ruvnet-brain 4.5.2 → 4.5.4

package/README.md

@@ -7,7 +7,7 @@ Created: 2026-06-29 22:36:38 EDT
 
 # 🧠 RuvNet Brain
 
-### 🧠 RuvNet Brain — [![RuvNet Brain version 4.5.2 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.5.2-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
+### 🧠 RuvNet Brain — [![RuvNet Brain version 4.5.4 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.5.4-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
 
 **A portable, source-grounded brain over Reuven Cohen's (rUv's) RuvNet stack — delivered as a Claude Code plugin that makes Claude _use_ the stack instead of fighting it.**
 
@@ -562,7 +562,7 @@ node forge-ask-all.mjs --dir . --q "How does RuVector implement HNSW vector sear
 
 This project versions in the open (see the live badge up top for the exact plugin version; the downloadable knowledge bundle is a separate track) — we don't claim “done,” “complete,” or “zero hallucinations.” Where it stands:
 
-- ✅ **The grounding brain is real and proven** — 199 public stores · 161,371 public source chunks, dual embeddings, cross-encoder rerank, plugin (MCP tool + explicit skills; automatic hooks retired), all re-runnable.
+- ✅ **The grounding brain is real and proven** — 199 public stores · 162,439 public source chunks, dual embeddings, cross-encoder rerank, plugin (MCP tool + explicit skills; automatic hooks retired), all re-runnable.
 - ✅ **Code-level depth** — the code-rich repos are indexed to full function bodies; “how is it implemented?” returns the implementation. Verified in the shipped bundle (clean-room 3/3).
 - ✅ **Routing holds** — named 47/48, described 26/28, scenario 7/8; behavioral L1–L3 all pass (**L4 downgraded — it measures that the brain spoke, not that anything listened**); private stores fenced out of the public bundle (zero-leak verified).
 - ⚠️ **Two routing residuals** (above) — surfaced, not hidden.

package/bin/install.mjs

@@ -2443,11 +2443,11 @@ export function automaticHookRetirementStatus(root = REPO_ROOT, { scope = 'sourc
     if (pairs.length !== expectedPairs.length || expectedPairs.some((pair) => !pairs.includes(pair))) {
       errors.push(`${contractsFile}: contracts must list exactly the continuity handlers (${expectedPairs.join(', ')})`);
     }
-    // One allowlist entry per DISTINCT (event, matcher): the matcher is a property of the event, so
-    // three snapshot registrations on three events need three entries, not three copies of one.
-    const expectedMatchers = [...new Set(continuityRegistrations().map((spec) => `${spec.event}:${spec.matcher}`))];
+    // Matchers belong to a host registry: one host's exception grants no authority to another.
+    const expectedMatchers = [['plugin', 'claude'], ['codex', 'codex']].flatMap(([layer, host]) =>
+      [...new Set(continuityRegistrations(host).map((spec) => `${layer}:${spec.event}:${spec.matcher}`))]);
     const declaredMatchers = Array.isArray(contracts.matcherAllowlist)
-      ? contracts.matcherAllowlist.map((row) => `${row?.event}:${row?.matcher}`) : [];
+      ? contracts.matcherAllowlist.map((row) => `${row?.layer}:${row?.event}:${row?.matcher}`) : [];
     if (declaredMatchers.length !== expectedMatchers.length
       || expectedMatchers.some((entry) => !declaredMatchers.includes(entry))) {
       errors.push(`${contractsFile}: matcherAllowlist must list exactly the continuity matchers (${expectedMatchers.join(', ')})`);
@@ -3214,6 +3214,10 @@ async function doctorRun({ json }) {
     agentdbLine = { id: 'agentdb', label: 'AgentDB', state: 'unknown', detail: `recording status unavailable: ${error.message}`, fix: null };
   }
 
+  const { turnRecordingStatus } = await import('../plugin/scripts/turn-outcome-capture.mjs');
+  const turnStatus = turnRecordingStatus({ projectDir: process.cwd() });
+  const turnLine = { id: 'turn-recording', label: 'Turn recording', state: turnStatus.state, detail: turnStatus.line, fix: null };
+
   // ── THE MECHANICAL VERDICT ────────────────────────────────────────────────────────────────────
   // `--hooks` is retained as a compatibility alias for a read-only zero-registration proof. It must
   // never execute dormant hook bodies.
@@ -3293,6 +3297,7 @@ async function doctorRun({ json }) {
     check('host-convergence', 'Hosts sync', !hostConvergence.healthy, hostConvergence.state, 'npx ruvnet-brain --update'),
     ...(rufloOperational ? [rufloCheckLine(rufloOperational)] : []),
     ...(agentdbLine ? [agentdbLine] : []),
+    turnLine,
   ];
   // THE ONE VERDICT. Text, --json and the exit code are all read from this object; nothing else decides.
   const verdict = doctorVerdict(confirmation, checks);

package/kb/lifecycle-evidence-retention.mjs

@@ -27,7 +27,10 @@ function rootsFor({ brainHome, kbDir }) {
 function regularJson(file) {
   const stat = fs.lstatSync(file);
   if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('not a trusted regular file');
-  return { value: JSON.parse(fs.readFileSync(file, 'utf8')), bytes: stat.size };
+  const bytes = fs.readFileSync(file);
+  const text = bytes.toString('utf8');
+  if (!Buffer.from(text, 'utf8').equals(bytes)) throw new Error('evidence is not valid UTF-8');
+  return { value: JSON.parse(text), bytes: stat.size };
 }
 
 function treeBytes(root) {
@@ -88,6 +91,11 @@ function scanTransactions(root, unsafe) {
       if (!names.length || names.some((file) => !PHASE_FILE.test(file))) throw new Error('transaction phase inventory is malformed');
       const phases = names.map((file) => regularJson(path.join(dir, file)).value);
       const latest = phases.at(-1);
+      if (phases.some((phase, index) => phase?.schemaVersion !== 1
+        || phase.kind !== 'ruvnet-brain-storage-transaction-phase' || phase.transactionId !== name
+        || phase.sequence !== index + 1 || names[index] !== `${String(index + 1).padStart(3, '0')}-${phase.state}.json`)) {
+        throw new Error('transaction phase identity is malformed');
+      }
       if (latest?.kind !== 'ruvnet-brain-storage-transaction-phase' || latest.transactionId !== name
         || latest.sequence !== names.length || typeof latest.state !== 'string') {
         throw new Error('transaction phase identity is malformed');
@@ -210,6 +218,45 @@ function quarantineAndRemove(entry, root, removeEntry, afterQuarantine) {
   removeEntry(quarantine);
 }
 
+// Keep every JSON token (including numeric precision and escaped string spelling).
+// Only formatting whitespace is redundant; phase files remain readable by recovery.
+function compactTerminalPhases(row) {
+  const compacted = [];
+  for (const name of fs.readdirSync(row.path).sort()) {
+    const file = path.join(row.path, name);
+    const stat = fs.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) throw new Error('phase is not an exclusive regular file');
+    const originalBytes = fs.readFileSync(file);
+    const original = originalBytes.toString('utf8');
+    if (!Buffer.from(original, 'utf8').equals(originalBytes)) throw new Error('phase is not valid UTF-8');
+    const compact = original.replace(/("(?:\\[\s\S]|[^"\\])*")|[ \t\r\n]+/g, (token, string) => string || '');
+    if (Buffer.byteLength(compact) >= stat.size) continue;
+    if (JSON.stringify(JSON.parse(original)) !== JSON.stringify(JSON.parse(compact))) throw new Error('phase compaction changed evidence');
+    const temporary = `${file}.compact-${crypto.randomBytes(8).toString('hex')}`;
+    let descriptor;
+    try {
+      descriptor = fs.openSync(temporary, 'wx', stat.mode & 0o777);
+      const replacementStat = fs.fstatSync(descriptor);
+      if (replacementStat.uid !== stat.uid || replacementStat.gid !== stat.gid) fs.fchownSync(descriptor, stat.uid, stat.gid);
+      fs.fchmodSync(descriptor, stat.mode & 0o777);
+      fs.writeFileSync(descriptor, compact);
+      fs.futimesSync(descriptor, stat.atimeMs / 1000, stat.mtimeMs / 1000);
+      fs.fsyncSync(descriptor);
+      fs.closeSync(descriptor); descriptor = undefined;
+      const current = fs.lstatSync(file);
+      if (!current.isFile() || current.isSymbolicLink() || current.ino !== stat.ino || current.dev !== stat.dev
+        || current.mode !== stat.mode || current.uid !== stat.uid || current.gid !== stat.gid || current.nlink !== 1
+        || !fs.readFileSync(file).equals(originalBytes)) throw new Error('phase changed during compaction');
+      fs.renameSync(temporary, file);
+      compacted.push(file);
+    } finally {
+      if (descriptor !== undefined) fs.closeSync(descriptor);
+      fs.rmSync(temporary, { force: true });
+    }
+  }
+  return compacted;
+}
+
 export function pruneLifecycleEvidence(options = {}) {
   const policy = options.policy || LIFECYCLE_EVIDENCE_RETENTION_POLICY;
   const removeEntry = options.removeEntry || ((entry) => fs.rmSync(entry, { recursive: true, force: true }));
@@ -218,6 +265,13 @@ export function pruneLifecycleEvidence(options = {}) {
   // the exact entry it just quarantined. Recovery must not guess away private data.
   const initial = assessLifecycleEvidence({ ...options, policy });
   const removed = { refresh: [], transactions: [] };
+  const compacted = [];
+  const compactState = snapshot(options);
+  if (!compactState.unsafe.length && compactState.bytes > policy.maxEvidenceBytes) {
+    for (const row of compactState.transactions.filter((entry) => TERMINAL_TRANSACTION.has(entry.latest.state))) {
+      compacted.push(...compactTerminalPhases(row));
+    }
+  }
   for (;;) {
     const state = snapshot(options);
     if (isWithin(state, policy)) break;
@@ -235,6 +289,6 @@ export function pruneLifecycleEvidence(options = {}) {
     removed[candidate.kind === 'refresh' ? 'refresh' : 'transactions'].push(candidate.path);
   }
   const final = assessLifecycleEvidence({ ...options, policy });
-  return { ...final, before: initial.before, removed,
+  return { ...final, before: initial.before, removed, compacted,
     after: final.after, withinBudget: final.withinBudget };
 }

package/kb/verify-citation.mjs

@@ -27,40 +27,63 @@ import readline from 'node:readline';
 /**
  * Parse the reader's stdout into structured citations. Never throws; unparseable input → [].
  *
- * The reader dumps each hit's full document body inline (`forge-ask-all.mjs`'s "----- full
- * document -----" section), unescaped. A retrieved document can itself legitimately CONTAIN text
- * shaped exactly like this format — this very file's own header comment is an example, and so is
- * any doc, ADR, or transcript that quotes or discusses the reader's output. Two guards keep such
- * look-alike text from being parsed as a real citation: (1) a block's `path`/`title` are read only
- * from the span between its own header and the NEXT header, never past it, so a citation missing
- * one is not silently filled in from something appearing later in the dump; (2) real hits are
- * numbered `#1, #2, …` strictly in order with no repeats — embedded example text does not continue
- * that sequence, so any header whose rank isn't exactly the next expected one is skipped. This is
- * not airtight against a document engineered to predict and spoof the exact next rank (tracked as
- * an open item, not solved here); it closes the realistic case this repo's own docs demonstrate.
+ * STRUCTURE, NOT TEXT PATTERNS (ADR-0102 G-004, #236). The reader dumps each hit's full document body
+ * inline, and a retrieved document can contain text shaped exactly like a hit header — including a forged
+ * "#N+1 repo=…" block that predicts the next rank, which the old next-header/next-rank guards could not
+ * stop ("not airtight"). The reader prints, before each body, `chars: <exact body length>`; the parser
+ * consumes the body BY THAT COUNT and requires the 67-'=' terminator right after it, so nothing inside a
+ * body is ever scanned for headers. A declared length that does not land on the terminator fails closed:
+ * that hit keeps no body and nothing after it is trusted; so does a body without `chars:` once an earlier
+ * hit carried one. Output with no `chars:` line at all (a reader older than this field) keeps the previous
+ * bounded-span parsing; a header with no body keeps none. `path`/`title`/scores come only from the header lines between
+ * a hit's header and its body, never from a body, and hits are numbered #1, #2, … strictly in order.
  */
+const SEPARATOR = '='.repeat(67);
 export function parseCitations(stdout) {
   const out = [];
   const text = String(stdout ?? '');
-  const blockRe = /^#(\d+)[ \t]+repo=(\S+)([^\r\n]*)/gm;
+  const headerRe = /^#(\d+)[ \t]+repo=(\S+)([^\r\n]*)/gm;
   const nextHeaderRe = /^#\d+\s+repo=\S+/gm;
+  const markerRe = /^----- full document -----\r?\n/gm;
   let m;
   let expectedRank = 1;
-  while ((m = blockRe.exec(text)) !== null) {
+  let structured = false;
+  while ((m = headerRe.exec(text)) !== null) {
     const rank = Number(m[1]);
     if (rank !== expectedRank) continue; // out-of-sequence header: a look-alike, not a real hit
-    const blockStart = m.index + m[0].length;
-    nextHeaderRe.lastIndex = blockStart;
+    const headStart = m.index + m[0].length;
+    nextHeaderRe.lastIndex = headStart;
     const next = nextHeaderRe.exec(text);
-    const block = text.slice(blockStart, next ? next.index : text.length);
-    const pathM = /^path\s*:\s*(.+)$/m.exec(block);
-    const titleM = /^title\s*:\s*(.+)$/m.exec(block);
-    // Only a block that actually resolves to a path fills this rank slot. Advancing on rank match
-    // alone (before this check) let a headerless-of-path look-alike fragment (e.g. an incidental
-    // "#N repo=..." mention with no path/title following) consume the slot, permanently rejecting
-    // the REAL citation at that rank when it appeared later in the stream — a false negative on a
-    // genuinely grounded answer, worse than the fabrication this rank check exists to prevent.
+    const nextAt = next ? next.index : text.length;
+    markerRe.lastIndex = headStart;
+    const marker = markerRe.exec(text);
+    const markerAt = marker && marker.index < nextAt ? marker.index : -1;
+    const head = text.slice(headStart, markerAt >= 0 ? markerAt : nextAt);
+    const pathM = /^path\s*:\s*(.+)$/m.exec(head);
+    const titleM = /^title\s*:\s*(.+)$/m.exec(head);
+    const charsM = /^chars:\s*(\d+)\b/m.exec(head);
+    // A pathless match does not fill (or burn) its rank: real reader output never omits path, and a
+    // look-alike fragment consuming the slot would reject the real citation that fills it later.
     if (!pathM) continue;
+    let returnedText = null;
+    let stop = false;
+    if (charsM && markerAt >= 0) {
+      const bodyStart = markerAt + marker[0].length;
+      const bodyEnd = bodyStart + Number(charsM[1]);
+      const terminator = text.startsWith(`\n${SEPARATOR}`, bodyEnd) ? 1 + SEPARATOR.length
+        : text.startsWith(`\r\n${SEPARATOR}`, bodyEnd) ? 2 + SEPARATOR.length : 0;
+      if (terminator) {
+        returnedText = text.slice(bodyStart, bodyEnd);
+        structured = true;
+        headerRe.lastIndex = bodyEnd + terminator; // resume AFTER the body: its contents are never parsed
+      } else stop = true; // the declared body does not end where it says: its boundary, and all after it, is unknown
+    } else if (markerAt >= 0 && structured) {
+      stop = true; // a body with no declared length after length-bound hits: its boundary is unknown
+    } else if (markerAt >= 0) {
+      // A reader older than `chars:`: the body is the bounded span up to the next header.
+      const body = /^----- full document -----\r?\n([\s\S]*?)\r?\n={67}(?:\r?\n|$)/m.exec(text.slice(headStart, nextAt));
+      returnedText = body ? body[1] : null;
+    }
     expectedRank = rank + 1;
     const repo = m[2];
     // Metadata comes only from the header, never from a retrieved document body.
@@ -73,9 +96,6 @@ export function parseCitations(stdout) {
     const fullPath = pathM[1].trim();
     // Strip the repo prefix the reader adds, so the remainder can be matched against the store.
     const docPath = fullPath.startsWith(`${repo}/`) ? fullPath.slice(repo.length + 1) : fullPath;
-    // Retain only the reader's bounded document body. Missing/truncated delimiters fail
-    // closed, so evaluators cannot borrow claims from headers, diagnostics, or later hits.
-    const body = /^----- full document -----\r?\n([\s\S]*?)\r?\n={67}(?:\r?\n|$)/m.exec(block);
     out.push({
       rank,
       repo,
@@ -83,11 +103,12 @@ export function parseCitations(stdout) {
       vec: score('vec'),
       kind: field('kind'),
       proofMethod: field('proof'),
-      returnedText: body ? body[1] : null,
+      returnedText,
       fullPath,
       docPath,
       title: titleM ? titleM[1].trim() : null,
     });
+    if (stop) break;
   }
   return out;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.5.2",
+  "version": "4.5.4",
   "description": "One-command installer for RuvNet Brain \u2014 a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships a UserPromptSubmit retrieve-and-inject grounding hook and a PreToolUse write gate that refuses ungrounded rUv-product code until search_ruvnet has been consulted (ADR-0012 / ADR-067).",
-  "version": "4.5.2",
+  "version": "4.5.4",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.5.2",
+  "version": "4.5.4",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/hooks/codex-hooks.json

@@ -1,5 +1,5 @@
 {
-  "description": "RuvNet Brain continuity plane for Codex. Broad legacy automatic gates remain retired. Registrations here are MEASURED, not assumed: a probe hook was registered on all twelve event names the installed codex-cli 0.154.0 binary declares and a real `codex exec` run was observed (2026-09-11). SessionStart, UserPromptSubmit and SessionEnd FIRED and carry handlers. Stop keeps the pre-existing, project-scoped continuation gate; session-snapshot was added at Stop on 2026-09-29 to record each turn's outcome (turn-outcome-capture.mjs) — Codex SessionEnd carries no last_assistant_message, so Stop is the only boundary that can. Its delivery rests on codex-cli 0.158.0's declared stop.command.input schema and the other Codex Stop handlers; it has NOT been live-observed and fails open. PreCompact is DECLARED ABSENT here: the binary declares the event but the probe never observed it, and a capture registered on an unobserved event would look symmetrical while capturing nothing. All handlers are bounded and fail open. Amended 2026-09-11: UserPromptSubmit also runs ground-ruvnet (grounding injection, ADR-040 §Amendment). Amended 2026-09-12: the 2026-09-11 PreToolUse/PostToolUse \"not observed\" note was measured with a prompt (`codex exec \"reply OK\"`) that never invoked a tool, so neither event had anything to fire on — that was an untested path, not a failing one. Re-probed with prompts that actually call a tool: a real apply_patch write fired PreToolUse/PostToolUse with tool_name \"apply_patch\", and a real MCP call to this repo's own search_ruvnet server fired both with tool_name \"mcp__ruvnet_brain__search_ruvnet\". Both are now registered below: decision-gate's write route (matcher includes apply_patch, Codex's raw write-tool name) and grounding-stamp (unchanged matcher already recognizes the mcp__..__search_ruvnet shape). The bash route (exec_command) remains unregistered — today's measurement covered a write and an MCP call, not exec_command, and extending on that evidence would be the same unproven leap this note replaces. Also added 2026-09-12: grounding-turn-mark (UserPromptSubmit) and grounding-turn-gate (Stop), the \"answered without searching\" pair — a prompt-level grounding directive is advisory, so this records whether it fired and forces continuation at Stop if no search_ruvnet call was recorded since (reusing grounding-stamp's own stamp evidence). Both are registered on Codex identically to Claude: the Stop-block contract (hookSpecificOutput.additionalContext) already has a proven Codex translation via codex-hook-adapter.mjs's Stop branch (see tests/unit/codex-lifecycle-hooks.test.mjs), the same path continuation-gate already uses. Capacity-aware parallel-work guidance is also registered at UserPromptSubmit: it advises the coordinator to launch only real independent workers within sampled resource headroom and the live runtime/tool cap; it never spawns workers or claims execution.",
+  "description": "RuvNet Brain continuity plane for Codex. Broad legacy automatic gates remain retired. Registrations here are MEASURED, not assumed: a probe hook was registered on all twelve event names the installed codex-cli 0.154.0 binary declares and a real `codex exec` run was observed (2026-09-11). SessionStart, UserPromptSubmit and SessionEnd FIRED and carry handlers. Stop keeps the pre-existing, project-scoped continuation gate; session-snapshot was added at Stop on 2026-09-29 to record each turn's outcome (turn-outcome-capture.mjs) \u2014 Codex SessionEnd carries no last_assistant_message, so Stop is the only boundary that can. Its delivery rests on codex-cli 0.158.0's declared stop.command.input schema and the other Codex Stop handlers; it has NOT been live-observed and fails open. PreCompact is DECLARED ABSENT here: the binary declares the event but the probe never observed it, and a capture registered on an unobserved event would look symmetrical while capturing nothing. All handlers are bounded and fail open. Amended 2026-09-11: UserPromptSubmit also runs ground-ruvnet (grounding injection, ADR-040 \u00a7Amendment). Amended 2026-09-12: the 2026-09-11 PreToolUse/PostToolUse \"not observed\" note was measured with a prompt (`codex exec \"reply OK\"`) that never invoked a tool, so neither event had anything to fire on \u2014 that was an untested path, not a failing one. Re-probed with prompts that actually call a tool: a real apply_patch write fired PreToolUse/PostToolUse with tool_name \"apply_patch\", and a real MCP call to this repo's own search_ruvnet server fired both with tool_name \"mcp__ruvnet_brain__search_ruvnet\". Both are now registered below: decision-gate's write route (matcher includes apply_patch, Codex's raw write-tool name) and grounding-stamp (unchanged matcher already recognizes the mcp__..__search_ruvnet shape). The bash route (exec_command) remains unregistered \u2014 today's measurement covered a write and an MCP call, not exec_command, and extending on that evidence would be the same unproven leap this note replaces. Also added 2026-09-12: grounding-turn-mark (UserPromptSubmit) and grounding-turn-gate (Stop), the \"answered without searching\" pair \u2014 a prompt-level grounding directive is advisory, so this records whether it fired and forces continuation at Stop if no search_ruvnet call was recorded since (reusing grounding-stamp's own stamp evidence). Both are registered on Codex identically to Claude: the Stop-block contract (hookSpecificOutput.additionalContext) already has a proven Codex translation via codex-hook-adapter.mjs's Stop branch (see tests/unit/codex-lifecycle-hooks.test.mjs), the same path continuation-gate already uses. Capacity-aware parallel-work guidance is also registered at UserPromptSubmit: it advises the coordinator to launch only real independent workers within sampled resource headroom and the live runtime/tool cap; it never spawns workers or claims execution. Automatic normalized project observations are captured at prompt, pre-tool, post-tool and child completion; Claude also observes PostToolUseFailure. Pending and degraded memory are disclosed; this does not establish synchronous ADR-073 conformance or native Grok recall. SessionStart has an 8-second measured replay/restore envelope.",
   "hooks": {
     "SessionStart": [
       {
@@ -7,8 +7,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node -e \"const f=require('node:fs'),o=require('node:os'),p=require('node:path'),c=require('node:child_process'),d=process.env.CODEX_HOME||p.join(o.homedir(),'.codex'),b=process.env.RUVNET_BRAIN_HOME||p.join(p.dirname(d),'.cache','ruvnet-brain'),w=p.join(b,'codex-hook.mjs');let s;try{s=f.statSync(w)}catch{}if(!s?.isFile())process.exit(0);const r=c.spawnSync(process.execPath,[w,...process.argv.slice(2)],{stdio:['inherit','pipe','pipe'],encoding:'utf8',env:process.env,timeout:Number(process.argv[1]),killSignal:'SIGKILL'});if(r.status===0||r.status===2){if(r.stdout)process.stdout.write(r.stdout);if(r.stderr)process.stderr.write(r.stderr)}process.exit(r.status===2?2:0)\" 4500 session-start",
-            "timeout": 5
+            "command": "node -e \"const f=require('node:fs'),o=require('node:os'),p=require('node:path'),c=require('node:child_process'),d=process.env.CODEX_HOME||p.join(o.homedir(),'.codex'),b=process.env.RUVNET_BRAIN_HOME||p.join(p.dirname(d),'.cache','ruvnet-brain'),w=p.join(b,'codex-hook.mjs');let s;try{s=f.statSync(w)}catch{}if(!s?.isFile())process.exit(0);const r=c.spawnSync(process.execPath,[w,...process.argv.slice(2)],{stdio:['inherit','pipe','pipe'],encoding:'utf8',env:process.env,timeout:Number(process.argv[1]),killSignal:'SIGKILL'});if(r.status===0||r.status===2){if(r.stdout)process.stdout.write(r.stdout);if(r.stderr)process.stderr.write(r.stderr)}process.exit(r.status===2?2:0)\" 7500 session-start",
+            "timeout": 8
           }
         ]
       }
@@ -36,6 +36,16 @@
       }
     ],
     "PreToolUse": [
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node -e \"const f=require('node:fs'),o=require('node:os'),p=require('node:path'),c=require('node:child_process'),d=process.env.CODEX_HOME||p.join(o.homedir(),'.codex'),b=process.env.RUVNET_BRAIN_HOME||p.join(p.dirname(d),'.cache','ruvnet-brain'),w=p.join(b,'codex-hook.mjs');let s;try{s=f.statSync(w)}catch{}if(!s?.isFile())process.exit(0);const r=c.spawnSync(process.execPath,[w,...process.argv.slice(2)],{stdio:['inherit','pipe','pipe'],encoding:'utf8',env:process.env,timeout:Number(process.argv[1]),killSignal:'SIGKILL'});if(r.status===0||r.status===2){if(r.stdout)process.stdout.write(r.stdout);if(r.stderr)process.stderr.write(r.stderr)}process.exit(r.status===2?2:0)\" 9000 session-snapshot PreToolUse",
+            "timeout": 10
+          }
+        ]
+      },
       {
         "matcher": "^(Write|Edit|MultiEdit|NotebookEdit|apply_patch)$",
         "hooks": [
@@ -48,6 +58,16 @@
       }
     ],
     "PostToolUse": [
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node -e \"const f=require('node:fs'),o=require('node:os'),p=require('node:path'),c=require('node:child_process'),d=process.env.CODEX_HOME||p.join(o.homedir(),'.codex'),b=process.env.RUVNET_BRAIN_HOME||p.join(p.dirname(d),'.cache','ruvnet-brain'),w=p.join(b,'codex-hook.mjs');let s;try{s=f.statSync(w)}catch{}if(!s?.isFile())process.exit(0);const r=c.spawnSync(process.execPath,[w,...process.argv.slice(2)],{stdio:['inherit','pipe','pipe'],encoding:'utf8',env:process.env,timeout:Number(process.argv[1]),killSignal:'SIGKILL'});if(r.status===0||r.status===2){if(r.stdout)process.stdout.write(r.stdout);if(r.stderr)process.stderr.write(r.stderr)}process.exit(r.status===2?2:0)\" 9000 session-snapshot PostToolUse",
+            "timeout": 10
+          }
+        ]
+      },
       {
         "matcher": "^(?:.*__)?search_ruvnet$",
         "hooks": [
@@ -63,6 +83,11 @@
       {
         "matcher": "*",
         "hooks": [
+          {
+            "type": "command",
+            "command": "node -e \"const f=require('node:fs'),o=require('node:os'),p=require('node:path'),c=require('node:child_process'),d=process.env.CODEX_HOME||p.join(o.homedir(),'.codex'),b=process.env.RUVNET_BRAIN_HOME||p.join(p.dirname(d),'.cache','ruvnet-brain'),w=p.join(b,'codex-hook.mjs');let s;try{s=f.statSync(w)}catch{}if(!s?.isFile())process.exit(0);const r=c.spawnSync(process.execPath,[w,...process.argv.slice(2)],{stdio:['inherit','pipe','pipe'],encoding:'utf8',env:process.env,timeout:Number(process.argv[1]),killSignal:'SIGKILL'});if(r.status===0||r.status===2){if(r.stdout)process.stdout.write(r.stdout);if(r.stderr)process.stderr.write(r.stderr)}process.exit(r.status===2?2:0)\" 9000 session-snapshot UserPromptSubmit",
+            "timeout": 10
+          },
           {
             "type": "command",
             "command": "node -e \"const f=require('node:fs'),o=require('node:os'),p=require('node:path'),c=require('node:child_process'),d=process.env.CODEX_HOME||p.join(o.homedir(),'.codex'),b=process.env.RUVNET_BRAIN_HOME||p.join(p.dirname(d),'.cache','ruvnet-brain'),w=p.join(b,'codex-hook.mjs');let s;try{s=f.statSync(w)}catch{}if(!s?.isFile())process.exit(0);const r=c.spawnSync(process.execPath,[w,...process.argv.slice(2)],{stdio:['inherit','pipe','pipe'],encoding:'utf8',env:process.env,timeout:Number(process.argv[1]),killSignal:'SIGKILL'});if(r.status===0||r.status===2){if(r.stdout)process.stdout.write(r.stdout);if(r.stderr)process.stderr.write(r.stderr)}process.exit(r.status===2?2:0)\" 9000 unprompted-speech UserPromptSubmit",
@@ -97,6 +122,18 @@
           }
         ]
       }
+    ],
+    "SubagentStop": [
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node -e \"const f=require('node:fs'),o=require('node:os'),p=require('node:path'),c=require('node:child_process'),d=process.env.CODEX_HOME||p.join(o.homedir(),'.codex'),b=process.env.RUVNET_BRAIN_HOME||p.join(p.dirname(d),'.cache','ruvnet-brain'),w=p.join(b,'codex-hook.mjs');let s;try{s=f.statSync(w)}catch{}if(!s?.isFile())process.exit(0);const r=c.spawnSync(process.execPath,[w,...process.argv.slice(2)],{stdio:['inherit','pipe','pipe'],encoding:'utf8',env:process.env,timeout:Number(process.argv[1]),killSignal:'SIGKILL'});if(r.status===0||r.status===2){if(r.stdout)process.stdout.write(r.stdout);if(r.stderr)process.stderr.write(r.stderr)}process.exit(r.status===2?2:0)\" 9000 session-snapshot SubagentStop",
+            "timeout": 10
+          }
+        ]
+      }
     ]
   }
 }