ruvnet-brain 4.5.16 → 4.5.17

package/plugin/scripts/ground-ruvnet.sh

@@ -652,30 +652,43 @@ if [ -n "$BLK" ]; then
   # is never marked delivered (measured: the once-a-day flywheel offer starved behind the memory offer).
   # Without a session there is no budget either — the pre-4.5 behaviour, everything every time.
   [ -n "$INJ_DIR" ] || INJ_BUDGET=999999999
+  [ "${RUVNET_HOOK_CONTEXT_BUDGET:-0}" = "1" ] && [ "$INJ_BUDGET" -gt 7900 ] && INJ_BUDGET=7900
   INJ_USED=0
   for _f in $(cd "$BLK" 2>/dev/null && ls | grep -v '\.' | sort -t- -k2,2n -k1,1n); do
     _rest=${_f#*-}; _prio=${_rest%%-*}; _id=${_rest#*-}
     if [ "$_id" != "resume" ] && [ "${_id#agentdb-recall-}" = "$_id" ] && inj_seen "$_id"; then
-      if [ -f "$BLK/$_f.short" ]; then echo short > "$BLK/$_f.pick"; INJ_SHORTENED=$((INJ_SHORTENED + 1)); fi
+      if [ -f "$BLK/$_f.short" ]; then
+        if [ "${RUVNET_HOOK_CONTEXT_BUDGET:-0}" = "1" ] && [ "$_prio" != "0" ]; then
+          _short_size=$(wc -c < "$BLK/$_f.short")
+          if [ $((INJ_USED + _short_size)) -gt 7900 ]; then printf '%s\n' "$_f" >> "$BLK/.budget-deferred"; INJ_DEFERRED=$((INJ_DEFERRED + 1)); continue; fi
+          INJ_USED=$((INJ_USED + _short_size))
+        fi
+        echo short > "$BLK/$_f.pick"; INJ_SHORTENED=$((INJ_SHORTENED + 1))
+      fi
       continue
     fi
     _size=$(($(wc -c < "$BLK/$_f" 2>/dev/null || echo 0)))
     # A block bigger than the whole budget still goes out when it is the prompt's ONLY non-safety block —
     # otherwise an offer longer than the budget (the flywheel's is ~2.9 KB) could never be made at all.
-    if [ "$_prio" != "0" ] && [ "$INJ_USED" -gt 0 ] && [ $((INJ_USED + _size)) -gt "$INJ_BUDGET" ]; then
-      INJ_DEFERRED=$((INJ_DEFERRED + 1)); continue
+    if [ "$_prio" != "0" ] && { [ "$INJ_USED" -gt 0 ] || { [ "${RUVNET_HOOK_CONTEXT_BUDGET:-0}" = "1" ] && [ "$_size" -gt 7900 ]; }; } && [ $((INJ_USED + _size)) -gt "$INJ_BUDGET" ]; then
+      printf '%s\n' "$_f" >> "$BLK/.budget-deferred"; INJ_DEFERRED=$((INJ_DEFERRED + 1)); continue
     fi
     if [ "$_id" = "flywheel" ]; then claim_flywheel_day || continue; fi
     echo full > "$BLK/$_f.pick"
     [ "$_prio" != "0" ] && INJ_USED=$((INJ_USED + _size))
     [ "$_id" != "resume" ] && [ "${_id#agentdb-recall-}" = "$_id" ] && inj_mark "$_id"
   done
+  if [ "${RUVNET_HOOK_CONTEXT_BUDGET:-0}" = "1" ] &&
+    "${RUVNET_NODE_BIN:-node}" "$(dirname "$0")/hook-context-budget.mjs" --ground-dir "$BLK" > "$BLK/.bounded-context"; then
+    cat "$BLK/.bounded-context"
+  else
   for _f in $(cd "$BLK" 2>/dev/null && ls | grep -v '\.' | sort -n); do
     case "$(cat "$BLK/$_f.pick" 2>/dev/null)" in
       full) cat "$BLK/$_f" ;;
       short) cat "$BLK/$_f.short" ;;
     esac
   done
+  fi
   rm -rf "$BLK" 2>/dev/null
 fi
 

package/plugin/scripts/grounding-answer.mjs

@@ -22,6 +22,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { normalizeToolOutcome } from './continuity-events.mjs';
 
 const BANNER = /^Searched \d+ RuvNet repos \(/;
 const CARD = /^⚡ FAST LANE — [^\n]*\n#1  repo=\S+  evidence=curated-capability-card\n/;
@@ -41,32 +42,30 @@ export function answerTextAnswered(text) {
   return empty < 0 || (t.indexOf('#1  repo=') >= 0 && t.indexOf('#1  repo=') < empty);
 }
 
-/** JSON-unescape the leading string value of a truncated `{"answer":"…` document (no full parse possible). */
-function leadingAnswer(raw) {
-  const m = /^\s*\{\s*"answer"\s*:\s*"((?:[^"\\]|\\.)*)/.exec(raw);
-  if (!m) return null;
-  try { return JSON.parse(`"${m[1]}"`); } catch {
-    // Truncated mid-escape: drop a dangling backslash sequence and retry once.
-    try { return JSON.parse(`"${m[1].replace(/\\[^"]?$|\\u[0-9a-fA-F]{0,3}$/, '')}"`); } catch { return null; }
-  }
-}
+const rejectedExecution = (response) => {
+  const execution = normalizeToolOutcome({ content: response });
+  return execution.uncertain || ['fail', 'pending', 'interrupted'].includes(execution.outcome);
+};
 
 /** The answer text of a tool response in any shape a host delivers it, or null. Never an echoed field. */
-export function answerOf(response) {
-  if (response == null) return null;
+export function answerOf(response, depth = 0) {
+  if (response == null || depth > 8 || rejectedExecution(response)) return null;
   if (Array.isArray(response)) {
-    const texts = response.filter((b) => b && b.type === 'text' && typeof b.text === 'string').map((b) => b.text);
-    return texts.length ? answerOf(texts[0]) : null;
+    const block = response.find((b) => b && b.type === 'text' && typeof b.text === 'string');
+    return block ? answerOf(block, depth + 1) : null;
   }
   if (typeof response === 'object') {
     if (typeof response.answer === 'string') return response.answer;
-    if (Array.isArray(response.content)) return answerOf(response.content);
-    if (response.structuredContent && typeof response.structuredContent.answer === 'string') return response.structuredContent.answer;
+    if (Array.isArray(response.content)) return answerOf(response.content, depth + 1);
+    if (response.structuredContent && typeof response.structuredContent.answer === 'string') return answerOf(response.structuredContent, depth + 1);
+    if (response.type === 'text' && typeof response.text === 'string') return answerOf(response.text, depth + 1);
     return null;
   }
   const s = String(response);
   if (/^\s*[{[]/.test(s)) {
-    try { return answerOf(JSON.parse(s)); } catch { return leadingAnswer(s); }
+    // The exact envelope supplying an answer must be complete: a prefix can hide later error flags.
+    if (Buffer.byteLength(s, 'utf8') > 2_097_152) return null;
+    try { return answerOf(JSON.parse(s), depth + 1); } catch { return null; }
   }
   return s;   // plain text content
 }
@@ -83,6 +82,7 @@ export function oversizePath(response) {
  * call's end); `notBeforeMs`: nor long before it (a file planted earlier is not this call's output).
  */
 export function brainAnsweredResponse(response, { home = os.homedir(), notAfterMs = null, notBeforeMs = null } = {}) {
+  if (rejectedExecution(response)) return false;
   const file = oversizePath(response);
   if (!file) return answerTextAnswered(answerOf(response));
   const projects = path.join(home, '.claude', 'projects') + path.sep;
@@ -116,6 +116,8 @@ async function main() {
     const payload = JSON.parse(Buffer.concat(chunks).toString('utf8'));
     const now = Date.now();
     // Grok duplicates the result as camelCase `toolResult`; read either (its capture also carries tool_response).
+    const execution = normalizeToolOutcome({ ...payload, content: payload?.tool_response ?? payload?.toolResult });
+    if (execution.uncertain || ['fail', 'pending', 'interrupted'].includes(execution.outcome)) process.exit(0);
     if (brainAnsweredResponse(payload?.tool_response ?? payload?.toolResult, { notAfterMs: now + 2000, notBeforeMs: now - 300_000 })) {
       process.stdout.write('answered\n');
     }

package/plugin/scripts/grounding-stamp.sh

@@ -70,6 +70,9 @@ VERDICT="$(printf '%s' "$INPUT" | "$NODE_BIN" "$HERE/grounding-answer.mjs" 2>/de
 # No HOME, no stamp dir to write — and under `set -u` a bare $HOME is an "unbound variable" on stderr
 # (found by hook-qualify's home-unset case on an ANSWERED search, 4.5). Exit quietly instead.
 [ -n "${HOME:-}" ] || exit 0
+# Same-turn proof is separate from the shared 24h write-gate freshness stamps below.
+# Native session/project/turn identity and the current marker nonce must all match.
+printf '%s' "$INPUT" | "$NODE_BIN" "$HERE/grounding-turn-mark.mjs" --record-search >/dev/null 2>&1 || true
 DIR="$HOME/.cache/ruvnet-brain/grounded"
 mkdir -p "$DIR" 2>/dev/null || exit 0
 

package/plugin/scripts/grounding-turn-evidence.mjs

@@ -1,38 +1,19 @@
 /**
- * grounding-turn-evidence.mjs — the pure half of ADR-0030 decision-point gate #1: "before asserting
- * what a tool or platform can or cannot do, did you CHECK a relevant source this turn, or are you
- * recalling?" Plus gates #2 (architecture needs >= 3 options) and #3 (relayed numbers need a
- * re-check), which run in SHADOW mode only: they are measured and logged, never delivered.
- *
- * WHY (owner, 2026-09-30): "a nudge without enforcement is worthless." The concrete incident: an
- * answer asserted "No hook can change the model of the current turn" from a WebFetch page summary
- * written by a small model, and a design was built on it. The existing grounding-turn-gate only
- * checked that SOME search_ruvnet stamp was newer than the turn marker — presence, not relevance or
- * order — armed only on rUv-stack prompts, and could not see WebFetch at all.
- *
- * DESIGN, deterministic and local (rUv ADR-G004 rejects LLM gate evaluation; no model is called):
- *   1. UserPromptSubmit (grounding-turn-mark.mjs) arms the turn only when the prompt ASKS for a
- *      capability / feasibility / architecture judgement AND names a subject (classifyPrompt). The
- *      caller replayed a naive output-only regex at 13.5% of turns and an order-aware one at 0.93%,
- *      mostly on harmless hedges; arming at prompt time is what keeps unarmed turns out of scope.
- *   2. The sources read this turn come from the host transcript (turnSources) — the ordered,
- *      complete record of every tool call and its result, including search_ruvnet's returned paths.
- *      A WebFetch body is a small model's summary of the page, so it is WEAK evidence; so is a
- *      subagent's relayed report and a WebSearch snippet list.
- *   3. At Stop, each capability claim in the final answer (capability-claim-evidence.mjs's own
- *      extractor, widened with this turn's vocabulary) needs one STRONG source whose path, URL,
- *      command or query names the claim's subject and that was read AFTER the last weak source about
- *      that subject (auditAssertions). Otherwise: one correction.
- *
- * Claims continuation-gate.mjs already audits (the RUVNET_TOOL behaviour class) are skipped here —
- * one correction per claim, never two gates arguing over the same sentence.
+ * Grounding evidence for ADR-0030: observed successful substantive results, not requested paths.
+ * Native failure/running/missing precedence is shared with continuity-events. A native non-error
+ * Read result may establish read success without inventing a process exit code. Raw command reads
+ * require terminal zero and one literal source command through the existing commandNodes parser.
+ * Weak summaries/relays remain weak. Claims still require matching returned body after weak sources;
+ * missing execution stays UNKNOWN. This verifies observed evidence, not semantic entailment.
  */
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { RUVNET_GATE1_TERMS } from './ruvnet-gate1-pattern.mjs';
-import { brainAnsweredResponse } from './grounding-answer.mjs';
+import { answerOf, brainAnsweredResponse } from './grounding-answer.mjs';
+import { normalizeToolOutcome } from './continuity-events.mjs';
+import { commandNodes } from './hook-input.mjs';
 import { extractClaims } from './capability-claim-evidence.mjs';
 import { currentTurnRecords, strippedProse } from './completion-claim-evidence.mjs';
 
@@ -146,32 +127,51 @@ export function brainAnswered(r, { home = os.homedir(), notAfterMs = null } = {}
   return brainAnsweredResponse(r, { home, notAfterMs });
 }
 
-export function sourceOf(name, input = {}, result = '', { resultAtMs = null } = {}) {
-  const n = String(name || '');
-  const r = String(result || '');
+const substantive = text => {
+  if (/^(?:[A-Za-z]:[\\/]|\/)\S+$/.test(text.trim())) return false;
+  try { const value = JSON.parse(text); if (value && typeof value === 'object' && !Array.isArray(value)
+    && Object.keys(value).some(key => !['path', 'file_path', 'url', 'query', 'description', 'tool_name'].includes(key))) return true; } catch {}
+  return [...tokenSet(text)].filter(word => /[a-z]/.test(word)).length >= 3;
+};
+function directSourceCommand(command) {
+  if (/[;&|<>`$\n]/.test(command)) return false;
+  const nodes = commandNodes(command), node = nodes[0];
+  if (nodes.length !== 1 || node.dynamic || node.assigns.length || node.argv.some(word => !word)) return false;
+  const [exe, ...args] = node.argv, name = path.basename(exe);
+  return (name === 'cat' && args.length === 1 && !args[0].startsWith('-'))
+    || (name === 'sed' && args.length === 3 && args[0] === '-n' && /^\d+(?:,\d+)?p$/.test(args[1]))
+    || (['head', 'tail'].includes(name) && args.length === 3 && args[0] === '-n' && /^\d+$/.test(args[1]))
+    || (name === 'curl' && args.some(arg => ['-f', '--fail', '-fs', '-fsS'].includes(arg))
+      && args.filter(arg => /^https:\/\//.test(arg)).length === 1
+      && args.every(arg => /^https:\/\//.test(arg) || ['-f', '--fail', '-s', '--silent', '-S', '--show-error', '-fs', '-fsS'].includes(arg)))
+    || (!['echo', 'printf', 'eval', 'sh', 'bash', 'zsh'].includes(name) && args.length === 1 && args[0] === '--help');
+}
+export function sourceOf(name, input = {}, result = '', { resultAtMs = null, resultEvidence = null } = {}) {
+  const content = resultEvidence && Object.hasOwn(resultEvidence, 'content') ? resultEvidence.content : result;
+  const n = String(name || ''), r = textOf(content), body = r.replace(/^(?:Exit code\s*:?\s*-?\d+|Process exited with code\s+-?\d+|Wall time:.*)\s*$/gim, ''), outcome = normalizeToolOutcome(resultEvidence || { content });
+  const bodyText = body.trim();
+  const observed = resultEvidence?.type === 'tool_result' && typeof resultEvidence.tool_use_id === 'string';
+  const failed = ['fail', 'interrupted'].includes(outcome.outcome), pending = outcome.outcome === 'pending';
+  const nativeSuccess = observed && outcome.successfulToolResult === true;
+  const base = (kind, ref, strength, body = bodyText, extra = {}) => ({ kind, ref, strength: failed ? 'failed' : !observed || pending ? 'unknown' : strength,
+    text: ref, result: body.slice(0, 20000), terminalOutcome: outcome.outcome, ...extra });
   if (/(?:^|__)search_ruvnet$/.test(n)) {
-    const ok = brainAnswered(r, { notAfterMs: resultAtMs == null ? null : resultAtMs + 5000 });
-    const paths = [...r.matchAll(/^path : (\S+)/gm)].map((m) => m[1]).slice(0, 20);
-    return { kind: 'search_ruvnet', ref: String(input.query || ''), strength: ok ? 'strong' : 'failed', ok, text: [input.query, ...paths].join(' ') };
-  }
-  if (n === 'WebFetch') return { kind: 'WebFetch', ref: String(input.url || ''), strength: 'weak', why: 'summarised-by-small-model', text: String(input.url || '') };
-  if (n === 'WebSearch') {
-    const urls = [...r.matchAll(/https?:\/\/[^\s)"'\]]+/g)].map((m) => m[0]).slice(0, 10);
-    return { kind: 'WebSearch', ref: String(input.query || ''), strength: 'weak', why: 'search-snippets', text: [input.query, ...urls].join(' ') };
-  }
-  if (n === 'Agent' || n === 'Task') {
-    return { kind: n, ref: String(input.description || input.subagent_type || ''), strength: 'weak', why: 'relayed-by-subagent',
-      text: `${input.description || ''} ${String(input.prompt || '').slice(0, 400)}`, result: r.slice(0, 20000) };
-  }
-  if (n === 'Read' || n === 'NotebookRead') return { kind: 'Read', ref: String(input.file_path || input.notebook_path || ''), strength: 'strong', text: String(input.file_path || input.notebook_path || ''), result: r.slice(0, 20000) };
-  if (n === 'Grep' || n === 'Glob') {
-    const ref = [input.pattern, input.path, input.glob].filter(Boolean).join(' ');
-    return { kind: n, ref, strength: 'strong', text: ref, result: r.slice(0, 20000) };
-  }
-  if (n === 'Bash') return { kind: 'Bash', ref: String(input.description || input.command || '').slice(0, 120), strength: 'strong', text: String(input.command || '').slice(0, 2000), result: r.slice(0, 20000) };
-  if (n.startsWith('mcp__') && !MCP_MUTATING.test(n)) {
-    return { kind: 'mcp', ref: n.split('__').pop(), strength: 'strong', text: `${n} ${JSON.stringify(input).slice(0, 1000)}`, result: r.slice(0, 20000) };
+    const ok = observed && !failed && !pending && !outcome.uncertain && brainAnswered(content, { notAfterMs: resultAtMs == null ? null : resultAtMs + 5000 });
+    // Only the producer's returned document sections bind subjects; global repo/query banners do not.
+    const answer = answerOf(content) || '', body = answer.split(/^={10,}\s*$/m)
+      .map(hit => hit.split(/^----- full document(?: \([^\n]*\))? -----\r?\n/m).slice(1).join('\n')).join('\n');
+    return base('search_ruvnet', String(input.query || ''), ok && outcome.successfulToolResult && substantive(body) ? 'strong' : ok ? 'unknown' : 'failed', body, { ok });
   }
+  if (n === 'WebFetch') return base(n, String(input.url || ''), r ? 'weak' : 'unknown', r, { why: 'summarised-by-small-model' });
+  if (n === 'WebSearch') return base(n, String(input.query || ''), r ? 'weak' : 'unknown', r, { why: 'search-snippets' });
+  if (n === 'Agent' || n === 'Task') return base(n, String(input.description || input.subagent_type || ''), r ? 'weak' : 'unknown', r, { why: 'relayed-by-subagent' });
+  if (n === 'Read' || n === 'NotebookRead') return base('Read', String(input.file_path || input.notebook_path || ''),
+    nativeSuccess && substantive(bodyText) ? 'strong' : 'unknown', bodyText, { successEvidence: nativeSuccess ? 'native-read-success' : null });
+  if (n === 'Grep' || n === 'Glob') return base(n, [input.pattern, input.path, input.glob].filter(Boolean).join(' '),
+    n === 'Grep' && input.output_mode === 'content' && nativeSuccess && substantive(bodyText) ? 'strong' : 'unknown');
+  if (n === 'Bash') return base(n, String(input.description || input.command || '').slice(0, 120),
+    outcome.outcome === 'pass' && directSourceCommand(String(input.command || '')) && substantive(bodyText) ? 'strong' : 'unknown');
+  if (n.startsWith('mcp__') && !MCP_MUTATING.test(n)) return base('mcp', n.split('__').pop(), 'unknown');
   if (NOT_A_SOURCE.test(n)) return null;
   return null;
 }
@@ -183,7 +183,7 @@ export function turnSources(lines) {
   for (const o of recs) {
     const c = o?.message?.content;
     const at = Date.parse(o?.timestamp || '');
-    if (Array.isArray(c)) for (const r of c) if (r?.type === 'tool_result' && r.tool_use_id) results.set(r.tool_use_id, { text: textOf(r.content), at: Number.isFinite(at) ? at : null });
+    if (Array.isArray(c)) for (const r of c) if (r?.type === 'tool_result' && r.tool_use_id) results.set(r.tool_use_id, { text: textOf(r.content), evidence: r, at: Number.isFinite(at) ? at : null });
   }
   const sources = [];
   for (const o of recs) {
@@ -192,7 +192,7 @@ export function turnSources(lines) {
     for (const u of c) {
       if (u?.type !== 'tool_use') continue;
       const res = results.get(u.id) || { text: '', at: null };
-      const s = sourceOf(u.name, u.input || {}, res.text, { resultAtMs: res.at });
+      const s = sourceOf(u.name, u.input || {}, res.text, { resultAtMs: res.at, resultEvidence: res.evidence });
       if (s) sources.push({ ...s, order: sources.length });
     }
   }
@@ -382,18 +382,13 @@ export function capabilityClaims(rawMessage, tools) {
   return [...out.values()];
 }
 
-/**
- * Sources that name every word of the subject. A STRONG source may also bind through what it
- * returned (a file read, a command's output, a search's hits); a weak one only through what it
- * pointed at — a summary's own wording is exactly what is not trusted. A word of 5+ characters also
- * matches inside a longer compound (`displaylink` in `DisplayLinkUserAgent`).
- */
+/** Strong sources bind through returned content only; summaries bind through their declared target. */
 export function bindingSources(subject, sources) {
   const words = subjectWords(subject);
   if (!words.length) return [];
   const has = (tokens, w) => tokens.has(w) || (w.length >= 5 && [...tokens].some((t) => t.length > w.length && t.includes(w)));
   return sources.filter((s) => {
-    const t = tokenSet(s.strength === 'strong' ? `${s.text} ${s.ref} ${s.result || ''}` : s.text);
+    const t = tokenSet(s.strength === 'strong' ? s.result || '' : s.text);
     return words.every((w) => has(t, w));
   });
 }
@@ -431,7 +426,7 @@ export function auditAssertions({ message, subjects = [], vocab = [], sources =
     const lastWeak = Math.max(-1, ...binding.filter((s) => s.strength === 'weak').map((s) => s.order));
     const strongAfter = binding.some((s) => s.strength === 'strong' && s.order > lastWeak);
     if (!strongAfter) {
-      findings.push({ ...claim, reason: lastWeak >= 0 ? 'the only sources about it this turn are weak (summarised or relayed)' : 'no source about it was read this turn',
+      findings.push({ ...claim, reason: lastWeak >= 0 ? 'the only verified sources about it this turn are weak (summarised or relayed)' : 'successful relevant returned source content is unproven (UNKNOWN or failed evidence)',
         read: describeSources(lastWeak >= 0 ? binding : sources) });
     }
   }
@@ -440,14 +435,14 @@ export function auditAssertions({ message, subjects = [], vocab = [], sources =
 
 export function describeSources(sources, max = 4) {
   if (!sources.length) return ['nothing'];
-  const shown = sources.slice(-max).map((s) => `${s.kind} ${JSON.stringify(String(s.ref).slice(0, 70))}${s.strength === 'weak' ? ` [${s.why} = weak evidence]` : ''}`);
+  const shown = sources.slice(-max).map((s) => `${s.kind} ${JSON.stringify(String(s.ref).slice(0, 70))}${s.strength === 'weak' ? ` [${s.why} = weak evidence]` : ['failed', 'unknown'].includes(s.strength) ? ` [${s.strength} evidence]` : ''}`);
   return sources.length > max ? [`${sources.length - max} earlier`, ...shown] : shown;
 }
 
 export function correctionText(findings) {
   const f = findings[0];
   const lines = [
-    `You asserted "${f.text.slice(0, 200)}" about ${f.subject}; no relevant source was read this turn`
+    `You asserted "${f.text.slice(0, 200)}" about ${f.subject}; a successful relevant source read is unproven this turn`
       + ` (${f.reason}; read: ${f.read.join('; ')}).`,
     ...findings.slice(1, 3).map((x) => `Also unsourced: "${x.text.slice(0, 160)}" about ${x.subject}.`),
     'Check the real source now (read the file, run the command with --help, search_ruvnet, or fetch the',
@@ -476,7 +471,7 @@ export function relayShadow({ message, sources }) {
   const relayed = nums.filter((n) => {
     const from = agentIdx.find((a) => String(a.result || '').includes(n));
     if (!from) return false;
-    return !sources.some((s) => s.order > from.order && s.kind !== 'Agent' && s.kind !== 'Task' && String(s.result || '').includes(n));
+    return !sources.some((s) => s.order > from.order && s.strength === 'strong' && s.kind !== 'Agent' && s.kind !== 'Task' && String(s.result || '').includes(n));
   });
   return relayed.length ? { gate: 'adr-0030-3-relayed-number', numbers: relayed.slice(0, 8), wouldBlock: true } : null;
 }

package/plugin/scripts/grounding-turn-gate.mjs

@@ -29,20 +29,12 @@
  *     tests/unit/ruvnet-gate1-pattern.test.mjs. This file does not re-test the prompt itself —
  *     Stop's payload carries no prompt text — it reads grounding-turn-mark.mjs's marker instead
  *     (see that file's header for why the split exists).
- *   - "was search_ruvnet called": the EXISTING evidence grounding-stamp.sh already produces —
- *     ~/.cache/ruvnet-brain/grounded/<term>, one file per product term, minted ONLY on a genuinely
- *     successful search (grounding-stamp.sh's own header: stamps mint ONLY on a successful grounded
- *     result). ground-before-write.sh already trusts this exact directory's file mtimes for its own
- *     24h freshness check; this file trusts the SAME directory the SAME way, just against a
- *     narrower window (since the marker's own mtime, not "20 hours ago", is the turn boundary).
- *     UPDATE (H1 / GitHub #316): per-product term files alone under-reported "was it searched" —
- *     grounding-stamp.sh used to recognise only a 9-term write-gate vocabulary that omitted `ruvnet`
- *     itself (and every other Gate-1 term), so a search literally about "ruvnet" minted nothing and
- *     this gate wrongly fired. grounding-stamp.sh now also writes a vocabulary-independent
- *     `.any-search` marker into this SAME directory on every successful search regardless of query
- *     content, so newestGroundingStampMs below (which already scans every file, by name-agnostic
- *     design) sees it with no code change needed here — a search_ruvnet call this turn always mints
- *     evidence here now, not only when its query happens to name a recognised product.
+ *   - "was search_ruvnet called": Claude's complete turn transcript is primary evidence. When
+ *     transcript history is unavailable, only a successful PostToolUse receipt bound to the marker
+ *     nonce and native session/project/turn identity may satisfy the obligation. Global product
+ *     stamps remain write-gate freshness data and cannot certify a current turn. Unobservable native
+ *     identity or absent relevant receipts is UNKNOWN, with one correction to check or qualify the
+ *     claim; it is not a claim that no search happened.
  *   - The Stop block/continue contract: `{"hookSpecificOutput":{"hookEventName":"Stop",
  *     "additionalContext":"..."}}` on stdout, exit 0. This is not a new discovery — it is the exact
  *     contract continuation-gate.mjs already uses and this repo's own tests already prove works on
@@ -64,7 +56,7 @@
  *     mtimes. The stamp was a lossy proxy: 7 real false alarms were measured, 3 from a queued
  *     mid-turn prompt re-dating the marker (fixed in grounding-turn-mark.mjs), 3 pre-H1 vocabulary
  *     misses, 1 successful search whose stamp never minted. Codex's rollout is not parsed anywhere in
- *     this repo, so Codex keeps the stamp evidence.
+ *     this repo, so Codex requires native-turn-bound search receipts.
  *   - When the marker says the prompt asked a capability/feasibility/architecture question, every
  *     capability claim in the final answer needs a RELEVANT, STRONG source read this turn after the
  *     last weak one (auditAssertions). A WebFetch body is a small model's summary: weak.
@@ -79,7 +71,7 @@
  * search is demanded only when the final answer asserts a rUv capability (ruvCapabilityClaims);
  * measured on a held-out set of 70 real Stop points: false positives 68/68 -> 0/68, and 2 borderline
  * claims (copula, parenthetical) are missed — tests/unit/grounding-turn-false-alarm.test.mjs.
- * A LONG turn (the transcript tail cannot see its start) falls back to the stamps, never to a pass.
+ * A LONG turn (the transcript tail cannot see its start) requires a bound receipt or reports UNKNOWN.
  *
  * FAILS OPEN ALWAYS. Exit 0 unconditionally — a gate that breaks a turn's completion because a
  * cache directory was unreadable would be disabled within a day.
@@ -90,7 +82,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { groundingSubjectAllowed } from './ruvnet-gate1-pattern.mjs';
 import { readStopHookInput } from './hook-input.mjs';
-import { markerPathFor, consumeMarker } from './grounding-turn-mark.mjs';
+import { MARKER_DIR, markerPathFor, consumeMarker, groundingIdentity, sameGroundingIdentity } from './grounding-turn-mark.mjs';
 import { readSettledTranscript } from './turn-outcome-capture.mjs';
 import {
   architectureShadow, auditAssertions, correctionText, describeSources, loadVocabulary, logShadow,
@@ -147,27 +139,30 @@ export function wasGroundedSince(markerMs, newestStampMs) {
  * The whole Stop decision for one armed turn: the correction text, or null. Exported so tests can
  * drive it with a synthetic transcript. Every failure inside returns null (fail open).
  */
-export function decide({ hookInput, marker, markerMs, env = process.env, read = readSettledTranscript }) {
+export function decide({ hookInput, marker, markerMs, searchEvidence = null, ownershipUnknown = false, env = process.env, read = readSettledTranscript }) {
   try {
     const host = env.RUVNET_HOOK_HOST === 'codex' ? 'codex' : 'claude';
     const tp = hookInput.transcript_path;
     let turn = null;
-    if (host === 'claude' && typeof tp === 'string' && /\.jsonl$/i.test(tp)) {
+    if (!ownershipUnknown && host === 'claude' && typeof tp === 'string' && /\.jsonl$/i.test(tp)) {
       try { turn = turnSources(read(tp, { maxMs: 0 })); } catch { turn = null; }
     }
     // The transcript is read as a bounded TAIL. When the turn's opening prompt is not inside it
     // (a long turn), the tail is a suffix of the turn and cannot prove a search did NOT happen
-    // earlier — so it is not evidence either way. Fall back to the stamp evidence (the same path
-    // Codex uses), never to a silent pass: `return null` here let every long turn skip the gate.
+    // earlier — so it is not evidence either way. Only a bound native receipt can supply the missing
+    // proof; shared freshness or an unreadable history cannot certify this turn.
     if (turn && !turn.boundaryFound) turn = null;
     const sources = turn ? turn.sources : null;
     const message = String(hookInput.last_assistant_message || '');
+    const bound = searchEvidence && sameGroundingIdentity(marker, groundingIdentity(hookInput, env))
+      && sameGroundingIdentity(searchEvidence, marker) && searchEvidence.nonce === marker.nonce;
+    const terms = bound ? searchEvidence.terms : [];
 
     let assertion = null;
     if (marker.assert && message) {
       const vocab = loadVocabulary({ env });
       const audit = auditAssertions({ message, subjects: marker.subjects, vocab, sources,
-        stampTerms: sources ? [] : stampTermsSince(markerMs),
+        stampTerms: sources ? [] : terms,
         subjectAllowed: (subject) => groundingSubjectAllowed(subject, marker.groundingScope) });
       if (audit.findings.length) assertion = audit.findings;
       const shadow = [architectureShadow({ architecture: marker.architecture, message }), relayShadow({ message, sources })].filter(Boolean);
@@ -177,8 +172,16 @@ export function decide({ hookInput, marker, markerMs, env = process.env, read =
     // Gate 1 demands a search only when the answer ASSERTS what a rUv product does (the directive's
     // own words). A status report, git/CI check or memory write on a rUv-named repo asserts nothing.
     const ruvClaims = marker.gate1 === false ? [] : ruvCapabilityClaims(message).filter((claim) => groundingSubjectAllowed(claim.subject, marker.groundingScope));
+    if (!sources && (ruvClaims.length || assertion)) {
+      const queried = ruvClaims.every(claim => terms.includes(claim.subject));
+      if (!bound || !queried) return [
+        'Grounding evidence for this session and turn is UNKNOWN; shared product freshness is not same-turn proof.',
+        'Check the relevant product source with `search_ruvnet` in this native turn, or restate the capability as UNVERIFIED.',
+        'This is one bounded correction; missing host evidence does not prove that no search occurred.',
+      ].join('\n');
+    }
     const grounded = !ruvClaims.length
-      || (sources ? searchedThisTurn(sources) : wasGroundedSince(markerMs, newestGroundingStampMs()));
+      || (sources ? searchedThisTurn(sources) : Boolean(bound));
     if (assertion) {
       return correctionText(assertion) + (grounded ? '' : '\nThis turn also asserted what a rUv tool does and no successful search_ruvnet call was recorded: call it with the product term(s).');
     }
@@ -189,7 +192,7 @@ export function decide({ hookInput, marker, markerMs, env = process.env, read =
       'ground-ruvnet\'s directive requires calling the search_ruvnet MCP tool before asserting what any',
       'RuvNet tool can/cannot do — but no successful',
       sources ? `search_ruvnet call is in this turn's transcript (read this turn: ${describeSources(sources).join('; ')}).`
-        : 'search_ruvnet call was recorded this turn (checked against the grounding-stamp evidence).',
+        : 'search_ruvnet call was proven by a receipt bound to this native session, project, turn and marker nonce.',
       '',
       'Do NOT end the turn on an ungrounded rUv-domain answer. Call `search_ruvnet` now with the',
       'relevant product term(s) in the query, ground your answer in the cited source paths it returns,',
@@ -203,18 +206,20 @@ export function decide({ hookInput, marker, markerMs, env = process.env, read =
 async function main() {
   const hookInput = await readStopHookInput();
   if (hookInput.__source !== 'stdin') process.exit(EXIT_ALLOW);
-  if (hookInput.stop_hook_active) process.exit(EXIT_ALLOW);
-  if (hookInput.hook_event_name !== 'Stop' || hookInput.interrupted || hookInput.cancelled) {
+  if (hookInput.stop_hook_active && !hookInput.interrupted && !hookInput.cancelled) process.exit(EXIT_ALLOW);
+  if (hookInput.hook_event_name !== 'Stop') {
     process.exit(EXIT_ALLOW);
   }
   if (!hookInput.session_id) process.exit(EXIT_ALLOW);
 
-  const marker = markerPathFor(hookInput.session_id);
+  const identity = groundingIdentity(hookInput), marker = markerPathFor(hookInput.session_id, MARKER_DIR, identity.host);
   if (!marker) process.exit(EXIT_ALLOW);
 
-  const episode = consumeMarker(marker);
+  const episode = consumeMarker(marker, identity);
   if (!episode) process.exit(EXIT_ALLOW);
-  const text = decide({ hookInput, marker: episode.marker, markerMs: episode.markerMs });
+  if (hookInput.interrupted || hookInput.cancelled) process.exit(EXIT_ALLOW);
+  const text = decide({ hookInput, marker: episode.marker, markerMs: episode.markerMs,
+    searchEvidence: episode.searchEvidence, ownershipUnknown: episode.ownershipUnknown });
   if (!text) process.exit(EXIT_ALLOW);
 
   process.stdout.write(JSON.stringify({