ruvnet-brain 4.5.5 → 4.5.6

package/README.md

@@ -7,7 +7,7 @@ Created: 2026-06-29 22:36:38 EDT
 
 # 🧠 RuvNet Brain
 
-### 🧠 RuvNet Brain — [![RuvNet Brain version 4.5.5 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.5.5-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
+### 🧠 RuvNet Brain — [![RuvNet Brain version 4.5.6 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.5.6-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
 
 **A portable, source-grounded brain over Reuven Cohen's (rUv's) RuvNet stack — delivered as a Claude Code plugin that makes Claude _use_ the stack instead of fighting it.**
 

package/bin/install.mjs

@@ -80,7 +80,8 @@ import {
 import { shellDiff as pluginShellDiff } from '../plugin/scripts/host-shell-boundary.mjs';
 import { codexTrustChanges, CODEX_TRUST_ACTION } from '../scripts/codex-hook-trust.mjs';
 import { repairSecurityGuidance } from '../scripts/security-guidance-codex-compat.mjs';
-import { installNativeLaunchers } from '../scripts/model-routing-launchers.mjs';
+import { installNativeLaunchers, installRoutingRuntime } from '../scripts/model-routing-launchers.mjs';
+import { installTerminalLaunchers } from '../scripts/model-terminal-launchers.mjs';
 import { readConsoleReceipts, replaceStaleConsoles } from '../scripts/console-instances.mjs';
 import { moveBrain, MoveRefused } from '../scripts/move-brain.mjs';
 import { brainLocation } from '../plugin/scripts/brain-location.mjs';
@@ -1631,6 +1632,7 @@ function codexManagedBlock(serverPath) {
     'command = "node"',
     `args = [${JSON.stringify(serverPath)}]`,
     'startup_timeout_sec = 30',
+    'env = { RUVNET_HOOK_HOST = "codex" }',
     CODEX_BLOCK_END,
   ].join('\n');
 }
@@ -1837,6 +1839,10 @@ export function wireCodexHost({
   // land where the server will look for them, and the walk is transitive because a dependency's own
   // dependency is no less required.
   const deps = serverDependencies(source);
+  // Progression capture reads its adapter version from this runtime resource, not an import.
+  // Keep it beside the copied plugin scripts, bound to the same source as the MCP shell.
+  deps.push({ spec: '../.claude-plugin/plugin.json',
+    from: path.resolve(path.dirname(source), '..', '.claude-plugin', 'plugin.json') });
   const missing = deps.filter((d) => !fs.existsSync(d.from));
   if (missing.length) {
     if (announce) warn(`MCP server dependency missing from this bundle (${missing.map((d) => d.spec).join(', ')}) — Codex left untouched (non-fatal)`);
@@ -4913,18 +4919,28 @@ export function syncManagedRouterDefault({ routerDir = path.join(os.homedir(), '
 }
 
 export function refreshInstalledModelLaunchers({ sourceRoot = REPO_ROOT, home = os.homedir() } = {}) {
+  const terminalFile = path.join(home, '.cache', 'ruvnet-brain', 'model-routing', 'terminal-launcher-config.json');
+  let terminal = { action: 'not-installed' };
+  if (fs.existsSync(terminalFile)) {
+    const previous = JSON.parse(fs.readFileSync(terminalFile, 'utf8'));
+    const runtime = installRoutingRuntime({ sourceRoot, home, apply: true });
+    const receipt = installTerminalLaunchers({ home, ...runtime, nodeBinary: previous.nodeBinary,
+      realCodex: previous.realCodex, realClaude: previous.realClaude, apply: true });
+    terminal = { action: previous.runtimeDigest === runtime.runtimeDigest ? 'unchanged' : 'updated',
+      runtimeDigest: runtime.runtimeDigest, shellConflicts: receipt.shellConflicts };
+  }
   const file = path.join(home, '.cache', 'ruvnet-brain', 'model-routing', 'launcher-config.json');
-  if (!fs.existsSync(file)) return { action: 'not-installed' };
+  if (!fs.existsSync(file)) return { action: 'not-installed', terminal };
   const previous = JSON.parse(fs.readFileSync(file, 'utf8'));
   const receipt = installNativeLaunchers({ sourceRoot, home, extensionsRoot: previous.extensionsRoot, nodeBinary: previous.nodeBinary, apply: true });
-  return { action: receipt.config.runtimeDigest === previous.runtimeDigest ? 'unchanged' : 'updated', runtimeDigest: receipt.config.runtimeDigest };
+  return { action: receipt.config.runtimeDigest === previous.runtimeDigest ? 'unchanged' : 'updated', runtimeDigest: receipt.config.runtimeDigest, terminal };
 }
 
 export function syncManagedRouterTools({ routerDir = path.join(os.homedir(), '.claude', 'model-router'), packageRoot = REPO_ROOT } = {}) {
   const destination = path.join(routerDir, 'bin');
   fs.mkdirSync(destination, { recursive: true });
   let copied = 0;
-  for (const name of ['model-router-engine.mjs', 'model-router-setup.mjs', 'model-router-status.mjs', 'model-router-outcome.mjs', 'subscription-hosts.mjs', 'review-model-defaults.mjs', 'dual-host-deliberation.mjs', 'dual-host-suggest.mjs', 'route-cheap.mjs', 'dispatch-receipt.mjs', 'metaharness-receipts.mjs', 'metaharness-router.mjs', 'model-router-dispatch.mjs', 'model-currency.mjs', 'model-currency-evidence.mjs', 'user-model-prompt-hook.mjs', 'model-router-agent-hook.mjs', 'model-weekly-assessment.mjs', 'model-weekly-analyst.mjs', 'model-weekly-cycle.mjs', 'model-weekly-qualification.mjs', 'model-native-qualification.mjs', 'model-routing-launchers.mjs', 'model-native-catalog.mjs', 'model-analyst-sandbox.mjs', 'model-routing-policy-promotion.mjs', 'model-routing-gateway.mjs', 'native-subscription-usage.mjs', 'codex-routed.sh', 'goldie-weekly.sh']) {
+  for (const name of ['model-router-engine.mjs', 'model-router-setup.mjs', 'model-router-status.mjs', 'model-router-outcome.mjs', 'subscription-hosts.mjs', 'review-model-defaults.mjs', 'dual-host-deliberation.mjs', 'dual-host-suggest.mjs', 'route-cheap.mjs', 'dispatch-receipt.mjs', 'metaharness-receipts.mjs', 'metaharness-router.mjs', 'model-router-dispatch.mjs', 'model-currency.mjs', 'model-currency-evidence.mjs', 'user-model-prompt-hook.mjs', 'model-router-agent-hook.mjs', 'model-weekly-assessment.mjs', 'model-weekly-analyst.mjs', 'model-weekly-cycle.mjs', 'model-weekly-qualification.mjs', 'model-native-qualification.mjs', 'model-routing-launchers.mjs', 'model-terminal-gateway.mjs', 'model-terminal-launchers.mjs', 'claude-terminal-mod.mjs', 'model-native-catalog.mjs', 'model-analyst-sandbox.mjs', 'model-routing-policy-promotion.mjs', 'model-routing-gateway.mjs', 'native-subscription-usage.mjs', 'codex-routed.sh', 'goldie-weekly.sh']) {
     const source = path.join(packageRoot, 'scripts', name);
     if (!fs.existsSync(source)) throw new Error(`Packaged router tool missing: ${name}`);
     const target = path.join(destination, name);
@@ -4935,8 +4951,9 @@ export function syncManagedRouterTools({ routerDir = path.join(os.homedir(), '.c
     finally { fs.rmSync(temporary, { force: true }); }
     copied++;
   }
-  // Preserve the package-relative import used by the optional legacy routing helper.
-  const runtimeRelative = path.join('plugin', 'scripts', 'runtime-preferences.mjs');
+  // Preserve package-relative imports without replacing user policy.mjs overrides.
+  for (const runtimeRelative of [path.join('plugin', 'scripts', 'runtime-preferences.mjs'),
+    path.join('config', 'model-router', 'policy.default.mjs')]) {
   const runtimeTarget = path.join(routerDir, runtimeRelative);
   const runtimeBytes = fs.readFileSync(path.join(packageRoot, runtimeRelative));
   if (!fs.existsSync(runtimeTarget) || !fs.readFileSync(runtimeTarget).equals(runtimeBytes)) {
@@ -4946,6 +4963,7 @@ export function syncManagedRouterTools({ routerDir = path.join(os.homedir(), '.c
     finally { fs.rmSync(temporary, { force: true }); }
     copied++;
   }
+  }
   const qualificationSource = path.join(packageRoot, 'config', 'model-router', 'qualification-contract.json');
   const qualificationTarget = path.join(routerDir, 'qualification-contract.json');
   const qualificationBytes = fs.readFileSync(qualificationSource);

package/config/model-router/claude-terminal-mod/.claude-plugin/plugin.json

@@ -0,0 +1 @@
+{"name":"rnb-terminal-routing","version":"0.1.0","description":"Reviewed per-user native terminal routing"}

package/config/model-router/claude-terminal-mod/README.md

@@ -0,0 +1,22 @@
+Updated: 2026-10-04 16:10:00 EDT | Version 0.1.1
+Created: 2026-10-04 16:10:00 EDT
+
+# Native terminal routing prototype
+
+Tested against the installed Claude Code 2.1.289 native binary and its generated mod declarations. Mods require 2.1.287 or later. This routes the native host's own `turn.step` middleware: it passes model and effort to `yield* next(...)`, preserving the native streaming result and TUI. It does not call a separate inference API or inject slash commands.
+
+`prepareClaudeTerminalMod({ destination })` in `scripts/claude-terminal-mod.mjs` materializes a private plugin directory, generates absolute Node/helper/engine paths, and copies the approved pure classifier into the mod. The source directory is deliberately unprepared. No Node APIs run inside sandboxed mod code. `$.process.run` invokes the bridge with prompt JSON on stdin, never in arguments. The existing policy engine validates current per-user catalog, profile, reviewed model/effort allocation and subscription eligibility. Review age remains evidence for the weekly refresh and does not revoke the owner-approved allocation; it supplies no native/default/metered fallback.
+
+A launcher must provide `RNB_CLAUDE_MOD_NONCE` (64 lowercase hexadecimal characters) and `RNB_CLAUDE_MOD_RECEIPT` (absolute receipt filename in an already prepared private directory). `session.start` calls the bridge to write an atomic, mode-0600 activation receipt. The launcher must compare nonce, exact real plugin root, native version, source digest, timestamp and live process state before accepting startup. `prepareClaudeTerminalMod` returns `modDigest`; `terminalModDigest` recomputes it. The receipt's `pid` is the bridge parent's mod worker, not an asserted main CLI PID. `--health` supports the same bounded receipt schema; it does not invent a native crash guard.
+
+`prompt.submit` approves the prompt once. Its optional `turnId` denotes a running turn, not the upcoming idle turn. A bounded FIFO stores pending text and decisions in RAM only. `turn.start` binds the next approved prompt to the newly minted exact turn ID. If native settings hooks settled different text, the bridge reclassifies that text using the original task class as a minimum. Image-only submissions use a conservative hard-review classification while passing original attachments and text unchanged. Every backend step keeps the bound model/effort and exact turn ID/index. Completion and session end remove decisions. Queue/active maps cap at 32 entries; pending prompts expire after five minutes. Direct mid-turn deliveries (a running `turnId` without `wait`) refuse because no new authoritative `turn.start` exists; queue the prompt to start its own turn. Subagent steps and unbound continuations refuse instead of borrowing the main turn's decision.
+
+A prompt/helper failure returns `{ drop }` without `next`. A step failure returns an immediate native refusal result without `next`, retaining turn ID/index. Every consequential hook has a `.catch` handler whose refusal does no process, filesystem or model work. Missing activation refuses subsequent prompts and steps.
+
+## Failure boundary
+
+Claude Code can skip all hooks if the mod fails to load, the native mod worker crashes, hooks are disabled, another guard refuses registration, or a hook and its catch handler both fail. Other mods later in the chain can rewrite model/effort. A startup receipt proves that the activation hook ran for that nonce and source digest; it is not a perpetual guarantee that routing hooks remain active. This prototype cannot claim universal fail-closed enforcement. The root CLI wrapper owns the startup guard and any further runtime monitoring. Native model inference and rendered TUI acceptance remain separate checks; plugin tests stub the engine boundary and incur no inference.
+
+## Checks
+
+Run `claude plugin validate config/model-router/claude-terminal-mod`, `claude plugin test config/model-router/claude-terminal-mod`, and `vitest run tests/unit/claude-terminal-mod.test.mjs`. The native tests exercise the installed mod runtime, including two different turn allocations, high coding effort, final-text class floors, missing decisions and helper exceptions. Unit tests call the actual policy engine against isolated catalog/profile/policy fixtures, including stale allocation, invalid policy, absent hard model and disabled subscription states.

package/config/model-router/claude-terminal-mod/hooks/hooks.json

@@ -0,0 +1 @@
+{"modules":["./register.js"]}

package/config/model-router/claude-terminal-mod/hooks/policy.default.mjs

@@ -0,0 +1,2 @@
+// Source-only adapter. Materialization copies the canonical classifier into the sandbox.
+export { classify } from '../../policy.default.mjs';

package/config/model-router/claude-terminal-mod/hooks/register.js

@@ -0,0 +1,66 @@
+import runtime from './runtime.js';
+import { createTurnCache, inspectDecision, classificationText, refusalStream, REFUSAL } from './routing.js';
+export function register(on) {
+  const cache = createTurnCache();
+  let ready = false;
+  on('session.start', async ($, e, next) => {
+    ready = false; cache.clear();
+    const nonce = await $.env.get('RNB_CLAUDE_MOD_NONCE');
+    const receiptPath = await $.env.get('RNB_CLAUDE_MOD_RECEIPT');
+    const version = (await $.session.version()).version;
+    const sessionId = await $.session.id();
+    const pluginRoot = $.plugin.root;
+    const result = await $.process.run([runtime.nodePath, runtime.helperPath, '--ready'], {
+      stdin: JSON.stringify({ nonce, receiptPath, version, sessionId, pluginRoot }), timeoutMs: 8000,
+    });
+    if (result.exitCode !== 0) throw new Error(REFUSAL);
+    const receipt = JSON.parse(result.stdout);
+    if (receipt.nonce !== nonce || receipt.status !== 'ready') throw new Error(REFUSAL);
+    ready = true; return next(e);
+  }).catch(($, e) => { ready = false; return { cwd: e.cwd }; });
+  on('prompt.submit', async ($, e, next) => {
+    // Direct delivery into a running turn has no authoritative new turn.start boundary.
+    if (e.turnId && !e.wait) return { drop: REFUSAL };
+    if (!ready || typeof e.text !== 'string' || (!e.text.trim() && !e.attachments?.length) || e.text.length > 200000) return { drop: REFUSAL };
+    const result = await $.process.run([runtime.nodePath, runtime.helperPath, '--decision'], {
+      stdin: JSON.stringify({ prompt: classificationText(e.text, e.attachments), enginePath: runtime.enginePath, policyPath: runtime.policyPath }), timeoutMs: 8000,
+    });
+    if (result.exitCode !== 0) return { drop: REFUSAL };
+    const now = await $.clock.now();
+    const decision = inspectDecision(JSON.parse(result.stdout), classificationText(e.text, e.attachments), now);
+    const entry = cache.enqueue(e.text, decision, now);
+    try {
+      const answer = await next(e);
+      if ('drop' in answer) cache.remove(entry);
+      return answer;
+    } catch (error) { cache.remove(entry); throw error; }
+  }).catch(() => ({ drop: REFUSAL }));
+  on('turn.start', async ($, e, next) => {
+    if (!ready) throw new Error(REFUSAL);
+    const now = await $.clock.now();
+    const pending = cache.pending();
+    if (!pending) throw new Error(REFUSAL);
+    if (pending?.text === e.text) cache.bind(e, now);
+    else {
+      // Settings hooks may settle a different prompt. Reassess with the original class floor.
+      const minimumClass = pending?.decision.taskClass;
+      const text = classificationText(e.text, pending ? [{}] : undefined);
+      const result = await $.process.run([runtime.nodePath, runtime.helperPath, '--decision'], {
+        stdin: JSON.stringify({ prompt: text, minimumClass, enginePath: runtime.enginePath, policyPath: runtime.policyPath }), timeoutMs: 8000,
+      });
+      if (result.exitCode !== 0) throw new Error(REFUSAL);
+      const decision = inspectDecision(JSON.parse(result.stdout), text, now, minimumClass);
+      cache.bind(e, now, decision);
+    }
+    return next(e);
+  }).catch(($, e) => ({ turnId: e.turnId }));
+  on('turn.step', async function* ($, e, next) {
+    if (!ready) return yield* refusalStream(e);
+    const decision = cache.get(e, await $.clock.now());
+    return yield* next({ ...e, model: decision.model, effort: decision.effort });
+  }).catch(async function* ($, e) { return yield* refusalStream(e); });
+  on('turn.complete', async ($, e, next) => { cache.complete(e.turnId); return next(e); })
+    .catch(($, e) => { cache.complete(e.turnId); return { text: REFUSAL }; });
+  on('session.end', async ($, e, next) => { ready = false; cache.clear(); return next(e); })
+    .catch(($, e) => { ready = false; cache.clear(); return { sessionId: e.sessionId }; });
+}

package/config/model-router/claude-terminal-mod/hooks/routing.js

@@ -0,0 +1,55 @@
+import { classify } from './policy.default.mjs';
+export const REFUSAL = 'Reviewed terminal routing unavailable; request refused without model fallback.';
+export function refusal(e) {
+  return { turnId: e.turnId, index: e.index, answer: REFUSAL, toolUses: [], stopReason: 'refusal', usage: null };
+}
+export async function* refusalStream(e) {
+  yield { kind: 'text', index: 0, text: REFUSAL };
+  yield { kind: 'stop', stopReason: 'refusal', usage: null };
+  return refusal(e);
+}
+export function classificationText(text, attachments) {
+  return text.trim() ? text : attachments?.length ? 'final substantive review of supplied attachments' : text;
+}
+export function inspectDecision(value, text, now, minimumClass) {
+  if (value?.schemaVersion !== 1 || value.subscriptionCovered !== true ||
+      !/^claude-[a-z0-9][a-z0-9.-]*$/.test(value.model || '') ||
+      !['low', 'medium', 'high', 'xhigh', 'max'].includes(value.effort) ||
+      !Number.isFinite(value.expiresAt) ||
+      !/^[a-f0-9]{64}$/.test(value.routeDigest || '')) throw new Error(REFUSAL);
+  text = minimumClass === 'hard' ? 'final substantive review\n' + text : minimumClass === 'medium' ? 'review task\n' + text : text;
+  const codeFences = Math.floor((text.match(/```/g) || []).length / 2);
+  const hasCode = codeFences > 0 || /\b(function|const|let|def|class|import|=>|SELECT|async)\b/.test(text) || /[{};]\s*$/m.test(text);
+  const rank = { fast: 0, medium: 1, hard: 2 };
+  const floor = classify({ taskHints: text, hasCode }, 'claude-code');
+  if (!Object.hasOwn(rank, value.taskClass) || rank[value.taskClass] < rank[floor]) throw new Error(REFUSAL);
+  return Object.freeze({ model: value.model, effort: value.effort, taskClass: value.taskClass, expiresAt: value.expiresAt });
+}
+// Prompt text exists only in this bounded in-memory queue; Claude mints turnId later.
+export function createTurnCache() {
+  const pending = [];
+  const active = new Map();
+  return {
+    enqueue(text, decision, now) {
+      while (pending.length && now - pending[0].createdAt > 300000) pending.shift();
+      if (pending.length >= 32) throw new Error(REFUSAL);
+      const entry = { text, decision, createdAt: now }; pending.push(entry); return entry;
+    },
+    remove(entry) { const index = pending.indexOf(entry); if (index >= 0) pending.splice(index, 1); },
+    pending() { return pending[0]; },
+    bind(e, now, replacement) {
+      // Never substitute the most recent prompt or the model shown in the TUI.
+      const entry = pending[0];
+      if ((!entry && !replacement) || (!replacement && entry.text !== e.text) || (entry && now - entry.createdAt > 300000) ||
+          active.has(e.turnId) || active.size >= 32) throw new Error(REFUSAL);
+      if (entry) pending.shift(); active.set(e.turnId, replacement || entry.decision);
+    },
+    get(e, now) {
+      const decision = active.get(e.turnId);
+      if (!decision || e.agentId || !Number.isSafeInteger(e.index) || e.index < 0) throw new Error(REFUSAL);
+      return decision;
+    },
+    complete(turnId) { active.delete(turnId); },
+    clear() { pending.length = 0; active.clear(); },
+  };
+}

package/config/model-router/claude-terminal-mod/hooks/runtime.js

@@ -0,0 +1,2 @@
+// This source directory refuses activation until prepareClaudeTerminalMod generates real paths.
+export default { nodePath: 'node', helperPath: '/unprepared-rnb-terminal-mod/helper.mjs', enginePath: '', policyPath: '' };

package/config/model-router/claude-terminal-mod/tests/native.test.ts

@@ -0,0 +1,86 @@
+import type { On, HookStream, TurnStepChunk, TurnStepResult } from 'claude-code';
+import { expect, test } from 'claude-code/testing';
+const nonce = 'a'.repeat(64);
+const digest = 'b'.repeat(64);
+const now = 1791120000000;
+function stubs(on: On, decisions: Record<string, unknown>[], captures: Record<string, unknown>[], fail = false) {
+  on('clock.now', () => ({ value: now }));
+  on('env.get', ($, e) => ({ value: e.name === 'RNB_CLAUDE_MOD_NONCE' ? nonce : '/tmp/receipt.json' }));
+  on('session.version', () => ({ value: { version: '2.1.289' } }));
+  on('session.id', () => ({ value: 'native-fixture-session' }));
+  on('process.run', ($, e) => {
+    if (e.argv.includes('--ready')) return { value: { exitCode: 0, stdout: JSON.stringify({nonce,status:'ready'}), stderr:'',isStdoutTruncated:false,isStderrTruncated:false } };
+    captures.push(JSON.parse(e.init!.stdin!));
+    const decision = decisions.shift();
+    if (fail) throw new Error('helper failed');
+    return { value: {exitCode:0, stdout:JSON.stringify({schemaVersion:1,subscriptionCovered:true,expiresAt:now+60000,routeDigest:digest,...decision}),stderr:'',isStdoutTruncated:false,isStderrTruncated:false} };
+  });
+  on('session.start', ($, e) => ({cwd:e.cwd}));
+  on('prompt.submit', ($, e) => { if(e.attachments) captures.push({passedAttachments:e.attachments});return {text:e.text}; });
+  on('turn.start', ($, e) => ({turnId:e.turnId}));
+  on('turn.step', async function* ($, e) {
+    captures.push({model:e.model,effort:e.effort,turnId:e.turnId,index:e.index});
+    yield {kind:'text',index:0,text:'native stream preserved'};
+    return {turnId:e.turnId,index:e.index,answer:'native stream preserved',toolUses:[],stopReason:'end_turn',usage:null};
+  });
+}
+async function resultOf(stream: HookStream<TurnStepChunk, TurnStepResult>) { let result; for (;;) {const item=await stream.next();if(item.done){result=item.value;break;}} return result; }
+test('two user turns route different models and efforts while streaming native results', async ($, on) => {
+  const captures: Record<string, unknown>[]=[];
+  stubs(on,[{model:'claude-sonnet-fixture',effort:'low',taskClass:'fast'},{model:'claude-opus-fixture',effort:'high',taskClass:'hard'}],captures);
+  await $.session.start({cwd:'/tmp',surface:'terminal',isInteractive:true});
+  for (const [turnId,text] of [['one','summarize these supplied notes'],['two','perform a security audit and prove correctness']] as const) {
+    await $.prompt.submit({text});
+    await $.turn.start({text,turnId});
+    const result=await resultOf($.turn.step({turnId,index:0,model:'wrong-default',effort:'medium',messageCount:1}));
+    expect(result.answer).toBe('native stream preserved');
+  }
+  expect(captures.filter(x=>x.turnId)).toEqual([
+    {model:'claude-sonnet-fixture',effort:'low',turnId:'one',index:0},
+    {model:'claude-opus-fixture',effort:'high',turnId:'two',index:0},
+  ]);
+});
+test('unbound model step refuses without passing to core', async ($, on) => {
+  const captures: Record<string, unknown>[]=[];stubs(on,[],captures);
+  await $.session.start({cwd:'/tmp',surface:'terminal',isInteractive:true});
+  const result=await resultOf($.turn.step({turnId:'missing',index:7,model:'wrong',messageCount:1}));
+  expect(result.stopReason).toBe('refusal');expect(result.turnId).toBe('missing');expect(result.index).toBe(7);
+  expect(captures.length).toBe(0);
+});
+test('helper exception drops prompt through immediate catch', async ($, on) => {
+  const captures: Record<string, unknown>[]=[];stubs(on,[],captures,true);
+  await $.session.start({cwd:'/tmp',surface:'terminal',isInteractive:true});
+  expect('drop' in await $.prompt.submit({text:'summarize notes'})).toBe(true);
+});
+test('coding uses high effort and final hook rewrite keeps original hard floor', async ($, on) => {
+  const captures: Record<string, unknown>[]=[];
+  stubs(on,[{model:'claude-sonnet-fixture',effort:'high',taskClass:'medium'},
+    {model:'claude-opus-fixture',effort:'high',taskClass:'hard'},
+    {model:'claude-opus-fixture',effort:'high',taskClass:'hard'}],captures);
+  await $.session.start({cwd:'/tmp',surface:'terminal',isInteractive:true});
+  await $.prompt.submit({text:'implement this module'});await $.turn.start({text:'implement this module',turnId:'code'});
+  await resultOf($.turn.step({turnId:'code',index:1,model:'wrong',messageCount:2}));
+  await $.prompt.submit({text:'security audit'});await $.turn.start({text:'summarize notes',turnId:'changed'});
+  await resultOf($.turn.step({turnId:'changed',index:0,model:'wrong',messageCount:2}));
+  expect(captures.some(x=>x.minimumClass==='hard')).toBe(true);
+  expect(captures.filter(x=>x.turnId).map(x=>x.effort)).toEqual(['high','high']);
+});
+
+test('invalid or non-subscription bridge replies drop before prompt reaches core', async ($, on) => {
+  const captures: Record<string, unknown>[]=[];
+  stubs(on,[{model:'claude-sonnet-fixture',effort:'low',taskClass:'fast',subscriptionCovered:false},
+    {model:'claude-sonnet-fixture',effort:'low',taskClass:'fast',routeDigest:'invalid'}],captures);
+  await $.session.start({cwd:'/tmp',surface:'terminal',isInteractive:true});
+  expect('drop' in await $.prompt.submit({text:'summarize notes'})).toBe(true);
+  expect('drop' in await $.prompt.submit({text:'summarize notes'})).toBe(true);
+});
+test('image-only user prompt retains attachments and binds a conservative hard allocation', async ($, on) => {
+  const captures: Record<string, unknown>[]=[];
+  stubs(on,[{model:'claude-opus-fixture',effort:'high',taskClass:'hard'}],captures);
+  await $.session.start({cwd:'/tmp',surface:'terminal',isInteractive:true});
+  await $.prompt.submit({text:'',attachments:[{type:'image',mediaType:'image/png',filename:'fixture.png'}]});
+  await $.turn.start({text:'',turnId:'image'});
+  await resultOf($.turn.step({turnId:'image',index:0,model:'wrong',messageCount:1}));
+  expect(captures.find(x=>x.passedAttachments)?.passedAttachments).toEqual([{type:'image',mediaType:'image/png',filename:'fixture.png'}]);
+  expect(captures.filter(x=>x.turnId)[0]?.model).toBe('claude-opus-fixture');
+});

package/config/model-router/policy.default.mjs

@@ -57,10 +57,13 @@ export function classify(features, harness = features.harness || 'codex') {
   const text = String(features.taskHints || '');
   const coding = features.hasCode || CODING.test(text);
   const assessedText = assessmentText(text);
+  const securityActions = assessedText.replace(/\bdo not (?:assess|recommend)[^.;\n]*/gi, '');
+  const securityReview = /\b(security|risks?)\b/i.test(securityActions) &&
+    /\b(review|assess(?:ment)?|audit|evaluat\w*|analy[sz]\w*|identify|determine)\b/i.test(securityActions);
   const consequential = /\b(consequential planning|substantive planning|substantive review|final substantive review|plan (?:a |the )?new system|design (?:a |the )?new architecture|ambiguous architecture|architecture ambiguity|architectur\w* tradeoff|tightly coupled uncertain implementation|uncertain tightly coupled implementation)\b/i.test(text);
   const architectureAmbiguity = /architectur\w*/i.test(text) && /\b(ambiguous|ambiguity|unresolved|uncertain|trade[- ]?off)\b/i.test(text);
   const coupledUncertainty = /tightly coupled/i.test(text) && /implementation|coding/i.test(text) && /uncertain|unresolved|ambiguous/i.test(text);
-  const hardText = HARD.test(assessedText) || consequenceFloor(assessedText) || consequential || architectureAmbiguity || coupledUncertainty;
+  const hardText = HARD.test(assessedText) || securityReview || consequenceFloor(assessedText) || consequential || architectureAmbiguity || coupledUncertainty;
   const substantialText = /\b(substantial (?:implementation|coding|feature|task)|cross-module (?:implementation|feature|refactor)|multi-file (?:implementation|feature|refactor)|end-to-end implementation|broad refactor)\b/i.test(text);
   const facts = validateTaskFacts(features.taskFacts);
   // Partial caller metadata supplements the assessment; it cannot lower explicit high-consequence text.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.5.5",
-  "description": "One-command installer for RuvNet Brain \u2014 a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
+  "version": "4.5.6",
+  "description": "One-command installer for RuvNet Brain — a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {
     "ruvnet-brain": "bin/install.mjs"
@@ -146,6 +146,7 @@
   },
   "dependencies": {
     "@metaharness/flywheel": "^0.1.7",
-    "@metaharness/router": "^0.4.0"
+    "@metaharness/router": "^0.4.0",
+    "ws": "^8.22.0"
   }
 }

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships a UserPromptSubmit retrieve-and-inject grounding hook and a PreToolUse write gate that refuses ungrounded rUv-product code until search_ruvnet has been consulted (ADR-0012 / ADR-067).",
-  "version": "4.5.5",
+  "version": "4.5.6",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.5.5",
+  "version": "4.5.6",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/mcp/managed-cli-interface.mjs

@@ -253,9 +253,10 @@ export function normalizeManagedExecution(execution) {
   const output = [execution?.stdout, execution?.stderr].filter(Boolean)
     .join(execution?.stdout && execution?.stderr ? '\n' : '');
   const contradictoryFailure = /(?:^|\n)\s*(?:❌|\[ERROR\])|invalid pragma command|key not found/i.test(output);
+  if (execution?.error) return { outcome: 'failure', output, contradictoryFailure };
   if (execution?.signal) return { outcome: 'interrupted', output, signal: execution.signal, contradictoryFailure };
-  if (execution?.error || contradictoryFailure || execution?.code === null || execution?.code === undefined) {
-    return { outcome: execution?.error || contradictoryFailure ? 'failure' : 'unknown', output, contradictoryFailure };
+  if (contradictoryFailure || execution?.code === null || execution?.code === undefined) {
+    return { outcome: contradictoryFailure ? 'failure' : 'unknown', output, contradictoryFailure };
   }
   return { outcome: execution.code === 0 ? 'success' : 'failure', output, contradictoryFailure };
 }
@@ -296,15 +297,19 @@ function managedProgressionCapture({ executable, argv, projectRoot, env, event,
 function resultOf(executable, argv, result) {
   const output = [result.stdout, result.stderr].filter(Boolean).join(result.stdout && result.stderr ? '\n' : '');
   const normalized = normalizeManagedExecution(result);
+  const terminal = { outcome: normalized.outcome, code: result.code ?? null, signal: result.signal ?? null,
+    error: result.error ?? null, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
   if (normalized.outcome !== 'success') {
-    const reason = result.error || (normalized.contradictoryFailure ? 'fatal output despite exit 0' : result.code == null ? 'no terminal exit status' : `exit ${result.code}`);
+    const reason = result.error || (result.signal ? `signal ${result.signal}` : result.code != null && result.code !== 0 ? `exit ${result.code}` : normalized.contradictoryFailure ? 'fatal output without successful completion' : 'no terminal exit status');
     return {
-      content: [{ type: 'text', text: output || `${executable} ${argv.join(' ')} failed: ${reason}` }],
+      content: [{ type: 'text', text: [output, `${executable} ${argv.join(' ')} failed: ${reason}`].filter(Boolean).join('\n') }],
+      structuredContent: terminal,
       isError: true,
     };
   }
   return {
     content: [{ type: 'text', text: output || `${executable} ${argv.join(' ')} completed successfully` }],
+    structuredContent: terminal,
     isError: false,
   };
 }

package/plugin/scripts/capability-claim-evidence.mjs

@@ -3,6 +3,7 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { redactText } from './continuity-events.mjs';
 
 const HEX40 = /^[a-f0-9]{40}$/;
 const HEX64 = /^[a-f0-9]{64}$/;
@@ -157,7 +158,13 @@ export function recordManagedCliObservation({ toolName, executable, argv, execut
   observedAt = new Date().toISOString() } = {}) {
   try {
     const output = [execution?.stdout, execution?.stderr].filter(Boolean).join('\n');
-    const reachable = execution?.code === 0 && !execution?.error;
+    const contradictoryFailure = /(?:^|\n)\s*(?:❌|\[ERROR\])|invalid pragma command|key not found/i.test(output);
+    const reachable = execution?.code === 0 && !execution?.error && !execution?.signal && !contradictoryFailure;
+    const outcome = execution?.error ? 'failure' : execution?.signal ? 'interrupted' : contradictoryFailure ? 'failure'
+      : Number.isSafeInteger(execution?.code) ? execution.code === 0 ? 'success' : 'failure' : 'unknown';
+    const terminal = { outcome, exitCode: Number.isSafeInteger(execution?.code) ? execution.code : null,
+      error: typeof execution?.error === 'string' ? redactText(execution.error).slice(0, 4096) : null,
+      signal: typeof execution?.signal === 'string' ? redactText(execution.signal).slice(0, 100) : null };
     const version = VERSION.exec(output)?.[1] || null;
     let observationClass = null;
     let fields = {};
@@ -169,7 +176,7 @@ export function recordManagedCliObservation({ toolName, executable, argv, execut
       observationClass = 'health';
       const negative = /\b(?:critical|degraded|error|failed|failure|unhealthy)\b/i.test(output);
       const positive = /\b(?:all checks passed|healthy|overall\s*[:=-]?\s*(?:ok|pass)|status\s*[:=-]\s*(?:ok|pass|healthy))\b/i.test(output);
-      fields = { healthVerdict: negative ? 'FAIL' : reachable && positive ? 'PASS' : 'UNKNOWN', reachable };
+      fields = { healthVerdict: negative || ['failure', 'interrupted'].includes(outcome) ? 'FAIL' : reachable && positive ? 'PASS' : 'UNKNOWN', reachable, terminal };
     }
     if (!observationClass) return null;
     const payload = {

package/plugin/scripts/project-capture-queue.mjs

@@ -6,6 +6,7 @@ import { spawn, spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { developmentHooksSuspended } from './development-maintenance.mjs';
 import { resolveTurnDb } from './turn-outcome-capture.mjs';
+import { enrichStateWithObservation } from './project-progression-hook.mjs';
 import { buildProjectProgression } from './project-progression-producer.mjs';
 import { resolveProjectStore } from './project-store-resolver.mjs';
 import { redactProgression } from './project-progression-contract.mjs';
@@ -57,6 +58,10 @@ export function queueCapture({ projectDir, originProjectDir = projectDir, event,
   if (!progression && !payload?.normalizedTransition) {
     try { progression = buildProjectProgression({ resolution: resolveProjectStore({ projectDir: originProjectDir }), projectDir: originProjectDir, payload, host, trigger: event }).projectProgression; } catch { return null; }
   }
+  // Freeze the bounded native observation before discarding raw host input. Replay receives no
+  // tool fields, so the native writer cannot append it twice.
+  if (progression && (payload?.tool_name || payload?.tool_input)) progression = { ...progression,
+    completeProjectState: enrichStateWithObservation(progression.completeProjectState, { ...payload, hook_event_name: event }) };
   // This queue is durable: never serialize arbitrary host prompts, tool input or output.
   const minimized = { session_id: payload?.session_id, hook_event_name: event,
     ...(progression ? { projectProgression: progression } : {}),
@@ -273,7 +278,8 @@ export function runOutboxReplay({ projectDir, token = process.env.RUVNET_REPLAY_
       for (const snapshot of store.outbox.pendingSnapshots()) {
         if (now() >= deadlineAt) return replayed;
         if (!refreshReplayLock(projectDir, held)) return replayed;
-        store.outbox.markCommitted(store.appendExact(snapshot));
+        store.captureFrozen(snapshot, { canCommit: () => refreshReplayLock(projectDir, held) });
+        // captureFrozen commits only the verified key, retaining conflicting original history.
         replayed += 1;
       }
       for (const file of queuedCaptures(projectDir)) {

package/plugin/scripts/project-progression-hook.mjs

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createProgressionSnapshot } from './project-progression-contract.mjs';
 import { ProjectProgressionStore } from './project-progression-store.mjs';
+import { redactText } from './continuity-events.mjs';
 
 const HOSTS = new Set(['claude', 'codex']);
 const CAPTURE_TRIGGERS = new Set([
@@ -105,15 +106,17 @@ function toolAction(payload) {
   const exitCode = Number.isSafeInteger(explicitCode)
     ? explicitCode
     : textualCode ? Number(textualCode[1]) : undefined;
-  const interrupted = responseRecord?.interrupted === true || responseRecord?.signal === 'SIGINT';
+  const error = boundedText(typeof responseRecord?.error === 'string' ? redactText(responseRecord.error) : undefined);
+  const signal = boundedText(typeof responseRecord?.signal === 'string' ? redactText(responseRecord.signal) : undefined);
+  const interrupted = responseRecord?.interrupted === true || Boolean(signal);
   const explicitError = responseRecord?.isError === true || payload.is_error === true;
   const declaredOutcome = ['success', 'failure', 'interrupted', 'unknown'].includes(responseRecord?.outcome)
     ? responseRecord.outcome : null;
-  const failed = explicitError || (Number.isSafeInteger(exitCode) && exitCode !== 0);
+  const failed = explicitError || Boolean(error) || (Number.isSafeInteger(exitCode) && exitCode !== 0);
   const terminal = failed || Number.isSafeInteger(exitCode)
     || responseRecord?.success === true || responseRecord?.ok === true;
   const outcome = payload.hook_event_name === 'PostToolUse'
-    ? (interrupted ? 'interrupted' : failed ? 'failure' : declaredOutcome || (terminal ? 'success' : 'unknown'))
+    ? (error ? 'failure' : interrupted ? 'interrupted' : failed ? 'failure' : declaredOutcome || (terminal ? 'success' : 'unknown'))
     : 'pending';
   const observation = {
     trigger: payload.hook_event_name,
@@ -121,7 +124,9 @@ function toolAction(payload) {
     ...(command ? { command } : {}),
     ...(filePath && !command ? { filePath } : {}),
     outcome,
-    ...(Number.isSafeInteger(exitCode) ? { exitCode } : {}),
+    ...(Number.isSafeInteger(exitCode) ? { exitCode } : responseRecord?.exit_code === null || responseRecord?.exitCode === null ? { exitCode: null } : {}),
+    ...(error ? { error } : {}),
+    ...(signal ? { signal } : {}),
     ...(interrupted ? { interrupted: true } : {}),
     ...(explicitError ? { isError: true } : {}),
   };
@@ -137,7 +142,7 @@ function toolAction(payload) {
   return observation;
 }
 
-function enrichStateWithObservation(state, payload) {
+export function enrichStateWithObservation(state, payload) {
   requireRecord(state, 'completeProjectState');
   const observation = toolAction(payload);
   if (!observation) return state;
@@ -164,6 +169,8 @@ export function captureProjectTransition({
   payload,
   projectDir,
   adapterVersion = readProgressionAdapterVersion(),
+  recoverFrozen = false,
+  canCommit,
   storeFactory = (options) => new ProjectProgressionStore(options),
 } = {}) {
   const normalizedHost = requireString(host, 'host').toLowerCase();
@@ -191,7 +198,7 @@ export function captureProjectTransition({
     aliased(progression, 'sourceIdentity', 'source_identity'),
     store.resolution.checkoutRoot, projectDir,
   );
-  const snapshot = createProgressionSnapshot({
+  let snapshot = createProgressionSnapshot({
     projectIdentity: store.resolution.projectIdentity,
     sourceIdentity,
     hostIdentity: { host: normalizedHost, adapterVersion },
@@ -206,7 +213,9 @@ export function captureProjectTransition({
       payload,
     ),
   });
-  const receipt = store.capture(snapshot);
+  let receipt;
+  if (recoverFrozen) ({ snapshot, receipt } = store.captureFrozen(snapshot, { canCommit }));
+  else receipt = store.capture(snapshot);
   verifyReceipt(snapshot, receipt);
   return { snapshot, receipt };
 }