ruvnet-brain 4.3.40 → 4.4.1

package/plugin/scripts/grounding-turn-evidence.mjs

@@ -32,6 +32,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { RUVNET_GATE1_TERMS } from './ruvnet-gate1-pattern.mjs';
+import { brainAnsweredResponse } from './grounding-answer.mjs';
 import { extractClaims } from './capability-claim-evidence.mjs';
 import { currentTurnRecords, strippedProse } from './completion-claim-evidence.mjs';
 
@@ -134,12 +135,22 @@ const textOf = (c) => (typeof c === 'string' ? c : Array.isArray(c)
 const NOT_A_SOURCE = /^(?:Edit|Write|MultiEdit|NotebookEdit|TodoWrite|ToolSearch|AskUserQuestion|ExitPlanMode|SendMessage|TaskStop|Monitor|Skill|Artifact.*|EnterWorktree|ExitWorktree)$/;
 const MCP_MUTATING = /__(?:create|update|delete|remove|publish|deploy|push|write|send|set|merge|upload|patch|put|post|add|rename|move|approve|promote|rollback|cancel|buy|store|edit|import|reset|stop|terminate|spawn|execute)[a-z_-]*$/i;
 
-/** One tool call as evidence: what it looked at (`text`, used for binding) and how much to trust it. */
-export function sourceOf(name, input = {}, result = '') {
+/**
+ * Did the brain actually answer? The ONE predicate (grounding-answer.mjs), shared with
+ * grounding-stamp.sh: the ANSWER TEXT (never the echoed retrieval.query) must begin with the brain's
+ * own header — heavy-lane banner, fast-lane card, optionally after the degraded paragraph — or the
+ * response is the host's oversize notice for its own saved file. `notAfterMs`: the transcript time of
+ * this tool result; a saved file modified later is not the tool's output.
+ */
+export function brainAnswered(r, { home = os.homedir(), notAfterMs = null } = {}) {
+  return brainAnsweredResponse(r, { home, notAfterMs });
+}
+
+export function sourceOf(name, input = {}, result = '', { resultAtMs = null } = {}) {
   const n = String(name || '');
   const r = String(result || '');
   if (/(?:^|__)search_ruvnet$/.test(n)) {
-    const ok = /Searched \d+ RuvNet repos/.test(r) && !/^\s*(?:search_ruvnet error:|.{0,200}RUVNET BRAIN IS DOWN|.{0,200}RuvNet Brain is disabled)/s.test(r);
+    const ok = brainAnswered(r, { notAfterMs: resultAtMs == null ? null : resultAtMs + 5000 });
     const paths = [...r.matchAll(/^path : (\S+)/gm)].map((m) => m[1]).slice(0, 20);
     return { kind: 'search_ruvnet', ref: String(input.query || ''), strength: ok ? 'strong' : 'failed', ok, text: [input.query, ...paths].join(' ') };
   }
@@ -171,7 +182,8 @@ export function turnSources(lines) {
   const results = new Map();
   for (const o of recs) {
     const c = o?.message?.content;
-    if (Array.isArray(c)) for (const r of c) if (r?.type === 'tool_result' && r.tool_use_id) results.set(r.tool_use_id, textOf(r.content));
+    const at = Date.parse(o?.timestamp || '');
+    if (Array.isArray(c)) for (const r of c) if (r?.type === 'tool_result' && r.tool_use_id) results.set(r.tool_use_id, { text: textOf(r.content), at: Number.isFinite(at) ? at : null });
   }
   const sources = [];
   for (const o of recs) {
@@ -179,7 +191,8 @@ export function turnSources(lines) {
     if (o?.type !== 'assistant' || !Array.isArray(c)) continue;
     for (const u of c) {
       if (u?.type !== 'tool_use') continue;
-      const s = sourceOf(u.name, u.input || {}, results.get(u.id) || '');
+      const res = results.get(u.id) || { text: '', at: null };
+      const s = sourceOf(u.name, u.input || {}, res.text, { resultAtMs: res.at });
       if (s) sources.push({ ...s, order: sources.length });
     }
   }
@@ -189,6 +202,134 @@ export function turnSources(lines) {
 /** Did a search_ruvnet call this turn return a real grounded answer? (Gate 1, from the transcript.) */
 export const searchedThisTurn = (sources) => sources.some((s) => s.kind === 'search_ruvnet' && s.ok);
 
+// ── does the ANSWER assert a rUv capability? (Gate 1's trigger at Stop, 4.4.0) ───────────────────
+// THE FALSE ALARM (measured 2026-09-30 on this repo's own transcripts): Gate 1 arms on any prompt
+// matching RUVNET_GATE1_PATTERN, and in this repository nearly every prompt does (`ruvnet-brain`,
+// "rUv", "swarm"). Of 183 real deliveries of "no successful search_ruvnet call", 172 were on turns
+// whose answer asserted nothing about a rUv tool — release status, git/CI checks, disk and backup
+// answers, memory writes. The directive is "search BEFORE asserting what a RuvNet tool can/cannot do",
+// so the Stop check now demands a search only when the final answer actually asserts that.
+// Deterministic, local (ADR-G004: no model evaluates a gate). Subjects are rUv PRODUCTS (grounded in
+// ruvector ADR-029 and ruflo docs/index.md); `RuvNet Brain` / `ruvnet-brain` is THIS product and is
+// grounded by reading this repo, never by search_ruvnet.
+const RUV_PRODUCT = String.raw`(?:@(?:ruvector|claude-flow|metaharness|ruvnet)\/[a-z0-9-]+|ruflo|ruvector(?:-core)?|rvf(?:-[a-z]+)?|agentdb|agenticow|rulake|ruview|rupixel|ruv-fann|agentic[- ]flow|agentic[- ]qe|synthlang|qudag|safla|metaharness|cve-bench|claude[- ]flow|ruv-swarm|aidefence|aimds|ruvllm|sona|agent[- ]booster|rvlite|ospipe|reasoningbank|flow-nexus|ruvnet(?!\s+brain)|r[uU]v)`;
+// "rUv's/Ruflo's (own) <up to 3 words>" or the bare product, never inside a path, filename or a
+// longer identifier (`ruvnet-brain`, `ruflo-core.mjs`, `kb/ruvector`).
+const RUV_SUBJECT = String.raw`(?<![\w/.@-])${RUV_PRODUCT}(?![\w-]|[./][\w])(?:(?:'|’)s)?(?:\s+own)?(?:\s+(?!(?:can|does|is|are|has|have|the|a|an|and|or|but|to|of|for|with|by|in|on|at|from|if|when|after|before|that|this|these|those|which|who|two|three|it|they|we|you|i)\b)[\w.@/-]+){0,4}?`;
+// Third-person verbs only: a CLI noun phrase (`ruflo memory store`, `ruvector search`) must never read
+// as subject + verb. Base forms ("turn", "ship", "store") count only right after a plural product noun
+// ("rUv's tools turn …") — a lookbehind, so a rejected noun never consumes the real verb after it.
+// Not \b at the end: `support-ticket` is no verb.
+const PLURAL_NOUN = 'tools|packages|crates|plugins|libraries|hooks|agents|skills|servers|workers|daemons|commands|apis|clis|sdks|bindings|routers|gates|controllers';
+const VERBS = 'support|provide|expose|ship|offer|export|implement|include|allow|enable|accept|return|store|require|need|handle|route|record|persist|index|cache|spawn|create|generate|compute|sort|classif|scan|detect|block|prevent|replace|wrap|call|launch|keep|clamp|turn|give|make|run|use|take|let|write|default';
+// "will not" is a capability claim only with a capability verb: "AgentDB will not open X" is, while
+// "Ruflo will not be touched by this patch" / "will not need a rebuild" report OUR change (4.4.0 nit).
+const WILL_NOT_VERBS = 'run|work|support|open|load|accept|start|install|handle|read|write|store|return|expose|allow|connect|recogni[sz]e|parse|build|compile|sync|scale|persist|import|export';
+// "now" makes a recency claim only with a capability verb ("Ruflo now supports X"); "AgentDB now records
+// every turn" describes behaviour this repo just wired, and is not a claim about the product.
+const NOW_VERBS = /\bnow\s+(?:supports|ships|works|exposes|provides|includes|offers|accepts|allows|enables|runs|requires|has|handles|can(?:not|'t|’t)?|does(?:n't|n’t|\s+not)?)\b/i;
+const CAPABILITY_VERB = String.raw`(?:(?:won't|won’t|will\s+not)\s+(?:${WILL_NOT_VERBS})\b|can(?:not|'t|’t)?\s+\w+|does(?:n't|n’t|\s+not)\s+\w+|do(?:n't|n’t|\s+not)\s+\w+|has(?:n't|n’t|\s+not)\s+\w+|has\s+(?:a|an|no|its|built-in|native)\b|(?:is|are)\s+(?:able|unable|capable|designed|built|meant|backed|limited|not\s+(?:able|available|supported))\b|only\s+(?:supports?|works|runs|accepts)|comes\s+with|works\s+(?:with|by|on|only)|(?:${VERBS})(?:e?s|ies)|(?<=\b(?:${PLURAL_NOUN})\s+)(?:${VERBS}))(?![\w-])`;
+// What rUv's own docs/research/source SAY is a capability claim too, in any tense.
+const DOC_VERB = String.raw`(?:says?|said|found|finds|shows?|showed|marks?|marked|documents?|documented|recommends?|prescribes?|states?|reports?|measured|took|warns?)\b`;
+const DOC_NOUN = String.raw`(?:research|benchmark|readme|docs?|documentation|release\s+notes|notes|code|source|adr|guidance|skill|campaign|issue|gist)`;
+const RUV_CLAIM = new RegExp(`(${RUV_SUBJECT})\\s+(?:\\([^)]{0,80}\\)\\s+)?(?:now\\s+|also\\s+|already\\s+|actually\\s+|really\\s+|still\\s+|always\\s+|never\\s+|only\\s+)?${CAPABILITY_VERB}`, 'gi');
+const RUV_DOC_CLAIM = new RegExp(`(?<![\\w/.@-])${RUV_PRODUCT}(?:(?:'|’)s)?(?:\\s+own)?(?:\\s+[\\w.@/-]+){0,3}?\\s+${DOC_NOUN}\\b[^.;]{0,40}?\\b${DOC_VERB}`, 'gi');
+// "Ruflo is the orchestration layer and it has no hooks API": the pronoun refers back, in the same
+// sentence — only to a product that OPENS the sentence as its subject (a product inside a list or a
+// parenthetical is not what "they" means: "N-API builds (ruvector, rvf, …), so they don't depend…").
+// The opening subject phrase of a sentence: "The RuVector router package (`ruvector-router`)",
+// "RuVector's router", "Ruflo". Words stop at a copula; a parenthetical right after it is allowed.
+// OUR change to a product ("the ruflo upgrade", "the AgentDB write", "the ruflo fix") is not the product.
+const CHANGE_NOUN = 'upgrade|update|fix|change|patch|install|installation|write|read|call|run|release|build|migration|restart|bump|version|commit|test|tests|check|ci|job|workflow|step|lock|config|setting|settings|issue|bug|error|failure|outage|incident|pr|branch|diff|rollout|deploy|deployment';
+const OPENING_SUBJECT = String.raw`^(?:the\s+)?(${RUV_PRODUCT})(?![\w-]|[./][\w])(?:(?:'|’)s)?(?:\s+(?!(?:is|are|was|were|has|and|or|but|it|they|${CHANGE_NOUN})\b)[\w.@/-]+){0,4}?\s+(?:\([^)]{0,80}\)\s+)?`;
+const RUV_COREF_CLAIM = new RegExp(`${OPENING_SUBJECT}(?:(?:is|are)\\s+(?:a|an|the)\\b|has\\b|provides?\\b|ships?\\b|${CAPABILITY_VERB})[^.;!?]{0,200}?\\b(?:and|but|so|which|because)\\s+(?:it|they)\\s+(?:also\\s+|now\\s+|still\\s+|only\\s+)?${CAPABILITY_VERB}`, 'gi');
+// A DEFINITION is a capability claim too: "The RuVector router package (…) is a vector database …"
+// asserts what the product is and does (4.4.1, a live miss). Only as the sentence's opening subject,
+// and only "is a/an": "your ruflo is a version behind" (a status) does not open the sentence.
+const RUV_DEFINE_CLAIM = new RegExp(`${OPENING_SUBJECT}(?:is|are)\\s+(?:a|an)\\s+(?!(?:version|bit|few|lot|little|couple|day|week|month|commit|no-op|success|failure|regression|bug|fix|one-line|change|problem|mistake|non-issue|win|loss)s?\\b)\\w`, 'gi');
+// "this is agentic-qe's own static/heuristic estimate": a copula naming what the PRODUCT's output is.
+const RUV_COPULA_OWN_CLAIM = new RegExp(`\\b(?:this|that|it)\\s+is\\s+(${RUV_PRODUCT})(?![\\w-]|[./][\\w])(?:'|’)s\\s+own\\s+(?!(?:ci|tests?|build|pipeline|run|job|workflow|checks?|bug|failure|issue|repo|release|fault|problem|mistake|error)\\b)[\\w/-]+`, 'gi');
+// "is confirmed honored by the installed ruflo": the product as the passive AGENT of a behaviour.
+const RUV_PASSIVE_CLAIM = new RegExp(`\\b(?:is|are)\\s+(?:\\w+\\s+){0,2}?(?:honou?red|supported|handled|enforced|rejected|ignored|accepted|respected|read|parsed)\\s+by\\s+(?:the\\s+)?(?:installed\\s+|global\\s+|current\\s+)?(${RUV_PRODUCT})(?![\\w-]|[./][\\w])`, 'gi');
+// Not an assertion: a question, a hedge, a plan or hypothetical. Narrower than HEDGE above on purpose,
+// and narrower still since the 4.4.0 review (S2): "now", "if" and "will not" no longer silence a whole
+// sentence — "Ruflo now supports Windows natively", "RuVector cannot run on Windows, so if you need it
+// use WSL" and "X will not run on Y" are claims. They are judged per claim in isAssertion instead.
+const NOT_RUV_ASSERTION = /\?|\b(?:might|may|maybe|perhaps|probably|possibly|potentially|likely|unlikely|apparently|seems?|i\s+think|i\s+believe|i\s+suspect|not\s+sure|unsure|unverified|unconfirmed|not\s+verified|would|could|should|i(?:'ll|’ll)|we(?:'ll|’ll)|will(?!\s+not\b)|plan(?:ned)?\s+to|going\s+to|once)\b/i;
+const FIRST_PERSON = /\b(?:I|we|me|my|our|us)\b/;
+
+function isAssertion(s, m) {
+  // "what rUv already ships" / "whether ruflo supports X" is a noun clause, not an assertion.
+  if (/\b(?:what|whatever|whether)\b[^.,;:!?]{0,40}$/i.test(s.slice(0, m.index))) return false;
+  // A condition in the claim's OWN clause makes it hypothetical ("Ruv can't use Brain if every update
+  // breaks"); a condition in a later clause does not ("cannot run on Windows, so if you need it…").
+  const start = Math.max(0, ...[...s.slice(0, m.index).matchAll(/[,;:—–]|\b(?:so|but)\b/g)].map((x) => x.index + x[0].length));
+  const after = s.slice(m.index + m[0].length);
+  const stop = after.search(/[,;:—–]|\b(?:so|but)\b/);
+  if (/\b(?:if|unless)\b/i.test(s.slice(start, m.index + m[0].length + (stop < 0 ? after.length : stop)))) return false;
+  // "now" is a recency claim about the product — unless it reports OUR change ("AgentDB now records
+  // every turn … with no reliance on me remembering", a measured false alarm).
+  if (/\bnow\b/i.test(s) && FIRST_PERSON.test(s)) return false;
+  if (/\bnow\s+\w/i.test(m[0]) && !NOW_VERBS.test(m[0])) return false;
+  // "returns 10 results", "takes about 3 s": a measurement this turn, not a capability.
+  return !/^\s*(?:about\s+|around\s+|only\s+|~|≈)?\d/.test(s.slice(m.index + m[0].length));
+}
+
+// "## What AgentDB actually is" followed by "It's a SQLite database file …": the heading names the subject
+// and the section's sentence-initial "It" refers to it (4.4.1, a measured known miss).
+const DEFINING_HEADING = new RegExp(`^\\s*#{1,6}\\s+(?:what|how)\\s+(?:the\\s+)?(${RUV_PRODUCT})(?![\\w-])\\s+(?:(?:actually|really|even)\\s+)?(?:is|are|does|works?)\\b`, 'i');   // the product ITSELF, not "the ruflo fix"
+function bindHeadingPronouns(message) {
+  let subject = null;
+  return String(message || '').split('\n').map((line) => {
+    if (/^\s*#{1,6}\s/.test(line)) { subject = DEFINING_HEADING.exec(line)?.[1] ?? null; return line; }
+    if (!subject) return line;
+    return line.replace(/(^|[.!?]\s+)(?:\*\*)?It(?:'|’)s\b/g, `$1${subject} is`)
+      .replace(/(^|[.!?]\s+)(?:\*\*)?It\s+(?=(?:is|has|does|can|stores|runs|uses|keeps)\b)/g, `$1${subject} `);
+  }).join('\n');
+}
+// A table row whose FIRST cell is a product and whose other cells DESCRIBE it ("| AgentDB | Append-only
+// audit trail | Concurrent-write safe KB |") asserts what the product is. Only descriptive cells count:
+// letters only (no digits, hashes, dates or versions) and no status vocabulary — a status table about a
+// product ("| ruflo | 3.41.2 | PASS |", "| ruflo | No version at all … |") never qualifies.
+const STATUS_WORD = /\b(?:no|not|none|n\/a|missing|stale|behind|current|unverified|verified|pass(?:ed)?|fail(?:ed)?|yes|done|version|commit|ok|error|broken|pending|todo|skipped|live|shipped|absent|present|installed|upgraded|restarted|healthy|unhealthy|running|reachable|unreachable|updated|configured|enabled|disabled|failing|passing|green|red|removed|added|fixed|deployed|published|merged|stopped|started|restored|reset|rebuilt)\b/i;
+function productRowClaims(message) {
+  const claims = [];
+  for (const line of String(message || '').split('\n')) {
+    if (!/^\s*\|/.test(line) || /^\s*\|[\s:|-]+\|\s*$/.test(line)) continue;
+    const cells = line.split('|').slice(1, -1).map((c) => c.replace(/\*\*|__|`/g, '').trim());
+    const first = new RegExp(`^(${RUV_PRODUCT})$`, 'i').exec(cells[0] || '');
+    if (!first || cells.length < 2) continue;
+    const described = cells.slice(1).filter((c) => /^[A-Za-z][A-Za-z +/-]{3,80}$/.test(c) && c.split(/\s+/).length >= 2 && !STATUS_WORD.test(c));
+    if (described.length === cells.length - 1) claims.push({ text: line.trim(), match: `${first[1]} | ${described[0]}`, subject: first[1].toLowerCase() });
+  }
+  return claims;
+}
+
+/** The final answer's sentences (and table cells) that assert what a rUv product does. Never throws. */
+export function ruvCapabilityClaims(rawMessage) {
+  const rows = productRowClaims(String(rawMessage || '').replace(/```[\s\S]*?```/g, '\n'));
+  const text = bindHeadingPronouns(rawMessage)
+    .replace(/```[\s\S]*?```/g, '\n')                    // command output and code are not prose claims
+    .replace(/^\s*>.*$/gm, ' ')                          // quoted material
+    .replace(/"[^"\n]{0,300}"|“[^”\n]{0,300}”/g, '\n')    // quoted speech: someone else's words (a break: it may carry the full stop)
+    .replace(/`([^`\n]{1,80})`/g, '$1')                  // inline code keeps its identifier
+    .replace(/^\s*#{1,6}\s.*$/gm, ' ')                   // headings name a topic
+    .replace(/\*\*|__/g, '')
+    .replace(/\|/g, '\n');                               // table cells judged one by one
+  const out = rows.slice(0, 8);
+  for (const raw of text.split(/(?<=[.!?;])\s+|\n+|\s+[—–]\s+/)) {
+    if (out.length >= 8) break;
+    const s = raw.replace(/^[\s\-*•#>\d.)]+/, '').trim();
+    if (!s || s.length > 400 || NOT_RUV_ASSERTION.test(s)) continue;
+    const m = [...s.matchAll(RUV_CLAIM), ...s.matchAll(RUV_DOC_CLAIM), ...s.matchAll(RUV_COREF_CLAIM), ...s.matchAll(RUV_DEFINE_CLAIM),
+      ...s.matchAll(RUV_COPULA_OWN_CLAIM), ...s.matchAll(RUV_PASSIVE_CLAIM)]
+      .find((x) => isAssertion(s, x));
+    if (m) out.push({ text: s, match: m[0], subject: (m[1] || m[0]).trim().split(/\s+/)[0].replace(/(?:'|’)s$/, '').toLowerCase() });
+    if (out.length >= 8) break;
+  }
+  return out;
+}
+
 // ── Stop-time audit ────────────────────────────────────────────────────────────────────────────────
 const HEDGE = /\?|\b(?:might|may|maybe|perhaps|probably|possibly|likely|unlikely|apparently|seems?|i\s+think|i\s+believe|i\s+suspect|i\s+(?:could|did)\s*n[o']?t\s+(?:confirm|verify|check)|not\s+sure|unsure|unverified|unconfirmed|not\s+verified|assum(?:e|ed|ing)|if|unless|whether|would|should|once|when)\b/i;
 const NEGATIVE = /\b(?:no\s+[\w-]+\s+(?:can|could|will)|cannot|can(?:'|’)t|can\s+not|is\s*n(?:'|’)?t\s+(?:possible|supported|able)|not\s+possible|impossible|does\s*n(?:'|’)?t\s+(?:support|allow|expose|provide|exist|let|offer)|does\s+not\s+(?:support|allow|expose|provide|exist|let|offer)|there(?:'|’)?s\s+no\s+(?:way|api|hook|setting|option)|there\s+is\s+no\s+(?:way|api|hook|setting|option)|has\s+no\s+(?:way|api|hook|setting|option)|only\s+(?:supports?|allows?|exposes?))\b/i;

package/plugin/scripts/grounding-turn-gate.mjs

@@ -72,6 +72,15 @@
  *   At most ONE correction per stop episode: both checks compose into one message, and
  *   stop_hook_active silences the continued stop.
  *
+ * 4.4.0 — GATE 1 FIRES ON A CLAIM, NOT ON A TOPIC. Gate 1 arms on any prompt that names the rUv
+ * stack, and in this repository that is nearly every prompt. Replayed through this decide() on 183
+ * real deliveries of the correction (the owner's sessions, 2026-09-12..10-01): 172 were on answers
+ * that asserted nothing about a rUv tool (release status, git/CI, disk/backup, memory writes). Now a
+ * search is demanded only when the final answer asserts a rUv capability (ruvCapabilityClaims);
+ * measured on a held-out set of 70 real Stop points: false positives 68/68 -> 0/68, and 2 borderline
+ * claims (copula, parenthetical) are missed — tests/unit/grounding-turn-false-alarm.test.mjs.
+ * A LONG turn (the transcript tail cannot see its start) falls back to the stamps, never to a pass.
+ *
  * FAILS OPEN ALWAYS. Exit 0 unconditionally — a gate that breaks a turn's completion because a
  * cache directory was unreadable would be disabled within a day.
  */
@@ -84,7 +93,7 @@ import { markerPathFor, readMarker } from './grounding-turn-mark.mjs';
 import { readSettledTranscript } from './turn-outcome-capture.mjs';
 import {
   architectureShadow, auditAssertions, correctionText, describeSources, loadVocabulary, logShadow,
-  relayShadow, searchedThisTurn, turnSources,
+  relayShadow, ruvCapabilityClaims, searchedThisTurn, turnSources,
 } from './grounding-turn-evidence.mjs';
 
 const HOME = os.homedir();
@@ -145,6 +154,11 @@ export function decide({ hookInput, marker, markerMs, env = process.env, read =
     if (host === 'claude' && typeof tp === 'string' && /\.jsonl$/i.test(tp)) {
       try { turn = turnSources(read(tp, { maxMs: 0 })); } catch { turn = null; }
     }
+    // The transcript is read as a bounded TAIL. When the turn's opening prompt is not inside it
+    // (a long turn), the tail is a suffix of the turn and cannot prove a search did NOT happen
+    // earlier — so it is not evidence either way. Fall back to the stamp evidence (the same path
+    // Codex uses), never to a silent pass: `return null` here let every long turn skip the gate.
+    if (turn && !turn.boundaryFound) turn = null;
     const sources = turn ? turn.sources : null;
     const message = String(hookInput.last_assistant_message || '');
 
@@ -158,15 +172,20 @@ export function decide({ hookInput, marker, markerMs, env = process.env, read =
       for (const row of shadow) logShadow({ ...row, at: new Date().toISOString(), session: hookInput.session_id, host });
     }
 
-    const grounded = marker.gate1 === false ? true
-      : sources ? searchedThisTurn(sources) : wasGroundedSince(markerMs, newestGroundingStampMs());
+    // Gate 1 demands a search only when the answer ASSERTS what a rUv product does (the directive's
+    // own words). A status report, git/CI check or memory write on a rUv-named repo asserts nothing.
+    const ruvClaims = marker.gate1 === false ? [] : ruvCapabilityClaims(message);
+    const grounded = !ruvClaims.length
+      || (sources ? searchedThisTurn(sources) : wasGroundedSince(markerMs, newestGroundingStampMs()));
     if (assertion) {
-      return correctionText(assertion) + (grounded ? '' : '\nThis turn also touched the rUv stack and no successful search_ruvnet call was recorded: call it with the product term(s).');
+      return correctionText(assertion) + (grounded ? '' : '\nThis turn also asserted what a rUv tool does and no successful search_ruvnet call was recorded: call it with the product term(s).');
     }
     if (grounded) return null;
     return [
-      'This turn touched the RuvNet / rUv stack and ground-ruvnet\'s directive required calling the',
-      'search_ruvnet MCP tool before asserting what any RuvNet tool can/cannot do — but no successful',
+      `You asserted "${ruvClaims[0].text.slice(0, 200)}" about ${ruvClaims[0].subject}`
+        + (ruvClaims.length > 1 ? ` (and ${ruvClaims.length - 1} more rUv capability claim(s))` : '') + ', and',
+      'ground-ruvnet\'s directive requires calling the search_ruvnet MCP tool before asserting what any',
+      'RuvNet tool can/cannot do — but no successful',
       sources ? `search_ruvnet call is in this turn's transcript (read this turn: ${describeSources(sources).join('; ')}).`
         : 'search_ruvnet call was recorded this turn (checked against the grounding-stamp evidence).',
       '',

package/plugin/scripts/hook-shim.mjs

@@ -344,6 +344,9 @@ function runHook(file, activeVersion = '') {
   // invocation if the user flips the switch while the hook is mid-run.
   const env = {
     ...process.env,
+    // The node running THIS shim, for bash bodies that need node (grounding-stamp.sh's verdict) on a
+    // machine where `node` is not on the PATH the host hands its hooks. Additive: older bodies ignore it.
+    RUVNET_NODE_BIN: process.execPath,
     ...(activeVersion ? { RUVNET_BRAIN_ACTIVE_VERSION: activeVersion } : {}),
     ...(BRAIN_OFF && entry.offBehavior === 'partial' ? { RUVNET_BRAIN_OFF: '1' } : {}),
   };

package/plugin/scripts/kling-preflight.sh

@@ -32,6 +32,7 @@
 set -uo pipefail
 
 INPUT=""
+_l=""   # set -u: a read that times out before any byte leaves _l unset ("unbound variable" on stderr)
 # BOUNDED READ (2026-07-27, ADR-055 F20): an unqualified `read` never returns on a stdin that is
 # opened and never closed — measured across the mesh, 18 of 37 registered commands sat until the
 # harness killed them. Real Claude Code writes and closes, so this costs no normal turn; that is

package/plugin/scripts/learn-capture.sh

@@ -44,6 +44,7 @@ esac
 # payload's delivery time; the size cap is ~30x the largest real payload. The trailing `[ -n "$_l" ]`
 # keeps the final unterminated line, which is what the original `||` clause was for.
 INPUT=""
+_l=""   # set -u: a read that times out before any byte leaves _l unset ("unbound variable" on stderr)
 while IFS= read -r -t 2 _l; do
   INPUT+="$_l"
   [ ${#INPUT} -ge 65536 ] && break

package/plugin/scripts/project-progression-reader.mjs

@@ -207,11 +207,13 @@ export function openProgressionReader(dbPath) {
   };
   let listStatement;
   let readStatement;
+  let allStatement;
   try {
     // Prepared eagerly so an unexpected schema (or a WAL image this process cannot read) is
     // reported as UNAVAILABLE now, before the caller has committed to the fast path.
     listStatement = prepare(`SELECT key FROM memory_entries WHERE ${ACTIVE_ROW_SQL} AND namespace = ? ORDER BY key`);
     readStatement = prepare(`SELECT content FROM memory_entries WHERE ${ACTIVE_ROW_SQL} AND namespace = ? AND key = ?`);
+    allStatement = prepare(`SELECT namespace, key, content FROM memory_entries WHERE ${ACTIVE_ROW_SQL} ORDER BY namespace, key`);
   } catch (error) {
     try { database.close(); } catch { /* the open failure is the news */ }
     throw error;
@@ -252,6 +254,14 @@ export function openProgressionReader(dbPath) {
       return content;
     },
 
+    /** Every active (namespace, key, content) row — bounded, never truncated (past the bound is an error). */
+    allRows({ maxRows = 100_000 } = {}) {
+      const rows = query(allStatement, []);
+      if (rows.length > maxRows) throw new ProgressionReaderUnavailable(`store holds more than ${maxRows} active rows`);
+      return rows.map((row) => ({ namespace: String(row.namespace ?? ''), key: String(row.key ?? ''),
+        content: typeof row.content === 'string' ? row.content : null }));
+    },
+
     close() {
       try { database.close(); } catch { /* closing a spent read handle is never news */ }
     },

package/plugin/scripts/project-progression-sources.mjs

@@ -35,7 +35,19 @@ function git(cwd, args) {
 }
 
 /**
- * The source identity, with each digest defined EXACTLY:
+ * The Brain's OWN state that may sit inside the customer's project: the AgentDB store and its sidecars
+ * (`.swarm/` — memory.db, -wal/-shm, the outbox and queue files) and what ruflo leaves in a cwd
+ * (`.claude-flow/`, `ruvector.db`). It is not the customer's source. Every capture writes `.swarm/`, so
+ * counting it made every later boundary look like a changed tree: the no-op path was never taken and
+ * memory.db grew at every boundary. Excluded by pathspec, so it does not depend on the user's gitignore
+ * (it only looked fine on machines whose global gitignore lists `.swarm/`).
+ */
+export const BRAIN_STATE_PATHSPEC_EXCLUDES = Object.freeze([':(exclude).swarm', ':(exclude).claude-flow', ':(exclude)ruvector.db']);
+const SOURCE_PATHSPEC = ['--', '.', ...BRAIN_STATE_PATHSPEC_EXCLUDES];
+
+/**
+ * The source identity, with each digest defined EXACTLY (each one EXCLUDING the Brain's own state,
+ * BRAIN_STATE_PATHSPEC_EXCLUDES above):
  *   trackedDigest   sha256 of `git ls-files -s` (mode + blob oid + stage + path for every tracked file)
  *   untrackedDigest sha256 of one `<content-sha256> <path>` line per untracked, non-ignored file —
  *                   the NAMES alone would call two different working trees identical
@@ -63,9 +75,9 @@ export function readSourceIdentity({ checkoutRoot, kind = 'git' } = {}) {
 
   const headBefore = git(checkoutRoot, ['rev-parse', 'HEAD'])?.trim() || 'unborn';
   const branch = git(checkoutRoot, ['rev-parse', '--abbrev-ref', 'HEAD'])?.trim() || 'detached';
-  const tracked = git(checkoutRoot, ['ls-files', '-s']);
-  const untrackedList = git(checkoutRoot, ['ls-files', '--others', '--exclude-standard']);
-  const diff = git(checkoutRoot, ['diff', 'HEAD']);
+  const tracked = git(checkoutRoot, ['ls-files', '-s', ...SOURCE_PATHSPEC]);
+  const untrackedList = git(checkoutRoot, ['ls-files', '--others', '--exclude-standard', ...SOURCE_PATHSPEC]);
+  const diff = git(checkoutRoot, ['diff', 'HEAD', ...SOURCE_PATHSPEC]);
   const headAfter = git(checkoutRoot, ['rev-parse', 'HEAD'])?.trim() || 'unborn';
 
   const untrackedLines = String(untrackedList ?? '').split('\n').filter(Boolean).map((relative) => {

package/plugin/scripts/project-progression-store.mjs

@@ -1,4 +1,7 @@
 import { spawnSync } from 'node:child_process';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { ProgressionOutbox } from './project-progression-outbox.mjs';
 import {
@@ -132,6 +135,190 @@ function sortRejected(rows) {
     || left.reasons.join('|').localeCompare(right.reasons.join('|')));
 }
 
+/**
+ * The working directory ruflo runs in. ruflo writes into its cwd on every invocation even when --path
+ * names the store (measured 2026-10-01, ruflo 3.49.0): `.claude/`, `.claude-flow/`, `ruvector.db`, and
+ * `<cwd>/.swarm/` holding hnsw.metadata.json — the stored snapshot CONTENT — which it also LOADS when it
+ * finds one there (ruflo/v3/@claude-flow/cli/src/memory/memory-initializer.ts: getMemoryRoot() = cwd).
+ * So the cwd must be:
+ *  - never the project tree (it changed the customer's working tree and broke no-op capture detection),
+ *    never inside `.swarm` (nested `.swarm/.swarm`);
+ *  - PER PROJECT (one shared dir would pool every project's snapshot text and let one project load
+ *    another's metadata);
+ *  - private and ours: under the Brain's own home (never a shared /tmp name another user could pre-create
+ *    or symlink), every directory we create checked to be a real directory, owned by us, mode 0700.
+ * Every ruflo call carries --path, so the store it reads and writes is unaffected by the cwd.
+ */
+export function rufloScratchRoot(env = process.env) {
+  if (env.RUVNET_RUFLO_CWD_ROOT) return path.resolve(env.RUVNET_RUFLO_CWD_ROOT);
+  return path.join(env.RUVNET_BRAIN_HOME || path.join(os.homedir(), '.cache', 'ruvnet-brain'), 'ruflo-cwd');
+}
+
+/** Create-or-verify one private directory: a real directory (not a link), owned by us, mode 0700. */
+export function ensurePrivateDir(dir) {
+  try { fs.mkdirSync(dir, { mode: 0o700 }); } catch (error) { if (error?.code !== 'EEXIST') throw error; }
+  const stat = fs.lstatSync(dir);
+  if (stat.isSymbolicLink() || !stat.isDirectory()) {
+    throw new Error(`ruflo scratch directory ${dir} is not a real directory (symlink or file); refusing to use it`);
+  }
+  if (process.platform !== 'win32') {
+    if (stat.uid !== process.getuid()) {
+      throw new Error(`ruflo scratch directory ${dir} is owned by uid ${stat.uid}, not ${process.getuid()}; refusing to use it`);
+    }
+    if ((stat.mode & 0o777) !== 0o700) {
+      fs.chmodSync(dir, 0o700);
+      if ((fs.lstatSync(dir).mode & 0o777) !== 0o700) throw new Error(`ruflo scratch directory ${dir} could not be made private (0700)`);
+    }
+  }
+  return dir;
+}
+
+export function rufloCwdFor(storePath, { root = rufloScratchRoot() } = {}) {
+  const projectKey = crypto.createHash('sha256').update(path.resolve(storePath)).digest('hex').slice(0, 32);
+  fs.mkdirSync(path.dirname(root), { recursive: true });
+  ensurePrivateDir(root);
+  return ensurePrivateDir(path.join(root, projectKey));
+}
+
+/**
+ * 4.3.40 ran ruflo with cwd `<project>/.swarm`, so upgraded projects still hold ruflo's cwd artifacts
+ * INSIDE the store directory — including `.swarm/.swarm/hnsw.metadata.json`, a copy of snapshot content.
+ * Removes exactly those, and only when every path in them is one ruflo is known to write there; anything
+ * unexpected (or any symlink) leaves that artifact untouched and is REPORTED. The store itself
+ * (memory.db, -wal/-shm, schema.sql), the outbox and queue files are never candidates.
+ *
+ * The allowlist is measured, not guessed: real ruflo 3.49.0 run with cwd=<dir> and --path elsewhere
+ * writes .claude/{memory.db,.proven-config-version,proven-config.json} (init/store),
+ * .claude-flow/harness-active-policy.json and .swarm/{hnsw.index,hnsw.metadata.json} and ruvector.db
+ * (store), .claude-flow/policy/state.json (retrieve). The owner's real 4.3.40 projects also hold
+ * .swarm/.swarm/agentdb-memory.db(-wal,-shm): ruflo's AgentDB bridge opens <cwd>/.swarm/agentdb-memory.db
+ * (ruflo/v3/@claude-flow/cli/src/memory/memory-bridge.ts getAgentDbPath), and the native bindings drop
+ * ruvector.db into whatever cwd they run in (ruflo/scripts/smoke-memory-no-stray-db.mjs, ADR-125 Phase 7).
+ */
+const SQLITE = (name) => [name, `${name}-wal`, `${name}-shm`, `${name}-journal`];
+const LEGACY_CWD_ARTIFACTS = Object.freeze({
+  '.swarm': new Set(['hnsw.index', 'hnsw.metadata.json', ...SQLITE('agentdb-memory.db')]),
+  '.claude': new Set(['.proven-config-version', 'proven-config.json', ...SQLITE('memory.db')]),
+  '.claude-flow': new Set(['harness-active-policy.json', 'policy/', 'policy/state.json']),
+  'ruvector.db': null, // a regular file
+});
+
+/** Every path under `dir`, relative, directories with a trailing slash; symlinks reported, never followed. */
+function relativeEntries(dir) {
+  const out = [];
+  const walk = (current, prefix) => {
+    for (const name of fs.readdirSync(current)) {
+      const full = path.join(current, name);
+      const stat = fs.lstatSync(full);
+      const rel = prefix + name;
+      if (stat.isSymbolicLink()) out.push({ rel, link: true });
+      else if (stat.isDirectory()) { out.push({ rel: `${rel}/` }); walk(full, `${rel}/`); }
+      else out.push({ rel, file: stat.isFile() });
+    }
+  };
+  walk(dir, '');
+  return out;
+}
+
+/**
+ * With `dryRun`, reports what WOULD be removed and touches nothing (--doctor). Returns
+ * { removed: [paths], refused: [{ path, reason }] }; a refusal must be shown to the user, never dropped.
+ */
+const IN_USE_MS = 10 * 60_000;
+// The files that carry DATA: the database, its WAL and its rollback journal. Never -shm: it is the WAL
+// index, and every reader — including this proof's own read-only open — rewrites it. Counting it made
+// every real 4.3.40 store look "changed while it was being checked" (and "in use" on the next run).
+const dataFiles = (dbPath) => {
+  const base = path.basename(dbPath);
+  return [base, `${base}-wal`, `${base}-journal`];
+};
+const sqliteFingerprint = (dbPath) => dataFiles(dbPath).map((name) => {
+  try { const st = fs.statSync(path.join(path.dirname(dbPath), name)); return `${name}:${st.size}:${st.mtimeMs}`; }
+  catch { return `${name}:absent`; }
+});
+const sameFiles = (a, b) => a.join('|') === b.join('|');
+
+/**
+ * Is every active (namespace, key, content) row of a stray nested AgentDB present, byte-identical, in
+ * the canonical store? Read-only through the progression reader (node:sqlite, readOnly — no write, no
+ * checkpoint). Anything it cannot prove — recently written (in use), unreadable, a row missing or
+ * different — keeps the file and says why.
+ */
+export function proveMirrored(nestedDb, canonicalDb, { now = Date.now(), maxRows = 100_000 } = {}) {
+  const fingerprint = sqliteFingerprint(nestedDb);
+  const newest = Math.max(...dataFiles(nestedDb).map((name) => {
+    try { return fs.statSync(path.join(path.dirname(nestedDb), name)).mtimeMs; } catch { return 0; }
+  }));
+  if (now - newest < IN_USE_MS) return { ok: false, reason: `kept: agentdb-memory.db was written ${Math.round((now - newest) / 1000)}s ago (in use)` };
+  const nested = withProgressionReader(nestedDb, (reader) => reader.allRows({ maxRows }));
+  if (!nested.ok) return { ok: false, reason: `kept: agentdb-memory.db could not be read to prove it is mirrored (${nested.reason})` };
+  const canonical = withProgressionReader(canonicalDb, (reader) => reader.allRows({ maxRows }));
+  if (!canonical.ok) return { ok: false, reason: `kept: memory.db could not be read to prove agentdb-memory.db is mirrored (${canonical.reason})` };
+  const have = new Map(canonical.value.map((row) => [`${row.namespace}\u0000${row.key}`, row.content]));
+  const missing = nested.value.filter((row) => row.content === null || have.get(`${row.namespace}\u0000${row.key}`) !== row.content);
+  if (missing.length) return { ok: false, reason: `kept: ${missing.length} of ${nested.value.length} rows not in memory.db`, missing: missing.length };
+  return { ok: true, rows: nested.value.length, fingerprint };
+}
+
+export function cleanLegacyRufloDebris(storeDir, { dryRun = false, now = Date.now() } = {}) {
+  const removed = [];
+  const refused = [];
+  for (const [name, allowed] of Object.entries(LEGACY_CWD_ARTIFACTS)) {
+    const entry = path.join(storeDir, name);
+    let stat;
+    try { stat = fs.lstatSync(entry); } catch { continue; } // absent: nothing to do
+    if (stat.isSymbolicLink()) { refused.push({ path: entry, reason: 'symbolic link' }); continue; }
+    if (allowed === null) {
+      if (!stat.isFile()) { refused.push({ path: entry, reason: 'not a regular file' }); continue; }
+    } else {
+      if (!stat.isDirectory()) { refused.push({ path: entry, reason: 'not a directory' }); continue; }
+      const unknown = relativeEntries(entry).filter((item) => item.link || item.file === false || !allowed.has(item.rel))
+        .map((item) => (item.link ? `${item.rel} (symbolic link)` : item.rel));
+      if (unknown.length) { refused.push({ path: entry, reason: `unexpected entries: ${unknown.join(', ')}` }); continue; }
+    }
+    // A nested AgentDB is a real store (owner's projects: 1-41 rows, still written by open 4.3.40
+    // sessions). It goes only when every row is PROVEN present, identically, in the canonical memory.db.
+    const nestedDb = path.join(entry, 'agentdb-memory.db');
+    const mirror = name === '.swarm' && fs.existsSync(nestedDb) ? proveMirrored(nestedDb, path.join(storeDir, 'memory.db'), { now }) : null;
+    if (mirror && !mirror.ok) { refused.push({ path: entry, reason: mirror.reason, kept: true }); continue; }
+    if (!dryRun) {
+      // The proof is only valid for the bytes it read: anything written since means the file is in use.
+      if (mirror && !sameFiles(mirror.fingerprint, sqliteFingerprint(nestedDb))) {
+        refused.push({ path: entry, reason: 'kept: agentdb-memory.db changed while it was being checked (in use)', kept: true });
+        continue;
+      }
+      fs.rmSync(entry, { recursive: true, force: true });
+    }
+    removed.push(entry);
+  }
+  return { removed, refused };
+}
+
+// What ruflo leaves in a cwd (measured, ruflo 3.49.0): `.swarm/` (hnsw.index, hnsw.metadata.json — a
+// copy of every stored value), `.claude/`, `.claude-flow/`, `ruvector.db`. None of it is read back by the
+// product: every call carries --path, and the store of record is that file.
+const RUFLO_CWD_ARTIFACTS = Object.freeze(['.swarm', '.claude', '.claude-flow', 'ruvector.db']);
+const STALE_RUN_MS = 3_600_000;
+
+/**
+ * One ruflo invocation's working directory: a fresh private `run-*` directory inside the project's
+ * scratch dir, removed again by the caller after the call. ruflo copies every snapshot it touches into
+ * `<cwd>/.swarm/hnsw.metadata.json`; with one cwd per call that copy never accumulates (4.4.0 kept one
+ * per project that grew without bound and outlived the project). Also clears what 4.4.0 left directly
+ * in the project scratch dir and any `run-*` older than an hour (a call killed before its cleanup).
+ */
+export function rufloRunDir(storePath, { root = rufloScratchRoot(), now = Date.now() } = {}) {
+  const projectScratch = rufloCwdFor(storePath, { root });
+  for (const name of fs.readdirSync(projectScratch)) {
+    const entry = path.join(projectScratch, name);
+    let stat;
+    try { stat = fs.lstatSync(entry); } catch { continue; }
+    const stale = name.startsWith('run-') && stat.isDirectory() && now - stat.mtimeMs > STALE_RUN_MS;
+    if (RUFLO_CWD_ARTIFACTS.includes(name) || stale) fs.rmSync(entry, { recursive: true, force: true });
+  }
+  return fs.mkdtempSync(path.join(projectScratch, 'run-'));
+}
+
 export class ProjectProgressionStore {
   constructor({
     projectDir,
@@ -146,6 +333,9 @@ export class ProjectProgressionStore {
   } = {}) {
     if (!rufloBinary) throw new Error(RUFLO_MISSING);
     this.resolution = resolveProjectStore({ projectDir, requestedStorePath });
+    // Best effort: a cleanup that cannot run must never stop a capture or a restore.
+    try { this.legacyDebris = cleanLegacyRufloDebris(path.dirname(this.resolution.canonicalAgentDbPath)); }
+    catch (error) { this.legacyDebris = { removed: [], refused: [{ path: null, reason: error.message }] }; }
     this.rufloBinary = rufloBinary;
     this.runner = runner;
     this.clock = clock;
@@ -164,12 +354,17 @@ export class ProjectProgressionStore {
   }
 
   run(args) {
-    return this.runner(this.rufloBinary, args, {
-      cwd: path.dirname(this.resolution.canonicalAgentDbPath),
-      encoding: 'utf8',
-      timeout: 120_000,
-      env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' },
-    });
+    const cwd = rufloRunDir(this.resolution.canonicalAgentDbPath);
+    try {
+      return this.runner(this.rufloBinary, args, {
+        cwd,
+        encoding: 'utf8',
+        timeout: 120_000,
+        env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' },
+      });
+    } finally {
+      fs.rmSync(cwd, { recursive: true, force: true });
+    }
   }
 
   validateSnapshot(snapshot) {

package/plugin/scripts/protect-brain-state.sh

@@ -41,6 +41,7 @@ INPUT=""
 # exactly why a hook that CAN hang forever survives unnoticed. -t bounds the wait, and the string
 # is truncated AFTER the loop because a hook payload is one line with no newline, so `read` hands
 # the whole thing back at once and a per-iteration cap never fires.
+_l=""   # set -u: a read that times out before any byte leaves _l unset ("unbound variable" on stderr)
 while IFS= read -r -t 2 _l; do
   INPUT+="$_l"
   [ ${#INPUT} -ge 65536 ] && break

package/plugin/scripts/route-dispatch.sh

@@ -44,6 +44,7 @@ INPUT=""
 # exactly why a hook that CAN hang forever survives unnoticed. -t bounds the wait, and the string
 # is truncated AFTER the loop because a hook payload is one line with no newline, so `read` hands
 # the whole thing back at once and a per-iteration cap never fires.
+_line=""   # set -u: a read that times out before any byte leaves _line unset ("unbound variable" on stderr)
 while IFS= read -r -t 2 _line; do
   INPUT+="$_line"
   [ ${#INPUT} -ge 65536 ] && break