ruvnet-brain 4.5.9 → 4.5.10

package/plugin/scripts/automatic-update.mjs

@@ -0,0 +1,125 @@
+// Owner-only automatic update policy. Project settings and inherited package-manager paths
+// cannot choose executable code or relax the signed corpus updater's compatibility checks.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { SETTINGS_VERSION, validate, saveSettings } from './user-settings.mjs';
+
+export const ownerSettingsPath = (home = os.homedir()) => path.join(home, '.config', 'ruvnet-brain', 'settings.json');
+export function updateSource({ home = os.homedir(), read = fs.readFileSync, validatePolicy = validate } = {}) {
+  const file = ownerSettingsPath(home);
+  let descriptor; let captured;
+  try {
+    let before;
+    try { before = fs.lstatSync(file); }
+    catch (error) { if (error.code === 'ENOENT') return 'latest'; throw error; }
+    if (!before.isFile() || before.isSymbolicLink()) throw new Error('owner settings must be a regular file, not a symlink');
+    descriptor = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
+    const stat = fs.fstatSync(descriptor);
+    if (!stat.isFile() || stat.dev !== before.dev || stat.ino !== before.ino
+      || (typeof process.getuid === 'function' && (stat.uid !== process.getuid() || (stat.mode & 0o022)))) {
+      throw new Error('owner settings identity or permissions are unsafe');
+    }
+    captured = JSON.parse(read(descriptor, 'utf8'));
+  } catch (error) { throw new Error(`owner update settings are unreadable or invalid: ${error.message}`); }
+  finally { if (descriptor !== undefined) fs.closeSync(descriptor); }
+  if (!captured || Array.isArray(captured) || captured.version !== SETTINGS_VERSION
+    || !captured.settings || Array.isArray(captured.settings) || typeof captured.settings !== 'object') {
+    throw new Error('automatic update source is unproven: owner settings envelope is invalid or from another version');
+  }
+  const state = validatePolicy(captured.settings);
+  if (!state.ok) throw new Error('automatic update source is unproven: owner settings are invalid');
+  const source = state.values.updateSource;
+  if (!['latest', 'installed'].includes(source)) throw new Error('automatic update source is not supported by this runtime');
+  return source;
+}
+
+export function saveUpdateSource(source, { home = os.homedir() } = {}) {
+  if (!['latest', 'installed'].includes(source)) throw new Error('--update-source must be latest or installed');
+  const result = saveSettings({ updateSource: source }, { file: ownerSettingsPath(home) });
+  if (!result.ok || result.values.updateSource !== source) throw new Error(result.log || 'update source was not persisted');
+  return result;
+}
+
+export function automaticPath({ nodePath = process.execPath, home = os.homedir(), platform = process.platform, env = process.env } = {}) {
+  const paths = [path.dirname(nodePath), path.join(home, '.npm-global', 'bin'), path.join(home, '.local', 'bin')];
+  if (platform === 'win32') {
+    const system = env.SystemRoot || env.SYSTEMROOT;
+    if (system && path.win32.isAbsolute(system)) paths.push(system, path.join(system, 'System32'));
+  } else paths.push('/opt/homebrew/bin', '/usr/local/bin', '/usr/bin', '/bin', '/usr/sbin', '/sbin');
+  return [...new Set(paths)].join(path.delimiter);
+}
+
+export function stableNode({ executable = process.execPath, explicit, realpath = fs.realpathSync, run = spawnSync } = {}) {
+  let candidate = explicit || executable;
+  if (!explicit) {
+    const cellar = /^(.*)[\\/]Cellar[\\/]([^\\/]+)[\\/][^\\/]+[\\/]bin[\\/]node$/.exec(executable);
+    if (cellar) candidate = path.join(cellar[1], 'opt', cellar[2], 'bin', 'node');
+    else if (/[\\/](?:\.nvm[\\/]versions|\.npm[\\/]_npx|\.volta[\\/]tools[\\/]image|\.fnm[\\/]node-versions)[\\/]/.test(executable)) {
+      throw new Error('automatic updates need a stable Node path; pass --nightly-node /absolute/stable/node');
+    }
+  }
+  if (!path.isAbsolute(candidate)) throw new Error('nightly Node path must be absolute');
+  try {
+    if (realpath(candidate) !== realpath(executable)) throw new Error('selected Node does not resolve to the running installer Node');
+  } catch (error) { throw new Error(`stable Node is unavailable or mismatched: ${error.message}`); }
+  const version = run(candidate, ['--version'], { encoding: 'utf8', timeout: 5000,
+    env: { PATH: automaticPath({ nodePath: candidate }), SystemRoot: process.env.SystemRoot || '' } });
+  if (version.error || version.status !== 0 || !/^v(\d+)\./.test(String(version.stdout).trim())
+    || Number(/^v(\d+)\./.exec(String(version.stdout).trim())[1]) < 18) throw new Error('automatic updates require supported Node 18 or newer');
+  return candidate;
+}
+
+export function installedUpdater({ home = os.homedir(), platform = process.platform } = {}) {
+  const root = path.join(home, '.npm-global', ...(platform === 'win32' ? [] : ['lib']), 'node_modules', 'ruvnet-brain');
+  const manifestPath = path.join(root, 'package.json');
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  const declared = manifest.bin?.['ruvnet-brain'];
+  if (manifest.name !== 'ruvnet-brain' || typeof declared !== 'string' || !declared
+    || path.isAbsolute(declared) || path.win32.isAbsolute(declared) || declared.split(/[\\/]/).includes('..')) {
+    throw new Error('installed update source has no safe declared Brain entrypoint');
+  }
+  const actualRoot = fs.realpathSync(root);
+  const entry = fs.realpathSync(path.resolve(root, declared));
+  const relative = path.relative(actualRoot, entry);
+  if (!relative || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative) || !fs.statSync(entry).isFile()) {
+    throw new Error('installed Brain entrypoint escapes its owner installation');
+  }
+  const sha256 = crypto.createHash('sha256').update(fs.readFileSync(entry)).digest('hex');
+  return { entry, version: manifest.version, sha256 };
+}
+
+export function automaticInvocation(args, { source = updateSource(), home = os.homedir(), nodePath = process.execPath,
+  packageTarget = 'ruvnet-brain@latest' } = {}) {
+  if (source === 'installed') {
+    if (packageTarget !== 'ruvnet-brain@latest') throw new Error('installed mode cannot select a proof tarball');
+    const installed = installedUpdater({ home });
+    return { executable: nodePath, args: [installed.entry, ...args], source, installed };
+  }
+  if (source !== 'latest') throw new Error('invalid automatic update source');
+  const name = process.platform === 'win32' ? 'npx.cmd' : 'npx';
+  const ownerNpx = path.join(home, '.npm-global', 'bin', name);
+  const adjacent = fs.existsSync(ownerNpx) ? ownerNpx : path.join(path.dirname(nodePath), name);
+  if (process.platform === 'win32') {
+    try {
+      const shim = fs.existsSync(adjacent) ? adjacent : automaticPath({ nodePath, home }).split(path.delimiter)
+        .map(dir => path.join(dir, name)).find(candidate => fs.existsSync(candidate));
+      if (!shim) throw new Error('managed npm npx shim is missing');
+      const root = fs.realpathSync(path.join(path.dirname(fs.realpathSync(shim)), 'node_modules', 'npm'));
+      const manifest = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+      const declared = manifest.bin?.npx;
+      if (manifest.name !== 'npm' || typeof declared !== 'string' || !declared || path.isAbsolute(declared)
+        || path.win32.isAbsolute(declared) || declared.split(/[\\/]/).includes('..')) throw new Error('unsafe npm npx entry');
+      const entry = fs.realpathSync(path.resolve(root, declared));
+      const relative = path.relative(root, entry);
+      if (!relative || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative) || !fs.statSync(entry).isFile()) {
+        throw new Error('managed npm npx entry escapes its package');
+      }
+      return { executable: nodePath, args: [entry, '--yes', packageTarget, ...args], source };
+    } catch (error) { throw new Error(`could not resolve managed npm: ${error.message}`); }
+  }
+  return { executable: fs.existsSync(adjacent) ? adjacent : name,
+    args: ['--yes', packageTarget, ...args], source };
+}

package/plugin/scripts/completion-claim-evidence.mjs

@@ -48,12 +48,14 @@ function sentences(message) {
 }
 
 // A sentence that is itself a disclosure, a negation, a hedge or a condition is not a claim.
-const NOT_A_CLAIM = /\b(?:not|never|no|nothing|none|cannot|can't|won't|isn't|aren't|wasn't|weren't|hasn't|haven't|didn't|doesn't|don't|without|unverified|untested|unproven|unknown|yet|if|unless|until|once|when|whether|should|would|could|might|may|maybe|probably|likely|expected|supposed|hopefully|assuming|pending|remaining|remains|todo|tbd|before|after|previously|earlier|already|yesterday|ago|last\s+(?:week|night|time|session|release)|claimed|claims|said|says|reported|told|neither|nor|as\s+soon\s+as|tell\s+me|I(?:'ll|’ll)|we(?:'ll|’ll)|will\s+(?!now\b)|(?:was|were)\s+working|damage\s+is\s+done)\b|\?/i;
+const NOT_A_CLAIM = /\b(?:not|never|no|nothing|none|cannot|can't|won't|isn't|aren't|wasn't|weren't|hasn't|haven't|didn't|doesn't|don't|without|unverified|untested|unproven|unknown|yet|if|unless|until|once|when|whether|should|would|could|might|may|maybe|probably|likely|expected|supposed|hopefully|assuming|pending|remaining|remains|todo|tbd|before|after|previously|earlier|already|yesterday|ago|last\s+(?:week|night|time|session|release)|neither|nor|as\s+soon\s+as|tell\s+me|I(?:'ll|’ll)|we(?:'ll|’ll)|will\s+(?!now\b)|(?:was|were)\s+working|damage\s+is\s+done)\b|\?/i;
+const HEARSAY = /\b(?:claimed|claims|said|says|reported|told)\b/i;
+const FIRST_PERSON_ASSERTION = /^(?:[-*•]\s*|#+\s*)*(?:I|we)(?:'ve|’ve|\s+have)?\s+(?:now\s+|just\s+|successfully\s+|also\s+|fully\s+)*(?:fixed|shipped|deployed|resolved|completed|implemented|landed|published|released|verified|finished|reported|wired\s+up)\b/i;
 const CLAIM_PATTERNS = [
   // "X is fixed", "the gate is now live", "tests are passing", "it's done"
   /\b(?:is|are|was|were|has\s+been|have\s+been|(?:it|that|this|what|everything|there)(?:'s|’s)|now)\s+(?:all\s+|fully\s+|now\s+|finally\s+|successfully\s+|actually\s+)*(?:fixed|done|complete|completed|resolved|shipped|deployed|live(?!\s+(?:in|inside|under|with|alongside))|implemented|landed|published|merged|released|verified|green|passing|operational|in\s+place|wired(?:\s+up)?|working(?!\s+(?:on|with|through|in|as|tree|copy|dir)))\b/i,
   // "I fixed", "I've shipped", "we deployed"
-  /\b(?:I|we)(?:'ve|’ve|\s+have)?\s+(?:now\s+|just\s+|successfully\s+|also\s+|fully\s+)*(?:fixed|shipped|deployed|resolved|completed|implemented|landed|published|released|verified|finished|wired\s+up)\b/i,
+  /\b(?:I|we)(?:'ve|’ve|\s+have)?\s+(?:now\s+|just\s+|successfully\s+|also\s+|fully\s+)*(?:fixed|shipped|deployed|resolved|completed|implemented|landed|published|released|verified|finished|reported|wired\s+up)\b/i,
   // "Done." "Fixed:" "Shipped —" "✅ Deployed" at the start of a line
   /^(?:[-*•]\s*|#+\s*|\*\*|✅\s*)*(?:done|fixed|shipped|deployed|resolved|complete|completed|implemented|all\s+done|all\s+set|all\s+green)\b\s*(?:[.!:—–-]|\*\*|$)/i,
   // "now works", "it will now block …", "works end to end"
@@ -64,7 +66,7 @@ const CLAIM_PATTERNS = [
 export function extractCompletionClaims(message) {
   const out = [];
   for (const sentence of sentences(message)) {
-    if (NOT_A_CLAIM.test(sentence)) continue;
+    if (NOT_A_CLAIM.test(sentence) || (HEARSAY.test(sentence) && !FIRST_PERSON_ASSERTION.test(sentence))) continue;
     if (CLAIM_PATTERNS.some((re) => re.test(sentence))) out.push({ class: 'completion', text: sentence });
   }
   return out;
@@ -219,6 +221,8 @@ export function auditCompletionClaims(message, { turn = null, host = 'claude' }
 const PROMISE_LEAD = /\b(?:I(?:'ll|’ll|\s+will)|I(?:'m|’m|\s+am)\s+going\s+to|next,?\s+I(?:'ll|’ll|\s+will)|I\s+commit\s+to)\s+(?:now\s+|next\s+|then\s+|also\s+|immediately\s+|first\s+)*([a-z][^.!?\n]{6,158})/i;
 const PROMISE_REJECT = /\?|:\*\*|\b(?:if|unless|once|when|whenever|as\s+soon\s+as|after|the\s+moment|until|whether|shortly|regularly|periodically|every\s+\d+|check\s+(?:back|again|on\s+it)|keep\s+(?:watching|an\s+eye)|maybe|might|could|would|probably|perhaps|possibly|option|alternatively|either|or\s+I\s+(?:can|could)|want\s+me|should\s+I|shall\s+I|let\s+you\s+know|wait|await|stand\s+by|hold\s+off|leave\s+(?:it|that|this)\s+to\s+you|happy\s+to|glad\s+to|be\s+honest|note\s+that|keep\s+(?:that|this)\s+in\s+mind|try\s+to|need\s+your|your\s+(?:approval|go-ahead|call|decision|confirmation))\b/i;
 const TRIVIAL_PROMISE = /^(?:not|never|be|say|mention|note|admit|point|flag|stop|stay|leave|keep|summari[sz]e|explain|answer|respond|reply|report|remember|give|tell|send|paste|bring|hand|show|walk|notify|post|update\s+you|come\s+back|get\s+back|handle|only|stand|work)\b/i;
+const OWNER_DEPENDENT_OFFER = /\b(?:say\s+the\s+word|(?:just|simply)\s+(?:ask|say)|ask\s+me|let\s+me\s+know|give\s+me\s+the\s+(?:word|go|nod|ok)|on\s+your\s+(?:word|go|ok|say)|up\s+to\s+you)\b/i;
+const STANDING_APPROVAL = /^(?:ask|confirm|check\s+with\s+you|clear\s+(?:it|this|that)\s+with\s+you|run\s+.+\s+by\s+you)\b.*\b(?:before|first)\b/i;
 
 export const normalizePromise = (value) => String(value || '').toLowerCase().replace(/[`*_"“”'’]/g, '')
   .replace(/[^a-z0-9./:+-]+/g, ' ').trim().slice(0, 160);
@@ -237,7 +241,8 @@ export function extractCommitments(message) {
     const candidates = item ? [item[1]] : sentences(line).map((s) => PROMISE_LEAD.exec(s)?.[1]).filter(Boolean);
     const whole = item ? item[1] : line;
     for (const action of candidates) {
-      if (PROMISE_REJECT.test(whole) || TRIVIAL_PROMISE.test(action.trim())) continue;
+      if (PROMISE_REJECT.test(whole) || OWNER_DEPENDENT_OFFER.test(whole)
+        || STANDING_APPROVAL.test(action.trim()) || TRIVIAL_PROMISE.test(action.trim())) continue;
       const text = action.replace(/\s+/g, ' ').trim().replace(/[,;:]$/, '');
       const key = normalizePromise(text);
       if (key.length < 6 || seen.has(key)) continue;

package/plugin/scripts/continuation-gate.mjs

@@ -47,7 +47,7 @@ import {
   buildCapabilityInventoryReceipt,
 } from './capability-inventory-receipt.mjs';
 import { auditCurrentCapabilityEvidence } from './capability-claim-evidence.mjs';
-import { continuationProjectIdentity, authorizedContinuationObjective, authorizedPromiseItems } from './continuation-objective.mjs';
+import { continuationProjectIdentity, authorizedContinuationObjective, authorizedPromiseItems, assistantCommitmentOwned, setAssistantCommitmentState } from './continuation-objective.mjs';
 import {
   auditCompletionClaims, readClaudeTurn, extractCommitments, claimClosesPromise,
   PROMISE_KIND, PROMISE_CAP_OPEN,
@@ -178,7 +178,8 @@ function save(led) {
   try {
     fs.mkdirSync(path.dirname(LEDGER), { recursive: true });
     fs.writeFileSync(LEDGER, JSON.stringify({ ...led, updated: new Date().toISOString() }, null, 2) + '\n');
-  } catch { /* the ledger is advisory — never break a turn over it */ }
+    return true;
+  } catch { return false; /* the ledger is advisory — never break a turn over it */ }
 }
 
 // ── commands ─────────────────────────────────────────────────────────────────────────────────────
@@ -217,6 +218,20 @@ if (has('--commit-to')) {
   process.exit(0);
 }
 
+if (has('--set-commitment-state')) {
+  try {
+    const sessionId = arg('--session-id');
+    const nativeSession = process.env.RUVNET_BRAIN_SESSION_ID || process.env.RUVNET_HOOK_SESSION_ID;
+    if (nativeSession && nativeSession !== sessionId) throw new Error('supplied session id differs from native session context');
+    const led = load();
+    setAssistantCommitmentState(led, { itemText: arg('--item'), state: arg('--set-commitment-state'),
+      sessionId, reason: arg('--reason'), replacementReference: arg('--replacement'),
+      identity: continuationProjectIdentity(process.cwd()) });
+    if (!save(led)) throw new Error('assistant commitment state could not be recorded');
+    console.log('assistant commitment state recorded; user objective unchanged'); process.exit(0);
+  } catch (error) { console.error(`refused: ${error.message}`); process.exit(2); }
+}
+
 if (has('--done')) {
   const led = load();
   const needle = arg('--done');
@@ -297,6 +312,9 @@ if (has('--help') || has('-h')) {
     '  --commit-to "<text>"               record work the model agreed to do; opens/reopens the',
     '                                      objective as state: active',
     '  --done "<exact item text>"         mark a plain ledger item done (exact text match only)',
+    '  --set-commitment-state <blocked|deferred|superseded|disputed> --item "<exact text>"',
+    '    --session-id "<capturing session>" --reason "<why>" [--replacement "<reference>"]',
+    '                                      retain a noncompleted assistant item; user work unchanged',
     '  --complete-objective "<evidence>"  close the current objective as state: completed, with the',
     '                                      completion evidence recorded — leaves other ledger items',
     '                                      untouched',
@@ -368,30 +386,33 @@ const completion = (() => {
  * normalized text; project + worktree scoped exactly like --commit-to's objective. Fails open.
  */
 function promiseBookkeeping() {
-  if (HOST !== 'claude' || !hookInput.session_id) return;
+  if (HOST !== 'claude' || !hookInput.session_id || hookInput.session_id === '*') return;
   try {
     const pid = projectIdentity.projectId;
     const at = new Date(nowMs).toISOString();
     let changed = false;
     if (completion.verdict === 'PASS') {
       for (const item of led.items) {
-        if (item?.kind !== PROMISE_KIND || item.done || item.projectId !== pid) continue;
+        if (!assistantCommitmentOwned(item, hookInput.session_id, projectIdentity)) continue;
         const claim = completion.claims.find((c) => claimClosesPromise(c.text, item.text));
         if (!claim) continue;
-        Object.assign(item, { done: true, doneAt: at, completionEvidence: { claim: claim.text,
+        Object.assign(item, { done: true, state: 'completed', doneAt: at, completionEvidence: { claim: claim.text,
           checks: completion.verification.checks.slice(-5).map((c) => c.what),
           transcript: String(hookInput.transcript_path || ''), sessionId: hookInput.session_id } });
         changed = true;
       }
     }
-    const openKeys = new Set(led.items.filter((i) => i?.kind === PROMISE_KIND && !i.done && i.projectId === pid).map((i) => i.key));
+    const owned = led.items.filter((i) => assistantCommitmentOwned(i, hookInput.session_id, projectIdentity));
+    const openKeys = new Set(owned.map((i) => i.key));
+    let activeCount = owned.filter((i) => i.state === undefined || i.state === 'active').length;
     // Owner preference suppresses only new capture; verified closure above and integrity audits stay active.
     const newPromises = process.env.RUVNET_PROMISE_CAPTURE === 'off' ? [] : extractCommitments(hookInput.last_assistant_message);
     for (const promise of newPromises) {
-      if (openKeys.has(promise.key) || openKeys.size >= PROMISE_CAP_OPEN) continue;
+      if (openKeys.has(promise.key) || activeCount >= PROMISE_CAP_OPEN) continue;
       openKeys.add(promise.key);
-      led.items.push({ schemaVersion: 1, kind: PROMISE_KIND, text: promise.text, key: promise.key, done: false, at,
-        projectId: pid, worktreeIds: [projectIdentity.worktreeId], sessionIds: ['*'],
+      activeCount += 1;
+      led.items.push({ schemaVersion: 1, kind: PROMISE_KIND, text: promise.text, key: promise.key, done: false, state: 'active', at,
+        projectId: pid, worktreeIds: [projectIdentity.worktreeId], sessionIds: [hookInput.session_id],
         capturedFrom: { sessionId: hookInput.session_id },
         authorization: { kind: 'owner-mandate', reference: 'i-will-is-a-contract-2026-09-15' } });
       changed = true;
@@ -786,7 +807,10 @@ const lines = [
     ? ['Name the check you ran (a "Verified:" line with the command or artifact) and say what is NOT verified.']
     : promises.length
     ? ['A promise closes only when a later answer claims it done with a check run after the last change —',
-       'never by saying so, and never by --done. If you genuinely cannot do it, say so plainly and why.']
+       'never by saying so, and never by --done. For blocked, deferred, superseded or disputed assistant',
+       'commitments, use --set-commitment-state with --item (exact text), --session-id (capturing session)',
+       'and --reason; superseded also requires --replacement. This retains the item, never completes it,',
+       'and does not cancel or complete authorized user work.']
     : committed.length
     ? ['Record objective completion only with actual completion evidence; legacy --done does not complete an objective.']
     : ['These clear by being done, not by being marked: merge or fix the PR, get the build green,',

package/plugin/scripts/continuation-objective.mjs

@@ -39,17 +39,52 @@ export function authorizedContinuationObjective(objective, input, identity) {
   return objective;
 }
 
-// Promises the assistant made in a final answer ("I'll do X next"), captured by continuation-gate
-// into the SAME ledger (owner mandate 2026-09-15: "I will" is a contract). Same scoping discipline
-// as the objective above — project AND worktree must match, a session wildcard only as the literal
-// '*' — and the same loop guards. An item that is done, malformed, or foreign is never returned.
-export function authorizedPromiseItems(items, input, identity) {
-  if (!identity || input?.hook_event_name !== 'Stop' || !text(input.session_id)
-    || input.interrupted || input.cancelled || input.stop_hook_active) return [];
-  return (Array.isArray(items) ? items : []).filter((item) => item?.kind === 'assistant-commitment'
-    && item.schemaVersion === 1 && item.done !== true && text(item.text) && Number.isFinite(Date.parse(item.at))
+// Automatic assistant commitments never confer project-wide user authority. Retained legacy
+// wildcards belong only to their proven capturing session; unknown ownership stays historical.
+export function assistantCommitmentOwned(item, sessionId, identity) {
+  return Boolean(identity && text(sessionId) && sessionId !== '*'
+    && item?.kind === 'assistant-commitment' && item.schemaVersion === 1
+    && item.done !== true && text(item.text) && Number.isFinite(Date.parse(item.at))
     && item.authorization?.kind === 'owner-mandate' && text(item.authorization.reference)
     && item.projectId === identity.projectId
     && Array.isArray(item.worktreeIds) && item.worktreeIds.includes(identity.worktreeId)
-    && Array.isArray(item.sessionIds) && (item.sessionIds.includes('*') || item.sessionIds.includes(input.session_id)));
+    && item.capturedFrom?.sessionId === sessionId
+    && Array.isArray(item.sessionIds)
+    && (item.sessionIds.includes(sessionId) || item.sessionIds.includes('*')));
+}
+
+const noncompletedStates = new Set(['blocked', 'deferred', 'superseded', 'disputed']);
+
+/** Explicit owner-session preference, not verified completion or authority to cancel user work. */
+export function setAssistantCommitmentState(ledger, { itemText, state, sessionId, reason,
+  replacementReference, identity, at = new Date().toISOString() } = {}) {
+  if (!noncompletedStates.has(state) || !text(reason) || reason.length > 4000
+    || !text(sessionId) || sessionId === '*' || !Number.isFinite(Date.parse(at))) {
+    throw new Error('commitment state requires a supported noncompleted state, exact session id and reason');
+  }
+  if (state === 'superseded' && (!text(replacementReference) || replacementReference === itemText)) {
+    throw new Error('superseded requires a distinct replacement reference');
+  }
+  const matches = (Array.isArray(ledger.items) ? ledger.items : []).filter((item) => item.text === itemText
+    && assistantCommitmentOwned(item, sessionId, identity));
+  if (matches.length !== 1) throw new Error('exact assistant commitment is not uniquely owned by this session and worktree');
+  const item = matches[0];
+  if (item.stateHistory !== undefined && !Array.isArray(item.stateHistory)) {
+    throw new Error('existing commitment state history is malformed; retain it for explicit recovery');
+  }
+  const transition = { from: item.state || 'active', to: state, at, reason: reason.trim(),
+    provenance: { kind: 'explicit-session-cli', sessionId },
+    ...(text(replacementReference) ? { replacementReference: replacementReference.trim() } : {}) };
+  item.stateHistory = [...(Array.isArray(item.stateHistory) ? item.stateHistory : []), transition];
+  item.state = state;
+  item.stateChangedAt = at;
+  return item;
+}
+
+// A state change suppresses only this assistant's nudge. The independent user objective is untouched.
+export function authorizedPromiseItems(items, input, identity) {
+  if (!identity || input?.hook_event_name !== 'Stop' || !text(input.session_id)
+    || input.interrupted || input.cancelled || input.stop_hook_active) return [];
+  return (Array.isArray(items) ? items : []).filter((item) => assistantCommitmentOwned(item, input.session_id, identity)
+    && (item.state === undefined || item.state === 'active'));
 }

package/plugin/scripts/continuity-journal.mjs

@@ -22,7 +22,8 @@ import { withProgressionReader } from './project-progression-reader.mjs';
 import { rufloRunDir } from './project-progression-store.mjs';
 import { resolveRuflo, rufloInvocation } from './ruflo-bin.mjs';
 import { resolveProjectStore } from './project-store-resolver.mjs';
-import { resolveTurnDb, readSettledTranscript } from './turn-outcome-capture.mjs';
+import { resolveTurnDb, readSettledTranscript, claudeTurn } from './turn-outcome-capture.mjs';
+import { privateContinuityEvent, maskExcludedPaths, captureFailureReason, turnReferencesExcludedResource } from './turn-capture-privacy.mjs';
 import {
   CONTINUITY_NAMESPACE, INITIAL_LOOKBACK_MS, collectCommits, collectReleases, collectTurnEvents, eventIdOf, eventKey,
 } from './continuity-events.mjs';
@@ -162,9 +163,8 @@ export class ContinuityJournal {
   record(events) {
     const consent = this.captureConsent();
     if (consent.skipped) throw new Error(`event capture suspended: ${consent.skipped}`);
-    const known = this.knownIds();
-    const fresh = [];
-    for (const event of events) {
+    const known = this.knownIds(); const fresh = [];
+    for (const original of events) { const event = privateContinuityEvent(original, consent.contentPathExcludes, consent.capturePath);
       const id = `${event.kind}:${event.id}`;
       if (known.has(id)) continue;
       known.add(id);
@@ -364,7 +364,6 @@ export function drain(journal, {
   if (!ruflo) return { committed, failed, remaining: journal.pending().length, skipped: 'ruflo not found' };
   if (!storeReady(journal.db)) return { committed, failed, remaining: journal.pending().length, skipped: 'store not initialized' };
   for (const rec of journal.pending()) {
-    const value = JSON.stringify(rec.event);
     let done = false;
     let attempts = 0;
     let last = null;
@@ -374,11 +373,12 @@ export function drain(journal, {
       catch (error) { consent = { skipped: `capture consent unavailable: ${error.message}` }; }
       if (consent.skipped) return { committed, failed, remaining: journal.pending().length, skipped: consent.skipped };
       if (now() >= deadline) break;
-      attempts += 1;
-      const result = store({ ruflo, db: journal.db, key: rec.key, value });
+      const value = JSON.stringify(privateContinuityEvent(rec.event, consent.contentPathExcludes, consent.capturePath));
+      if (value !== JSON.stringify(rec.event)) return { committed, failed, remaining: journal.pending().length, skipped: 'content exclusions changed; immutable continuity retained' };
+      attempts += 1; const result = store({ ruflo, db: journal.db, key: rec.key, value });
       const back = readBack({ ruflo, db: journal.db, key: rec.key });
       const content = typeof back.content === 'string' ? back.content.trim() : '';
-      if (content && (content === value || sameEvent(content, rec.event))) {
+      if (content && (content === value || value === JSON.stringify(rec.event) && sameEvent(content, rec.event))) {
         journal.appendRecords([{ type: 'commit', key: rec.key, digest: rec.digest, committedAt: new Date(now()).toISOString(), readPath: back.readPath,
           alreadyStored: result.status !== 0 || content !== value, ...(attempts > 1 ? { attempts, lastError: last?.reason } : {}) }]);
         committed += 1;
@@ -389,7 +389,7 @@ export function drain(journal, {
         failed += 1;
         done = true;
       } else {
-        last = { reason: WAL_REFUSAL.test(result.output || '') ? 'wal-contention' : `store exited ${result.status}`, error: String(result.output || '').trim().slice(-300) };
+        last = { reason: WAL_REFUSAL.test(result.output || '') ? 'wal-contention' : `store exited ${result.status}`, error: maskExcludedPaths(captureFailureReason({ stderr: result.output }, result.status), consent.contentPathExcludes) };
         const wait = backoff[Math.min(attempt, backoff.length - 1)];
         if (attempt >= backoff.length || now() + wait >= deadline) break;
         sleep(wait);
@@ -474,8 +474,8 @@ export function captureContinuityEvents({
     if (host === 'claude' && typeof payload.transcript_path === 'string' && payload.transcript_path) {
       try { lines = readTranscript(payload.transcript_path); } catch { /* unreadable transcript: git events still count */ }
     }
-    const last = typeof payload.last_assistant_message === 'string' ? payload.last_assistant_message : '';
-    events.push(...collectTurnEvents({ lines, lastAssistantMessage: last, host, session, project, env, at: now() }));
+    const last = typeof payload.last_assistant_message === 'string' ? payload.last_assistant_message : ''; const policy = journal.captureConsent();
+    if (!policy.skipped && !(lines && turnReferencesExcludedResource(claudeTurn(lines), policy.contentPathExcludes, projectDir))) events.push(...collectTurnEvents({ lines, lastAssistantMessage: last, host, session, project, env, at: now() }));
   }
   try { report.recorded = journal.record(events).length; } catch (error) { return { ...report, skipped: `outbox write failed: ${error.message}` }; }
   try { if (journal.needsCompaction()) journal.compact(); } catch { /* bounded next time */ }

package/plugin/scripts/ground-ruvnet.sh

@@ -446,6 +446,9 @@ fi
 RUVNET=0
 if printf '%s' "$TEXT" | grep -qiE '\bruvnet\b|\bruflo\b|\bruvector\b|\brvf\b|\bagentdb\b|\bagenticow\b|\brulake\b|\bruview\b|\brupixel\b|\bruv-fann\b|\bagentic-flow\b|\bsynthlang\b|\bdspy\b|\bqudag\b|\bsafla\b|\bmetaharness\b|\bcve-bench\b|\bsparc\b|\bswarms?\b|\bclaude-flow\b|\brUv\b'; then
   RUVNET=1
+  # Only Gate1 is optional by product. Errors/no node retain default-all.
+  _SCOPE=$(printf '%s' "$TEXT" | "${RUVNET_NODE_BIN:-node}" "${BASH_SOURCE[0]%/*}/ruvnet-gate1-pattern.mjs" --scope-matches 2>/dev/null) || _SCOPE=1
+  [ "$_SCOPE" = "0" ] && RUVNET=0
 fi
 
 # ── Gate 2: is the task reaching for a CLASSICAL DEFAULT that rUv already replaced? ──────────────

package/plugin/scripts/grounding-code-projection.mjs

@@ -79,7 +79,12 @@ export function projectGroundingInput(raw) {
   return projection;
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) {
+function isMain() {
+  try { return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); }
+  catch { return false; }
+}
+
+if (isMain()) {
   try { process.stdout.write(projectGroundingInput(fs.readFileSync(0, 'utf8'))); }
   catch { process.exitCode = 1; } // A failed exemption leaves the original guard in force.
 }

package/plugin/scripts/grounding-turn-evidence.mjs

@@ -414,9 +414,9 @@ export function answerSubjects(message) {
   return [...out];
 }
 
-export function auditAssertions({ message, subjects = [], vocab = [], sources = null, stampTerms = [] }) {
+export function auditAssertions({ message, subjects = [], vocab = [], sources = null, stampTerms = [], subjectAllowed = () => true }) {
   const tools = [...new Set([...vocab, ...subjects, ...answerSubjects(message)])].filter((t) => t.length >= 3);
-  const claims = capabilityClaims(message, tools);
+  const claims = capabilityClaims(message, tools).filter((claim) => subjectAllowed(claim.subject));
   const findings = [];
   const unknown = [];
   for (const claim of claims) {

package/plugin/scripts/grounding-turn-gate.mjs

@@ -88,8 +88,9 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { groundingSubjectAllowed } from './ruvnet-gate1-pattern.mjs';
 import { readStopHookInput } from './hook-input.mjs';
-import { markerPathFor, readMarker } from './grounding-turn-mark.mjs';
+import { markerPathFor, consumeMarker } from './grounding-turn-mark.mjs';
 import { readSettledTranscript } from './turn-outcome-capture.mjs';
 import {
   architectureShadow, auditAssertions, correctionText, describeSources, loadVocabulary, logShadow,
@@ -166,7 +167,8 @@ export function decide({ hookInput, marker, markerMs, env = process.env, read =
     if (marker.assert && message) {
       const vocab = loadVocabulary({ env });
       const audit = auditAssertions({ message, subjects: marker.subjects, vocab, sources,
-        stampTerms: sources ? [] : stampTermsSince(markerMs) });
+        stampTerms: sources ? [] : stampTermsSince(markerMs),
+        subjectAllowed: (subject) => groundingSubjectAllowed(subject, marker.groundingScope) });
       if (audit.findings.length) assertion = audit.findings;
       const shadow = [architectureShadow({ architecture: marker.architecture, message }), relayShadow({ message, sources })].filter(Boolean);
       for (const row of shadow) logShadow({ ...row, at: new Date().toISOString(), session: hookInput.session_id, host });
@@ -174,7 +176,7 @@ export function decide({ hookInput, marker, markerMs, env = process.env, read =
 
     // Gate 1 demands a search only when the answer ASSERTS what a rUv product does (the directive's
     // own words). A status report, git/CI check or memory write on a rUv-named repo asserts nothing.
-    const ruvClaims = marker.gate1 === false ? [] : ruvCapabilityClaims(message);
+    const ruvClaims = marker.gate1 === false ? [] : ruvCapabilityClaims(message).filter((claim) => groundingSubjectAllowed(claim.subject, marker.groundingScope));
     const grounded = !ruvClaims.length
       || (sources ? searchedThisTurn(sources) : wasGroundedSince(markerMs, newestGroundingStampMs()));
     if (assertion) {
@@ -210,17 +212,9 @@ async function main() {
   const marker = markerPathFor(hookInput.session_id);
   if (!marker) process.exit(EXIT_ALLOW);
 
-  let markerStat;
-  try { markerStat = fs.statSync(marker); } catch { process.exit(EXIT_ALLOW); }
-
-  // Consume the marker unconditionally: whether this fires or not, it must never pressure a LATER,
-  // unrelated turn (same reasoning as continuation-gate.mjs's cooldown lock, applied here as a
-  // single-use marker instead of a timed window, because "did this turn ground itself" has no
-  // meaningful reading beyond the one turn it was written for).
-  const armed = readMarker(marker) || { gate1: true, subjects: [] };
-  try { fs.unlinkSync(marker); } catch { /* a marker that vanished between stat and unlink already told us what we needed */ }
-
-  const text = decide({ hookInput, marker: armed, markerMs: markerStat.mtimeMs });
+  const episode = consumeMarker(marker);
+  if (!episode) process.exit(EXIT_ALLOW);
+  const text = decide({ hookInput, marker: episode.marker, markerMs: episode.markerMs });
   if (!text) process.exit(EXIT_ALLOW);
 
   process.stdout.write(JSON.stringify({