ruvnet-brain 4.3.28 → 4.3.29

package/plugin/scripts/decision-gate.mjs

@@ -92,34 +92,30 @@ export const MIN_HEADROOM_MS = 3000;
  *   hijack-ruvnet       the managed-memory boundary (ADR-063): a correctness rule about where data
  *                       goes, ahead of anything about process.
  *   ground-before-write don't write RuvNet-product code ungrounded (ADR-0012).
- *   design-wall         don't ship a visual surface nobody looked at.
  *
  * `unprompted-speech` is LAST and is not really a peer: it is the speech chokepoint, which refuses
- * only for a lesson the user personally opted into blocking. It is included so that Write/Edit and
- * Bash have exactly ONE process that can refuse them — which is the entire invariant — and its
- * allow-path stdout envelope is forwarded untouched.
+ * only for a lesson the user personally opted into blocking. It is included so that Write/Edit have
+ * exactly ONE process that can refuse them — which is the entire invariant — and its allow-path
+ * stdout envelope is forwarded untouched.
+ *
+ * H5 (this repo's own dead-code audit): a 'bash' route used to sit alongside 'write' here, gating
+ * identifier-preflight, spend-guard, degradation-watch, hijack-ruvnet (a SECOND use, alongside its
+ * 'write' one) and design-wall on a PreToolUse-Bash event. It was never registered in
+ * plugin/hooks/hooks.json or codex-hooks.json — continuity-hook-policy.mjs's own header names this
+ * explicitly: "decision-gate's BASH route ... remains reachable through hook-shim's dispatch table
+ * by explicit invocation" only, never wired into the automatic plane. Removed as dead routing, not
+ * as a verdict on the four now-orphaned policies' worth: identifier-preflight.mjs, spend-guard.mjs,
+ * degradation-watch.mjs and design-wall.sh all remain in the tree with their own passing tests
+ * (each exports/exposes pure, independently-tested logic — `check`/`identifierIn`, `dependentEvent`,
+ * etc. — used elsewhere, e.g. tests/unit/lesson-gate.test.mjs imports degradation-watch.mjs's
+ * `dependentEvent` directly to cross-check lesson-hooks.sh's own pattern). Only their SELECTION by
+ * this gate's dead 'bash' route is removed here.
  */
 const POLICY = (id, file, interpreter = 'bash') => ({ id, file, interpreter });
 const REFUSAL_POLICIES = [
   POLICY('protect-state', 'protect-brain-state.sh'),
-  // degradation-watch sits second because it decides whether ANY record this system keeps is real.
-  // Measured 2026-08-13: better_sqlite3.node was built for NODE_MODULE_VERSION 141 against a node
-  // needing 137, ruflo fell back to sql.js, and nothing persisted for three days while every write
-  // printed `[OK] Data stored successfully`. A warning was printed on every one of those writes and
-  // read. It could not stop anything, because a warning is text and text is skimmable — so this is
-  // a refusal instead. It probes only for commands whose truth DEPENDS on durable memory (a lesson
-  // store, a ship), so ordinary Bash pays nothing.
-  POLICY('degradation-watch', 'degradation-watch.mjs', 'node'),
-  // identifier-preflight is FIRST among the cheap checks and costs one file read: it refuses a
-  // command that names a model this machine's CLI does not accept. `codex exec --model gpt-5.6`
-  // (correct: gpt-5.6-sol, in ~/.codex/config.toml) printed a 400 and EXITED 0 into a redirected
-  // file on 2026-08-13, so a 50-minute audit produced nothing and there was no exit code to catch.
-  // It refuses ONLY a positively-known-wrong value and allows every unknown, because a wall that
-  // fabricates a reason is one people learn to route around.
-  POLICY('identifier-preflight', 'identifier-preflight.mjs', 'node'),
   POLICY('hijack-ruvnet', 'hijack-ruvnet.sh'),
   POLICY('ground-before-write', 'ground-before-write.sh'),
-  POLICY('design-wall', 'design-wall.sh'),
   // adr-currency-gate fires on the EDIT, where the pre-push gate fires on the push. Same rule, same
   // machinery (it calls doc-currency.mjs, never a second copy of the logic) — moved to the earliest
   // moment it has enough information. On 2026-08-13 four ADRs went stale together and were caught
@@ -128,22 +124,12 @@ const REFUSAL_POLICIES = [
   // DEBT, not change: you may edit governed code freely, but not while a document governing it is
   // still unreconciled from the last round.
   POLICY('adr-currency', 'adr-currency-gate.mjs', 'node'),
-  // spend-guard refuses an agent FLEET that would inherit metered API keys. The $1,600 of
-  // agentic-qe#557: ~374 headless agents billed api.anthropic.com per-token for 11 hours while the
-  // Claude Max subscription sat unused. The rule was stored, ratified and severity:high — and
-  // delivered as advisory text, which is what gets skimmed. `claude` and `codex` are the seats and
-  // are never touched; OPENROUTER is metered and deliberately allowed, because cost-optimal routing
-  // exists to spend it and a gate that fires on the feature you configured is the gate you disable.
-  POLICY('spend-guard', 'spend-guard.mjs', 'node'),
 ];
 const SPEECH = { id: 'unprompted-speech', file: 'unprompted-runtime.mjs', interpreter: 'node' };
 
 /** Which policies apply to which PreToolUse sub-event, mirroring the matchers they replaced. */
 const REGISTRY = {
   'write': ['protect-state', 'hijack-ruvnet', 'ground-before-write', 'adr-currency'],
-  // degradation-watch is bash-only on purpose: the acts it guards — `ruflo memory store`, `git
-  // push` — are commands, so the dependency is observable there and nowhere else.
-  'bash': ['protect-state', 'identifier-preflight', 'spend-guard', 'degradation-watch', 'hijack-ruvnet', 'design-wall'],
 };
 
 export function policiesFor(event, registry = REGISTRY, all = REFUSAL_POLICIES) {
@@ -156,33 +142,22 @@ export function policiesFor(event, registry = REGISTRY, all = REFUSAL_POLICIES)
 /**
  * ── APPLICABILITY: THE CHEAPEST POLICY IS THE ONE NEVER SPAWNED ──────────────────────────────────
  *
- * degradation-watch was spawned for EVERY Bash call and then exited 0 on its own second line — its
- * `dependentEvent()` returns null for anything that is not a ship or a memory store, which is nearly
- * everything. Measured here on 2026-08-14: 63-65ms of node boot bought to learn that `ls -la` is not
- * `git push`, on every single Bash tool call, on the machine where a node boot costs 60ms. On the
- * audit's machine that same boot is ~300ms.
- *
- * The predicate is IMPORTED, never restated. Copying the DEPENDENT_COMMANDS regexes up here would
- * make two answers to one question and guarantee they drift — the same reason adr-currency-gate calls
- * doc-currency.mjs instead of carrying a second copy of the logic.
- *
- * FAIL TOWARD RUNNING THE POLICY. If the import fails, or the predicate throws, the policy is
- * spawned exactly as before: this is a latency optimisation and it may never become a way to silently
- * disable a guard.
+ * H5: this table's one entry (degradation-watch, applicable only to the now-removed 'bash' route)
+ * was removed along with that route — see the REGISTRY comment above. The mechanism itself stays:
+ * an empty table costs nothing (skipReason below returns null immediately for every policy, so every
+ * currently-registered policy is consulted exactly as if this file did not exist), and it is the
+ * correct extension point for a future policy that only applies to SOME invocations of its event.
  */
-let dependentEvent = null;   // set from degradation-watch.mjs at startup; null → spawn it as before
 /**
  * Resolved once per invocation by the runtime block below; null means no bash on this host.
  *
- * Declared HERE, above that block, and not next to runPolicy() where it reads more naturally: the
- * `if (isMain())` block runs during module evaluation, so a `let` declared after it sits in the
- * temporal dead zone and the assignment throws — the identical mistake `speechEventFor` was already
- * a hoisted `function` to avoid, recorded a few lines further down.
+ * Declared HERE, and not next to runPolicy() where it reads more naturally: the `if (isMain())`
+ * block runs during module evaluation, so a `let` declared after it sits in the temporal dead zone
+ * and the assignment throws — the identical mistake `speechEventFor` was already a hoisted
+ * `function` to avoid, recorded a few lines further down.
  */
 let BASH = null;
-const APPLICABILITY = {
-  'degradation-watch': (input) => (dependentEvent ? Boolean(dependentEvent(input.command)) : true),
-};
+const APPLICABILITY = {};
 
 /** Returns a skip reason, or null if the policy must be consulted. */
 export function skipReason(policy, toolInput, table = APPLICABILITY) {
@@ -239,18 +214,15 @@ if (isMain()) {
   const payload = readPayload();
   const selected = policiesFor(EVENT);
   // An unknown event is not an occasion to refuse anything. Same rule as unprompted-runtime's
-  // "never speak on a guess", pointed at the other decision.
-  if (!selected.length && EVENT !== 'write' && EVENT !== 'bash') process.exit(ALLOW);
+  // "never speak on a guess", pointed at the other decision. 'write' is the only registered route
+  // (H5 removed the dead 'bash' one — see the REGISTRY comment above), so it is the only exception.
+  if (!selected.length && EVENT !== 'write') process.exit(ALLOW);
 
   const budgetMs = Number(process.env.RUVNET_DECISION_BUDGET_MS) || DEFAULT_BUDGET_MS;
   const deadline = started + budgetMs;
   // Resolved ONCE. On win32 resolveBash() can shell out to `where.exe`; four bash policies meant up
   // to four of those per tool call, for an answer that cannot change mid-invocation.
   BASH = resolveBash();
-  // Best-effort, and deliberately not a static import: a missing or broken degradation-watch.mjs
-  // must cost us the optimisation, not the whole gate. `runPolicy` already tolerates a missing
-  // policy file; a top-level `import` of it would have made that tolerance a lie.
-  try { ({ dependentEvent } = await import('./degradation-watch.mjs')); } catch { dependentEvent = null; }
 
   const trace = [];            // one row per policy — surfaced by RUVNET_DECISION_TRACE=1
   const unconsulted = [];      // policies the budget cost us. NEVER silent; see reportBudget().

package/plugin/scripts/ground-ruvnet.sh

@@ -50,6 +50,23 @@ fi
 TEXT=$(printf '%s' "$INPUT" | jq -r '.prompt // .user_prompt // .input // empty' 2>/dev/null)
 [ -z "$TEXT" ] && TEXT="$INPUT"
 
+# ── H2: HARNESS-GENERATED MESSAGES ARE NOT A USER'S PROMPT. ──────────────────────────────────────
+# Background task notifications, slash-command scaffolding, and other harness-authored bookkeeping
+# arrive on UserPromptSubmit exactly like real user text, wrapped in tags such as
+# <task-notification>, <local-command-caveat>, <command-name>, <local-command-stdout>, and
+# <system-reminder>. None of that is something a human typed, so none of Gates 1-4 below should ever
+# fire on it — injecting a grounding directive in response to the harness's own bookkeeping message
+# is noise on every background-task turn. This is a literal, byte-identical copy of
+# plugin/scripts/hook-input.mjs's HARNESS_GENERATED_SHELL_PATTERN (SOURCE OF TRUTH there), kept as a
+# copy here (not a `node hook-input.mjs` call) for the same reason Gate 1's own pattern below is a
+# copy: this is a hot, every-prompt hook (see the bounded-read comment above), and a process spawn
+# per prompt is exactly the kind of non-surgical cost this file's header warns against.
+# tests/unit/hook-input-harness.test.mjs proves this copy is byte-identical to
+# HARNESS_GENERATED_SHELL_PATTERN and that both agree with isHarnessGenerated() behaviorally.
+if printf '%s' "$TEXT" | grep -qiE '\[Your previous response|\[Request interrupted|</?system-reminder>|</?(command-name|command-message|command-args|local-command-stdout|local-command-stderr|local-command-caveat|task-notification|function_results|function_calls|budget)\b|^[[:space:]]*Caveat:|Base directory for this skill:|This session is being continued from a previous conversation|^[[:space:]]*#[[:space:]]*claudeMd\b|\[INTELLIGENCE\]'; then
+  exit 0
+fi
+
 # ── QUIET-PROMPT FAST PATH. ────────────────────────────────────────────────────────────────────
 # A hook whose output contract is silence must not pay the full stack-currency/project-state scan
 # before discovering that nothing can fire. This mattered on a packed Windows install: immediately
@@ -403,8 +420,19 @@ fi
 # The bug this kills: line "5. CLEARED TO GO" below ends every build response with "Want me to
 # build it now?" — a question asked to an EMPTY ROOM inside a /loop. That is what a real user's
 # "it wouldn't run autonomously" looked like from the outside.
+#
+# H3 (fixed): the ORIGINAL fix over-corrected into a NEW bug in the opposite direction. Matching
+# conversational phrases — "autonomous", "unattended", "don't stop", "keep going/working", "soak
+# run" — meant an ATTENDED human saying ordinary things ("please keep working on this", "don't stop
+# until the tests pass") got the full AUTONOMOUS MODE block injected: "no human is watching", "NEVER
+# halt to ask", ignore the CLEARED-TO-GO checkpoint question. A human who is plainly IN the
+# conversation is not an empty room; inferring "nobody is watching" from prose a watching human just
+# typed is exactly backwards. AUTON is now restricted to signals a HUMAN does not type by hand: the
+# `<<autonomous-loop` sentinel a real unattended harness wraps its own prompts in, a `/loop` slash
+# command LEADING the text (the actual mechanism that starts a loop — see the `loop` skill — not the
+# bare word "loop" appearing anywhere), or the explicit RUVNET_AUTONOMOUS=1 environment signal.
 AUTON=0
-if printf '%s' "$TEXT" | grep -qiE '/loop|\bautonomous(ly)?\b|\bunattended\b|do(n.t| not) stop|keep (working|going)( until| on)?|\bsoak run\b|<<autonomous-loop'; then
+if printf '%s' "$TEXT" | grep -qiE '<<autonomous-loop|^[[:space:]]*/loop\b'; then
   AUTON=1
 fi
 [ "${RUVNET_AUTONOMOUS:-0}" = "1" ] && AUTON=1
@@ -492,9 +520,54 @@ if [ "$AUTON" -eq 1 ]; then
    and a wait.
 EOF
   if [ -f "$CP_FILE" ]; then
-    echo "[RuvNet Brain — RESUME: your prior checkpoint. Continue from 'next'; do not repeat done work.]"
-    cat "$CP_FILE" 2>/dev/null
-    echo ""
+    # H3: a checkpoint from a loop that ended days or weeks ago used to be injected UNCONDITIONALLY —
+    # resumed as though it were this session's own live state, with no age check at all.
+    #
+    # NOT resolved via scripts/loop-checkpoint.mjs (a first version of this fix did, and shipped
+    # tests/unit/payload-self-contained.test.mjs RED: loop-checkpoint.mjs lives only at repo-root
+    # scripts/, never inside plugin/scripts/, and only `plugin/` reaches a real install — every
+    # shipped layout flattens it, so that reference resolved to nothing everywhere except this
+    # repo's own dogfood checkout, and the feature silently degraded to "always inject" for every
+    # real user). The 24h threshold is instead inlined here as `node -e`, no file reference at all —
+    # payload-self-contained by construction. scripts/loop-checkpoint.mjs's own exported
+    # CHECKPOINT_STALE_MS (used by scripts/single-source-check.mjs's E1 audit) is the SOURCE OF
+    # TRUTH for the number; tests/unit/ground-ruvnet-staleness-inline.test.mjs asserts this literal
+    # matches it, same drift-test idiom as Gate 1's own bash/JS pattern copy.
+    STALE_RC=9
+    STALE_AGE=""
+    if command -v node >/dev/null 2>&1; then
+      UPDATED_AT=$(node -e '
+        let raw = ""; process.stdin.on("data", (c) => { raw += c; });
+        process.stdin.on("end", () => {
+          try { const cp = JSON.parse(raw); process.stdout.write(typeof cp.updatedAt === "string" ? cp.updatedAt : ""); }
+          catch { /* empty stdout: not a valid checkpoint */ }
+        });
+      ' < "$CP_FILE" 2>/dev/null)
+      if [ -n "$UPDATED_AT" ]; then
+        STALE_AGE=$(node -e '
+          const STALE_MS = 24 * 60 * 60 * 1000;
+          const ms = Date.parse(process.argv[1]);
+          if (!Number.isFinite(ms)) process.exit(2);
+          const ageMs = Date.now() - ms;
+          if (ageMs < STALE_MS) process.exit(0);
+          process.stdout.write(String(Math.floor(ageMs / 86_400_000)));
+          process.exit(1);
+        ' "$UPDATED_AT" 2>/dev/null)
+        STALE_RC=$?
+      else
+        STALE_RC=2
+      fi
+    fi
+    if [ "$STALE_RC" -eq 1 ]; then
+      echo "[RuvNet Brain — a stale checkpoint (age ${STALE_AGE} days) was ignored; starting fresh rather than resuming a plan that old.]"
+    else
+      # RC 0 (fresh) — inject as intended. RC 2 (no parseable `updatedAt`) or RC 9 (no node on this
+      # host) both mean "unknown age", which must never be treated as PROVEN stale — fall back to
+      # the pre-fix behavior of injecting rather than silently dropping a checkpoint we cannot judge.
+      echo "[RuvNet Brain — RESUME: your prior checkpoint. Continue from 'next'; do not repeat done work.]"
+      cat "$CP_FILE" 2>/dev/null
+      echo ""
+    fi
   fi
 fi
 

package/plugin/scripts/grounding-stamp.sh

@@ -72,6 +72,21 @@ case "$INPUT" in
   *) exit 0 ;;
 esac
 
+DIR="$HOME/.cache/ruvnet-brain/grounded"
+mkdir -p "$DIR" 2>/dev/null || exit 0
+
+# ── 2.5. THE ANY-SEARCH MARKER (H1 / GitHub #316). ──────────────────────────────────────────────
+# grounding-turn-gate.mjs's Stop-time check must treat ANY successful search_ruvnet this turn as
+# satisfying "a search happened" — independent of whether the query text below happens to contain
+# one of the recognised product terms. A query like "how should agent handoffs stay consistent"
+# grounds just as genuinely as one that names a product by name, and nothing should require the
+# model to re-word a real search just to satisfy a keyword scan. This mints into the SAME
+# directory grounding-turn-gate.mjs already scans for the newest mtime (newestGroundingStampMs),
+# so no change is needed on that side. Written unconditionally now that the success banner (step 2)
+# is confirmed, before the QUERY parse below — a search can succeed with a query this regex cannot
+# extract, and that must not cost it this signal.
+: > "$DIR/.any-search" 2>/dev/null || true
+
 # ── 3. WHICH terms — from the QUERY only, as it always was. The first raw "query" key in the JSON is
 # tool_input's; inside tool_response text the quotes are escaped (\"query\") so they cannot match.
 QUERY=""
@@ -79,12 +94,26 @@ re='"query"[[:space:]]*:[[:space:]]*"([^"]*)"'
 [[ $INPUT =~ $re ]] && QUERY="${BASH_REMATCH[1]}"
 [ -n "$QUERY" ] || exit 0
 
-DIR="$HOME/.cache/ruvnet-brain/grounded"
-mkdir -p "$DIR" 2>/dev/null || exit 0
-
-# Same product-term list as ground-before-write.sh — ONE list per concept, mirrored in both
+# WRITE_GATE terms — same product-term list as ground-before-write.sh's own copy, mirrored in both
 # files on purpose (a shared sourced file would add a dependency a blocking hook must not have).
-for t in agentdb metaharness ruvector aidefence agentic-flow agentic-qe ruv-swarm rvf ruflo; do
+# Do not change this list without mirroring ground-before-write.sh's copy — H1 keeps that gate's
+# per-product WRITE semantics untouched (see decision-gate.mjs / ground-before-write.sh for why
+# these 9 are scoped to code hand-rolling risk, not general rUv-ecosystem conversation).
+WRITE_GATE_TERMS="agentdb metaharness ruvector aidefence agentic-flow agentic-qe ruv-swarm rvf ruflo"
+
+# GATE-1-ONLY additions (H1 / GitHub #316): ruvnet-gate1-pattern.mjs's RUVNET_GATE1_PATTERN is the
+# ONE owner of this vocabulary — grounding-turn-mark.mjs already arms the Stop-time turn gate from
+# it. Before this fix, grounding-stamp.sh only recognised the 9 WRITE_GATE_TERMS above, so a search
+# literally about "ruvnet" (or "sparc", "qudag", "claude-flow", ...) minted no per-term stamp, and
+# combined with the missing any-search marker above, grounding-turn-gate.mjs wrongly reported "no
+# successful search_ruvnet call this turn" even though one had just happened. Terms already covered
+# by WRITE_GATE_TERMS are not repeated here. tests/unit/grounding-stamp-terms.test.mjs asserts
+# WRITE_GATE_TERMS plus GATE1_ONLY_TERMS together cover every RUVNET_GATE1_PATTERN alternative, so a
+# future addition to that pattern left unmirrored here goes red immediately (same idiom as
+# tests/unit/ruvnet-gate1-pattern.test.mjs's byte-identity check against ground-ruvnet.sh).
+GATE1_ONLY_TERMS="ruvnet agenticow rulake ruview rupixel ruv-fann synthlang dspy qudag safla cve-bench sparc swarm claude-flow ruv"
+
+for t in $WRITE_GATE_TERMS $GATE1_ONLY_TERMS; do
   [[ $QUERY == *"$t"* ]] && { : > "$DIR/$t" 2>/dev/null || true; }
 done
 

package/plugin/scripts/grounding-turn-gate.mjs

@@ -35,8 +35,14 @@
  *     result). ground-before-write.sh already trusts this exact directory's file mtimes for its own
  *     24h freshness check; this file trusts the SAME directory the SAME way, just against a
  *     narrower window (since the marker's own mtime, not "20 hours ago", is the turn boundary).
- *     No second "was it searched" signal is invented — a search_ruvnet call this turn mints a stamp
- *     here exactly as it always has, for exactly the same reason (decision-gate's write gate).
+ *     UPDATE (H1 / GitHub #316): per-product term files alone under-reported "was it searched" —
+ *     grounding-stamp.sh used to recognise only a 9-term write-gate vocabulary that omitted `ruvnet`
+ *     itself (and every other Gate-1 term), so a search literally about "ruvnet" minted nothing and
+ *     this gate wrongly fired. grounding-stamp.sh now also writes a vocabulary-independent
+ *     `.any-search` marker into this SAME directory on every successful search regardless of query
+ *     content, so newestGroundingStampMs below (which already scans every file, by name-agnostic
+ *     design) sees it with no code change needed here — a search_ruvnet call this turn always mints
+ *     evidence here now, not only when its query happens to name a recognised product.
  *   - The Stop block/continue contract: `{"hookSpecificOutput":{"hookEventName":"Stop",
  *     "additionalContext":"..."}}` on stdout, exit 0. This is not a new discovery — it is the exact
  *     contract continuation-gate.mjs already uses and this repo's own tests already prove works on

package/plugin/scripts/grounding-turn-mark.mjs

@@ -34,7 +34,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { readStdinBounded } from './hook-input.mjs';
+import { readStdinBounded, isHarnessGenerated } from './hook-input.mjs';
 import { ruvnetGate1Matches } from './ruvnet-gate1-pattern.mjs';
 
 const HOME = os.homedir();
@@ -54,6 +54,11 @@ export function shouldMark(hookInput) {
   if (!hookInput || hookInput.hook_event_name !== 'UserPromptSubmit') return false;
   if (!hookInput.session_id) return false;
   const text = String(hookInput.prompt ?? hookInput.user_prompt ?? hookInput.input ?? '');
+  // H2: a background task notification, slash-command scaffold, or other harness-authored message
+  // arrives on UserPromptSubmit exactly like real user text — arming the Stop-time grounding gate off
+  // one of these (because it happens to mention a rUv term) would demand a search_ruvnet call to
+  // close out a "turn" nobody had a hand in.
+  if (isHarnessGenerated(text)) return false;
   return ruvnetGate1Matches(text);
 }
 

package/plugin/scripts/hook-input.mjs

@@ -127,6 +127,60 @@ export function rawToolResponse(ev) {
   return ev.tool_response;
 }
 
+// ── HARNESS-GENERATED PROMPT DETECTION (H2) ─────────────────────────────────────────────────────
+//
+// WHY THIS LIVES HERE, and not only in scripts/correction-detect.mjs where it started. Background
+// task notifications, slash-command scaffolding, and other harness-authored bookkeeping arrive on
+// UserPromptSubmit exactly like real user text — wrapped in tags such as <task-notification>,
+// <local-command-caveat>, <command-name>, <local-command-stdout>, and <system-reminder>. None of
+// that is something a human typed, but before this fix every UserPromptSubmit consumer that reads
+// `prompt`/`user_prompt`/`input` reacted to it as if it were a real prompt: grounding-turn-mark.mjs
+// could arm the Stop-time grounding gate off a harness message that happens to mention a rUv term,
+// unprompted-runtime.mjs's producers could fire advisories at a background notification, and
+// capacity-aware-parallel-work.mjs could recommend a parallel-work fan-out for text nobody wrote.
+// scripts/correction-detect.mjs already carried the exact regex list needed to recognise these
+// (HARNESS_TEMPLATES, built from live corpus evidence — see that file's header for the measured
+// 29%-of-holdout-pool finding that justified it) but as a private, unexported-to-this-purpose copy
+// nothing else could reuse. This is now the ONE owner; correction-detect.mjs re-exports its old name
+// from here instead of keeping its own literal array (tests/unit/hook-input-harness.test.mjs proves
+// the two never drift).
+export const HARNESS_GENERATED_PATTERNS = [
+  /\[Your previous response/i,
+  /\[Request interrupted/i,
+  /<\/?system-reminder>/i,
+  /<\/?(?:command-name|command-message|command-args|local-command-stdout|local-command-stderr|local-command-caveat|task-notification|function_results|function_calls|budget)\b/i,
+  /^\s*Caveat:/i,
+  /Base directory for this skill:/i,
+  /This session is being continued from a previous conversation/i,
+  /^\s*#\s*claudeMd\b/im,
+  /\[INTELLIGENCE\]/i,
+];
+
+/** True when `promptText` is harness-authored bookkeeping rather than something a user typed. */
+export function isHarnessGenerated(promptText) {
+  const text = typeof promptText === 'string' ? promptText : String(promptText ?? '');
+  if (!text) return false;
+  return HARNESS_GENERATED_PATTERNS.some((re) => re.test(text));
+}
+
+/**
+ * The bash-portable EQUIVALENT of isHarnessGenerated(), for ground-ruvnet.sh — a hot, every-prompt
+ * hook (see its own header on the 38s-regression bounded-read fix) that must not pay a `node` spawn
+ * per prompt just for this check. This constant is exactly what ground-ruvnet.sh embeds as its own
+ * `grep -qiE` literal (SOURCE OF TRUTH here — tests/unit/hook-input-harness.test.mjs parses
+ * ground-ruvnet.sh's copy and asserts byte-identity, same idiom as ruvnet-gate1-pattern.mjs's own
+ * copy-with-a-drift-test for Gate 1). Its relationship to HARNESS_GENERATED_PATTERNS above is
+ * BEHAVIORAL parity only, not byte-identity: that is an array of independently-flagged regexes (one
+ * uses the 'm' flag) with no single source ERE it could be copied from verbatim, so the same test
+ * instead proves real `grep -qiE` against this string agrees with isHarnessGenerated() on
+ * representative inputs — the same idiom ruvnet-gate1-pattern.test.mjs uses for ITS third,
+ * non-identity assertion. POSIX `[[:space:]]` is used instead of `\s` and plain `(...)` instead of
+ * `(?:...)` — GNU/PCRE extensions with no POSIX ERE guarantee — because this string must run under
+ * whatever `grep` a user's shell resolves to, not only the one on the machine that wrote it.
+ */
+export const HARNESS_GENERATED_SHELL_PATTERN =
+  '\\[Your previous response|\\[Request interrupted|</?system-reminder>|</?(command-name|command-message|command-args|local-command-stdout|local-command-stderr|local-command-caveat|task-notification|function_results|function_calls|budget)\\b|^[[:space:]]*Caveat:|Base directory for this skill:|This session is being continued from a previous conversation|^[[:space:]]*#[[:space:]]*claudeMd\\b|\\[INTELLIGENCE\\]';
+
 /** Arbitrary dotted-path lookup (e.g. "tool_input.file_path"); "" if any segment is missing. */
 export function field(ev, dottedPath) {
   if (!ev || !dottedPath) return '';

package/plugin/scripts/hook-shim.mjs

@@ -108,6 +108,16 @@ const TABLE = {
   // one is the sole writer of unprompted BYTES, this one is the sole author of a REFUSAL. The four
   // policies it consults are unchanged and still individually tested; the gate only composes them.
   'decision-gate':    { file: 'decision-gate.mjs',   interpreter: 'node', mode: 'blocking', offBehavior: 'run', stdinBytes: 65536 },
+  // H5 CORRECTION (2026-09-26): a first pass removed these two TABLE entries as "retired dead code",
+  // since neither id is dispatched by plugin/hooks/hooks.json, plugin/hooks/codex-hooks.json, or this
+  // repo's .claude/settings.json. That broke a REAL test:
+  // tests/integration/codex-dispatch-cwd-divergence.test.mjs fires the genuine
+  // codex-hook.mjs -> codex-hook-adapter.mjs -> hook-shim.mjs 'learn-capture' chain to prove a real,
+  // shipped cross-host CWD-divergence fix (learn-capture.sh's project-containment check, #85/#107) —
+  // it needs the id to actually resolve through this TABLE, exactly as continuity-hook-policy.mjs's
+  // own header already says: "remains reachable through hook-shim's dispatch table by explicit
+  // invocation". Restored. wired-check.mjs's H6 fix does not depend on these keys existing either
+  // way — it stopped trusting hook-shim.mjs as a blind generic spawner, not their presence here.
   'learn-capture':    { file: 'learn-capture.sh',    interpreter: 'bash', mode: 'advisory', offBehavior: 'silence' },
   'learn-flush':      { file: 'learn-flush.mjs',     interpreter: 'node', mode: 'advisory', offBehavior: 'silence' },
   'session-snapshot': { file: 'session-snapshot-hook.mjs', interpreter: 'node', mode: 'advisory', offBehavior: 'run', stdinBytes: 65536 },

package/plugin/scripts/memory-doctor.mjs

@@ -45,6 +45,10 @@ import { canonicalPath, pathIdentity } from './project-identity.mjs';
 
 const HOME = os.homedir();
 const DEFAULT_SCAN_ROOTS = ['Code', 'code', 'src', 'source', 'projects', 'dev', 'work'];
+const DEFAULT_PROJECT_VENDOR = Object.freeze([
+  '/clones/', '/node_modules/', '/vendor/', '/upstream/', '/ruvnet-repos/', '/ruvnet_repos/',
+  '/ruvnet-packages/', '/.targets/', '.claude-backup', '_snapshots',
+]);
 
 // Telemetry namespaces: high-volume, unembedded, zero-signal. Written by the npx hook calls.
 // Counted separately so "you have 11,000 memories" is never mistaken for "you have 11,000 lessons".
@@ -171,6 +175,45 @@ export function candidateRoots({
   return [...roots.values()].sort();
 }
 
+/**
+ * Enumerate project directories once for wiring/reconciliation consumers. The result is canonical
+ * and de-duplicated by filesystem identity, so symlinked roots and case aliases cannot double-count
+ * a project. `purpose` is retained in the interface for callers that need to document a narrower
+ * scan without creating another traversal policy.
+ */
+export function findProjects(root, { purpose = 'general', maxDepth = 4, vendor = [] } = {}) {
+  if (typeof root !== 'string' || !root.trim()) return [];
+  const exclusions = [...DEFAULT_PROJECT_VENDOR, ...vendor].map(String);
+  const found = new Map();
+  const canonicalRoot = canonicalPath(root);
+  if (!canonicalRoot) return [];
+  const walk = (dir, depth) => {
+    if (depth > maxDepth) return;
+    let entries;
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const entry of entries) {
+      const candidate = path.join(dir, entry.name);
+      if (exclusions.some((marker) => `${candidate}/`.includes(marker))) continue;
+      if (entry.isDirectory()) {
+        if (entry.name === '.claude') {
+          const identity = pathIdentity(dir) ?? canonicalPath(dir) ?? dir;
+          found.set(identity, canonicalPath(dir) ?? dir);
+          continue;
+        }
+        if (entry.name.startsWith('.') || entry.name === 'node_modules') continue;
+        walk(candidate, depth + 1);
+      } else if (entry.name === '.mcp.json') {
+        const identity = pathIdentity(dir) ?? canonicalPath(dir) ?? dir;
+        found.set(identity, canonicalPath(dir) ?? dir);
+      }
+    }
+  };
+  walk(canonicalRoot, 0);
+  // Keep purpose observable to profilers without changing the stable result shape.
+  void purpose;
+  return [...found.values()].sort();
+}
+
 // Keyed by pathIdentity for the same reason candidateRoots is: one store reached by two names is
 // one store. Values are the canonical spelling, which is what every caller reads back.
 function storesBelow(root) {

package/plugin/scripts/nightly-controller.mjs

@@ -55,7 +55,12 @@ function schedulerEnvironment(env) {
     throw new Error('RUVNET_CONSOLE_ROOT must be an absolute path');
   }
   const isolatedHome = path.resolve(fixtureRoot);
-  if (isolatedHome === path.resolve(os.homedir())) {
+  // The real system home, NOT os.homedir() — os.homedir() reads process.env.HOME, which a caller
+  // isolating a fixture has typically ALREADY set to this same isolatedHome (consoleFixtureEnvironment
+  // does exactly this), so comparing against it made this guard trip on every correctly-isolated
+  // fixture instead of only on an accidental real-home leak. os.userInfo().homedir is the OS user
+  // database entry and ignores the HOME env var override, so it still names the real home here.
+  if (isolatedHome === path.resolve(os.userInfo().homedir)) {
     throw new Error('RUVNET_CONSOLE_ROOT must not be the real user home in test mode');
   }
   return { ...env, HOME: isolatedHome, USERPROFILE: isolatedHome };

package/plugin/scripts/project-progression-contract.mjs

@@ -40,6 +40,23 @@ const STATE_VALUE_FIELDS = Object.freeze([
   'currentGoal', 'acceptanceContract', 'activeProcess', 'activeStep', 'nextAction',
 ]);
 
+// Canonical field ownership. Producers may fill a field only from the listed durable sources;
+// readers/checkpoints preserve this provenance and surface conflicts instead of silently choosing.
+export const PROGRESSION_FIELD_AUTHORITY = Object.freeze({
+  currentGoal: Object.freeze(['ledger', 'prior-head', 'owner-note', 'transcript-derived']),
+  nextAction: Object.freeze(['ledger', 'prior-head']),
+  acceptanceContract: Object.freeze(['prior-head', 'ledger']),
+  plan: Object.freeze(['ledger', 'prior-head']),
+  completed: Object.freeze(['ledger', 'prior-head']),
+  inProgress: Object.freeze(['ledger', 'prior-head']),
+  decisions: Object.freeze(['ledger', 'owner-note', 'prior-head']),
+  changedFiles: Object.freeze(['git']),
+  sourceIdentity: Object.freeze(['git']),
+});
+export function fieldAuthorityAllows(field, source) {
+  return PROGRESSION_FIELD_AUTHORITY[field]?.includes(source) === true;
+}
+
 function eventKeyFor(value) {
   const identityDigest = digestCanonical({
     projectId: value.projectIdentity.id,

package/plugin/scripts/project-progression-hook.mjs

@@ -96,12 +96,24 @@ function toolAction(payload) {
   const responseRecord = response && typeof response === 'object' && !Array.isArray(response)
     ? response
     : null;
-  const exitCode = responseRecord && [responseRecord.exit_code, responseRecord.exitCode, responseRecord.status]
+  const explicitCode = responseRecord && [responseRecord.exit_code, responseRecord.exitCode, responseRecord.status]
     .find((value) => Number.isSafeInteger(value));
-  const interrupted = responseRecord?.interrupted === true;
-  const failed = interrupted || (Number.isSafeInteger(exitCode) && exitCode !== 0);
+  const responseText = typeof response === 'string' ? response : '';
+  // Native host terminal envelopes may serialize an exact `Exit code: N` line. Do not
+  // scan arbitrary prose: tool output often quotes logs or examples containing `status: 0`.
+  const textualCode = responseText.match(/^\s*Exit code:\s*(-?\d+)\s*$/i);
+  const exitCode = Number.isSafeInteger(explicitCode)
+    ? explicitCode
+    : textualCode ? Number(textualCode[1]) : undefined;
+  const interrupted = responseRecord?.interrupted === true || responseRecord?.signal === 'SIGINT';
+  const explicitError = responseRecord?.isError === true || payload.is_error === true;
+  const declaredOutcome = ['success', 'failure', 'interrupted', 'unknown'].includes(responseRecord?.outcome)
+    ? responseRecord.outcome : null;
+  const failed = explicitError || (Number.isSafeInteger(exitCode) && exitCode !== 0);
+  const terminal = failed || Number.isSafeInteger(exitCode)
+    || responseRecord?.success === true || responseRecord?.ok === true;
   const outcome = payload.hook_event_name === 'PostToolUse'
-    ? (failed ? 'failure' : response === undefined ? 'unknown' : 'success')
+    ? (interrupted ? 'interrupted' : failed ? 'failure' : declaredOutcome || (terminal ? 'success' : 'unknown'))
     : 'pending';
   const observation = {
     trigger: payload.hook_event_name,
@@ -111,6 +123,7 @@ function toolAction(payload) {
     outcome,
     ...(Number.isSafeInteger(exitCode) ? { exitCode } : {}),
     ...(interrupted ? { interrupted: true } : {}),
+    ...(explicitError ? { isError: true } : {}),
   };
   if (responseRecord) {
     const stdout = boundedText(responseRecord.stdout);
@@ -133,7 +146,7 @@ function enrichStateWithObservation(state, payload) {
   return {
     ...state,
     commands: [...commands, observation],
-    ...(observation.outcome === 'failure' ? { failures: [...failures, observation] } : {}),
+    ...(observation.outcome === 'failure' || observation.outcome === 'interrupted' ? { failures: [...failures, observation] } : {}),
   };
 }
 

package/plugin/scripts/project-progression-producer.mjs

@@ -30,7 +30,7 @@
  */
 import crypto from 'node:crypto';
 import path from 'node:path';
-import { digestCanonical, redactProgression, restoreProjectProgression } from './project-progression-contract.mjs';
+import { digestCanonical, fieldAuthorityAllows, redactProgression, restoreProjectProgression } from './project-progression-contract.mjs';
 import { readOwnerNote, readSourceIdentity, readTranscriptReference, readWorkLedger } from './project-progression-sources.mjs';
 import { withProgressionReader } from './project-progression-reader.mjs';
 
@@ -132,30 +132,34 @@ export function buildProjectProgression({
   const priorState = heads.length === 1 ? heads[0].completeProjectState : null;
 
   const provenance = {};
-  const record = (field, sourceName) => { provenance[field] = marker(sourceName); };
+  const record = (field, sourceName) => {
+    if (sourceName !== 'none' && !fieldAuthorityAllows(field === 'sourceIdentity' ? 'sourceIdentity' : field, sourceName)) {
+      throw new Error(`source ${sourceName} is not authoritative for progression field ${field}`);
+    }
+    provenance[field] = marker(sourceName);
+  };
 
-  // GOAL — the ledger's oldest open item is what the user actually committed to; the owner note and
-  // the prior head come next; the transcript is the last resort and is never authoritative.
+  // GOAL — the ledger's oldest open item is what the user actually committed to. A coherent prior
+  // head carries that commitment forward; an owner note or transcript can provide context only when
+  // no durable goal exists. Neither contextual source is an instruction.
   let currentGoal = ledger.open[0] ?? null;
   if (currentGoal) record('currentGoal', 'ledger');
   else if (typeof priorState?.currentGoal === 'string' && priorState.currentGoal) {
     currentGoal = priorState.currentGoal;
     record('currentGoal', 'prior-head');
-  } else if (transcript.derivedGoal) {
-    currentGoal = transcript.derivedGoal;
-    record('currentGoal', 'transcript-derived');
   } else if (note?.excerpt) {
     currentGoal = note.excerpt.split('\n')[0].slice(0, 240);
     record('currentGoal', 'owner-note');
+  } else if (transcript.derivedGoal) {
+    currentGoal = transcript.derivedGoal;
+    record('currentGoal', 'transcript-derived');
   } else record('currentGoal', 'none');
 
-  // NEXT ACTION — the next open ledger item, else the assistant's own last stated step (derived).
+  // NEXT ACTION — only a ledger commitment or coherent prior state may become a resumable action.
+  // Transcript text is evidence/context, never an invented structured action.
   let nextAction = ledger.open[1] ?? ledger.open[0] ?? null;
   if (nextAction) record('nextAction', 'ledger');
-  else if (transcript.derivedNextAction) {
-    nextAction = transcript.derivedNextAction;
-    record('nextAction', 'transcript-derived');
-  } else if (typeof priorState?.nextAction === 'string' && priorState.nextAction) {
+  else if (typeof priorState?.nextAction === 'string' && priorState.nextAction) {
     nextAction = priorState.nextAction;
     record('nextAction', 'prior-head');
   } else record('nextAction', 'none');