ruvnet-brain 4.3.36 → 4.3.38

package/plugin/scripts/continuation-gate.mjs

@@ -41,13 +41,17 @@ import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 import crypto from 'node:crypto';
-import { readStdinBounded } from './hook-input.mjs';
+import { readStopHookInput } from './hook-input.mjs';
 import {
   auditCapabilityClaims,
   buildCapabilityInventoryReceipt,
 } from './capability-inventory-receipt.mjs';
 import { auditCurrentCapabilityEvidence } from './capability-claim-evidence.mjs';
-import { continuationProjectIdentity, authorizedContinuationObjective } from './continuation-objective.mjs';
+import { continuationProjectIdentity, authorizedContinuationObjective, authorizedPromiseItems } from './continuation-objective.mjs';
+import {
+  auditCompletionClaims, readClaudeTurn, extractCommitments, claimClosesPromise,
+  PROMISE_KIND, PROMISE_CAP_OPEN,
+} from './completion-claim-evidence.mjs';
 
 const HOME = os.homedir();
 
@@ -219,6 +223,12 @@ if (has('--done')) {
   // EXACT text match only (GPT-5.6-Sol review). The earlier "unambiguous substring" fallback could still
   // clear a SINGLETON open item via a fragment — a fake-completion valve under a gate that now applies real
   // continuation pressure. Marking done requires the item's exact text (copy it from the ledger line).
+  // A captured PROMISE never closes by being declared done — only a later answer whose completion
+  // claim passed the post-change verification rule closes it (see promiseBookkeeping below).
+  if (led.items.some((i) => !i.done && i.text === needle && i.kind === PROMISE_KIND)) {
+    console.error('refused: a captured promise closes only with verification evidence at Stop (a completion claim with a check run after the last change), never by --done');
+    process.exit(2);
+  }
   const targets = led.items.filter((i) => !i.done && i.text === needle);
   for (const i of targets) { i.done = true; i.doneAt = new Date().toISOString(); }
   save(led);
@@ -307,21 +317,7 @@ if (has('--clear')) { save({ items: [] }); console.log('ledger cleared'); proces
  * Never block waiting for stdin: the CLI paths (--commit-to / --done) are invoked from a terminal
  * with no piped input, and a gate that hangs is worse than a gate that is silent.
  */
-async function readHookInput() {
-  // Three cases, treated DIFFERENTLY (ADR-043, Fable red-team #1):
-  //  - 'tty'        : run bare in a terminal, not as a hook → never force.
-  //  - 'unreadable' : stdin present but read/parse FAILED. `fs.readFileSync(0)` throws EAGAIN
-  //                   intermittently on macOS — a real footgun. The old code returned {} here, which
-  //                   under a forcing gate LAUNDERS a read error into a fresh-stop verdict → a forced
-  //                   loop. We must not force when we could not confirm the payload.
-  //  - 'stdin'      : a payload we actually parsed → the only case allowed to force.
-  if (process.stdin.isTTY) return { __source: 'tty' };
-  try {
-    const raw = (await readStdinBounded()).toString('utf8');
-    return { ...JSON.parse(raw || '{}'), __source: 'stdin' };
-  } catch { return { __source: 'unreadable' }; }
-}
-const hookInput = await readHookInput();
+const hookInput = await readStopHookInput(); // shared with grounding-turn-gate: hook-input.mjs (ADR-043)
 
 // LOOP-SAFETY 1 (ADR-043 / Fable #1) — only an affirmatively-parsed hook payload may force. A 'tty' or
 // 'unreadable' source cannot be confirmed a fresh stop, so it never forces.
@@ -332,9 +328,8 @@ if (hookInput.__source !== 'stdin') process.exit(EXIT_ALLOW);
  * continuing because of a stop hook (verified against code.claude.com/docs/en/hooks.md, ADR-043).
  * Honouring it caps each natural-stop episode at EXACTLY ONE forced continuation. Truthy, not
  * `=== true`, so a future string/number drift ("true", 1) cannot slip past into a loop.
+ * (The check itself now sits just after promise bookkeeping, below — still before any request.)
  */
-if (hookInput.stop_hook_active) process.exit(EXIT_ALLOW);
-
 if (hookInput.hook_event_name !== 'Stop' || hookInput.interrupted || hookInput.cancelled) process.exit(EXIT_ALLOW);
 const projectIdentity = continuationProjectIdentity(hookInput.cwd);
 if (!projectIdentity) process.exit(EXIT_ALLOW);
@@ -342,6 +337,73 @@ LEDGER = process.env.RUVNET_WORK_LEDGER
   || path.join(HOME, '.config', 'ruvnet-brain', 'work-ledgers', `${projectIdentity.projectId.replace(':', '-')}.json`);
 const led = load();
 const nowMs = Date.now();
+const HOST = process.env.RUVNET_HOOK_HOST === 'codex' ? 'codex' : 'claude';
+
+/**
+ * COMPLETION CLAIMS (ADR-074 class `completion`, owner 2026-09-30: "You can never ever tell me
+ * something is done and implemented without having tested it end to end"). Audited ONCE per Stop:
+ * the verdict both requests a correction (below, under every loop guard) and is the only evidence
+ * that may close a captured promise. Claude transcripts are parsed; Codex's rollout format is not
+ * parsed anywhere in this repo, so on Codex only the answer-side half is enforced and the transcript
+ * half is reported UNKNOWN (completion-claim-evidence.mjs header). Fails open: a throw is NONE.
+ */
+const completion = (() => {
+  const message = String(hookInput.last_assistant_message || '');
+  if (!message || !hookInput.session_id) return { verdict: 'NONE', claims: [] };
+  try {
+    const turn = HOST === 'claude' ? readClaudeTurn(hookInput.transcript_path) : null;
+    // Claude always sends a JSONL transcript; one we cannot read is OUR failure, and a Stop hook
+    // fails open on its own machinery (ADR-074 failure semantics) — never a correction request.
+    if (HOST === 'claude' && !turn) return { verdict: 'NONE', claims: [], unreadable: true };
+    return auditCompletionClaims(message, { turn, host: HOST });
+  } catch { return { verdict: 'NONE', claims: [] }; }
+})();
+
+/**
+ * PROMISES ("I'll do X next") become ledger items, and a promise closes ONLY on evidence. This is
+ * BOOKKEEPING, not forcing, so it runs before the stop_hook_active exit: the turn's real final
+ * answer usually arrives on a continued stop, and a promise made there must not be lost. Claude
+ * only — closing needs the transcript receipt, which Codex does not have here, and an item that
+ * can never close must never be written. Per-turn and total caps; dedupe against open items by
+ * normalized text; project + worktree scoped exactly like --commit-to's objective. Fails open.
+ */
+function promiseBookkeeping() {
+  if (HOST !== 'claude' || !hookInput.session_id) return;
+  try {
+    const pid = projectIdentity.projectId;
+    const at = new Date(nowMs).toISOString();
+    let changed = false;
+    if (completion.verdict === 'PASS') {
+      for (const item of led.items) {
+        if (item?.kind !== PROMISE_KIND || item.done || item.projectId !== pid) continue;
+        const claim = completion.claims.find((c) => claimClosesPromise(c.text, item.text));
+        if (!claim) continue;
+        Object.assign(item, { done: true, doneAt: at, completionEvidence: { claim: claim.text,
+          checks: completion.verification.checks.slice(-5).map((c) => c.what),
+          transcript: String(hookInput.transcript_path || ''), sessionId: hookInput.session_id } });
+        changed = true;
+      }
+    }
+    const openKeys = new Set(led.items.filter((i) => i?.kind === PROMISE_KIND && !i.done && i.projectId === pid).map((i) => i.key));
+    for (const promise of extractCommitments(hookInput.last_assistant_message)) {
+      if (openKeys.has(promise.key) || openKeys.size >= PROMISE_CAP_OPEN) continue;
+      openKeys.add(promise.key);
+      led.items.push({ schemaVersion: 1, kind: PROMISE_KIND, text: promise.text, key: promise.key, done: false, at,
+        projectId: pid, worktreeIds: [projectIdentity.worktreeId], sessionIds: ['*'],
+        capturedFrom: { sessionId: hookInput.session_id },
+        authorization: { kind: 'owner-mandate', reference: 'i-will-is-a-contract-2026-09-15' } });
+      changed = true;
+    }
+    if (changed) save(led);
+  } catch { /* the ledger is advisory — never break a turn over it */ }
+}
+promiseBookkeeping();
+
+/**
+ * LOOP-SAFETY 2 (moved below the bookkeeping above, unchanged in effect): no request is ever
+ * emitted on a stop that is already a continuation.
+ */
+if (hookInput.stop_hook_active) process.exit(EXIT_ALLOW);
 // Terminal objectives remain terminal even if legacy/global ledger rows or observations stay open.
 if (['cancelled', 'completed', 'blocked'].includes(led.objective?.state)) process.exit(EXIT_ALLOW);
 const objective = authorizedContinuationObjective(led.objective, hookInput, projectIdentity);
@@ -578,7 +640,18 @@ function securityAlertWork() {
 const observations = [...artifactOpenWork(), ...redCiOpenWork(), ...openPrWork(), ...securityAlertWork()];
 if (observations.length) console.error(JSON.stringify({ kind: 'continuation-advisory',
   authority: false, items: observations.map(({ text, at }) => ({ text, at })) }));
-const open = [...capabilityClaimWork(), ...(objective ? [{ text: objective.text, at: objective.at }] : [])];
+// ONE correction per turn: a single item however many claims the answer made; the stop_hook_active
+// exit and the cooldown lock below bound it to one request per stop episode.
+const completionWork = completion.verdict === 'FAIL' ? [{
+  text: `You claimed "${completion.claims[0].text.slice(0, 160)}" is done; ${completion.problems.join('; ')}. Run the real consumer path, or restate it as UNVERIFIED.`,
+  at: new Date(nowMs).toISOString(), derived: true, kind: 'completion-claim-integrity',
+}] : [];
+const promiseWork = HOST === 'claude'
+  ? authorizedPromiseItems(led.items, hookInput, projectIdentity)
+    .map((i) => ({ text: `you said you would: ${i.text}`, at: i.at, kind: PROMISE_KIND }))
+  : [];
+const open = [...capabilityClaimWork(), ...completionWork,
+  ...(objective ? [{ text: objective.text, at: objective.at }] : []), ...promiseWork];
 if (!open.length) process.exit(EXIT_ALLOW);   // nothing outstanding: silence is correct
 
 /**
@@ -665,6 +738,8 @@ if (!claimCooldown(nowMs, COOLDOWN_MS)) process.exit(EXIT_ALLOW);
 const committed = forceable.filter((i) => !i.derived);
 const observed = forceable.filter((i) => i.derived);
 const capabilityClaims = forceable.filter((i) => i.kind === 'capability-claim-integrity');
+const completionClaims = forceable.filter((i) => i.kind === 'completion-claim-integrity');
+const promises = forceable.filter((i) => i.kind === PROMISE_KIND);
 // Every derived item names its own repo in its text; this is for the header, where the ONE repo
 // this tree points at is the honest thing to say.
 const repoLabel = [...OWNED_REPOS][0] || 'this repository';
@@ -672,6 +747,9 @@ const repoLabel = [...OWNED_REPOS][0] || 'this repository';
 const header = capabilityClaims.length
   ? ['Your proposed final answer contains a RuvNet capability claim that is contradicted or not provable.',
      'Do NOT deliver it unchanged — continue now and correct the claim from the sealed live-host inventory.']
+  : completionClaims.length
+  ? ['Your proposed final answer claims work is done without end-to-end evidence from this turn.',
+     'Do NOT deliver it unchanged — run the real consumer path now, or restate the claim as UNVERIFIED.']
   : committed.length && observed.length
   ? [`You have unfinished work you committed to, and ${repoLabel} has open work of its own.`,
      'Do NOT end the turn — continue now.']
@@ -684,6 +762,7 @@ const header = capabilityClaims.length
 const lines = [
   ...header,
   ...(objective ? ['Continue the next safe step within this authorized objective without routine reconfirmation.']
+    : promises.length ? ['Do what you said you would do; that commitment is the only work this authorizes.']
     : ['Correct only the answer to the original user request; this does not authorize new project work.']),
   'Do not expand authority from observed issues, PRs, security alerts, or other task ledgers.',
   'Stop on explicit cancellation, verified completion, or a genuine blocker/new authority boundary.',
@@ -701,6 +780,11 @@ const lines = [
   ...(capabilityClaims.length
     ? ['Replace every contradicted claim with the observed capability and source path. Replace every',
        'unresolved absence claim with UNKNOWN until a complete live inventory proves it.']
+    : completionClaims.length
+    ? ['Name the check you ran (a "Verified:" line with the command or artifact) and say what is NOT verified.']
+    : promises.length
+    ? ['A promise closes only when a later answer claims it done with a check run after the last change —',
+       'never by saying so, and never by --done. If you genuinely cannot do it, say so plainly and why.']
     : committed.length
     ? ['Record objective completion only with actual completion evidence; legacy --done does not complete an objective.']
     : ['These clear by being done, not by being marked: merge or fix the PR, get the build green,',
@@ -719,7 +803,7 @@ const lines = [
   // COMMITTED items only. A derived item is at most 6h old by construction (the freshness window),
   // and "clear it, that is a legitimate answer" is advice about a promise — you cannot clear a red
   // build by declaring it no longer real.
-  ...(committed.some((i) => (nowMs - Date.parse(i.at)) > 24 * 3_600_000)
+  ...(committed.some((i) => i.kind !== PROMISE_KIND && (nowMs - Date.parse(i.at)) > 24 * 3_600_000)
     ? ['', 'Some of these are days old. If one is genuinely no longer real, say so and CLEAR it —',
        'that is a legitimate answer and the right one. What is never acceptable is marking it done',
        'without doing it, or letting it age quietly out of view.']

package/plugin/scripts/continuation-objective.mjs

@@ -38,3 +38,18 @@ export function authorizedContinuationObjective(objective, input, identity) {
     || !Array.isArray(objective.worktreeIds) || !objective.worktreeIds.includes(identity.worktreeId)) return null;
   return objective;
 }
+
+// Promises the assistant made in a final answer ("I'll do X next"), captured by continuation-gate
+// into the SAME ledger (owner mandate 2026-09-15: "I will" is a contract). Same scoping discipline
+// as the objective above — project AND worktree must match, a session wildcard only as the literal
+// '*' — and the same loop guards. An item that is done, malformed, or foreign is never returned.
+export function authorizedPromiseItems(items, input, identity) {
+  if (!identity || input?.hook_event_name !== 'Stop' || !text(input.session_id)
+    || input.interrupted || input.cancelled || input.stop_hook_active) return [];
+  return (Array.isArray(items) ? items : []).filter((item) => item?.kind === 'assistant-commitment'
+    && item.schemaVersion === 1 && item.done !== true && text(item.text) && Number.isFinite(Date.parse(item.at))
+    && item.authorization?.kind === 'owner-mandate' && text(item.authorization.reference)
+    && item.projectId === identity.projectId
+    && Array.isArray(item.worktreeIds) && item.worktreeIds.includes(identity.worktreeId)
+    && Array.isArray(item.sessionIds) && (item.sessionIds.includes('*') || item.sessionIds.includes(input.session_id)));
+}

package/plugin/scripts/continuity-hook-policy.mjs

@@ -20,7 +20,7 @@
  *   session-start       continuity recovery   at SessionStart       claude, codex
  *   unprompted-speech   advisory delivery     at UserPromptSubmit   claude, codex
  *   continuation-gate   continuation nudge    at turn end           claude, codex
- *   session-snapshot    continuity capture    at turn end           claude
+ *   session-snapshot    continuity capture    at turn end           claude, codex
  *   session-snapshot    continuity capture    at PreCompact         claude
  *   session-snapshot    continuity capture    at SessionEnd         claude, codex
  *   ground-ruvnet       grounding injection   at UserPromptSubmit   claude, codex
@@ -95,7 +95,8 @@ const registration = (id, matcher, hosts) => Object.freeze({ id, matcher, hosts:
  *                     struct, so this is "not proven", not "not supported".
  *   PreCompact        NOT OBSERVED — a one-line turn never approaches a compaction threshold.
  *
- * Therefore Codex capture is registered at SessionEnd ONLY. Stop keeps the pre-existing
+ * Therefore Codex capture was registered at SessionEnd ONLY (Stop added 2026-09-29 for turn
+ * outcomes — see the Stop registration below; its delivery is still unobserved). Stop keeps the pre-existing
  * continuation-gate registration (unchanged by this lane); no NEW handler is added to an event whose
  * delivery has not been seen. hook-contracts.json carries the same measurement and its date.
  *
@@ -154,7 +155,13 @@ export const CONTINUITY_EVENTS = Object.freeze({
   ]),
   Stop: Object.freeze([
     registration('continuation-gate', '*', ['claude', 'codex']),
-    registration('session-snapshot', '*', ['claude']),
+    // Codex added 2026-09-29 (owner requirement: every turn's outcome recorded on BOTH hosts —
+    // turn-outcome-capture.mjs). Codex SessionEnd carries no last_assistant_message, so Stop is the
+    // only boundary that can record a Codex turn. Evidence: codex-cli 0.158.0's own
+    // stop.command.input schema (last_assistant_message, turn_id) and the two Codex Stop handlers
+    // already registered above/below. NOT yet live-observed firing — see the probe box: the capture
+    // fails open, so an unfired registration costs nothing but must not be read as proof.
+    registration('session-snapshot', '*', ['claude', 'codex']),
     // The "answered without searching" gate, half 2 of 2 (2026-09-12). Forces continuation
     // (hookSpecificOutput.additionalContext — the same contract continuation-gate.mjs already uses
     // and codex-hook-adapter.mjs already translates to Codex's decision:block on both hosts) when

package/plugin/scripts/decision-gate.mjs

@@ -32,6 +32,8 @@ const EVENT = process.argv[2] || '';
 /** Exit codes that mean something to the host. Anything else from a policy is an ERROR, not a refusal. */
 const ALLOW = 0;
 const REFUSE = 2;
+/** A policy that could not decide and says why on stderr (e.g. duplicate-gate's index under overload). */
+const SKIPPED_SELF = 3;
 
 /**
  * ── THE BUDGET AND THE HOST TIMEOUT ARE ONE NUMBER, NOT TWO ──────────────────────────────────────
@@ -124,12 +126,17 @@ const REFUSAL_POLICIES = [
   // DEBT, not change: you may edit governed code freely, but not while a document governing it is
   // still unreconciled from the last round.
   POLICY('adr-currency', 'adr-currency-gate.mjs', 'node'),
+  // duplicate-code (2026-09-30, owner: "is it the simplest version of the code that works, that doesn't
+  // create duplicates or replication across the project?"). Last: it is a question about craft, not a
+  // boundary, and it refuses at most once per path per session. Tuned on replayed history — the
+  // numbers and the method are in duplicate-gate.mjs and scripts/duplicate-gate-replay.mjs.
+  POLICY('duplicate-code', 'duplicate-gate.mjs', 'node'),
 ];
 const SPEECH = { id: 'unprompted-speech', file: 'unprompted-runtime.mjs', interpreter: 'node' };
 
 /** Which policies apply to which PreToolUse sub-event, mirroring the matchers they replaced. */
 const REGISTRY = {
-  'write': ['protect-state', 'hijack-ruvnet', 'ground-before-write', 'adr-currency'],
+  'write': ['protect-state', 'hijack-ruvnet', 'ground-before-write', 'adr-currency', 'duplicate-code'],
 };
 
 export function policiesFor(event, registry = REGISTRY, all = REFUSAL_POLICIES) {
@@ -245,6 +252,9 @@ if (isMain()) {
   const results = await Promise.all(consulted.map((p) => runPolicy(p, payload, deadline, undefined, trace)));
   const verdicts = results.filter((r) => typeof r.code === 'number');
   for (const r of results) if (r.skipped === 'budget') unconsulted.push(r.id);
+  // A policy that exits SKIPPED (3) did not vote and said why (duplicate-gate under overload). Same
+  // two channels as a blown budget, below — never silence standing in for a verdict.
+  const selfSkipped = results.filter((r) => r.skipped === 'self');
 
   const decision = decide(verdicts);
 
@@ -264,6 +274,7 @@ if (isMain()) {
     }
   } catch { /* a ledger must never break a tool call */ }
 
+  reportSelfSkipped({ session, selfSkipped });
   if (!decision.allow) {
     reportBudget({ session, unconsulted, trace, started, budgetMs });
     process.stderr.write(`${decision.reason}\n`);
@@ -329,6 +340,14 @@ function reportBudget({ session, unconsulted, trace, started, budgetMs }) {
   );
 }
 
+/** Record and print each policy that skipped itself (exit 3), with its own one-line reason. */
+function reportSelfSkipped({ session, selfSkipped }) {
+  for (const r of selfSkipped) {
+    try { appendOutcome({ kind: 'policy-skipped', event: EVENT, session, policy: r.id, reason: r.reason, ts: Date.now() }); } catch { /* a ledger must never break a tool call */ }
+    process.stderr.write(`[decision-gate] ${r.reason || `${r.id} skipped`} — ${r.id} did not vote; this allow is not its verdict.\n`);
+  }
+}
+
 /**
  * Run one policy as a CAPTURED child. Never lets its bytes touch the real streams.
  *
@@ -362,7 +381,7 @@ function runPolicy(p, payload, deadline, extraArg, trace) {
     const finish = (r) => { if (settled) return; settled = true; clearTimeout(timer); resolve(done(r)); };
     let child;
     try {
-      child = spawn(cmd, args, { stdio: ['pipe', 'pipe', 'pipe'], env: { ...process.env, RUVNET_DECISION_GATE: '1' } });
+      child = spawn(cmd, args, { stdio: ['pipe', 'pipe', 'pipe'], env: { ...process.env, RUVNET_DECISION_GATE: '1', RUVNET_DECISION_DEADLINE: String(deadline) } });
     } catch { return finish({ id: p.id, skipped: 'spawn' }); }
     // SIGKILL, not SIGTERM: a bash policy that has spawned its own child (jq, node, ruflo) can sit in
     // a TERM handler, and the host's own kill is what we are racing. The whole batch shares ONE
@@ -379,6 +398,7 @@ function runPolicy(p, payload, deadline, extraArg, trace) {
     child.on('close', (code) => {
       // A spawn failure, a timeout, or any code other than 0/2 is an ERROR — and an error here must
       // never be mistaken for a refusal. That distinction is the one lesson-gate.mjs had to learn twice.
+      if (code === SKIPPED_SELF) return finish({ id: p.id, skipped: 'self', reason: firstLine(stderr) });
       if (code !== ALLOW && code !== REFUSE) return finish({ id: p.id, skipped: `exit:${code}` });
       finish({ id: p.id, code, stderr, stdout });
     });