ruvnet-brain 4.5.9 → 4.5.10

package/plugin/scripts/session-start-core.mjs

@@ -105,6 +105,7 @@ export async function runSessionStart({
       || s.startsWith(KNOWLEDGE_LINE_PREFIX)
       || s.startsWith(FOOTPRINT_LINE_PREFIX)
       || s.startsWith('[RuvNet Brain — OPEN ISSUES')
+      || s.startsWith('[RuvNet Brain — TURN CAPTURE]')
       || /\bopen issue\(s\)/i.test(s)
       || /^\[RuvNet Brain — external signal/i.test(s)
       || (s.startsWith('Workflow ') && !/\b(Say it plainly|offer to look|ask only|run:|invoke)\b/i.test(s))
@@ -191,7 +192,8 @@ export async function runSessionStart({
   }
   const restoreProof = { name: 'restore', ms: Date.now() - restoreStart, failed: restoreFailed };
   // Turn health remains visible even when the separate progression restore fails.
-  const turnStatus = turnRecordingStatus({ projectDir: cwd, env, home });
+  const turnStatus = turnRecordingStatus({ projectDir: cwd, env, home, noticeOnFirstUse: true });
+  if (turnStatus.notice) emit(`[RuvNet Brain — TURN CAPTURE] ${turnStatus.notice}`);
   if (turnStatus.state === 'warn') emit(`[RuvNet Brain — TURN RECORDING] ${turnStatus.line}`);
   // Opt-in, matching the pre-existing `trace()` convention below: several other tests assert
   // SessionStart's stderr is EMPTY in the clean case (hook-battery.test.mjs, hook-hardening.test.mjs

package/plugin/scripts/turn-capture-privacy.mjs

@@ -0,0 +1,202 @@
+// Content privacy only: canonical project/store/source bindings are never rewritten here.
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { redactText } from './continuity-events.mjs';
+import { normalizeHostEvent } from './hook-input.mjs';
+
+const normalized = (value) => String(value).replace(/\\/g, '/').replace(/\/{2,}/g, '/')
+  .replace(/\/$/, (match, offset, source) => source === '/' || /^[A-Za-z]:\/$/.test(source) ? match : '');
+const escaped = (value) => value.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+const separator = '[/\\\\]';
+
+/** Rooted prefixes or simple * / ** globs; no expansion or unbounded recipes. */
+export function contentPathExcludes(value) {
+  if (value === undefined) return [];
+  if (!Array.isArray(value) || value.length > 16) throw new Error('contentPathExcludes must be an array of at most 16 rooted prefixes or globs');
+  return value.map((raw) => {
+    if (typeof raw !== 'string' || !raw || raw.length > 1024 || /[\x00-\x1f?\[\]{}!]/.test(raw)) throw new Error('invalid content path exclusion');
+    const pattern = normalized(raw);
+    if (!pattern.startsWith('/') && !/^[A-Za-z]:\//.test(pattern)) throw new Error('content path exclusions must be rooted');
+    const parts = pattern.split('/');
+    if (parts.length > 32 || parts.some((part) => part === '.' || part === '..'
+      || (part !== '**' && (part.match(/\*/g) || []).length > 1))
+      || parts.filter((part) => part === '**').length > 1) throw new Error('invalid or overly complex content path exclusion');
+    return pattern;
+  });
+}
+
+function globBody(pattern) {
+  const parts = pattern.split('/');
+  let body = '';
+  for (let i = 0; i < parts.length; i += 1) {
+    const part = parts[i];
+    if (i && parts[i - 1] !== '**') body += separator;
+    if (part === '**') {
+      if (i === parts.length - 1) {
+        if (body.endsWith(separator)) body = body.slice(0, -separator.length);
+        body += `(?:${separator}[^\\n]*)?`;
+      } else body += `(?:[^/\\\\\\n]+${separator})*`;
+    } else body += part.split('*').map(escaped).join('[^/\\\\\\n]*');
+  }
+  return body;
+}
+
+export function pathIsExcluded(file, patterns = [], projectDir) {
+  if (!patterns.length || typeof file !== 'string' || !file) return false;
+  const rooted = normalized(path.isAbsolute(file) || /^[A-Za-z]:[\\/]/.test(file)
+    ? file : `${projectDir || process.cwd()}/${file}`);
+  const candidate = path.posix.normalize(rooted);
+  const physical = (value) => {
+    if (/^[A-Za-z]:\//.test(value) && process.platform !== 'win32') return value;
+    let ancestor = value; const suffix = [];
+    for (let depth = 0; depth < 128; depth += 1) {
+      try { return path.posix.join(normalized(fs.realpathSync.native(ancestor)), ...suffix); }
+      catch (error) {
+        if (error.code !== 'ENOENT') throw new Error('content exclusion resource resolution unavailable');
+        const parent = path.posix.dirname(ancestor);
+        if (parent === ancestor) break;
+        suffix.unshift(path.posix.basename(ancestor)); ancestor = /^[A-Za-z]:$/.test(parent) ? `${parent}/` : parent;
+      }
+    }
+    throw new Error('content exclusion resource resolution unavailable');
+  };
+  const candidates = [...new Set([candidate, physical(rooted)])];
+  return patterns.some((pattern) => {
+    const flags = /^[A-Za-z]:\//.test(pattern) ? 'i' : '';
+    return candidates.some((candidate) => {
+      if (pattern.includes('*')) {
+        const slash = pattern.lastIndexOf('/', pattern.indexOf('*')); const base = pattern.slice(0, slash) || '/';
+        return [pattern, `${physical(base).replace(/\/$/, '')}${pattern.slice(slash)}`].some((variant) => new RegExp(`^${globBody(variant)}$`, flags).test(candidate));
+      }
+      return [...new Set([pattern, physical(pattern)])].some((prefix) => {
+        const comparable = flags ? candidate.toLowerCase() : candidate;
+        if (flags) prefix = prefix.toLowerCase();
+        return comparable === prefix || comparable.startsWith(prefix.endsWith('/') ? prefix : `${prefix}/`);
+      });
+    });
+  });
+}
+
+/** Conservative prose masking may remove the remainder of an unquoted path-bearing clause. */
+export function maskExcludedPaths(text, patterns = [], projectDir) {
+  let result = String(text || '');
+  if (!patterns.length) return result;
+  const excluded = (value) => (projectDir || /^[A-Za-z]:[\\/]|^\//.test(value)) && pathIsExcluded(value, patterns, projectDir);
+  result = result.replace(/(["'\x60])([^"'\x60\n]+)\1/g, (match, quote, value) =>
+    /[\\/]/.test(value) && excluded(value) ? `${quote}[REDACTED:excluded-path]${quote}` : match);
+  result = result.replace(/[^\s"'\x60,;<>]+/g, (value) => /[\\/]/.test(value) && excluded(value) ? '[REDACTED:excluded-path]' : value);
+  for (const pattern of patterns) {
+    const body = globBody(pattern);
+    const tail = pattern.includes('*') ? '' : pattern.endsWith('/') ? `[^\\n"'\x60,;<>]*` : `(?:${separator}[^\\n"'\x60,;<>]*)?`;
+    const flags = /^[A-Za-z]:\//.test(pattern) ? 'gi' : 'g';
+    result = result.replace(new RegExp(`${body}${tail}(?=$|[\\s"'\x60,;<>.])`, flags), '[REDACTED:excluded-path]');
+  }
+  return result;
+}
+
+export function turnReferencesExcludedResource(turn, patterns = [], projectDir) {
+  return [...(turn.resources || []), ...(turn.files || [])].some((file) => pathIsExcluded(file, patterns, projectDir))
+    || [...(turn.resourceTexts || []), ...(turn.actions || []), turn.finalText || ''].some((text) => maskExcludedPaths(text, patterns, projectDir) !== text);
+}
+
+export function privateTurn(turn, patterns, projectDir) {
+  const excludedFiles = turn.files.filter((file) => pathIsExcluded(file, patterns, projectDir));
+  const redact = (text) => {
+    let result = maskExcludedPaths(text, patterns, projectDir);
+    for (const file of excludedFiles) {
+      for (const reference of [file, path.basename(file.replace(/\\/g, '/'))]) {
+        if (reference) result = result.split(reference).join('[REDACTED:excluded-path]');
+      }
+    }
+    return result;
+  };
+  const excludedResource = turnReferencesExcludedResource(turn, patterns, projectDir);
+  return { excludedResource, finalText: excludedResource ? '[REDACTED:excluded-resource-outcome]' : redact(turn.finalText), files: turn.files.filter((file) => !excludedFiles.includes(file)),
+    actions: excludedResource ? [] : turn.actions.map(redact) };
+}
+
+// Only derived content is filtered. IDs, provenance, project/source and evidence bindings survive.
+function contentValue(value, patterns, projectDir) {
+  if (typeof value === 'string') return maskExcludedPaths(value, patterns, projectDir) !== value ? '[REDACTED:excluded-content]' : value;
+  if (Array.isArray(value)) return value.map((item) => contentValue(item, patterns, projectDir));
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [key,
+    ['id', 'key', 'source', 'provenance', 'authoritative', 'note', 'state', 'status', 'outcome', 'trigger', 'tool'].includes(key)
+      ? item : contentValue(item, patterns, projectDir)]));
+}
+
+export function privateContinuityEvent(event, patterns = [], projectDir) {
+  const files = Array.isArray(event.detail?.files) ? event.detail.files : [];
+  const turn = privateTurn({ finalText: event.summary, files, actions: [] }, patterns, projectDir);
+  const detail = contentValue(event.detail, patterns, projectDir);
+  if (Array.isArray(event.detail?.files)) detail.files = turn.files;
+  const privateCommand = ['command', 'description', 'task'].some((field) => typeof event.detail?.[field] === 'string' && maskExcludedPaths(event.detail[field], patterns, projectDir) !== event.detail[field]);
+  if (privateCommand) for (const field of ['command', 'description', 'task']) if (typeof detail?.[field] === 'string') detail[field] = '[REDACTED:excluded-resource-detail]';
+  return { ...event, summary: privateCommand || turn.excludedResource ? '[REDACTED:excluded-resource-summary]' : turn.finalText, ...(detail ? { detail } : {}) };
+}
+
+export function payloadReferencesExcludedResource(payload, patterns = [], projectDir) {
+  const normalized = normalizeHostEvent(payload) || {}; const input = normalized.tool_input || {};
+  return [input.file_path, input.notebook_path, input.path].some((file) => pathIsExcluded(file, patterns, projectDir))
+    || [input.command, input.cmd, input.description, normalized.prompt, normalized.user_prompt].some((value) => typeof value === 'string' && maskExcludedPaths(value, patterns, projectDir) !== value);
+}
+
+export function privateTransitionObservation(observation, patterns = [], projectDir, payload = {}) {
+  if (!patterns.length) return observation;
+  const filtered = { ...observation }; const privateInput = payloadReferencesExcludedResource(payload, patterns, projectDir);
+  if (typeof observation.selectedIntent?.text === 'string'
+    && (privateInput || maskExcludedPaths(observation.selectedIntent.text, patterns, projectDir) !== observation.selectedIntent.text)) delete filtered.selectedIntent;
+  for (const field of ['error', 'signal']) if (typeof observation[field] === 'string') filtered[field] = privateInput || maskExcludedPaths(observation[field], patterns, projectDir) !== observation[field]
+    ? `[REDACTED:excluded-resource-${field}]` : observation[field];
+  return filtered;
+}
+
+export function privateProgressionState(state, patterns = [], projectDir) {
+  if (!patterns.length) return state;
+  for (const binding of [...(state.plan || []).map((item) => item?.id), state.evidence?.transcript?.path, state.evidence?.workLedger?.file]) {
+    if (typeof binding === 'string' && maskExcludedPaths(binding, patterns, projectDir) !== binding) throw new Error('content exclusion conflicts with immutable progression binding');
+  }
+  const result = { ...state };
+  for (const field of ['currentGoal', 'nextAction', 'acceptanceContract', 'completed', 'inProgress', 'blockers', 'failures',
+    'decisions', 'commands', 'untested', 'resumeConflicts']) {
+    if (Object.hasOwn(state, field)) result[field] = contentValue(state[field], patterns, projectDir);
+  }
+  for (const field of ['commands', 'failures']) if (Array.isArray(state[field])) result[field] = state[field].map((observation) => {
+    if (!observation || typeof observation !== 'object') return contentValue(observation, patterns, projectDir);
+    const filtered = contentValue(observation, patterns, projectDir);
+    if (pathIsExcluded(observation.filePath, patterns, projectDir) || String(observation.filePath || '').includes('[REDACTED:excluded-path]')
+      || typeof observation.command === 'string' && maskExcludedPaths(observation.command, patterns, projectDir) !== observation.command) {
+      if (observation.filePath) filtered.filePath = '[REDACTED:excluded-path]'; if (observation.command) filtered.command = '[REDACTED:excluded-resource-command]';
+      for (const output of ['stdout', 'stderr', 'result', 'error', 'signal']) if (Object.hasOwn(observation, output)) filtered[output] = '[REDACTED:excluded-resource-output]';
+    }
+    return filtered;
+  });
+  if (Array.isArray(state.observations)) result.observations = state.observations.map((observation) => privateTransitionObservation(observation, patterns, projectDir));
+  if (Array.isArray(state.changedFiles)) result.changedFiles = state.changedFiles.filter((file) =>
+    typeof file !== 'string' || !pathIsExcluded(file, patterns, projectDir));
+  return result;
+}
+
+export function captureFailureReason(result, status) {
+  if (result.error?.message) return redactText(result.error.message).slice(0, 300);
+  const lines = [result.stderr, result.stdout].filter((stream) => stream != null).join('\n').split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  const terminal = lines.findLast((line) => /(?:\[ERROR\]|\bfatal\b|\bError:|\bSQLITE_[A-Z_]+\b|refus(?:ing|ed))/i.test(line));
+  return redactText(terminal || lines.at(-1) || `ruflo exited ${status}`).slice(0, 300);
+}
+
+/** One notice per eligible canonical store; this is a cache marker, never a consent writer. */
+export function firstTurnCaptureNotice({ target, brainHome, policyFile, env }) {
+  if (target.skipped || String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() === 'off') return null;
+  const dir = path.join(brainHome, 'turn-capture', 'notices');
+  const file = path.join(dir, crypto.createHash('sha256').update(target.db).digest('hex'));
+  try {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const stat = fs.lstatSync(dir);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || fs.realpathSync.native(dir) !== dir) return null;
+    fs.writeFileSync(file, '', { flag: 'wx', mode: 0o600 });
+  } catch { return null; }
+  return `Turn outcome capture is enabled for this project: redacted assistant outcomes, changed files and command descriptions go to its AgentDB store; never raw user prompts. `
+    + `The breadcrumb contains hashes and lengths only. Project/path opt-out and contentPathExcludes are read live from ${policyFile}; `
+    + `set projects[${JSON.stringify(target.projectRoot)}] to "off" to opt out. Content exclusions accept rooted prefixes or simple * / ** globs and do not purge historical records.`;
+}

package/plugin/scripts/turn-outcome-capture.mjs

@@ -44,6 +44,7 @@ import { resolveRuflo, rufloInvocation } from './ruflo-bin.mjs';
 import { redactText, userLevelAgentdbHooks } from './continuity-events.mjs';
 import { resolveProjectStore } from './project-store-resolver.mjs';
 import { digest, journalTurn, readJournal, pendingTurnFiles, acknowledgeJournal, appendReceipt, storeData } from './turn-transport-journal.mjs';
+import { contentPathExcludes, pathIsExcluded, privateTurn, maskExcludedPaths, captureFailureReason, firstTurnCaptureNotice } from './turn-capture-privacy.mjs';
 
 export const TURN_NAMESPACE = 'turns';
 export const MIN_OUTCOME_CHARS = 200;
@@ -83,6 +84,7 @@ export function claudeTurn(lines) {
   const texts = [];
   const files = new Set();
   const actions = [];
+  const resources = []; const resourceTexts = [];
   for (const o of recs.slice(start)) {
     if ((o?.message?.role || o?.role) !== 'assistant') continue;
     const c = o.message?.content;
@@ -92,6 +94,8 @@ export function claudeTurn(lines) {
     for (const u of c) {
       if (!u || u.type !== 'tool_use') continue;
       const inp = u.input || {};
+      const resource = inp.file_path || inp.notebook_path || inp.path; if (typeof resource === 'string' && resource) resources.push(resource);
+      if (u.name === 'Bash' && typeof inp.command === 'string') resourceTexts.push(inp.command);
       if (['Edit', 'Write', 'MultiEdit', 'NotebookEdit'].includes(u.name)) {
         const f = inp.file_path || inp.notebook_path;
         if (typeof f === 'string' && f) files.add(f);
@@ -106,7 +110,7 @@ export function claudeTurn(lines) {
   // other assistant text is kept too, newest last, so the record still says what happened.
   const last = texts.length ? texts[texts.length - 1] : '';
   const finalText = last.length >= MIN_OUTCOME_CHARS ? last : texts.join('\n').slice(-2500);
-  return { finalText, files: [...files], actions };
+  return { finalText, files: [...files], actions, resources, resourceTexts };
 }
 
 function readTail(file, bytes = TRANSCRIPT_TAIL_BYTES) {
@@ -168,12 +172,15 @@ export function resolveTurnDb({ projectDir, brainHome, requestedStorePath, gitTi
       policy = JSON.parse(fs.readFileSync(file, 'utf8'));
       if (policy?.schemaVersion !== 1 || !consentMap(policy.projects)
         || (Object.hasOwn(policy, 'paths') && !consentMap(policy.paths))) throw new Error('invalid policy');
+      contentPathExcludes(policy.contentPathExcludes);
     } catch { return { skipped: 'turn capture policy unreadable or invalid', projectRoot: resolved.projectRoot }; }
   }
   // A path rule wins over a project rule, allowing a linked checkout/subdirectory to opt out.
   const setting = policy.paths?.[capturePath] ?? policy.projects?.[resolved.projectRoot];
   if (setting !== undefined && !['on', 'off'].includes(setting)) return { skipped: 'invalid turn capture consent', projectRoot: resolved.projectRoot };
   const db = resolved.canonicalAgentDbPath;
+  const exclusions = contentPathExcludes(policy.contentPathExcludes);
+  if ([db, capturePath].some((binding) => pathIsExcluded(binding, exclusions, capturePath))) return { skipped: 'content exclusion conflicts with canonical source/store binding', projectRoot: resolved.projectRoot };
   if (unknownOriginalPath && Object.entries(policy.paths || {}).some(([origin, choice]) => choice === 'off'
     && (origin === resolved.checkoutRoot || origin.startsWith(`${resolved.checkoutRoot}${path.sep}`)))) {
     return { db, scope: 'project', capturePath, projectRoot: resolved.projectRoot, skipped: 'capture origin cannot be verified under path opt-out' };
@@ -183,7 +190,8 @@ export function resolveTurnDb({ projectDir, brainHome, requestedStorePath, gitTi
   let exists = false;
   try { exists = fs.statSync(db).isFile(); } catch { /* absent */ }
   if (!exists && setting !== 'on') return { db, scope: 'project', capturePath, projectRoot: resolved.projectRoot, skipped: 'no project memory db; persisted opt-in required' };
-  return { db, scope: 'project', capturePath, projectRoot: resolved.projectRoot, optedIn: setting === 'on' };
+  return { db, scope: 'project', capturePath, projectRoot: resolved.projectRoot, optedIn: setting === 'on',
+    contentPathExcludes: exclusions };
 }
 
 // Revalidation narrows the queue-to-launch window; it does not make SQLite's later open atomic.
@@ -292,9 +300,10 @@ export function captureTurnOutcome({
       try { turn = claudeTurn(readTranscript(payload.transcript_path, { maxMs: message ? 0 : settleMs })); } catch { /* unreadable */ }
     }
     if (message && (message.length >= MIN_OUTCOME_CHARS || message.length >= turn.finalText.length)) turn.finalText = message;
+    turn = privateTurn(turn, target.contentPathExcludes, target.capturePath);
     if (!sessionKey) report.skipped = 'no session identity in the host payload';
     else if (turn.finalText.length < MIN_OUTCOME_CHARS && !turn.files.length) {
-      report.skipped = host === 'codex' && !message ? 'codex payload carried no last_assistant_message' : 'trivial turn';
+      report.skipped = turn.excludedResource ? 'turn content withheld: explicitly excluded resource' : host === 'codex' && !message ? 'codex payload carried no last_assistant_message' : 'trivial turn';
     } else {
       const fingerprint = crypto.createHash('sha256').update(JSON.stringify([turn.finalText, turn.files])).digest('hex');
       const stateFile = path.join(brainHome, 'turn-capture', 'last-turn.json');
@@ -365,7 +374,7 @@ export function runSteps({ steps = [], receipts } = {}, { run: suppliedRun = spa
   };
   const results = [];
   for (const queued of steps) {
-    let status = 1; let error = null; let verified = false; let db = ''; let key;
+    let status = 1; let error = null; let verified = false; let db = ''; let key; let privacyPatterns = [];
     const kind = queued.kind === 'journal' ? 'store' : queued.kind;
     try {
       if (String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() === 'off') throw new Error('RUVNET_TURN_CAPTURE=off');
@@ -373,6 +382,7 @@ export function runSteps({ steps = [], receipts } = {}, { run: suppliedRun = spa
       if (queued.kind !== 'journal' && (!queued.projectRoot || !queued.projectDir || !queued.brainHome)) throw new Error('queued step has no canonical project binding');
       const target = resolveTurnDb({ projectDir, brainHome, gitTimeoutMs: 1000 });
       if (target.skipped) throw new Error(target.skipped);
+      privacyPatterns = target.contentPathExcludes;
       db = target.db;
       let args; let value; let binding;
       if (kind === 'store') {
@@ -382,7 +392,8 @@ export function runSteps({ steps = [], receipts } = {}, { run: suppliedRun = spa
         if (data.legacyBrainHome && data.legacyBrainHome !== brainHome) throw new Error('queued consent settings differ from trusted caller');
         if (queued.kind !== 'journal' && queued.brainHome !== brainHome) throw new Error('queued consent settings differ from trusted caller');
         binding = queued.kind === 'journal' ? data.binding : queued;
-        key = data.key; value = redactText(data.value);
+        key = data.key; value = maskExcludedPaths(redactText(data.value), target.contentPathExcludes, target.capturePath);
+        if (value !== redactText(data.value)) throw new Error('content exclusions changed; immutable turn retained');
         args = ['memory', 'store', '-k', key, '--value', value, '-n', TURN_NAMESPACE, '--path', db, '--no-upsert', '--provenance', 'agent_output'];
       } else if (kind === 'distill') {
         if (queued.brainHome !== brainHome) throw new Error('queued consent settings differ from trusted caller');
@@ -420,9 +431,10 @@ export function runSteps({ steps = [], receipts } = {}, { run: suppliedRun = spa
       status = Number.isInteger(r.status) ? r.status : 1;
       if (kind === 'store' && !verified) verified = read({ ruflo, db, key, run, options }) === value;
       if (verified) status = 0;
-      if (!verified && (r.error || status !== 0)) error = redactText(r.error?.message || String(r.stderr || '').trim().split(/\r?\n/)[0] || `ruflo exited ${status}`).slice(0, 300);
+      if (!verified && (r.error || status !== 0)) error = captureFailureReason(r, status);
       else if (kind === 'store' && !verified) { status = 1; error = 'exact turn key/content readback failed'; }
     } catch (e) { status = 1; error = redactText(e.message).slice(0, 300); }
+    if (error) error = maskExcludedPaths(error, privacyPatterns, projectDir);
     const row = { at: new Date().toISOString(), kind, db: redactText(db), storeIdentity: digest(db), key, status, error,
       ...(kind === 'store' ? { verified } : {}) };
     results.push(row);
@@ -454,11 +466,14 @@ export function replayTurnQueue({ projectDir = process.cwd(), env = process.env,
 }
 
 /** Bounded recent evidence, isolated by canonical db. A continuity success cannot mask turn failures. */
-export function turnRecordingStatus({ projectDir = process.cwd(), env = process.env, home = os.homedir(), now = Date.now() } = {}) {
+export function turnRecordingStatus({ projectDir = process.cwd(), env = process.env, home = os.homedir(), now = Date.now(), noticeOnFirstUse = false } = {}) {
   const brainHome = env.RUVNET_BRAIN_HOME || path.join(home, '.cache', 'ruvnet-brain');
   let target;
   try { target = resolveTurnDb({ projectDir, brainHome }); } catch { return { state: 'unknown', line: 'turn recording unavailable: canonical store resolution failed' }; }
   if (String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() === 'off' || target.skipped) return { state: 'unknown', line: `turn recording n/a — ${target.skipped || 'RUVNET_TURN_CAPTURE=off'}` };
+  const deferred = String(env.RUVNET_HOOK_HOST || 'claude') === 'claude' && String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() !== 'force' && userLevelAgentdbHooks({ home }).turnCapture;
+  const notice = noticeOnFirstUse && !deferred ? firstTurnCaptureNotice({ target, brainHome, policyFile: turnCapturePolicyFile(brainHome), env }) : null;
+  const status = (value) => ({ ...value, ...(notice ? { notice } : {}) });
   let rows = [];
   try {
     rows = readTail(path.join(brainHome, 'turn-capture', 'receipts.jsonl'), 128 * 1024).flatMap((line) => {
@@ -467,14 +482,14 @@ export function turnRecordingStatus({ projectDir = process.cwd(), env = process.
   } catch { /* first run */ }
   rows = [...new Map(rows.map((row) => [row.key || row.at, row])).values()];
   let pending = 0;
-  try { pending = pendingTurnFiles(target.db, 25).length; } catch { return { state: 'warn', line: 'turn recording durable queue unsafe or unreadable' }; }
+  try { pending = pendingTurnFiles(target.db, 25).length; } catch { return status({ state: 'warn', line: 'turn recording durable queue unsafe or unreadable' }); }
   const historical = rows.filter((r) => r.status === 0 && r.verified === undefined);
   const failed = rows.filter((r) => r.status !== 0 || r.verified === false);
-  if (failed.length) return { state: 'warn', line: `turn recording failing ${failed.length}/${rows.length} — ${redactText(failed.at(-1).error || 'write has no exact readback evidence').slice(0, 300)}` };
-  if (historical.length) return { state: 'unknown', line: `turn recording unverified historical (${historical.length} receipts without exact readback evidence)` };
-  if (pending) return { state: 'unknown', line: `turn recording pending durable replay (${pending} entries); not yet proven` };
-  return rows.length ? { state: 'ok', line: `turn recording ✓ (${rows.length}/${rows.length} exact readbacks)` }
-    : { state: 'unknown', line: 'turn recording not yet proven — no exact readback receipt' };
+  if (failed.length) return status({ state: 'warn', line: `turn recording failing ${failed.length}/${rows.length} — ${redactText(failed.at(-1).error || 'write has no exact readback evidence').slice(0, 300)}` });
+  if (historical.length) return status({ state: 'unknown', line: `turn recording unverified historical (${historical.length} receipts without exact readback evidence)` });
+  if (pending) return status({ state: 'unknown', line: `turn recording pending durable replay (${pending} entries); not yet proven` });
+  return status(rows.length ? { state: 'ok', line: `turn recording ✓ (${rows.length}/${rows.length} exact readbacks)` }
+    : { state: 'unknown', line: 'turn recording not yet proven — no exact readback receipt' });
 }
 
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url) && process.argv[2] === '--run-steps') {

package/plugin/scripts/user-settings.mjs

@@ -34,6 +34,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { normalizeGroundingScope } from './ruvnet-gate1-pattern.mjs';
 
 const HOME = os.homedir();
 
@@ -104,6 +105,23 @@ export const SETTINGS_SCHEMA = Object.freeze([
     downside: 'Off, answers about rUv\'s ecosystem are no longer grounded in his source and nothing warns you when they drift, the write-path grounding gate stops enforcing, and nothing is learned from this or any later session until you switch it back on. Updates and health alarms keep running while it is off, which the console states plainly rather than hiding.',
   }),
 
+  Object.freeze({
+    key: 'updateSource', label: 'Code source used by explicitly requested updates',
+    type: 'enum', options: Object.freeze(['latest', 'installed']), default: 'latest',
+    escalates: Object.freeze([]),
+    help: 'Latest uses the published updater; installed explicitly uses the verified installed updater.',
+    whyItMatters: 'This user-owned preference selects updater code, not corpus freshness or search scope. Consumers must read the canonical user settings path, never project overrides.',
+    downside: 'Installed mode may retain older updater code; if that updater is unavailable or invalid it must report failure rather than silently download or switch sources.',
+  }),
+
+  Object.freeze({
+    key: 'groundingScope', label: 'Products that trigger conversational grounding',
+    type: 'product-list', default: 'all', escalates: Object.freeze([]),
+    help: 'All products, or a nonempty list such as ["ruvector", "metaharness"]. RuVector includes RVF and ruvector-postgres.',
+    whyItMatters: 'Only narrows prompt grounding directives and corresponding Stop checks. Search still accesses the installed corpus. Independent write and managed-memory safety guards remain active.',
+    downside: 'Excluded product claims are not forced through Brain grounding; verify your fork against its own sources. Unknown, malformed or empty lists use all products.',
+  }),
+
   Object.freeze({
     key: 'brainProfile',
     label: 'How much of the brain is installed',
@@ -289,7 +307,11 @@ export function validate(input) {
       warnings.push({ key, reason: 'not a known setting — ignored' });
       continue;
     }
-    if (entry.type === 'bool') {
+    if (entry.type === 'product-list') {
+      const scope = normalizeGroundingScope(raw);
+      if (!scope.ok) { errors.push({ key, reason: 'expected all or a nonempty list of known product terms — using all' }); continue; }
+      values[key] = scope.value;
+    } else if (entry.type === 'bool') {
       if (typeof raw !== 'boolean') { errors.push({ key, reason: `expected true or false, got ${JSON.stringify(raw)} — using the default (${entry.default})` }); continue; }
       values[key] = raw;
     } else if (entry.type === 'enum') {

package/scripts/brain-grade-groundtruth.mjs

@@ -87,6 +87,7 @@ const mean = (k) => valid.reduce((s, r) => s + r[k], 0) / valid.length;
 const minK = (k) => Math.min(...valid.map(r => r[k]));
 const gtFail = report.filter(r => !r.groundTruthPathExists).length;
 const summary = {
+  generatedAt: new Date().toISOString(),
   name: NAME, variant: VARIANT, questions: questions.length, models: MODELS,
   avgStrict: +mean('avgStrict').toFixed(2), avgRealUse: +mean('avgRealUse').toFixed(2),
   minStrict: minK('avgStrict'), minRealUse: minK('avgRealUse'),

package/scripts/brain-score.mjs

@@ -116,9 +116,10 @@ function readJson(rel) {
  * tracked file's mtime to "now", so a panel graded weeks ago read as freshly current on any new
  * clone — the exact false-freshness failure this whole gate exists to prevent (see the file header:
  * "grounded 100/100... recorded 2026-07-10... quoted as current"). Each grader-produced file's own
- * `summary.generatedAt` (when present) is now preferred; checkout mtime is used only as a fallback
- * for older panels that predate the stamp, so this cannot regress a panel that never recorded one.
- * `dir` is overridable so a fixture test can exercise this without touching the real `data/` panel.
+ * `summary.generatedAt` dates each contributing score. Missing/invalid stamps leave the
+ * aggregate undated; otherwise the oldest contributor controls its currency. Checkout times
+ * cannot establish when a panel ran.
+ * `dir` is overridable so fixtures need not touch the real `data/` panel.
  */
 export function readPanel(dir = path.join(ROOT, 'data')) {
   let files = [];
@@ -127,17 +128,16 @@ export function readPanel(dir = path.join(ROOT, 'data')) {
     let j = null;
     try { j = JSON.parse(fs.readFileSync(path.join(dir, f), 'utf8')); } catch { /* unreadable/absent */ }
     return { f, j };
-  }).filter((r) => r.j?.summary);
+  }).filter((r) => Number.isFinite(r.j?.summary?.avgStrict));
   if (!rows.length) return { value: null, detail: null, at: null };
   const strict = rows.map((r) => r.j.summary.avgStrict).filter(Number.isFinite);
   if (!strict.length) return { value: null, detail: null, at: null };
-  const at = rows
-    .map((r) => {
-      const recorded = r.j.summary.generatedAt;
-      if (typeof recorded === 'string' && Number.isFinite(Date.parse(recorded))) return new Date(recorded).toISOString();
-      try { return fs.statSync(path.join(dir, r.f)).mtime.toISOString(); } catch { return null; }
-    })
-    .filter(Boolean).sort().pop();
+  const stamps = rows.map((r) => {
+    const recorded = r.j.summary.generatedAt;
+    return typeof recorded === 'string' && Number.isFinite(Date.parse(recorded))
+      ? new Date(recorded).toISOString() : null;
+  });
+  const at = stamps.every(Boolean) ? stamps.sort()[0] : null;
   return {
     value: Math.round((strict.reduce((a, b) => a + b, 0) / strict.length) * 10) / 10,
     detail: `${strict.length} store(s) graded`,

package/scripts/issue-watch.mjs

@@ -150,16 +150,19 @@ export async function run({ dryRun = false, now = Date.now(), repo = REPO } = {}
     // lastAlertAt: state is only written when the push actually went out, so a failed push
     // retries next run instead of burying the sighting.
     const firstSighting = !state[key];
+    // Acknowledgment delivery is not page delivery. Retry each missing channel independently.
+    const needsNewPage = !state[key]?.newAlertAt;
+    const needsAck = !state[key]?.ackAt;
 
     results.push({ number: issue.number, title: issue.title, ageHours, ownerComment, breach, dueForAlert, firstSighting, url });
 
-    if (firstSighting) {
+    if (needsNewPage || needsAck) {
       if (dryRun) {
         alertsSent.push({ number: issue.number, sent: false, kind: 'new-issue', reason: 'dry-run' });
       } else {
-        const topic = resolveTopic();
-        let sent = false;
-        if (topic) sent = await pushNtfy(topic, {
+        const topic = needsNewPage ? resolveTopic() : null;
+        let sent = !needsNewPage;
+        if (needsNewPage && topic) sent = await pushNtfy(topic, {
           title: `New issue #${issue.number} (open ${fmtAge(ageHours)})`,
           body: `${issue.title}\n${url}`,
           priority: 'high', tags: 'new,eyes',
@@ -171,12 +174,20 @@ export async function run({ dryRun = false, now = Date.now(), repo = REPO } = {}
         // not caring — the opposite of the point). Carries BOT_MARKER so judgeIssue() can never
         // mistake it for the owner responding. Best-effort like ntfy: a comment failure must not
         // break the watch; unacked issues simply retry next run (ackAt is delivery-derived).
-        let ackAt = null;
-        const ackBody = `🤖 Automated acknowledgment — received and opened. The maintainer has been paged and this is being worked. The next update here will be a fix, findings, or the maintainer in person.`;
-        const ack = spawnSync(GH_BIN, ['issue', 'comment', String(issue.number), '--repo', repo, '--body', ackBody], { encoding: 'utf8' });
-        if (ack.status === 0) ackAt = new Date(now).toISOString();
-        if (sent || ackAt) state[key] = { firstSeenAt: new Date(now).toISOString(), ...(sent ? { newAlertAt: new Date(now).toISOString() } : {}), ...(ackAt ? { ackAt } : {}), title: issue.title, url };
-        alertsSent.push({ number: issue.number, sent, acked: Boolean(ackAt), kind: 'new-issue', reason: topic ? null : 'no ntfy topic configured' });
+        let acked = !needsAck;
+        if (needsAck) {
+          const ackBody = `${BOT_MARKER} acknowledgment — received and opened. The next update here will be a fix, findings, or the maintainer in person.`;
+          const ack = spawnSync(GH_BIN, ['issue', 'comment', String(issue.number), '--repo', repo, '--body', ackBody], { encoding: 'utf8' });
+          acked = ack.status === 0;
+        }
+        if (sent || acked) state[key] = {
+          ...(state[key] || {}), firstSeenAt: state[key]?.firstSeenAt || new Date(now).toISOString(),
+          ...(needsNewPage && sent ? { newAlertAt: new Date(now).toISOString() } : {}),
+          ...(needsAck && acked ? { ackAt: new Date(now).toISOString() } : {}), title: issue.title, url,
+        };
+        alertsSent.push({ number: issue.number, sent, acked, kind: 'new-issue',
+          pageAttempted: needsNewPage, ackAttempted: needsAck,
+          reason: needsNewPage && !topic ? 'no ntfy topic configured' : null });
       }
     }
 

package/scripts/model-weekly-cycle.mjs

@@ -36,16 +36,50 @@ function writeOwned(dir, token, file, value) { const committed = transaction(dir
 function release(dir, token) { transaction(dir, () => { if (json(dir, ownerFile, 4096)?.token === token) fs.unlinkSync(path.join(dir, ownerFile)); }); }
 export function runCycleStage({ script, args, timeoutMs, env, spawnHost = spawn }) {
   return new Promise((resolve, reject) => {
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 900000) throw new Error('Invalid weekly stage deadline');
+    const deadline = performance.now() + timeoutMs, retirementMs = Math.min(1000, timeoutMs / 10);
+    const workDeadline = deadline - retirementMs;
     const child = spawnHost(process.execPath, [path.join(DIR, script), ...args], { env, shell: false, stdio: ['ignore', 'pipe', 'pipe'] });
-    let stdout = '', timedOut = false, killTimer;
-    const timer = setTimeout(() => { timedOut = true; child.kill('SIGTERM'); killTimer = setTimeout(() => child.kill('SIGKILL'), 1000); }, timeoutMs);
-    child.stderr.on('data', () => {}); child.stdout.on('data', (d) => { stdout += d; if (stdout.length > 262144) { timedOut = true; child.kill('SIGKILL'); } });
-    child.once('error', () => { clearTimeout(timer); clearTimeout(killTimer); reject(new Error('Weekly cycle child host unavailable')); });
-    child.once('exit', (code) => { clearTimeout(timer); clearTimeout(killTimer);
-      if (timedOut) return reject(new Error('Weekly cycle child exceeded bounded deadline or output limit'));
-      let result; try { result = JSON.parse(stdout.trim().split('\n').at(-1)); } catch { return reject(new Error('Weekly cycle child receipt missing')); }
-      resolve({ code, result });
+    let stdout = '', outputBytes = 0, failure, settled = false, exitObserved = false;
+    let timer, killTimer, retirementTimer;
+    const kill = (signal) => { try { child.kill(signal); } catch { /* owned child retirement remains unverified */ } };
+    const finish = (error, value) => {
+      if (settled) return; settled = true;
+      clearTimeout(timer); clearTimeout(killTimer); clearTimeout(retirementTimer);
+      // Drop only our child's referenced handles, including pipes held open after its exit.
+      // Signals/exit cannot prove detached descendants retired.
+      for (const stream of [child.stdin, child.stdout, child.stderr]) { try { stream?.destroy?.(); } catch { /* best effort */ } }
+      try { child.unref?.(); } catch { /* best effort */ }
+      if (error) {
+        error.stageCleanup = { ownedChildPid: child.pid ?? null, childExitObserved: exitObserved,
+          ownedChildRetirement: exitObserved ? 'exit-observed' : 'unverified', descendantRetirement: 'unproven' };
+        reject(error);
+      } else resolve(value);
+    };
+    const fail = (reason) => {
+      if (settled || failure) return; failure = new Error(reason);
+      // Reserve retirement inside the caller's budget; do not wait indefinitely for exit/close.
+      const remaining = Math.max(0, Math.min(retirementMs, deadline - performance.now()));
+      killTimer = setTimeout(() => kill('SIGKILL'), remaining / 2);
+      retirementTimer = setTimeout(() => finish(failure), remaining);
+      kill('SIGTERM');
+    };
+    const consume = (chunk, capture) => {
+      if (settled || failure) return;
+      if (performance.now() >= workDeadline) return fail('Weekly cycle child exceeded bounded deadline or output limit');
+      outputBytes += Buffer.isBuffer(chunk) ? chunk.length : Buffer.byteLength(String(chunk));
+      if (outputBytes > 262144) return fail('Weekly cycle child exceeded bounded deadline or output limit');
+      if (capture) stdout += chunk;
+    };
+    child.stderr.on('data', (chunk) => consume(chunk, false)); child.stdout.on('data', (chunk) => consume(chunk, true));
+    child.on('error', () => fail('Weekly cycle child host unavailable'));
+    child.once('exit', (code) => {
+      exitObserved = true; if (failure) return finish(failure); if (settled) return;
+      if (performance.now() >= workDeadline) { fail('Weekly cycle child exceeded bounded deadline or output limit'); return finish(failure); }
+      let result; try { result = JSON.parse(stdout.trim().split('\n').at(-1)); } catch { return finish(new Error('Weekly cycle child receipt missing')); }
+      finish(null, { code, result });
     });
+    timer = setTimeout(() => fail('Weekly cycle child exceeded bounded deadline or output limit'), Math.max(0, workDeadline - performance.now()));
   });
 }
 const INVENTORY_URL = 'https://openrouter.ai/api/v1/models';
@@ -172,7 +206,9 @@ export async function runWeeklyCycle({ routerDir = path.join(os.homedir(), '.cla
     delete state.pendingSemanticReceipt; delete state.pendingSemanticReleaseIds;
     state.lastQualification = qualified.result; save(STATE_FILE, state); record.status = 'complete';
     save('weekly-cycle-last-attempt.json', record); return record;
-  } catch (error) { record.status = 'failed'; record.releaseStatus = 'unknown-or-pending'; record.reason = error.message.slice(0, 240); try { save('weekly-cycle-last-attempt.json', record); } catch { /* superseded cannot write */ } return record;
+  } catch (error) { record.status = 'failed'; record.releaseStatus = 'unknown-or-pending'; record.reason = error.message.slice(0, 240);
+    if (error.stageCleanup) record.stageCleanup = error.stageCleanup;
+    try { save('weekly-cycle-last-attempt.json', record); } catch { /* superseded cannot write */ } return record;
   } finally { release(routerDir, token); }
 }
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {