ruvnet-brain 4.6.2 → 4.6.3

package/plugin/scripts/continuity-journal.mjs

@@ -12,6 +12,7 @@
  * RETAIN_COMMITTED_MS, ages quarantine/corrupt notices after QUARANTINE_REPORT_MS, and bounds committed
  * history at MAX_EVENT_RECORDS. Pending events are never dropped; prolonged outages report pressure.
  */
+import { nativeTurnLines } from './native-turn-transcript.mjs';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -137,7 +138,9 @@ export class ContinuityJournal {
   scan() {
     this.requireBudget();
     let text = '';
-    try { text = fs.readFileSync(this.path, 'utf8'); } catch { /* no outbox yet */ }
+    try { text = fs.readFileSync(this.path, 'utf8'); } catch (error) {
+      if (error.code !== 'ENOENT') throw new Error(`continuity outbox unreadable: ${error.code || 'I/O error'}`);
+    }
     const events = new Map();
     const committed = new Map();
     const failures = new Map();
@@ -367,23 +370,23 @@ export function stopNotice({ journal, status, session }) {
 }
 function defaultStore({ ruflo, db, key, value }) {
   const cwd = rufloRunDir(db);
+  const source = JSON.parse(value).source;
+  const provenance = ['assistant-detected', 'owner-correction-detected', 'agent-result'].includes(source) ? 'agent_output' : 'system_observation';
   try {
     const { executable, args } = rufloInvocation(ruflo, ['memory', 'store', '--key', key, '--value', value,
-      '--namespace', CONTINUITY_NAMESPACE, '--no-upsert', '--provenance', 'system_observation', '--path', db]);
+      '--namespace', CONTINUITY_NAMESPACE, '--no-upsert', '--require-native', '--append-only', '--provenance', provenance, '--path', db]);
     const r = spawnSync(executable, args, { cwd, encoding: 'utf8', timeout: 60_000, windowsHide: true,
-      env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' } });
+      env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_MEMORY_PATH: undefined } });
     return { status: Number.isInteger(r.status) ? r.status : 1, output: `${r.stderr || ''}\n${r.stdout || ''}${r.error ? `\n${r.error.message}` : ''}` };
   } finally { fs.rmSync(cwd, { recursive: true, force: true }); }
 }
 
 function defaultReadBack({ ruflo, db, key }) {
-  const fast = withProgressionReader(db, (reader) => reader.readContent(CONTINUITY_NAMESPACE, key));
-  if (fast.ok) return { key, content: fast.value, readPath: 'node:sqlite' };
   const cwd = rufloRunDir(db);
   try {
     const { executable, args } = rufloInvocation(ruflo, ['memory', 'retrieve', '--key', key, '--namespace', CONTINUITY_NAMESPACE, '--value-only', '--path', db]);
-    const r = spawnSync(executable, args, { cwd, encoding: 'utf8', timeout: 60_000, windowsHide: true, env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' } });
-    return { key, content: r.status === 0 ? String(r.stdout || '') : null, readPath: `ruflo-cli (${fast.reason})` };
+    const r = spawnSync(executable, args, { cwd, encoding: 'utf8', timeout: 60_000, windowsHide: true, env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_MEMORY_PATH: undefined } });
+    return { key, content: r.status === 0 ? String(r.stdout || '') : null, readPath: 'ruflo-cli' };
   } finally { fs.rmSync(cwd, { recursive: true, force: true }); }
 }
 
@@ -414,15 +417,18 @@ export function drain(journal, {
       if (now() >= deadline) break;
       const value = JSON.stringify(privateContinuityEvent(rec.event, consent.contentPathExcludes, consent.capturePath));
       if (value !== JSON.stringify(rec.event)) return { committed, failed, remaining: journal.pending().length, skipped: 'content exclusions changed; immutable continuity retained' };
-      attempts += 1; const result = store({ ruflo, db: journal.db, key: rec.key, value });
-      const back = readBack({ ruflo, db: journal.db, key: rec.key });
+      attempts += 1;
+      const prior = readBack({ ruflo, db: journal.db, key: rec.key });
+      const alreadyStored = typeof prior.content === 'string' && prior.content.trim() === value && (prior.key === undefined || prior.key === rec.key);
+      const result = alreadyStored ? { status: 0 } : store({ ruflo, db: journal.db, key: rec.key, value });
+      const back = alreadyStored ? prior : readBack({ ruflo, db: journal.db, key: rec.key });
       const content = typeof back.content === 'string' ? back.content.trim() : '';
-      if (content === value && digestCanonical(rec.event) === rec.digest && (back.key === undefined || back.key === rec.key)) {
+      if (result.status === 0 && content === value && digestCanonical(rec.event) === rec.digest && (back.key === undefined || back.key === rec.key)) {
         journal.appendRecords([{ type: 'commit', key: rec.key, digest: rec.digest, committedAt: new Date(now()).toISOString(), readPath: back.readPath,
-          alreadyStored: result.status !== 0 || content !== value, ...(attempts > 1 ? { attempts, lastError: last?.reason } : {}) }]);
+          alreadyStored, ...(attempts > 1 ? { attempts, lastError: last?.reason } : {}) }]);
         committed += 1;
         done = true;
-      } else if (content) {
+      } else if (content && (content !== value || digestCanonical(rec.event) !== rec.digest || (back.key !== undefined && back.key !== rec.key))) {
         // A DIFFERENT row holds our key: never overwritten (--no-upsert), never retried, reported.
         journal.appendRecords([{ type: 'quarantine', key: rec.key, at: new Date(now()).toISOString(), reason: 'a different stored row holds this key' }]);
         failed += 1;
@@ -466,7 +472,7 @@ export function takeLock(journal, { now = Date.now } = {}) {
 export function launchDrain({ projectRoot, spawnFn = spawn, env = process.env } = {}) {
   try {
     const child = spawnFn(process.execPath, [fileURLToPath(import.meta.url), '--drain', projectRoot], {
-      cwd: os.tmpdir(), detached: true, stdio: 'ignore', windowsHide: true, env: { ...env, RUFLO_DAEMON_AUTOSTART: '0' },
+      cwd: os.tmpdir(), detached: true, stdio: 'ignore', windowsHide: true, env: { ...env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_MEMORY_PATH: undefined },
     });
     child.unref?.();
     return true;
@@ -513,13 +519,13 @@ export function captureContinuityEvents({
     events.push(...collectCommits({ checkoutRoot: resolution.checkoutRoot, sinceMs, host, session, project }));
     events.push(...collectReleases({ checkoutRoot: resolution.checkoutRoot, sinceMs, host, session, project }));
   }
-  if (event === 'Stop') {
+  if (['Stop', 'SessionEnd', 'PreCompact', 'SubagentStop'].includes(event)) {
     let lines = null;
-    if (host === 'claude' && typeof payload.transcript_path === 'string' && payload.transcript_path) {
+    if (typeof payload.transcript_path === 'string' && payload.transcript_path) {
       try { lines = readTranscript(payload.transcript_path); } catch { /* unreadable transcript: git events still count */ }
     }
     const last = typeof payload.last_assistant_message === 'string' ? payload.last_assistant_message : ''; const policy = journal.captureConsent();
-    if (!policy.skipped && !(lines && turnReferencesExcludedResource(claudeTurn(lines), policy.contentPathExcludes, projectDir))) events.push(...collectTurnEvents({ lines, lastAssistantMessage: last, host, session, project, env, at: now() }));
+    if (!policy.skipped && !(lines && turnReferencesExcludedResource(claudeTurn(nativeTurnLines(lines, host)), policy.contentPathExcludes, projectDir))) events.push(...collectTurnEvents({ lines, lastAssistantMessage: last, host, session, project, env, at: now() }));
   }
   try { report.recorded = journal.record(events).length; } catch (error) { return { ...report, skipped: `outbox write failed: ${error.message}` }; }
   try { if (journal.needsCompaction()) journal.compact(); } catch { /* bounded next time */ }

package/plugin/scripts/native-turn-transcript.mjs

@@ -0,0 +1,51 @@
+/** Bounded, mechanical Codex JSONL normalization. No model inference or user-text persistence. */
+const LIMIT = 2 * 1024 * 1024;
+const text = content => typeof content === 'string' ? content : Array.isArray(content)
+  ? content.filter(part => ['text', 'input_text', 'output_text'].includes(part?.type)).map(part => part.text || '').join('\n') : '';
+const message = (role, content) => ({ message: { role, content } });
+const parse = value => { try { return JSON.parse(value); } catch { return null; } };
+
+/** Keep call IDs intact; torn/unknown records cannot manufacture successful tool evidence. */
+export function nativeTurnLines(lines, host) {
+  if (host !== 'codex') return lines;
+  const records = []; let bytes = 0;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    bytes += Buffer.byteLength(String(lines[i]));
+    if (bytes > LIMIT) break;
+    const record = parse(lines[i]); if (record) records.push(record);
+  }
+  records.reverse();
+  const out = []; const sessions = new Map(); const calls = new Map();
+  for (const record of records) {
+    const p = record.payload;
+    if (record.type === 'event_msg' && p?.type === 'user_message') {
+      out.push(message('user', p.message || '')); continue;
+    }
+    if (record.type === 'event_msg' && p?.type === 'agent_message' && typeof p.message === 'string') {
+      out.push(message('assistant', p.message)); continue;
+    }
+    if (record.type !== 'response_item' || !p) continue;
+    if (p.type === 'message' && ['user', 'assistant'].includes(p.role)) {
+      out.push(message(p.role, text(p.content))); continue;
+    }
+    if (['function_call', 'custom_tool_call'].includes(p.type) && typeof p.call_id === 'string') {
+      const args = typeof p.arguments === 'string' ? parse(p.arguments) : p.arguments;
+      let name = String(p.name || '').split('.').at(-1); let input = args || {};
+      if (name === 'exec_command' && typeof args?.cmd === 'string') { name = 'Bash'; input = { command: args.cmd }; }
+      if (name === 'apply_patch') input = { input: p.input || '' };
+      if (name === 'write_stdin' && sessions.has(args?.session_id)) {
+        name = 'Bash'; input = { command: sessions.get(args.session_id) };
+      }
+      calls.set(p.call_id, { name, input });
+      out.push(message('assistant', [{ type: 'tool_use', id: p.call_id, name, input }]));
+    } else if (['function_call_output', 'custom_tool_call_output'].includes(p.type) && typeof p.call_id === 'string') {
+      const result = typeof p.output === 'string' ? parse(p.output) : p.output;
+      const call = calls.get(p.call_id);
+      if (Number.isSafeInteger(result?.session_id) && call?.name === 'Bash') sessions.set(result.session_id, call.input.command);
+      // Native structured exit fields are retained; opaque text is never guessed to be a pass.
+      out.push(message('user', [{ ...(result && typeof result === 'object' ? result : {}),
+        type: 'tool_result', tool_use_id: p.call_id, content: typeof p.output === 'string' ? p.output : JSON.stringify(p.output ?? '') }]));
+    }
+  }
+  return out.map(record => JSON.stringify(record));
+}

package/plugin/scripts/project-capture-queue.mjs

@@ -318,6 +318,8 @@ export function runOutboxReplay({ projectDir, token = process.env.RUVNET_REPLAY_
             const options = { rawInput: JSON.stringify(job.payload), host: job.host, env,
               budgetMs: Math.max(0, deadlineAt - now()), deadlineAt, signal,
               makeStoreFactory: () => makeStoreFactory(deadlineAt), now, ordered: held, writeMetadata: false,
+              // A queued job was admitted at its live boundary; replay must not re-run (or be suspended by) enrollment.
+              enrollMemory: () => ({ state: 'existing' }),
               captureTurn: () => ({ recorded: false, skipped: 'detached replay' }),
               captureEvents: () => ({ recorded: 0, skipped: 'detached replay' }) };
             const result = job.payload?.normalizedTransition ? captureNormalized(job, options)

package/plugin/scripts/project-memory-enrollment.mjs

@@ -0,0 +1,203 @@
+/** Consent-gated lazy enrollment. Hooks queue derived events before a detached native bootstrap. */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { spawn, spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { resolveProjectStore, globalEnrollmentAllowed } from './project-store-resolver.mjs';
+import { resolveTurnDb, turnCapturePolicyFile } from './turn-outcome-capture.mjs';
+import { resolveRuflo, rufloInvocation } from './ruflo-bin.mjs';
+import { redactText } from './continuity-events.mjs';
+import { enrichStateWithObservation } from './project-progression-hook.mjs';
+import { redactProgression } from './project-progression-contract.mjs';
+import { normalizeHostEvent } from './hook-input.mjs';
+import { maskExcludedPaths, privateProgressionState } from './turn-capture-privacy.mjs';
+
+const canonical = (value) => { try { return fs.realpathSync.native(value); } catch { return path.resolve(value); } };
+export const ENROLLMENT_NAMESPACE = 'project-enrollment';
+const receiptName = '.memory-enrollment.json';
+const queueName = '.memory-enrollment-pending';
+
+export function enrollmentPlan({ projectDir, env = process.env, deadlineAt = Infinity,
+  temporaryRoots = [os.tmpdir(), '/tmp', '/private/tmp'], systemRoots = ['/System', '/Library', '/usr', '/etc', '/var', '/private/var', '/proc', '/sys', '/dev'] } = {}) {
+  const home = canonical(env.HOME || env.USERPROFILE || os.homedir());
+  const brainHome = canonical(env.RUVNET_BRAIN_HOME || path.join(home, '.cache', 'ruvnet-brain'));
+  const resolution = resolveProjectStore({ projectDir, gitTimeoutMs: 500, deadlineAt });
+  // The consent guard and the plan must agree on which roots are excluded from default enrollment.
+  const consent = resolveTurnDb({ projectDir, brainHome, gitTimeoutMs: 500, deadlineAt, enrollmentRoots: { temporaryRoots, systemRoots } });
+  if (consent.skipped) return { ...resolution, state: 'disabled', reason: consent.skipped };
+  let policy = {};
+  try { policy = JSON.parse(fs.readFileSync(turnCapturePolicyFile(brainHome), 'utf8')); } catch { /* resolveTurnDb validates any present policy */ }
+  const explicit = policy.paths?.[canonical(projectDir)] ?? policy.projects?.[resolution.projectRoot];
+  const hasDb = fs.existsSync(resolution.canonicalAgentDbPath);
+  // RUVNET_TURN_CAPTURE=off means turn capture is off: it never creates a store. (It does not suspend progression or
+  // continuity capture on an existing store; queueBoundary additionally withholds the assistant text while it is off.)
+  if (!hasDb && String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() === 'off') return { ...resolution, state: 'disabled', reason: 'RUVNET_TURN_CAPTURE=off' };
+  if (!hasDb && explicit !== 'on') {
+    if (resolution.kind !== 'git') return { ...resolution, state: 'disabled', reason: 'non-Git enrollment requires explicit project opt-in' };
+    if (!globalEnrollmentAllowed({ resolution, home, brainHome, temporaryRoots, systemRoots })) {
+      return { ...resolution, state: 'disabled', reason: 'global enrollment excludes home, temporary, system and Brain cache roots' };
+    }
+  }
+  let enrollmentPending = false;
+  const receipt = path.join(resolution.projectRoot, '.swarm', receiptName);
+  if (fs.existsSync(receipt)) {
+    const stat = fs.lstatSync(receipt);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) throw new Error('unsafe enrollment receipt');
+    // An unparsable receipt is a torn write from a killed hook: it means "not ready", never "unavailable forever".
+    try { enrollmentPending = JSON.parse(fs.readFileSync(receipt, 'utf8')).state === 'pending'; } catch { enrollmentPending = true; }
+  }
+  return { ...resolution, state: hasDb && !enrollmentPending ? 'existing' : 'pending', brainHome, contentPathExcludes: consent.contentPathExcludes || [] };
+}
+
+/** Create-if-absent. A hook killed mid-write leaves a torn FINAL file, which every reader tolerates (an unparsable
+ * receipt means pending; an unparsable queue entry is preserved as .corrupt). No hard-link or rename dance: a link
+ * window leaves nlink 2 on a killed hook, which the readers' nlink check would then reject forever. */
+function createExclusive(file, text) {
+  let fd;
+  try { fd = fs.openSync(file, 'wx', 0o600); } catch (error) { if (error.code === 'EEXIST') return; throw error; }
+  try { fs.writeFileSync(fd, text); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+}
+
+function safeDirectory(directory) {
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  const stat = fs.lstatSync(directory);
+  if (!stat.isDirectory() || stat.isSymbolicLink() || canonical(directory) !== directory) throw new Error('enrollment directory is not canonical');
+}
+
+/** Only a small derived outcome is queued; never prompts, transcripts, tool input or environment. */
+function queueBoundary(plan, { event, payload, host, projectDir, env = process.env }) {
+  if (!event || typeof payload?.session_id !== 'string' || !payload.session_id) return false;
+  const directory = path.join(plan.projectRoot, '.swarm', queueName);
+  safeDirectory(directory);
+  const turnCaptureOff = String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() === 'off';
+  const text = turnCaptureOff ? '' : String(payload.last_assistant_message || '');
+  const filtered = maskExcludedPaths(text, plan.contentPathExcludes, projectDir);
+  const last = filtered === text ? redactText(text).slice(0, 12000) : '[REDACTED:excluded-resource-outcome]';
+  const normalized = normalizeHostEvent(payload) || payload;
+  const observed = enrichStateWithObservation({ commands: [] }, { ...normalized, hook_event_name: event },
+    { contentPathExcludes: plan.contentPathExcludes, projectDir }).commands[0];
+  const tool = observed ? { tool_name: redactText(observed.tool), tool_input: {
+    ...(observed.command ? { command: redactText(observed.command) } : {}),
+    ...(observed.filePath ? { file_path: redactText(observed.filePath) } : {}) },
+    tool_response: JSON.parse(redactText(JSON.stringify(Object.fromEntries(Object.entries(observed)
+      .filter(([key]) => ['outcome', 'exitCode', 'error', 'signal', 'interrupted', 'isError', 'stdout', 'stderr', 'result'].includes(key)))))) } : {};
+  let strategic = {};
+  if (payload.projectProgression || payload.project_progression) {
+    const extension = redactProgression(payload.projectProgression || payload.project_progression).value;
+    extension.completeProjectState = privateProgressionState(extension.completeProjectState, plan.contentPathExcludes, projectDir);
+    strategic = { projectProgression: extension };
+  }
+  const boundary = { projectDir: canonical(projectDir), event, host,
+    payload: { session_id: payload.session_id, hook_event_name: event, ...tool, ...strategic, ...(last ? { last_assistant_message: last } : {}) } };
+  const digest = crypto.createHash('sha256').update(JSON.stringify(boundary)).digest('hex');
+  const file = path.join(directory, `${digest}.json`);
+  createExclusive(file, JSON.stringify(boundary));
+  const dirFd = fs.openSync(directory, 'r'); try { fs.fsyncSync(dirFd); } finally { fs.closeSync(dirFd); }
+  return true;
+}
+
+export function ensureProjectMemory({ projectDir, env = process.env, event, payload, host = env.RUVNET_HOOK_HOST || 'claude', deadlineAt = Infinity,
+  launch = launchEnrollment, planOptions = {} } = {}) {
+  try {
+    const plan = enrollmentPlan({ ...planOptions, projectDir, env, deadlineAt });
+    if (plan.state === 'disabled') return plan;
+    if (plan.state === 'existing') {
+      const queue = path.join(plan.projectRoot, '.swarm', queueName);
+      if (!fs.existsSync(queue) || !fs.readdirSync(queue).some((name) => /^[a-f0-9]{64}\.json$/.test(name))) return plan;
+    }
+    safeDirectory(path.join(plan.projectRoot, '.swarm'));
+    if (plan.state === 'pending') {
+      const receipt = path.join(plan.projectRoot, '.swarm', receiptName);
+      createExclusive(receipt, JSON.stringify({ schemaVersion: 1, state: 'pending', canonicalAgentDbPath: plan.canonicalAgentDbPath }));
+    }
+    const queued = plan.state === 'pending' && queueBoundary(plan, { event, payload, host, projectDir, env });
+    const launched = launch({ projectDir, env });
+    return { ...plan, state: plan.state === 'existing' ? 'existing' : 'pending', queued, launched };
+  } catch (error) { return { state: 'unavailable', reason: error.message }; }
+}
+
+export function launchEnrollment({ projectDir, env }) {
+  const child = spawn(process.execPath, [fileURLToPath(import.meta.url), '--enroll', canonical(projectDir)], {
+    cwd: os.tmpdir(), env: { ...env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_MEMORY_PATH: undefined }, detached: true, windowsHide: true, stdio: 'ignore',
+  });
+  child.unref();
+  return Boolean(child.pid);
+}
+
+/** Exact native append and same-path readback; existing stores are never initialized or replaced. */
+export async function enrollProjectMemory({ projectDir, env = process.env, run = spawnSync, replay } = {}) {
+  const plan = enrollmentPlan({ projectDir, env });
+  if (plan.state === 'disabled') return plan;
+  const swarm = path.join(plan.projectRoot, '.swarm');
+  safeDirectory(swarm);
+  const lock = path.join(swarm, '.memory-enrollment.lock');
+  const token = `${process.pid} ${crypto.randomUUID()}`;
+  try { fs.writeFileSync(lock, token, { flag: 'wx', mode: 0o600 }); } catch (error) {
+    if (error.code !== 'EEXIST') throw error;
+    const stat = fs.lstatSync(lock);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) return { ...plan, state: 'pending', reason: 'unsafe enrollment lock' };
+    const previous = fs.readFileSync(lock, 'utf8');
+    const pid = Number(previous.split(' ')[0]);
+    let dead = false;
+    if (Number.isSafeInteger(pid) && pid > 0) try { process.kill(pid, 0); } catch (failure) { dead = failure.code === 'ESRCH'; }
+    if (!dead || fs.readFileSync(lock, 'utf8') !== previous) return { ...plan, state: 'pending', reason: 'enrollment worker busy' };
+    fs.unlinkSync(lock);
+    try { fs.writeFileSync(lock, token, { flag: 'wx', mode: 0o600 }); } catch { return { ...plan, state: 'pending', reason: 'enrollment worker busy' }; }
+  }
+  const workerDeadlineAt = Date.now() + 60000;
+  const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'rnb-enrollment-worker-'));
+  try {
+    const binary = resolveRuflo({ env, home: env.HOME || os.homedir() });
+    if (!binary) return { ...plan, state: 'pending', reason: 'global Ruflo unavailable' };
+    const key = `project-bootstrap-${plan.projectIdentity.id}`;
+    const value = JSON.stringify({ schemaVersion: 1, projectIdentity: plan.projectIdentity });
+    const invoke = (args) => { const call = rufloInvocation(binary, args); return run(call.executable, call.args,
+      { cwd: scratch, env: { ...env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_MEMORY_PATH: undefined }, encoding: 'utf8', timeout: Math.max(1, Math.min(30000, workerDeadlineAt - Date.now())), maxBuffer: 256 * 1024, shell: false }); };
+    if (plan.state !== 'existing') {
+      invoke(['memory', 'store', '--key', key, '--value', value, '--namespace', ENROLLMENT_NAMESPACE,
+        '--path', plan.canonicalAgentDbPath, '--require-native', '--append-only', '--no-upsert', '--no-embedding']);
+      // Concurrent workers may lose the strict insertion race; exact readback still establishes readiness.
+      const result = invoke(['memory', 'retrieve', '--key', key, '--namespace', ENROLLMENT_NAMESPACE,
+        '--path', plan.canonicalAgentDbPath, '--value-only']);
+      if (result.status !== 0 || String(result.stdout || '').trim() !== value) return { ...plan, state: 'pending', reason: 'native bootstrap readback unavailable' };
+      const receipt = path.join(swarm, receiptName);
+      const temporary = `${receipt}.${crypto.randomUUID()}.tmp`;
+      fs.writeFileSync(temporary, JSON.stringify({ schemaVersion: 1, state: 'ready', key,
+        canonicalAgentDbPath: plan.canonicalAgentDbPath, verifiedAt: new Date().toISOString() }), { flag: 'wx', mode: 0o600 });
+      fs.renameSync(temporary, receipt);
+    }
+    const queue = path.join(swarm, queueName);
+    if (fs.existsSync(queue)) {
+      safeDirectory(queue);
+      const capture = replay || (await import('./session-snapshot-hook.mjs')).runSessionSnapshotHook;
+      for (const name of fs.readdirSync(queue).filter((name) => /^[a-f0-9]{64}\.json$/.test(name)).slice(0, 32)) {
+        if (Date.now() > workerDeadlineAt - 8000) break;
+        const file = path.join(queue, name);
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > 256000) continue;
+        let boundary;
+        try { boundary = JSON.parse(fs.readFileSync(file, 'utf8')); } catch {
+          // Preserve the evidence, stop it blocking every later replay.
+          try { fs.renameSync(file, `${file}.corrupt`); } catch { /* retry next boundary */ }
+          continue;
+        }
+        // Original path privacy is rechecked, never replaced by the primary worktree identity.
+        const consent = enrollmentPlan({ projectDir: boundary.projectDir, env });
+        if (consent.state === 'disabled' || consent.canonicalAgentDbPath !== plan.canonicalAgentDbPath) continue;
+        const result = capture(boundary.projectDir, boundary.event, { rawInput: JSON.stringify(boundary.payload), host: boundary.host,
+          env, enrollMemory: () => ({ state: 'existing' }) });
+        if (result?.turn?.queued || result?.turn?.recorded || result?.continuity?.recorded > 0 || result?.progressionCaptured || result?.deferredToReplayer) fs.unlinkSync(file);
+      }
+    }
+    return { ...plan, state: 'ready' };
+  } finally {
+    fs.rmSync(scratch, { recursive: true, force: true });
+    try { if (fs.readFileSync(lock, 'utf8') === token) fs.unlinkSync(lock); } catch { /* ownership changed */ }
+  }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url) && process.argv[2] === '--enroll') {
+  enrollProjectMemory({ projectDir: process.argv[3] }).catch(() => { /* pending queue survives; retry at the next boundary */ });
+}

package/plugin/scripts/project-progression-reader.mjs

@@ -43,8 +43,8 @@
 import fs from 'node:fs';
 import { loadNodeSqlite } from './node-sqlite.mjs';
 
-/** Rows that `ruflo memory` itself considers live (memory-initializer.js ACTIVE_MEMORY_ROW_SQL). */
-const ACTIVE_ROW_SQL = "(status = 'active' OR status IS NULL)";
+/** Installed Ruflo live-memory-row.js visibility; bind current time on every read. */
+const ACTIVE_ROW_SQL = "(status = 'active' OR status IS NULL) AND (expires_at IS NULL OR expires_at > ?)";
 
 /**
  * Every SQLite database file begins with this 16-byte header (sqlite.org/fileformat.html §1.3):
@@ -224,7 +224,7 @@ export function openProgressionReader(dbPath, { deadlineAt = Infinity, signal }
   }
 
   const query = (statement, params) => {
-    try { return statement.all(...params); } catch (error) {
+    try { return statement.all(Date.now(), ...params); } catch (error) {
       throw new ProgressionReaderUnavailable(`read failed: ${error.message}`);
     }
   };
@@ -236,7 +236,7 @@ export function openProgressionReader(dbPath, { deadlineAt = Infinity, signal }
       if (!Number.isSafeInteger(maxEntries) || maxEntries < 1) throw new TypeError('maxEntries must be a positive safe integer');
       let rows = [];
       if (Number.isFinite(deadlineAt) || signal) {
-        for (const row of listStatement.iterate(namespace)) {
+        for (const row of listStatement.iterate(Date.now(), namespace)) {
           checkDeadline(); rows.push(row);
           if (rows.length > maxEntries) throw new Error('progression enumeration exceeds its bound');
         }

package/plugin/scripts/project-progression-session-start.mjs

@@ -124,29 +124,6 @@ function resultText(result, field) {
   return Buffer.isBuffer(value) ? value.toString('utf8') : String(value ?? '');
 }
 
-function initializeCanonicalStore(store, resolution) {
-  const key = 'project-continuity-bootstrap-v1';
-  const namespace = 'project-progression-control';
-  const value = JSON.stringify({
-    schema: 'ruvnet-brain.project-continuity-bootstrap',
-    schemaVersion: 1,
-    projectIdentity: resolution.projectIdentity,
-  });
-  store.run([
-    'memory', 'store', '--key', key, '--value', value,
-    '--namespace', namespace, '--no-upsert', '--provenance', 'system_observation',
-    '--path', resolution.canonicalAgentDbPath,
-  ]);
-  const readback = store.run([
-    'memory', 'retrieve', '--key', key, '--namespace', namespace,
-    '--value-only', '--path', resolution.canonicalAgentDbPath,
-  ]);
-  if (resultStatus(readback) !== 0 || resultText(readback, 'stdout') !== value
-    || !fs.existsSync(resolution.canonicalAgentDbPath)) {
-    throw new Error('canonical AgentDB initialization failed');
-  }
-}
-
 /**
  * One line, only when there is something to say. Durable-but-uncommitted snapshots are evidence the
  * session must know about: they will be committed at the next capture boundary, and until then the
@@ -267,10 +244,13 @@ export function restoreProgressionForSession({
       const failed = miss('outbox-replay');
       return { ...failed, context: `${failed.context} Replay is suspended by capture consent; no older checkpoint was injected.` };
     }
-    if (initializing) {
-      fs.mkdirSync(path.dirname(resolution.canonicalAgentDbPath), { recursive: true, mode: 0o700 });
-      initializeCanonicalStore(store, resolution);
-    }
+    // ADR-105 rule 6: restoring a session never creates a store. A project's store is created only by the
+    // consent-gated native enrollment (project-memory-enrollment.mjs), never by SessionStart and never when
+    // consent is absent or RUVNET_TURN_CAPTURE=off.
+    if (initializing) return {
+      status: 'unavailable', reason: 'not-enrolled', severity: 'info',
+      context: '[RuvNet Brain — PROJECT CONTINUITY UNAVAILABLE]\nNo canonical project store exists yet; it is created by consent-gated native enrollment at the first captured boundary. Nothing to restore.',
+    };
     if (!suspended) {
       const queue = drainCaptureQueue({ projectDir, budgetMs: Math.max(0, deadlineAt - Date.now()),
         deadlineAt, signal, env, makeStoreFactory: () => () => store });

package/plugin/scripts/project-progression-store.mjs

@@ -358,9 +358,8 @@ export class ProjectProgressionStore {
     this.deadlineAt = deadlineAt;
     this.signal = signal;
     this.resolution = resolveProjectStore({ projectDir, requestedStorePath, deadlineAt });
-    // Best effort: a cleanup that cannot run must never stop a capture or a restore.
-    try { this.legacyDebris = cleanLegacyRufloDebris(path.dirname(this.resolution.canonicalAgentDbPath)); }
-    catch (error) { this.legacyDebris = { removed: [], refused: [{ path: null, reason: error.message }] }; }
+    // Opening continuity is never authorization to remove another store or its artifacts.
+    this.legacyDebris = { removed: [], refused: [], skipped: 'automatic cleanup disabled; existing stores preserved' };
     this.brainHome = brainHome;
     this.rufloBinary = rufloBinary;
     this.runner = runner;
@@ -387,7 +386,7 @@ export class ProjectProgressionStore {
         cwd,
         encoding: 'utf8',
         timeout: 120_000,
-        env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' },
+        env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_MEMORY_PATH: undefined },
       });
     } finally {
       fs.rmSync(cwd, { recursive: true, force: true });
@@ -416,11 +415,24 @@ export class ProjectProgressionStore {
     this.requireCaptureConsent(snapshot);
     const stored = this.run([
       'memory', 'store', '--key', snapshot.eventKey, '--value', JSON.stringify(snapshot),
-      '--namespace', PROGRESSION_NAMESPACE, '--no-upsert', '--provenance', 'system_observation',
+      '--namespace', PROGRESSION_NAMESPACE, '--no-upsert', '--require-native', '--append-only', '--provenance', 'system_observation',
       '--path', this.resolution.canonicalAgentDbPath,
     ]);
     const alreadyStored = resultStatus(stored) !== 0;
-    if (!alreadyStored) onPhase('stored');
+    if (alreadyStored) {
+      const diagnostic = `${resultText(stored, 'stderr')}\n${resultText(stored, 'stdout')}`.replace(/\x1b\[[0-9;]*m/g, '');
+      const isDuplicate = line => {
+        const reason = line.trim().replace(/^\[ERROR\]\s*/, '').replace(/^Failed to store:\s*/, '');
+        return reason === 'immutable append rejected: logical key already exists'
+          || reason === `key "${snapshot.eventKey}" already exists in namespace "${PROGRESSION_NAMESPACE}" — pass upsert=true (--upsert on the CLI) to update it`;
+      };
+      const lines = diagnostic.split(/\r?\n/).map(line => line.trim()).filter(Boolean);
+      const duplicate = lines.some(isDuplicate) && lines.filter(line => /^\[ERROR\]|^Failed to store:/i.test(line)).every(isDuplicate)
+        && !/\b(?:unavailable|refus(?:ed|ing|al)|permission denied|native WAL|unsafe write)\b/i.test(diagnostic);
+      if (resultStatus(stored) !== 1 || stored.error || stored.signal || !duplicate) {
+        throw new Error(`progression native append failed: ${resultText(stored, 'stderr').trim() || resultText(stored, 'stdout').trim() || 'unknown error'}`);
+      }
+    } else onPhase('stored');
 
     // THE READ-BACK, through the fast path when it is available.
     //

package/plugin/scripts/project-store-resolver.mjs

@@ -1,6 +1,7 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import os from 'node:os';
 import { execFileSync } from 'node:child_process';
 
 function sha256(value) {
@@ -47,21 +48,36 @@ function gitValue(cwd, args, gitTimeoutMs, deadlineAt) {
     return execFileSync('git', args, {
       cwd,
       encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, LC_ALL: 'C', LANG: 'C' },
       ...(Number.isFinite(remaining) || gitTimeoutMs
         ? { timeout: Math.max(1, Math.floor(Math.min(gitTimeoutMs || Infinity, remaining))), killSignal: 'SIGKILL' } : {}),
     }).trim();
   } catch (error) {
     // A timed-out Git identity check is not evidence for a non-git project.
     if (error.code === 'ETIMEDOUT') throw new Error('Git project identity timed out');
-    return null;
+    if (error.code === 'ENOENT' && !(() => { for (let c = cwd; ; c = path.dirname(c)) { if (fs.existsSync(path.join(c, '.git'))) return true; if (path.dirname(c) === c) return false; } })()) return null; // no git binary and no .git marker: not a Git project
+    if (error.status === 128 && /^fatal: not a git repository\b/m.test(String(error.stderr || ''))) {
+      let cursor = cwd;
+      for (;;) {
+        if (fs.existsSync(path.join(cursor, '.git'))) throw new Error('Git project identity unavailable: invalid Git marker');
+        const parent = path.dirname(cursor);
+        if (parent === cursor) break;
+        cursor = parent;
+      }
+      return null;
+    }
+    throw new Error('Git project identity unavailable');
   }
 }
 
 function gitProject(projectDir, gitTimeoutMs, deadlineAt) {
-  const commonValue = gitValue(projectDir, ['rev-parse', '--path-format=absolute', '--git-common-dir'], gitTimeoutMs, deadlineAt);
-  const checkoutValue = gitValue(projectDir, ['rev-parse', '--show-toplevel'], gitTimeoutMs, deadlineAt);
-  if (!commonValue || !checkoutValue) return null;
+  // One process, two lines (common dir, then checkout root): each Git spawn is a load-sensitive cost on the prompt path.
+  const identity = gitValue(projectDir, ['rev-parse', '--path-format=absolute', '--git-common-dir', '--show-toplevel'], gitTimeoutMs, deadlineAt);
+  if (identity === null) return null;
+  const [commonValue, checkoutValue, ...extra] = identity.split('\n');
+  if (extra.length) throw new Error('Git project identity incomplete');
+  if (!commonValue || !checkoutValue) throw new Error('Git project identity incomplete');
   const gitCommonDir = canonicalDirectory(commonValue, 'Git common directory');
   const checkoutRoot = canonicalDirectory(checkoutValue, 'Git checkout root');
   if (path.basename(gitCommonDir) !== '.git') {
@@ -74,6 +90,18 @@ function gitProject(projectDir, gitTimeoutMs, deadlineAt) {
   };
 }
 
+function nonGitRoot(input) {
+  // A home directory that does not exist (CI sandboxes, relocated HOME) must not make project resolution throw.
+  const home = (() => { try { return fs.realpathSync.native(os.homedir()); } catch { return path.resolve(os.homedir()); } })();
+  let cursor = input;
+  while (cursor !== path.dirname(cursor) && cursor !== home) {
+    if (fs.existsSync(path.join(cursor, '.swarm', 'memory.db'))
+      || ['AGENTS.md', 'package.json', 'Cargo.toml', 'pyproject.toml'].some((marker) => fs.existsSync(path.join(cursor, marker)))) return cursor;
+    cursor = path.dirname(cursor);
+  }
+  return input;
+}
+
 export function resolveProjectStore({ projectDir = process.cwd(), requestedStorePath, gitTimeoutMs, deadlineAt = Infinity } = {}) {
   const canonicalInput = canonicalDirectory(projectDir, 'projectDir');
   if (gitTimeoutMs !== undefined && (!Number.isSafeInteger(gitTimeoutMs) || gitTimeoutMs <= 0)) throw new TypeError('gitTimeoutMs must be a positive integer');
@@ -81,7 +109,7 @@ export function resolveProjectStore({ projectDir = process.cwd(), requestedStore
   const resolved = git ?? {
     gitCommonDir: null,
     checkoutRoot: canonicalInput,
-    projectRoot: canonicalInput,
+    projectRoot: nonGitRoot(canonicalInput),
   };
   const kind = git ? 'git' : 'non-git';
   const canonicalAgentDbPath = path.join(resolved.projectRoot, '.swarm', 'memory.db');
@@ -116,3 +144,13 @@ export function resolveProjectStore({ projectDir = process.cwd(), requestedStore
     projectIdentity,
   });
 }
+
+/** Default enrollment applies only to Git developer roots; explicit consent is evaluated by callers. */
+export function globalEnrollmentAllowed({ resolution, home = os.homedir(), brainHome = path.join(home, '.cache', 'ruvnet-brain'),
+  temporaryRoots = [os.tmpdir(), '/tmp', '/private/tmp'],
+  systemRoots = ['/System', '/Library', '/usr', '/etc', '/var', '/private/var', '/proc', '/sys', '/dev'] } = {}) {
+  const canonical = (value) => { try { return fs.realpathSync.native(value); } catch { return path.resolve(value); } };
+  const root = resolution.projectRoot;
+  return resolution.kind === 'git' && root !== canonical(home) && root !== path.parse(root).root
+    && ![...temporaryRoots, ...systemRoots, brainHome].some((excluded) => isWithin(canonical(excluded), root));
+}

package/plugin/scripts/session-snapshot-hook.mjs

@@ -15,6 +15,7 @@ import { projectDirectory } from './project-identity.mjs';
 import { buildProjectProgression } from './project-progression-producer.mjs';
 import { ProjectProgressionStore } from './project-progression-store.mjs';
 import { resolveProjectStore } from './project-store-resolver.mjs';
+import { ensureProjectMemory } from './project-memory-enrollment.mjs';
 import { resolveTurnDb, captureTurnOutcome } from './turn-outcome-capture.mjs';
 import { captureContinuityEvents, stopNotice } from './continuity-journal.mjs';
 import { automaticProgressionSuspensionResult } from './project-progression-suspension.mjs';
@@ -129,6 +130,7 @@ export function runSessionSnapshotHook(projectDir, event, {
   spawnReplay = replayOutboxDetached,
   ordered = null,
   captureEvents = captureContinuityEvents,
+  enrollMemory = ensureProjectMemory,
   deadlineAt: inheritedDeadlineAt = Infinity,
   signal,
 } = {}) {
@@ -136,6 +138,11 @@ export function runSessionSnapshotHook(projectDir, event, {
   const checkDeadline = () => { if (signal?.aborted || now() >= deadlineAt) throw new Error('restore deadline exceeded'); };
   const suspended = (reason) => ({ metadataWritten: false, progressionCaptured: false, receipt: null, skipped: reason,
     turn: { event, recorded: false, skipped: reason }, continuity: { event, recorded: 0, launched: false, skipped: reason } });
+  let enrollmentPayload = {};
+  try { enrollmentPayload = rawInput ? JSON.parse(rawInput) : {}; } catch { /* malformed payload */ }
+  const enrollment = enrollMemory({ projectDir, env, event, payload: enrollmentPayload, host, deadlineAt });
+  if (enrollment.state === 'pending') return { ...suspended('native project memory enrollment pending'), enrollment };
+  if (enrollment.state === 'disabled' || enrollment.state === 'unavailable') return { ...suspended(enrollment.reason), enrollment };
   // Consent is checked before metadata, transcript inspection or any durable capture queue.
   try {
     checkDeadline();

package/plugin/scripts/session-start-core.mjs

@@ -26,6 +26,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { enrollmentPlan } from './project-memory-enrollment.mjs';
 import { restoreWithBrief } from './continuity-brief.mjs';
 import { turnRecordingStatus } from './turn-outcome-capture.mjs';
 import {
@@ -189,6 +190,11 @@ export async function runSessionStart({
     }
   };
 
+  // Report only. SessionStart never creates or bootstraps a store (ADR-105 rule 6); enrollment starts at the first
+  // consented captured boundary, so a session that merely started leaves no store behind.
+  let enrollment;
+  try { enrollment = enrollmentPlan({ projectDir: cwd, env, deadlineAt: hookDeadlineAt }); } catch (error) { enrollment = { state: 'unavailable', reason: error.message }; }
+  if (enrollment.state === 'pending' || enrollment.state === 'unavailable') emit(`[RuvNet Brain — TURN CAPTURE] Project memory enrollment ${enrollment.state}; restoration is not yet proven.`);
   const restoreStart = Date.now();
   const restoreDeadlineAt = Math.min(hookDeadlineAt, restoreStart + STAGE_BUDGETS_MS.restore);
   const restoreController = new AbortController();