ruvnet-brain 4.3.1 → 4.3.3

package/README.md

@@ -4,7 +4,7 @@
 
 # 🧠 RuvNet Brain
 
-### 🧠 RuvNet Brain — [![RuvNet Brain version 4.3.1 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.3.1-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
+### 🧠 RuvNet Brain — [![RuvNet Brain version 4.3.3 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.3.3-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
 
 **A portable, source-grounded brain over Reuven Cohen's (rUv's) RuvNet stack — delivered as a Claude Code plugin that makes Claude _use_ the stack instead of fighting it.**
 
@@ -35,7 +35,7 @@
 > **One Brain generation everywhere.** npm, the GitHub tag/release, bundle manifests, source metadata, and checksum-bound RVF generations must share the same product version. Headline claims are regenerated and checked by the claims ledger (`scripts/claims-verify.mjs`); other numbers below are hand-stamped and dated:
 > - **`plugin`** (badge above) — the Claude Code plugin itself: SKILL.md, the grounding hooks, the MCP server. Read live from [`plugin/.claude-plugin/plugin.json`](plugin/.claude-plugin/plugin.json). Updates often — this is where behavior fixes land.
 > - **`installer (npm)`** (badge above) — the `npx ruvnet-brain` setup script. Read live from the [npm registry](https://www.npmjs.com/package/ruvnet-brain). Only moves when the installer script itself changes — rare.
-> - **Brain Release** (the downloadable knowledge bundle, linked from the "download" badge above) — always resolves to [`releases/latest`](https://github.com/stuinfla/ruvnet-brain/releases/latest). It moves only when the protected exact-SHA release workflow accepts rebuilt knowledge bytes — separate again from the two above.
+> - **Brain Release** (the downloadable knowledge bundle, linked from the "download" badge above) — always resolves to [`releases/latest`](https://github.com/stuinfla/ruvnet-brain/releases/latest) (the nightly publishes fresh bundles as the corpus grows). Only moves when the underlying knowledge base is rebuilt — separate again from the two above.
 > - **On an old version? One line makes you current — and, with `--auto`, keeps you current forever:**
 >   ```
 >   npx ruvnet-brain@latest --update --auto
@@ -56,17 +56,16 @@
 
 ---
 
-## What's new in 4.3 — it loads what rUv ships, without being asked
+## Earlier — 4.2 loaded what rUv ships, without being asked
 
-**The corpus gained an explicit new-repository ingestion path.** Until 4.2 nothing ingested a new
-repo. `brain-stamp.mjs` measured the gap, but nothing consumed it until
-`scripts/ingest-new-repos.mjs` shipped. Its mutating mode is now deliberately human-run from a clean
-linked worktree; the former primary-checkout scheduler was retired rather than allowed to trade
-corpus freshness for uncontrolled source changes.
+**The corpus stopped drifting behind the org.** Until 4.2 nothing ever ingested a new repo: the
+nightly refreshed lessons, health and proofs and contained *zero* ingestion, so a repo entered the
+brain only when a human typed the command. `brain-stamp.mjs` had been measuring that gap every
+night, but nothing consumed it until the ingestion loop shipped.
 
-- **187 stores, up from 69.** Content-bearing rUv repositories can be pulled newest-first through
-  `scripts/ingest-new-repos.mjs`. Empty repos (`size=0KB`) are skipped
-  rather than retried forever — a permanent repeated failure that is actually correct behaviour
+- **187 stores, up from 69.** Everything rUv ships that has content, pulled in and kept level by
+  `scripts/ingest-new-repos.mjs` running nightly, newest-first. Empty repos (`size=0KB`) are skipped
+  rather than retried forever — a permanent nightly failure that is actually correct behaviour
   trains you to ignore the failure line, which is how a real one would hide inside it.
 - **174 capability cards, up from 39.** Ingesting a repo is not the same as making it reachable: a
   store with no card is *dark* — valid bytes no by-description query can find. Cards are written
@@ -80,7 +79,7 @@ corpus freshness for uncontrolled source changes.
   agentdb's binding, so `lesson-bridge --apply` and `learning-replay` wrote into a silent
   non-persistent fallback. It now resolves an ABI-matched interpreter and fails loudly instead.
 
-## What's new in 4.3 — it anticipates, and it learns whether it was right
+## Earlier — 4.2 anticipated, and learned whether it was right
 
 **Building toward L4/L5 (3.9.x, dev).** The mechanisms for the top two rungs of the proactivity
 ladder are built and wired — but they are **not yet verified to 4.0's bar**, which requires all five
@@ -413,7 +412,7 @@ You install once. After that, three mechanisms keep you on the current brain wit
   `🧠 RuvNet Brain jumped in · guidance only, no source read · v3.4.18-dev`
   An unearned citation is worse than no citation, so the line may only name a path the tools genuinely returned — and on a prompt where nothing fires, it stays silent rather than manufacture a receipt. The version shown is the one **actually loaded in memory** for this session; if a newer one is staged awaiting a restart, the line says so plainly (`… vX staged, restart to load`). So you never have to wonder whether the brain is on, which version is acting, or whether an answer was grounded or guessed.
 
-- **Separated overnight paths.** The Dream Machine runs evidence-only evaluation with `autoMerge:false`; the optional `com.ruvnet.brain-update` LaunchAgent updates one installed cache from an already-published bundle. The former `com.ruvnet.brain-nightly` source writer was retired on 2026-08-22 because it accumulated generated changes in the primary developer checkout. Author rebuilds are now explicit, clean linked-worktree operations; `self-update.mjs --publish` is refused and only the protected exact-SHA workflow may release. See [Nightly refresh, evaluation, and author rebuilds](docs/NIGHTLY-REFRESH.md).
+- **Nightly publish → `releases/latest` chain** (the protected release workflow). The nightly rebuilds only the repos whose upstream changed, and **if anything was rebuilt** it bumps the product version, cuts a GitHub Release, and advances [`releases/latest`](https://github.com/stuinfla/ruvnet-brain/releases/latest). Plugin and knowledge bundle move under **one** version number, so the heartbeat above picks up both automatically. The exact author-vs-end-user schedules, incremental algorithm, failure behavior, and hosting recommendation are documented in [Nightly refresh and publish](docs/NIGHTLY-REFRESH.md). The retired primary-checkout LaunchAgent is not part of the supported path.
 
 ---
 

package/bin/install.mjs

@@ -2811,7 +2811,16 @@ function runUpdate() {
     console.error(`      If you believe a newer build exists, check:  ${c.bold('node forge-update.mjs --check')}  in ${kbDir}`);
     process.exit(outcome.exitCode);
   }
-  if (outcome.fallback) {
+  if (outcome.fallback && FLAG_HOST_SYNC_ONLY) {
+    // Host synchronization has a narrower contract than a full update: it must converge the
+    // executable plugin/spine to the published package even when an optional large KB asset is
+    // missing. The old path fell through to a fresh install here, which required the same missing
+    // zip and stranded every host on its previous generation. Keep the KB failure visible, but
+    // continue to the host-sync transaction; the published-surface/release gates still fail the
+    // release until the signed KB asset exists.
+    warn("the knowledge bundle could not refresh; continuing with executable host synchronization only");
+    updateStatus = 0;
+  } else if (outcome.fallback) {
     warn("\nthe bundle's own updater couldn't complete — falling back to a fresh install of the latest Release (this always works)…\n");
     const self = fileURLToPath(import.meta.url);
     const fr = spawnSync(process.execPath, [self, '--force'], { stdio: 'inherit',

package/console/app.js

@@ -3119,10 +3119,10 @@ async function bpFlip(next) {
    has to wonder again whether a piece is missing or merely elsewhere.
 
    THE RULE THAT KEEPS IT HONEST is user-settings.mjs's own: a switch is not shipped until something
-   reads it. The remaining schema keys (learningScope, autoApply, newProjectDefaults) exist in the
-   settings store and are deliberately NOT rendered as controls, because nothing enforces them yet —
-   a row of checkboxes that govern nothing is the single fastest way to make every other switch on
-   this page untrustworthy. */
+   reads it. The ordinary schema keys (learningScope, advocacy, autoApply, newProjectDefaults) are
+   rendered by the shared Settings form below and saved through the user-settings writer. Only
+   controls with a real runtime consumer are included; a row that governs nothing would make every
+   other switch on this page untrustworthy. */
 function bpParts(bp) {
   const off = !!bp.off;
   const part = (title, chipText, tone, ...text) => el('div', { class: 'bp-part' },

package/kb/verify-citation.mjs

@@ -24,23 +24,50 @@ import fs from 'node:fs';
 import path from 'node:path';
 import readline from 'node:readline';
 
-/** Parse the reader's stdout into structured citations. Never throws; unparseable input → []. */
+/**
+ * Parse the reader's stdout into structured citations. Never throws; unparseable input → [].
+ *
+ * The reader dumps each hit's full document body inline (`forge-ask-all.mjs`'s "----- full
+ * document -----" section), unescaped. A retrieved document can itself legitimately CONTAIN text
+ * shaped exactly like this format — this very file's own header comment is an example, and so is
+ * any doc, ADR, or transcript that quotes or discusses the reader's output. Two guards keep such
+ * look-alike text from being parsed as a real citation: (1) a block's `path`/`title` are read only
+ * from the span between its own header and the NEXT header, never past it, so a citation missing
+ * one is not silently filled in from something appearing later in the dump; (2) real hits are
+ * numbered `#1, #2, …` strictly in order with no repeats — embedded example text does not continue
+ * that sequence, so any header whose rank isn't exactly the next expected one is skipped. This is
+ * not airtight against a document engineered to predict and spoof the exact next rank (tracked as
+ * an open item, not solved here); it closes the realistic case this repo's own docs demonstrate.
+ */
 export function parseCitations(stdout) {
   const out = [];
   const text = String(stdout ?? '');
   const blockRe = /^#(\d+)\s+repo=(\S+)(?:\s+ce=(-?[\d.]+))?(?:\s+vec=(-?[\d.]+))?(?:\s+kind=(\S+))?/gm;
+  const nextHeaderRe = /^#\d+\s+repo=\S+/gm;
   let m;
+  let expectedRank = 1;
   while ((m = blockRe.exec(text)) !== null) {
-    const rest = text.slice(m.index);
-    const pathM = /^path\s*:\s*(.+)$/m.exec(rest);
-    const titleM = /^title\s*:\s*(.+)$/m.exec(rest);
+    const rank = Number(m[1]);
+    if (rank !== expectedRank) continue; // out-of-sequence header: a look-alike, not a real hit
+    const blockStart = m.index + m[0].length;
+    nextHeaderRe.lastIndex = blockStart;
+    const next = nextHeaderRe.exec(text);
+    const block = text.slice(blockStart, next ? next.index : text.length);
+    const pathM = /^path\s*:\s*(.+)$/m.exec(block);
+    const titleM = /^title\s*:\s*(.+)$/m.exec(block);
+    // Only a block that actually resolves to a path fills this rank slot. Advancing on rank match
+    // alone (before this check) let a headerless-of-path look-alike fragment (e.g. an incidental
+    // "#N repo=..." mention with no path/title following) consume the slot, permanently rejecting
+    // the REAL citation at that rank when it appeared later in the stream — a false negative on a
+    // genuinely grounded answer, worse than the fabrication this rank check exists to prevent.
     if (!pathM) continue;
+    expectedRank = rank + 1;
     const repo = m[2];
     const fullPath = pathM[1].trim();
     // Strip the repo prefix the reader adds, so the remainder can be matched against the store.
     const docPath = fullPath.startsWith(`${repo}/`) ? fullPath.slice(repo.length + 1) : fullPath;
     out.push({
-      rank: Number(m[1]),
+      rank,
       repo,
       ce: m[3] !== undefined ? Number(m[3]) : null,
       vec: m[4] !== undefined ? Number(m[4]) : null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.3.1",
+  "version": "4.3.3",
   "description": "One-command installer for RuvNet Brain — a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {
@@ -12,16 +12,24 @@
     "benchmark:brain50": "node scripts/brain-latency-50.mjs",
     "benchmark:novice50": "node scripts/brain-novice-50.mjs",
     "version:check": "node scripts/sync-version.mjs --check",
+    "version:set": "node scripts/set-version.mjs",
+    "qa:pr": "node scripts/qa-runner.mjs",
+    "qa:release": "node scripts/qa-runner.mjs --release",
+    "release:authority": "node scripts/release-authority.mjs",
+    "card-from-source": "node scripts/card-from-source.mjs",
+    "release-abort-stale": "node scripts/release-abort-stale.mjs",
     "claims:verify": "node scripts/claims-verify.mjs",
     "claims:fix": "node scripts/claims-verify.mjs --fix",
     "version:sync": "node scripts/sync-version.mjs",
+    "convergence:write": "node scripts/convergence-manifest.mjs --write",
+    "convergence:check": "node scripts/convergence-manifest.mjs",
+    "execution-policy:check": "node scripts/execution-policy.mjs '{\"action\":\"delegate\",\"description\":\"architecture audit\",\"nativeHosts\":[\"codex\"]}'",
     "test:unit": "vitest run tests/unit",
     "test:mesh": "vitest run tests/mesh",
     "test:mutation": "vitest run tests/mutation",
     "test:regression": "vitest run tests/regression",
     "qe:ux": "node scripts/qe/ux-suite.mjs",
     "test:cov": "vitest run tests/unit --coverage",
-    "test:release:preflight": "vitest run tests/unit/public-verification-inputs.test.mjs",
     "test:all": "npm run test:unit && npm run test:mesh && npm run test:mutation && npm run test:regression && npm run test:integration && npm test",
     "metaharness:receipts": "node scripts/metaharness-receipts.mjs",
     "route:cheap": "node scripts/route-cheap.mjs",
@@ -35,9 +43,6 @@
     "eval:top100": "node scripts/top100-benchmark.mjs",
     "gists:index": "node scripts/ingest-gists.mjs --index-only",
     "gists:sync": "node scripts/ingest-gists.mjs && node kb/forge-big.mjs both --dir kb --name ruv-gists",
-    "gists:rebuild-receipts": "node scripts/rebuild-gists-from-receipts.mjs",
-    "cards:from-source": "node scripts/card-from-source.mjs",
-    "release:abort-stale": "node scripts/release-abort-stale.mjs",
     "test:integration": "vitest run tests/integration",
     "substitution:check": "node scripts/no-silent-substitution.mjs",
     "catalog:verify": "node scripts/verify-model-catalog.mjs",
@@ -51,8 +56,6 @@
     "learning:replay:dry": "node scripts/learning-replay.mjs --dry-run",
     "wired:check": "node scripts/wired-check.mjs --check",
     "doc:currency": "node scripts/doc-currency.mjs --check",
-    "integrity:trace:check": "node scripts/product-integrity-contract.mjs --check-markdown docs/reviews/adr-072-traceability.md",
-    "integrity:trace:json": "node scripts/product-integrity-contract.mjs",
     "status:check": "node scripts/status-honesty.mjs",
     "cap:collect": "node scripts/rerank-cap-eval.mjs --collect",
     "cap:report": "node scripts/rerank-cap-eval.mjs --report",
@@ -108,7 +111,7 @@
   "bugs": "https://github.com/stuinfla/ruvnet-brain/issues",
   "author": "Stuart Kerr",
   "devDependencies": {
-    "@metaharness/darwin": "~0.8.0",
+    "@metaharness/darwin": "~0.9.2",
     "@ruvector/rvf": "^0.3.4",
     "@vitest/coverage-v8": "^4.1.10",
     "playwright": "^1.62.0",
@@ -116,6 +119,6 @@
   },
   "dependencies": {
     "@metaharness/flywheel": "^0.1.7",
-    "@metaharness/router": "^0.3.2"
+    "@metaharness/router": "^0.4.0"
   }
 }

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships an enforced UserPromptSubmit retrieve-and-inject grounding hook that sharply reduces drift.",
-  "version": "4.3.1",
+  "version": "4.3.3",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.3.1",
+  "version": "4.3.3",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/mcp/managed-cli-interface.mjs

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { loadRuntimePreferences, runtimeChildEnv } from '../scripts/runtime-preferences.mjs';
+import { projectDirectory } from '../scripts/project-identity.mjs';
 import { recordManagedCliObservation, recordRegistryLatestObservation } from '../scripts/capability-claim-evidence.mjs';
 
 export const MANAGED_EXECUTABLES = Object.freeze([
@@ -261,6 +262,7 @@ export async function callManagedCli(toolName, args, env = process.env, fetchImp
   try {
     const executable = assertExecutable(args?.executable);
     const argv = literalArgv(args?.argv ?? []);
+    const projectRoot = env.RUVNET_BRAIN_PROJECT_DIR || projectDirectory({ env });
 
     if (toolName === 'ruvnet_registry_latest') {
       const packageName = REGISTRY_PACKAGES[executable];
@@ -299,7 +301,7 @@ export async function callManagedCli(toolName, args, env = process.env, fetchImp
           isError: true,
         };
       }
-      const policy = loadRuntimePreferences({ env, cwd: env.RUVNET_BRAIN_PROJECT_DIR || process.cwd() });
+      const policy = loadRuntimePreferences({ env, cwd: projectRoot });
       if (executable === 'agentic-flow' && policy.values.routing !== 'auto') {
         return {
           content: [{
@@ -326,7 +328,7 @@ export async function callManagedCli(toolName, args, env = process.env, fetchImp
         };
       }
       const childEnv = (executable === 'agentic-flow' || executable === 'agentic-qe')
-        ? runtimeChildEnv({ env, cwd: env.RUVNET_BRAIN_PROJECT_DIR || process.cwd() })
+        ? runtimeChildEnv({ env, cwd: projectRoot })
         : env;
       const execution = await execute(executable, argv, childEnv);
       recordManagedCliObservation({ toolName, executable, argv, execution, env });

package/plugin/scripts/codex-hook-adapter.mjs

@@ -31,6 +31,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { CONTEXT_EVENTS } from './codex-hook-events.mjs';
 
 const raw = fs.readFileSync(0, 'utf8');
 let input = {};
@@ -41,13 +42,10 @@ const event = String(input.hook_event_name || '');
 let adapted = false;
 const codexToolName = String(input.tool_name).toLowerCase();
 
-/**
- * Events whose output schema defines a *HookSpecificOutputWire with `additionalContext`. Only these
- * may carry a hook's prose back to the model.
- */
-const CONTEXT_EVENTS = new Set([
-  'PreToolUse', 'PostToolUse', 'PermissionRequest', 'SessionStart', 'SubagentStart', 'UserPromptSubmit',
-]);
+// CONTEXT_EVENTS (events whose output schema defines a *HookSpecificOutputWire with
+// `additionalContext`) now lives in the pure sibling ./codex-hook-events.mjs — see that file's
+// header for why: this module's top level reads stdin synchronously, which makes it unsafe to
+// import for its constants alone (Dream Cycle 2026-08-30).
 
 /** Every file an apply_patch touches, in patch order. Codex patches are routinely multi-file. */
 export function patchFiles(patch) {
@@ -172,6 +170,13 @@ if (event === 'Stop') {
   process.exit(0);
 }
 
+// Dream Cycle 2026-08-25: this event's schema has nowhere to carry an envelope at all — see
+// CONTEXT_EVENTS above. The `!parsed` branch below already dropped unparseable prose here; a body
+// that happens to emit VALID JSON (e.g. a stray hookSpecificOutput.additionalContext) used to skip
+// that guard and fall through to a verbatim stdout write, which Codex rejects exactly like prose
+// would. No shipped body does this today, but nothing enforced that it couldn't start.
+if (!CONTEXT_EVENTS.has(event)) process.exit(0);
+
 if (!parsed) {
   // Prose from a shared body. It is only deliverable on an event whose schema has somewhere to put
   // it; everywhere else it is dropped rather than emitted as output the host will reject.

package/plugin/scripts/codex-hook-events.mjs

@@ -0,0 +1,39 @@
+/**
+ * codex-hook-events.mjs — the Codex event catalogue, as pure data.
+ *
+ * Split out of codex-hook-adapter.mjs (Dream Cycle 2026-08-30) because that file's top level reads
+ * stdin synchronously (`fs.readFileSync(0, 'utf8')`) the moment it is imported — the same
+ * import-time side-effect hazard the 2026-08-26 brain-stamp.mjs finding named (a test importing the
+ * side-effecting module directly hangs/misbehaves rather than observing its constants). That is
+ * exactly why `tests/unit/codex-claude-hook-parity.test.mjs` never imported the adapter's own
+ * CONTEXT_EVENTS and instead carried a hand-copied array — which had already drifted to 4 of the
+ * real 6 events, so `PermissionRequest` and `SubagentStart` had zero coverage proving the
+ * wrap-in-envelope branch runs for them at all. Extracting the pure data here, with no filesystem or
+ * stdin access at import time, lets both the adapter and its test read the same values instead of
+ * two copies that only stay in sync by whoever remembers to edit both.
+ */
+
+/**
+ * Events whose output schema defines a *HookSpecificOutputWire with `additionalContext`. Only these
+ * may carry a hook's prose back to the model.
+ */
+export const CONTEXT_EVENTS = new Set([
+  'PreToolUse', 'PostToolUse', 'PermissionRequest', 'SessionStart', 'SubagentStart', 'UserPromptSubmit',
+]);
+
+/**
+ * The complete Codex hook-event catalogue, PascalCase to match every event name used in this file's
+ * sibling and its manifest — not this repo's invention. Read from the live host and recorded
+ * verbatim (as snake_case) in `plugin/hooks/codex-hooks.json`'s own `description`: "pre_tool_use,
+ * permission_request, post_tool_use, pre_compact, post_compact, session_start, session_end,
+ * user_prompt_submit, subagent_start, subagent_stop, stop." `codex-hooks.json` currently wires only
+ * 7 of these 11 (see its `DECLARED ABSENT` note for the one Claude-Code-only event, `TeammateIdle`,
+ * which Codex has no equivalent for at all); the remaining 4 registered-nowhere-yet events
+ * (PermissionRequest, PostCompact, SubagentStart, SubagentStop) still pass through the adapter's
+ * event classification the moment anything is ever wired to them, so the classification itself is
+ * worth proving correct now rather than the day a hook body first reaches one unproven.
+ */
+export const ALL_HOST_EVENTS = [
+  'PreToolUse', 'PermissionRequest', 'PostToolUse', 'PreCompact', 'PostCompact',
+  'SessionStart', 'SessionEnd', 'UserPromptSubmit', 'SubagentStart', 'SubagentStop', 'Stop',
+];

package/plugin/scripts/coverage-integrity.mjs

@@ -53,7 +53,7 @@ function validateLegacyGistAggregateReceipt({ receipt, passagesFile, expectedIds
 
 export function validateGistAggregateReceipt({ receipt, passagesFile, expectedIds = null,
   sourceObservationSha256 = null }) {
-  if (receipt?.schemaVersion === 2 && sourceObservationSha256 === null) {
+  if (receipt?.schemaVersion === 2) {
     return validateLegacyGistAggregateReceipt({ receipt, passagesFile, expectedIds });
   }
   if (receipt?.schemaVersion !== 3 || receipt?.kind !== 'ruvnet-brain-gist-source-receipts'
@@ -201,7 +201,7 @@ export function generationLedgerBytes(ledger) {
   return Buffer.from(`${JSON.stringify(ledger, null, 2)}\n`);
 }
 
-export function validatePublicInventory({ assetsDir, coverage, ledger, installedPublicStores = null }) {
+export function validatePublicInventory({ assetsDir, coverage, ledger, installedPublicStores = null, gistReceipt = null }) {
   const root = path.resolve(assetsDir);
   const selected = installedPublicStores === null ? null : [...installedPublicStores].map((store) => String(store).toLowerCase());
   if (selected && (selected.some((store) => !store) || new Set(selected).size !== selected.length)) {
@@ -239,14 +239,14 @@ export function validatePublicInventory({ assetsDir, coverage, ledger, installed
     if (gistStores.size !== 1 || !gistStores.has('ruv-gists')) throw new Error('eligible gists must use the ruv-gists aggregate');
     if (!selectedSet || selectedSet.has('ruv-gists')) {
       const receiptFile = path.join(root, 'ruv-gists.sources.json');
-      const receipt = readJson(receiptFile, 'gist aggregate receipt');
+      const receipt = gistReceipt || readJson(receiptFile, 'gist aggregate receipt');
       const passages = path.join(root, 'ruv-gists.passages.jsonl');
       const ids = gists.map((row) => String(row.key || '').replace(/^gist:/, ''));
       if (ids.some((id) => !id)) throw new Error('gist coverage row identity is missing');
       validateGistAggregateReceipt({ receipt, passagesFile: passages, expectedIds: ids,
         sourceObservationSha256: coverage.sourceObservationSha256 });
       if (receipt.schemaVersion === 3) evidenceFiles.push(evidenceIdentity(root, passages, 'gist-passages'));
-      evidenceFiles.push(evidenceIdentity(root, receiptFile, 'gist-receipt'));
+      if (!gistReceipt) evidenceFiles.push(evidenceIdentity(root, receiptFile, 'gist-receipt'));
     }
     gistAggregate = 'ruv-gists';
   }

package/plugin/scripts/hook-shim.mjs

@@ -275,7 +275,7 @@ function resolveCodeRoot() {
   try {
     const dev = JSON.parse(fs.readFileSync(DEV, 'utf8'));
     if (dev && dev.codeRoot && fs.existsSync(path.join(dev.codeRoot, 'scripts'))) {
-      return { root: dev.codeRoot, source: 'dev' };
+      return { root: dev.codeRoot, source: 'dev', version: dev.version || '' };
     }
   } catch { /* no dev mode */ }
   try {
@@ -285,13 +285,13 @@ function resolveCodeRoot() {
     const real = fs.realpathSync(root);
     // Containment: only ever execute from the immutable version store.
     if (!real.startsWith(fs.realpathSync(VERSIONS) + path.sep)) return null;
-    return { root: real, source: `gen ${active.generation ?? '?'}` };
+    return { root: real, source: `gen ${active.generation ?? '?'}`, version: active.version || '' };
   } catch { return null; }
 }
 
 // Run one hook body. No shell is ever involved: spawnSync with an argument array, interpreter
 // chosen from the typed table — never from input.
-function runHook(file) {
+function runHook(file, activeVersion = '') {
   if (!fs.existsSync(file)) return 0; // nothing to run — never invent a failure
   let cmd;
   if (entry.interpreter === 'node') {
@@ -312,9 +312,11 @@ function runHook(file) {
   // core also reads the sentinel because the POSIX compatibility launcher and bare installs invoke
   // it outside this shim. Passing the snapshot means the two readings cannot disagree within one
   // invocation if the user flips the switch while the hook is mid-run.
-  const env = (BRAIN_OFF && entry.offBehavior === 'partial')
-    ? { ...process.env, RUVNET_BRAIN_OFF: '1' }
-    : process.env;
+  const env = {
+    ...process.env,
+    ...(activeVersion ? { RUVNET_BRAIN_ACTIVE_VERSION: activeVersion } : {}),
+    ...(BRAIN_OFF && entry.offBehavior === 'partial' ? { RUVNET_BRAIN_OFF: '1' } : {}),
+  };
   const io = hookInput !== null
     ? { stdio: ['pipe', 'inherit', 'inherit'], input: hookInput }
     : { stdio: 'inherit' };
@@ -342,7 +344,7 @@ function dispatchHook() {
     // codeRoot IS a plugin-payload root (versions/<v>/ mirrors the plugin dir: scripts/, hooks/, mcp/).
     const spineFile = path.join(spine.root, 'scripts', entry.file);
     if (fs.existsSync(spineFile)) {
-      return runHook(spineFile);
+      return runHook(spineFile, spine.version);
     }
     // Spine resolved but the body file is missing — fall back LOUDLY (finding 25), once per
     // generation. The key omits entry.file on purpose: one broken generation is ONE piece of news,

package/plugin/scripts/learn-capture.sh

@@ -147,7 +147,26 @@ else
   # they mean; the component that actually creates the queue was not brought along, so the invariant
   # held for two of three participants and was violated by the one doing the writing. Same shape as
   # ADR-066: a writer and a reader that disagree about the store make the recording theatre.
-  DIR="${RUVNET_BRAIN_PROJECT_DIR:-$PWD}/.swarm/ruvnet-brain-learn"
+  # RESIDUAL of #134/#104: RUVNET_BRAIN_PROJECT_DIR is never set by real hook dispatch on either
+  # host (neither hook-shim.mjs nor codex-hook-adapter.mjs seeds it), so it degraded back to bare
+  # $PWD in production. CLAUDE_PROJECT_DIR is the one project-root signal both hosts DO provide on
+  # every invocation. Trusted only when $PWD actually lies inside it — the SAME containment rule
+  # project-identity.mjs's projectDirectory() applies for the identical reason (#85/#107: an
+  # unrelated declared root must never overrule a cwd it does not contain). A plain string-prefix
+  # check, not a realpath/inode compare, to honour this hook's own no-process-spawn contract.
+  ROOT_DIR="$PWD"
+  if [ -n "${CLAUDE_PROJECT_DIR:-}" ]; then
+    CPD="${CLAUDE_PROJECT_DIR%/}"
+    # Git Bash presents PWD as /c/... while Node supplies CLAUDE_PROJECT_DIR as C:\\... on
+    # Windows. Compare normalized, case-folded spellings so the real project-root signal works
+    # on both hosts without spawning a platform-specific path converter.
+    _pwd_for_compare="$PWD"
+    if [ -n "$(pwd -W 2>/dev/null || true)" ]; then _pwd_for_compare="$(pwd -W)"; fi
+    _pwd_cmp=$(printf '%s' "$_pwd_for_compare" | tr '\\\\' '/' | tr '[:upper:]' '[:lower:]')
+    _cpd_cmp=$(printf '%s' "$CPD" | tr '\\\\' '/' | tr '[:upper:]' '[:lower:]')
+    case "$_pwd_cmp/" in "$_cpd_cmp"/*) ROOT_DIR="$CPD" ;; esac
+  fi
+  DIR="${RUVNET_BRAIN_PROJECT_DIR:-$ROOT_DIR}/.swarm/ruvnet-brain-learn"
 fi
 # PROJECT SCOPE MEANS THE PROJECT MUST HAVE OPTED IN. In project scope $DIR sits under `.swarm`,
 # which is Ruflo's own convention and is created by `ruflo init` — so its PRESENCE is the project's

package/plugin/scripts/learn-flush.mjs

@@ -15,6 +15,7 @@ import { execFileSync } from 'node:child_process';
 import { readStdinBounded } from './hook-input.mjs';
 import { learningScope, loadRuntimePreferences } from './runtime-preferences.mjs';
 import { resolveRuflo, RUFLO_MISSING } from './ruflo-bin.mjs';
+import { projectDirectory } from './project-identity.mjs';
 
 // ONE BOUNDED LINE ON STDERR. stderr because a SessionEnd hook's stdout is not surfaced, and bounded
 // because a hook that prints a stack trace on every `/clear` gets muted — and a muted diagnostic is
@@ -23,7 +24,12 @@ import { resolveRuflo, RUFLO_MISSING } from './ruflo-bin.mjs';
 const warn = (msg) => { try { process.stderr.write(`learn-flush: ${msg}\n`); } catch { /* stderr gone */ } };
 
 const HOME = os.homedir();
-const PROJECT = process.env.RUVNET_BRAIN_PROJECT_DIR || process.cwd();
+// RESIDUAL of #134/#104: RUVNET_BRAIN_PROJECT_DIR is never set by real hook dispatch on either host,
+// so it degraded back to raw cwd() in production. `projectDirectory()` (project-identity.mjs) is the
+// SAME CLAUDE_PROJECT_DIR-with-containment rule #85/#107 already fixed for the receipt/Console
+// agreement — reused here rather than trusting the variable unconditionally, which would reopen the
+// class of bug #107 was: an unrelated declared root overruling a cwd it does not actually contain.
+const PROJECT = process.env.RUVNET_BRAIN_PROJECT_DIR || projectDirectory();
 // ISSUE #139 — this WRITER resolved scope correctly while two READERS hardcoded it, so they agreed
 // only by coincidence. The resolution moved into runtime-preferences.mjs and all three now call it;
 // a future scope is one edit, not three. Behaviour here is unchanged by design.

package/plugin/scripts/lesson-gate.mjs

@@ -270,14 +270,29 @@ const HERE = (() => {
   }
   return path.basename(d);
 })();
+/**
+ * A "suffix match" for project names, bounded so it cannot fire on a bare shared tail. `a` matches
+ * `b` when `b` is a whole path/name SEGMENT suffix of `a` — the character immediately before it must
+ * be a separator, never a mid-word letter. Without this, "Sentry" matched inside "WhitSentry" and any
+ * project name that merely happens to end another's, which is the exact cross-project leak the
+ * 2026-07-22 project-scope fix (this same function, below) was written to close.
+ */
+const segmentSuffixMatch = (a, b) => {
+  if (a === b) return true;
+  if (a.length <= b.length || !a.endsWith(b)) return false;
+  return /[-_/]/.test(a[a.length - b.length - 1]);
+};
+
 /** Does this lesson belong to the project we are standing in? Match is loose on purpose — stored
- *  names carry prefixes like `Code-` that the directory name does not. */
+ *  names carry prefixes like `Code-` that the directory name does not — but bounded to a real
+ *  delimiter so it cannot match a bare, accidental shared suffix between unrelated projects. */
 const isHome = (l) => {
   const ps = Array.isArray(l.projects) ? l.projects : [];
   if (!ps.length) return true;                       // unscoped: applies anywhere, by declaration
   return ps.some((p) => {
     const n = String(p).replace(/^Code-/, '');
-    return n === HERE || String(p) === HERE || HERE.endsWith(n) || n.endsWith(HERE);
+    return n === HERE || String(p) === HERE
+      || segmentSuffixMatch(HERE, n) || segmentSuffixMatch(n, HERE);
   });
 };
 const isUniversal = (l) => Array.isArray(l.projects) && l.projects.length >= 2;

package/plugin/scripts/lesson-hooks.sh

@@ -205,8 +205,23 @@ if [ "$EVENT" = "PreToolUse-bash" ] && [ -f "$HOOK_INPUT_JS" ]; then
   # with absolute paths writes) matched NOTHING, while `grep -n "npm publish" docs/` matched, so
   # reading ABOUT shipping counted as shipping. Quoted regions are stripped first because the
   # truth-maker is what will EXECUTE — a commit message is not a command.
-  CMD_EXEC=$(printf '%s' "$CMD" | sed -e 's/"[^"]*"/ /g' -e "s/'[^']*'/ /g")
-  if printf '%s' "$CMD_EXEC" | grep -qE '\bgit\b[^|;&]*\bpush\b|\b(npm|yarn|pnpm) publish\b|\bgh release create\b|release\.mjs'; then
+  # tr runs BEFORE sed, not after: sed matches one line at a time, so a double/single-quoted string
+  # that legitimately SPANS a real newline (a multi-line commit message, a heredoc body) would
+  # otherwise never get stripped — its opening quote sits on one sed-internal line with no closer,
+  # its closing quote on another with no opener — leaking whatever words it quotes (e.g. "npm" and
+  # "publish" mentioned in prose) into CMD_EXEC as if they were unquoted. Collapsing newlines/tabs to
+  # spaces FIRST makes the whole command one logical line, so the existing quote-stripping regexes
+  # then span it correctly, same as they already do for a single-line quoted string. Caught live by
+  # an adversarial critic pass on the first cut of this fix (which ran tr after sed): a multi-line
+  # `git commit -m "...npm\npublish is unaffected..."` false-positived as a ship command on this side
+  # while degradation-watch.mjs's `dependentEvent()` (unmodified, not line-oriented) correctly said no
+  # — the exact "two ship definitions disagree" defect this diff exists to close, reopened in a new
+  # shape. [[:space:]]+ (not a literal space) then matches degradation-watch.mjs's `\s+` on what's
+  # left. 2026-08-27: the two definitions also disagreed on a tab/doubled-space/wrapped-newline
+  # `npm publish`/`gh release create`, which the JS side (already `\s+`-tolerant on a plain string)
+  # caught and this side missed silently.
+  CMD_EXEC=$(printf '%s' "$CMD" | tr '\n\t' '  ' | sed -e 's/"[^"]*"/ /g' -e "s/'[^']*'/ /g")
+  if printf '%s' "$CMD_EXEC" | grep -qE '\bgit\b[^|;&]*\bpush\b|\b(npm|yarn|pnpm)[[:space:]]+publish\b|\bgh[[:space:]]+release[[:space:]]+create\b|release\.mjs'; then
     ARGS+=(--trigger ship)
   fi
 fi