ruvnet-brain 4.5.5 → 4.5.7

package/README.md

@@ -7,7 +7,7 @@ Created: 2026-06-29 22:36:38 EDT
 
 # 🧠 RuvNet Brain
 
-### 🧠 RuvNet Brain — [![RuvNet Brain version 4.5.5 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.5.5-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
+### 🧠 RuvNet Brain — [![RuvNet Brain version 4.5.7 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.5.7-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
 
 **A portable, source-grounded brain over Reuven Cohen's (rUv's) RuvNet stack — delivered as a Claude Code plugin that makes Claude _use_ the stack instead of fighting it.**
 

package/bin/install.mjs

@@ -80,7 +80,8 @@ import {
 import { shellDiff as pluginShellDiff } from '../plugin/scripts/host-shell-boundary.mjs';
 import { codexTrustChanges, CODEX_TRUST_ACTION } from '../scripts/codex-hook-trust.mjs';
 import { repairSecurityGuidance } from '../scripts/security-guidance-codex-compat.mjs';
-import { installNativeLaunchers } from '../scripts/model-routing-launchers.mjs';
+import { installNativeLaunchers, installRoutingRuntime } from '../scripts/model-routing-launchers.mjs';
+import { installTerminalLaunchers } from '../scripts/model-terminal-launchers.mjs';
 import { readConsoleReceipts, replaceStaleConsoles } from '../scripts/console-instances.mjs';
 import { moveBrain, MoveRefused } from '../scripts/move-brain.mjs';
 import { brainLocation } from '../plugin/scripts/brain-location.mjs';
@@ -1631,6 +1632,7 @@ function codexManagedBlock(serverPath) {
     'command = "node"',
     `args = [${JSON.stringify(serverPath)}]`,
     'startup_timeout_sec = 30',
+    'env = { RUVNET_HOOK_HOST = "codex" }',
     CODEX_BLOCK_END,
   ].join('\n');
 }
@@ -1837,6 +1839,10 @@ export function wireCodexHost({
   // land where the server will look for them, and the walk is transitive because a dependency's own
   // dependency is no less required.
   const deps = serverDependencies(source);
+  // Progression capture reads its adapter version from this runtime resource, not an import.
+  // Keep it beside the copied plugin scripts, bound to the same source as the MCP shell.
+  deps.push({ spec: '../.claude-plugin/plugin.json',
+    from: path.resolve(path.dirname(source), '..', '.claude-plugin', 'plugin.json') });
   const missing = deps.filter((d) => !fs.existsSync(d.from));
   if (missing.length) {
     if (announce) warn(`MCP server dependency missing from this bundle (${missing.map((d) => d.spec).join(', ')}) — Codex left untouched (non-fatal)`);
@@ -4913,18 +4919,28 @@ export function syncManagedRouterDefault({ routerDir = path.join(os.homedir(), '
 }
 
 export function refreshInstalledModelLaunchers({ sourceRoot = REPO_ROOT, home = os.homedir() } = {}) {
+  const terminalFile = path.join(home, '.cache', 'ruvnet-brain', 'model-routing', 'terminal-launcher-config.json');
+  let terminal = { action: 'not-installed' };
+  if (fs.existsSync(terminalFile)) {
+    const previous = JSON.parse(fs.readFileSync(terminalFile, 'utf8'));
+    const runtime = installRoutingRuntime({ sourceRoot, home, apply: true });
+    const receipt = installTerminalLaunchers({ home, ...runtime, nodeBinary: previous.nodeBinary,
+      realCodex: previous.realCodex, realClaude: previous.realClaude, apply: true });
+    terminal = { action: previous.runtimeDigest === runtime.runtimeDigest ? 'unchanged' : 'updated',
+      runtimeDigest: runtime.runtimeDigest, shellConflicts: receipt.shellConflicts };
+  }
   const file = path.join(home, '.cache', 'ruvnet-brain', 'model-routing', 'launcher-config.json');
-  if (!fs.existsSync(file)) return { action: 'not-installed' };
+  if (!fs.existsSync(file)) return { action: 'not-installed', terminal };
   const previous = JSON.parse(fs.readFileSync(file, 'utf8'));
   const receipt = installNativeLaunchers({ sourceRoot, home, extensionsRoot: previous.extensionsRoot, nodeBinary: previous.nodeBinary, apply: true });
-  return { action: receipt.config.runtimeDigest === previous.runtimeDigest ? 'unchanged' : 'updated', runtimeDigest: receipt.config.runtimeDigest };
+  return { action: receipt.config.runtimeDigest === previous.runtimeDigest ? 'unchanged' : 'updated', runtimeDigest: receipt.config.runtimeDigest, terminal };
 }
 
 export function syncManagedRouterTools({ routerDir = path.join(os.homedir(), '.claude', 'model-router'), packageRoot = REPO_ROOT } = {}) {
   const destination = path.join(routerDir, 'bin');
   fs.mkdirSync(destination, { recursive: true });
   let copied = 0;
-  for (const name of ['model-router-engine.mjs', 'model-router-setup.mjs', 'model-router-status.mjs', 'model-router-outcome.mjs', 'subscription-hosts.mjs', 'review-model-defaults.mjs', 'dual-host-deliberation.mjs', 'dual-host-suggest.mjs', 'route-cheap.mjs', 'dispatch-receipt.mjs', 'metaharness-receipts.mjs', 'metaharness-router.mjs', 'model-router-dispatch.mjs', 'model-currency.mjs', 'model-currency-evidence.mjs', 'user-model-prompt-hook.mjs', 'model-router-agent-hook.mjs', 'model-weekly-assessment.mjs', 'model-weekly-analyst.mjs', 'model-weekly-cycle.mjs', 'model-weekly-qualification.mjs', 'model-native-qualification.mjs', 'model-routing-launchers.mjs', 'model-native-catalog.mjs', 'model-analyst-sandbox.mjs', 'model-routing-policy-promotion.mjs', 'model-routing-gateway.mjs', 'native-subscription-usage.mjs', 'codex-routed.sh', 'goldie-weekly.sh']) {
+  for (const name of ['model-router-engine.mjs', 'model-router-setup.mjs', 'model-router-status.mjs', 'model-router-outcome.mjs', 'subscription-hosts.mjs', 'review-model-defaults.mjs', 'dual-host-deliberation.mjs', 'dual-host-suggest.mjs', 'route-cheap.mjs', 'dispatch-receipt.mjs', 'metaharness-receipts.mjs', 'metaharness-router.mjs', 'model-router-dispatch.mjs', 'model-currency.mjs', 'model-currency-evidence.mjs', 'user-model-prompt-hook.mjs', 'model-router-agent-hook.mjs', 'model-weekly-assessment.mjs', 'model-weekly-analyst.mjs', 'model-weekly-cycle.mjs', 'model-weekly-qualification.mjs', 'model-native-qualification.mjs', 'model-routing-launchers.mjs', 'model-terminal-gateway.mjs', 'model-terminal-launchers.mjs', 'claude-terminal-mod.mjs', 'model-native-catalog.mjs', 'model-analyst-sandbox.mjs', 'model-routing-policy-promotion.mjs', 'model-routing-gateway.mjs', 'native-subscription-usage.mjs', 'codex-routed.sh', 'goldie-weekly.sh']) {
     const source = path.join(packageRoot, 'scripts', name);
     if (!fs.existsSync(source)) throw new Error(`Packaged router tool missing: ${name}`);
     const target = path.join(destination, name);
@@ -4935,8 +4951,9 @@ export function syncManagedRouterTools({ routerDir = path.join(os.homedir(), '.c
     finally { fs.rmSync(temporary, { force: true }); }
     copied++;
   }
-  // Preserve the package-relative import used by the optional legacy routing helper.
-  const runtimeRelative = path.join('plugin', 'scripts', 'runtime-preferences.mjs');
+  // Preserve package-relative imports without replacing user policy.mjs overrides.
+  for (const runtimeRelative of [path.join('plugin', 'scripts', 'runtime-preferences.mjs'),
+    path.join('config', 'model-router', 'policy.default.mjs')]) {
   const runtimeTarget = path.join(routerDir, runtimeRelative);
   const runtimeBytes = fs.readFileSync(path.join(packageRoot, runtimeRelative));
   if (!fs.existsSync(runtimeTarget) || !fs.readFileSync(runtimeTarget).equals(runtimeBytes)) {
@@ -4946,6 +4963,7 @@ export function syncManagedRouterTools({ routerDir = path.join(os.homedir(), '.c
     finally { fs.rmSync(temporary, { force: true }); }
     copied++;
   }
+  }
   const qualificationSource = path.join(packageRoot, 'config', 'model-router', 'qualification-contract.json');
   const qualificationTarget = path.join(routerDir, 'qualification-contract.json');
   const qualificationBytes = fs.readFileSync(qualificationSource);

package/config/model-router/claude-terminal-mod/.claude-plugin/plugin.json

@@ -0,0 +1 @@
+{"name":"rnb-terminal-routing","version":"0.1.0","description":"Reviewed per-user native terminal routing"}

package/config/model-router/claude-terminal-mod/README.md

@@ -0,0 +1,22 @@
+Updated: 2026-10-04 16:10:00 EDT | Version 0.1.1
+Created: 2026-10-04 16:10:00 EDT
+
+# Native terminal routing prototype
+
+Tested against the installed Claude Code 2.1.289 native binary and its generated mod declarations. Mods require 2.1.287 or later. This routes the native host's own `turn.step` middleware: it passes model and effort to `yield* next(...)`, preserving the native streaming result and TUI. It does not call a separate inference API or inject slash commands.
+
+`prepareClaudeTerminalMod({ destination })` in `scripts/claude-terminal-mod.mjs` materializes a private plugin directory, generates absolute Node/helper/engine paths, and copies the approved pure classifier into the mod. The source directory is deliberately unprepared. No Node APIs run inside sandboxed mod code. `$.process.run` invokes the bridge with prompt JSON on stdin, never in arguments. The existing policy engine validates current per-user catalog, profile, reviewed model/effort allocation and subscription eligibility. Review age remains evidence for the weekly refresh and does not revoke the owner-approved allocation; it supplies no native/default/metered fallback.
+
+A launcher must provide `RNB_CLAUDE_MOD_NONCE` (64 lowercase hexadecimal characters) and `RNB_CLAUDE_MOD_RECEIPT` (absolute receipt filename in an already prepared private directory). `session.start` calls the bridge to write an atomic, mode-0600 activation receipt. The launcher must compare nonce, exact real plugin root, native version, source digest, timestamp and live process state before accepting startup. `prepareClaudeTerminalMod` returns `modDigest`; `terminalModDigest` recomputes it. The receipt's `pid` is the bridge parent's mod worker, not an asserted main CLI PID. `--health` supports the same bounded receipt schema; it does not invent a native crash guard.
+
+`prompt.submit` approves the prompt once. Its optional `turnId` denotes a running turn, not the upcoming idle turn. A bounded FIFO stores pending text and decisions in RAM only. `turn.start` binds the next approved prompt to the newly minted exact turn ID. If native settings hooks settled different text, the bridge reclassifies that text using the original task class as a minimum. Image-only submissions use a conservative hard-review classification while passing original attachments and text unchanged. Every backend step keeps the bound model/effort and exact turn ID/index. Completion and session end remove decisions. Queue/active maps cap at 32 entries; pending prompts expire after five minutes. Direct mid-turn deliveries (a running `turnId` without `wait`) refuse because no new authoritative `turn.start` exists; queue the prompt to start its own turn. Subagent steps and unbound continuations refuse instead of borrowing the main turn's decision.
+
+A prompt/helper failure returns `{ drop }` without `next`. A step failure returns an immediate native refusal result without `next`, retaining turn ID/index. Every consequential hook has a `.catch` handler whose refusal does no process, filesystem or model work. Missing activation refuses subsequent prompts and steps.
+
+## Failure boundary
+
+Claude Code can skip all hooks if the mod fails to load, the native mod worker crashes, hooks are disabled, another guard refuses registration, or a hook and its catch handler both fail. Other mods later in the chain can rewrite model/effort. A startup receipt proves that the activation hook ran for that nonce and source digest; it is not a perpetual guarantee that routing hooks remain active. This prototype cannot claim universal fail-closed enforcement. The root CLI wrapper owns the startup guard and any further runtime monitoring. Native model inference and rendered TUI acceptance remain separate checks; plugin tests stub the engine boundary and incur no inference.
+
+## Checks
+
+Run `claude plugin validate config/model-router/claude-terminal-mod`, `claude plugin test config/model-router/claude-terminal-mod`, and `vitest run tests/unit/claude-terminal-mod.test.mjs`. The native tests exercise the installed mod runtime, including two different turn allocations, high coding effort, final-text class floors, missing decisions and helper exceptions. Unit tests call the actual policy engine against isolated catalog/profile/policy fixtures, including stale allocation, invalid policy, absent hard model and disabled subscription states.

package/config/model-router/claude-terminal-mod/hooks/hooks.json

@@ -0,0 +1 @@
+{"modules":["./register.js"]}

package/config/model-router/claude-terminal-mod/hooks/policy.default.mjs

@@ -0,0 +1,2 @@
+// Source-only adapter. Materialization copies the canonical classifier into the sandbox.
+export { classify } from '../../policy.default.mjs';

package/config/model-router/claude-terminal-mod/hooks/register.js

@@ -0,0 +1,66 @@
+import runtime from './runtime.js';
+import { createTurnCache, inspectDecision, classificationText, refusalStream, REFUSAL } from './routing.js';
+export function register(on) {
+  const cache = createTurnCache();
+  let ready = false;
+  on('session.start', async ($, e, next) => {
+    ready = false; cache.clear();
+    const nonce = await $.env.get('RNB_CLAUDE_MOD_NONCE');
+    const receiptPath = await $.env.get('RNB_CLAUDE_MOD_RECEIPT');
+    const version = (await $.session.version()).version;
+    const sessionId = await $.session.id();
+    const pluginRoot = $.plugin.root;
+    const result = await $.process.run([runtime.nodePath, runtime.helperPath, '--ready'], {
+      stdin: JSON.stringify({ nonce, receiptPath, version, sessionId, pluginRoot }), timeoutMs: 8000,
+    });
+    if (result.exitCode !== 0) throw new Error(REFUSAL);
+    const receipt = JSON.parse(result.stdout);
+    if (receipt.nonce !== nonce || receipt.status !== 'ready') throw new Error(REFUSAL);
+    ready = true; return next(e);
+  }).catch(($, e) => { ready = false; return { cwd: e.cwd }; });
+  on('prompt.submit', async ($, e, next) => {
+    // Direct delivery into a running turn has no authoritative new turn.start boundary.
+    if (e.turnId && !e.wait) return { drop: REFUSAL };
+    if (!ready || typeof e.text !== 'string' || (!e.text.trim() && !e.attachments?.length) || e.text.length > 200000) return { drop: REFUSAL };
+    const result = await $.process.run([runtime.nodePath, runtime.helperPath, '--decision'], {
+      stdin: JSON.stringify({ prompt: classificationText(e.text, e.attachments), enginePath: runtime.enginePath, policyPath: runtime.policyPath }), timeoutMs: 8000,
+    });
+    if (result.exitCode !== 0) return { drop: REFUSAL };
+    const now = await $.clock.now();
+    const decision = inspectDecision(JSON.parse(result.stdout), classificationText(e.text, e.attachments), now);
+    const entry = cache.enqueue(e.text, decision, now);
+    try {
+      const answer = await next(e);
+      if ('drop' in answer) cache.remove(entry);
+      return answer;
+    } catch (error) { cache.remove(entry); throw error; }
+  }).catch(() => ({ drop: REFUSAL }));
+  on('turn.start', async ($, e, next) => {
+    if (!ready) throw new Error(REFUSAL);
+    const now = await $.clock.now();
+    const pending = cache.pending();
+    if (!pending) throw new Error(REFUSAL);
+    if (pending?.text === e.text) cache.bind(e, now);
+    else {
+      // Settings hooks may settle a different prompt. Reassess with the original class floor.
+      const minimumClass = pending?.decision.taskClass;
+      const text = classificationText(e.text, pending ? [{}] : undefined);
+      const result = await $.process.run([runtime.nodePath, runtime.helperPath, '--decision'], {
+        stdin: JSON.stringify({ prompt: text, minimumClass, enginePath: runtime.enginePath, policyPath: runtime.policyPath }), timeoutMs: 8000,
+      });
+      if (result.exitCode !== 0) throw new Error(REFUSAL);
+      const decision = inspectDecision(JSON.parse(result.stdout), text, now, minimumClass);
+      cache.bind(e, now, decision);
+    }
+    return next(e);
+  }).catch(($, e) => ({ turnId: e.turnId }));
+  on('turn.step', async function* ($, e, next) {
+    if (!ready) return yield* refusalStream(e);
+    const decision = cache.get(e, await $.clock.now());
+    return yield* next({ ...e, model: decision.model, effort: decision.effort });
+  }).catch(async function* ($, e) { return yield* refusalStream(e); });
+  on('turn.complete', async ($, e, next) => { cache.complete(e.turnId); return next(e); })
+    .catch(($, e) => { cache.complete(e.turnId); return { text: REFUSAL }; });
+  on('session.end', async ($, e, next) => { ready = false; cache.clear(); return next(e); })
+    .catch(($, e) => { ready = false; cache.clear(); return { sessionId: e.sessionId }; });
+}

package/config/model-router/claude-terminal-mod/hooks/routing.js

@@ -0,0 +1,55 @@
+import { classify } from './policy.default.mjs';
+export const REFUSAL = 'Reviewed terminal routing unavailable; request refused without model fallback.';
+export function refusal(e) {
+  return { turnId: e.turnId, index: e.index, answer: REFUSAL, toolUses: [], stopReason: 'refusal', usage: null };
+}
+export async function* refusalStream(e) {
+  yield { kind: 'text', index: 0, text: REFUSAL };
+  yield { kind: 'stop', stopReason: 'refusal', usage: null };
+  return refusal(e);
+}
+export function classificationText(text, attachments) {
+  return text.trim() ? text : attachments?.length ? 'final substantive review of supplied attachments' : text;
+}
+export function inspectDecision(value, text, now, minimumClass) {
+  if (value?.schemaVersion !== 1 || value.subscriptionCovered !== true ||
+      !/^claude-[a-z0-9][a-z0-9.-]*$/.test(value.model || '') ||
+      !['low', 'medium', 'high', 'xhigh', 'max'].includes(value.effort) ||
+      !Number.isFinite(value.expiresAt) ||
+      !/^[a-f0-9]{64}$/.test(value.routeDigest || '')) throw new Error(REFUSAL);
+  text = minimumClass === 'hard' ? 'final substantive review\n' + text : minimumClass === 'medium' ? 'review task\n' + text : text;
+  const codeFences = Math.floor((text.match(/```/g) || []).length / 2);
+  const hasCode = codeFences > 0 || /\b(function|const|let|def|class|import|=>|SELECT|async)\b/.test(text) || /[{};]\s*$/m.test(text);
+  const rank = { fast: 0, medium: 1, hard: 2 };
+  const floor = classify({ taskHints: text, hasCode }, 'claude-code');
+  if (!Object.hasOwn(rank, value.taskClass) || rank[value.taskClass] < rank[floor]) throw new Error(REFUSAL);
+  return Object.freeze({ model: value.model, effort: value.effort, taskClass: value.taskClass, expiresAt: value.expiresAt });
+}
+// Prompt text exists only in this bounded in-memory queue; Claude mints turnId later.
+export function createTurnCache() {
+  const pending = [];
+  const active = new Map();
+  return {
+    enqueue(text, decision, now) {
+      while (pending.length && now - pending[0].createdAt > 300000) pending.shift();
+      if (pending.length >= 32) throw new Error(REFUSAL);
+      const entry = { text, decision, createdAt: now }; pending.push(entry); return entry;
+    },
+    remove(entry) { const index = pending.indexOf(entry); if (index >= 0) pending.splice(index, 1); },
+    pending() { return pending[0]; },
+    bind(e, now, replacement) {
+      // Never substitute the most recent prompt or the model shown in the TUI.
+      const entry = pending[0];
+      if ((!entry && !replacement) || (!replacement && entry.text !== e.text) || (entry && now - entry.createdAt > 300000) ||
+          active.has(e.turnId) || active.size >= 32) throw new Error(REFUSAL);
+      if (entry) pending.shift(); active.set(e.turnId, replacement || entry.decision);
+    },
+    get(e, now) {
+      const decision = active.get(e.turnId);
+      if (!decision || e.agentId || !Number.isSafeInteger(e.index) || e.index < 0) throw new Error(REFUSAL);
+      return decision;
+    },
+    complete(turnId) { active.delete(turnId); },
+    clear() { pending.length = 0; active.clear(); },
+  };
+}

package/config/model-router/claude-terminal-mod/hooks/runtime.js

@@ -0,0 +1,2 @@
+// This source directory refuses activation until prepareClaudeTerminalMod generates real paths.
+export default { nodePath: 'node', helperPath: '/unprepared-rnb-terminal-mod/helper.mjs', enginePath: '', policyPath: '' };

package/config/model-router/claude-terminal-mod/tests/native.test.ts

@@ -0,0 +1,86 @@
+import type { On, HookStream, TurnStepChunk, TurnStepResult } from 'claude-code';
+import { expect, test } from 'claude-code/testing';
+const nonce = 'a'.repeat(64);
+const digest = 'b'.repeat(64);
+const now = 1791120000000;
+function stubs(on: On, decisions: Record<string, unknown>[], captures: Record<string, unknown>[], fail = false) {
+  on('clock.now', () => ({ value: now }));
+  on('env.get', ($, e) => ({ value: e.name === 'RNB_CLAUDE_MOD_NONCE' ? nonce : '/tmp/receipt.json' }));
+  on('session.version', () => ({ value: { version: '2.1.289' } }));
+  on('session.id', () => ({ value: 'native-fixture-session' }));
+  on('process.run', ($, e) => {
+    if (e.argv.includes('--ready')) return { value: { exitCode: 0, stdout: JSON.stringify({nonce,status:'ready'}), stderr:'',isStdoutTruncated:false,isStderrTruncated:false } };
+    captures.push(JSON.parse(e.init!.stdin!));
+    const decision = decisions.shift();
+    if (fail) throw new Error('helper failed');
+    return { value: {exitCode:0, stdout:JSON.stringify({schemaVersion:1,subscriptionCovered:true,expiresAt:now+60000,routeDigest:digest,...decision}),stderr:'',isStdoutTruncated:false,isStderrTruncated:false} };
+  });
+  on('session.start', ($, e) => ({cwd:e.cwd}));
+  on('prompt.submit', ($, e) => { if(e.attachments) captures.push({passedAttachments:e.attachments});return {text:e.text}; });
+  on('turn.start', ($, e) => ({turnId:e.turnId}));
+  on('turn.step', async function* ($, e) {
+    captures.push({model:e.model,effort:e.effort,turnId:e.turnId,index:e.index});
+    yield {kind:'text',index:0,text:'native stream preserved'};
+    return {turnId:e.turnId,index:e.index,answer:'native stream preserved',toolUses:[],stopReason:'end_turn',usage:null};
+  });
+}
+async function resultOf(stream: HookStream<TurnStepChunk, TurnStepResult>) { let result; for (;;) {const item=await stream.next();if(item.done){result=item.value;break;}} return result; }
+test('two user turns route different models and efforts while streaming native results', async ($, on) => {
+  const captures: Record<string, unknown>[]=[];
+  stubs(on,[{model:'claude-sonnet-fixture',effort:'low',taskClass:'fast'},{model:'claude-opus-fixture',effort:'high',taskClass:'hard'}],captures);
+  await $.session.start({cwd:'/tmp',surface:'terminal',isInteractive:true});
+  for (const [turnId,text] of [['one','summarize these supplied notes'],['two','perform a security audit and prove correctness']] as const) {
+    await $.prompt.submit({text});
+    await $.turn.start({text,turnId});
+    const result=await resultOf($.turn.step({turnId,index:0,model:'wrong-default',effort:'medium',messageCount:1}));
+    expect(result.answer).toBe('native stream preserved');
+  }
+  expect(captures.filter(x=>x.turnId)).toEqual([
+    {model:'claude-sonnet-fixture',effort:'low',turnId:'one',index:0},
+    {model:'claude-opus-fixture',effort:'high',turnId:'two',index:0},
+  ]);
+});
+test('unbound model step refuses without passing to core', async ($, on) => {
+  const captures: Record<string, unknown>[]=[];stubs(on,[],captures);
+  await $.session.start({cwd:'/tmp',surface:'terminal',isInteractive:true});
+  const result=await resultOf($.turn.step({turnId:'missing',index:7,model:'wrong',messageCount:1}));
+  expect(result.stopReason).toBe('refusal');expect(result.turnId).toBe('missing');expect(result.index).toBe(7);
+  expect(captures.length).toBe(0);
+});
+test('helper exception drops prompt through immediate catch', async ($, on) => {
+  const captures: Record<string, unknown>[]=[];stubs(on,[],captures,true);
+  await $.session.start({cwd:'/tmp',surface:'terminal',isInteractive:true});
+  expect('drop' in await $.prompt.submit({text:'summarize notes'})).toBe(true);
+});
+test('coding uses high effort and final hook rewrite keeps original hard floor', async ($, on) => {
+  const captures: Record<string, unknown>[]=[];
+  stubs(on,[{model:'claude-sonnet-fixture',effort:'high',taskClass:'medium'},
+    {model:'claude-opus-fixture',effort:'high',taskClass:'hard'},
+    {model:'claude-opus-fixture',effort:'high',taskClass:'hard'}],captures);
+  await $.session.start({cwd:'/tmp',surface:'terminal',isInteractive:true});
+  await $.prompt.submit({text:'implement this module'});await $.turn.start({text:'implement this module',turnId:'code'});
+  await resultOf($.turn.step({turnId:'code',index:1,model:'wrong',messageCount:2}));
+  await $.prompt.submit({text:'security audit'});await $.turn.start({text:'summarize notes',turnId:'changed'});
+  await resultOf($.turn.step({turnId:'changed',index:0,model:'wrong',messageCount:2}));
+  expect(captures.some(x=>x.minimumClass==='hard')).toBe(true);
+  expect(captures.filter(x=>x.turnId).map(x=>x.effort)).toEqual(['high','high']);
+});
+
+test('invalid or non-subscription bridge replies drop before prompt reaches core', async ($, on) => {
+  const captures: Record<string, unknown>[]=[];
+  stubs(on,[{model:'claude-sonnet-fixture',effort:'low',taskClass:'fast',subscriptionCovered:false},
+    {model:'claude-sonnet-fixture',effort:'low',taskClass:'fast',routeDigest:'invalid'}],captures);
+  await $.session.start({cwd:'/tmp',surface:'terminal',isInteractive:true});
+  expect('drop' in await $.prompt.submit({text:'summarize notes'})).toBe(true);
+  expect('drop' in await $.prompt.submit({text:'summarize notes'})).toBe(true);
+});
+test('image-only user prompt retains attachments and binds a conservative hard allocation', async ($, on) => {
+  const captures: Record<string, unknown>[]=[];
+  stubs(on,[{model:'claude-opus-fixture',effort:'high',taskClass:'hard'}],captures);
+  await $.session.start({cwd:'/tmp',surface:'terminal',isInteractive:true});
+  await $.prompt.submit({text:'',attachments:[{type:'image',mediaType:'image/png',filename:'fixture.png'}]});
+  await $.turn.start({text:'',turnId:'image'});
+  await resultOf($.turn.step({turnId:'image',index:0,model:'wrong',messageCount:1}));
+  expect(captures.find(x=>x.passedAttachments)?.passedAttachments).toEqual([{type:'image',mediaType:'image/png',filename:'fixture.png'}]);
+  expect(captures.filter(x=>x.turnId)[0]?.model).toBe('claude-opus-fixture');
+});

package/config/model-router/policy.default.mjs

@@ -57,10 +57,13 @@ export function classify(features, harness = features.harness || 'codex') {
   const text = String(features.taskHints || '');
   const coding = features.hasCode || CODING.test(text);
   const assessedText = assessmentText(text);
+  const securityActions = assessedText.replace(/\bdo not (?:assess|recommend)[^.;\n]*/gi, '');
+  const securityReview = /\b(security|risks?)\b/i.test(securityActions) &&
+    /\b(review|assess(?:ment)?|audit|evaluat\w*|analy[sz]\w*|identify|determine)\b/i.test(securityActions);
   const consequential = /\b(consequential planning|substantive planning|substantive review|final substantive review|plan (?:a |the )?new system|design (?:a |the )?new architecture|ambiguous architecture|architecture ambiguity|architectur\w* tradeoff|tightly coupled uncertain implementation|uncertain tightly coupled implementation)\b/i.test(text);
   const architectureAmbiguity = /architectur\w*/i.test(text) && /\b(ambiguous|ambiguity|unresolved|uncertain|trade[- ]?off)\b/i.test(text);
   const coupledUncertainty = /tightly coupled/i.test(text) && /implementation|coding/i.test(text) && /uncertain|unresolved|ambiguous/i.test(text);
-  const hardText = HARD.test(assessedText) || consequenceFloor(assessedText) || consequential || architectureAmbiguity || coupledUncertainty;
+  const hardText = HARD.test(assessedText) || securityReview || consequenceFloor(assessedText) || consequential || architectureAmbiguity || coupledUncertainty;
   const substantialText = /\b(substantial (?:implementation|coding|feature|task)|cross-module (?:implementation|feature|refactor)|multi-file (?:implementation|feature|refactor)|end-to-end implementation|broad refactor)\b/i.test(text);
   const facts = validateTaskFacts(features.taskFacts);
   // Partial caller metadata supplements the assessment; it cannot lower explicit high-consequence text.

package/kb/forge-update.mjs

@@ -1405,6 +1405,35 @@ export function bundleIdentity(src) {
   return parts.some(Boolean) ? parts.join('|') : null;
 }
 
+const downloadedArchiveVerifiers = new WeakSet();
+
+function archiveVerifierFromDigests(actualDigests, bytes) {
+  const verifier = Object.freeze({
+    bytes,
+    digest(algorithm = 'sha256') {
+      if (!Object.hasOwn(actualDigests, algorithm)) throw new Error(`archive algorithm ${algorithm} was not captured`);
+      return actualDigests[algorithm];
+    },
+  });
+  downloadedArchiveVerifiers.add(verifier);
+  return verifier;
+}
+
+// Capture the closed transaction algorithm inventory synchronously. Never retain mutable bytes:
+// the capability attests only to this creation-time snapshot, not a later caller-owned Buffer.
+export function createDownloadedArchiveVerifier(downloadedBuffer, expectedDigests = []) {
+  if (!Buffer.isBuffer(downloadedBuffer) || !Array.isArray(expectedDigests)) throw new TypeError('archive bytes and digest inventory required');
+  const algorithms = new Set(['sha256']);
+  for (const expected of expectedDigests) {
+    if (expected == null) continue;
+    if (typeof expected !== 'string' || !expected) throw new TypeError('invalid archive digest');
+    algorithms.add(expected.includes(':') ? expected.split(':')[0] : 'sha256');
+  }
+  const actualDigests = Object.freeze(Object.fromEntries([...algorithms].map(algorithm =>
+    [algorithm, createHash(algorithm).update(downloadedBuffer).digest('hex')])));
+  return archiveVerifierFromDigests(actualDigests, downloadedBuffer.length);
+}
+
 /**
  * Confirm the download+extraction actually changed what is on disk (issue #35 item 2, Dr. Mark
  * Allen / @mamd69).
@@ -1448,8 +1477,11 @@ export function bundleIdentity(src) {
  * @returns {{ok: boolean, reason: string|null, landed: object|null, kind: 'noop'|'damaged'|null,
  *            storeUnchanged: boolean, bundleChanged: boolean|null}}
  */
-export function verifyLanded({ kbDir, kbName, before, beforeBundle = null, expectedDigest = null, downloadedBuffer = null }) {
+export function verifyLanded({ kbDir, kbName, before, beforeBundle = null, expectedDigest = null, downloadedBuffer = null, archiveVerifier = null }) {
   const damaged = (reason, landed = null) => ({ ok: false, kind: 'damaged', reason, landed, storeUnchanged: false, bundleChanged: null });
+  if (archiveVerifier !== null && (!downloadedArchiveVerifiers.has(archiveVerifier) || downloadedBuffer !== null)) {
+    return damaged('archive verification capability is invalid or mixed with mutable archive bytes');
+  }
   const p = path.join(kbDir, 'SOURCE.json');
   if (!fs.existsSync(p)) {
     return damaged(`no SOURCE.json found at ${p} after extraction — cannot confirm what actually landed`);
@@ -1487,9 +1519,11 @@ export function verifyLanded({ kbDir, kbName, before, beforeBundle = null, expec
 
   // Bytes that do not match what the release declared are a HARD failure whatever the identities
   // say, and the copy now in place is suspect — so this is checked before anything else.
-  if (expectedDigest && downloadedBuffer) {
+  if (expectedDigest && (downloadedBuffer || archiveVerifier)) {
     const algo = expectedDigest.includes(':') ? expectedDigest.split(':')[0] : 'sha256';
-    const actual = `${algo}:${createHash(algo).update(downloadedBuffer).digest('hex')}`;
+    let actual;
+    try { actual = `${algo}:${archiveVerifier ? archiveVerifier.digest(algo) : createHash(algo).update(downloadedBuffer).digest('hex')}`; }
+    catch (error) { return damaged(`downloaded bundle digest verification failed: ${error.message}`, landed); }
     if (actual !== expectedDigest) {
       return damaged(`downloaded bundle digest ${actual} does not match the release-declared digest ${expectedDigest}`, landed);
     }
@@ -1705,7 +1739,7 @@ async function main() {
   const originLabel = resolved.origin === 'latest-release-asset' ? `live release asset "${resolved.assetName}"`
     : resolved.origin === 'live-manifest' ? 'live manifest' : 'PINNED FALLBACK (see warning above)';
   console.log(`\n[${behindStores.length} store(s)] downloading ${resolved.url}\n  (source: ${originLabel}) ...`);
-  const buf = await fetchBuffer(resolved.url);
+  let buf = await fetchBuffer(resolved.url);
   const sigBuf = await fetchBuffer(`${resolved.url}.sig`, { failureCode: 3, kind: 'signature' });
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'forge-update-release-'));
   const zipPath = path.join(tmp, 'bundle.zip');
@@ -1718,6 +1752,14 @@ async function main() {
   const signature = verifyDownloadedBundle(zipPath, sigPath);
   if (!signature.ok) { fs.rmSync(tmp, { recursive: true, force: true }); die(`✗ SIGNATURE VERIFICATION FAILED: ${signature.reason}`, 4); }
   console.log(`  ✓ signature verified — ${signature.reason}`);
+  let archiveVerifier;
+  try { archiveVerifier = createDownloadedArchiveVerifier(buf, resolvedTargets.map(({ resolved: target }) => target.digest)); }
+  catch (error) {
+    fs.rmSync(tmp, { recursive: true, force: true });
+    die(`archive digest snapshot failed: ${error.message} — local files untouched.`, 4);
+  }
+  const bundleSha256 = archiveVerifier.digest();
+  buf = null; // Snapshot owns only immutable digest strings; release the downloaded bytes before validation.
   // DISK-SPACE PREFLIGHT, before a single byte is unpacked: the bundle unpacks in temp, then a whole
   // candidate generation is built beside the live one: the bundle, plus what prepareCandidate carries into
   // it from live — node_modules, and every private/local-ingest store file (restorePrivateFilesIntoCandidate
@@ -1801,7 +1843,7 @@ async function main() {
       for (const { local, resolved: storeResolution } of landingTargets) {
         execFileSync(process.execPath, [guard, '--dir', dir, '--name', local.kbName], { cwd: dir, stdio: 'pipe' });
         const verified = verifyLanded({ kbDir: dir, kbName: local.kbName, before: local, beforeBundle: source,
-          expectedDigest: storeResolution.digest, downloadedBuffer: buf });
+          expectedDigest: storeResolution.digest, archiveVerifier });
         if (!verified.ok && verified.kind !== 'noop') return { valid: false, failures: [verified.reason] };
         if (phase === 'live') finalVerificationByStore.set(local.kbName, verified);
       }
@@ -1872,7 +1914,6 @@ async function main() {
   fs.rmSync(tmp, { recursive: true, force: true });
   console.log(`  storage transaction: ${transaction.terminalVerdict}`);
   if (transaction.terminalVerdict === 'cleanup-pending') {
-    const bundleSha256 = createHash('sha256').update(buf).digest('hex');
     const cleanupOutcome = writeUpdateOutcome({ terminalVerdict: 'cleanup-pending', storageDelta: transaction.storageDelta,
       transactionReceipts: transaction.paths.receipts, bundleSha256,
       phaseEvidence: phaseEvidenceFor({ root: KB_DIR, terminalVerdict: 'cleanup-pending', bundleSha256,
@@ -1886,7 +1927,7 @@ async function main() {
   for (const { local, resolved: storeResolution } of landingTargets) {
     const verified = finalVerificationByStore.get(local.kbName)
       || verifyLanded({ kbDir: KB_DIR, kbName: local.kbName, before: local, beforeBundle: source,
-        expectedDigest: storeResolution.digest, downloadedBuffer: buf });
+        expectedDigest: storeResolution.digest, archiveVerifier });
     if (verified.storeUnchanged || verified.kind === 'noop') unchangedStores.push(local.kbName);
     landedByStore.set(local.kbName, { landed: verified.landed, origin: storeResolution.origin, assetName: storeResolution.assetName });
   }
@@ -1947,10 +1988,10 @@ async function main() {
     currencyVerdict: verdict.verdict, currencyReason: verdict.reason, candidateKind: candidateIdentity.kind,
     storageDelta: transaction.storageDelta,
     transactionReceipts: transaction.paths.receipts,
-    bundleSha256: createHash('sha256').update(buf).digest('hex'),
+    bundleSha256,
     coverageSha256: sha256File(path.join(KB_DIR, 'COVERAGE.json')),
     phaseEvidence: phaseEvidenceFor({ root: KB_DIR, terminalVerdict: transaction.terminalVerdict,
-      bundleSha256: createHash('sha256').update(buf).digest('hex'),
+      bundleSha256,
       transactionReceipts: transaction.paths.receipts, overlay: privateOverlay,
       storageDelta: transaction.storageDelta }) });
   if (finalOutcome?.terminalVerdict === 'recovery-required') die(finalOutcome.reason);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.5.5",
-  "description": "One-command installer for RuvNet Brain \u2014 a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
+  "version": "4.5.7",
+  "description": "One-command installer for RuvNet Brain — a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {
     "ruvnet-brain": "bin/install.mjs"
@@ -146,6 +146,7 @@
   },
   "dependencies": {
     "@metaharness/flywheel": "^0.1.7",
-    "@metaharness/router": "^0.4.0"
+    "@metaharness/router": "^0.4.0",
+    "ws": "^8.22.0"
   }
 }

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships a UserPromptSubmit retrieve-and-inject grounding hook and a PreToolUse write gate that refuses ungrounded rUv-product code until search_ruvnet has been consulted (ADR-0012 / ADR-067).",
-  "version": "4.5.5",
+  "version": "4.5.7",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.5.5",
+  "version": "4.5.7",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/commands/configure.md

@@ -1,6 +1,7 @@
 ---
 description: Open the RuvNet Brain Console (/rnbc) — a local web page that mirrors YOUR machine's RuvNet setup, explains it in plain English, and lets you safely configure and fix it. Read-only until you click; every machine change is explained first and is reversible.
-updated: 2026-10-01
+updated: 2026-10-04
+version: 1.0.1
 ---
 
 Launch the **RuvNet Brain Console** (RNBC) for the user. `/rnbc` is its name; `/rnb`, `/rvbc`,
@@ -64,6 +65,17 @@ header chip says how fresh the reading is and re-measures if they click it.
 Report it plainly — the real error, not a guess — and offer to fix it. Never leave them staring at
 a dead tab wondering whether it is still loading.
 
+## Promise capture preference
+
+If the user asks to stop automatic promise capture, explain the supported setting:
+`RUVNET_PROMISE_CAPTURE=off` in the hook process environment. It can be supplied for the machine or
+one project through the host's environment configuration. The exact value `off` stops capturing new
+"I'll …" promises; unset it or set `on` to resume capture. This preference is separate from the Brain
+on/off switch and is not currently a Console toggle. Existing promises remain visible and forceable,
+and close only on verified evidence. Capability and completion integrity checks keep running. Do not
+disable the Stop hook or edit the work ledger to apply this preference. Reopen the host if its current
+session has not picked up the changed environment.
+
 ---
 
 ## Things NOT to do before the page is open

package/plugin/hooks/hook-contracts.json

@@ -297,7 +297,7 @@
         "codex"
       ],
       "mode": "advisory",
-      "offBehavior": "run",
+      "offBehavior": "silence",
       "matcher": "*",
       "timeout": 6
     },