ruvnet-brain 4.6.1 → 4.6.3

package/plugin/scripts/project-memory-enrollment.mjs

@@ -0,0 +1,203 @@
+/** Consent-gated lazy enrollment. Hooks queue derived events before a detached native bootstrap. */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { spawn, spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { resolveProjectStore, globalEnrollmentAllowed } from './project-store-resolver.mjs';
+import { resolveTurnDb, turnCapturePolicyFile } from './turn-outcome-capture.mjs';
+import { resolveRuflo, rufloInvocation } from './ruflo-bin.mjs';
+import { redactText } from './continuity-events.mjs';
+import { enrichStateWithObservation } from './project-progression-hook.mjs';
+import { redactProgression } from './project-progression-contract.mjs';
+import { normalizeHostEvent } from './hook-input.mjs';
+import { maskExcludedPaths, privateProgressionState } from './turn-capture-privacy.mjs';
+
+const canonical = (value) => { try { return fs.realpathSync.native(value); } catch { return path.resolve(value); } };
+export const ENROLLMENT_NAMESPACE = 'project-enrollment';
+const receiptName = '.memory-enrollment.json';
+const queueName = '.memory-enrollment-pending';
+
+export function enrollmentPlan({ projectDir, env = process.env, deadlineAt = Infinity,
+  temporaryRoots = [os.tmpdir(), '/tmp', '/private/tmp'], systemRoots = ['/System', '/Library', '/usr', '/etc', '/var', '/private/var', '/proc', '/sys', '/dev'] } = {}) {
+  const home = canonical(env.HOME || env.USERPROFILE || os.homedir());
+  const brainHome = canonical(env.RUVNET_BRAIN_HOME || path.join(home, '.cache', 'ruvnet-brain'));
+  const resolution = resolveProjectStore({ projectDir, gitTimeoutMs: 500, deadlineAt });
+  // The consent guard and the plan must agree on which roots are excluded from default enrollment.
+  const consent = resolveTurnDb({ projectDir, brainHome, gitTimeoutMs: 500, deadlineAt, enrollmentRoots: { temporaryRoots, systemRoots } });
+  if (consent.skipped) return { ...resolution, state: 'disabled', reason: consent.skipped };
+  let policy = {};
+  try { policy = JSON.parse(fs.readFileSync(turnCapturePolicyFile(brainHome), 'utf8')); } catch { /* resolveTurnDb validates any present policy */ }
+  const explicit = policy.paths?.[canonical(projectDir)] ?? policy.projects?.[resolution.projectRoot];
+  const hasDb = fs.existsSync(resolution.canonicalAgentDbPath);
+  // RUVNET_TURN_CAPTURE=off means turn capture is off: it never creates a store. (It does not suspend progression or
+  // continuity capture on an existing store; queueBoundary additionally withholds the assistant text while it is off.)
+  if (!hasDb && String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() === 'off') return { ...resolution, state: 'disabled', reason: 'RUVNET_TURN_CAPTURE=off' };
+  if (!hasDb && explicit !== 'on') {
+    if (resolution.kind !== 'git') return { ...resolution, state: 'disabled', reason: 'non-Git enrollment requires explicit project opt-in' };
+    if (!globalEnrollmentAllowed({ resolution, home, brainHome, temporaryRoots, systemRoots })) {
+      return { ...resolution, state: 'disabled', reason: 'global enrollment excludes home, temporary, system and Brain cache roots' };
+    }
+  }
+  let enrollmentPending = false;
+  const receipt = path.join(resolution.projectRoot, '.swarm', receiptName);
+  if (fs.existsSync(receipt)) {
+    const stat = fs.lstatSync(receipt);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) throw new Error('unsafe enrollment receipt');
+    // An unparsable receipt is a torn write from a killed hook: it means "not ready", never "unavailable forever".
+    try { enrollmentPending = JSON.parse(fs.readFileSync(receipt, 'utf8')).state === 'pending'; } catch { enrollmentPending = true; }
+  }
+  return { ...resolution, state: hasDb && !enrollmentPending ? 'existing' : 'pending', brainHome, contentPathExcludes: consent.contentPathExcludes || [] };
+}
+
+/** Create-if-absent. A hook killed mid-write leaves a torn FINAL file, which every reader tolerates (an unparsable
+ * receipt means pending; an unparsable queue entry is preserved as .corrupt). No hard-link or rename dance: a link
+ * window leaves nlink 2 on a killed hook, which the readers' nlink check would then reject forever. */
+function createExclusive(file, text) {
+  let fd;
+  try { fd = fs.openSync(file, 'wx', 0o600); } catch (error) { if (error.code === 'EEXIST') return; throw error; }
+  try { fs.writeFileSync(fd, text); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+}
+
+function safeDirectory(directory) {
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  const stat = fs.lstatSync(directory);
+  if (!stat.isDirectory() || stat.isSymbolicLink() || canonical(directory) !== directory) throw new Error('enrollment directory is not canonical');
+}
+
+/** Only a small derived outcome is queued; never prompts, transcripts, tool input or environment. */
+function queueBoundary(plan, { event, payload, host, projectDir, env = process.env }) {
+  if (!event || typeof payload?.session_id !== 'string' || !payload.session_id) return false;
+  const directory = path.join(plan.projectRoot, '.swarm', queueName);
+  safeDirectory(directory);
+  const turnCaptureOff = String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() === 'off';
+  const text = turnCaptureOff ? '' : String(payload.last_assistant_message || '');
+  const filtered = maskExcludedPaths(text, plan.contentPathExcludes, projectDir);
+  const last = filtered === text ? redactText(text).slice(0, 12000) : '[REDACTED:excluded-resource-outcome]';
+  const normalized = normalizeHostEvent(payload) || payload;
+  const observed = enrichStateWithObservation({ commands: [] }, { ...normalized, hook_event_name: event },
+    { contentPathExcludes: plan.contentPathExcludes, projectDir }).commands[0];
+  const tool = observed ? { tool_name: redactText(observed.tool), tool_input: {
+    ...(observed.command ? { command: redactText(observed.command) } : {}),
+    ...(observed.filePath ? { file_path: redactText(observed.filePath) } : {}) },
+    tool_response: JSON.parse(redactText(JSON.stringify(Object.fromEntries(Object.entries(observed)
+      .filter(([key]) => ['outcome', 'exitCode', 'error', 'signal', 'interrupted', 'isError', 'stdout', 'stderr', 'result'].includes(key)))))) } : {};
+  let strategic = {};
+  if (payload.projectProgression || payload.project_progression) {
+    const extension = redactProgression(payload.projectProgression || payload.project_progression).value;
+    extension.completeProjectState = privateProgressionState(extension.completeProjectState, plan.contentPathExcludes, projectDir);
+    strategic = { projectProgression: extension };
+  }
+  const boundary = { projectDir: canonical(projectDir), event, host,
+    payload: { session_id: payload.session_id, hook_event_name: event, ...tool, ...strategic, ...(last ? { last_assistant_message: last } : {}) } };
+  const digest = crypto.createHash('sha256').update(JSON.stringify(boundary)).digest('hex');
+  const file = path.join(directory, `${digest}.json`);
+  createExclusive(file, JSON.stringify(boundary));
+  const dirFd = fs.openSync(directory, 'r'); try { fs.fsyncSync(dirFd); } finally { fs.closeSync(dirFd); }
+  return true;
+}
+
+export function ensureProjectMemory({ projectDir, env = process.env, event, payload, host = env.RUVNET_HOOK_HOST || 'claude', deadlineAt = Infinity,
+  launch = launchEnrollment, planOptions = {} } = {}) {
+  try {
+    const plan = enrollmentPlan({ ...planOptions, projectDir, env, deadlineAt });
+    if (plan.state === 'disabled') return plan;
+    if (plan.state === 'existing') {
+      const queue = path.join(plan.projectRoot, '.swarm', queueName);
+      if (!fs.existsSync(queue) || !fs.readdirSync(queue).some((name) => /^[a-f0-9]{64}\.json$/.test(name))) return plan;
+    }
+    safeDirectory(path.join(plan.projectRoot, '.swarm'));
+    if (plan.state === 'pending') {
+      const receipt = path.join(plan.projectRoot, '.swarm', receiptName);
+      createExclusive(receipt, JSON.stringify({ schemaVersion: 1, state: 'pending', canonicalAgentDbPath: plan.canonicalAgentDbPath }));
+    }
+    const queued = plan.state === 'pending' && queueBoundary(plan, { event, payload, host, projectDir, env });
+    const launched = launch({ projectDir, env });
+    return { ...plan, state: plan.state === 'existing' ? 'existing' : 'pending', queued, launched };
+  } catch (error) { return { state: 'unavailable', reason: error.message }; }
+}
+
+export function launchEnrollment({ projectDir, env }) {
+  const child = spawn(process.execPath, [fileURLToPath(import.meta.url), '--enroll', canonical(projectDir)], {
+    cwd: os.tmpdir(), env: { ...env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_MEMORY_PATH: undefined }, detached: true, windowsHide: true, stdio: 'ignore',
+  });
+  child.unref();
+  return Boolean(child.pid);
+}
+
+/** Exact native append and same-path readback; existing stores are never initialized or replaced. */
+export async function enrollProjectMemory({ projectDir, env = process.env, run = spawnSync, replay } = {}) {
+  const plan = enrollmentPlan({ projectDir, env });
+  if (plan.state === 'disabled') return plan;
+  const swarm = path.join(plan.projectRoot, '.swarm');
+  safeDirectory(swarm);
+  const lock = path.join(swarm, '.memory-enrollment.lock');
+  const token = `${process.pid} ${crypto.randomUUID()}`;
+  try { fs.writeFileSync(lock, token, { flag: 'wx', mode: 0o600 }); } catch (error) {
+    if (error.code !== 'EEXIST') throw error;
+    const stat = fs.lstatSync(lock);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) return { ...plan, state: 'pending', reason: 'unsafe enrollment lock' };
+    const previous = fs.readFileSync(lock, 'utf8');
+    const pid = Number(previous.split(' ')[0]);
+    let dead = false;
+    if (Number.isSafeInteger(pid) && pid > 0) try { process.kill(pid, 0); } catch (failure) { dead = failure.code === 'ESRCH'; }
+    if (!dead || fs.readFileSync(lock, 'utf8') !== previous) return { ...plan, state: 'pending', reason: 'enrollment worker busy' };
+    fs.unlinkSync(lock);
+    try { fs.writeFileSync(lock, token, { flag: 'wx', mode: 0o600 }); } catch { return { ...plan, state: 'pending', reason: 'enrollment worker busy' }; }
+  }
+  const workerDeadlineAt = Date.now() + 60000;
+  const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'rnb-enrollment-worker-'));
+  try {
+    const binary = resolveRuflo({ env, home: env.HOME || os.homedir() });
+    if (!binary) return { ...plan, state: 'pending', reason: 'global Ruflo unavailable' };
+    const key = `project-bootstrap-${plan.projectIdentity.id}`;
+    const value = JSON.stringify({ schemaVersion: 1, projectIdentity: plan.projectIdentity });
+    const invoke = (args) => { const call = rufloInvocation(binary, args); return run(call.executable, call.args,
+      { cwd: scratch, env: { ...env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_MEMORY_PATH: undefined }, encoding: 'utf8', timeout: Math.max(1, Math.min(30000, workerDeadlineAt - Date.now())), maxBuffer: 256 * 1024, shell: false }); };
+    if (plan.state !== 'existing') {
+      invoke(['memory', 'store', '--key', key, '--value', value, '--namespace', ENROLLMENT_NAMESPACE,
+        '--path', plan.canonicalAgentDbPath, '--require-native', '--append-only', '--no-upsert', '--no-embedding']);
+      // Concurrent workers may lose the strict insertion race; exact readback still establishes readiness.
+      const result = invoke(['memory', 'retrieve', '--key', key, '--namespace', ENROLLMENT_NAMESPACE,
+        '--path', plan.canonicalAgentDbPath, '--value-only']);
+      if (result.status !== 0 || String(result.stdout || '').trim() !== value) return { ...plan, state: 'pending', reason: 'native bootstrap readback unavailable' };
+      const receipt = path.join(swarm, receiptName);
+      const temporary = `${receipt}.${crypto.randomUUID()}.tmp`;
+      fs.writeFileSync(temporary, JSON.stringify({ schemaVersion: 1, state: 'ready', key,
+        canonicalAgentDbPath: plan.canonicalAgentDbPath, verifiedAt: new Date().toISOString() }), { flag: 'wx', mode: 0o600 });
+      fs.renameSync(temporary, receipt);
+    }
+    const queue = path.join(swarm, queueName);
+    if (fs.existsSync(queue)) {
+      safeDirectory(queue);
+      const capture = replay || (await import('./session-snapshot-hook.mjs')).runSessionSnapshotHook;
+      for (const name of fs.readdirSync(queue).filter((name) => /^[a-f0-9]{64}\.json$/.test(name)).slice(0, 32)) {
+        if (Date.now() > workerDeadlineAt - 8000) break;
+        const file = path.join(queue, name);
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > 256000) continue;
+        let boundary;
+        try { boundary = JSON.parse(fs.readFileSync(file, 'utf8')); } catch {
+          // Preserve the evidence, stop it blocking every later replay.
+          try { fs.renameSync(file, `${file}.corrupt`); } catch { /* retry next boundary */ }
+          continue;
+        }
+        // Original path privacy is rechecked, never replaced by the primary worktree identity.
+        const consent = enrollmentPlan({ projectDir: boundary.projectDir, env });
+        if (consent.state === 'disabled' || consent.canonicalAgentDbPath !== plan.canonicalAgentDbPath) continue;
+        const result = capture(boundary.projectDir, boundary.event, { rawInput: JSON.stringify(boundary.payload), host: boundary.host,
+          env, enrollMemory: () => ({ state: 'existing' }) });
+        if (result?.turn?.queued || result?.turn?.recorded || result?.continuity?.recorded > 0 || result?.progressionCaptured || result?.deferredToReplayer) fs.unlinkSync(file);
+      }
+    }
+    return { ...plan, state: 'ready' };
+  } finally {
+    fs.rmSync(scratch, { recursive: true, force: true });
+    try { if (fs.readFileSync(lock, 'utf8') === token) fs.unlinkSync(lock); } catch { /* ownership changed */ }
+  }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url) && process.argv[2] === '--enroll') {
+  enrollProjectMemory({ projectDir: process.argv[3] }).catch(() => { /* pending queue survives; retry at the next boundary */ });
+}

package/plugin/scripts/project-progression-reader.mjs

@@ -43,8 +43,8 @@
 import fs from 'node:fs';
 import { loadNodeSqlite } from './node-sqlite.mjs';
 
-/** Rows that `ruflo memory` itself considers live (memory-initializer.js ACTIVE_MEMORY_ROW_SQL). */
-const ACTIVE_ROW_SQL = "(status = 'active' OR status IS NULL)";
+/** Installed Ruflo live-memory-row.js visibility; bind current time on every read. */
+const ACTIVE_ROW_SQL = "(status = 'active' OR status IS NULL) AND (expires_at IS NULL OR expires_at > ?)";
 
 /**
  * Every SQLite database file begins with this 16-byte header (sqlite.org/fileformat.html §1.3):
@@ -224,7 +224,7 @@ export function openProgressionReader(dbPath, { deadlineAt = Infinity, signal }
   }
 
   const query = (statement, params) => {
-    try { return statement.all(...params); } catch (error) {
+    try { return statement.all(Date.now(), ...params); } catch (error) {
       throw new ProgressionReaderUnavailable(`read failed: ${error.message}`);
     }
   };
@@ -236,7 +236,7 @@ export function openProgressionReader(dbPath, { deadlineAt = Infinity, signal }
       if (!Number.isSafeInteger(maxEntries) || maxEntries < 1) throw new TypeError('maxEntries must be a positive safe integer');
       let rows = [];
       if (Number.isFinite(deadlineAt) || signal) {
-        for (const row of listStatement.iterate(namespace)) {
+        for (const row of listStatement.iterate(Date.now(), namespace)) {
           checkDeadline(); rows.push(row);
           if (rows.length > maxEntries) throw new Error('progression enumeration exceeds its bound');
         }

package/plugin/scripts/project-progression-session-start.mjs

@@ -124,29 +124,6 @@ function resultText(result, field) {
   return Buffer.isBuffer(value) ? value.toString('utf8') : String(value ?? '');
 }
 
-function initializeCanonicalStore(store, resolution) {
-  const key = 'project-continuity-bootstrap-v1';
-  const namespace = 'project-progression-control';
-  const value = JSON.stringify({
-    schema: 'ruvnet-brain.project-continuity-bootstrap',
-    schemaVersion: 1,
-    projectIdentity: resolution.projectIdentity,
-  });
-  store.run([
-    'memory', 'store', '--key', key, '--value', value,
-    '--namespace', namespace, '--no-upsert', '--provenance', 'system_observation',
-    '--path', resolution.canonicalAgentDbPath,
-  ]);
-  const readback = store.run([
-    'memory', 'retrieve', '--key', key, '--namespace', namespace,
-    '--value-only', '--path', resolution.canonicalAgentDbPath,
-  ]);
-  if (resultStatus(readback) !== 0 || resultText(readback, 'stdout') !== value
-    || !fs.existsSync(resolution.canonicalAgentDbPath)) {
-    throw new Error('canonical AgentDB initialization failed');
-  }
-}
-
 /**
  * One line, only when there is something to say. Durable-but-uncommitted snapshots are evidence the
  * session must know about: they will be committed at the next capture boundary, and until then the
@@ -267,10 +244,13 @@ export function restoreProgressionForSession({
       const failed = miss('outbox-replay');
       return { ...failed, context: `${failed.context} Replay is suspended by capture consent; no older checkpoint was injected.` };
     }
-    if (initializing) {
-      fs.mkdirSync(path.dirname(resolution.canonicalAgentDbPath), { recursive: true, mode: 0o700 });
-      initializeCanonicalStore(store, resolution);
-    }
+    // ADR-105 rule 6: restoring a session never creates a store. A project's store is created only by the
+    // consent-gated native enrollment (project-memory-enrollment.mjs), never by SessionStart and never when
+    // consent is absent or RUVNET_TURN_CAPTURE=off.
+    if (initializing) return {
+      status: 'unavailable', reason: 'not-enrolled', severity: 'info',
+      context: '[RuvNet Brain — PROJECT CONTINUITY UNAVAILABLE]\nNo canonical project store exists yet; it is created by consent-gated native enrollment at the first captured boundary. Nothing to restore.',
+    };
     if (!suspended) {
       const queue = drainCaptureQueue({ projectDir, budgetMs: Math.max(0, deadlineAt - Date.now()),
         deadlineAt, signal, env, makeStoreFactory: () => () => store });

package/plugin/scripts/project-progression-store.mjs

@@ -358,9 +358,8 @@ export class ProjectProgressionStore {
     this.deadlineAt = deadlineAt;
     this.signal = signal;
     this.resolution = resolveProjectStore({ projectDir, requestedStorePath, deadlineAt });
-    // Best effort: a cleanup that cannot run must never stop a capture or a restore.
-    try { this.legacyDebris = cleanLegacyRufloDebris(path.dirname(this.resolution.canonicalAgentDbPath)); }
-    catch (error) { this.legacyDebris = { removed: [], refused: [{ path: null, reason: error.message }] }; }
+    // Opening continuity is never authorization to remove another store or its artifacts.
+    this.legacyDebris = { removed: [], refused: [], skipped: 'automatic cleanup disabled; existing stores preserved' };
     this.brainHome = brainHome;
     this.rufloBinary = rufloBinary;
     this.runner = runner;
@@ -387,7 +386,7 @@ export class ProjectProgressionStore {
         cwd,
         encoding: 'utf8',
         timeout: 120_000,
-        env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' },
+        env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_MEMORY_PATH: undefined },
       });
     } finally {
       fs.rmSync(cwd, { recursive: true, force: true });
@@ -416,11 +415,24 @@ export class ProjectProgressionStore {
     this.requireCaptureConsent(snapshot);
     const stored = this.run([
       'memory', 'store', '--key', snapshot.eventKey, '--value', JSON.stringify(snapshot),
-      '--namespace', PROGRESSION_NAMESPACE, '--no-upsert', '--provenance', 'system_observation',
+      '--namespace', PROGRESSION_NAMESPACE, '--no-upsert', '--require-native', '--append-only', '--provenance', 'system_observation',
       '--path', this.resolution.canonicalAgentDbPath,
     ]);
     const alreadyStored = resultStatus(stored) !== 0;
-    if (!alreadyStored) onPhase('stored');
+    if (alreadyStored) {
+      const diagnostic = `${resultText(stored, 'stderr')}\n${resultText(stored, 'stdout')}`.replace(/\x1b\[[0-9;]*m/g, '');
+      const isDuplicate = line => {
+        const reason = line.trim().replace(/^\[ERROR\]\s*/, '').replace(/^Failed to store:\s*/, '');
+        return reason === 'immutable append rejected: logical key already exists'
+          || reason === `key "${snapshot.eventKey}" already exists in namespace "${PROGRESSION_NAMESPACE}" — pass upsert=true (--upsert on the CLI) to update it`;
+      };
+      const lines = diagnostic.split(/\r?\n/).map(line => line.trim()).filter(Boolean);
+      const duplicate = lines.some(isDuplicate) && lines.filter(line => /^\[ERROR\]|^Failed to store:/i.test(line)).every(isDuplicate)
+        && !/\b(?:unavailable|refus(?:ed|ing|al)|permission denied|native WAL|unsafe write)\b/i.test(diagnostic);
+      if (resultStatus(stored) !== 1 || stored.error || stored.signal || !duplicate) {
+        throw new Error(`progression native append failed: ${resultText(stored, 'stderr').trim() || resultText(stored, 'stdout').trim() || 'unknown error'}`);
+      }
+    } else onPhase('stored');
 
     // THE READ-BACK, through the fast path when it is available.
     //

package/plugin/scripts/project-store-resolver.mjs

@@ -1,6 +1,7 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import os from 'node:os';
 import { execFileSync } from 'node:child_process';
 
 function sha256(value) {
@@ -47,21 +48,36 @@ function gitValue(cwd, args, gitTimeoutMs, deadlineAt) {
     return execFileSync('git', args, {
       cwd,
       encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, LC_ALL: 'C', LANG: 'C' },
       ...(Number.isFinite(remaining) || gitTimeoutMs
         ? { timeout: Math.max(1, Math.floor(Math.min(gitTimeoutMs || Infinity, remaining))), killSignal: 'SIGKILL' } : {}),
     }).trim();
   } catch (error) {
     // A timed-out Git identity check is not evidence for a non-git project.
     if (error.code === 'ETIMEDOUT') throw new Error('Git project identity timed out');
-    return null;
+    if (error.code === 'ENOENT' && !(() => { for (let c = cwd; ; c = path.dirname(c)) { if (fs.existsSync(path.join(c, '.git'))) return true; if (path.dirname(c) === c) return false; } })()) return null; // no git binary and no .git marker: not a Git project
+    if (error.status === 128 && /^fatal: not a git repository\b/m.test(String(error.stderr || ''))) {
+      let cursor = cwd;
+      for (;;) {
+        if (fs.existsSync(path.join(cursor, '.git'))) throw new Error('Git project identity unavailable: invalid Git marker');
+        const parent = path.dirname(cursor);
+        if (parent === cursor) break;
+        cursor = parent;
+      }
+      return null;
+    }
+    throw new Error('Git project identity unavailable');
   }
 }
 
 function gitProject(projectDir, gitTimeoutMs, deadlineAt) {
-  const commonValue = gitValue(projectDir, ['rev-parse', '--path-format=absolute', '--git-common-dir'], gitTimeoutMs, deadlineAt);
-  const checkoutValue = gitValue(projectDir, ['rev-parse', '--show-toplevel'], gitTimeoutMs, deadlineAt);
-  if (!commonValue || !checkoutValue) return null;
+  // One process, two lines (common dir, then checkout root): each Git spawn is a load-sensitive cost on the prompt path.
+  const identity = gitValue(projectDir, ['rev-parse', '--path-format=absolute', '--git-common-dir', '--show-toplevel'], gitTimeoutMs, deadlineAt);
+  if (identity === null) return null;
+  const [commonValue, checkoutValue, ...extra] = identity.split('\n');
+  if (extra.length) throw new Error('Git project identity incomplete');
+  if (!commonValue || !checkoutValue) throw new Error('Git project identity incomplete');
   const gitCommonDir = canonicalDirectory(commonValue, 'Git common directory');
   const checkoutRoot = canonicalDirectory(checkoutValue, 'Git checkout root');
   if (path.basename(gitCommonDir) !== '.git') {
@@ -74,6 +90,18 @@ function gitProject(projectDir, gitTimeoutMs, deadlineAt) {
   };
 }
 
+function nonGitRoot(input) {
+  // A home directory that does not exist (CI sandboxes, relocated HOME) must not make project resolution throw.
+  const home = (() => { try { return fs.realpathSync.native(os.homedir()); } catch { return path.resolve(os.homedir()); } })();
+  let cursor = input;
+  while (cursor !== path.dirname(cursor) && cursor !== home) {
+    if (fs.existsSync(path.join(cursor, '.swarm', 'memory.db'))
+      || ['AGENTS.md', 'package.json', 'Cargo.toml', 'pyproject.toml'].some((marker) => fs.existsSync(path.join(cursor, marker)))) return cursor;
+    cursor = path.dirname(cursor);
+  }
+  return input;
+}
+
 export function resolveProjectStore({ projectDir = process.cwd(), requestedStorePath, gitTimeoutMs, deadlineAt = Infinity } = {}) {
   const canonicalInput = canonicalDirectory(projectDir, 'projectDir');
   if (gitTimeoutMs !== undefined && (!Number.isSafeInteger(gitTimeoutMs) || gitTimeoutMs <= 0)) throw new TypeError('gitTimeoutMs must be a positive integer');
@@ -81,7 +109,7 @@ export function resolveProjectStore({ projectDir = process.cwd(), requestedStore
   const resolved = git ?? {
     gitCommonDir: null,
     checkoutRoot: canonicalInput,
-    projectRoot: canonicalInput,
+    projectRoot: nonGitRoot(canonicalInput),
   };
   const kind = git ? 'git' : 'non-git';
   const canonicalAgentDbPath = path.join(resolved.projectRoot, '.swarm', 'memory.db');
@@ -116,3 +144,13 @@ export function resolveProjectStore({ projectDir = process.cwd(), requestedStore
     projectIdentity,
   });
 }
+
+/** Default enrollment applies only to Git developer roots; explicit consent is evaluated by callers. */
+export function globalEnrollmentAllowed({ resolution, home = os.homedir(), brainHome = path.join(home, '.cache', 'ruvnet-brain'),
+  temporaryRoots = [os.tmpdir(), '/tmp', '/private/tmp'],
+  systemRoots = ['/System', '/Library', '/usr', '/etc', '/var', '/private/var', '/proc', '/sys', '/dev'] } = {}) {
+  const canonical = (value) => { try { return fs.realpathSync.native(value); } catch { return path.resolve(value); } };
+  const root = resolution.projectRoot;
+  return resolution.kind === 'git' && root !== canonical(home) && root !== path.parse(root).root
+    && ![...temporaryRoots, ...systemRoots, brainHome].some((excluded) => isWithin(canonical(excluded), root));
+}

package/plugin/scripts/session-snapshot-hook.mjs

@@ -15,6 +15,7 @@ import { projectDirectory } from './project-identity.mjs';
 import { buildProjectProgression } from './project-progression-producer.mjs';
 import { ProjectProgressionStore } from './project-progression-store.mjs';
 import { resolveProjectStore } from './project-store-resolver.mjs';
+import { ensureProjectMemory } from './project-memory-enrollment.mjs';
 import { resolveTurnDb, captureTurnOutcome } from './turn-outcome-capture.mjs';
 import { captureContinuityEvents, stopNotice } from './continuity-journal.mjs';
 import { automaticProgressionSuspensionResult } from './project-progression-suspension.mjs';
@@ -129,6 +130,7 @@ export function runSessionSnapshotHook(projectDir, event, {
   spawnReplay = replayOutboxDetached,
   ordered = null,
   captureEvents = captureContinuityEvents,
+  enrollMemory = ensureProjectMemory,
   deadlineAt: inheritedDeadlineAt = Infinity,
   signal,
 } = {}) {
@@ -136,6 +138,11 @@ export function runSessionSnapshotHook(projectDir, event, {
   const checkDeadline = () => { if (signal?.aborted || now() >= deadlineAt) throw new Error('restore deadline exceeded'); };
   const suspended = (reason) => ({ metadataWritten: false, progressionCaptured: false, receipt: null, skipped: reason,
     turn: { event, recorded: false, skipped: reason }, continuity: { event, recorded: 0, launched: false, skipped: reason } });
+  let enrollmentPayload = {};
+  try { enrollmentPayload = rawInput ? JSON.parse(rawInput) : {}; } catch { /* malformed payload */ }
+  const enrollment = enrollMemory({ projectDir, env, event, payload: enrollmentPayload, host, deadlineAt });
+  if (enrollment.state === 'pending') return { ...suspended('native project memory enrollment pending'), enrollment };
+  if (enrollment.state === 'disabled' || enrollment.state === 'unavailable') return { ...suspended(enrollment.reason), enrollment };
   // Consent is checked before metadata, transcript inspection or any durable capture queue.
   try {
     checkDeadline();

package/plugin/scripts/session-start-core.mjs

@@ -26,6 +26,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { enrollmentPlan } from './project-memory-enrollment.mjs';
 import { restoreWithBrief } from './continuity-brief.mjs';
 import { turnRecordingStatus } from './turn-outcome-capture.mjs';
 import {
@@ -189,6 +190,11 @@ export async function runSessionStart({
     }
   };
 
+  // Report only. SessionStart never creates or bootstraps a store (ADR-105 rule 6); enrollment starts at the first
+  // consented captured boundary, so a session that merely started leaves no store behind.
+  let enrollment;
+  try { enrollment = enrollmentPlan({ projectDir: cwd, env, deadlineAt: hookDeadlineAt }); } catch (error) { enrollment = { state: 'unavailable', reason: error.message }; }
+  if (enrollment.state === 'pending' || enrollment.state === 'unavailable') emit(`[RuvNet Brain — TURN CAPTURE] Project memory enrollment ${enrollment.state}; restoration is not yet proven.`);
   const restoreStart = Date.now();
   const restoreDeadlineAt = Math.min(hookDeadlineAt, restoreStart + STAGE_BUDGETS_MS.restore);
   const restoreController = new AbortController();

package/plugin/scripts/turn-outcome-capture.mjs

@@ -23,11 +23,9 @@
  *   • Content = assistant outcome text, files changed, Bash descriptions. NEVER raw user text (a
  *     2026-07-13 measurement: prompt echoes made 87% of a store noise). Trivial turns are skipped.
  *
- * CODEX: codex-cli 0.158.0's own `stop.command.input` schema (read from the installed binary
- * 2026-09-29) carries `last_assistant_message` (nullable) and `transcript_path` (nullable).
- * The Codex rollout format is NOT parsed: project-progression-sources.mjs already declares it
- * unknown, and the rollout records observed locally (custom_tool_call / function_call with free-form
- * inputs) give no stable file-change shape. Codex records therefore carry the outcome text only.
+ * CODEX: native response_item JSONL is normalized mechanically through native-turn-transcript.
+ * SessionEnd and PreCompact recover a closing outcome when Stop payload text is absent. Tool IDs
+ * correlate observable gate outcomes; opaque custom orchestration inputs remain unclassified.
  *
  * LATENCY: Stop runs synchronously in the host's turn, and one `ruflo memory store` costs ~0.7s
  * (measured). So the writes run in ONE detached worker (this file, `--run-steps`), store then
@@ -40,9 +38,11 @@ import path from 'node:path';
 import crypto from 'node:crypto';
 import { spawn, spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { nativeTurnLines } from './native-turn-transcript.mjs';
 import { resolveRuflo, rufloInvocation } from './ruflo-bin.mjs';
+import { rufloCwdFor, rufloScratchRoot } from './project-progression-store.mjs';
 import { redactText, userLevelAgentdbHooks } from './continuity-events.mjs';
-import { resolveProjectStore } from './project-store-resolver.mjs';
+import { resolveProjectStore, globalEnrollmentAllowed } from './project-store-resolver.mjs';
 import { digest, journalTurn, readJournal, pendingTurnFiles, acknowledgeJournal, appendReceipt, storeData } from './turn-transport-journal.mjs';
 import { contentPathExcludes, pathIsExcluded, privateTurn, maskExcludedPaths, captureFailureReason, firstTurnCaptureNotice } from './turn-capture-privacy.mjs';
 
@@ -162,7 +162,7 @@ const consentMap = (value) => value !== null && typeof value === 'object'
   && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype
   && Object.values(value).every((setting) => setting === 'on' || setting === 'off');
 
-export function resolveTurnDb({ projectDir, brainHome, requestedStorePath, gitTimeoutMs = 1000, unknownOriginalPath = false, deadlineAt = Infinity, signal } = {}) {
+export function resolveTurnDb({ projectDir, brainHome, requestedStorePath, gitTimeoutMs = 1000, unknownOriginalPath = false, deadlineAt = Infinity, signal, enrollmentRoots = {} } = {}) {
   if (signal?.aborted || Date.now() >= deadlineAt) throw new Error('restore deadline exceeded');
   const resolved = resolveProjectStore({ projectDir, requestedStorePath, gitTimeoutMs, deadlineAt });
   if (signal?.aborted || Date.now() >= deadlineAt) throw new Error('restore deadline exceeded');
@@ -173,12 +173,14 @@ export function resolveTurnDb({ projectDir, brainHome, requestedStorePath, gitTi
     try {
       policy = JSON.parse(fs.readFileSync(file, 'utf8'));
       if (policy?.schemaVersion !== 1 || !consentMap(policy.projects)
+        || (Object.hasOwn(policy, 'default') && !['on', 'off'].includes(policy.default))
         || (Object.hasOwn(policy, 'paths') && !consentMap(policy.paths))) throw new Error('invalid policy');
       contentPathExcludes(policy.contentPathExcludes);
     } catch { return { skipped: 'turn capture policy unreadable or invalid', projectRoot: resolved.projectRoot }; }
   }
   // A path rule wins over a project rule, allowing a linked checkout/subdirectory to opt out.
-  const setting = policy.paths?.[capturePath] ?? policy.projects?.[resolved.projectRoot];
+  const explicitSetting = policy.paths?.[capturePath] ?? policy.projects?.[resolved.projectRoot];
+  const setting = explicitSetting ?? policy.default;
   if (setting !== undefined && !['on', 'off'].includes(setting)) return { skipped: 'invalid turn capture consent', projectRoot: resolved.projectRoot };
   const db = resolved.canonicalAgentDbPath;
   const exclusions = contentPathExcludes(policy.contentPathExcludes);
@@ -191,6 +193,9 @@ export function resolveTurnDb({ projectDir, brainHome, requestedStorePath, gitTi
   if (setting === 'off') return { db, scope: 'project', capturePath, projectRoot: resolved.projectRoot, skipped: 'persisted turn capture opt-out' };
   let exists = false;
   try { exists = fs.statSync(db).isFile(); } catch { /* absent */ }
+  if (!exists && setting === 'on' && explicitSetting !== 'on' && !globalEnrollmentAllowed({ resolution: resolved, brainHome, ...enrollmentRoots })) {
+    return { db, scope: 'project', capturePath, projectRoot: resolved.projectRoot, skipped: 'global capture consent requires a safe Git project root; explicit project/path opt-in required' };
+  }
   if (!exists && setting !== 'on') return { db, scope: 'project', capturePath, projectRoot: resolved.projectRoot, skipped: 'no project memory db; persisted opt-in required' };
   return { db, scope: 'project', capturePath, projectRoot: resolved.projectRoot, optedIn: setting === 'on',
     contentPathExcludes: exclusions };
@@ -292,14 +297,14 @@ export function captureTurnOutcome({
   if (deferTo) {
     report.skipped = 'deferred: an enabled user-level Stop writer explicitly targets the canonical turn store; actual native delivery is unproven';
     report.deferredToUserLevel = true;
-  } else if (event === 'Stop') {
+  } else if (['Stop', 'SessionEnd', 'PreCompact'].includes(event)) {
     const sessionKey = String(payload.session_id || payload.transcript_path || '');
     const message = typeof payload.last_assistant_message === 'string' ? payload.last_assistant_message.trim() : '';
     let turn = { finalText: '', files: [], actions: [] };
-    if (host === 'claude' && typeof payload.transcript_path === 'string' && payload.transcript_path) {
+    if (typeof payload.transcript_path === 'string' && payload.transcript_path) {
       // With the closing message in hand, the transcript is read immediately (tool calls are already
       // flushed); without it, wait for the closing message to land, bounded.
-      try { turn = claudeTurn(readTranscript(payload.transcript_path, { maxMs: message ? 0 : settleMs })); } catch { /* unreadable */ }
+      try { turn = claudeTurn(nativeTurnLines(readTranscript(payload.transcript_path, { maxMs: message || event !== 'Stop' ? 0 : settleMs }), host)); } catch { /* unreadable */ }
     }
     if (message && (message.length >= MIN_OUTCOME_CHARS || message.length >= turn.finalText.length)) turn.finalText = message;
     turn = privateTurn(turn, target.contentPathExcludes, target.capturePath);
@@ -323,12 +328,12 @@ export function captureTurnOutcome({
           catch (error) { return { ...report, skipped: `durable turn queue invalid: ${redactText(error.message)}` }; }
         }
         steps.push({ ...binding, kind: 'store', ruflo, args: ['memory', 'store', '-k', key, '--value', value, '-n', TURN_NAMESPACE,
-          '--path', db, '--no-upsert', '--tags', `project=${project},host=${host}`, '--provenance', 'agent_output'] });
+          '--path', db, '--no-upsert', '--require-native', '--append-only', '--tags', `project=${project},host=${host}`, '--provenance', 'agent_output'] });
         // This synchronous boundary proves only queuing; the worker's exact receipt proves recording.
         Object.assign(report, { queued: true, key, value });
       }
     }
-  } else report.skipped = `turn outcomes are recorded at Stop, not ${event}`;
+  } else report.skipped = `no turn outcome capture at ${event}`;
 
   if (event === 'SessionEnd' || event === 'PreCompact') {
     if (!fs.existsSync(db)) report.distill = { queued: false, skipped: 'no memory db to distill yet' };
@@ -376,7 +381,7 @@ export function runSteps({ steps = [], receipts } = {}, { run: suppliedRun = spa
   };
   const results = [];
   for (const queued of steps) {
-    let status = 1; let error = null; let verified = false; let db = ''; let key; let privacyPatterns = [];
+    let status = 1; let error = null; let skipped = null; let verified = false; let db = ''; let key; let privacyPatterns = [];
     const kind = queued.kind === 'journal' ? 'store' : queued.kind;
     try {
       if (String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() === 'off') throw new Error('RUVNET_TURN_CAPTURE=off');
@@ -396,7 +401,7 @@ export function runSteps({ steps = [], receipts } = {}, { run: suppliedRun = spa
         binding = queued.kind === 'journal' ? data.binding : queued;
         key = data.key; value = maskExcludedPaths(redactText(data.value), target.contentPathExcludes, target.capturePath);
         if (value !== redactText(data.value)) throw new Error('content exclusions changed; immutable turn retained');
-        args = ['memory', 'store', '-k', key, '--value', value, '-n', TURN_NAMESPACE, '--path', db, '--no-upsert', '--provenance', 'agent_output'];
+        args = ['memory', 'store', '-k', key, '--value', value, '-n', TURN_NAMESPACE, '--path', db, '--no-upsert', '--require-native', '--append-only', '--provenance', 'agent_output'];
       } else if (kind === 'distill') {
         if (queued.brainHome !== brainHome) throw new Error('queued consent settings differ from trusted caller');
         const recipe = queued.args;
@@ -424,21 +429,30 @@ export function runSteps({ steps = [], receipts } = {}, { run: suppliedRun = spa
       const invocation = rufloInvocation(ruflo, args);
       const remaining = deadlineMs === undefined ? STEP_TIMEOUT_MS : deadlineMs - Date.now();
       if (remaining <= 0) throw new Error('turn replay deadline exhausted');
-      const options = { encoding: 'utf8', timeout: Math.min(STEP_TIMEOUT_MS, remaining), cwd: path.dirname(db), windowsHide: true,
-        maxBuffer: 1024 * 1024, env: { ...env, ...RUFLO_ENV, CLAUDE_FLOW_MEMORY_PATH: path.dirname(db) } };
+      // Measured 2026-10-10 with global Ruflo 3.56.3: cwd=<project>/.swarm litters ruvector.db/.claude-flow there, and
+      // CLAUDE_FLOW_MEMORY_PATH=<.swarm> makes Ruflo create a second agentdb-memory.db beside the canonical store.
+      // The explicit --path already binds the store, so run from private scratch with neither.
+      const options = { encoding: 'utf8', timeout: Math.min(STEP_TIMEOUT_MS, remaining), windowsHide: true,
+        cwd: rufloCwdFor(db, { root: rufloScratchRoot({ ...env, RUVNET_BRAIN_HOME: brainHome }) }),
+        maxBuffer: 1024 * 1024, env: { ...env, ...RUFLO_ENV } };
+      delete options.env.CLAUDE_FLOW_MEMORY_PATH;
       const existing = kind === 'store' && queued.journalFile ? read({ ruflo, db, key, run, options }) : null;
       if (existing !== null && existing !== value) throw new Error('existing turn key content differs; no upsert permitted');
       verified = kind === 'store' && existing === value;
       const r = verified ? { status: 0 } : run(invocation.executable, invocation.args, options);
       status = Number.isInteger(r.status) ? r.status : 1;
-      if (kind === 'store' && !verified) verified = read({ ruflo, db, key, run, options }) === value;
+      if (kind === 'store' && !verified && status === 0) verified = read({ ruflo, db, key, run, options }) === value;
       if (verified) status = 0;
+      if (kind === 'distill' && status === 0) {
+        const match = /(?:^|\n)\s*skipped:\s*([^\n]+)/i.exec(String(r.stdout || '').replace(/\x1b\[[0-9;]*m/g, ''));
+        if (match) skipped = redactText(match[1]).slice(0, 300);
+      }
       if (!verified && (r.error || status !== 0)) error = captureFailureReason(r, status);
       else if (kind === 'store' && !verified) { status = 1; error = 'exact turn key/content readback failed'; }
     } catch (e) { status = 1; error = redactText(e.message).slice(0, 300); }
     if (error) error = maskExcludedPaths(error, privacyPatterns, projectDir);
     const row = { at: new Date().toISOString(), kind, db: redactText(db), storeIdentity: digest(db), key, status, error,
-      ...(kind === 'store' ? { verified } : {}) };
+      ...(kind === 'store' ? { verified } : {}), ...(skipped ? { skipped } : {}) };
     results.push(row);
     if (receipts) {
       try { appendReceipt(receipts, row); if (verified && queued.journalFile) acknowledgeJournal(queued.journalFile, db); }