ruvnet-brain 4.6.2 → 4.6.4

package/plugin/scripts/learn-capture.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 // PostToolUse captures only a fixed workflow vocabulary, then schedules bounded orphan recovery.
+import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID, createHash } from 'node:crypto';
 import { spawn } from 'node:child_process';
@@ -7,38 +8,70 @@ import { fileURLToPath } from 'node:url';
 import { readStdinBounded } from './hook-input.mjs';
 import { learningContext } from './runtime-preferences.mjs';
 import { learningTarget } from './learning-store.mjs';
-import { safeQueue, safeAction, writeExclusive, takeQueueLock, releaseQueueLock } from './learning-queue.mjs';
+import { safeQueue, safeAction, writeExclusive, takeQueueLock, releaseQueueLock, queueFiles } from './learning-queue.mjs';
 
-try {
-  const context = learningContext();
-  if (!context.enabled) process.exit(0);
-  const raw = await readStdinBounded({ maxBytes: 65536, emptyMs: 150 });
-  const input = JSON.parse(raw.toString());
-  if (input.hook_event_name && input.hook_event_name !== 'PostToolUse') process.exit(0);
-  const response = input.tool_response;
-  if (typeof response === 'string') {
-    const exit = /^Process exited with code (-?\d+)\s*$/m.exec(response);
-    if ((exit && Number(exit[1]) !== 0) || /Process running with session ID/.test(response)) process.exit(0);
-  }
-  if (input.error || input.is_error === true || response?.error || response?.interrupted === true || response?.signal
-    || response?.success === false || response?.is_error === true || response?.isError === true
-    || [response?.exit_code, response?.exitCode, response?.status].some(value => Number.isInteger(value) && value !== 0)) process.exit(0);
-  const tool = input.tool_name;
-  if (!['Bash', 'Write', 'Edit', 'MultiEdit'].includes(tool)) process.exit(0);
-  const action = safeAction(tool, tool === 'Bash' ? input.tool_input?.command : 'edit file');
-  if (!action) process.exit(0);
-  const fresh = learningContext();
-  if (!fresh.enabled || fresh.queueDir !== context.queueDir) process.exit(0);
-  learningTarget(fresh); // Existing authorized user store is required before creating any user queue bytes.
-  const dir = safeQueue(fresh, true);
-  const sid = createHash('sha256').update(String(input.session_id || process.env.CLAUDE_SESSION_ID || 'default')).digest('hex').slice(0, 24);
-  writeExclusive(path.join(dir, `session-${sid}-${randomUUID()}.jsonl`), JSON.stringify({ tool, action }) + '\n');
-  // Per-scope lock in the flusher suppresses duplicate workers; capture never waits on the learner.
-  const token = takeQueueLock(fresh);
-  if (!token) process.exit(0);
-  const child = spawn(process.execPath, [fileURLToPath(new URL('./learn-flush.mjs', import.meta.url)), '--supervisor'], {
-    cwd: fresh.projectDir, detached: true, stdio: 'ignore', windowsHide: true, env: { ...process.env, RUVNET_LEARN_WORKER_TOKEN: token },
-  });
-  child.on('error', () => releaseQueueLock(fresh, token)); child.unref();
-} catch { /* advisory transport; unsafe/malformed input produces no persisted payload */ }
-process.exit(0);
+/**
+ * One PostToolUse observation. Since ADR-106 it runs IN-PROCESS from session-snapshot's PostToolUse
+ * boundary (one registration instead of two); the script entry below stays for explicit invocation.
+ * learningContext() owns consent and brain-off, so the fold keeps ADR-054's OFF contract.
+ */
+export function captureLearning(input) {
+  try {
+    const context = learningContext();
+    if (!context.enabled || !input || typeof input !== 'object') return false;
+    if (input.hook_event_name && input.hook_event_name !== 'PostToolUse') return false;
+    const response = input.tool_response;
+    if (typeof response === 'string') {
+      const exit = /^Process exited with code (-?\d+)\s*$/m.exec(response);
+      if ((exit && Number(exit[1]) !== 0) || /Process running with session ID/.test(response)) return false;
+    }
+    if (input.error || input.is_error === true || response?.error || response?.interrupted === true || response?.signal
+      || response?.success === false || response?.is_error === true || response?.isError === true
+      || [response?.exit_code, response?.exitCode, response?.status].some(value => Number.isInteger(value) && value !== 0)) return false;
+    const tool = input.tool_name;
+    if (!['Bash', 'Write', 'Edit', 'MultiEdit'].includes(tool)) return false;
+    const action = safeAction(tool, tool === 'Bash' ? input.tool_input?.command : 'edit file');
+    if (!action) return false;
+    const fresh = learningContext();
+    if (!fresh.enabled || fresh.queueDir !== context.queueDir) return false;
+    learningTarget(fresh); // Existing authorized user store is required before creating any user queue bytes.
+    const dir = safeQueue(fresh, true);
+    const sid = createHash('sha256').update(String(input.session_id || process.env.CLAUDE_SESSION_ID || 'default')).digest('hex').slice(0, 24);
+    writeExclusive(path.join(dir, `session-${sid}-${randomUUID()}.jsonl`), JSON.stringify({ tool, action }) + '\n');
+    // Per-scope lock in the flusher suppresses duplicate workers; capture never waits on the learner.
+    const token = takeQueueLock(fresh);
+    if (!token) return true;
+    const child = spawn(process.execPath, [fileURLToPath(new URL('./learn-flush.mjs', import.meta.url)), '--supervisor'], {
+      cwd: fresh.projectDir, detached: true, stdio: 'ignore', windowsHide: true, env: { ...process.env, RUVNET_LEARN_WORKER_TOKEN: token },
+    });
+    child.on('error', () => releaseQueueLock(fresh, token)); child.unref();
+    return true;
+  } catch { return false; /* advisory transport; unsafe/malformed input produces no persisted payload */ }
+}
+
+/**
+ * Lifecycle recovery (formerly its own SessionStart/SessionEnd registration, ADR-106): when learning
+ * is enabled, start learn-flush detached so an orphaned queue is drained by one finite worker. The
+ * caller never waits; learn-flush owns the lock, the deadline and the consent re-checks.
+ */
+export function scheduleLearningRecovery({ cwd = process.cwd(), env = process.env, spawnFn = spawn } = {}) {
+  try {
+    const context = learningContext({ env, cwd });
+    if (!context.enabled) return false;
+    // Nothing queued, nothing to recover. Spawning anyway cost a process at every session boundary and,
+    // on Windows, a live worker holds the project directory as its cwd (EBUSY on delete/move).
+    if (queueFiles(context, { limit: 1, deadline: Date.now() + 100 }).length === 0) return false;
+    const child = spawnFn(process.execPath, [fileURLToPath(new URL('./learn-flush.mjs', import.meta.url))], {
+      cwd, detached: true, stdio: 'ignore', windowsHide: true, env });
+    child.on?.('error', () => {}); child.unref?.();
+    return true;
+  } catch { return false; }
+}
+
+const isMain = (() => { try { return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); } catch { return false; } })();
+if (isMain) {
+  try {
+    if (learningContext().enabled) captureLearning(JSON.parse((await readStdinBounded({ maxBytes: 65536, emptyMs: 150 })).toString()));
+  } catch { /* malformed input produces no persisted payload */ }
+  process.exit(0);
+}

package/plugin/scripts/native-turn-transcript.mjs

@@ -0,0 +1,51 @@
+/** Bounded, mechanical Codex JSONL normalization. No model inference or user-text persistence. */
+const LIMIT = 2 * 1024 * 1024;
+const text = content => typeof content === 'string' ? content : Array.isArray(content)
+  ? content.filter(part => ['text', 'input_text', 'output_text'].includes(part?.type)).map(part => part.text || '').join('\n') : '';
+const message = (role, content) => ({ message: { role, content } });
+const parse = value => { try { return JSON.parse(value); } catch { return null; } };
+
+/** Keep call IDs intact; torn/unknown records cannot manufacture successful tool evidence. */
+export function nativeTurnLines(lines, host) {
+  if (host !== 'codex') return lines;
+  const records = []; let bytes = 0;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    bytes += Buffer.byteLength(String(lines[i]));
+    if (bytes > LIMIT) break;
+    const record = parse(lines[i]); if (record) records.push(record);
+  }
+  records.reverse();
+  const out = []; const sessions = new Map(); const calls = new Map();
+  for (const record of records) {
+    const p = record.payload;
+    if (record.type === 'event_msg' && p?.type === 'user_message') {
+      out.push(message('user', p.message || '')); continue;
+    }
+    if (record.type === 'event_msg' && p?.type === 'agent_message' && typeof p.message === 'string') {
+      out.push(message('assistant', p.message)); continue;
+    }
+    if (record.type !== 'response_item' || !p) continue;
+    if (p.type === 'message' && ['user', 'assistant'].includes(p.role)) {
+      out.push(message(p.role, text(p.content))); continue;
+    }
+    if (['function_call', 'custom_tool_call'].includes(p.type) && typeof p.call_id === 'string') {
+      const args = typeof p.arguments === 'string' ? parse(p.arguments) : p.arguments;
+      let name = String(p.name || '').split('.').at(-1); let input = args || {};
+      if (name === 'exec_command' && typeof args?.cmd === 'string') { name = 'Bash'; input = { command: args.cmd }; }
+      if (name === 'apply_patch') input = { input: p.input || '' };
+      if (name === 'write_stdin' && sessions.has(args?.session_id)) {
+        name = 'Bash'; input = { command: sessions.get(args.session_id) };
+      }
+      calls.set(p.call_id, { name, input });
+      out.push(message('assistant', [{ type: 'tool_use', id: p.call_id, name, input }]));
+    } else if (['function_call_output', 'custom_tool_call_output'].includes(p.type) && typeof p.call_id === 'string') {
+      const result = typeof p.output === 'string' ? parse(p.output) : p.output;
+      const call = calls.get(p.call_id);
+      if (Number.isSafeInteger(result?.session_id) && call?.name === 'Bash') sessions.set(result.session_id, call.input.command);
+      // Native structured exit fields are retained; opaque text is never guessed to be a pass.
+      out.push(message('user', [{ ...(result && typeof result === 'object' ? result : {}),
+        type: 'tool_result', tool_use_id: p.call_id, content: typeof p.output === 'string' ? p.output : JSON.stringify(p.output ?? '') }]));
+    }
+  }
+  return out.map(record => JSON.stringify(record));
+}

package/plugin/scripts/project-capture-queue.mjs

@@ -318,6 +318,8 @@ export function runOutboxReplay({ projectDir, token = process.env.RUVNET_REPLAY_
             const options = { rawInput: JSON.stringify(job.payload), host: job.host, env,
               budgetMs: Math.max(0, deadlineAt - now()), deadlineAt, signal,
               makeStoreFactory: () => makeStoreFactory(deadlineAt), now, ordered: held, writeMetadata: false,
+              // A queued job was admitted at its live boundary; replay must not re-run (or be suspended by) enrollment.
+              enrollMemory: () => ({ state: 'existing' }),
               captureTurn: () => ({ recorded: false, skipped: 'detached replay' }),
               captureEvents: () => ({ recorded: 0, skipped: 'detached replay' }) };
             const result = job.payload?.normalizedTransition ? captureNormalized(job, options)

package/plugin/scripts/project-memory-enrollment.mjs

@@ -0,0 +1,203 @@
+/** Consent-gated lazy enrollment. Hooks queue derived events before a detached native bootstrap. */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { spawn, spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { resolveProjectStore, globalEnrollmentAllowed } from './project-store-resolver.mjs';
+import { resolveTurnDb, turnCapturePolicyFile } from './turn-outcome-capture.mjs';
+import { resolveRuflo, rufloInvocation } from './ruflo-bin.mjs';
+import { redactText } from './continuity-events.mjs';
+import { enrichStateWithObservation } from './project-progression-hook.mjs';
+import { redactProgression } from './project-progression-contract.mjs';
+import { normalizeHostEvent } from './hook-input.mjs';
+import { maskExcludedPaths, privateProgressionState } from './turn-capture-privacy.mjs';
+
+const canonical = (value) => { try { return fs.realpathSync.native(value); } catch { return path.resolve(value); } };
+export const ENROLLMENT_NAMESPACE = 'project-enrollment';
+const receiptName = '.memory-enrollment.json';
+const queueName = '.memory-enrollment-pending';
+
+export function enrollmentPlan({ projectDir, env = process.env, deadlineAt = Infinity,
+  temporaryRoots = [os.tmpdir(), '/tmp', '/private/tmp'], systemRoots = ['/System', '/Library', '/usr', '/etc', '/var', '/private/var', '/proc', '/sys', '/dev'] } = {}) {
+  const home = canonical(env.HOME || env.USERPROFILE || os.homedir());
+  const brainHome = canonical(env.RUVNET_BRAIN_HOME || path.join(home, '.cache', 'ruvnet-brain'));
+  const resolution = resolveProjectStore({ projectDir, gitTimeoutMs: 500, deadlineAt });
+  // The consent guard and the plan must agree on which roots are excluded from default enrollment.
+  const consent = resolveTurnDb({ projectDir, brainHome, gitTimeoutMs: 500, deadlineAt, enrollmentRoots: { temporaryRoots, systemRoots } });
+  if (consent.skipped) return { ...resolution, state: 'disabled', reason: consent.skipped };
+  let policy = {};
+  try { policy = JSON.parse(fs.readFileSync(turnCapturePolicyFile(brainHome), 'utf8')); } catch { /* resolveTurnDb validates any present policy */ }
+  const explicit = policy.paths?.[canonical(projectDir)] ?? policy.projects?.[resolution.projectRoot];
+  const hasDb = fs.existsSync(resolution.canonicalAgentDbPath);
+  // RUVNET_TURN_CAPTURE=off means turn capture is off: it never creates a store. (It does not suspend progression or
+  // continuity capture on an existing store; queueBoundary additionally withholds the assistant text while it is off.)
+  if (!hasDb && String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() === 'off') return { ...resolution, state: 'disabled', reason: 'RUVNET_TURN_CAPTURE=off' };
+  if (!hasDb && explicit !== 'on') {
+    if (resolution.kind !== 'git') return { ...resolution, state: 'disabled', reason: 'non-Git enrollment requires explicit project opt-in' };
+    if (!globalEnrollmentAllowed({ resolution, home, brainHome, temporaryRoots, systemRoots })) {
+      return { ...resolution, state: 'disabled', reason: 'global enrollment excludes home, temporary, system and Brain cache roots' };
+    }
+  }
+  let enrollmentPending = false;
+  const receipt = path.join(resolution.projectRoot, '.swarm', receiptName);
+  if (fs.existsSync(receipt)) {
+    const stat = fs.lstatSync(receipt);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) throw new Error('unsafe enrollment receipt');
+    // An unparsable receipt is a torn write from a killed hook: it means "not ready", never "unavailable forever".
+    try { enrollmentPending = JSON.parse(fs.readFileSync(receipt, 'utf8')).state === 'pending'; } catch { enrollmentPending = true; }
+  }
+  return { ...resolution, state: hasDb && !enrollmentPending ? 'existing' : 'pending', brainHome, contentPathExcludes: consent.contentPathExcludes || [] };
+}
+
+/** Create-if-absent. A hook killed mid-write leaves a torn FINAL file, which every reader tolerates (an unparsable
+ * receipt means pending; an unparsable queue entry is preserved as .corrupt). No hard-link or rename dance: a link
+ * window leaves nlink 2 on a killed hook, which the readers' nlink check would then reject forever. */
+function createExclusive(file, text) {
+  let fd;
+  try { fd = fs.openSync(file, 'wx', 0o600); } catch (error) { if (error.code === 'EEXIST') return; throw error; }
+  try { fs.writeFileSync(fd, text); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+}
+
+function safeDirectory(directory) {
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  const stat = fs.lstatSync(directory);
+  if (!stat.isDirectory() || stat.isSymbolicLink() || canonical(directory) !== directory) throw new Error('enrollment directory is not canonical');
+}
+
+/** Only a small derived outcome is queued; never prompts, transcripts, tool input or environment. */
+function queueBoundary(plan, { event, payload, host, projectDir, env = process.env }) {
+  if (!event || typeof payload?.session_id !== 'string' || !payload.session_id) return false;
+  const directory = path.join(plan.projectRoot, '.swarm', queueName);
+  safeDirectory(directory);
+  const turnCaptureOff = String(env.RUVNET_TURN_CAPTURE || '').toLowerCase() === 'off';
+  const text = turnCaptureOff ? '' : String(payload.last_assistant_message || '');
+  const filtered = maskExcludedPaths(text, plan.contentPathExcludes, projectDir);
+  const last = filtered === text ? redactText(text).slice(0, 12000) : '[REDACTED:excluded-resource-outcome]';
+  const normalized = normalizeHostEvent(payload) || payload;
+  const observed = enrichStateWithObservation({ commands: [] }, { ...normalized, hook_event_name: event },
+    { contentPathExcludes: plan.contentPathExcludes, projectDir }).commands[0];
+  const tool = observed ? { tool_name: redactText(observed.tool), tool_input: {
+    ...(observed.command ? { command: redactText(observed.command) } : {}),
+    ...(observed.filePath ? { file_path: redactText(observed.filePath) } : {}) },
+    tool_response: JSON.parse(redactText(JSON.stringify(Object.fromEntries(Object.entries(observed)
+      .filter(([key]) => ['outcome', 'exitCode', 'error', 'signal', 'interrupted', 'isError', 'stdout', 'stderr', 'result'].includes(key)))))) } : {};
+  let strategic = {};
+  if (payload.projectProgression || payload.project_progression) {
+    const extension = redactProgression(payload.projectProgression || payload.project_progression).value;
+    extension.completeProjectState = privateProgressionState(extension.completeProjectState, plan.contentPathExcludes, projectDir);
+    strategic = { projectProgression: extension };
+  }
+  const boundary = { projectDir: canonical(projectDir), event, host,
+    payload: { session_id: payload.session_id, hook_event_name: event, ...tool, ...strategic, ...(last ? { last_assistant_message: last } : {}) } };
+  const digest = crypto.createHash('sha256').update(JSON.stringify(boundary)).digest('hex');
+  const file = path.join(directory, `${digest}.json`);
+  createExclusive(file, JSON.stringify(boundary));
+  const dirFd = fs.openSync(directory, 'r'); try { fs.fsyncSync(dirFd); } finally { fs.closeSync(dirFd); }
+  return true;
+}
+
+export function ensureProjectMemory({ projectDir, env = process.env, event, payload, host = env.RUVNET_HOOK_HOST || 'claude', deadlineAt = Infinity,
+  launch = launchEnrollment, planOptions = {} } = {}) {
+  try {
+    const plan = enrollmentPlan({ ...planOptions, projectDir, env, deadlineAt });
+    if (plan.state === 'disabled') return plan;
+    if (plan.state === 'existing') {
+      const queue = path.join(plan.projectRoot, '.swarm', queueName);
+      if (!fs.existsSync(queue) || !fs.readdirSync(queue).some((name) => /^[a-f0-9]{64}\.json$/.test(name))) return plan;
+    }
+    safeDirectory(path.join(plan.projectRoot, '.swarm'));
+    if (plan.state === 'pending') {
+      const receipt = path.join(plan.projectRoot, '.swarm', receiptName);
+      createExclusive(receipt, JSON.stringify({ schemaVersion: 1, state: 'pending', canonicalAgentDbPath: plan.canonicalAgentDbPath }));
+    }
+    const queued = plan.state === 'pending' && queueBoundary(plan, { event, payload, host, projectDir, env });
+    const launched = launch({ projectDir, env });
+    return { ...plan, state: plan.state === 'existing' ? 'existing' : 'pending', queued, launched };
+  } catch (error) { return { state: 'unavailable', reason: error.message }; }
+}
+
+export function launchEnrollment({ projectDir, env }) {
+  const child = spawn(process.execPath, [fileURLToPath(import.meta.url), '--enroll', canonical(projectDir)], {
+    cwd: os.tmpdir(), env: { ...env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_MEMORY_PATH: undefined }, detached: true, windowsHide: true, stdio: 'ignore',
+  });
+  child.unref();
+  return Boolean(child.pid);
+}
+
+/** Exact native append and same-path readback; existing stores are never initialized or replaced. */
+export async function enrollProjectMemory({ projectDir, env = process.env, run = spawnSync, replay } = {}) {
+  const plan = enrollmentPlan({ projectDir, env });
+  if (plan.state === 'disabled') return plan;
+  const swarm = path.join(plan.projectRoot, '.swarm');
+  safeDirectory(swarm);
+  const lock = path.join(swarm, '.memory-enrollment.lock');
+  const token = `${process.pid} ${crypto.randomUUID()}`;
+  try { fs.writeFileSync(lock, token, { flag: 'wx', mode: 0o600 }); } catch (error) {
+    if (error.code !== 'EEXIST') throw error;
+    const stat = fs.lstatSync(lock);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) return { ...plan, state: 'pending', reason: 'unsafe enrollment lock' };
+    const previous = fs.readFileSync(lock, 'utf8');
+    const pid = Number(previous.split(' ')[0]);
+    let dead = false;
+    if (Number.isSafeInteger(pid) && pid > 0) try { process.kill(pid, 0); } catch (failure) { dead = failure.code === 'ESRCH'; }
+    if (!dead || fs.readFileSync(lock, 'utf8') !== previous) return { ...plan, state: 'pending', reason: 'enrollment worker busy' };
+    fs.unlinkSync(lock);
+    try { fs.writeFileSync(lock, token, { flag: 'wx', mode: 0o600 }); } catch { return { ...plan, state: 'pending', reason: 'enrollment worker busy' }; }
+  }
+  const workerDeadlineAt = Date.now() + 60000;
+  const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'rnb-enrollment-worker-'));
+  try {
+    const binary = resolveRuflo({ env, home: env.HOME || os.homedir() });
+    if (!binary) return { ...plan, state: 'pending', reason: 'global Ruflo unavailable' };
+    const key = `project-bootstrap-${plan.projectIdentity.id}`;
+    const value = JSON.stringify({ schemaVersion: 1, projectIdentity: plan.projectIdentity });
+    const invoke = (args) => { const call = rufloInvocation(binary, args); return run(call.executable, call.args,
+      { cwd: scratch, env: { ...env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_MEMORY_PATH: undefined }, encoding: 'utf8', timeout: Math.max(1, Math.min(30000, workerDeadlineAt - Date.now())), maxBuffer: 256 * 1024, shell: false }); };
+    if (plan.state !== 'existing') {
+      invoke(['memory', 'store', '--key', key, '--value', value, '--namespace', ENROLLMENT_NAMESPACE,
+        '--path', plan.canonicalAgentDbPath, '--require-native', '--append-only', '--no-upsert', '--no-embedding']);
+      // Concurrent workers may lose the strict insertion race; exact readback still establishes readiness.
+      const result = invoke(['memory', 'retrieve', '--key', key, '--namespace', ENROLLMENT_NAMESPACE,
+        '--path', plan.canonicalAgentDbPath, '--value-only']);
+      if (result.status !== 0 || String(result.stdout || '').trim() !== value) return { ...plan, state: 'pending', reason: 'native bootstrap readback unavailable' };
+      const receipt = path.join(swarm, receiptName);
+      const temporary = `${receipt}.${crypto.randomUUID()}.tmp`;
+      fs.writeFileSync(temporary, JSON.stringify({ schemaVersion: 1, state: 'ready', key,
+        canonicalAgentDbPath: plan.canonicalAgentDbPath, verifiedAt: new Date().toISOString() }), { flag: 'wx', mode: 0o600 });
+      fs.renameSync(temporary, receipt);
+    }
+    const queue = path.join(swarm, queueName);
+    if (fs.existsSync(queue)) {
+      safeDirectory(queue);
+      const capture = replay || (await import('./session-snapshot-hook.mjs')).runSessionSnapshotHook;
+      for (const name of fs.readdirSync(queue).filter((name) => /^[a-f0-9]{64}\.json$/.test(name)).slice(0, 32)) {
+        if (Date.now() > workerDeadlineAt - 8000) break;
+        const file = path.join(queue, name);
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > 256000) continue;
+        let boundary;
+        try { boundary = JSON.parse(fs.readFileSync(file, 'utf8')); } catch {
+          // Preserve the evidence, stop it blocking every later replay.
+          try { fs.renameSync(file, `${file}.corrupt`); } catch { /* retry next boundary */ }
+          continue;
+        }
+        // Original path privacy is rechecked, never replaced by the primary worktree identity.
+        const consent = enrollmentPlan({ projectDir: boundary.projectDir, env });
+        if (consent.state === 'disabled' || consent.canonicalAgentDbPath !== plan.canonicalAgentDbPath) continue;
+        const result = capture(boundary.projectDir, boundary.event, { rawInput: JSON.stringify(boundary.payload), host: boundary.host,
+          env, enrollMemory: () => ({ state: 'existing' }) });
+        if (result?.turn?.queued || result?.turn?.recorded || result?.continuity?.recorded > 0 || result?.progressionCaptured || result?.deferredToReplayer) fs.unlinkSync(file);
+      }
+    }
+    return { ...plan, state: 'ready' };
+  } finally {
+    fs.rmSync(scratch, { recursive: true, force: true });
+    try { if (fs.readFileSync(lock, 'utf8') === token) fs.unlinkSync(lock); } catch { /* ownership changed */ }
+  }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url) && process.argv[2] === '--enroll') {
+  enrollProjectMemory({ projectDir: process.argv[3] }).catch(() => { /* pending queue survives; retry at the next boundary */ });
+}

package/plugin/scripts/project-progression-reader.mjs

@@ -43,8 +43,8 @@
 import fs from 'node:fs';
 import { loadNodeSqlite } from './node-sqlite.mjs';
 
-/** Rows that `ruflo memory` itself considers live (memory-initializer.js ACTIVE_MEMORY_ROW_SQL). */
-const ACTIVE_ROW_SQL = "(status = 'active' OR status IS NULL)";
+/** Installed Ruflo live-memory-row.js visibility; bind current time on every read. */
+const ACTIVE_ROW_SQL = "(status = 'active' OR status IS NULL) AND (expires_at IS NULL OR expires_at > ?)";
 
 /**
  * Every SQLite database file begins with this 16-byte header (sqlite.org/fileformat.html §1.3):
@@ -224,7 +224,7 @@ export function openProgressionReader(dbPath, { deadlineAt = Infinity, signal }
   }
 
   const query = (statement, params) => {
-    try { return statement.all(...params); } catch (error) {
+    try { return statement.all(Date.now(), ...params); } catch (error) {
       throw new ProgressionReaderUnavailable(`read failed: ${error.message}`);
     }
   };
@@ -236,7 +236,7 @@ export function openProgressionReader(dbPath, { deadlineAt = Infinity, signal }
       if (!Number.isSafeInteger(maxEntries) || maxEntries < 1) throw new TypeError('maxEntries must be a positive safe integer');
       let rows = [];
       if (Number.isFinite(deadlineAt) || signal) {
-        for (const row of listStatement.iterate(namespace)) {
+        for (const row of listStatement.iterate(Date.now(), namespace)) {
           checkDeadline(); rows.push(row);
           if (rows.length > maxEntries) throw new Error('progression enumeration exceeds its bound');
         }

package/plugin/scripts/project-progression-session-start.mjs

@@ -124,29 +124,6 @@ function resultText(result, field) {
   return Buffer.isBuffer(value) ? value.toString('utf8') : String(value ?? '');
 }
 
-function initializeCanonicalStore(store, resolution) {
-  const key = 'project-continuity-bootstrap-v1';
-  const namespace = 'project-progression-control';
-  const value = JSON.stringify({
-    schema: 'ruvnet-brain.project-continuity-bootstrap',
-    schemaVersion: 1,
-    projectIdentity: resolution.projectIdentity,
-  });
-  store.run([
-    'memory', 'store', '--key', key, '--value', value,
-    '--namespace', namespace, '--no-upsert', '--provenance', 'system_observation',
-    '--path', resolution.canonicalAgentDbPath,
-  ]);
-  const readback = store.run([
-    'memory', 'retrieve', '--key', key, '--namespace', namespace,
-    '--value-only', '--path', resolution.canonicalAgentDbPath,
-  ]);
-  if (resultStatus(readback) !== 0 || resultText(readback, 'stdout') !== value
-    || !fs.existsSync(resolution.canonicalAgentDbPath)) {
-    throw new Error('canonical AgentDB initialization failed');
-  }
-}
-
 /**
  * One line, only when there is something to say. Durable-but-uncommitted snapshots are evidence the
  * session must know about: they will be committed at the next capture boundary, and until then the
@@ -267,10 +244,13 @@ export function restoreProgressionForSession({
       const failed = miss('outbox-replay');
       return { ...failed, context: `${failed.context} Replay is suspended by capture consent; no older checkpoint was injected.` };
     }
-    if (initializing) {
-      fs.mkdirSync(path.dirname(resolution.canonicalAgentDbPath), { recursive: true, mode: 0o700 });
-      initializeCanonicalStore(store, resolution);
-    }
+    // ADR-105 rule 6: restoring a session never creates a store. A project's store is created only by the
+    // consent-gated native enrollment (project-memory-enrollment.mjs), never by SessionStart and never when
+    // consent is absent or RUVNET_TURN_CAPTURE=off.
+    if (initializing) return {
+      status: 'unavailable', reason: 'not-enrolled', severity: 'info',
+      context: '[RuvNet Brain — PROJECT CONTINUITY UNAVAILABLE]\nNo canonical project store exists yet; it is created by consent-gated native enrollment at the first captured boundary. Nothing to restore.',
+    };
     if (!suspended) {
       const queue = drainCaptureQueue({ projectDir, budgetMs: Math.max(0, deadlineAt - Date.now()),
         deadlineAt, signal, env, makeStoreFactory: () => () => store });

package/plugin/scripts/project-progression-store.mjs

@@ -358,9 +358,8 @@ export class ProjectProgressionStore {
     this.deadlineAt = deadlineAt;
     this.signal = signal;
     this.resolution = resolveProjectStore({ projectDir, requestedStorePath, deadlineAt });
-    // Best effort: a cleanup that cannot run must never stop a capture or a restore.
-    try { this.legacyDebris = cleanLegacyRufloDebris(path.dirname(this.resolution.canonicalAgentDbPath)); }
-    catch (error) { this.legacyDebris = { removed: [], refused: [{ path: null, reason: error.message }] }; }
+    // Opening continuity is never authorization to remove another store or its artifacts.
+    this.legacyDebris = { removed: [], refused: [], skipped: 'automatic cleanup disabled; existing stores preserved' };
     this.brainHome = brainHome;
     this.rufloBinary = rufloBinary;
     this.runner = runner;
@@ -387,7 +386,7 @@ export class ProjectProgressionStore {
         cwd,
         encoding: 'utf8',
         timeout: 120_000,
-        env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0' },
+        env: { ...process.env, RUFLO_DAEMON_AUTOSTART: '0', CLAUDE_FLOW_MEMORY_PATH: undefined },
       });
     } finally {
       fs.rmSync(cwd, { recursive: true, force: true });
@@ -416,11 +415,24 @@ export class ProjectProgressionStore {
     this.requireCaptureConsent(snapshot);
     const stored = this.run([
       'memory', 'store', '--key', snapshot.eventKey, '--value', JSON.stringify(snapshot),
-      '--namespace', PROGRESSION_NAMESPACE, '--no-upsert', '--provenance', 'system_observation',
+      '--namespace', PROGRESSION_NAMESPACE, '--no-upsert', '--require-native', '--append-only', '--provenance', 'system_observation',
       '--path', this.resolution.canonicalAgentDbPath,
     ]);
     const alreadyStored = resultStatus(stored) !== 0;
-    if (!alreadyStored) onPhase('stored');
+    if (alreadyStored) {
+      const diagnostic = `${resultText(stored, 'stderr')}\n${resultText(stored, 'stdout')}`.replace(/\x1b\[[0-9;]*m/g, '');
+      const isDuplicate = line => {
+        const reason = line.trim().replace(/^\[ERROR\]\s*/, '').replace(/^Failed to store:\s*/, '');
+        return reason === 'immutable append rejected: logical key already exists'
+          || reason === `key "${snapshot.eventKey}" already exists in namespace "${PROGRESSION_NAMESPACE}" — pass upsert=true (--upsert on the CLI) to update it`;
+      };
+      const lines = diagnostic.split(/\r?\n/).map(line => line.trim()).filter(Boolean);
+      const duplicate = lines.some(isDuplicate) && lines.filter(line => /^\[ERROR\]|^Failed to store:/i.test(line)).every(isDuplicate)
+        && !/\b(?:unavailable|refus(?:ed|ing|al)|permission denied|native WAL|unsafe write)\b/i.test(diagnostic);
+      if (resultStatus(stored) !== 1 || stored.error || stored.signal || !duplicate) {
+        throw new Error(`progression native append failed: ${resultText(stored, 'stderr').trim() || resultText(stored, 'stdout').trim() || 'unknown error'}`);
+      }
+    } else onPhase('stored');
 
     // THE READ-BACK, through the fast path when it is available.
     //

package/plugin/scripts/project-store-resolver.mjs

@@ -1,6 +1,7 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import os from 'node:os';
 import { execFileSync } from 'node:child_process';
 
 function sha256(value) {
@@ -47,21 +48,36 @@ function gitValue(cwd, args, gitTimeoutMs, deadlineAt) {
     return execFileSync('git', args, {
       cwd,
       encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, LC_ALL: 'C', LANG: 'C' },
       ...(Number.isFinite(remaining) || gitTimeoutMs
         ? { timeout: Math.max(1, Math.floor(Math.min(gitTimeoutMs || Infinity, remaining))), killSignal: 'SIGKILL' } : {}),
     }).trim();
   } catch (error) {
     // A timed-out Git identity check is not evidence for a non-git project.
     if (error.code === 'ETIMEDOUT') throw new Error('Git project identity timed out');
-    return null;
+    if (error.code === 'ENOENT' && !(() => { for (let c = cwd; ; c = path.dirname(c)) { if (fs.existsSync(path.join(c, '.git'))) return true; if (path.dirname(c) === c) return false; } })()) return null; // no git binary and no .git marker: not a Git project
+    if (error.status === 128 && /^fatal: not a git repository\b/m.test(String(error.stderr || ''))) {
+      let cursor = cwd;
+      for (;;) {
+        if (fs.existsSync(path.join(cursor, '.git'))) throw new Error('Git project identity unavailable: invalid Git marker');
+        const parent = path.dirname(cursor);
+        if (parent === cursor) break;
+        cursor = parent;
+      }
+      return null;
+    }
+    throw new Error('Git project identity unavailable');
   }
 }
 
 function gitProject(projectDir, gitTimeoutMs, deadlineAt) {
-  const commonValue = gitValue(projectDir, ['rev-parse', '--path-format=absolute', '--git-common-dir'], gitTimeoutMs, deadlineAt);
-  const checkoutValue = gitValue(projectDir, ['rev-parse', '--show-toplevel'], gitTimeoutMs, deadlineAt);
-  if (!commonValue || !checkoutValue) return null;
+  // One process, two lines (common dir, then checkout root): each Git spawn is a load-sensitive cost on the prompt path.
+  const identity = gitValue(projectDir, ['rev-parse', '--path-format=absolute', '--git-common-dir', '--show-toplevel'], gitTimeoutMs, deadlineAt);
+  if (identity === null) return null;
+  const [commonValue, checkoutValue, ...extra] = identity.split('\n');
+  if (extra.length) throw new Error('Git project identity incomplete');
+  if (!commonValue || !checkoutValue) throw new Error('Git project identity incomplete');
   const gitCommonDir = canonicalDirectory(commonValue, 'Git common directory');
   const checkoutRoot = canonicalDirectory(checkoutValue, 'Git checkout root');
   if (path.basename(gitCommonDir) !== '.git') {
@@ -74,6 +90,18 @@ function gitProject(projectDir, gitTimeoutMs, deadlineAt) {
   };
 }
 
+function nonGitRoot(input) {
+  // A home directory that does not exist (CI sandboxes, relocated HOME) must not make project resolution throw.
+  const home = (() => { try { return fs.realpathSync.native(os.homedir()); } catch { return path.resolve(os.homedir()); } })();
+  let cursor = input;
+  while (cursor !== path.dirname(cursor) && cursor !== home) {
+    if (fs.existsSync(path.join(cursor, '.swarm', 'memory.db'))
+      || ['AGENTS.md', 'package.json', 'Cargo.toml', 'pyproject.toml'].some((marker) => fs.existsSync(path.join(cursor, marker)))) return cursor;
+    cursor = path.dirname(cursor);
+  }
+  return input;
+}
+
 export function resolveProjectStore({ projectDir = process.cwd(), requestedStorePath, gitTimeoutMs, deadlineAt = Infinity } = {}) {
   const canonicalInput = canonicalDirectory(projectDir, 'projectDir');
   if (gitTimeoutMs !== undefined && (!Number.isSafeInteger(gitTimeoutMs) || gitTimeoutMs <= 0)) throw new TypeError('gitTimeoutMs must be a positive integer');
@@ -81,7 +109,7 @@ export function resolveProjectStore({ projectDir = process.cwd(), requestedStore
   const resolved = git ?? {
     gitCommonDir: null,
     checkoutRoot: canonicalInput,
-    projectRoot: canonicalInput,
+    projectRoot: nonGitRoot(canonicalInput),
   };
   const kind = git ? 'git' : 'non-git';
   const canonicalAgentDbPath = path.join(resolved.projectRoot, '.swarm', 'memory.db');
@@ -116,3 +144,13 @@ export function resolveProjectStore({ projectDir = process.cwd(), requestedStore
     projectIdentity,
   });
 }
+
+/** Default enrollment applies only to Git developer roots; explicit consent is evaluated by callers. */
+export function globalEnrollmentAllowed({ resolution, home = os.homedir(), brainHome = path.join(home, '.cache', 'ruvnet-brain'),
+  temporaryRoots = [os.tmpdir(), '/tmp', '/private/tmp'],
+  systemRoots = ['/System', '/Library', '/usr', '/etc', '/var', '/private/var', '/proc', '/sys', '/dev'] } = {}) {
+  const canonical = (value) => { try { return fs.realpathSync.native(value); } catch { return path.resolve(value); } };
+  const root = resolution.projectRoot;
+  return resolution.kind === 'git' && root !== canonical(home) && root !== path.parse(root).root
+    && ![...temporaryRoots, ...systemRoots, brainHome].some((excluded) => isWithin(canonical(excluded), root));
+}