ruvnet-brain 4.3.21 → 4.3.25

package/plugin/scripts/continuity-hook-policy.mjs

@@ -1,16 +1,171 @@
 /**
  * The only automatic lifecycle surface RuvNet Brain permits.
  *
- * The 4.3.16 stabilization retired the old collection of grounding, learning, routing, and
- * release interceptors. Continuity is deliberately narrower: SessionStart restores the canonical
- * project checkpoint, and Stop may request one continuation only when an explicitly authorized,
- * project-scoped objective remains open. Keeping this allowlist in one module prevents a registry
- * from quietly growing another pile of independent gates.
+ * The 4.3.16 stabilization retired the old collection of grounding, learning, routing, and release
+ * interceptors, and they STAY retired — this file is what keeps a registry from quietly regrowing
+ * that pile. What it is not is a claim that "two hooks" is the right number forever. The continuity
+ * plane had exactly two handlers and could not do its job: SessionStart restored a journal that
+ * nothing ever wrote, because no event was allowed to WRITE one. An allowlist that forbids the
+ * capture boundary while demanding the restore is not a safety property, it is a contradiction.
+ *
+ * So the allowlist is now a LIST PER EVENT rather than one entry per event, and each registration
+ * declares which hosts may carry it. Adding to it is still a deliberate act that has to pass
+ * `npm run hooks:check`; what changed is that the shape can express the plane that actually works.
+ *
+ * EVENT → OWNER (the same table hook-contracts.json publishes, kept here because this is the file
+ * that enforces it). Owner first, event second: wired-check.mjs reads a module header for
+ * "<EventName> ... hook|gate" to decide whether a FILE is itself a hook body, and an event-first
+ * table made this policy module look like one. The information is identical; the shape is not.
+ *
+ *   session-start       continuity recovery   at SessionStart       claude, codex
+ *   unprompted-speech   advisory delivery     at UserPromptSubmit   claude, codex
+ *   continuation-gate   continuation nudge    at turn end           claude, codex
+ *   session-snapshot    continuity capture    at turn end           claude
+ *   session-snapshot    continuity capture    at PreCompact         claude
+ *   session-snapshot    continuity capture    at SessionEnd         claude, codex
+ *   ground-ruvnet       grounding injection   at UserPromptSubmit   claude, codex
+ *   decision-gate       write authorization   at PreToolUse (write) claude, codex
+ *   grounding-stamp     grounding receipt     at PostToolUse        claude, codex
+ *   grounding-turn-mark grounding turn marker at UserPromptSubmit   claude, codex
+ *   grounding-turn-gate answered-w/o-search   at turn end           claude, codex
+ *
+ * THE GROUNDING ROWS WERE ADDED 2026-09-11 (Stuart), and this header is the record of why. The
+ * 4.3.16 retirement took the ONLY enforcement of ADR-0012 — never write rUv-product code the brain
+ * has not seen — out of the automatic plane, leaving it in hook-shim's table where nothing ran it.
+ * On 2026-09-11 the exact failure that rule exists to prevent recurred in this repo: a console was
+ * built without asking the brain whether one existed (it did: console/, RVBC). Stuart: "the fact
+ * that you don't have a hook set up to do that means you're a toy versus a solution." So the write
+ * gate is automatic again, WITH its key: decision-gate's write route is the one refuser (ADR-067),
+ * grounding-stamp on a successful search_ruvnet is the receipt that opens it, and ground-ruvnet is
+ * the prompt-level directive that tells the model to search first. ground-ruvnet is a second owner
+ * of UserPromptSubmit alongside unprompted-speech — scoped by ADR-040 §Amendment 2026-09-11 to
+ * grounding DIRECTIVES, which are not the advisory speech that seam owns.
+ *
+ * CODEX EXTENSION, 2026-09-12 — the 2026-09-11 "not proven" claim below (see the probe box) was
+ * measured with `codex exec "reply OK"`, a prompt that never invokes a tool at all: of course
+ * PreToolUse/PostToolUse never fired, because nothing ever ran a tool for them to fire on. That is
+ * "never asked the question", not "asked and got no". Re-measured today against codex-cli 0.154.0
+ * with a prompt that actually calls a tool: a real `apply_patch` write fired PreToolUse and
+ * PostToolUse with `tool_name:"apply_patch"`, and a real MCP call to this repo's own `search_ruvnet`
+ * server fired both with `tool_name:"mcp__ruvnet_brain__search_ruvnet"` — which the EXISTING
+ * `^(?:.*__)?search_ruvnet$` matcher already recognizes unchanged (`.*__` absorbs the
+ * `mcp__ruvnet_brain__` prefix). So decision-gate's write route and grounding-stamp are extended to
+ * Codex: `apply_patch` is added to the shared PreToolUse matcher (Claude's Write/Edit/MultiEdit/
+ * NotebookEdit are untouched — the addition is a dead branch on Claude, since Claude never names a
+ * tool `apply_patch`), and grounding-stamp's PostToolUse matcher is reused byte-identical. Real
+ * transcripts of both round trips, both hosts, live in this change's commit and PROGRESS.md.
+ *
+ * STILL NOT IN THIS PLANE, and deliberately so: decision-gate's BASH route (Codex `exec_command`)
+ * and ADR-075's ExecutionPolicy. Today's measurement proved PreToolUse/PostToolUse delivery for a
+ * write and an MCP call specifically — it did not exercise `exec_command`, so extending the bash
+ * route on that same evidence would be exactly the assumption this rule exists to forbid. Both
+ * remain reachable through hook-shim's dispatch table by explicit invocation.
+ *
+ * "ANSWERED WITHOUT SEARCHING", ADDED 2026-09-12. ground-ruvnet's Gate 1 is a prompt-level
+ * DIRECTIVE ("call search_ruvnet before asserting"), and a directive is advisory — nothing checked
+ * whether the model actually complied before the turn ended, which is the "stopping is the absence
+ * of an action" gap continuation-gate.mjs's own header already names, applied to grounding instead
+ * of unfinished work. grounding-turn-mark (UserPromptSubmit) records that Gate 1 fired for this
+ * turn; grounding-turn-gate (Stop) forces continuation if grounding-stamp.sh's evidence shows no
+ * search_ruvnet call happened since. Full rationale, including why this is a NEW pair rather than
+ * an extension of continuation-gate.mjs, lives in grounding-turn-gate.mjs's own header.
  */
 
+/**
+ * @typedef {{ id: string, matcher: string, hosts: readonly string[] }} ContinuityRegistration
+ */
+
+const registration = (id, matcher, hosts) => Object.freeze({ id, matcher, hosts: Object.freeze(hosts) });
+
+/**
+ * CODEX REGISTRATIONS ARE MEASURED, NOT ASSUMED (probe run 2026-09-11, codex-cli 0.154.0).
+ *
+ * A name in an event catalogue is not a delivery. Registering a capture on an event the host never
+ * fires produces a plane that LOOKS symmetrical and silently captures nothing on one side of it —
+ * which is worse than an asymmetry that is written down. So a temporary CODEX_HOME was given a probe
+ * hook registered on all twelve event names the installed binary declares, and a real
+ * `codex exec "reply OK"` was run against it. What actually arrived:
+ *
+ *   SessionStart      FIRED   payload captured
+ *   UserPromptSubmit  FIRED   payload captured
+ *   SessionEnd        FIRED   payload captured (it fires even when the turn errors out)
+ *   Stop              NOT OBSERVED — the probe turn never completed, so `run_turn_stop_hooks`
+ *                     had no completion to fire on. The binary declares the event and the wire
+ *                     struct, so this is "not proven", not "not supported".
+ *   PreCompact        NOT OBSERVED — a one-line turn never approaches a compaction threshold.
+ *
+ * Therefore Codex capture is registered at SessionEnd ONLY. Stop keeps the pre-existing
+ * continuation-gate registration (unchanged by this lane); no NEW handler is added to an event whose
+ * delivery has not been seen. hook-contracts.json carries the same measurement and its date.
+ *
+ * RE-MEASURED 2026-09-12, codex-cli 0.154.0, PreToolUse/PostToolUse specifically. The 2026-09-11
+ * probe above used `codex exec "reply OK"` — a prompt that never invokes a tool — so PreToolUse and
+ * PostToolUse were never exercised at all; "NOT OBSERVED" there described an untested path, not a
+ * failing one. Today's probe used prompts that DO invoke a tool:
+ *
+ *   PreToolUse / PostToolUse (apply_patch)              FIRED   tool_name:"apply_patch",
+ *                                                                tool_input.command = the raw patch,
+ *                                                                tool_response = "Exit code: 0…
+ *                                                                Success. Updated the following
+ *                                                                files: A <path>"
+ *   PreToolUse / PostToolUse (MCP search_ruvnet, this    FIRED   tool_name:
+ *   repo's own plugin/mcp/server.mjs registered as a             "mcp__ruvnet_brain__search_ruvnet",
+ *   real MCP server in the probe's CODEX_HOME)                   tool_response.content[0].text =
+ *                                                                "Searched N RuvNet repos …"
+ *
+ * Both are now registered for Codex: decision-gate's write route (`apply_patch` added to the shared
+ * PreToolUse matcher below — Claude's tool names are untouched) and grounding-stamp (the existing
+ * `^(?:.*__)?search_ruvnet$` matcher already matches `mcp__ruvnet_brain__search_ruvnet` unchanged,
+ * since `.*__` absorbs any qualifying prefix). Full transcripts in this change's commit message.
+ */
 export const CONTINUITY_EVENTS = Object.freeze({
-  SessionStart: Object.freeze({ id: 'session-start', matcher: 'startup|resume|clear|compact|fork' }),
-  Stop: Object.freeze({ id: 'continuation-gate', matcher: '*' }),
+  SessionStart: Object.freeze([
+    registration('session-start', 'startup|resume|clear|compact|fork', ['claude', 'codex']),
+  ]),
+  UserPromptSubmit: Object.freeze([
+    registration('unprompted-speech', '*', ['claude', 'codex']),
+    registration('ground-ruvnet', '*', ['claude', 'codex']),
+    // The "answered without searching" gate, half 1 of 2 (2026-09-12) — see grounding-turn-gate.mjs's
+    // header for the full rationale. Records that ground-ruvnet's Gate 1 fired for this turn, since
+    // Stop's own payload carries no prompt text for grounding-turn-gate to test.
+    registration('grounding-turn-mark', '*', ['claude', 'codex']),
+  ]),
+  // The write gate and its key (ADR-0012 / ADR-067), re-registered 2026-09-11 — see the header.
+  // Extended to Codex 2026-09-12: a real `apply_patch` write was measured to fire PreToolUse on
+  // codex-cli 0.154.0 (see the probe box above). `apply_patch` is Codex's own raw tool name for a
+  // write — the matcher tests the RAW host event, before codex-hook-adapter.mjs normalizes it to
+  // Claude's `Edit` shape for decision-gate.mjs's own policies (protect-state, hijack-ruvnet,
+  // ground-before-write, adr-currency all then see tool_name:"Edit" exactly as on Claude).
+  PreToolUse: Object.freeze([
+    registration('decision-gate', '^(Write|Edit|MultiEdit|NotebookEdit|apply_patch)$', ['claude', 'codex']),
+  ]),
+  // Extended to Codex 2026-09-12: a real MCP `search_ruvnet` call was measured to fire PostToolUse
+  // on codex-cli 0.154.0 with tool_name "mcp__ruvnet_brain__search_ruvnet" — the matcher below
+  // already matched that shape unchanged (see the probe box above), and grounding-stamp.sh's own
+  // gating logic is a raw-payload substring scan with no host-specific field access, so it needed
+  // no change either (proven live: the real MCP tool_response's `content[0].text` carries the exact
+  // "Searched N RuvNet repos" banner and query text the script already looks for).
+  PostToolUse: Object.freeze([
+    registration('grounding-stamp', '^(?:.*__)?search_ruvnet$', ['claude', 'codex']),
+  ]),
+  Stop: Object.freeze([
+    registration('continuation-gate', '*', ['claude', 'codex']),
+    registration('session-snapshot', '*', ['claude']),
+    // The "answered without searching" gate, half 2 of 2 (2026-09-12). Forces continuation
+    // (hookSpecificOutput.additionalContext — the same contract continuation-gate.mjs already uses
+    // and codex-hook-adapter.mjs already translates to Codex's decision:block on both hosts) when
+    // grounding-turn-mark's marker for this session shows Gate 1 fired and no search_ruvnet stamp
+    // (grounding-stamp.sh) postdates it. A separate registration from continuation-gate on purpose —
+    // see grounding-turn-gate.mjs's header for why folding it in would corrupt that file's ledger
+    // semantics rather than extend them.
+    registration('grounding-turn-gate', '*', ['claude', 'codex']),
+  ]),
+  PreCompact: Object.freeze([
+    registration('session-snapshot', '*', ['claude']),
+  ]),
+  SessionEnd: Object.freeze([
+    registration('session-snapshot', '*', ['claude', 'codex']),
+  ]),
 });
 
 const commandHas = (command, id) => {
@@ -19,19 +174,39 @@ const commandHas = (command, id) => {
   return new RegExp(`(?:^|[\\s"'])${id}(?:$|[\\s"'])`).test(text);
 };
 
-export function continuityHookId(command) {
-  for (const [event, spec] of Object.entries(CONTINUITY_EVENTS)) {
-    if (commandHas(command, spec.id)) return { event, id: spec.id };
+/** Which continuity handler, if any, a command invokes — scoped to `event` when one is supplied. */
+export function continuityHookId(command, event) {
+  const events = event ? { [event]: CONTINUITY_EVENTS[event] ?? [] } : CONTINUITY_EVENTS;
+  for (const [name, specs] of Object.entries(events)) {
+    for (const spec of specs) if (commandHas(command, spec.id)) return { event: name, id: spec.id };
   }
   return null;
 }
 
-export function isAllowedContinuityRegistration({ event, matcher, command } = {}) {
-  const spec = CONTINUITY_EVENTS[event];
-  if (!spec || String(matcher ?? '') !== spec.matcher) return false;
-  return commandHas(command, spec.id);
+/**
+ * Is this exact (event, matcher, command) registration permitted, for this host?
+ * `host` defaults to undefined, meaning "any host that may carry it" — the check every caller used
+ * before hosts existed, kept so a host-agnostic caller keeps its old answer.
+ */
+export function isAllowedContinuityRegistration({ event, matcher, command, host } = {}) {
+  const specs = CONTINUITY_EVENTS[event];
+  if (!specs) return false;
+  return specs.some((spec) => String(matcher ?? '') === spec.matcher
+    && commandHas(command, spec.id)
+    && (host === undefined || spec.hosts.includes(host)));
+}
+
+/** Every registration this policy expects on `host`, as flat {event, id, matcher} rows. */
+export function continuityRegistrations(host) {
+  return Object.entries(CONTINUITY_EVENTS).flatMap(([event, specs]) => specs
+    .filter((spec) => host === undefined || spec.hosts.includes(host))
+    .map((spec) => ({ event, id: spec.id, matcher: spec.matcher, hosts: [...spec.hosts] })));
 }
 
+/**
+ * The (event, id) pairs a contracts manifest must list — PAIRS, not ids, because `session-snapshot`
+ * is legitimately registered at three different boundaries and a bare id set cannot say that.
+ */
 export function continuityContractIds() {
-  return Object.values(CONTINUITY_EVENTS).map(({ id }) => id);
+  return continuityRegistrations().map(({ event, id }) => `${event}:${id}`);
 }

package/plugin/scripts/coverage-integrity.mjs

@@ -121,6 +121,13 @@ export function sha256File(file) {
   return hash.digest('hex');
 }
 
+// One shared file-identity primitive: always hashes the actual written bytes on disk (never a
+// claimed/serialized value). Every corpus/release receipt reader and writer binds file identity
+// through this single function so they can never independently drift from each other.
+export function fileIdentity(file) {
+  return { file: path.basename(file), sha256: sha256File(file), bytes: fs.statSync(file).size };
+}
+
 const readJson = (file, label) => {
   let stat;
   try { stat = fs.lstatSync(file); } catch { throw new Error(`${label} is missing`); }

package/plugin/scripts/gates.mjs

@@ -20,6 +20,24 @@
 // stops anything. Counting all hooks as "protection" would be the same inflation as counting
 // cloned upstream repos as your own wiring. Advisory and blocking are different claims.
 //
+// THREE MORE (console audit, 2026-09-11), each a way the card lied on the owner's own machine:
+//
+//   3. It read plugin/hooks/hooks.json from the console's REPO. On an installed host REPO is the
+//      console runtime under ~/.cache, which ships no plugin/hooks/ at all — so the live page showed
+//      the 3 machine hooks and NOTHING from the plugin, while Claude Code was loading the plugin's
+//      hooks.json from ~/.claude/plugins/cache/…. The survey now reads the hooks the HOST loads
+//      (the installed plugin cache), falling back to the repo only in a dev checkout, and says which.
+//
+//   4. Every plugin row was named "hook-shim" — the launcher — so five different gates collapsed
+//      into one name and the duplicate detector could not tell them apart. Rows are now named by
+//      the gate hook-shim runs (`hook-shim.mjs memory-ensure` → memory-ensure).
+//
+//   5. "0 can block" was true and useless. hook-shim's own table marks ground-before-write,
+//      decision-gate, design-wall and protect-brain-state `blocking` — and none of them is
+//      registered in hooks.json. "Nothing is enforcing" and "these enforcers are unplugged" are
+//      different sentences; only the second is actionable. Unregistered blocking gates are listed,
+//      with whether the file even exists on disk.
+//
 // Reads only. Never asserts a count it cannot source from a file on this machine.
 // ─────────────────────────────────────────────────────────────────────────────────────────────────
 
@@ -28,9 +46,10 @@ import os from 'node:os';
 import path from 'node:path';
 
 const HOME = os.homedir();
-const BLOCKS = path.join(HOME, '.cache/ruvnet-brain/gate-blocks.jsonl');
+const PLUGIN_ID = 'ruvnet-brain@ruvnet-brain';
 
 function readJSON(f) { try { return JSON.parse(fs.readFileSync(f, 'utf8')); } catch { return null; } }
+function isFile(f) { try { return fs.statSync(f).isFile(); } catch { return false; } }
 
 // Two independent things must BOTH be true for a hook to stop anything, and conflating them is how
 // a census gets sold as protection:
@@ -42,12 +61,28 @@ const BLOCKING_EVENTS = new Set(['PreToolUse', 'UserPromptSubmit']);
 const swallowsExit = (cmd) => /\|\|\s*true\s*$/.test(String(cmd || '').trim());
 const canBlock = (event, cmd) => BLOCKING_EVENTS.has(event) && !swallowsExit(cmd);
 
+// The plugin wires every hook through one launcher: `node ".../hook-shim.mjs" <gate> …`. The GATE is
+// the name worth reading; the launcher is not.
+const SHIM_ID = /hook-shim\.mjs["']?\s+([\w-]+)/;
 const NAME = (cmd) => {
+  const shim = String(cmd || '').match(SHIM_ID);
+  if (shim) return shim[1];
   const m = String(cmd || '').match(/([\w-]+)\.(sh|mjs|js)/);
   return m ? m[1] : String(cmd || '').split(/\s+/).filter((t) => !t.startsWith('-')).pop()?.slice(0, 28) || 'hook';
 };
 
-function collect(hooksObj, source) {
+// hook-shim.mjs is executable on import (it reads argv[2] at module level), so its TABLE is read as
+// TEXT, never imported. Each entry is one line: `'id': { file: 'x.sh', …, mode: 'blocking'|'advisory', … }`.
+const TABLE_ENTRY = /'([\w-]+)':\s*\{[^}]*?\bfile:\s*'([^']+)'[^}]*?\bmode:\s*'(blocking|advisory)'/g;
+export function readShimTable(shimFile) {
+  let src = '';
+  try { src = fs.readFileSync(shimFile, 'utf8'); } catch { return null; }
+  const table = {};
+  for (const m of src.matchAll(TABLE_ENTRY)) table[m[1]] = { file: m[2], mode: m[3] };
+  return Object.keys(table).length ? table : null;
+}
+
+function collect(hooksObj, source, shimTable = null) {
   const out = [];
   for (const [event, groups] of Object.entries(hooksObj || {})) {
     const list = Array.isArray(groups) ? groups : [groups];
@@ -55,27 +90,88 @@ function collect(hooksObj, source) {
       const hooks = Array.isArray(g?.hooks) ? g.hooks : (g?.command ? [g] : []);
       for (const h of hooks) {
         if (!h?.command) continue;
-        out.push({ event, matcher: g?.matcher ?? '*', name: NAME(h.command), blocking: canBlock(event, h.command), source });
+        const name = NAME(h.command);
+        // An advisory shim entry exits 0 by contract, so even a PreToolUse wiring without `|| true`
+        // cannot refuse through it. Both conditions are required; the shim's own word is final.
+        const shimMode = shimTable?.[name]?.mode ?? null;
+        const blocking = canBlock(event, h.command) && shimMode !== 'advisory';
+        out.push({ event, matcher: g?.matcher ?? '*', name, blocking, source, ...(shimMode ? { shimMode } : {}) });
       }
     }
   }
   return out;
 }
 
+// Which plugin hooks.json does the HOST load? Explicit root → the installed plugin cache (what Claude
+// Code actually reads) → the repo's plugin/ in a dev checkout → none. The answer is reported, not
+// assumed, because on an installed host the repo path does not exist and used to read as "no gates".
+export function resolvePluginRoot({ home = HOME, repo = null, pluginRoot = null } = {}) {
+  if (pluginRoot) return { root: pluginRoot, source: 'explicit' };
+  const reg = readJSON(path.join(home, '.claude/plugins/installed_plugins.json'));
+  const entries = reg?.plugins?.[PLUGIN_ID];
+  const installPath = Array.isArray(entries) ? entries[0]?.installPath : null;
+  if (installPath && isFile(path.join(installPath, 'hooks', 'hooks.json'))) return { root: installPath, source: 'installed' };
+  if (repo && isFile(path.join(repo, 'plugin', 'hooks', 'hooks.json'))) return { root: path.join(repo, 'plugin'), source: 'repo' };
+  return { root: null, source: null };
+}
+
+// Git hooks stop COMMITS, not tool calls — reported in their own list so they never inflate the
+// tool-call count. A worktree's `.git` is a file pointing at <common>/worktrees/<name>; hooks live
+// at <common>/hooks. `.sample` files are not hooks.
+export function gitHooks(repo) {
+  if (!repo) return [];
+  const dotGit = path.join(repo, '.git');
+  let hooksDir = null;
+  try {
+    const st = fs.statSync(dotGit);
+    if (st.isDirectory()) hooksDir = path.join(dotGit, 'hooks');
+    else {
+      const m = fs.readFileSync(dotGit, 'utf8').match(/^gitdir:\s*(.+)$/m);
+      if (m) hooksDir = path.join(path.dirname(path.dirname(m[1].trim())), 'hooks');
+    }
+  } catch { return []; }
+  if (!hooksDir) return [];
+  let names = [];
+  try { names = fs.readdirSync(hooksDir); } catch { return []; }
+  return names
+    .filter((n) => !n.endsWith('.sample') && isFile(path.join(hooksDir, n)))
+    .sort()
+    .map((n) => {
+      const file = path.join(hooksDir, n);
+      let executable = false;
+      try { fs.accessSync(file, fs.constants.X_OK); executable = true; } catch { /* present but will not run */ }
+      return { name: n, path: file, blocking: true, executable, source: 'git' };
+    });
+}
+
 // Every catch the gates have recorded. This file only exists once a gate has actually refused
 // something — an empty ledger is an honest "nothing caught yet", never a failure.
-export function gateBlocks() {
+export function gateBlocks(home = HOME) {
   try {
-    return fs.readFileSync(BLOCKS, 'utf8').trim().split('\n')
+    return fs.readFileSync(path.join(home, '.cache/ruvnet-brain/gate-blocks.jsonl'), 'utf8').trim().split('\n')
       .map((l) => { try { return JSON.parse(l); } catch { return null; } })
       .filter(Boolean);
   } catch { return []; }
 }
 
-export function gatesSurvey({ repo } = {}) {
-  const machine = collect(readJSON(path.join(HOME, '.claude/settings.json'))?.hooks, 'machine');
-  const pluginCfg = repo ? readJSON(path.join(repo, 'plugin/hooks/hooks.json')) : null;
-  const plugin = collect(pluginCfg?.hooks || pluginCfg, 'plugin');
+export function gatesSurvey({ repo, home = HOME, pluginRoot } = {}) {
+  const machine = collect(readJSON(path.join(home, '.claude/settings.json'))?.hooks, 'machine');
+
+  const resolved = resolvePluginRoot({ home, repo, pluginRoot });
+  const pluginPath = resolved.root ? path.join(resolved.root, 'hooks', 'hooks.json') : null;
+  const pluginCfg = pluginPath ? readJSON(pluginPath) : null;
+  const shimTable = resolved.root ? readShimTable(path.join(resolved.root, 'scripts', 'hook-shim.mjs')) : null;
+  const plugin = collect(pluginCfg?.hooks || pluginCfg, 'plugin', shimTable);
+
+  // Blocking gates the launcher KNOWS but hooks.json never wires — they cannot stop anything until
+  // registered. `onDisk` separates "unplugged" from "missing": both are findings, of different kinds.
+  const registeredNames = new Set(plugin.map((g) => g.name));
+  const unregistered = Object.entries(shimTable || {})
+    .filter(([id, e]) => e.mode === 'blocking' && !registeredNames.has(id))
+    .map(([id, e]) => ({ name: id, mode: e.mode, file: e.file, onDisk: isFile(path.join(resolved.root, 'scripts', e.file)) }))
+    .sort((a, b) => a.name.localeCompare(b.name));
+
+  const git = gitHooks(repo);
 
   const all = [...machine, ...plugin];
   const blocking = all.filter((g) => g.blocking);
@@ -89,7 +185,7 @@ export function gatesSurvey({ repo } = {}) {
   // name share a count. That is a real ambiguity and it is narrow; attributing the whole machine's
   // history to whichever directory you happen to be standing in was neither.
   const here = repo ? path.basename(path.resolve(repo)) : null;
-  const allBlocks = gateBlocks();
+  const allBlocks = gateBlocks(home);
   const blocks = here ? allBlocks.filter((b) => b.cwd === here) : allBlocks;
 
   // Same gate, same event, wired both machine-wide AND by the plugin — it runs twice on every
@@ -134,11 +230,18 @@ export function gatesSurvey({ repo } = {}) {
       advisory: all.length - blockingWired,
       blockingDistinct: uniqueBlocking,  // distinct gates that can refuse; ≤ blocking when wired twice
       duplicated,                        // wired twice; runs twice
+      unregisteredBlocking: unregistered.length, // blocking gates the launcher knows but nothing wires
+      gitHooks: git.length,              // stop commits, not tool calls — never added to `blocking`
+      pluginSource: resolved.source,     // 'installed' | 'repo' | 'explicit' | null — which hooks.json was read
       caughtTotal: blocks.length,
       caughtThisWeek: recent.length,
       everRecorded: blocks.length > 0,
     },
     gates: all.sort((a, b) => Number(b.blocking) - Number(a.blocking)),
+    unregistered,
+    git,
+    pluginSource: resolved.source,
+    pluginPath,
     // Newest first — the most recent catch is the one worth reading.
     catches: blocks.slice(-12).reverse(),
     byGate: Object.fromEntries(Object.entries(byGate).map(([k, v]) => [k, v.length])),

package/plugin/scripts/grounding-turn-gate.mjs

@@ -0,0 +1,167 @@
+#!/usr/bin/env node
+/**
+ * grounding-turn-gate.mjs — Stop-time enforcement of "you were told to ground, did you?"
+ *
+ * THE GAP THIS CLOSES, measured rather than assumed. ground-ruvnet.sh's Gate 1 fires a PROMPT-LEVEL
+ * directive — "you MUST call the search_ruvnet MCP tool ... BEFORE stating what any RuvNet tool
+ * can/cannot do" — whenever the user's prompt touches the rUv stack. That directive is advisory: a
+ * prompt is text in context, and rUv's own ADR-G007 names the failure mode by name — "prompts are
+ * advisory. Agents can and do ignore them, especially in long sessions." Every OTHER wall in this
+ * project fires on an ACTION (a Write, a push, a claim); a plain-text ANSWER that never calls a
+ * tool is invisible to all of them, which is the exact shape of continuation-gate.mjs's own
+ * "stopping is the absence of an action" problem, applied to grounding instead of to unfinished
+ * work.
+ *
+ * WHY A NEW HOOK, not an extension of continuation-gate.mjs. continuation-gate.mjs's whole
+ * architecture is a work LEDGER: explicit `--commit-to` items and derived backlog items, each with
+ * an age, a cooldown-guarded force, and a "committed vs observed" vocabulary baked into its header
+ * composition. What this file checks is neither — it is a stateless, single-turn compliance
+ * question ("did Gate 1 fire this turn, and did search_ruvnet answer it?") with no ledger, no age,
+ * and no meaningful "committed vs observed" framing. Folding it into continuation-gate.mjs's
+ * cooldown lock would mean a real ledger force and a same-turn grounding nudge fight over one
+ * shared 20s window, and folding it into that file's header composition would invent a third
+ * category (`header` is currently a strict if/else over exactly two shapes). A second, independent
+ * Stop registration is the surgical change; forcing this into continuation-gate.mjs's shape is not.
+ *
+ * THE MECHANISM, REUSED, NOT INVENTED:
+ *   - Gate 1's regex: imported from ruvnet-gate1-pattern.mjs, the same copy
+ *     grounding-turn-mark.mjs uses, proven byte-identical to ground-ruvnet.sh by
+ *     tests/unit/ruvnet-gate1-pattern.test.mjs. This file does not re-test the prompt itself —
+ *     Stop's payload carries no prompt text — it reads grounding-turn-mark.mjs's marker instead
+ *     (see that file's header for why the split exists).
+ *   - "was search_ruvnet called": the EXISTING evidence grounding-stamp.sh already produces —
+ *     ~/.cache/ruvnet-brain/grounded/<term>, one file per product term, minted ONLY on a genuinely
+ *     successful search (grounding-stamp.sh's own header: stamps mint ONLY on a successful grounded
+ *     result). ground-before-write.sh already trusts this exact directory's file mtimes for its own
+ *     24h freshness check; this file trusts the SAME directory the SAME way, just against a
+ *     narrower window (since the marker's own mtime, not "20 hours ago", is the turn boundary).
+ *     No second "was it searched" signal is invented — a search_ruvnet call this turn mints a stamp
+ *     here exactly as it always has, for exactly the same reason (decision-gate's write gate).
+ *   - The Stop block/continue contract: `{"hookSpecificOutput":{"hookEventName":"Stop",
+ *     "additionalContext":"..."}}` on stdout, exit 0. This is not a new discovery — it is the exact
+ *     contract continuation-gate.mjs already uses and this repo's own tests already prove works on
+ *     BOTH hosts (tests/unit/codex-lifecycle-hooks.test.mjs, "translates the Claude Stop
+ *     continuation envelope into Codex block plus reason" — codex-hook-adapter.mjs's Stop branch
+ *     converts this exact envelope into Codex's `{decision:"block",reason}` wire shape). Blocking a
+ *     Stop is genuinely supported here; this file exercises the already-proven path rather than
+ *     asking a new question of the host.
+ *
+ * LOOP SAFETY: identical checks to continuation-gate.mjs (same reasons, same file) — only an
+ * affirmatively-parsed `stdin` payload with a real `session_id` may force, `stop_hook_active` means
+ * this stop episode has already been continued once and this gate stays silent, and an
+ * interrupted/cancelled turn is never forced. The marker is consumed (deleted) whether or not it
+ * fires, so a genuinely abandoned marker cannot pressure some unrelated later turn.
+ *
+ * FAILS OPEN ALWAYS. Exit 0 unconditionally — a gate that breaks a turn's completion because a
+ * cache directory was unreadable would be disabled within a day.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { readStdinBounded } from './hook-input.mjs';
+import { markerPathFor } from './grounding-turn-mark.mjs';
+
+const HOME = os.homedir();
+const EXIT_ALLOW = 0;
+
+// Same directory grounding-stamp.sh writes and ground-before-write.sh reads — no env override in
+// either of those (they are pure-bash, deliberately dependency-free per ADR-0021), so this reader
+// must resolve the identical default for the two to ever agree. Tests isolate via HOME, exactly as
+// tests/unit/codex-lifecycle-hooks.test.mjs already does for the rest of this hook family.
+const GROUNDED_DIR = path.join(HOME, '.cache', 'ruvnet-brain', 'grounded');
+
+/** Newest mtime (ms since epoch) among grounding-stamp.sh's product-term stamp files, or null if
+ *  the directory is absent/empty/unreadable — never throws, this is a fail-open evidence read. */
+export function newestGroundingStampMs(dir = GROUNDED_DIR) {
+  let entries;
+  try { entries = fs.readdirSync(dir); } catch { return null; }
+  let newest = null;
+  for (const name of entries) {
+    try {
+      const st = fs.statSync(path.join(dir, name));
+      if (!st.isFile()) continue;
+      const ms = st.mtimeMs;
+      if (newest === null || ms > newest) newest = ms;
+    } catch { /* a stamp that vanished mid-scan is not evidence either way */ }
+  }
+  return newest;
+}
+
+/** A little slack for filesystem mtime granularity (some filesystems round to whole seconds), so a
+ *  stamp written the same wall-clock second as the marker is never wrongly judged "before" it. */
+const SKEW_MS = 1500;
+
+/** Pure decision: given the marker's mtime and the newest grounding stamp's mtime, was this turn's
+ *  Gate-1 directive satisfied? Exported so the unit test can drive it without touching the
+ *  filesystem or spawning a process. */
+export function wasGroundedSince(markerMs, newestStampMs) {
+  if (newestStampMs === null) return false;
+  return newestStampMs >= markerMs - SKEW_MS;
+}
+
+async function readHookInput() {
+  // Mirrors continuation-gate.mjs's own three-way source classification exactly (ADR-043 /
+  // Fable #1): only a payload we actually parsed off stdin may ever force a continuation.
+  if (process.stdin.isTTY) return { __source: 'tty' };
+  try {
+    const raw = (await readStdinBounded()).toString('utf8');
+    return { ...JSON.parse(raw || '{}'), __source: 'stdin' };
+  } catch { return { __source: 'unreadable' }; }
+}
+
+async function main() {
+  const hookInput = await readHookInput();
+  if (hookInput.__source !== 'stdin') process.exit(EXIT_ALLOW);
+  if (hookInput.stop_hook_active) process.exit(EXIT_ALLOW);
+  if (hookInput.hook_event_name !== 'Stop' || hookInput.interrupted || hookInput.cancelled) {
+    process.exit(EXIT_ALLOW);
+  }
+  if (!hookInput.session_id) process.exit(EXIT_ALLOW);
+
+  const marker = markerPathFor(hookInput.session_id);
+  if (!marker) process.exit(EXIT_ALLOW);
+
+  let markerStat;
+  try { markerStat = fs.statSync(marker); } catch { process.exit(EXIT_ALLOW); }
+
+  // Consume the marker unconditionally: whether this fires or not, it must never pressure a LATER,
+  // unrelated turn (same reasoning as continuation-gate.mjs's cooldown lock, applied here as a
+  // single-use marker instead of a timed window, because "did this turn ground itself" has no
+  // meaningful reading beyond the one turn it was written for).
+  try { fs.unlinkSync(marker); } catch { /* a marker that vanished between stat and unlink already told us what we needed */ }
+
+  const grounded = wasGroundedSince(markerStat.mtimeMs, newestGroundingStampMs());
+  if (grounded) process.exit(EXIT_ALLOW);
+
+  const lines = [
+    'This turn touched the RuvNet / rUv stack and ground-ruvnet\'s directive required calling the',
+    'search_ruvnet MCP tool before asserting what any RuvNet tool can/cannot do — but no successful',
+    'search_ruvnet call was recorded this turn (checked against the same grounding-stamp evidence',
+    'ground-before-write.sh already trusts).',
+    '',
+    'Do NOT end the turn on an ungrounded rUv-domain answer. Call `search_ruvnet` now with the',
+    'relevant product term(s) in the query, ground your answer in the cited source paths it returns,',
+    'and correct anything you already asserted from memory. Training priors on the rUv stack are',
+    'stale by construction (ADR-0012) — this is not a formality.',
+  ];
+
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'Stop',
+      additionalContext: lines.join('\n'),
+    },
+  }));
+  process.exit(EXIT_ALLOW);
+}
+
+/** Never runs main() merely because a test (or anything else) imported this file for its pure
+ *  helpers — same guard decision-gate.mjs uses, for the same reason (entrypoint-guard-safety). */
+function isMain() {
+  try {
+    if (!process.argv[1]) return false;
+    return fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
+  } catch { return false; }
+}
+
+if (isMain()) main();