ruvnet-brain 4.3.9 → 4.3.10

package/plugin/scripts/version-bump-gate.sh

@@ -18,11 +18,21 @@
 # is the product. This is that discipline applied at the push boundary.
 #
 # CONTRACT: exit 0 = allow · exit 2 + stderr = BLOCK. FAILS OPEN on anything unparseable.
-# Opt-in (router profile.json), bash builtins + git only — same hardening as its four siblings.
+# Opt-in (router profile.json); local Git checks and a Node maintenance-state check.
 # ─────────────────────────────────────────────────────────────────────────────────────────────
 
 set -uo pipefail
 
+# Reversible, repository-scoped development maintenance; no profile, ledger, or Git work first.
+MAINTENANCE_HELPER="${BASH_SOURCE[0]%/*}/development-maintenance.mjs"
+if [ -f "$MAINTENANCE_HELPER" ] && node --input-type=module -e '
+  import { pathToFileURL } from "node:url";
+  const { developmentHooksSuspended } = await import(pathToFileURL(process.argv[1]));
+  process.exit(developmentHooksSuspended() ? 0 : 1);
+' "$MAINTENANCE_HELPER" >/dev/null 2>&1; then
+  exit 0
+fi
+
 INPUT=""
 # BOUNDED READ (2026-07-27, ADR-055 F20): an unqualified `read` never returns on a stdin that is
 # opened and never closed — measured across the mesh, 18 of 37 registered commands sat until the
@@ -42,7 +52,9 @@ PROFILE="${MODEL_ROUTER_PROFILE:-$HOME/.claude/model-router/profile.json}"
 [ -f "$PROFILE" ] || exit 0
 [ "${RUVNET_SKIP_VERSION_GATE:-0}" = "1" ] && exit 0
 
-field() { local re="\"$1\"[[:space:]]*:[[:space:]]*\"([^\"]*)\""; [[ $INPUT =~ $re ]] && printf '%s' "${BASH_REMATCH[1]}"; }
+# Consume JSON escape pairs so quoted commit messages do not truncate the command before a
+# following git push. This retains the existing bounded Bash parser's matching behavior.
+field() { local re="\"$1\"[[:space:]]*:[[:space:]]*\"([^\"\\\\]*(\\\\.[^\"\\\\]*)*)\""; [[ $INPUT =~ $re ]] && printf '%s' "${BASH_REMATCH[1]}"; }
 [ "$(field tool_name)" = "Bash" ] || exit 0
 CMD=$(field command)
 [[ $CMD == *"git push"* ]] || exit 0

package/plugin/skills/ruvnet-brain/PLAYBOOK.md

@@ -1,23 +1,19 @@
 # THE PLAYBOOK — the standing build playbook, in full
 
-Updated: 2026-08-19 | Version 1.1.0
+Updated: 2026-09-07 11:07:28 EDT | Version 1.2.0
 Created: 2026-07-27
 
-**Read this before your first build response in a session.** `plugin/scripts/session-start.sh`
-injects a condensed form of it into every session's context and points here for the full text; the
-UserPromptSubmit gate (`plugin/scripts/ground-ruvnet.sh` Gate 3) refers back to it on each build turn
-as *THE PLAYBOOK*.
+**Read this when explicitly using the Brain build skill.** Automatic Brain lifecycle hooks are
+retired: no SessionStart or UserPromptSubmit registration injects this playbook. MCP, skills and
+explicit commands remain available; the user or lead agent invokes them when appropriate.
 
-## Why this file exists rather than nine kilobytes of context
-
-The full text below used to be printed verbatim by the SessionStart hook, on every session, in every
-project on the machine. Measured 2026-07-27: 6,282 bytes of it, inside a 9,127-byte hook output
-against `scripts/selfcheck.mjs`'s 4,096-byte cap — a cap that exists because, in that file's own
-words, *"it lands in the user's context window."* Static instructional prose does not need to be
-re-injected verbatim every session to be obeyed; a directive plus a pointer does the same job for
-about a fifth of the bytes, and the full text stays one `Read` away for the turn that actually needs
-it. The condensed form the hook injects keeps every operative instruction — what is here and not
-there is elaboration, worked examples, and phrasing guidance.
+Release work uses `scripts/release-qualification.mjs` and its reviewed requirement inventory.
+The retained tests were individually reviewed; the historical approximately 4,332 unit cases were
+not all individually audited and remain diagnostics. A diagnostic pass is not production proof.
+Promote only the clean exact candidate SHA and its sealed artifacts after qualification. Public
+acceptance still requires all nine OS/host-mode leaves plus real native installed-update proof on
+each platform, ending at `install-verified`. Imported upstream corpus freshness remains UNKNOWN
+until separately proven. See `docs/QA-RELEASE-PROCESS.md` and the audit records in `docs/reviews/`.
 
 ---
 
@@ -110,14 +106,10 @@ rule-compliance, cite a source the tools didn't return, or claim a check that di
   A completion moves that task to completed, unblocks its dependents, and the freed slot claims the
   first unassigned, unblocked pending task immediately. Only allow a slot to idle when no such task
   exists. Keep dependent integration with the designated integration owner.
-  - **Claude Code:** its shared task ledger and `TeammateIdle` hook make recycling enforceable: the
-    shipped recycler refuses idle while a ready unassigned task exists, then Claude's locked
-    `TaskUpdate` claim performs the transition.
-  - **Codex:** Codex 0.146.0 exposes no `TeammateIdle` or `TaskCompleted` hook and no equivalent
-    shared-task hook ledger. Initial fan-out and completion-notification recycling are guidance,
-    not hook enforcement: the lead must immediately dispatch the next ready ledger item when a
-    collaboration slot completes. State this degraded boundary if it affects the run; never call it
-    enforced.
+  - **Claude Code and Codex:** the lead explicitly dispatches the next ready task when a slot
+    completes. No automatic `TeammateIdle` or `TaskCompleted` Brain handler enforces recycling.
+    `plugin/scripts/swarm-slot-recycler.mjs` remains available for explicit invocation with an
+    appropriate task ledger; do not describe its mere presence as active host enforcement.
   If Ruflo / RuVector MCP tools aren't available in this environment, DON'T block or stall — degrade
   gracefully to the native host's agents and local .rvf, and briefly note the tool that would make
   it better + how to add it. Never demand a tool the user doesn't have.

package/scripts/build-bundle.mjs

@@ -22,6 +22,7 @@ import { getVersion, getVersionTag, stripTag } from './version.mjs';
 import { auditRvfIndexes } from './rvf-index-audit.mjs';
 import { readRvfGenerations, validateSelectedRvfGenerations } from './rvf-generation.mjs';
 import { validatePublicInventory } from './public-inventory.mjs';
+import { bindAssembledReleaseProjection } from './release-projection.mjs';
 // The org total is DERIVED, never a literal: it was hardcoded 248 in this file and in its
 // sibling while the account actually had 200 — one stale fact, restated twice (2026-08-12).
 import { orgRepoCount } from './org-repo-count.mjs';
@@ -590,6 +591,13 @@ if (missing.length) {
   process.exit(1);
 }
 
+if (PROJECTION) {
+  const source = spawnSync('git', ['rev-parse', 'HEAD'], { cwd: ROOT, encoding: 'utf8' });
+  if (source.status !== 0) throw new Error('cannot identify the projected bundle source');
+  bindAssembledReleaseProjection({ assetsDir: OUT, version: stripTag(BRAIN_VERSION),
+    sourceSnapshot: source.stdout.trim() });
+}
+
 // ---- exact release artifact -------------------------------------------------------------------
 // The release signer signs dist/ruvnet-brain.zip, not this assembly directory. Rebuilding only the
 // directory can therefore sign stale bytes left by an older run—the source tree is green while

package/scripts/build-primer.mjs

@@ -13,6 +13,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { rerankKb } from '../kb/forge-rerank.mjs';
+import { writeGroundedPrimer } from './primer-grounding.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const arg = (f, d) => { const i = process.argv.indexOf(f); return i >= 0 && process.argv[i + 1] ? process.argv[i + 1] : d; };
@@ -57,10 +58,8 @@ for (const a of ARCHES) {
 }
 
 const primer = `# ${NAME} — Primer\n\n<!-- Generated primer · grounded in real source via rerankKb (${VARIANT}) · archetypes: ${ARCHES.map(a => a.key).join(', ')} -->\n\n${sections.join('\n')}`;
-const countRefs = (txt) => [...new Set([...allPaths].filter((p) => txt.includes(p) || txt.includes(p.split('/').pop())))];
-const refs = countRefs(primer);
 const outFile = path.join(KB, `${NAME}-primer.md`);
-fs.writeFileSync(outFile, primer);
+const refs = writeGroundedPrimer({ primer, sourcePaths: allPaths, output: outFile });
 
 // 3-vendor "is this a complete, correct primer?" score (informational; the hard gate is citation count)
 const jsys = 'Grade 1-100 whether this repo primer is COMPLETE, CORRECT and CONFIDENT for an engineer new to the repo (98=excellent/actionable; vague-or-hedgy=POISON<50). Return ONLY {"score":N,"reason":"<=15 words"}.';

package/scripts/candidate-host-evidence.mjs

@@ -1,56 +1,74 @@
 #!/usr/bin/env node
-import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
-import { stagedHostVerifier } from './staged-host-verifier.mjs';
+import { fileURLToPath } from 'node:url';
+import { stagedHostVerifier, readCandidateRetrieval, verifyCandidateRetrievalAssets } from './staged-host-verifier.mjs';
 import { payloadIdFor } from './release-payload.mjs';
+import { validateRetrievalCanaryReceipt } from './retrieval-canary.mjs';
 
 const arg = (name) => {
   const index = process.argv.indexOf(name);
   return index >= 0 ? process.argv[index + 1] : null;
 };
-const sha256 = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
 
-const manifestPath = path.resolve(arg('--manifest'));
-const packagePath = path.resolve(arg('--package'));
-const bundlePath = path.resolve(arg('--bundle'));
-const out = path.resolve(arg('--out'));
-const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
-const payloadId = payloadIdFor(manifest);
-const identity = { version: manifest.version, candidateSha: manifest.candidateSha, payloadId };
-const result = await stagedHostVerifier({ assets: { packagePath, bundlePath }, identity })
-  .verify({ source: 'candidate', assets: { packagePath, bundlePath } });
-if (result.verdict !== 'PASS') throw new Error(`candidate host matrix failed: ${result.error || 'unknown'}`);
-
-const modeNames = { claude: 'claude-only', codex: 'codex-only', dual: 'dual-host' };
-const leaves = Object.entries(modeNames).map(([mode, name]) => {
-  const fixture = result.fixtures?.[mode];
-  const grounding = fixture?.grounding;
-  const grounded = grounding && ['repo', 'path', 'file', 'storedPath']
-    .every((field) => typeof grounding[field] === 'string' && grounding[field].trim());
-  if (fixture?.status !== 'PASS' || fixture?.process?.status !== 0 || !grounded) {
-    throw new Error(`${name} did not produce a clean installed-search grounding receipt`);
+export async function buildCandidateHostEvidence({ manifestFile, packagePath, bundlePath, planFile, coverageFile, failureFile },
+  { createVerifier = stagedHostVerifier } = {}) {
+  const manifest = JSON.parse(fs.readFileSync(manifestFile, 'utf8'));
+  const payloadId = payloadIdFor(manifest);
+  const identity = { version: manifest.version, candidateSha: manifest.candidateSha, payloadId };
+  const retrieval = readCandidateRetrieval({ manifest, planFile, coverageFile });
+  verifyCandidateRetrievalAssets({ retrieval, assets: { packagePath, bundlePath } });
+  const result = await createVerifier({ assets: { packagePath, bundlePath }, identity, retrieval })
+    .verify({ source: 'candidate', assets: { packagePath, bundlePath } });
+  verifyCandidateRetrievalAssets({ retrieval, assets: { packagePath, bundlePath } });
+  if (result.verdict !== 'PASS') {
+    if (failureFile) fs.writeFileSync(path.resolve(failureFile), JSON.stringify({
+      schemaVersion: 1, kind: 'ruvnet-brain-candidate-host-failure', verdict: 'FAIL',
+      sha: manifest.candidateSha, payloadId, artifactSha256: retrieval.artifactSha256,
+      candidateArchiveSha256: retrieval.candidateArchiveSha256, planSha256: retrieval.plan.planSha256,
+      result,
+    }, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
+    throw new Error(`candidate host matrix failed: ${result.error || 'unknown'}`);
   }
+
+  const modeNames = { claude: 'claude-only', codex: 'codex-only', dual: 'dual-host' };
+  const leaves = Object.entries(modeNames).map(([mode, name]) => {
+    const fixture = result.fixtures?.[mode];
+    const grounding = fixture?.grounding;
+    const grounded = grounding && ['repo', 'path', 'file', 'storedPath']
+      .every((field) => typeof grounding[field] === 'string' && grounding[field].trim());
+    if (fixture?.status !== 'PASS' || fixture?.process?.status !== 0 || !grounded) {
+      throw new Error(`${name} did not produce a clean installed-search grounding receipt`);
+    }
+    validateRetrievalCanaryReceipt(fixture.retrieval, { plan: retrieval.plan });
+    return {
+      name,
+      sha: manifest.candidateSha,
+      payloadId,
+      status: fixture.status === 'PASS' ? 'completed' : 'failed',
+      conclusion: 'success',
+      verdict: 'PASS',
+      source: 'candidate-host-evidence',
+      mode,
+      functionalSearch: true,
+      searchExit: fixture.process.status,
+      grounding,
+      retrieval: fixture.retrieval,
+      artifactSha256: retrieval.artifactSha256,
+    };
+  });
   return {
-    name,
+    schemaVersion: 1,
     sha: manifest.candidateSha,
     payloadId,
-    status: fixture.status === 'PASS' ? 'completed' : 'failed',
-    conclusion: 'success',
-    verdict: 'PASS',
-    source: 'candidate-host-evidence',
-    mode,
-    functionalSearch: true,
-    searchExit: fixture.process.status,
-    grounding,
-    artifactSha256: sha256(packagePath),
+    artifactSha256: retrieval.artifactSha256,
+    leaves,
   };
-});
-fs.writeFileSync(out, `${JSON.stringify({
-  schemaVersion: 1,
-  sha: manifest.candidateSha,
-  payloadId,
-  artifactSha256: sha256(packagePath),
-  leaves,
-}, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
-console.log(JSON.stringify({ verdict: 'PASS', payloadId, leaves: leaves.map(({ name }) => name) }));
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const evidence = await buildCandidateHostEvidence({ manifestFile: arg('--manifest'),
+    packagePath: arg('--package'), bundlePath: arg('--bundle'), planFile: arg('--plan'), coverageFile: arg('--coverage'), failureFile: arg('--out') ? `${arg('--out')}.failure.json` : null });
+  fs.writeFileSync(path.resolve(arg('--out')), `${JSON.stringify(evidence, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+  console.log(JSON.stringify({ verdict: 'PASS', payloadId: evidence.payloadId, leaves: evidence.leaves.map(({ name }) => name) }));
+}

package/scripts/ci/build-fixture-kb.mjs

@@ -23,6 +23,9 @@
 //
 //   node scripts/ci/build-fixture-kb.mjs --out <dir> [--drop-mcp] [--no-rvf]
 import fs from 'node:fs';
+import crypto from 'node:crypto';
+import { coverageGenerationFor, releaseCoverageGenerationFor, validateCoverageDirectory } from '../../plugin/scripts/coverage-integrity.mjs';
+import { validatePublicInventory } from '../public-inventory.mjs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -60,8 +63,62 @@ fs.writeFileSync(path.join(OUT, 'package.json'), JSON.stringify({
   },
 }, null, 2));
 
-if (!NO_RVF) {
-  fs.writeFileSync(path.join(OUT, 'fixture.rvf'), 'not a real store — presence is what gatherInstallState() counts\n');
+// Synthetic coverage uses the production validators; it is not release evidence.
+{
+  const dir = OUT;
+  const source = { brainVersion: JSON.parse(fs.readFileSync(path.join(REPO_ROOT, 'package.json'))).version, stores: { fixture: {} } };
+  fs.writeFileSync(path.join(dir, 'SOURCE.json'), JSON.stringify(source));
+  const storeNames = ['fixture'];
+  const sourceSnapshot = 'd'.repeat(40);
+  const publicLedger = { schemaVersion: 2, kind: 'ruvnet-brain-public-generation-ledger',
+    brainVersion: source.brainVersion, releaseTag: `v${source.brainVersion}`, sourceSnapshot, stores: {} };
+  for (const name of storeNames) {
+    const bytes = Buffer.alloc(512, 7);
+    fs.writeFileSync(path.join(dir, `${name}.big.rvf`), bytes);
+    publicLedger.stores[name] = { file: `${name}.big.rvf`, sha256: crypto.createHash('sha256').update(bytes).digest('hex'),
+      bytes: bytes.length, sourceCommit: source.stores[name].sourceCommit || null,
+      model: 'fixture-model', dimensions: 384, builtUtc: '2026-08-21T12:00:00.000Z' };
+  }
+  const publicLedgerBytes = Buffer.from(`${JSON.stringify(publicLedger)}\n`);
+  fs.writeFileSync(path.join(dir, 'RVF-GENERATIONS.json'), `${JSON.stringify({ ...publicLedger,
+    kind: 'ruvnet-brain-runtime-generation-ledger' })}\n`);
+  fs.writeFileSync(path.join(dir, 'PUBLIC-RVF-GENERATIONS.json'), publicLedgerBytes);
+  fs.writeFileSync(path.join(dir, 'PRIVATE-STORES.json'), JSON.stringify({ privateStores: [] }));
+  fs.writeFileSync(path.join(dir, 'public-store-classes.json'), JSON.stringify({ schemaVersion: 1, derived: [] }));
+  const rows = storeNames.map((name) => ({ key: `repo:${name}`, kind: 'repository', name,
+    url: `https://github.com/ruvnet/${name}`, status: 'CURRENT', disposition: 'eligible', upstream: {},
+    artifact: { store: name }, reasons: [] }));
+  const enumerationReceipt = { schemaVersion: 1, terminal: true, duplicateKeys: 0,
+    repositories: { expected: rows.length, pages: [] }, gists: { expected: 0, pages: [] } };
+  const generatorSourceSha = 'a'.repeat(64);
+  const snapshotRoot = 'b'.repeat(64);
+  const sourceObservationSha256 = 'c'.repeat(64);
+  const policy = { policyDispositionDigests: [], exemptionDigests: [] };
+  const corpus = { schemaVersion: 1, kind: 'ruvnet-brain-corpus-coverage', generatorSourceSha,
+    snapshotRoot, sourceObservationSha256, rows, enumerationReceipt, policy,
+    totals: { rows: rows.length, repositories: rows.length, gists: 0, byStatus: { CURRENT: rows.length } } };
+  corpus.coverageGeneration = coverageGenerationFor({ generatorSourceSha, snapshotRoot,
+    sourceObservationSha256, rows, enumerationReceipt, policyDispositionDigests: [], exemptionDigests: [] });
+  const corpusBytes = `${JSON.stringify(corpus, null, 2)}\n`;
+  fs.writeFileSync(path.join(dir, 'CORPUS-COVERAGE.json'), corpusBytes);
+  const publicInventory = validatePublicInventory({ assetsDir: dir, coverage: corpus, ledger: publicLedger });
+  const release = { ...structuredClone(corpus), kind: 'ruvnet-brain-release-coverage',
+    releaseIdentity: { version: source.brainVersion, tag: `v${source.brainVersion}`, sourceSnapshot },
+    corpusSeed: { tag: `corpus-sha256-${'e'.repeat(64)}`, archiveSha256: 'e'.repeat(64), archiveBytes: 1,
+      receiptSha256: 'f'.repeat(64) },
+    corpusCoverage: { file: 'CORPUS-COVERAGE.json', sha256: crypto.createHash('sha256').update(corpusBytes).digest('hex'),
+      coverageGeneration: corpus.coverageGeneration },
+    generationLedger: { file: 'PUBLIC-RVF-GENERATIONS.json', sha256: crypto.createHash('sha256').update(publicLedgerBytes).digest('hex'),
+      bytes: publicLedgerBytes.length, storeCount: storeNames.length },
+    publicInventoryPartitionSha256: publicInventory.partitionSha256,
+    installedProjectionSchema: 2 };
+  delete release.coverageGeneration;
+  release.releaseCoverageGeneration = releaseCoverageGenerationFor(release);
+  fs.writeFileSync(path.join(dir, 'COVERAGE.json'), JSON.stringify(release));
+  const validation = validateCoverageDirectory(dir, { expectedVersion: source.brainVersion });
+  if (!validation.valid) throw new Error(validation.failures.join('; '));
+  // Deliberately corrupt the validated fixture only for the early integrity-failure scenario.
+  if (NO_RVF) fs.rmSync(path.join(dir, 'fixture.big.rvf'));
 }
 
 console.log(`[build-fixture-kb] staged ${OUT} (mcp: ${!DROP_MCP}, rvf: ${!NO_RVF})`);

package/scripts/ci/mutate-hook-timeout.mjs

@@ -1,20 +1,10 @@
 #!/usr/bin/env node
-// scripts/ci/mutate-hook-timeout.mjs — M-D8c (ADR-058 §D8): register ONE additional hook in the
-// PACKED, INSTALLED hooks.json whose body sleeps past its declared timeout, then run
-// `--doctor --hooks` again against the SAME installed surface and assert the battery goes RED.
-// Proves the hook-FIRE assertion is real (a genuine watchdog catch), not manifest-present —
-// tests/integration/install-smoke.mjs's own `--doctor --hooks goes RED when a registered hook
-// sleeps past its declared timeout` test is the fast local rehearsal of this exact mechanism
-// against a synthetic surface; this runs it against the REAL packed-and-installed plugin tree a
-// stranger's machine actually has, right after the `healthy` scenario's install.
-//
-//   node scripts/ci/mutate-hook-timeout.mjs --installed <dir> --home <dir>
+// Legacy filename: verify forbidden automatic registration is refused without executing its body.
+// Uses the actual installed package manifest and doctor, not a synthetic status callback.
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
 
-const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 const argv = process.argv.slice(2);
 const arg = (flag) => { const i = argv.indexOf(flag); return i >= 0 && argv[i + 1] ? argv[i + 1] : null; };
 const INSTALLED = arg('--installed');
@@ -25,46 +15,33 @@ if (!INSTALLED || !HOME_DIR) {
   process.exit(2);
 }
 
-const pluginRoot = path.join(HOME_DIR, '.claude', 'plugins', 'marketplaces', 'ruvnet-brain', 'plugin');
+const pluginRoot = path.join(INSTALLED, 'plugin');
 const hooksFile = path.join(pluginRoot, 'hooks', 'hooks.json');
 if (!fs.existsSync(hooksFile)) {
   console.error(`[mutate-hook-timeout] FAIL: no installed hooks.json at ${hooksFile} — run the healthy scenario first`);
   process.exit(1);
 }
 
-// The REAL held-open-stdin hang fixture this repo already uses to prove the watchdog
-// (tests/fixtures/selfcheck-hooks/hang.mjs) — a synchronous stdin read freezes the event loop, so
-// only an EXTERNAL watchdog (never an in-process timer) can catch it.
-fs.copyFileSync(
-  path.join(REPO_ROOT, 'tests', 'fixtures', 'selfcheck-hooks', 'hang.mjs'),
-  path.join(pluginRoot, 'scripts', 'ci-hang-fixture.mjs'),
-);
-
-const doc = JSON.parse(fs.readFileSync(hooksFile, 'utf8'));
+// Legacy filename retained. The current invariant rejects registration without running its body.
+const original = fs.readFileSync(hooksFile);
+const marker = path.join(HOME_DIR, 'forbidden-hook-executed');
+const body = path.join(pluginRoot, 'scripts', 'ci-forbidden-hook.mjs');
+fs.writeFileSync(body, `import fs from 'node:fs'; fs.writeFileSync(${JSON.stringify(marker)}, 'executed');`);
+const doc = JSON.parse(original);
 doc.hooks ??= {};
-doc.hooks.UserPromptSubmit ??= [];
-doc.hooks.UserPromptSubmit.push({
-  matcher: '*',
-  hooks: [{ type: 'command', command: 'node "${CLAUDE_PLUGIN_ROOT}/scripts/ci-hang-fixture.mjs"', timeout: 1 }],
-});
-fs.writeFileSync(hooksFile, JSON.stringify(doc, null, 2));
-console.log(`[mutate-hook-timeout] registered a 1s-timeout sleeping hook in ${hooksFile}`);
-
-const r = spawnSync(process.execPath, [path.join(INSTALLED, 'bin', 'install.mjs'), '--doctor', '--hooks'], {
-  env: { ...process.env, HOME: HOME_DIR, USERPROFILE: HOME_DIR, RUVNET_BRAIN_TEST: '1' },
-  input: '',
-  encoding: 'utf8',
-  timeout: 120_000,
-});
-console.log(r.stdout);
-if (r.stderr) console.error(r.stderr);
-
-if (r.status === 0) {
-  console.error('[mutate-hook-timeout] FAIL: expected --doctor --hooks to go RED with a sleeping hook registered, got exit 0');
-  process.exit(1);
-}
-if (!/\bhang\b/.test(r.stdout || '')) {
-  console.error('[mutate-hook-timeout] FAIL: exited non-zero, but no "hang" violation was named — some OTHER check may have failed instead');
-  process.exit(1);
+doc.hooks.UserPromptSubmit = [{ hooks: [{ type: 'command', command: 'node "${CLAUDE_PLUGIN_ROOT}/scripts/ci-forbidden-hook.mjs"', timeout: 1 }] }];
+fs.writeFileSync(hooksFile, JSON.stringify(doc));
+try {
+  const r = spawnSync(process.execPath, [path.join(INSTALLED, 'bin', 'install.mjs'), '--doctor', '--hooks'], {
+    env: { ...process.env, HOME: HOME_DIR, USERPROFILE: HOME_DIR, RUVNET_BRAIN_TEST: '1' },
+    input: '', encoding: 'utf8', timeout: 120000,
+  });
+  console.log(r.stdout);
+  if (r.stderr) console.error(r.stderr);
+  if (r.status !== 1 || !/retired registry must not declare event UserPromptSubmit/.test(r.stdout || '')
+    || fs.existsSync(marker)) throw new Error('doctor did not reject the forbidden installed registration without executing it');
+  console.log('[mutate-hook-timeout] PASS — forbidden registration refused; its body did not execute');
+} finally {
+  fs.writeFileSync(hooksFile, original);
+  fs.rmSync(body, { force: true });
 }
-console.log(`[mutate-hook-timeout] PASS — the battery went RED (exit ${r.status}) with a real "hang" violation`);

package/scripts/ci/stranger-scenario.mjs

@@ -13,7 +13,7 @@
 //
 // SCENARIOS:
 //   healthy           — a complete fixture bundle. Asserts exit 0, then runs --doctor --hooks and
-//                        asserts AT LEAST ONE hook fired through the INSTALLED registration, and
+//                        asserts automatic hooks are absent from the INSTALLED registries, and
 //                        that no author-local ~/.claude/settings.json exists in this virgin image.
 //   seeded-broken     — forge-mcp-all.mjs deleted from the fixture (M-D8a). Asserts exit NON-ZERO.
 //   strict-ungrounded — a healthy-shaped fixture (already never ships forge-ask-all.mjs — see
@@ -29,7 +29,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 import { spawnSync, execFileSync } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import { selfCheckOuterTimeoutMs } from './stranger-timeout.mjs';
 import { stageLocalBundle } from './stranger-fixture-stage.mjs';
 
@@ -83,7 +83,7 @@ function buildKbFixture({ dropMcp, noRvf }) {
 
 /**
  * Marketplace-clone-shaped plugin surface, the REAL plugin/ tree at the candidate SHA — never a
- * synthetic fixture — so "at least one hook fired" is a real, meaningful registration.
+ * synthetic fixture — so retirement is checked against the real installed registry.
  */
 function seedPluginSurface() {
   const dest = path.join(HOME_DIR, '.claude', 'plugins', 'marketplaces', 'ruvnet-brain', 'plugin');
@@ -181,33 +181,18 @@ if (SCENARIO === 'healthy') {
   console.log(doctor.stdout);
   if (doctor.stderr) console.error(doctor.stderr);
 
-  // TWO REQUIREMENTS OF D8 CONTRADICTED EACH OTHER HERE, and the contradiction is worth stating
-  // rather than papering over.
-  //
-  //   · The hook battery must pass on a healthy image — that is this cell's whole purpose.
-  //   · `--doctor` DELIBERATELY exits non-zero when grounding is unproven. That is the D8 decision:
-  //     the install-time smoke stays non-fatal (an air-gapped machine is not a broken install), but
-  //     the verdict must stop EVAPORATING — it persists to install-state.json and --doctor gates on
-  //     it until a real cited answer clears it.
-  //
-  // Every CI image is offline with no model weights, so grounding is ALWAYS unproven here and
-  // `--doctor` will ALWAYS exit 1. Asserting exit 0 asserted that D8's own design does not work.
-  //
-  // So the assertion binds to the SUBSTANCE: the battery must report zero contract violations, and
-  // any non-zero exit must be attributable ONLY to the grounding verdict. A doctor that fails for a
-  // hook violation still fails this cell — which is the property that was actually wanted.
+  const installedApi = await import(pathToFileURL(path.join(INSTALLED, 'bin', 'install.mjs')).href);
+  const retirement = installedApi.automaticHookRetirementStatus(INSTALLED, { scope: 'installed' });
+  const installedClaude = installedApi.claudeInstalledHookRetirementStatus({ home: HOME_DIR,
+    plugin: { managed: true, installed: true, installPath: path.join(HOME_DIR, '.claude', 'plugins', 'marketplaces', 'ruvnet-brain', 'plugin') } });
+  if (!retirement.ok || !installedClaude.ok) fail(`automatic hook retirement failed: ${JSON.stringify({ retirement, installedClaude })}`);
   const out = `${doctor.stdout || ''}${doctor.stderr || ''}`;
-  const batteryClean = /Self-check passed/.test(out);
-  const onlyGrounding = /Grounding UNPROVEN/.test(out) && !/contract violation/.test(out);
-  if (doctor.status !== 0 && !(batteryClean && onlyGrounding)) {
-    fail(`--doctor --hooks ended with ${describeExit(doctor)} for a reason other than unproven grounding on a healthy install`);
+  if (!/automatic Brain hook retirement: 0 registration\(s\), 0 manifest error\(s\)/.test(out)) fail('doctor did not verify automatic hook retirement');
+  const onlyGrounding = /Grounding UNPROVEN/.test(out) && !/automatic hook retirement failed/i.test(out);
+  if (doctor.status !== 0 && !(doctor.status === 1 && onlyGrounding)) {
+    fail(`doctor failed beyond unproven grounding: ${describeExit(doctor)}`);
   }
-  if (!batteryClean) fail('--doctor --hooks did not report a clean hook battery on a healthy install');
-  const firingsMatch = /registrations from marketplace-clone,\s*\d+\s*stdin regimes each\s*\((\d+)\s*firings\)/.exec(doctor.stdout || '');
-  if (!firingsMatch) fail('--doctor --hooks output did not name the marketplace-clone registration/firing count at all');
-  const firings = Number(firingsMatch[1]);
-  if (!(firings > 0)) fail(`expected at least one hook FIRING through the installed registration, got ${firings}`);
-  log(`OK — ${firings} real hook firing(s) through the installed marketplace-clone registration`);
+  log(`OK — installed automatic hooks retired across ${retirement.files.length} package surfaces and the actual Claude registry`);
 
   if (fs.existsSync(authorSettings)) fail('installer must never create an author-local settings.json in a virgin image');
   log('OK — no author-local ~/.claude/settings.json in this virgin image');