ruvnet-brain 4.3.40 → 4.4.1

package/kb/update-storage-transaction.mjs

@@ -258,7 +258,23 @@ export function recoverIncompleteStorageTransactions(liveDir, { removeTree = rem
     const phaseFiles = fs.readdirSync(receipts).filter((name) => /^\d{3}-[A-Z_]+\.json$/.test(name)).sort();
     if (!phaseFiles.length) throw new Error(`storage transaction receipt is empty: ${receipts}`);
     const latest = JSON.parse(fs.readFileSync(path.join(receipts, phaseFiles.at(-1)), 'utf8'));
-    if (['NOOP', 'COMMITTED', 'ROLLED_BACK'].includes(latest.state)) continue;
+    if (['NOOP', 'COMMITTED', 'ROLLED_BACK'].includes(latest.state)) {
+      // A quarantined unsealed candidate is kept for ONE full update cycle, then released on the next
+      // run — but only if its bytes are exactly what was sealed when it was quarantined.
+      const quarantine = latest.quarantinedUnsealedCandidate;
+      if (latest.state === 'ROLLED_BACK' && quarantine && latest.quarantineReclaimed !== true
+        && path.resolve(quarantine) === transactionPaths(live, transactionId).failed) {
+        const unchanged = !fs.existsSync(quarantine) || (() => {
+          try { requireDigest(quarantine, latest.quarantineIdentity, 'quarantined candidate'); return true; } catch { return false; }
+        })();
+        if (unchanged) {
+          removeIfPresent(quarantine);
+          appendRecoveryReceipt(receipts, 'ROLLED_BACK', { quarantineReclaimed: true,
+            reason: 'released the quarantined unsealed candidate one update cycle later (bytes unchanged)' });
+        }
+      }
+      continue;
+    }
     if (latest.state === 'RECOVERY_REQUIRED') throw new Error(`storage transaction requires manual recovery: ${transactionId}`);
     const paths = latest.paths;
     const expectedPaths = transactionPaths(live, transactionId);
@@ -273,12 +289,22 @@ export function recoverIncompleteStorageTransactions(liveDir, { removeTree = rem
     try {
       // Validate every retained tree before any rename or deletion. A receipt owns
       // paths, but cannot authorize discarding bytes added after the process died.
-      if (fs.existsSync(paths.candidate)) requireDigest(paths.candidate, latest.candidate, 'interrupted candidate');
+      // A kill DURING candidate building (the long phase: copy, private restore, guard) leaves a candidate
+      // that was never sealed, so no receipt can vouch for its bytes. Refusing made every later update
+      // fail forever; deleting would discard bytes nothing proved disposable. It is QUARANTINED instead:
+      // renamed intact to this transaction's `failed` path, named in the receipt, and live (proved equal
+      // to the prior identity) stays in service.
+      const unsealedCandidate = fs.existsSync(paths.candidate) && !latest.candidate?.sha256
+        && ['LOCKED', 'CANDIDATE_BUILDING'].includes(latest.state);
+      if (fs.existsSync(paths.candidate) && !unsealedCandidate) requireDigest(paths.candidate, latest.candidate, 'interrupted candidate');
       if (fs.existsSync(paths.rollback)) requireDigest(paths.rollback, prior, 'interrupted rollback');
       if (fs.existsSync(paths.failed)) throw new Error('interrupted failed tree has no safe recovery disposition');
       if (['LOCKED', 'CANDIDATE_BUILDING', 'CANDIDATE_VERIFIED'].includes(latest.state)) {
         requireDigest(live, prior, 'interrupted live');
-        removeIfPresent(paths.candidate);
+        if (unsealedCandidate) {
+          assertDirectory(paths.candidate, 'unsealed candidate');
+          fs.renameSync(paths.candidate, paths.failed);
+        } else removeIfPresent(paths.candidate);
       } else if (latest.state === 'OLD_RENAME_STARTED') {
         const hasLive = fs.existsSync(live);
         const hasRollback = fs.existsSync(paths.rollback);
@@ -324,10 +350,12 @@ export function recoverIncompleteStorageTransactions(liveDir, { removeTree = rem
         continue;
       } else throw new Error(`unsupported interrupted state ${latest.state}`);
       const delta = storageDelta(paths, { prior, candidate: latest.candidate || null });
+      const quarantined = unsealedCandidate
+        ? { quarantinedUnsealedCandidate: paths.failed, quarantineIdentity: identitySummary(treeIdentity(paths.failed)) } : {};
       appendRecoveryReceipt(receipts, 'ROLLED_BACK', { terminalVerdict: 'interrupted-run-restored', prior,
-        storageDelta: delta, reason: `recovered interrupted ${latest.state} transaction before new work` });
+        storageDelta: delta, reason: `recovered interrupted ${latest.state} transaction before new work`, ...quarantined });
       recovered.push({ transactionId, from: latest.state, terminalVerdict: 'interrupted-run-restored',
-        storageDelta: delta });
+        storageDelta: delta, ...quarantined });
     } catch (error) {
       appendRecoveryReceipt(receipts, 'RECOVERY_REQUIRED', { terminalVerdict: 'recovery-required', prior,
         reason: error.message });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.3.40",
+  "version": "4.4.1",
   "description": "One-command installer for RuvNet Brain \u2014 a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships a UserPromptSubmit retrieve-and-inject grounding hook and a PreToolUse write gate that refuses ungrounded rUv-product code until search_ruvnet has been consulted (ADR-0012 / ADR-067).",
-  "version": "4.3.40",
+  "version": "4.4.1",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.3.40",
+  "version": "4.4.1",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/hooks/codex-hooks.json

@@ -92,8 +92,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node -e \"const f=require('node:fs'),o=require('node:os'),p=require('node:path'),c=require('node:child_process'),d=process.env.CODEX_HOME||p.join(o.homedir(),'.codex'),b=process.env.RUVNET_BRAIN_HOME||p.join(p.dirname(d),'.cache','ruvnet-brain'),w=p.join(b,'codex-hook.mjs');let s;try{s=f.statSync(w)}catch{}if(!s?.isFile())process.exit(0);const r=c.spawnSync(process.execPath,[w,...process.argv.slice(2)],{stdio:['inherit','pipe','pipe'],encoding:'utf8',env:process.env,timeout:Number(process.argv[1]),killSignal:'SIGKILL'});if(r.status===0||r.status===2){if(r.stdout)process.stdout.write(r.stdout);if(r.stderr)process.stderr.write(r.stderr)}process.exit(r.status===2?2:0)\" 9000 session-snapshot SessionEnd",
-            "timeout": 10
+            "command": "node -e \"const f=require('node:fs'),o=require('node:os'),p=require('node:path'),c=require('node:child_process'),d=process.env.CODEX_HOME||p.join(o.homedir(),'.codex'),b=process.env.RUVNET_BRAIN_HOME||p.join(p.dirname(d),'.cache','ruvnet-brain'),w=p.join(b,'codex-hook.mjs');let s;try{s=f.statSync(w)}catch{}if(!s?.isFile())process.exit(0);const r=c.spawnSync(process.execPath,[w,...process.argv.slice(2)],{stdio:['inherit','pipe','pipe'],encoding:'utf8',env:process.env,timeout:Number(process.argv[1]),killSignal:'SIGKILL'});if(r.status===0||r.status===2){if(r.stdout)process.stdout.write(r.stdout);if(r.stderr)process.stderr.write(r.stderr)}process.exit(r.status===2?2:0)\" 2500 session-snapshot SessionEnd",
+            "timeout": 3
           }
         ]
       }

package/plugin/hooks/hooks.json

@@ -1,5 +1,5 @@
 {
-  "description": "RuvNet Brain lifecycle plane. The broad legacy routing, learning, and release interceptors remain retired. What is automatic is exactly: SessionStart restores the canonical project checkpoint; UserPromptSubmit runs the single unprompted-speech chokepoint, ground-ruvnet grounding injection, and a capacity-aware context hint for clearly large independent work. The capacity hook uses bounded CPU/memory-pressure evidence, never starts agents, and tells the coordinator to check live tools and clamp to the runtime cap; it is not user-facing speech. ground-ruvnet remains a directive to the model, not speech — ADR-040 §Amendment 2026-09-11. PreToolUse runs decision-gate's write route, the ONE process that may refuse a Write/Edit/MultiEdit/NotebookEdit/apply_patch (ADR-067, composing ground-before-write per ADR-0012); PostToolUse on a successful search_ruvnet mints the grounding stamp that opens that gate. grounding-turn-mark (UserPromptSubmit) records that the grounding directive fired this turn, and grounding-turn-gate (Stop) forces continuation if no search_ruvnet call was recorded since. Stop also runs the ledger-scoped continuation handler and captures a project snapshot; PreCompact and SessionEnd capture a project snapshot. Every capture is bounded and fails open; only decision-gate may block on exit code, and it fails open on its own errors — the Stop stdout envelopes are advisory at the shim boundary but keep the agent working.",
+  "description": "RuvNet Brain lifecycle plane. The broad legacy routing, learning, and release interceptors remain retired. What is automatic is exactly: SessionStart restores the canonical project checkpoint; UserPromptSubmit runs the single unprompted-speech chokepoint, ground-ruvnet grounding injection, and a capacity-aware context hint for clearly large independent work. The capacity hook uses bounded CPU/memory-pressure evidence, never starts agents, and tells the coordinator to check live tools and clamp to the runtime cap; it is not user-facing speech. ground-ruvnet remains a directive to the model, not speech — ADR-040 §Amendment 2026-09-11. PreToolUse runs decision-gate's write route, the ONE process that may refuse a Write/Edit/MultiEdit/NotebookEdit/apply_patch (ADR-067, composing ground-before-write per ADR-0012); PostToolUse on a successful search_ruvnet mints the grounding stamp that opens that gate. grounding-turn-mark (UserPromptSubmit) records that the grounding directive fired this turn, and grounding-turn-gate (Stop) forces continuation if the final answer asserts a rUv capability and no search_ruvnet call was recorded since. Stop also runs the ledger-scoped continuation handler and captures a project snapshot; PreCompact and SessionEnd capture a project snapshot. Every capture is bounded and fails open; only decision-gate may block on exit code, and it fails open on its own errors — the Stop stdout envelopes are advisory at the shim boundary but keep the agent working.",
   "hooks": {
     "SessionStart": [
       {

package/plugin/scripts/capability-registry.mjs

@@ -451,11 +451,11 @@ export const CAPABILITIES = [
       if (d.unreadable) {
         const locked = /lock|busy|writer/i.test(String(d.unreadable));
         return row(STATE.UNKNOWN, locked
-          ? `the memory store is currently held by another process (${d.unreadable}) — that is a passing lock, not a fault; re-checking in a moment should clear it`
+          ? `could not read the memory store: another process is holding it (${d.unreadable}) — that is a passing lock, not a fault; re-checking in a moment should clear it`
           : `the memory store could not be read (${d.unreadable}) — this is not a transient lock, so re-checking will not clear it; the store or its journal files need attention before distillation state can be established`);
       }
-      if (d.schemaless) return row(STATE.UNKNOWN, 'the store exists but has no memory_entries table (pre-AgentDB schema, never initialised) — nothing to distill yet, and nothing is broken');
-      if (typeof d.total !== 'number') return row(STATE.UNKNOWN, 'the store opened but returned no countable rows — distillation state not established');
+      if (d.schemaless) return row(STATE.UNKNOWN, 'cannot measure distillation: the store exists but has no memory_entries table (pre-AgentDB schema, never initialised) — nothing to distill yet, and nothing is broken');
+      if (typeof d.total !== 'number') return row(STATE.UNKNOWN, 'the store opened but returned no countable rows — distillation state could not be established');
 
       if (d.total === 0) return row(STATE.ABSENT, 'the memory store is empty, so there is nothing to distill yet');
       if (d.learns) return row(STATE.ON, `${d.patterns} reusable patterns distilled from ${d.real} memories (${(d.cover * 100).toFixed(1)}% embedded)`);

package/plugin/scripts/codex-hook-wrapper.mjs

@@ -60,7 +60,7 @@ const blockingHooks = new Set([
 const DETACHED_HOOKS = new Set(['learn-flush']);
 
 /** THE BUDGET IS DERIVED FROM WHAT THE HOOK MEASURABLY COSTS, never from what looks tidy. */
-function timeoutFor(hookId) {
+function timeoutFor(hookId, event = '') {
   const override = Number(process.env.RUVNET_CODEX_HOOK_TIMEOUT_MS);
   if (Number.isFinite(override) && override > 0) return override;
   // decision-gate's own internal budget is 4000ms (RUVNET_DECISION_BUDGET_MS) and it is allowed to
@@ -75,6 +75,11 @@ function timeoutFor(hookId) {
   if (hookId === 'ground-ruvnet' || hookId === 'unprompted-speech' || hookId === 'continuation-gate') {
     return 8_500;
   }
+  // SessionEnd is hard-capped at 3s by the host (see DETACHED_HOOKS above) and the codex-hooks.json
+  // launcher kills this wrapper at 2500ms. A 4000ms budget here was a number nobody would ever reach:
+  // the body planned for 8s and was SIGKILLed mid-write. 2200ms leaves the launcher its margin, and the
+  // body receives it as RUVNET_CODEX_BUDGET_MS (below) so it can save the new snapshot first.
+  if (event === 'SessionEnd') return 2_200;
   return 4_000;
 }
 
@@ -193,7 +198,7 @@ if (DETACHED_HOOKS.has(hookId)) {
   process.exit(0);
 }
 
-const budgetMs = timeoutFor(hookId);
+const budgetMs = timeoutFor(hookId, process.argv[3] || '');
 const result = spawnSync(process.execPath, [adapter, ...process.argv.slice(2)], {
   input,
   encoding: 'utf8',

package/plugin/scripts/design-wall.sh

@@ -29,6 +29,7 @@ INPUT=""
 # exactly why a hook that CAN hang forever survives unnoticed. -t bounds the wait, and the string
 # is truncated AFTER the loop because a hook payload is one line with no newline, so `read` hands
 # the whole thing back at once and a per-iteration cap never fires.
+_l=""   # set -u: a read that times out before any byte leaves _l unset ("unbound variable" on stderr)
 while IFS= read -r -t 2 _l; do
   INPUT+="$_l"
   [ ${#INPUT} -ge 65536 ] && break

package/plugin/scripts/ground-before-write.sh

@@ -43,6 +43,7 @@ INPUT=""
 # exactly why a hook that CAN hang forever survives unnoticed. -t bounds the wait, and the string
 # is truncated AFTER the loop because a hook payload is one line with no newline, so `read` hands
 # the whole thing back at once and a per-iteration cap never fires.
+_l=""   # set -u: a read that times out before any byte leaves _l unset ("unbound variable" on stderr)
 while IFS= read -r -t 2 _l; do
   INPUT+="$_l"
   [ ${#INPUT} -ge 65536 ] && break

package/plugin/scripts/ground-ruvnet.sh

@@ -347,7 +347,7 @@ LASTV=$(cat "$VSTAMP" 2>/dev/null || echo 0)
 VJITTER=$(( ( $(hostname 2>/dev/null | cksum 2>/dev/null | cut -d' ' -f1 || echo 0) % 8641 ) - 4320 ))
 VINTERVAL=$(( 21600 + VJITTER ))
 if [ "$NOWV" -gt 0 ] && [ $((NOWV - LASTV)) -gt "$VINTERVAL" ]; then
-  echo "$NOWV" > "$VSTAMP" 2>/dev/null
+  echo "$NOWV" 2>/dev/null > "$VSTAMP"   # 2>/dev/null FIRST: a failed redirect prints the shell's own error otherwise
   # BACKGROUNDED (QE-0011 code#1): these are 3 sequential `curl --max-time 3` = up to ~9s. Running
   # them synchronously HERE — before the grounding gates below — risks the whole hook being killed by
   # Claude Code's ~5s hook timeout on the once/20h refresh tick, which would DROP the actual grounding
@@ -357,7 +357,7 @@ if [ "$NOWV" -gt 0 ] && [ $((NOWV - LASTV)) -gt "$VINTERVAL" ]; then
   ( for PKG in ruflo @claude-flow/cli @ruvector/rvf; do
       L=$(curl -fsS --max-time 3 "https://registry.npmjs.org/$PKG/latest" 2>/dev/null | sed -E 's/.*"version":"([^"]+)".*/\1/' | head -c 40)
       [ -n "$L" ] && echo "$PKG $L"
-    done > "$VCACHE".tmp 2>/dev/null && mv -f "$VCACHE".tmp "$VCACHE" 2>/dev/null ) &
+    done 2>/dev/null > "$VCACHE".tmp && mv -f "$VCACHE".tmp "$VCACHE" 2>/dev/null ) 2>/dev/null &
 fi
 if [ -s "$VCACHE" ]; then
   OUTDATED=""
@@ -625,7 +625,7 @@ if [ -n "$METER_TMP" ]; then
   mkdir -p "$METER_LEDGER_DIR" 2>/dev/null && \
     printf '{"ts":"%s","source":"hook","class":"%s","bytes":%d,"cwd":"%s"}\n' \
       "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$METER_CLASS" "$METER_BYTES" "$( { pwd -W 2>/dev/null || pwd 2>/dev/null; } | sed 's/"/\\"/g')" \
-      >> "$METER_LEDGER_DIR/token-ledger.jsonl" 2>/dev/null
+      2>/dev/null >> "$METER_LEDGER_DIR/token-ledger.jsonl"
 fi
 
 exit 0

package/plugin/scripts/grounding-answer.mjs

@@ -0,0 +1,129 @@
+#!/usr/bin/env node
+/**
+ * grounding-answer.mjs — the ONE predicate for "did search_ruvnet actually answer?", shared by the
+ * PostToolUse stamp (grounding-stamp.sh calls this file as a CLI) and the Stop gate
+ * (grounding-turn-evidence.mjs imports brainAnsweredResponse).
+ *
+ * 4.4.0 ADVERSARIAL REVIEW, BLOCKER B1. The previous predicate matched success markers anywhere in
+ * the tool response. But every lane echoes the MODEL's query back at structuredContent.retrieval.query
+ * (kb/grounded-response.mjs) — including the router-decline lane ("NO SEARCH WAS RUN",
+ * kb/search-outcome.mjs) and source discovery. A query that merely contained `Searched 37 RuvNet repos`
+ * turned a search that never ran into a 24-hour stamp, and the long-turn fallback then trusted it.
+ *
+ * THE RULE NOW: success is read from the ANSWER TEXT only — `answer` or `content[].text`, never
+ * `retrieval`, `grounding`, `routing` or any other echoed field — and the answer must BEGIN with the
+ * header the brain itself prints (kb/search-outcome.mjs, kb/card-lane.mjs renderCardHit), optionally
+ * after the degraded-search paragraph. Text the model controls never sits at the start of the answer.
+ * An oversize result counts only when the host's own notice is the WHOLE response's beginning and the
+ * saved file is the host's: under $HOME/.claude/projects/<p>/…/tool-results/, a regular file, not a
+ * link, written no later than the tool call, and itself beginning with an answer that passes this rule.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const BANNER = /^Searched \d+ RuvNet repos \(/;
+const CARD = /^⚡ FAST LANE — [^\n]*\n#1  repo=\S+  evidence=curated-capability-card\n/;
+// The first failed repo's error is quoted inside this paragraph and can itself contain newlines, so the
+// paragraph is matched up to its fixed closing sentence, bounded, not up to the first newline.
+const DEGRADED = /^⚠ DEGRADED SEARCH: [\s\S]{0,4000}?\nResults below cover only the healthy repos\. Mention this degradation to the user\.\n\n/;
+const EMPTY = '(no results — the search ran';
+const OVERSIZE = /^Error: result \([\d,]+ characters\) exceeds maximum allowed tokens\. Output has been saved to (\S+?\.txt)\./;
+const PERSISTED = /^<persisted-output>\nOutput too large \([^)]*\)\. Full output saved to: (\S+?\.txt)\n/;
+
+/** Does this ANSWER TEXT carry the brain's own success header at its start (and not the empty result)? */
+export function answerTextAnswered(text) {
+  const t = String(text ?? '').replace(DEGRADED, '');
+  if (CARD.test(t)) return true;
+  if (!BANNER.test(t)) return false;
+  const empty = t.indexOf(EMPTY);
+  return empty < 0 || (t.indexOf('#1  repo=') >= 0 && t.indexOf('#1  repo=') < empty);
+}
+
+/** JSON-unescape the leading string value of a truncated `{"answer":"…` document (no full parse possible). */
+function leadingAnswer(raw) {
+  const m = /^\s*\{\s*"answer"\s*:\s*"((?:[^"\\]|\\.)*)/.exec(raw);
+  if (!m) return null;
+  try { return JSON.parse(`"${m[1]}"`); } catch {
+    // Truncated mid-escape: drop a dangling backslash sequence and retry once.
+    try { return JSON.parse(`"${m[1].replace(/\\[^"]?$|\\u[0-9a-fA-F]{0,3}$/, '')}"`); } catch { return null; }
+  }
+}
+
+/** The answer text of a tool response in any shape a host delivers it, or null. Never an echoed field. */
+export function answerOf(response) {
+  if (response == null) return null;
+  if (Array.isArray(response)) {
+    const texts = response.filter((b) => b && b.type === 'text' && typeof b.text === 'string').map((b) => b.text);
+    return texts.length ? answerOf(texts[0]) : null;
+  }
+  if (typeof response === 'object') {
+    if (typeof response.answer === 'string') return response.answer;
+    if (Array.isArray(response.content)) return answerOf(response.content);
+    if (response.structuredContent && typeof response.structuredContent.answer === 'string') return response.structuredContent.answer;
+    return null;
+  }
+  const s = String(response);
+  if (/^\s*[{[]/.test(s)) {
+    try { return answerOf(JSON.parse(s)); } catch { return leadingAnswer(s); }
+  }
+  return s;   // plain text content
+}
+
+/** The host's saved-result path when the response IS the host's oversize notice, else null. */
+export function oversizePath(response) {
+  if (typeof response !== 'string') return null;
+  const m = OVERSIZE.exec(response) || PERSISTED.exec(response);
+  return m ? m[1] : null;
+}
+
+/**
+ * Did the brain answer? `notAfterMs`: the file must not be modified after this instant (the tool
+ * call's end); `notBeforeMs`: nor long before it (a file planted earlier is not this call's output).
+ */
+export function brainAnsweredResponse(response, { home = os.homedir(), notAfterMs = null, notBeforeMs = null } = {}) {
+  const file = oversizePath(response);
+  if (!file) return answerTextAnswered(answerOf(response));
+  const projects = path.join(home, '.claude', 'projects') + path.sep;
+  if (file.includes('..') || !file.startsWith(projects)
+    || !/^[^\\/].*[\\/]tool-results[\\/][^\\/]+$/.test(file.slice(projects.length))) return false;
+  try {
+    const st = fs.lstatSync(file);
+    if (!st.isFile() || st.isSymbolicLink()) return false;
+    if (notAfterMs != null && st.mtimeMs > notAfterMs) return false;
+    if (notBeforeMs != null && st.mtimeMs < notBeforeMs) return false;
+    const fd = fs.openSync(file, 'r');
+    try {
+      const buf = Buffer.alloc(65536);
+      const head = buf.subarray(0, fs.readSync(fd, buf, 0, buf.length, 0)).toString('utf8');
+      return answerTextAnswered(answerOf(head));
+    } finally { fs.closeSync(fd); }
+  } catch { return false; }
+}
+
+/** CLI for grounding-stamp.sh: a PostToolUse payload on stdin → prints `answered` or nothing. Exit 0. */
+async function main() {
+  const chunks = [];
+  let bytes = 0;
+  await new Promise((resolve) => {
+    const done = () => resolve();
+    const t = setTimeout(done, 3000); t.unref?.();
+    process.stdin.on('data', (c) => { if (bytes < 2_097_152) { chunks.push(c); bytes += c.length; } });
+    process.stdin.once('end', done); process.stdin.once('error', done);
+  });
+  try {
+    const payload = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    const now = Date.now();
+    if (brainAnsweredResponse(payload?.tool_response, { notAfterMs: now + 2000, notBeforeMs: now - 300_000 })) {
+      process.stdout.write('answered\n');
+    }
+  } catch { /* unparseable payload: nothing minted */ }
+  process.exit(0);
+}
+
+function isMain() {
+  try { return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); }
+  catch { return false; }
+}
+if (isMain()) main();

package/plugin/scripts/grounding-stamp.sh

@@ -23,12 +23,10 @@
 #     Measured on the pre-fix tree, in tests/unit/brain-off.test.mjs's recorded red run: five
 #     distinct non-answers, five valid stamps.
 #
-# The success signal is the one line kb/forge-mcp-all.mjs prints on every genuinely-executed search
-# and on nothing else — `Searched <n> RuvNet repos (...)` — with the four known non-answers refused
-# explicitly first. Cheapest reliable signal in the payload: no parsing, no field extraction, plain
-# substring matching over the raw stdin, all of it bash builtins. The refusal markers are quote-free
-# on purpose: a PostToolUse payload JSON-encodes the tool response, so anything containing a double
-# quote would arrive as \" and never match.
+# The success signal is the header the brain prints at the START of a genuine answer and nowhere
+# else — `Searched <n> RuvNet repos (...)` or the fast-lane card header. Since 4.4.0 it is decided by
+# grounding-answer.mjs on the PARSED answer text (substring matching over the raw payload was forged
+# twice: first by the query in tool_input, then by the same query echoed in retrieval.query).
 #
 # CONTRACT: PostToolUse is non-blocking — always exit 0, swallow every failure.
 
@@ -41,36 +39,33 @@ INPUT=""
 # exactly why a hook that CAN hang forever survives unnoticed. -t bounds the wait, and the string
 # is truncated AFTER the loop because a hook payload is one line with no newline, so `read` hands
 # the whole thing back at once and a per-iteration cap never fires.
+_l=""   # set -u: a read that times out before any byte leaves _l unset ("unbound variable" on stderr)
 while IFS= read -r -t 2 _l; do
   INPUT+="$_l"
-  [ ${#INPUT} -ge 65536 ] && break
+  [ ${#INPUT} -ge 2097152 ] && break
 done
 [ -n "$_l" ] && INPUT+="$_l"
-INPUT="${INPUT:0:65536}"
+# 2 MiB, not 64 KiB (4.4.0): the verdict below PARSES the payload, and a payload cut mid-JSON parses as
+# nothing — too small a cap would silently mint nothing for a large genuine answer.
+INPUT="${INPUT:0:2097152}"
 [ -n "$INPUT" ] || exit 0
 
-shopt -s nocasematch 2>/dev/null || true
-
-# ── 1. REFUSE the known non-answers, before anything else. Each of these minted a real 24h stamp. ──
-case "$INPUT" in
-  # ADR-054: the brain is switched off. The exact phrase is pinned to the producer by test.
-  *"RuvNet Brain is disabled"*) exit 0 ;;
-  # The GONG: every repo failed. An outage is not grounding.
-  *"RUVNET BRAIN IS DOWN"*)     exit 0 ;;
-  # A thrown error inside the tool.
-  *"search_ruvnet error:"*)     exit 0 ;;
-  # The search ran and matched nothing. A real answer to the wrong question — but the brain showed
-  # the model no source, so there is nothing for a stamp to attest to.
-  *"(no results"*)              exit 0 ;;
-esac
-
-# ── 2. REQUIRE the success banner. No banner ⇒ no successful search happened in this payload ⇒ no
-# stamp. This is what makes a missing or empty tool_response mint nothing, which is the query-only
-# behaviour finally gone.
-case "$INPUT" in
-  *"Searched "*"RuvNet repos"*) ;;
-  *) exit 0 ;;
-esac
+# ── 0-2. DID THE BRAIN ANSWER? ONE predicate, plugin/scripts/grounding-answer.mjs, shared with Stop. ──
+# 4.4.0 adversarial review, BLOCKER B1: matching markers anywhere in tool_response still minted from
+# the MODEL's query, because every lane echoes it back at structuredContent.retrieval.query — the
+# router-decline lane ("NO SEARCH WAS RUN") and source discovery included. The predicate now PARSES
+# the response and reads the ANSWER TEXT only (answer / content[].text), which must BEGIN with the
+# brain's own header; an oversize notice counts only as the host's whole response, pointing at the
+# host's own saved file, written during this call. No node, an unparseable payload, or any other
+# shape ⇒ nothing mints: a stamp that cannot be proven is not minted.
+HERE="$(cd "${BASH_SOURCE[0]%/*}" 2>/dev/null && pwd)" || exit 0   # builtin expansion: no dirname on a bare PATH
+# hook-shim.mjs passes the node that is running it (RUVNET_NODE_BIN); PATH is only the fallback, since a
+# host may hand its hooks a PATH with no node on it.
+NODE_BIN="${RUVNET_NODE_BIN:-}"
+[ -n "$NODE_BIN" ] && [ -x "$NODE_BIN" ] || NODE_BIN="$(command -v node 2>/dev/null)" || NODE_BIN=""
+[ -n "$NODE_BIN" ] && [ -f "$HERE/grounding-answer.mjs" ] || exit 0
+VERDICT="$(printf '%s' "$INPUT" | "$NODE_BIN" "$HERE/grounding-answer.mjs" 2>/dev/null)" || VERDICT=""
+[ "$VERDICT" = "answered" ] || exit 0
 
 DIR="$HOME/.cache/ruvnet-brain/grounded"
 mkdir -p "$DIR" 2>/dev/null || exit 0
@@ -89,9 +84,15 @@ mkdir -p "$DIR" 2>/dev/null || exit 0
 
 # ── 3. WHICH terms — from the QUERY only, as it always was. The first raw "query" key in the JSON is
 # tool_input's; inside tool_response text the quotes are escaped (\"query\") so they cannot match.
+# Read from the tool_input segment only, so a raw "query" key inside an object-shaped response
+# (Codex passes the MCP result as an object, and the result carries retrieval.query) cannot decide
+# which products are stamped. Product terms match case-insensitively (a query says "RuVector").
 QUERY=""
+TI="${INPUT#*\"tool_input\"}"
+TI="${TI%%\"tool_response\"*}"
 re='"query"[[:space:]]*:[[:space:]]*"([^"]*)"'
-[[ $INPUT =~ $re ]] && QUERY="${BASH_REMATCH[1]}"
+[[ $TI =~ $re ]] && QUERY="${BASH_REMATCH[1]}"
+shopt -s nocasematch 2>/dev/null || true
 [ -n "$QUERY" ] || exit 0
 
 # WRITE_GATE terms — same product-term list as ground-before-write.sh's own copy, mirrored in both