ruvnet-brain 4.5.3 → 4.5.5

package/plugin/scripts/agentdb-recall.mjs

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 /** Prompt-time canonical AgentDB recall (ADR-101, G-022).
- * Every nontrivial prompt searches the project and legacy default namespaces in
+ * Every nonempty human prompt searches curated signal, turn outcomes and project/default namespaces in
  * .swarm/memory.db. Recalled records are untrusted evidence, never instructions.
  * Global Ruflo executes in isolated scratch directories; all processes share one
- * <=2s deadline. ground-ruvnet.sh delivers <=600 bytes with session digest dedupe.
+ * <=2s deadline. ground-ruvnet.sh delivers <=600 bytes on each eligible prompt.
  */
 import fs from 'node:fs';
 import path from 'node:path';
@@ -33,10 +33,10 @@ export function agentdbStores(projectDir = process.cwd(), gitTimeoutMs) {
   return { root: resolved.projectRoot, stores };
 }
 
-/** Explicit acknowledgements are the only human prompts skipped. */
+/** Every nonempty human prompt can change or authorize project work. */
 export function recallTrigger(prompt) {
   const text = String(prompt || '').trim();
-  if (!text || isHarnessGenerated(text) || /^(?:ok(?:ay)?|yes|no|thanks?(?: you)?|got it|sounds good|great|sure|yep|yup|done|👍)[.!\s]*$/i.test(text)) return null;
+  if (!text || isHarnessGenerated(text)) return null;
   return { kinds: ['prompt'] };
 }
 
@@ -48,17 +48,18 @@ const STOP = new Set(('the a an and or but for nor so yet to of in on at by with
 
 /** Up to `max` distinctive words from the prompt, in order. */
 export function promptKeywords(prompt, max = 6) {
-  const words = String(prompt || '').toLowerCase().replace(/[^a-z0-9.\s-]/g, ' ').split(/\s+/)
+  const words = redactText(prompt).toLowerCase().replace(/[^a-z0-9.\s-]/g, ' ').split(/\s+/)
     .map((w) => w.replace(/^[-.]+|[-.]+$/g, '')).filter((w) => w.length >= 3 && !STOP.has(w) && !/^\d+$/.test(w));
   return [...new Set(words)].slice(0, max);
 }
 
 export function recallQuery(prompt) {
-  const terms = promptKeywords(redactText(prompt), 14);
-  if (/where are we|status|catch me up/i.test(prompt)) terms.push('project status progress');
-  if (/score|grade|north.star/i.test(prompt)) terms.push('scorecard north star');
-  if (/releas|publish|workflow run|dispatch/i.test(prompt)) terms.push('release decision authority');
-  return terms.join(' ') || String(prompt).trim().slice(0, 200);
+  const safePrompt = redactText(prompt);
+  const terms = promptKeywords(safePrompt, 14);
+  if (/where are we|status|catch me up/i.test(safePrompt)) terms.push('project status progress');
+  if (/score|grade|north.star/i.test(safePrompt)) terms.push('scorecard north star');
+  if (/releas|publish|workflow run|dispatch/i.test(safePrompt)) terms.push('release decision authority');
+  return terms.join(' ') || safePrompt.trim().slice(0, 200);
 }
 
 export function parseSearchJson(stdout) {
@@ -79,12 +80,64 @@ function clean(value, limit) {
   return out;
 }
 
-const NOISE_KEY = /^(?:verify[-_]|probe[-_]|test[-_]|rnb-quality-probe)/i;
-/** Prefer the substantive passage in long rubric/requirement records, never a generated summary. */
-export function evidenceExcerpt(value, key) {
+const NOISE_KEY = /^(?:verify[-_]|probe[-_]|test[-_]|rnb-quality-probe|session[-_]|turn[-_]|project-progress[-_]|cevt[-_])/i;
+const SIGNAL_NAMESPACES = new Set(['lessons', 'patterns', 'pattern']);
+/** Turn knowledge is the actual redacted outcome, never its session/transcript wrapper. */
+function turnOutcomeClauses(value, prompt) {
+  const outcome = /(?:^|\|\|\s*)OUTCOME:\s*([\s\S]*)/i.exec(redactText(value))?.[1]?.split(/\s*\|\|\s*[A-Z][A-Z ]*:/)[0];
+  if (!outcome) return [];
+  // Context-delivery vocabulary is not a result-bearing match (e.g. "project memory").
+  const terms = new Set(promptKeywords(prompt, 40).filter(t =>
+    !/^(?:previous|prior|canonical|project|memory|context|supplied|provided|automatically|recall|checks|results|concluded|identify|occurred|recover|read|files|tools|answer|concisely|disclose)$/.test(t)));
+  if (!terms.size) return [];
+  const clauses = outcome.split(/(?<=[.!?])\s+/).map((clause, index) => ({ clause, index,
+    relevance: promptKeywords(clause, 100).filter((term) => terms.has(term)).length }));
+  clauses.sort((a, b) => b.relevance - a.relevance);
+  const selected = []; let bytes = 9;
+  for (const entry of clauses.filter(c => c.relevance)) {
+    const size = Buffer.byteLength(entry.clause) + 1;
+    if (bytes + size <= 280) { selected.push(entry); bytes += size; }
+  }
+  if (!selected.length && clauses[0]?.relevance) return [clean(clauses[0].clause, 270)];
+  return selected.sort((a, b) => a.index - b.index).map(e => e.clause);
+}
+
+export function turnOutcomeExcerpt(value, prompt) {
+  const clauses = turnOutcomeClauses(value, prompt);
+  return clauses.length ? clean('OUTCOME: ' + clauses.join(' '), 280) : '';
+}
+
+/** Quote a substantive exact-value passage, including the remedy in structured lessons. */
+export function evidenceExcerpt(value, key, prompt = '') {
   const text = redactText(value);
+  if (/^project-state-current/i.test(key)) {
+    // Checkpoints often lead with version/hash metadata. Quote one actual field,
+    // selected by task terms, instead of spending the evidence budget on identity.
+    const first = text.indexOf('{'); const last = text.lastIndexOf('}');
+    if (first >= 0 && last > first) {
+      const json = text.slice(first, last + 1);
+      for (const candidate of [json, json.replace(/\\"/g, '"')]) {
+        try {
+          const object = JSON.parse(candidate);
+          if (!object || Array.isArray(object) || typeof object !== 'object') continue;
+          const terms = promptKeywords(prompt, 14);
+          const fields = Object.entries(object).filter(([name, field]) => typeof field === 'string'
+            && !/^(?:source|sha|version|candidate|shipped|host|timestamp|at)$/i.test(name));
+          fields.sort(([a, av], [b, bv]) => {
+            const weight = (name, field) => terms.filter(t => (name + ' ' + field).toLowerCase().includes(t)).length
+              + (/^(?:next|nextAction|blockers?|automaticMemory|status|scope)$/i.test(name) ? 0.25 : 0);
+            return weight(b, bv) - weight(a, av);
+          });
+          if (fields.length) return clean(fields[0][0] + ': ' + fields[0][1], 110);
+        } catch { /* An unparseable historical value is quoted as text below. */ }
+      }
+    }
+  }
   let start = -1;
-  if (/^scorecard/i.test(key)) {
+  if (/^lesson[-_]/i.test(key)) {
+    const match = /\bWORKED(?:\([^)]*\))?\s*:/i.exec(text);
+    if (match) start = match.index;
+  } else if (/^scorecard/i.test(key)) {
     const match = /\b(?:OVERALL\s*[:=]?\s*\d|Ops\s+\d|Brain.Score overall\s+\d|Continuity\s*=\s*\d)/i.exec(text);
     if (match) start = match.index;
   } else if (/^decision-agentdb-read-write/i.test(key)) {
@@ -93,19 +146,17 @@ export function evidenceExcerpt(value, key) {
   return clean(start >= 0 ? text.slice(start) : text, 110);
 }
 
-export function pickRows(results) {
-  const candidates = results.flatMap((r) => r.rows.filter((p) => p.namespace === r.namespace && !NOISE_KEY.test(p.key)
+export function pickRows(results, limit = 3) {
+  const candidates = results.flatMap((r) => r.rows.filter((p) => p.namespace === r.namespace && (!NOISE_KEY.test(p.key) || p.namespace === 'turns' && /^turn[-_]/i.test(p.key))
     && (!r.family || p.key.toLowerCase().includes(r.family))
-    && Number.isFinite(p.score) && p.score >= MIN_RELEVANCE));
-  const ranked = candidates.sort((a, b) => b.score - a.score);
-  // Represent both namespaces when relevant; neither may hide historical requirements.
+    && Number.isFinite(p.score) && p.score >= MIN_RELEVANCE).map((p) => ({ ...p, targeted: Boolean(r.family) })));
+  const signal = (p) => SIGNAL_NAMESPACES.has(p.namespace) ? 2 : p.namespace === 'turns' ? 1 : 0;
+  const ranked = candidates.sort((a, b) => Number(b.targeted) - Number(a.targeted) || signal(b) - signal(a) || b.score - a.score);
+  // Curated lessons and patterns are signal; lifecycle transcript telemetry is not.
+  // Do not reserve a slot for a weak match just because its namespace was searched.
   const chosen = [];
-  for (const ns of [...new Set(results.map((r) => r.namespace))]) {
-    const row = ranked.find((r) => r.namespace === ns);
-    if (row) chosen.push(row);
-  }
   for (const row of ranked) {
-    if (chosen.length >= 3) break;
+    if (chosen.length >= limit) break;
     if (!chosen.some((r) => r.key === row.key && r.namespace === row.namespace)) chosen.push(row);
   }
   return chosen.map((p) => ({ store: 'memory.db', key: p.key, namespace: p.namespace,
@@ -119,7 +170,10 @@ export function formatBlock({ picks, status }) {
   const shown = picks.slice();
   const render = (limit) => heading + shown.map((p) =>
     `\n${JSON.stringify(clean(p.key, 72))} [${clean(p.namespace, 32)}]: ${JSON.stringify(clean(p.preview, limit))}`).join('');
-  let limit = 110;
+  let limit = Math.min(280, Math.max(110, ...shown.map(p => Buffer.byteLength(String(p.preview || '')))));
+  // Preserve substantive multi-fact passages; drop lower-ranked records before
+  // clipping every record into incomplete facts merely to fill three slots.
+  while (shown.length > 1 && Buffer.byteLength(render(limit) + '\n') > BLOCK_MAX_BYTES) shown.pop();
   while (limit > 0 && Buffer.byteLength(render(limit) + '\n') > BLOCK_MAX_BYTES) limit -= 1;
   while (shown.length && Buffer.byteLength(render(limit) + '\n') > BLOCK_MAX_BYTES) shown.pop();
   return render(limit);
@@ -179,27 +233,44 @@ export async function recall({ prompt, projectDir = process.cwd(), env = process
     const store = stores[0];
     const query = recallQuery(prompt);
     const scratchFor = scratch || ((storePath) => rufloCwdFor(storePath, { root: rufloScratchRoot(env) }));
-    const namespaces = [...new Set([path.basename(root), 'default'])];
+    const namespaces = [...new Set(['lessons', 'patterns', 'pattern', 'turns', path.basename(root), 'default'])];
     const family = /score|grade|north.star/i.test(prompt) ? 'scorecard'
       : /where are we|status|catch me up/i.test(prompt) ? 'project-state-current'
       : /releas|publish|workflow run|dispatch/i.test(prompt) ? 'release'
       : /requirement|always|every prompt/i.test(prompt) ? 'decision-agentdb' : null;
     const jobs = namespaces.flatMap((namespace) => [{ namespace, family: null, args: ['--format', 'json', '-q', query, '-n', namespace, '--limit', '12'] },
-      ...(family ? [{ namespace, family, args: ['--format', 'json', '-q', family, '-n', namespace, '-t', 'keyword', '--limit', '4'] }] : [])]);
+      ...(family && !SIGNAL_NAMESPACES.has(namespace) && namespace !== 'turns' ? [{ namespace, family, args: ['--format', 'json', '-q', family, '-n', namespace, '-t', 'keyword', '--limit', '4'] }] : [])]);
     const results = await Promise.all(jobs.map(async ({ namespace, family: recordFamily, args }) => ({ namespace, family: recordFamily,
       ...await searchOnce({ ruflo: bin, store, deadline, env, scratch: scratchFor, args }) })));
     let status = results.every((r) => r.state === 'ok') ? 'ok'
       : results.some((r) => r.state === 'timed out') ? 'timed out' : 'unavailable';
-    const candidates = pickRows(results);
+    // Overfetch a bounded six exact values so rejected turn metadata cannot hide
+    // the next useful outcome; at most three verified excerpts are delivered.
+    const candidates = pickRows(results, 6);
     // Ruflo previews are ~60 characters. Read the actual selected values within
     // the same deadline so the block contains useful evidence rather than titles.
     const retrieved = await Promise.all(candidates.map(async (p) => {
       const r = await searchOnce({ ruflo: bin, store, deadline, env, scratch: scratchFor, operation: 'retrieve',
         args: ['-k', p.key, '-n', p.namespace, '--value-only'] });
-      if (r.state === 'ok' && r.value && !r.value.startsWith('[WARN]')) return { pick: { ...p, preview: evidenceExcerpt(r.value, p.key) }, state: 'ok' };
+      if (r.state === 'ok' && r.value && !r.value.startsWith('[WARN]')) {
+        const clauses = p.namespace === 'turns' ? turnOutcomeClauses(r.value, prompt) : null;
+        const preview = clauses ? turnOutcomeExcerpt(r.value, prompt) : evidenceExcerpt(r.value, p.key, prompt);
+        return { pick: preview ? { ...p, preview, clauses } : null, state: 'ok' };
+      }
       return { pick: null, state: r.state === 'ok' ? 'unavailable' : r.state };
     }));
-    const picks = retrieved.flatMap((r) => r.pick ? [r.pick] : []);
+    const seenClauses = new Set();
+    const picks = retrieved.flatMap(({ pick }) => {
+      if (!pick) return [];
+      const { clauses, ...p } = pick;
+      if (!clauses) return [p];
+      const unique = clauses.filter(clause => {
+        const id = clause.toLowerCase().replace(/[`*_-]/g, '').replace(/\s+/g, ' ').trim();
+        if (seenClauses.has(id)) return false;
+        seenClauses.add(id); return true;
+      });
+      return unique.length ? [{ ...p, preview: clean('OUTCOME: ' + unique.join(' '), 280) }] : [];
+    }).slice(0, 3);
     if (retrieved.some((r) => r.state !== 'ok')) status = retrieved.some((r) => r.state === 'timed out') ? 'timed out reading exact values' : 'unavailable exact values';
     return { block: formatBlock({ picks, status }), picks, stores, status: { 'memory.db': status } };
   } catch { return empty; }

package/plugin/scripts/codex-hook-adapter.mjs

@@ -216,21 +216,20 @@ function validPostToolUseOutput(value) {
   if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
   const topLevelKeys = new Set([
     'continue', 'stopReason', 'suppressOutput', 'systemMessage',
-    'terminalSequence', 'decision', 'reason', 'hookSpecificOutput',
+    'decision', 'reason', 'hookSpecificOutput',
   ]);
   if (Object.keys(value).some((key) => !topLevelKeys.has(key))) return false;
   if (value.continue !== undefined && typeof value.continue !== 'boolean') return false;
   if (value.stopReason !== undefined && typeof value.stopReason !== 'string') return false;
   if (value.suppressOutput !== undefined && typeof value.suppressOutput !== 'boolean') return false;
   if (value.systemMessage !== undefined && typeof value.systemMessage !== 'string') return false;
-  if (value.terminalSequence !== undefined && typeof value.terminalSequence !== 'string') return false;
   if (value.decision !== undefined && value.decision !== 'block') return false;
   if (value.decision === 'block' && (typeof value.reason !== 'string' || !value.reason.trim())) return false;
   if (value.hookSpecificOutput !== undefined) {
     const specific = value.hookSpecificOutput;
     if (!specific || typeof specific !== 'object' || Array.isArray(specific)) return false;
     const specificKeys = new Set([
-      'hookEventName', 'additionalContext', 'updatedToolOutput', 'updatedMCPToolOutput',
+      'hookEventName', 'additionalContext',
     ]);
     if (Object.keys(specific).some((key) => !specificKeys.has(key))) return false;
     if (specific.hookEventName !== 'PostToolUse') return false;
@@ -268,13 +267,23 @@ if (!parsed) {
   process.exit(0);
 }
 
-// A body can emit syntactically valid JSON that is still invalid for Codex's event-specific wire
-// schema (wrong event name, unsupported fields, or bad field types). Preserve the advisory as text
-// inside the known-good PostToolUse envelope instead of forwarding a payload the host rejects.
+// Codex 0.160.0 post-tool-use.command.output (extracted from the installed binary on
+// 2026-10-04) rejects terminalSequence, updatedToolOutput, and telemetry fields. The
+// host additionally rejects updatedMCPToolOutput semantically after schema parsing. Keep
+// supported control fields even when a shared body includes incompatible metadata: wrapping
+// the whole output as context alone would silently discard a security block.
 if (event === 'PostToolUse' && !validPostToolUseOutput(parsed)) {
-  process.stdout.write(JSON.stringify({
-    hookSpecificOutput: { hookEventName: event, additionalContext: stdout.trim() },
-  }));
+  const normalized = {};
+  for (const key of ['continue', 'stopReason', 'suppressOutput', 'systemMessage', 'reason']) {
+    const type = ['continue', 'suppressOutput'].includes(key) ? 'boolean' : 'string';
+    if (typeof parsed[key] === type) normalized[key] = parsed[key];
+  }
+  if (parsed.decision === 'block') {
+    normalized.decision = 'block';
+    if (!normalized.reason?.trim()) normalized.reason = stdout.trim();
+  }
+  normalized.hookSpecificOutput = { hookEventName: event, additionalContext: stdout.trim() };
+  process.stdout.write(JSON.stringify(normalized));
   process.exit(0);
 }
 

package/plugin/scripts/continuity-hook-policy.mjs

@@ -125,6 +125,7 @@ export const CONTINUITY_EVENTS = Object.freeze({
     registration('session-start', 'startup|resume|clear|compact|fork', ['claude', 'codex']),
   ]),
   UserPromptSubmit: Object.freeze([
+    registration('session-snapshot', '*', ['claude', 'codex']),
     registration('unprompted-speech', '*', ['claude', 'codex']),
     registration('ground-ruvnet', '*', ['claude', 'codex']),
     // Context-only recommendation for clearly substantial, independently splittable work. The
@@ -142,6 +143,7 @@ export const CONTINUITY_EVENTS = Object.freeze({
   // Claude's `Edit` shape for decision-gate.mjs's own policies (protect-state, hijack-ruvnet,
   // ground-before-write, adr-currency all then see tool_name:"Edit" exactly as on Claude).
   PreToolUse: Object.freeze([
+    registration('session-snapshot', '*', ['claude', 'codex']),
     registration('decision-gate', '^(Write|Edit|MultiEdit|NotebookEdit|apply_patch)$', ['claude', 'codex']),
   ]),
   // Extended to Codex 2026-09-12: a real MCP `search_ruvnet` call was measured to fire PostToolUse
@@ -151,8 +153,15 @@ export const CONTINUITY_EVENTS = Object.freeze({
   // no change either (proven live: the real MCP tool_response's `content[0].text` carries the exact
   // "Searched N RuvNet repos" banner and query text the script already looks for).
   PostToolUse: Object.freeze([
+    registration('session-snapshot', '*', ['claude', 'codex']),
     registration('grounding-stamp', '^(?:.*__)?search_ruvnet$', ['claude', 'codex']),
   ]),
+  PostToolUseFailure: Object.freeze([
+    registration('session-snapshot', '*', ['claude']),
+  ]),
+  SubagentStop: Object.freeze([
+    registration('session-snapshot', '*', ['claude', 'codex']),
+  ]),
   Stop: Object.freeze([
     registration('continuation-gate', '*', ['claude', 'codex']),
     // Codex added 2026-09-29 (owner requirement: every turn's outcome recorded on BOTH hosts —

package/plugin/scripts/continuity-journal.mjs

@@ -1,33 +1,16 @@
 /**
- * continuity-journal.mjs — durable outbox FIRST, then AgentDB, then an exact read-back. Never silent.
- * THE GUARANTEE, and the failure it is built around. `ruflo memory store` refuses a write while another
- * process holds the store's native WAL sidecars: memory-initializer.ts storeEntry/getEntry check
- * `hasNativeWalSidecars(dbPath)` and return `walRefusalError` ("active native WAL connection — refusing
- * an unsafe sql.js whole-image write"; ruflo #2735/#2878, search_ruvnet:
- * ruflo/v3/@claude-flow/cli/src/memory/memory-initializer.ts). That is ordinary under concurrency, so an
- * event that is only ever handed to `ruflo` once is an event that can be lost. Here:
+ * Durable material events: fsync the outbox, store through canonical Ruflo, then exact-read back.
+ * Ruflo refuses sql.js writes during native WAL contention (#2735/#2878); a refused event stays
+ * pending and the bounded worker retries with backoff. Only verified bytes produce a commit receipt.
+ * Current original-path consent governs capture and every replay attempt; opt-out retains debt.
+ * One kind:id denotes one event, even when concurrent sessions observe it. A conflicting stored row
+ * is quarantined. Missing store/Ruflo is not applicable, while pending debt or corruption is reported
+ * by the SessionStart brief, doctor, and a once-per-session Claude Stop notice.
  *
- *   1. append(): every event is written to `.swarm/continuity-events-outbox.jsonl` and fsynced BEFORE
- *      any store call. From that instant it cannot be lost by a crash, a SIGKILL or a refusal.
- *   2. drain(): `ruflo memory store --no-upsert --path <db>` (the ONLY writer of memory.db), then the
- *      row is read back by exact key through the read-only node:sqlite reader (the same independent
- *      read path project-progression-store.mjs uses) and compared. Only then is a `commit` line
- *      appended. A refusal is retried with backoff inside the worker's budget; whatever is left stays
- *      pending and is retried by the next boundary's worker.
- *   3. status(): pending count, oldest pending, last commit, last failure — surfaced by the SessionStart
- *      brief, `--doctor`, and (Claude) a Stop line when recording is stuck. Never swallowed.
- * WHAT "✗" MEANS, AND WHAT KEEPS THE FILE SMALL (independent review S3/S4, 2026-10-01):
- *   • ONE EVENT, ONE KEY: two lines under one key are one event seen twice (first wins); only a stored row
- *     that is NOT that kind:id is a conflict, and that key is quarantined.
- *   • NOT APPLICABLE IS NOT A FAILURE: no initialized store → nothing journalled; no ruflo → events wait,
- *     no drainer, and the line says "n/a", never ✗.
- *   • A PROBLEM IS REPORTED, THEN CLEARS: quarantine/corrupt lines age out after QUARANTINE_REPORT_MS or
- *     with `continuity-brief.mjs --clear`; the Stop line shows once per session per condition.
- *   • BOUNDED. A failure is ONE record per event (attempt count, last error), never a line per attempt;
- *     compact() rewrites the file atomically (lock + size re-check, so a concurrent append is never
- *     lost): committed events older than RETAIN_COMMITTED_MS leave (the store keeps them and dedupes),
- *     corrupt lines become one notice; MAX_EVENT_RECORDS bounds committed history, never pending events.
- *     A prolonged outage can grow the pending file beyond that soft cap; status reports capacity pressure.
+ * Failures retain one attempts/last-error record per event. Lock-protected compaction checks the file
+ * size before atomic replacement so concurrent appends survive. It removes committed history after
+ * RETAIN_COMMITTED_MS, ages quarantine/corrupt notices after QUARANTINE_REPORT_MS, and bounds committed
+ * history at MAX_EVENT_RECORDS. Pending events are never dropped; prolonged outages report pressure.
  */
 import fs from 'node:fs';
 import os from 'node:os';
@@ -39,7 +22,7 @@ import { withProgressionReader } from './project-progression-reader.mjs';
 import { rufloRunDir } from './project-progression-store.mjs';
 import { resolveRuflo, rufloInvocation } from './ruflo-bin.mjs';
 import { resolveProjectStore } from './project-store-resolver.mjs';
-import { readSettledTranscript } from './turn-outcome-capture.mjs';
+import { resolveTurnDb, readSettledTranscript } from './turn-outcome-capture.mjs';
 import {
   CONTINUITY_NAMESPACE, INITIAL_LOOKBACK_MS, collectCommits, collectReleases, collectTurnEvents, eventIdOf, eventKey,
 } from './continuity-events.mjs';
@@ -72,9 +55,11 @@ const ms = (iso) => Date.parse(iso || '') || 0;
 
 export class ContinuityJournal {
   /** `ruflo`: the binary (string), null = not installed, undefined = resolve it. */
-  constructor({ projectRoot, fsync = fs.fsyncSync, now = Date.now, ruflo } = {}) {
+  constructor({ projectRoot, projectDir = projectRoot, env = process.env, fsync = fs.fsyncSync, now = Date.now, ruflo } = {}) {
     if (typeof projectRoot !== 'string' || !projectRoot) throw new TypeError('projectRoot is required');
     this.projectRoot = projectRoot;
+    this.projectDir = projectDir;
+    this.brainHome = env.RUVNET_BRAIN_HOME || path.join(env.HOME || os.homedir(), '.cache', 'ruvnet-brain');
     this.swarm = path.join(projectRoot, '.swarm');
     this.path = path.join(this.swarm, OUTBOX_NAME);
     this.db = path.join(this.swarm, 'memory.db');
@@ -169,15 +154,21 @@ export class ContinuityJournal {
     return ids;
   }
 
+  captureConsent(projectDir = this.projectDir, unknownOriginalPath = false) {
+    return resolveTurnDb({ projectDir, brainHome: this.brainHome, requestedStorePath: this.db, unknownOriginalPath });
+  }
+
   /** Journal the events this boundary observed that are not already known. Returns what was added. */
   record(events) {
+    const consent = this.captureConsent();
+    if (consent.skipped) throw new Error(`event capture suspended: ${consent.skipped}`);
     const known = this.knownIds();
     const fresh = [];
     for (const event of events) {
       const id = `${event.kind}:${event.id}`;
       if (known.has(id)) continue;
       known.add(id);
-      fresh.push({ type: 'event', key: eventKey(event), digest: digestCanonical(event), journaledAt: new Date(this.now()).toISOString(), event });
+      fresh.push({ type: 'event', capturePath: consent.capturePath, key: eventKey(event), digest: digestCanonical(event), journaledAt: new Date(this.now()).toISOString(), event });
     }
     this.appendRecords(fresh);
     return fresh;
@@ -378,6 +369,11 @@ export function drain(journal, {
     let attempts = 0;
     let last = null;
     for (let attempt = 0; !done && now() < deadline; attempt += 1) {
+      let consent;
+      try { consent = journal.captureConsent(rec.capturePath || journal.projectRoot, !rec.capturePath); }
+      catch (error) { consent = { skipped: `capture consent unavailable: ${error.message}` }; }
+      if (consent.skipped) return { committed, failed, remaining: journal.pending().length, skipped: consent.skipped };
+      if (now() >= deadline) break;
       attempts += 1;
       const result = store({ ruflo, db: journal.db, key: rec.key, value });
       const back = readBack({ ruflo, db: journal.db, key: rec.key });
@@ -452,7 +448,11 @@ export function captureContinuityEvents({
   if (String(env.RUVNET_CONTINUITY_CAPTURE || '').toLowerCase() === 'off') return { ...report, skipped: 'RUVNET_CONTINUITY_CAPTURE=off' };
   let resolution;
   try { resolution = resolveProjectStore({ projectDir }); } catch { return { ...report, skipped: 'project store could not be resolved' }; }
-  const journal = new ContinuityJournal({ projectRoot: resolution.projectRoot, now, ruflo });
+  const journal = new ContinuityJournal({ projectRoot: resolution.projectRoot, projectDir, env, now, ruflo });
+  try {
+    const consent = journal.captureConsent();
+    if (consent.skipped) return { ...report, skipped: consent.skipped.startsWith('no project memory db') ? `not applicable: ${consent.skipped}` : consent.skipped };
+  } catch (error) { return { ...report, skipped: `capture consent unavailable: ${error.message}` }; }
   try {
     const st = fs.lstatSync(journal.swarm);
     if (!st.isDirectory() || st.isSymbolicLink()) return { ...report, skipped: '.swarm is not a real directory' };
@@ -487,7 +487,7 @@ export function captureContinuityEvents({
 
 /** The detached worker body. */
 export function runDrain(projectRoot, options = {}) {
-  const journal = new ContinuityJournal({ projectRoot, ...(options.ruflo !== undefined ? { ruflo: options.ruflo } : {}) });
+  const journal = new ContinuityJournal({ projectRoot, ...(options.env ? { env: options.env } : {}), ...(options.ruflo !== undefined ? { ruflo: options.ruflo } : {}) });
   const release = takeLock(journal);
   if (!release) return { skipped: 'another drainer holds the lock' };
   try { return drain(journal, options); } finally { release(); }

package/plugin/scripts/ground-ruvnet.sh

@@ -68,7 +68,7 @@ if printf '%s' "$TEXT" | grep -qiE '\[Your previous response|\[Request interrupt
 fi
 
 # Read canonical memory before the quiet path; useful evidence may exist even
-# for a worktree with no local .swarm. Acks/off/no-match keep the cheap return.
+# for a worktree with no local .swarm. Off/absent/no-match keep the cheap return.
 _ADB_OUT=""
 if [ "${RUVNET_AGENTDB_FIRST:-on}" != "off" ]; then
   _ADB_OUT=$(printf '%s' "$INPUT" | "${RUVNET_NODE_BIN:-node}" "$(dirname "$0")/agentdb-recall.mjs" 2>/dev/null)
@@ -145,8 +145,8 @@ inj_seen() {
 }
 inj_mark() { [ -n "$INJ_DIR" ] && mkdir -p "$INJ_DIR" 2>/dev/null && : > "$INJ_DIR/$1" 2>/dev/null; return 0; }
 
-# ── Canonical AgentDB recall (ADR-101): every nontrivial human prompt. ──────────────
-# Priority 0 and digest dedupe preserve safety output and avoid re-sending evidence.
+# ── Canonical AgentDB recall (ADR-101): every nonempty human prompt. ──────────────
+# Priority 0 preserves safety output. Recall is delivered on every eligible prompt.
 if [ -n "$_ADB_OUT" ]; then
   _ADB_ID=$(printf '%s\n' "$_ADB_OUT" | head -n 1 | tr -cd 'A-Za-z0-9' | cut -c1-12)
   [ -n "$_ADB_ID" ] && printf '%s\n' "$_ADB_OUT" | sed '1d' | out_to "0-0-agentdb-recall-$_ADB_ID"
@@ -652,7 +652,7 @@ if [ -n "$BLK" ]; then
   INJ_USED=0
   for _f in $(cd "$BLK" 2>/dev/null && ls | grep -v '\.' | sort -t- -k2,2n -k1,1n); do
     _rest=${_f#*-}; _prio=${_rest%%-*}; _id=${_rest#*-}
-    if [ "$_id" != "resume" ] && inj_seen "$_id"; then
+    if [ "$_id" != "resume" ] && [ "${_id#agentdb-recall-}" = "$_id" ] && inj_seen "$_id"; then
       if [ -f "$BLK/$_f.short" ]; then echo short > "$BLK/$_f.pick"; INJ_SHORTENED=$((INJ_SHORTENED + 1)); fi
       continue
     fi
@@ -665,7 +665,7 @@ if [ -n "$BLK" ]; then
     if [ "$_id" = "flywheel" ]; then claim_flywheel_day || continue; fi
     echo full > "$BLK/$_f.pick"
     [ "$_prio" != "0" ] && INJ_USED=$((INJ_USED + _size))
-    [ "$_id" != "resume" ] && inj_mark "$_id"
+    [ "$_id" != "resume" ] && [ "${_id#agentdb-recall-}" = "$_id" ] && inj_mark "$_id"
   done
   for _f in $(cd "$BLK" 2>/dev/null && ls | grep -v '\.' | sort -n); do
     case "$(cat "$BLK/$_f.pick" 2>/dev/null)" in

package/plugin/scripts/hook-shim.mjs

@@ -197,29 +197,9 @@ if (!entry) {
 // forgets to declare one fails toward the pre-ADR-054 behaviour rather than toward silent death.
 if (BRAIN_OFF && entry.offBehavior === 'silence') process.exit(0);
 
-// The ground hook is registered on every prompt. On Windows, starting Git Bash and then jq can
-// consume most of the hook's five-second declaration before an unrelated prompt reaches the
-// shell body's "emit nothing" verdict. Read a bounded copy here, in the Node process that is
-// already running, and skip the interpreter entirely only when BOTH prompt intent and project
-// state prove that no advisory can fire. The regex deliberately over-approximates the shell gates:
-// false positives take the established body; false negatives would be a product defect.
+// Read a bounded payload before dispatch. The ground body owns the quiet-prompt
+// decision because it resolves canonical memory beyond the hook process's cwd.
 let hookInput = null;
-const GROUND_RELEVANT = /ruvnet|ruflo|ruvector|\brvf\b|agentdb|agenticow|rulake|ruview|rupixel|ruv-fann|agentic-flow|synthlang|dspy|qudag|safla|metaharness|cve-bench|sparc|swarm|claude-flow|pinecone|pgvector|chroma|weaviate|faiss|milvus|qdrant|hnswlib|annoy|vector|langchain|llama|autogen|crew-ai|semantic-kernel|embedding|retrieval|prompt compression|token cost|post-quantum|quantum-resistant|\badr\b|decision|architect|design|plan|spec|refactor|migrat|implement|build|write|add|change|fix|update|deploy|create|enhance|set up|setup|wire|integrate|test|coverage|audit|review|benchmark|lint|scan|debug|optimi|app|feature|service|system|backend|frontend|\bapi\b|module|pipeline|infra|database|schema|workflow|roadmap|milestone|autonomous|unattended|do not stop|keep working|keep going|soak run|harness|quality|readiness|evolve|self-improv|hardening|cheaper|cheap|lower cost|compute arbitrage|cascade|scorecard|score .*repo/i;
-
-function projectCanSpeakWithoutPrompt() {
-  if (process.env.RUVNET_AUTONOMOUS === '1') return true;
-  try {
-    if (fs.existsSync(path.join(process.cwd(), '.claude-flow')) ||
-        fs.existsSync(path.join(process.cwd(), '.swarm'))) return true;
-    for (const name of ['package.json', '.mcp.json']) {
-      try {
-        if (/claude-flow|ruflo/i.test(fs.readFileSync(path.join(process.cwd(), name), 'utf8'))) return true;
-      } catch { /* absent/unreadable project metadata cannot create an advisory */ }
-    }
-  } catch { /* fail toward running the body below */ return true; }
-  return false;
-}
-
 function readHookInput(limit) {
   return new Promise((resolve) => {
     const chunks = [];
@@ -398,14 +378,8 @@ function dispatchHook() {
 if (entry.stdinBytes) {
   readHookInput(entry.stdinBytes).then((input) => {
     hookInput = input;
-    if (hookId === 'ground-ruvnet') {
-      let text = input.toString('utf8');
-      try {
-        const parsed = JSON.parse(text);
-        text = parsed?.prompt ?? parsed?.user_prompt ?? parsed?.input ?? text;
-      } catch { /* raw/malformed input is classified as-is */ }
-      if (!GROUND_RELEVANT.test(String(text)) && !projectCanSpeakWithoutPrompt()) process.exit(0);
-    }
+    // The body resolves canonical project memory before its quiet return. A cwd-only
+    // preflight here would hide eligible memory in nested directories and worktrees.
     process.exit(dispatchHook());
   }).catch(() => {
     hookInput = Buffer.alloc(0);