version on stdout';
+    }
+    die(`python3 3.11 or newer is required (found ${found.length ? found[0] : 'unknown'}${why})`, 1);
+  }
+}
 
 // ------------------------------------------------------------------ helpers
 const exists = (p) => fs.existsSync(p);                       // follows symlinks, as [ -e ]
@@ -553,11 +582,34 @@ function shSplit(s) {                                            // shlex.split,
   return words;
 }
 
-// The wrapper is `<PREFIX> [--context] [--then '<the user's command>']`; --context
-// (--statusline-context yes) adds a line with the model and the context use.
+// The wrapper is `<PREFIX> [--context] [--line] [--then '<the user's command>']`; --context
+// (--statusline-context yes) adds a line with the model, effort and context use, --line
+// (--statusline riskrails, the default) the plugin's prompt line. With riskrails the
+// command is exactly `<PREFIX> [--context] --line`: a command of the user's is replaced
+// (printed, and kept in <home>/riskrails/statusline.json: the dated settings.json backup is
+// replaced by a second run the same day); with own it stays behind --then, and own brings
+// a replaced command back. The mode is recorded there too: a run without --statusline
+// keeps the recorded one, so the update notice's `--yes` does not undo own.
 function statuslineGate(file, gate, mode) {
   const PREFIX = '"$HOME/.claude/hooks/runtime-gate.py" statusline';
-  const WANT = STATUSLINE_CONTEXT === 'yes' ? `${PREFIX} --context` : PREFIX;
+  const RECORD = path.join(path.dirname(file), 'riskrails', 'statusline.json');
+  let record = {};
+  try { const r = JSON.parse(read(RECORD)); if (isObj(r)) record = r; } catch (e) { /* none yet */ }
+  const MODE = STATUSLINE_GIVEN ? STATUSLINE : (['riskrails', 'own'].includes(record.mode) ? record.mode : 'riskrails');
+  const OWN = MODE === 'own';
+  const kept = typeof record.replaced === 'string' && record.replaced.trim() ? record.replaced : '';
+  let saved = '';                                    // a command of the user's this run replaces
+  const persist = () => {
+    if (mode === 'dry') return;
+    const next = Object.assign({}, record, { mode: MODE },
+      saved ? { replaced: saved, replaced_at: BACKUP_DATE } : {});
+    if (JSON.stringify(next) === JSON.stringify(record)) return;
+    mkdirp(path.dirname(RECORD));
+    fs.writeFileSync(RECORD + '.tmp', asciiJSON(next) + '\n');
+    fs.renameSync(RECORD + '.tmp', RECORD);
+  };
+  const CTX = STATUSLINE_CONTEXT === 'yes' ? `${PREFIX} --context` : PREFIX;
+  const WANT = OWN ? CTX : `${CTX} --line`;
   const OLD_PREFIX = '"$HOME/.claude/hooks/fable-gate.py" statusline';
   let settings = {};
   if (exists(file)) {
@@ -570,26 +622,64 @@ function statuslineGate(file, gate, mode) {
     line.command = PREFIX + cmd.slice(OLD_PREFIX.length);
     ours = true; gate = 'moved';
   }
-  // What follows the prefix and an optional --context: the user's --then, byte for byte.
-  const tail = () => line.command.slice(PREFIX.length).trim().replace(/^--context(\s+|$)/, '');
+  // What follows the prefix and its --context/--line flags: the user's --then, byte for byte.
+  const tail = () => line.command.slice(PREFIX.length).trim().replace(/^((--context|--line)(\s+|$))+/, '');
+  // The user's own command inside a `--then '<command>'` tail, for the replaced message.
+  const wrapped = (rest) => {
+    // an unparsable tail is not recorded: an earlier good `replaced` stays, the dated backup holds the line
+    try { const parts = shSplit(rest); return parts.length > 1 ? parts[1] : ''; } catch (e) { return ''; }
+  };
   const shown = STATUSLINE_CONTEXT === 'yes' ? ' with the model and the context use' : '';
+  const plugin = STATUSLINE_CONTEXT === 'yes'
+    ? 'the model, effort and context line and the prompt line' : 'the prompt line';
+  const backup = '--statusline own brings it back';
   let action = null;
   if (gate === 'moved') {
     const rest = tail();
-    line.command = rest ? `${WANT} ${rest}` : WANT;
-    action = 'moved the fable-gate statusline wrapper to runtime-gate (your command is unchanged)';
+    if (OWN) {
+      line.command = rest ? `${WANT} ${rest}` : WANT;
+      action = 'moved the fable-gate statusline wrapper to runtime-gate (your command is unchanged)';
+    } else {
+      line.command = WANT;
+      saved = rest.startsWith('--then') ? wrapped(rest) : '';
+      action = `moved the fable-gate statusline wrapper to runtime-gate, with the plugin's statusline (${plugin})` +
+        (saved ? `; replaced your statusline command: ${saved} (${backup})` : '');
+    }
   } else if (gate === 'on') {
     if (ours) {
       const rest = tail();
-      const want = rest ? `${WANT} ${rest}` : WANT;
-      if (want === cmd) return ['statusline: already records the quota'];
+      const hadLine = /(^|\s)--line(\s|$)/.test(cmd.slice(PREFIX.length));
+      // one-shot: only the run that switches to own restores; once own is recorded, a bare line stays bare
+      const restore = OWN && !rest && kept && record.mode !== 'own';
+      saved = !OWN && rest.startsWith('--then') ? wrapped(rest) : '';
+      const want = restore ? `${WANT} --then ${shQuote(kept)}` : OWN && rest ? `${WANT} ${rest}` : WANT;
+      if (want === cmd) {
+        persist();
+        return [OWN ? 'statusline: already records the quota' : "statusline: already the plugin's statusline"];
+      }
       line.command = want;
-      action = STATUSLINE_CONTEXT === 'yes'
-        ? 'added the model and the context use to the statusline wrapper (your command is unchanged)'
-        : 'removed the model and context line from the statusline wrapper (your command is unchanged)';
+      if (saved) {
+        action = `replaced your statusline command with the plugin's statusline (${plugin}): ${saved} (${backup})`;
+      } else if (restore) {
+        action = `restored your statusline command behind the quota check${shown}: ${kept}`;
+      } else if (!OWN) {
+        action = `set the plugin's statusline (${plugin})`;
+      } else if (hadLine) {
+        action = rest ? `removed the plugin's prompt line; your command runs behind the quota check${shown}`
+          : `removed the plugin's prompt line; no command of yours to restore, so the quota check runs${shown} alone`;
+      } else {
+        action = STATUSLINE_CONTEXT === 'yes'
+          ? 'added the model and the context use to the statusline wrapper (your command is unchanged)'
+          : 'removed the model and context line from the statusline wrapper (your command is unchanged)';
+      }
     } else if (line === undefined || line === null) {
       settings.statusLine = { type: 'command', command: WANT };
-      action = `added a statusline that records the quota (and the Fable weekly limit)${shown}`;
+      action = OWN ? `added a statusline that records the quota (and the Fable weekly limit)${shown}`
+        : `added the plugin's statusline (${plugin}), which also records the quota`;
+    } else if (!OWN && isObj(line) && line.type === 'command' && typeof cmd === 'string' && cmd.trim()) {
+      line.command = WANT;
+      saved = cmd;
+      action = `replaced your statusline command with the plugin's statusline (${plugin}): ${cmd} (${backup})`;
     } else if (isObj(line) && line.type === 'command' && typeof cmd === 'string' && cmd.trim()) {
       line.command = `${WANT} --then ${shQuote(cmd)}`;
       action = `wrapped your statusline command with the quota check${shown} (its output is unchanged)`;
@@ -609,6 +699,7 @@ function statuslineGate(file, gate, mode) {
     }
   }
   if (mode === 'dry') return ['statusline: would have ' + action];
+  persist();                                         // the replaced command first: never lost
   fs.writeFileSync(file + '.tmp', asciiJSON(settings) + '\n');
   fs.renameSync(file + '.tmp', file);
   return ['statusline: ' + action];
@@ -1205,9 +1296,9 @@ function claudeSummary() {
     'Restart Claude Code, then:',
     '  /config        model and effort match the profile',
     `  /hooks         lists cap-large-read, ai-guard, project-scaffold and context-guard, plus runtime-gate on PreToolUse, PostToolUse, SubagentStart, SubagentStop${C.GATE === 'on' ? ' and StopFailure' : ''}`,
-    '  /skills        lists ai-init, ai-audit, ai-task, ai-status, project-init, sdlc-*, usage-report',
-    '  /ai-init       in a project, to survey it and build .ai/',
-    '  /project-update in a project that already has .ai/ or docs/sdlc/, to pull in these rules',
+    '  /skills        lists rr-setup, rr-spec, rr-plan, rr-build, rr-build-all, rr-review, rr-ship, rr-status',
+    '  /rr-setup      in a project, to survey it and build .ai/',
+    '  /rr-setup --update in a project that already has .ai/ or docs/sdlc/, to pull in these rules',
   ];
   out(lines.join('\n'));
 }
@@ -1411,8 +1502,8 @@ function codexSummary() {
     '',
     'Restart Codex, then:',
     '  /hooks         review and trust the guard, gate and context hooks — until you do, Codex skips them',
-    '  /skills        lists ai-init, ai-audit, ai-task, ai-status, project-init, sdlc-*, usage-report',
-    '  /ai-init       in a project, to survey it and build .ai/',
+    '  /skills        lists rr-setup, rr-spec, rr-plan, rr-build, rr-build-all, rr-review, rr-ship, rr-status',
+    '  /rr-setup      in a project, to survey it and build .ai/',
     '',
     `Your previous default model was replaced. backups/${BACKUP_DATE}/config.toml holds the old one.`,
   ].join('\n'));

package/hooks/ai-path-guard-defaults.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "Shipped defaults for ai-path-guard. Do not edit this file; a project overrides it in .ai/policies/path-guard.json (patterns are unioned, allow wins over every other list). Patterns are POSIX extended regular expressions matched against the absolute path. deny_patterns are secrets: refused for read and write. protected_config_patterns are always on and refuse writes: the task's state and journal, task.md, the compact record (.ai/memory/, .ai/local/memory/), and the guards' own configuration, engine and state.py under .claude/ or .codex/, in a project or in the user's home, and the riskrails plugin's cache folder, which carries the same code on the plugin route. A project's dependency_instruction_patterns, from before 3.4, are read as deny_patterns. task_protected_patterns are on only while a task is in flight (.ai/state/state.json, or else current.json, exists and has not reached \"done\"): the runtime's settings, Claude's record of installed plugins and the pipeline's policies, so a run cannot change the rules it is being judged by. Reading anything but a secret is allowed.",
+  "_comment": "Shipped defaults for ai-path-guard. Do not edit this file; a project overrides it in .ai/policies/path-guard.json (patterns are unioned, allow wins over every other list). Patterns are POSIX extended regular expressions matched against the absolute path. deny_patterns are secrets: refused for read and write. protected_config_patterns are always on and refuse writes: the task's state and journal, task.md, the compact record (.ai/memory/, .ai/local/memory/), and the guards' own configuration, engine and state.py under .claude/ or .codex/, in a project or in the user's home, and the riskrails plugin's cache folder, which carries the same code on the plugin route. Also the installer's statusline record (.claude/riskrails/statusline.json), which keeps the statusline command it replaced. A project's dependency_instruction_patterns, from before 3.4, are read as deny_patterns. task_protected_patterns are on only while a task is in flight (.ai/state/state.json, or else current.json, exists and has not reached \"done\"): the runtime's settings, Claude's record of installed plugins and the pipeline's policies, so a run cannot change the rules it is being judged by. Reading anything but a secret is allowed.",
   "deny_patterns": [
     "(^|/)\\.env$",
     "(^|/)\\.env\\.(local|prod|production|staging|live)$",
@@ -38,7 +38,8 @@
     "(^|/)\\.(claude|codex)/hooks/runtime-gate\\.py$",
     "(^|/)\\.(claude|codex)/hooks/(guard|lib)/",
     "(^|/)\\.(claude|codex)/skills/ai-task/",
-    "(^|/)\\.(claude|codex)/plugins/cache/[^/]+/riskrails(/|$)"
+    "(^|/)\\.(claude|codex)/plugins/cache/[^/]+/riskrails(/|$)",
+    "(^|/)\\.claude/(riskrails|claude-agentic)/statusline\\.json$"
   ],
   "task_protected_patterns": [
     "(^|/)\\.claude/settings[^/]*\\.json$",