ruvnet-brain 4.3.40 → 4.4.0

package/plugin/scripts/ground-ruvnet.sh

@@ -347,7 +347,7 @@ LASTV=$(cat "$VSTAMP" 2>/dev/null || echo 0)
 VJITTER=$(( ( $(hostname 2>/dev/null | cksum 2>/dev/null | cut -d' ' -f1 || echo 0) % 8641 ) - 4320 ))
 VINTERVAL=$(( 21600 + VJITTER ))
 if [ "$NOWV" -gt 0 ] && [ $((NOWV - LASTV)) -gt "$VINTERVAL" ]; then
-  echo "$NOWV" > "$VSTAMP" 2>/dev/null
+  echo "$NOWV" 2>/dev/null > "$VSTAMP"   # 2>/dev/null FIRST: a failed redirect prints the shell's own error otherwise
   # BACKGROUNDED (QE-0011 code#1): these are 3 sequential `curl --max-time 3` = up to ~9s. Running
   # them synchronously HERE — before the grounding gates below — risks the whole hook being killed by
   # Claude Code's ~5s hook timeout on the once/20h refresh tick, which would DROP the actual grounding
@@ -357,7 +357,7 @@ if [ "$NOWV" -gt 0 ] && [ $((NOWV - LASTV)) -gt "$VINTERVAL" ]; then
   ( for PKG in ruflo @claude-flow/cli @ruvector/rvf; do
       L=$(curl -fsS --max-time 3 "https://registry.npmjs.org/$PKG/latest" 2>/dev/null | sed -E 's/.*"version":"([^"]+)".*/\1/' | head -c 40)
       [ -n "$L" ] && echo "$PKG $L"
-    done > "$VCACHE".tmp 2>/dev/null && mv -f "$VCACHE".tmp "$VCACHE" 2>/dev/null ) &
+    done 2>/dev/null > "$VCACHE".tmp && mv -f "$VCACHE".tmp "$VCACHE" 2>/dev/null ) 2>/dev/null &
 fi
 if [ -s "$VCACHE" ]; then
   OUTDATED=""
@@ -625,7 +625,7 @@ if [ -n "$METER_TMP" ]; then
   mkdir -p "$METER_LEDGER_DIR" 2>/dev/null && \
     printf '{"ts":"%s","source":"hook","class":"%s","bytes":%d,"cwd":"%s"}\n' \
       "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$METER_CLASS" "$METER_BYTES" "$( { pwd -W 2>/dev/null || pwd 2>/dev/null; } | sed 's/"/\\"/g')" \
-      >> "$METER_LEDGER_DIR/token-ledger.jsonl" 2>/dev/null
+      2>/dev/null >> "$METER_LEDGER_DIR/token-ledger.jsonl"
 fi
 
 exit 0

package/plugin/scripts/grounding-answer.mjs

@@ -0,0 +1,129 @@
+#!/usr/bin/env node
+/**
+ * grounding-answer.mjs — the ONE predicate for "did search_ruvnet actually answer?", shared by the
+ * PostToolUse stamp (grounding-stamp.sh calls this file as a CLI) and the Stop gate
+ * (grounding-turn-evidence.mjs imports brainAnsweredResponse).
+ *
+ * 4.4.0 ADVERSARIAL REVIEW, BLOCKER B1. The previous predicate matched success markers anywhere in
+ * the tool response. But every lane echoes the MODEL's query back at structuredContent.retrieval.query
+ * (kb/grounded-response.mjs) — including the router-decline lane ("NO SEARCH WAS RUN",
+ * kb/search-outcome.mjs) and source discovery. A query that merely contained `Searched 37 RuvNet repos`
+ * turned a search that never ran into a 24-hour stamp, and the long-turn fallback then trusted it.
+ *
+ * THE RULE NOW: success is read from the ANSWER TEXT only — `answer` or `content[].text`, never
+ * `retrieval`, `grounding`, `routing` or any other echoed field — and the answer must BEGIN with the
+ * header the brain itself prints (kb/search-outcome.mjs, kb/card-lane.mjs renderCardHit), optionally
+ * after the degraded-search paragraph. Text the model controls never sits at the start of the answer.
+ * An oversize result counts only when the host's own notice is the WHOLE response's beginning and the
+ * saved file is the host's: under $HOME/.claude/projects/<p>/…/tool-results/, a regular file, not a
+ * link, written no later than the tool call, and itself beginning with an answer that passes this rule.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const BANNER = /^Searched \d+ RuvNet repos \(/;
+const CARD = /^⚡ FAST LANE — [^\n]*\n#1  repo=\S+  evidence=curated-capability-card\n/;
+// The first failed repo's error is quoted inside this paragraph and can itself contain newlines, so the
+// paragraph is matched up to its fixed closing sentence, bounded, not up to the first newline.
+const DEGRADED = /^⚠ DEGRADED SEARCH: [\s\S]{0,4000}?\nResults below cover only the healthy repos\. Mention this degradation to the user\.\n\n/;
+const EMPTY = '(no results — the search ran';
+const OVERSIZE = /^Error: result \([\d,]+ characters\) exceeds maximum allowed tokens\. Output has been saved to (\S+?\.txt)\./;
+const PERSISTED = /^<persisted-output>\nOutput too large \([^)]*\)\. Full output saved to: (\S+?\.txt)\n/;
+
+/** Does this ANSWER TEXT carry the brain's own success header at its start (and not the empty result)? */
+export function answerTextAnswered(text) {
+  const t = String(text ?? '').replace(DEGRADED, '');
+  if (CARD.test(t)) return true;
+  if (!BANNER.test(t)) return false;
+  const empty = t.indexOf(EMPTY);
+  return empty < 0 || (t.indexOf('#1  repo=') >= 0 && t.indexOf('#1  repo=') < empty);
+}
+
+/** JSON-unescape the leading string value of a truncated `{"answer":"…` document (no full parse possible). */
+function leadingAnswer(raw) {
+  const m = /^\s*\{\s*"answer"\s*:\s*"((?:[^"\\]|\\.)*)/.exec(raw);
+  if (!m) return null;
+  try { return JSON.parse(`"${m[1]}"`); } catch {
+    // Truncated mid-escape: drop a dangling backslash sequence and retry once.
+    try { return JSON.parse(`"${m[1].replace(/\\[^"]?$|\\u[0-9a-fA-F]{0,3}$/, '')}"`); } catch { return null; }
+  }
+}
+
+/** The answer text of a tool response in any shape a host delivers it, or null. Never an echoed field. */
+export function answerOf(response) {
+  if (response == null) return null;
+  if (Array.isArray(response)) {
+    const texts = response.filter((b) => b && b.type === 'text' && typeof b.text === 'string').map((b) => b.text);
+    return texts.length ? answerOf(texts[0]) : null;
+  }
+  if (typeof response === 'object') {
+    if (typeof response.answer === 'string') return response.answer;
+    if (Array.isArray(response.content)) return answerOf(response.content);
+    if (response.structuredContent && typeof response.structuredContent.answer === 'string') return response.structuredContent.answer;
+    return null;
+  }
+  const s = String(response);
+  if (/^\s*[{[]/.test(s)) {
+    try { return answerOf(JSON.parse(s)); } catch { return leadingAnswer(s); }
+  }
+  return s;   // plain text content
+}
+
+/** The host's saved-result path when the response IS the host's oversize notice, else null. */
+export function oversizePath(response) {
+  if (typeof response !== 'string') return null;
+  const m = OVERSIZE.exec(response) || PERSISTED.exec(response);
+  return m ? m[1] : null;
+}
+
+/**
+ * Did the brain answer? `notAfterMs`: the file must not be modified after this instant (the tool
+ * call's end); `notBeforeMs`: nor long before it (a file planted earlier is not this call's output).
+ */
+export function brainAnsweredResponse(response, { home = os.homedir(), notAfterMs = null, notBeforeMs = null } = {}) {
+  const file = oversizePath(response);
+  if (!file) return answerTextAnswered(answerOf(response));
+  const projects = path.join(home, '.claude', 'projects') + path.sep;
+  if (file.includes('..') || !file.startsWith(projects)
+    || !/^[^\\/].*[\\/]tool-results[\\/][^\\/]+$/.test(file.slice(projects.length))) return false;
+  try {
+    const st = fs.lstatSync(file);
+    if (!st.isFile() || st.isSymbolicLink()) return false;
+    if (notAfterMs != null && st.mtimeMs > notAfterMs) return false;
+    if (notBeforeMs != null && st.mtimeMs < notBeforeMs) return false;
+    const fd = fs.openSync(file, 'r');
+    try {
+      const buf = Buffer.alloc(65536);
+      const head = buf.subarray(0, fs.readSync(fd, buf, 0, buf.length, 0)).toString('utf8');
+      return answerTextAnswered(answerOf(head));
+    } finally { fs.closeSync(fd); }
+  } catch { return false; }
+}
+
+/** CLI for grounding-stamp.sh: a PostToolUse payload on stdin → prints `answered` or nothing. Exit 0. */
+async function main() {
+  const chunks = [];
+  let bytes = 0;
+  await new Promise((resolve) => {
+    const done = () => resolve();
+    const t = setTimeout(done, 3000); t.unref?.();
+    process.stdin.on('data', (c) => { if (bytes < 2_097_152) { chunks.push(c); bytes += c.length; } });
+    process.stdin.once('end', done); process.stdin.once('error', done);
+  });
+  try {
+    const payload = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    const now = Date.now();
+    if (brainAnsweredResponse(payload?.tool_response, { notAfterMs: now + 2000, notBeforeMs: now - 300_000 })) {
+      process.stdout.write('answered\n');
+    }
+  } catch { /* unparseable payload: nothing minted */ }
+  process.exit(0);
+}
+
+function isMain() {
+  try { return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); }
+  catch { return false; }
+}
+if (isMain()) main();

package/plugin/scripts/grounding-stamp.sh

@@ -23,12 +23,10 @@
 #     Measured on the pre-fix tree, in tests/unit/brain-off.test.mjs's recorded red run: five
 #     distinct non-answers, five valid stamps.
 #
-# The success signal is the one line kb/forge-mcp-all.mjs prints on every genuinely-executed search
-# and on nothing else — `Searched <n> RuvNet repos (...)` — with the four known non-answers refused
-# explicitly first. Cheapest reliable signal in the payload: no parsing, no field extraction, plain
-# substring matching over the raw stdin, all of it bash builtins. The refusal markers are quote-free
-# on purpose: a PostToolUse payload JSON-encodes the tool response, so anything containing a double
-# quote would arrive as \" and never match.
+# The success signal is the header the brain prints at the START of a genuine answer and nowhere
+# else — `Searched <n> RuvNet repos (...)` or the fast-lane card header. Since 4.4.0 it is decided by
+# grounding-answer.mjs on the PARSED answer text (substring matching over the raw payload was forged
+# twice: first by the query in tool_input, then by the same query echoed in retrieval.query).
 #
 # CONTRACT: PostToolUse is non-blocking — always exit 0, swallow every failure.
 
@@ -41,36 +39,33 @@ INPUT=""
 # exactly why a hook that CAN hang forever survives unnoticed. -t bounds the wait, and the string
 # is truncated AFTER the loop because a hook payload is one line with no newline, so `read` hands
 # the whole thing back at once and a per-iteration cap never fires.
+_l=""   # set -u: a read that times out before any byte leaves _l unset ("unbound variable" on stderr)
 while IFS= read -r -t 2 _l; do
   INPUT+="$_l"
-  [ ${#INPUT} -ge 65536 ] && break
+  [ ${#INPUT} -ge 2097152 ] && break
 done
 [ -n "$_l" ] && INPUT+="$_l"
-INPUT="${INPUT:0:65536}"
+# 2 MiB, not 64 KiB (4.4.0): the verdict below PARSES the payload, and a payload cut mid-JSON parses as
+# nothing — too small a cap would silently mint nothing for a large genuine answer.
+INPUT="${INPUT:0:2097152}"
 [ -n "$INPUT" ] || exit 0
 
-shopt -s nocasematch 2>/dev/null || true
-
-# ── 1. REFUSE the known non-answers, before anything else. Each of these minted a real 24h stamp. ──
-case "$INPUT" in
-  # ADR-054: the brain is switched off. The exact phrase is pinned to the producer by test.
-  *"RuvNet Brain is disabled"*) exit 0 ;;
-  # The GONG: every repo failed. An outage is not grounding.
-  *"RUVNET BRAIN IS DOWN"*)     exit 0 ;;
-  # A thrown error inside the tool.
-  *"search_ruvnet error:"*)     exit 0 ;;
-  # The search ran and matched nothing. A real answer to the wrong question — but the brain showed
-  # the model no source, so there is nothing for a stamp to attest to.
-  *"(no results"*)              exit 0 ;;
-esac
-
-# ── 2. REQUIRE the success banner. No banner ⇒ no successful search happened in this payload ⇒ no
-# stamp. This is what makes a missing or empty tool_response mint nothing, which is the query-only
-# behaviour finally gone.
-case "$INPUT" in
-  *"Searched "*"RuvNet repos"*) ;;
-  *) exit 0 ;;
-esac
+# ── 0-2. DID THE BRAIN ANSWER? ONE predicate, plugin/scripts/grounding-answer.mjs, shared with Stop. ──
+# 4.4.0 adversarial review, BLOCKER B1: matching markers anywhere in tool_response still minted from
+# the MODEL's query, because every lane echoes it back at structuredContent.retrieval.query — the
+# router-decline lane ("NO SEARCH WAS RUN") and source discovery included. The predicate now PARSES
+# the response and reads the ANSWER TEXT only (answer / content[].text), which must BEGIN with the
+# brain's own header; an oversize notice counts only as the host's whole response, pointing at the
+# host's own saved file, written during this call. No node, an unparseable payload, or any other
+# shape ⇒ nothing mints: a stamp that cannot be proven is not minted.
+HERE="$(cd "${BASH_SOURCE[0]%/*}" 2>/dev/null && pwd)" || exit 0   # builtin expansion: no dirname on a bare PATH
+# hook-shim.mjs passes the node that is running it (RUVNET_NODE_BIN); PATH is only the fallback, since a
+# host may hand its hooks a PATH with no node on it.
+NODE_BIN="${RUVNET_NODE_BIN:-}"
+[ -n "$NODE_BIN" ] && [ -x "$NODE_BIN" ] || NODE_BIN="$(command -v node 2>/dev/null)" || NODE_BIN=""
+[ -n "$NODE_BIN" ] && [ -f "$HERE/grounding-answer.mjs" ] || exit 0
+VERDICT="$(printf '%s' "$INPUT" | "$NODE_BIN" "$HERE/grounding-answer.mjs" 2>/dev/null)" || VERDICT=""
+[ "$VERDICT" = "answered" ] || exit 0
 
 DIR="$HOME/.cache/ruvnet-brain/grounded"
 mkdir -p "$DIR" 2>/dev/null || exit 0
@@ -89,9 +84,15 @@ mkdir -p "$DIR" 2>/dev/null || exit 0
 
 # ── 3. WHICH terms — from the QUERY only, as it always was. The first raw "query" key in the JSON is
 # tool_input's; inside tool_response text the quotes are escaped (\"query\") so they cannot match.
+# Read from the tool_input segment only, so a raw "query" key inside an object-shaped response
+# (Codex passes the MCP result as an object, and the result carries retrieval.query) cannot decide
+# which products are stamped. Product terms match case-insensitively (a query says "RuVector").
 QUERY=""
+TI="${INPUT#*\"tool_input\"}"
+TI="${TI%%\"tool_response\"*}"
 re='"query"[[:space:]]*:[[:space:]]*"([^"]*)"'
-[[ $INPUT =~ $re ]] && QUERY="${BASH_REMATCH[1]}"
+[[ $TI =~ $re ]] && QUERY="${BASH_REMATCH[1]}"
+shopt -s nocasematch 2>/dev/null || true
 [ -n "$QUERY" ] || exit 0
 
 # WRITE_GATE terms — same product-term list as ground-before-write.sh's own copy, mirrored in both

package/plugin/scripts/grounding-turn-evidence.mjs

@@ -32,6 +32,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { RUVNET_GATE1_TERMS } from './ruvnet-gate1-pattern.mjs';
+import { brainAnsweredResponse } from './grounding-answer.mjs';
 import { extractClaims } from './capability-claim-evidence.mjs';
 import { currentTurnRecords, strippedProse } from './completion-claim-evidence.mjs';
 
@@ -134,12 +135,22 @@ const textOf = (c) => (typeof c === 'string' ? c : Array.isArray(c)
 const NOT_A_SOURCE = /^(?:Edit|Write|MultiEdit|NotebookEdit|TodoWrite|ToolSearch|AskUserQuestion|ExitPlanMode|SendMessage|TaskStop|Monitor|Skill|Artifact.*|EnterWorktree|ExitWorktree)$/;
 const MCP_MUTATING = /__(?:create|update|delete|remove|publish|deploy|push|write|send|set|merge|upload|patch|put|post|add|rename|move|approve|promote|rollback|cancel|buy|store|edit|import|reset|stop|terminate|spawn|execute)[a-z_-]*$/i;
 
-/** One tool call as evidence: what it looked at (`text`, used for binding) and how much to trust it. */
-export function sourceOf(name, input = {}, result = '') {
+/**
+ * Did the brain actually answer? The ONE predicate (grounding-answer.mjs), shared with
+ * grounding-stamp.sh: the ANSWER TEXT (never the echoed retrieval.query) must begin with the brain's
+ * own header — heavy-lane banner, fast-lane card, optionally after the degraded paragraph — or the
+ * response is the host's oversize notice for its own saved file. `notAfterMs`: the transcript time of
+ * this tool result; a saved file modified later is not the tool's output.
+ */
+export function brainAnswered(r, { home = os.homedir(), notAfterMs = null } = {}) {
+  return brainAnsweredResponse(r, { home, notAfterMs });
+}
+
+export function sourceOf(name, input = {}, result = '', { resultAtMs = null } = {}) {
   const n = String(name || '');
   const r = String(result || '');
   if (/(?:^|__)search_ruvnet$/.test(n)) {
-    const ok = /Searched \d+ RuvNet repos/.test(r) && !/^\s*(?:search_ruvnet error:|.{0,200}RUVNET BRAIN IS DOWN|.{0,200}RuvNet Brain is disabled)/s.test(r);
+    const ok = brainAnswered(r, { notAfterMs: resultAtMs == null ? null : resultAtMs + 5000 });
     const paths = [...r.matchAll(/^path : (\S+)/gm)].map((m) => m[1]).slice(0, 20);
     return { kind: 'search_ruvnet', ref: String(input.query || ''), strength: ok ? 'strong' : 'failed', ok, text: [input.query, ...paths].join(' ') };
   }
@@ -171,7 +182,8 @@ export function turnSources(lines) {
   const results = new Map();
   for (const o of recs) {
     const c = o?.message?.content;
-    if (Array.isArray(c)) for (const r of c) if (r?.type === 'tool_result' && r.tool_use_id) results.set(r.tool_use_id, textOf(r.content));
+    const at = Date.parse(o?.timestamp || '');
+    if (Array.isArray(c)) for (const r of c) if (r?.type === 'tool_result' && r.tool_use_id) results.set(r.tool_use_id, { text: textOf(r.content), at: Number.isFinite(at) ? at : null });
   }
   const sources = [];
   for (const o of recs) {
@@ -179,7 +191,8 @@ export function turnSources(lines) {
     if (o?.type !== 'assistant' || !Array.isArray(c)) continue;
     for (const u of c) {
       if (u?.type !== 'tool_use') continue;
-      const s = sourceOf(u.name, u.input || {}, results.get(u.id) || '');
+      const res = results.get(u.id) || { text: '', at: null };
+      const s = sourceOf(u.name, u.input || {}, res.text, { resultAtMs: res.at });
       if (s) sources.push({ ...s, order: sources.length });
     }
   }
@@ -189,6 +202,87 @@ export function turnSources(lines) {
 /** Did a search_ruvnet call this turn return a real grounded answer? (Gate 1, from the transcript.) */
 export const searchedThisTurn = (sources) => sources.some((s) => s.kind === 'search_ruvnet' && s.ok);
 
+// ── does the ANSWER assert a rUv capability? (Gate 1's trigger at Stop, 4.4.0) ───────────────────
+// THE FALSE ALARM (measured 2026-09-30 on this repo's own transcripts): Gate 1 arms on any prompt
+// matching RUVNET_GATE1_PATTERN, and in this repository nearly every prompt does (`ruvnet-brain`,
+// "rUv", "swarm"). Of 183 real deliveries of "no successful search_ruvnet call", 172 were on turns
+// whose answer asserted nothing about a rUv tool — release status, git/CI checks, disk and backup
+// answers, memory writes. The directive is "search BEFORE asserting what a RuvNet tool can/cannot do",
+// so the Stop check now demands a search only when the final answer actually asserts that.
+// Deterministic, local (ADR-G004: no model evaluates a gate). Subjects are rUv PRODUCTS (grounded in
+// ruvector ADR-029 and ruflo docs/index.md); `RuvNet Brain` / `ruvnet-brain` is THIS product and is
+// grounded by reading this repo, never by search_ruvnet.
+const RUV_PRODUCT = String.raw`(?:@(?:ruvector|claude-flow|metaharness|ruvnet)\/[a-z0-9-]+|ruflo|ruvector(?:-core)?|rvf(?:-[a-z]+)?|agentdb|agenticow|rulake|ruview|rupixel|ruv-fann|agentic[- ]flow|agentic[- ]qe|synthlang|qudag|safla|metaharness|cve-bench|claude[- ]flow|ruv-swarm|aidefence|aimds|ruvllm|sona|agent[- ]booster|rvlite|ospipe|reasoningbank|flow-nexus|ruvnet(?!\s+brain)|r[uU]v)`;
+// "rUv's/Ruflo's (own) <up to 3 words>" or the bare product, never inside a path, filename or a
+// longer identifier (`ruvnet-brain`, `ruflo-core.mjs`, `kb/ruvector`).
+const RUV_SUBJECT = String.raw`(?<![\w/.@-])${RUV_PRODUCT}(?![\w-]|[./][\w])(?:(?:'|’)s)?(?:\s+own)?(?:\s+(?!(?:can|does|is|are|has|have|the|a|an|and|or|but|to|of|for|with|by|in|on|at|from|if|when|after|before|that|this|these|those|which|who|two|three|it|they|we|you|i)\b)[\w.@/-]+){0,4}?`;
+// Third-person verbs only: a CLI noun phrase (`ruflo memory store`, `ruvector search`) must never read
+// as subject + verb. Base forms ("turn", "ship", "store") count only right after a plural product noun
+// ("rUv's tools turn …") — a lookbehind, so a rejected noun never consumes the real verb after it.
+// Not \b at the end: `support-ticket` is no verb.
+const PLURAL_NOUN = 'tools|packages|crates|plugins|libraries|hooks|agents|skills|servers|workers|daemons|commands|apis|clis|sdks|bindings|routers|gates|controllers';
+const VERBS = 'support|provide|expose|ship|offer|export|implement|include|allow|enable|accept|return|store|require|need|handle|route|record|persist|index|cache|spawn|create|generate|compute|sort|classif|scan|detect|block|prevent|replace|wrap|call|launch|keep|clamp|turn|give|make|run|use|take|let|write';
+// "will not" is a capability claim only with a capability verb: "AgentDB will not open X" is, while
+// "Ruflo will not be touched by this patch" / "will not need a rebuild" report OUR change (4.4.0 nit).
+const WILL_NOT_VERBS = 'run|work|support|open|load|accept|start|install|handle|read|write|store|return|expose|allow|connect|recogni[sz]e|parse|build|compile|sync|scale|persist|import|export';
+// "now" makes a recency claim only with a capability verb ("Ruflo now supports X"); "AgentDB now records
+// every turn" describes behaviour this repo just wired, and is not a claim about the product.
+const NOW_VERBS = /\bnow\s+(?:supports|ships|works|exposes|provides|includes|offers|accepts|allows|enables|runs|requires|has|handles|can(?:not|'t|’t)?|does(?:n't|n’t|\s+not)?)\b/i;
+const CAPABILITY_VERB = String.raw`(?:(?:won't|won’t|will\s+not)\s+(?:${WILL_NOT_VERBS})\b|can(?:not|'t|’t)?\s+\w+|does(?:n't|n’t|\s+not)\s+\w+|do(?:n't|n’t|\s+not)\s+\w+|has(?:n't|n’t|\s+not)\s+\w+|has\s+(?:a|an|no|its|built-in|native)\b|(?:is|are)\s+(?:able|unable|capable|designed|built|meant|backed|limited|not\s+(?:able|available|supported))\b|only\s+(?:supports?|works|runs|accepts)|comes\s+with|works\s+(?:with|by|on|only)|(?:${VERBS})(?:e?s|ies)|(?<=\b(?:${PLURAL_NOUN})\s+)(?:${VERBS}))(?![\w-])`;
+// What rUv's own docs/research/source SAY is a capability claim too, in any tense.
+const DOC_VERB = String.raw`(?:says?|said|found|finds|shows?|showed|marks?|marked|documents?|documented|recommends?|prescribes?|states?|reports?|measured|took|warns?)\b`;
+const DOC_NOUN = String.raw`(?:research|benchmark|readme|docs?|documentation|release\s+notes|notes|code|source|adr|guidance|skill|campaign|issue|gist)`;
+const RUV_CLAIM = new RegExp(`(${RUV_SUBJECT})\\s+(?:\\([^)]{0,80}\\)\\s+)?(?:now\\s+|also\\s+|already\\s+|actually\\s+|really\\s+|still\\s+|always\\s+|never\\s+|only\\s+)?${CAPABILITY_VERB}`, 'gi');
+const RUV_DOC_CLAIM = new RegExp(`(?<![\\w/.@-])${RUV_PRODUCT}(?:(?:'|’)s)?(?:\\s+own)?(?:\\s+[\\w.@/-]+){0,3}?\\s+${DOC_NOUN}\\b[^.;]{0,40}?\\b${DOC_VERB}`, 'gi');
+// "Ruflo is the orchestration layer and it has no hooks API": the pronoun refers back, in the same
+// sentence — only to a product that OPENS the sentence as its subject (a product inside a list or a
+// parenthetical is not what "they" means: "N-API builds (ruvector, rvf, …), so they don't depend…").
+const RUV_COREF_CLAIM = new RegExp(`^(?:the\\s+)?(${RUV_PRODUCT})(?![\\w-]|[./][\\w])(?:(?:'|’)s)?\\s+(?:(?:is|are)\\s+(?:a|an|the)\\b|has\\b|provides?\\b|ships?\\b)[^.;!?()]{0,80}?\\b(?:and|but|so|which|because)\\s+(?:it|they)\\s+(?:also\\s+|now\\s+|still\\s+|only\\s+)?${CAPABILITY_VERB}`, 'gi');
+// Not an assertion: a question, a hedge, a plan or hypothetical. Narrower than HEDGE above on purpose,
+// and narrower still since the 4.4.0 review (S2): "now", "if" and "will not" no longer silence a whole
+// sentence — "Ruflo now supports Windows natively", "RuVector cannot run on Windows, so if you need it
+// use WSL" and "X will not run on Y" are claims. They are judged per claim in isAssertion instead.
+const NOT_RUV_ASSERTION = /\?|\b(?:might|may|maybe|perhaps|probably|possibly|potentially|likely|unlikely|apparently|seems?|i\s+think|i\s+believe|i\s+suspect|not\s+sure|unsure|unverified|unconfirmed|not\s+verified|would|could|should|i(?:'ll|’ll)|we(?:'ll|’ll)|will(?!\s+not\b)|plan(?:ned)?\s+to|going\s+to|once)\b/i;
+const FIRST_PERSON = /\b(?:I|we|me|my|our|us)\b/;
+
+function isAssertion(s, m) {
+  // "what rUv already ships" / "whether ruflo supports X" is a noun clause, not an assertion.
+  if (/\b(?:what|whatever|whether)\b[^.,;:!?]{0,40}$/i.test(s.slice(0, m.index))) return false;
+  // A condition in the claim's OWN clause makes it hypothetical ("Ruv can't use Brain if every update
+  // breaks"); a condition in a later clause does not ("cannot run on Windows, so if you need it…").
+  const start = Math.max(0, ...[...s.slice(0, m.index).matchAll(/[,;:—–]|\b(?:so|but)\b/g)].map((x) => x.index + x[0].length));
+  const after = s.slice(m.index + m[0].length);
+  const stop = after.search(/[,;:—–]|\b(?:so|but)\b/);
+  if (/\b(?:if|unless)\b/i.test(s.slice(start, m.index + m[0].length + (stop < 0 ? after.length : stop)))) return false;
+  // "now" is a recency claim about the product — unless it reports OUR change ("AgentDB now records
+  // every turn … with no reliance on me remembering", a measured false alarm).
+  if (/\bnow\b/i.test(s) && FIRST_PERSON.test(s)) return false;
+  if (/\bnow\s+\w/i.test(m[0]) && !NOW_VERBS.test(m[0])) return false;
+  // "returns 10 results", "takes about 3 s": a measurement this turn, not a capability.
+  return !/^\s*(?:about\s+|around\s+|only\s+|~|≈)?\d/.test(s.slice(m.index + m[0].length));
+}
+
+/** The final answer's sentences (and table cells) that assert what a rUv product does. Never throws. */
+export function ruvCapabilityClaims(rawMessage) {
+  const text = String(rawMessage || '')
+    .replace(/```[\s\S]*?```/g, '\n')                    // command output and code are not prose claims
+    .replace(/^\s*>.*$/gm, ' ')                          // quoted material
+    .replace(/"[^"\n]{0,300}"|“[^”\n]{0,300}”/g, '\n')    // quoted speech: someone else's words (a break: it may carry the full stop)
+    .replace(/`([^`\n]{1,80})`/g, '$1')                  // inline code keeps its identifier
+    .replace(/^\s*#{1,6}\s.*$/gm, ' ')                   // headings name a topic
+    .replace(/\*\*|__/g, '')
+    .replace(/\|/g, '\n');                               // table cells judged one by one
+  const out = [];
+  for (const raw of text.split(/(?<=[.!?;])\s+|\n+|\s+[—–]\s+/)) {
+    const s = raw.replace(/^[\s\-*•#>\d.)]+/, '').trim();
+    if (!s || s.length > 400 || NOT_RUV_ASSERTION.test(s)) continue;
+    const m = [...s.matchAll(RUV_CLAIM), ...s.matchAll(RUV_DOC_CLAIM), ...s.matchAll(RUV_COREF_CLAIM)].find((x) => isAssertion(s, x));
+    if (m) out.push({ text: s, match: m[0], subject: (m[1] || m[0]).trim().split(/\s+/)[0].replace(/(?:'|’)s$/, '').toLowerCase() });
+    if (out.length >= 8) break;
+  }
+  return out;
+}
+
 // ── Stop-time audit ────────────────────────────────────────────────────────────────────────────────
 const HEDGE = /\?|\b(?:might|may|maybe|perhaps|probably|possibly|likely|unlikely|apparently|seems?|i\s+think|i\s+believe|i\s+suspect|i\s+(?:could|did)\s*n[o']?t\s+(?:confirm|verify|check)|not\s+sure|unsure|unverified|unconfirmed|not\s+verified|assum(?:e|ed|ing)|if|unless|whether|would|should|once|when)\b/i;
 const NEGATIVE = /\b(?:no\s+[\w-]+\s+(?:can|could|will)|cannot|can(?:'|’)t|can\s+not|is\s*n(?:'|’)?t\s+(?:possible|supported|able)|not\s+possible|impossible|does\s*n(?:'|’)?t\s+(?:support|allow|expose|provide|exist|let|offer)|does\s+not\s+(?:support|allow|expose|provide|exist|let|offer)|there(?:'|’)?s\s+no\s+(?:way|api|hook|setting|option)|there\s+is\s+no\s+(?:way|api|hook|setting|option)|has\s+no\s+(?:way|api|hook|setting|option)|only\s+(?:supports?|allows?|exposes?))\b/i;

package/plugin/scripts/grounding-turn-gate.mjs

@@ -72,6 +72,15 @@
  *   At most ONE correction per stop episode: both checks compose into one message, and
  *   stop_hook_active silences the continued stop.
  *
+ * 4.4.0 — GATE 1 FIRES ON A CLAIM, NOT ON A TOPIC. Gate 1 arms on any prompt that names the rUv
+ * stack, and in this repository that is nearly every prompt. Replayed through this decide() on 183
+ * real deliveries of the correction (the owner's sessions, 2026-09-12..10-01): 172 were on answers
+ * that asserted nothing about a rUv tool (release status, git/CI, disk/backup, memory writes). Now a
+ * search is demanded only when the final answer asserts a rUv capability (ruvCapabilityClaims);
+ * measured on a held-out set of 70 real Stop points: false positives 68/68 -> 0/68, and 2 borderline
+ * claims (copula, parenthetical) are missed — tests/unit/grounding-turn-false-alarm.test.mjs.
+ * A LONG turn (the transcript tail cannot see its start) falls back to the stamps, never to a pass.
+ *
  * FAILS OPEN ALWAYS. Exit 0 unconditionally — a gate that breaks a turn's completion because a
  * cache directory was unreadable would be disabled within a day.
  */
@@ -84,7 +93,7 @@ import { markerPathFor, readMarker } from './grounding-turn-mark.mjs';
 import { readSettledTranscript } from './turn-outcome-capture.mjs';
 import {
   architectureShadow, auditAssertions, correctionText, describeSources, loadVocabulary, logShadow,
-  relayShadow, searchedThisTurn, turnSources,
+  relayShadow, ruvCapabilityClaims, searchedThisTurn, turnSources,
 } from './grounding-turn-evidence.mjs';
 
 const HOME = os.homedir();
@@ -145,6 +154,11 @@ export function decide({ hookInput, marker, markerMs, env = process.env, read =
     if (host === 'claude' && typeof tp === 'string' && /\.jsonl$/i.test(tp)) {
       try { turn = turnSources(read(tp, { maxMs: 0 })); } catch { turn = null; }
     }
+    // The transcript is read as a bounded TAIL. When the turn's opening prompt is not inside it
+    // (a long turn), the tail is a suffix of the turn and cannot prove a search did NOT happen
+    // earlier — so it is not evidence either way. Fall back to the stamp evidence (the same path
+    // Codex uses), never to a silent pass: `return null` here let every long turn skip the gate.
+    if (turn && !turn.boundaryFound) turn = null;
     const sources = turn ? turn.sources : null;
     const message = String(hookInput.last_assistant_message || '');
 
@@ -158,15 +172,20 @@ export function decide({ hookInput, marker, markerMs, env = process.env, read =
       for (const row of shadow) logShadow({ ...row, at: new Date().toISOString(), session: hookInput.session_id, host });
     }
 
-    const grounded = marker.gate1 === false ? true
-      : sources ? searchedThisTurn(sources) : wasGroundedSince(markerMs, newestGroundingStampMs());
+    // Gate 1 demands a search only when the answer ASSERTS what a rUv product does (the directive's
+    // own words). A status report, git/CI check or memory write on a rUv-named repo asserts nothing.
+    const ruvClaims = marker.gate1 === false ? [] : ruvCapabilityClaims(message);
+    const grounded = !ruvClaims.length
+      || (sources ? searchedThisTurn(sources) : wasGroundedSince(markerMs, newestGroundingStampMs()));
     if (assertion) {
-      return correctionText(assertion) + (grounded ? '' : '\nThis turn also touched the rUv stack and no successful search_ruvnet call was recorded: call it with the product term(s).');
+      return correctionText(assertion) + (grounded ? '' : '\nThis turn also asserted what a rUv tool does and no successful search_ruvnet call was recorded: call it with the product term(s).');
     }
     if (grounded) return null;
     return [
-      'This turn touched the RuvNet / rUv stack and ground-ruvnet\'s directive required calling the',
-      'search_ruvnet MCP tool before asserting what any RuvNet tool can/cannot do — but no successful',
+      `You asserted "${ruvClaims[0].text.slice(0, 200)}" about ${ruvClaims[0].subject}`
+        + (ruvClaims.length > 1 ? ` (and ${ruvClaims.length - 1} more rUv capability claim(s))` : '') + ', and',
+      'ground-ruvnet\'s directive requires calling the search_ruvnet MCP tool before asserting what any',
+      'RuvNet tool can/cannot do — but no successful',
       sources ? `search_ruvnet call is in this turn's transcript (read this turn: ${describeSources(sources).join('; ')}).`
         : 'search_ruvnet call was recorded this turn (checked against the grounding-stamp evidence).',
       '',

package/plugin/scripts/hook-shim.mjs

@@ -344,6 +344,9 @@ function runHook(file, activeVersion = '') {
   // invocation if the user flips the switch while the hook is mid-run.
   const env = {
     ...process.env,
+    // The node running THIS shim, for bash bodies that need node (grounding-stamp.sh's verdict) on a
+    // machine where `node` is not on the PATH the host hands its hooks. Additive: older bodies ignore it.
+    RUVNET_NODE_BIN: process.execPath,
     ...(activeVersion ? { RUVNET_BRAIN_ACTIVE_VERSION: activeVersion } : {}),
     ...(BRAIN_OFF && entry.offBehavior === 'partial' ? { RUVNET_BRAIN_OFF: '1' } : {}),
   };

package/plugin/scripts/kling-preflight.sh

@@ -32,6 +32,7 @@
 set -uo pipefail
 
 INPUT=""
+_l=""   # set -u: a read that times out before any byte leaves _l unset ("unbound variable" on stderr)
 # BOUNDED READ (2026-07-27, ADR-055 F20): an unqualified `read` never returns on a stdin that is
 # opened and never closed — measured across the mesh, 18 of 37 registered commands sat until the
 # harness killed them. Real Claude Code writes and closes, so this costs no normal turn; that is

package/plugin/scripts/learn-capture.sh

@@ -44,6 +44,7 @@ esac
 # payload's delivery time; the size cap is ~30x the largest real payload. The trailing `[ -n "$_l" ]`
 # keeps the final unterminated line, which is what the original `||` clause was for.
 INPUT=""
+_l=""   # set -u: a read that times out before any byte leaves _l unset ("unbound variable" on stderr)
 while IFS= read -r -t 2 _l; do
   INPUT+="$_l"
   [ ${#INPUT} -ge 65536 ] && break

package/plugin/scripts/project-progression-sources.mjs

@@ -35,7 +35,19 @@ function git(cwd, args) {
 }
 
 /**
- * The source identity, with each digest defined EXACTLY:
+ * The Brain's OWN state that may sit inside the customer's project: the AgentDB store and its sidecars
+ * (`.swarm/` — memory.db, -wal/-shm, the outbox and queue files) and what ruflo leaves in a cwd
+ * (`.claude-flow/`, `ruvector.db`). It is not the customer's source. Every capture writes `.swarm/`, so
+ * counting it made every later boundary look like a changed tree: the no-op path was never taken and
+ * memory.db grew at every boundary. Excluded by pathspec, so it does not depend on the user's gitignore
+ * (it only looked fine on machines whose global gitignore lists `.swarm/`).
+ */
+export const BRAIN_STATE_PATHSPEC_EXCLUDES = Object.freeze([':(exclude).swarm', ':(exclude).claude-flow', ':(exclude)ruvector.db']);
+const SOURCE_PATHSPEC = ['--', '.', ...BRAIN_STATE_PATHSPEC_EXCLUDES];
+
+/**
+ * The source identity, with each digest defined EXACTLY (each one EXCLUDING the Brain's own state,
+ * BRAIN_STATE_PATHSPEC_EXCLUDES above):
  *   trackedDigest   sha256 of `git ls-files -s` (mode + blob oid + stage + path for every tracked file)
  *   untrackedDigest sha256 of one `<content-sha256> <path>` line per untracked, non-ignored file —
  *                   the NAMES alone would call two different working trees identical
@@ -63,9 +75,9 @@ export function readSourceIdentity({ checkoutRoot, kind = 'git' } = {}) {
 
   const headBefore = git(checkoutRoot, ['rev-parse', 'HEAD'])?.trim() || 'unborn';
   const branch = git(checkoutRoot, ['rev-parse', '--abbrev-ref', 'HEAD'])?.trim() || 'detached';
-  const tracked = git(checkoutRoot, ['ls-files', '-s']);
-  const untrackedList = git(checkoutRoot, ['ls-files', '--others', '--exclude-standard']);
-  const diff = git(checkoutRoot, ['diff', 'HEAD']);
+  const tracked = git(checkoutRoot, ['ls-files', '-s', ...SOURCE_PATHSPEC]);
+  const untrackedList = git(checkoutRoot, ['ls-files', '--others', '--exclude-standard', ...SOURCE_PATHSPEC]);
+  const diff = git(checkoutRoot, ['diff', 'HEAD', ...SOURCE_PATHSPEC]);
   const headAfter = git(checkoutRoot, ['rev-parse', 'HEAD'])?.trim() || 'unborn';
 
   const untrackedLines = String(untrackedList ?? '').split('\n').filter(Boolean).map((relative) => {

package/plugin/scripts/project-progression-store.mjs

@@ -1,4 +1,7 @@
 import { spawnSync } from 'node:child_process';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { ProgressionOutbox } from './project-progression-outbox.mjs';
 import {
@@ -132,6 +135,51 @@ function sortRejected(rows) {
     || left.reasons.join('|').localeCompare(right.reasons.join('|')));
 }
 
+/**
+ * The working directory ruflo runs in. ruflo writes into its cwd on every invocation even when --path
+ * names the store (measured 2026-10-01, ruflo 3.49.0): `.claude/`, `.claude-flow/`, `ruvector.db`, and
+ * `<cwd>/.swarm/` holding hnsw.metadata.json — the stored snapshot CONTENT — which it also LOADS when it
+ * finds one there (ruflo/v3/@claude-flow/cli/src/memory/memory-initializer.ts: getMemoryRoot() = cwd).
+ * So the cwd must be:
+ *  - never the project tree (it changed the customer's working tree and broke no-op capture detection),
+ *    never inside `.swarm` (nested `.swarm/.swarm`);
+ *  - PER PROJECT (one shared dir would pool every project's snapshot text and let one project load
+ *    another's metadata);
+ *  - private and ours: under the Brain's own home (never a shared /tmp name another user could pre-create
+ *    or symlink), every directory we create checked to be a real directory, owned by us, mode 0700.
+ * Every ruflo call carries --path, so the store it reads and writes is unaffected by the cwd.
+ */
+export function rufloScratchRoot(env = process.env) {
+  if (env.RUVNET_RUFLO_CWD_ROOT) return path.resolve(env.RUVNET_RUFLO_CWD_ROOT);
+  return path.join(env.RUVNET_BRAIN_HOME || path.join(os.homedir(), '.cache', 'ruvnet-brain'), 'ruflo-cwd');
+}
+
+/** Create-or-verify one private directory: a real directory (not a link), owned by us, mode 0700. */
+export function ensurePrivateDir(dir) {
+  try { fs.mkdirSync(dir, { mode: 0o700 }); } catch (error) { if (error?.code !== 'EEXIST') throw error; }
+  const stat = fs.lstatSync(dir);
+  if (stat.isSymbolicLink() || !stat.isDirectory()) {
+    throw new Error(`ruflo scratch directory ${dir} is not a real directory (symlink or file); refusing to use it`);
+  }
+  if (process.platform !== 'win32') {
+    if (stat.uid !== process.getuid()) {
+      throw new Error(`ruflo scratch directory ${dir} is owned by uid ${stat.uid}, not ${process.getuid()}; refusing to use it`);
+    }
+    if ((stat.mode & 0o777) !== 0o700) {
+      fs.chmodSync(dir, 0o700);
+      if ((fs.lstatSync(dir).mode & 0o777) !== 0o700) throw new Error(`ruflo scratch directory ${dir} could not be made private (0700)`);
+    }
+  }
+  return dir;
+}
+
+export function rufloCwdFor(storePath, { root = rufloScratchRoot() } = {}) {
+  const projectKey = crypto.createHash('sha256').update(path.resolve(storePath)).digest('hex').slice(0, 32);
+  fs.mkdirSync(path.dirname(root), { recursive: true });
+  ensurePrivateDir(root);
+  return ensurePrivateDir(path.join(root, projectKey));
+}
+
 export class ProjectProgressionStore {
   constructor({
     projectDir,
@@ -165,7 +213,7 @@ export class ProjectProgressionStore {
 
   run(args) {
     return this.runner(this.rufloBinary, args, {
-      cwd: path.dirname(this.resolution.canonicalAgentDbPath),
+      cwd: rufloCwdFor(this.resolution.canonicalAgentDbPath),
       encoding: 'utf8',
       timeout: 120_000,
       env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' },

package/plugin/scripts/protect-brain-state.sh

@@ -41,6 +41,7 @@ INPUT=""
 # exactly why a hook that CAN hang forever survives unnoticed. -t bounds the wait, and the string
 # is truncated AFTER the loop because a hook payload is one line with no newline, so `read` hands
 # the whole thing back at once and a per-iteration cap never fires.
+_l=""   # set -u: a read that times out before any byte leaves _l unset ("unbound variable" on stderr)
 while IFS= read -r -t 2 _l; do
   INPUT+="$_l"
   [ ${#INPUT} -ge 65536 ] && break

package/plugin/scripts/route-dispatch.sh

@@ -44,6 +44,7 @@ INPUT=""
 # exactly why a hook that CAN hang forever survives unnoticed. -t bounds the wait, and the string
 # is truncated AFTER the loop because a hook payload is one line with no newline, so `read` hands
 # the whole thing back at once and a per-iteration cap never fires.
+_line=""   # set -u: a read that times out before any byte leaves _line unset ("unbound variable" on stderr)
 while IFS= read -r -t 2 _line; do
   INPUT+="$_line"
   [ ${#INPUT} -ge 65536 ] && break