ruvnet-brain 4.6.4 → 4.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.6.4",
+  "version": "4.7.0",
   "description": "One-command installer for RuvNet Brain — a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {
@@ -78,7 +78,6 @@
     "release:qualify": "node scripts/release-qualification.mjs",
     "rehearse:corpus": "node scripts/rehearse-corpus-pipeline.mjs",
     "single-source:check": "node scripts/single-source-check.mjs",
-    "benchmark:continuity": "node scripts/qa/progression-validation-benchmark.mjs",
     "host:codex:execution-proof": "node scripts/codex-host-execution-proof.mjs"
   },
   "files": [

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships a UserPromptSubmit retrieve-and-inject grounding hook and a PreToolUse write gate that refuses ungrounded rUv-product code until search_ruvnet has been consulted (ADR-0012 / ADR-067).",
-  "version": "4.6.4",
+  "version": "4.7.0",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.6.4",
+  "version": "4.7.0",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/commands/checkpoint.md

@@ -1,61 +1,43 @@
 ---
-description: "Write a full project checkpoint to this project's canonical AgentDB store — the goal, the acceptance contract, the decisions, what is done, what is blocked, and the exact next action — so the next session (in Claude Code or Codex) resumes from a verified record instead of from nothing. Prints a read-back receipt."
-updated: 2026-09-11
+description: "Write a project checkpoint to this project's AgentDB store with `ruflo memory store` — the goal, the acceptance contract, the decisions, what is done, what is blocked, and the exact next action — and prove it by exact-key `ruflo memory retrieve`. The next session (Claude Code or Codex) restores the newest checkpoint by exact key."
+updated: 2026-10-12
 ---
 
 # RuvNet-Brain: checkpoint
 
 The user is asking you to **persist the state of this project** so the next session can resume it.
 
-Automatic capture already runs at Stop, PreCompact and SessionEnd, and it records everything that can
-be READ from the machine: the git tree, their work ledger, their newest `project-state-current` note,
-a bounded transcript reference. **It cannot read what only you know** — the acceptance contract you
-are working to, the decision you just made and why, the exact next action. That is what this command
-is for, and it is why a checkpoint is worth more than another automatic snapshot.
+PreCompact and SessionEnd already store a small automatic `project-state-auto-<ms>` marker (event,
+branch, head). **It cannot record what only you know** — the acceptance contract, the decision you
+just made and why, the exact next action. That is what this command is for.
 
 ## Do this
 
-**1. Write down the real state — from THIS session, not from a template.**
+**1. Write down the real state — from THIS session, not from a template.** Plain text or JSON with the
+fields you can honestly fill: current goal, acceptance contract, next action, decisions (and why),
+completed / in progress / blockers, failures, changed files, proof artifacts, and what is UNTESTED.
+Empty is better than invented: a fabricated "next action" is worse than none.
 
-Build a JSON object with the fields you can honestly fill. Every field is optional; set at least one.
-Empty is better than invented: a fabricated "next action" is worse than no next action, because the
-next session will act on it.
-
-| field | what goes in it |
-|---|---|
-| `currentGoal` | one sentence: what this work is actually for |
-| `acceptanceContract` | what would make it DONE — the conditions, not the vibe |
-| `nextAction` | the single next concrete step, specific enough to start cold |
-| `decisions` | decisions made and WHY; include the ones you'd otherwise have to re-derive |
-| `completed` / `inProgress` / `blockers` | honest status; a blocker named is a blocker halved |
-| `failures` | what was tried and did not work, so it is not tried again |
-| `changedFiles` | the files this work touched |
-| `proofArtifacts` | commands run, outputs seen, receipts — the evidence, not the claim |
-| `untested` | what was built but NOT verified. Do not omit this one. |
-
-**2. Store it.**
+**2. Store it with rUv's own tool** (append-only: a new key every time, never an update), in the
+project's namespace (the repository directory name):
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/scripts/project-progression-checkpoint.mjs" --json '<your JSON>'
+KEY="project-state-current-$(node -e 'process.stdout.write(String(Date.now()))')"
+ruflo memory store -k "$KEY" -n "<project-dir-name>" --path "<project>/.swarm/memory.db" --value "<the checkpoint text>"
 ```
 
-For anything longer than a line or two, write the JSON to a temp file first and use
-`--json-file <path>` — a large single-quoted argument is how a shell mangles a checkpoint.
-
-**3. Report the receipt, not a claim.**
+**3. Prove it, then report the receipt, not a claim.**
 
-The command prints the exact event key, the payload digest, and the digest of the row **read back
-from the store by that exact key**. Tell the user it is stored only when `readbackVerified` is
-`true`. If the command exits non-zero, say exactly what it printed — an unstored checkpoint that is
-reported as stored is the specific failure this whole system exists to prevent.
+```bash
+ruflo memory retrieve -k "$KEY" -n "<project-dir-name>" --path "<project>/.swarm/memory.db" --value-only
+```
 
-If it reports `replayedPending`, say so: those were snapshots a previously interrupted session had
-made durable but never committed, and this checkpoint settled them.
+Say it is stored only when the retrieved value is exactly what you stored. If either command exits
+non-zero, quote what it printed.
 
 ## What NOT to do
 
 - **Do not** invent progress, decisions, or proof to make the checkpoint look complete.
-- **Do not** write the user's secrets into it. Redaction runs anyway, but do not rely on it.
-- **Do not** hand-write rows into `.swarm/memory.db` or call `ruflo memory store` yourself. This
-  command is the one writer; a second path is how two stores drift apart.
-- **Do not** claim the next session "will remember" anything the receipt did not confirm.
+- **Do not** write secrets into it.
+- **Do not** reuse a key: `project-state-current-<epochms>` is append-only, so concurrent sessions never
+  overwrite each other. SessionStart restores the newest one by exact key.

package/plugin/commands/rnb-brief.md

@@ -1,41 +1,44 @@
 ---
-description: "Come up to speed on this project from AgentDB: the brief (state, what changed, decisions, standing rules, open items, gate outcomes, agent findings) and, on request, the full recorded history. Also records a decision, lesson or open item explicitly, with a read-back receipt."
-updated: 2026-10-01
+description: "Come up to speed on this project from AgentDB with rUv's own tools: the newest project-state-current checkpoint, lessons, recent turn outcomes and decisions, read by exact key with `ruflo memory list|retrieve|search`. Also records a decision, lesson or open item with a read-back receipt."
+updated: 2026-10-12
 ---
 
 # RuvNet-Brain: rnb-brief
 
 The user wants to know **what has happened on this project**, from the record — not from your memory.
+Every command below is `ruflo` (the global binary); `<db>` is `<project>/.swarm/memory.db` and `<ns>` is
+the project directory name.
 
 ## Do this
 
-**1. Show the brief.** Run it and show the output as-is:
+**1. The newest checkpoint.** List, pick the newest `project-state-current-*` key, read it exactly:
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/scripts/continuity-brief.mjs"
+ruflo memory list -n <ns> --limit 1000 --format json --path <db>
+ruflo memory retrieve -k <newest project-state-current-key> -n <ns> --value-only --path <db>
 ```
 
-**2. If they asked for more** (history, "everything", one kind of thing, a time window), pull it:
+**2. Lessons, decisions and recent turns.**
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/scripts/continuity-brief.mjs" --full [--kind decision|lesson|commit|release|gate|finding|open-item] [--since 7d] [--limit 200]
+ruflo memory list -n lessons --format json --path <db>
+ruflo memory list -n turns --limit 20 --format json --path <db>
+ruflo memory search -q "<what the user asked about>" -n continuity-events --limit 10 --path <db>
 ```
 
-Every line carries its provenance (the AgentDB key and time, or the commit SHA). Quote it when you
-rely on an item. A line marked `detected` was inferred from the transcript, not stated explicitly —
-say so. A line marked `PENDING` is durable in the outbox but not yet committed to AgentDB.
+Quote the key of every item you rely on. Search hits are ranked previews: read the exact value with
+`ruflo memory retrieve` before asserting it.
 
 **3. If they asked you to record something** (a decision, a standing rule, an open item):
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/scripts/continuity-brief.mjs" --record --kind decision|lesson|open-item --text "<exactly what was decided>" [--owner "<who>"]
+ruflo memory store -k "<decision|lesson|open-item>-$(node -e 'process.stdout.write(String(Date.now()))')" -n continuity-events --path <db> --value "<exactly what was decided>"
+ruflo memory retrieve -k <that key> -n continuity-events --value-only --path <db>
 ```
 
-Report it as stored only when it prints `stored-and-read-back`. `durable-pending` means it is safe in the
-outbox and will commit at the next capture boundary — say exactly that, not "stored".
+Report it as stored only when the retrieved value matches exactly.
 
 ## What NOT to do
 
-- Do not summarize the history from memory or from the conversation instead of running the command.
-- Do not hand-write rows into `.swarm/memory.db` or call `ruflo memory store` for these yourself.
-- If the last line says `AgentDB: recording stuck`, tell the user that line verbatim before anything else.
+- Do not summarize the history from memory or from the conversation instead of running the commands.
+- Do not use the MCP `agentdb_hierarchical-*` tools for this: they read a different store.

package/plugin/hooks/codex-hooks.json

@@ -1,5 +1,5 @@
 {
-  "description": "RuvNet Brain continuity plane for Codex. Broad legacy automatic gates remain retired. Registrations here are MEASURED, not assumed: a probe hook was registered on all twelve event names the installed codex-cli 0.154.0 binary declares and a real `codex exec` run was observed (2026-09-11). SessionStart, UserPromptSubmit and SessionEnd FIRED and carry handlers. Stop keeps the pre-existing, project-scoped continuation gate; session-snapshot was added at Stop on 2026-09-29 to record each turn's outcome (turn-outcome-capture.mjs) — Codex SessionEnd carries no last_assistant_message, so Stop is the only boundary that can. Its delivery rests on codex-cli 0.158.0's declared stop.command.input schema and the other Codex Stop handlers; it has NOT been live-observed and fails open. PreCompact uses the existing session-snapshot capture handler: Codex0.160.1 declares this native boundary. Registration is not proof of native delivery; manual/automatic delivery remains separately evidenced. All handlers are bounded and fail open. Amended 2026-09-11: UserPromptSubmit also runs ground-ruvnet (grounding injection, ADR-040 §Amendment). Amended 2026-09-12: the 2026-09-11 PreToolUse/PostToolUse \"not observed\" note was measured with a prompt (`codex exec \"reply OK\"`) that never invoked a tool, so neither event had anything to fire on — that was an untested path, not a failing one. Re-probed with prompts that actually call a tool: a real apply_patch write fired PreToolUse/PostToolUse with tool_name \"apply_patch\", and a real MCP call to this repo's own search_ruvnet server fired both with tool_name \"mcp__ruvnet_brain__search_ruvnet\". Both are now registered below: decision-gate's write route (matcher includes apply_patch, Codex's raw write-tool name) and grounding-stamp (unchanged matcher already recognizes the mcp__..__search_ruvnet shape). The bash route (exec_command) remains unregistered — today's measurement covered a write and an MCP call, not exec_command, and extending on that evidence would be the same unproven leap this note replaces. Also added 2026-09-12: grounding-turn-mark (UserPromptSubmit) and grounding-turn-gate (Stop), the \"answered without searching\" pair — a prompt-level grounding directive is advisory, so this records whether it fired and forces continuation at Stop if no search_ruvnet call was recorded since (reusing grounding-stamp's own stamp evidence). Both are registered on Codex identically to Claude: the Stop-block contract (hookSpecificOutput.additionalContext) already has a proven Codex translation via codex-hook-adapter.mjs's Stop branch (see tests/unit/codex-lifecycle-hooks.test.mjs), the same path continuation-gate already uses. Capacity-aware parallel-work guidance is also registered at UserPromptSubmit: it advises the coordinator to launch only real independent workers within sampled resource headroom and the live runtime/tool cap; it never spawns workers or claims execution. Automatic normalized project observations are captured at prompt, pre-tool, post-tool and child completion; Claude also observes PostToolUseFailure. Queued memory is silent (the normal state at prompt and tool boundaries); a stuck queue (queued work older than 10 minutes), an unwritable queue and a hook that failed or timed out internally are disclosed; this does not establish synchronous ADR-073 conformance or native Grok recall. SessionStart has an 8-second measured replay/restore envelope. Issue377: consent-eligible learning captures only fixed workflow metadata; lifecycle recovery schedules one finite worker. Original records remain retained with hash-bound acknowledgments. Native delivery must be separately evidenced; registration is not proof. Amended 2026-10-11 (ADR-106): learning capture and recovery no longer have their own registrations; session-snapshot PostToolUse captures in-process, and session-start and session-snapshot SessionEnd schedule learn-flush detached, with learningContext() owning consent and brain-off. A failed advisory body is recorded by the shim and summarized once at SessionStart. decision-gate also consults decision-recall (a new ADR or ADR status change needs a fresh AgentDB consult) and continuation-gate asks once for a decision record after a new ADR.",
+  "description": "RuvNet Brain continuity plane for Codex. Broad legacy automatic gates remain retired. Registrations here are MEASURED, not assumed: a probe hook was registered on all twelve event names the installed codex-cli 0.154.0 binary declares and a real `codex exec` run was observed (2026-09-11). SessionStart, UserPromptSubmit and SessionEnd FIRED and carry handlers. Stop keeps the pre-existing, project-scoped continuation gate; session-snapshot was added at Stop on 2026-09-29 to record each turn's outcome (turn-outcome-capture.mjs) — Codex SessionEnd carries no last_assistant_message, so Stop is the only boundary that can. Its delivery rests on codex-cli 0.158.0's declared stop.command.input schema and the other Codex Stop handlers; it has NOT been live-observed and fails open. PreCompact uses the existing session-snapshot capture handler: Codex0.160.1 declares this native boundary. Registration is not proof of native delivery; manual/automatic delivery remains separately evidenced. All handlers are bounded and fail open. Amended 2026-09-11: UserPromptSubmit also runs ground-ruvnet (grounding injection, ADR-040 §Amendment). Amended 2026-09-12: the 2026-09-11 PreToolUse/PostToolUse \"not observed\" note was measured with a prompt (`codex exec \"reply OK\"`) that never invoked a tool, so neither event had anything to fire on — that was an untested path, not a failing one. Re-probed with prompts that actually call a tool: a real apply_patch write fired PreToolUse/PostToolUse with tool_name \"apply_patch\", and a real MCP call to this repo's own search_ruvnet server fired both with tool_name \"mcp__ruvnet_brain__search_ruvnet\". Both are now registered below: decision-gate's write route (matcher includes apply_patch, Codex's raw write-tool name) and grounding-stamp (unchanged matcher already recognizes the mcp__..__search_ruvnet shape). The bash route (exec_command) remains unregistered — today's measurement covered a write and an MCP call, not exec_command, and extending on that evidence would be the same unproven leap this note replaces. Also added 2026-09-12: grounding-turn-mark (UserPromptSubmit) and grounding-turn-gate (Stop), the \"answered without searching\" pair — a prompt-level grounding directive is advisory, so this records whether it fired and forces continuation at Stop if no search_ruvnet call was recorded since (reusing grounding-stamp's own stamp evidence). Both are registered on Codex identically to Claude: the Stop-block contract (hookSpecificOutput.additionalContext) already has a proven Codex translation via codex-hook-adapter.mjs's Stop branch (see tests/unit/codex-lifecycle-hooks.test.mjs), the same path continuation-gate already uses. Capacity-aware parallel-work guidance is also registered at UserPromptSubmit: it advises the coordinator to launch only real independent workers within sampled resource headroom and the live runtime/tool cap; it never spawns workers or claims execution. Automatic normalized project observations are captured at prompt, pre-tool, post-tool and child completion; Claude also observes PostToolUseFailure. Queued memory is silent (the normal state at prompt and tool boundaries); a stuck queue (queued work older than 10 minutes), an unwritable queue and a hook that failed or timed out internally are disclosed; this does not establish synchronous ADR-073 conformance or native Grok recall. SessionStart has an 8-second measured replay/restore envelope. Issue377: consent-eligible learning captures only fixed workflow metadata; lifecycle recovery schedules one finite worker. Original records remain retained with hash-bound acknowledgments. Native delivery must be separately evidenced; registration is not proof. Amended 2026-10-12 (ADR-106): lifecycle memory only calls ruflo; no local queue, journal or outbox; a refused write is a hook-failures row.",
   "hooks": {
     "SessionStart": [
       {
@@ -36,16 +36,6 @@
       }
     ],
     "PreToolUse": [
-      {
-        "matcher": "*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node -e \"const f=require('node:fs'),o=require('node:os'),p=require('node:path'),c=require('node:child_process'),d=process.env.CODEX_HOME||p.join(o.homedir(),'.codex'),b=process.env.RUVNET_BRAIN_HOME||p.join(p.dirname(d),'.cache','ruvnet-brain'),w=p.join(b,'codex-hook.mjs');let s;try{s=f.statSync(w)}catch{}if(!s?.isFile())process.exit(0);const r=c.spawnSync(process.execPath,[w,...process.argv.slice(2)],{stdio:['inherit','pipe','pipe'],encoding:'utf8',env:process.env,timeout:Number(process.argv[1]),killSignal:'SIGKILL'});if(r.status===0||r.status===2){if(r.stdout)process.stdout.write(r.stdout);if(r.stderr)process.stderr.write(r.stderr)}process.exit(r.status===2?2:0)\" 9000 session-snapshot PreToolUse",
-            "timeout": 10
-          }
-        ]
-      },
       {
         "matcher": "^(Write|Edit|MultiEdit|NotebookEdit|apply_patch)$",
         "hooks": [
@@ -83,11 +73,6 @@
       {
         "matcher": "*",
         "hooks": [
-          {
-            "type": "command",
-            "command": "node -e \"const f=require('node:fs'),o=require('node:os'),p=require('node:path'),c=require('node:child_process'),d=process.env.CODEX_HOME||p.join(o.homedir(),'.codex'),b=process.env.RUVNET_BRAIN_HOME||p.join(p.dirname(d),'.cache','ruvnet-brain'),w=p.join(b,'codex-hook.mjs');let s;try{s=f.statSync(w)}catch{}if(!s?.isFile())process.exit(0);const r=c.spawnSync(process.execPath,[w,...process.argv.slice(2)],{stdio:['inherit','pipe','pipe'],encoding:'utf8',env:process.env,timeout:Number(process.argv[1]),killSignal:'SIGKILL'});if(r.status===0||r.status===2){if(r.stdout)process.stdout.write(r.stdout);if(r.stderr)process.stderr.write(r.stderr)}process.exit(r.status===2?2:0)\" 9000 session-snapshot UserPromptSubmit",
-            "timeout": 10
-          },
           {
             "type": "command",
             "command": "node -e \"const f=require('node:fs'),o=require('node:os'),p=require('node:path'),c=require('node:child_process'),d=process.env.CODEX_HOME||p.join(o.homedir(),'.codex'),b=process.env.RUVNET_BRAIN_HOME||p.join(p.dirname(d),'.cache','ruvnet-brain'),w=p.join(b,'codex-hook.mjs');let s;try{s=f.statSync(w)}catch{}if(!s?.isFile())process.exit(0);const r=c.spawnSync(process.execPath,[w,...process.argv.slice(2)],{stdio:['inherit','pipe','pipe'],encoding:'utf8',env:process.env,timeout:Number(process.argv[1]),killSignal:'SIGKILL'});if(r.status===0||r.status===2){if(r.stdout)process.stdout.write(r.stdout);if(r.stderr)process.stderr.write(r.stderr)}process.exit(r.status===2?2:0)\" 9000 unprompted-speech UserPromptSubmit",
@@ -123,18 +108,6 @@
         ]
       }
     ],
-    "SubagentStop": [
-      {
-        "matcher": "*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node -e \"const f=require('node:fs'),o=require('node:os'),p=require('node:path'),c=require('node:child_process'),d=process.env.CODEX_HOME||p.join(o.homedir(),'.codex'),b=process.env.RUVNET_BRAIN_HOME||p.join(p.dirname(d),'.cache','ruvnet-brain'),w=p.join(b,'codex-hook.mjs');let s;try{s=f.statSync(w)}catch{}if(!s?.isFile())process.exit(0);const r=c.spawnSync(process.execPath,[w,...process.argv.slice(2)],{stdio:['inherit','pipe','pipe'],encoding:'utf8',env:process.env,timeout:Number(process.argv[1]),killSignal:'SIGKILL'});if(r.status===0||r.status===2){if(r.stdout)process.stdout.write(r.stdout);if(r.stderr)process.stderr.write(r.stderr)}process.exit(r.status===2?2:0)\" 9000 session-snapshot SubagentStop",
-            "timeout": 10
-          }
-        ]
-      }
-    ],
     "PreCompact": [
       {
         "hooks": [

package/plugin/hooks/hook-contracts.json

@@ -1,5 +1,5 @@
 {
-  "_note": "The legacy automatic gate collection remains retired. What is permitted is the continuity plane below and nothing else: SessionStart restores the canonical project checkpoint; UserPromptSubmit runs the single unprompted-speech chokepoint; Stop may nudge one explicitly authorized project-scoped objective AND capture a project snapshot; PreCompact and SessionEnd capture a project snapshot. Version 3 of this file permitted exactly two handlers, which was not a safety property but a contradiction: it demanded a restore while forbidding any event that could WRITE the journal the restore reads, so the canonical store held zero progression rows. Adding to this list is still a deliberate act that must pass `npm run hooks:check`; what changed is that the shape can now express the plane that actually works. Amended 2026-09-11 (Stuart): the continuity-only charter had retired the ONLY enforcement of ADR-0012 — never write rUv-product code the brain has not seen — and the failure it exists to prevent recurred the day it was measured absent. The plane now also carries three grounding registrations: ground-ruvnet (UserPromptSubmit, grounding injection — a second owner of that event, scoped by ADR-040 §Amendment 2026-09-11 to directives rather than speech), decision-gate’s write route (PreToolUse, the one refuser, ADR-067), and grounding-stamp (PostToolUse on a successful search_ruvnet, the receipt that opens the write gate). Amended 2026-09-12: the 2026-09-11 claim that Codex PreToolUse/PostToolUse delivery had never been observed was measured with a prompt that never invoked a tool (`codex exec \"reply OK\"`), so it was an untested path, not a failing one. Re-measured with prompts that actually call a tool (a real apply_patch write, a real MCP search_ruvnet call against this repo's own server): both events FIRED on codex-cli 0.154.0 with real payloads. decision-gate's write route and grounding-stamp are now dual-host (see _codexCapture and contracts below); the bash route (exec_command) remains Claude-only — today's measurement did not exercise it. Also amended 2026-09-12: added grounding-turn-mark (UserPromptSubmit) and grounding-turn-gate (Stop), the \"answered without searching\" pair — ground-ruvnet's Gate 1 directive is advisory, so nothing previously checked whether the model complied before the turn ended. grounding-turn-mark records that Gate 1 fired for a turn; grounding-turn-gate forces continuation at Stop if grounding-stamp's own evidence shows no search_ruvnet call happened since. Both dual-host from the start (the Stop-block contract is already proven on Codex via continuation-gate). Added capacity-aware-parallel-work at UserPromptSubmit on both measured hosts: it is context-only, resource-bounded, and requires the coordinator to check actual tool/runtime slots; it does not spawn or claim workers. Amended 2026-09-30 (ADR-0030 decision point #1, no new registration): grounding-turn-mark also arms a turn when the prompt asks a capability/feasibility/architecture question about any tool or platform, and grounding-turn-gate then requires every capability claim in the final answer to be bound to a relevant STRONG source read this turn after the last weak one (a WebFetch body is a small model's summary: weak); on Claude it reads the transcript instead of stamp mtimes, which removed the measured 'no search recorded' false alarms. ADR-0030 #2/#3 run in shadow only. Amendment 2026-10-03: normalized prompt/tool/failure/child observations are automatic; startup replays before restoring. Queued and unavailable evidence remain distinct from exact committed readback. Native Grok prompt recall is unsupported. Amendment 2026-10-11 (ADR-106): learn-flush (SessionStart, SessionEnd) and learn-capture (PostToolUse) are no longer separate registrations; session-start, session-snapshot SessionEnd and session-snapshot PostToolUse run them in-process or detached, with learningContext() still owning consent and brain-off. All three were trailing groups, so no surviving Codex trust position or hash moved. decision-gate gained the decision-recall policy and continuation-gate the decision-record check (ADR-105 §8) without new registrations; the shim records failed advisory bodies for one SessionStart summary.",
+  "_note": "The legacy automatic gate collection remains retired. What is permitted is the continuity plane below and nothing else: SessionStart restores the canonical project checkpoint; UserPromptSubmit runs the single unprompted-speech chokepoint; Stop may nudge one explicitly authorized project-scoped objective AND capture a project snapshot; PreCompact and SessionEnd capture a project snapshot. Version 3 of this file permitted exactly two handlers, which was not a safety property but a contradiction: it demanded a restore while forbidding any event that could WRITE the journal the restore reads, so the canonical store held zero progression rows. Adding to this list is still a deliberate act that must pass `npm run hooks:check`; what changed is that the shape can now express the plane that actually works. Amended 2026-09-11 (Stuart): the continuity-only charter had retired the ONLY enforcement of ADR-0012 — never write rUv-product code the brain has not seen — and the failure it exists to prevent recurred the day it was measured absent. The plane now also carries three grounding registrations: ground-ruvnet (UserPromptSubmit, grounding injection — a second owner of that event, scoped by ADR-040 §Amendment 2026-09-11 to directives rather than speech), decision-gate’s write route (PreToolUse, the one refuser, ADR-067), and grounding-stamp (PostToolUse on a successful search_ruvnet, the receipt that opens the write gate). Amended 2026-09-12: the 2026-09-11 claim that Codex PreToolUse/PostToolUse delivery had never been observed was measured with a prompt that never invoked a tool (`codex exec \"reply OK\"`), so it was an untested path, not a failing one. Re-measured with prompts that actually call a tool (a real apply_patch write, a real MCP search_ruvnet call against this repo's own server): both events FIRED on codex-cli 0.154.0 with real payloads. decision-gate's write route and grounding-stamp are now dual-host (see _codexCapture and contracts below); the bash route (exec_command) remains Claude-only — today's measurement did not exercise it. Also amended 2026-09-12: added grounding-turn-mark (UserPromptSubmit) and grounding-turn-gate (Stop), the \"answered without searching\" pair — ground-ruvnet's Gate 1 directive is advisory, so nothing previously checked whether the model complied before the turn ended. grounding-turn-mark records that Gate 1 fired for a turn; grounding-turn-gate forces continuation at Stop if grounding-stamp's own evidence shows no search_ruvnet call happened since. Both dual-host from the start (the Stop-block contract is already proven on Codex via continuation-gate). Added capacity-aware-parallel-work at UserPromptSubmit on both measured hosts: it is context-only, resource-bounded, and requires the coordinator to check actual tool/runtime slots; it does not spawn or claim workers. Amended 2026-09-30 (ADR-0030 decision point #1, no new registration): grounding-turn-mark also arms a turn when the prompt asks a capability/feasibility/architecture question about any tool or platform, and grounding-turn-gate then requires every capability claim in the final answer to be bound to a relevant STRONG source read this turn after the last weak one (a WebFetch body is a small model's summary: weak); on Claude it reads the transcript instead of stamp mtimes, which removed the measured 'no search recorded' false alarms. ADR-0030 #2/#3 run in shadow only. Amendment 2026-10-03: normalized prompt/tool/failure/child observations are automatic; startup replays before restoring. Queued and unavailable evidence remain distinct from exact committed readback. Native Grok prompt recall is unsupported. Amendment 2026-10-12 (ADR-106): the hand-rolled progression store, outbox, capture queue, continuity journal, turn journal and learning queue are deleted; session-snapshot keeps Stop (turn outcome), PreCompact/SessionEnd (checkpoint + distill) and PostToolUse (opted-in learning), each a direct `ruflo memory store` with exact-key readback, and a refusal is a hook-failures row.",
   "_version": 12,
   "_eventOwners": [
     {
@@ -10,7 +10,7 @@
         "claude",
         "codex"
       ],
-      "responsibility": "Replay consent-eligible pending canonical memory within the shared startup budget, then restore only verified coherent state; disclose pending or unavailable rather than silently treating an older checkpoint as latest."
+      "responsibility": "Restore the newest project-state-current-* checkpoint (and a newer project-state-auto-* one) by exact-key `ruflo memory retrieve`, list lesson keys, and summarize hook failures once; disclose unknown rather than claim a restore."
     },
     {
       "event": "UserPromptSubmit",
@@ -40,7 +40,7 @@
         "claude",
         "codex"
       ],
-      "responsibility": "Persist redacted turn outcomes through the fsynced canonical-project journal; queued is not recorded. No global fallback. Exact-key content readback commits transport; terminal boundaries also distill eligible records."
+      "responsibility": "Write the redacted turn outcome with one bounded `ruflo memory store` in namespace turns and prove it by exact-key readback; a refusal is a hook-failures row. No journal, outbox or replay."
     },
     {
       "event": "PreCompact",
@@ -50,7 +50,7 @@
         "claude",
         "codex"
       ],
-      "responsibility": "The boundary at which context is about to be lost — capture before it is."
+      "responsibility": "Store one append-only project-state-auto-<ms> checkpoint through `ruflo memory store` and read it back by exact key; start turn distillation (`ruflo memory distill run`)."
     },
     {
       "event": "SessionEnd",
@@ -60,7 +60,7 @@
         "claude",
         "codex"
       ],
-      "responsibility": "The boundary at which the session is about to be gone — capture before it is."
+      "responsibility": "Store one append-only project-state-auto-<ms> checkpoint through `ruflo memory store` and read it back by exact key; start turn distillation (`ruflo memory distill run`)."
     },
     {
       "event": "UserPromptSubmit",
@@ -122,26 +122,6 @@
       ],
       "responsibility": "The 'answered without searching' gate (2026-09-12): if grounding-turn-mark's marker shows Gate 1 fired this turn and grounding-stamp's own stamp evidence shows no search_ruvnet call happened since, forces continuation via the same hookSpecificOutput.additionalContext contract continuation-gate already uses on both hosts. A separate registration from continuation-gate — see grounding-turn-gate.mjs's header for why folding it into that file's ledger/cooldown semantics would corrupt them rather than extend them. Consumes its marker unconditionally so a stale one can never pressure an unrelated later turn. Amended 2026-09-30 (ADR-0030 #1): on Claude, 'was search_ruvnet called' is read from the transcript, and on an armed turn each capability claim in the final answer must be bound to a relevant strong source read this turn after the last weak one, else ONE correction naming the claim and what was read; on Codex (rollout not parsed) only rUv-term claims are judged, from stamps, and the rest are UNKNOWN. Gates #2/#3 are shadow-logged, never delivered."
     },
-    {
-      "event": "UserPromptSubmit",
-      "owner": "session-snapshot",
-      "class": "normalized continuity observation",
-      "hosts": [
-        "claude",
-        "codex"
-      ],
-      "responsibility": "Capture bounded redacted observable intent or outcome through the canonical progression bridge; retain pending/failed status and do not infer success from pre-tool intent."
-    },
-    {
-      "event": "PreToolUse",
-      "owner": "session-snapshot",
-      "class": "normalized continuity observation",
-      "hosts": [
-        "claude",
-        "codex"
-      ],
-      "responsibility": "Capture bounded redacted observable intent or outcome through the canonical progression bridge; retain pending/failed status and do not infer success from pre-tool intent."
-    },
     {
       "event": "PostToolUse",
       "owner": "session-snapshot",
@@ -150,26 +130,7 @@
         "claude",
         "codex"
       ],
-      "responsibility": "Capture bounded redacted observable intent or outcome through the canonical progression bridge; retain pending/failed status and do not infer success from pre-tool intent."
-    },
-    {
-      "event": "PostToolUseFailure",
-      "owner": "session-snapshot",
-      "class": "normalized continuity observation",
-      "hosts": [
-        "claude"
-      ],
-      "responsibility": "Capture bounded redacted observable intent or outcome through the canonical progression bridge; retain pending/failed status and do not infer success from pre-tool intent."
-    },
-    {
-      "event": "SubagentStop",
-      "owner": "session-snapshot",
-      "class": "normalized continuity observation",
-      "hosts": [
-        "claude",
-        "codex"
-      ],
-      "responsibility": "Capture bounded redacted observable intent or outcome through the canonical progression bridge; retain pending/failed status and do not infer success from pre-tool intent."
+      "responsibility": "When learning is opted in, write one minimized workflow observation with `ruflo memory store` + exact-key readback; a refusal is a hook-failures row. No queue."
     }
   ],
   "_notInThisPlane": [
@@ -358,30 +319,6 @@
       "matcher": "*",
       "timeout": 10
     },
-    {
-      "id": "session-snapshot",
-      "event": "UserPromptSubmit",
-      "hosts": [
-        "claude",
-        "codex"
-      ],
-      "mode": "advisory",
-      "offBehavior": "run",
-      "matcher": "*",
-      "timeout": 10
-    },
-    {
-      "id": "session-snapshot",
-      "event": "PreToolUse",
-      "hosts": [
-        "claude",
-        "codex"
-      ],
-      "mode": "advisory",
-      "offBehavior": "run",
-      "matcher": "*",
-      "timeout": 10
-    },
     {
       "id": "session-snapshot",
       "event": "PostToolUse",
@@ -393,29 +330,6 @@
       "offBehavior": "run",
       "matcher": "*",
       "timeout": 10
-    },
-    {
-      "id": "session-snapshot",
-      "event": "PostToolUseFailure",
-      "hosts": [
-        "claude"
-      ],
-      "mode": "advisory",
-      "offBehavior": "run",
-      "matcher": "*",
-      "timeout": 10
-    },
-    {
-      "id": "session-snapshot",
-      "event": "SubagentStop",
-      "hosts": [
-        "claude",
-        "codex"
-      ],
-      "mode": "advisory",
-      "offBehavior": "run",
-      "matcher": "*",
-      "timeout": 10
     }
   ],
   "matcherAllowlist": [
@@ -468,13 +382,6 @@
       "reason": "The grounding tool with or without an MCP server prefix (mcp__plugin_ruvnet-brain_ruvnet-brain__search_ruvnet, or Codex's mcp__ruvnet_brain__search_ruvnet, measured live 2026-09-12). Only a successful search may mint a stamp; the body checks the result banner.",
       "retiredBy": "not retired — registered 2026-09-11 (ADR-0012); Codex host proven reachable 2026-09-12, matcher unchanged"
     },
-    {
-      "layer": "plugin",
-      "event": "PreToolUse",
-      "matcher": "*",
-      "reason": "Observe normalized lifecycle transitions independently of the write-refusal and grounding matchers; the body enforces canonical identity, consent and bounded non-authoritative semantic observations.",
-      "retiredBy": "not retired - owner automatic AgentDB mandate 2026-10-03"
-    },
     {
       "layer": "plugin",
       "event": "PostToolUse",
@@ -482,27 +389,6 @@
       "reason": "Observe normalized lifecycle transitions independently of the write-refusal and grounding matchers; the body enforces canonical identity, consent and bounded non-authoritative semantic observations.",
       "retiredBy": "not retired - owner automatic AgentDB mandate 2026-10-03"
     },
-    {
-      "layer": "plugin",
-      "event": "PostToolUseFailure",
-      "matcher": "*",
-      "reason": "Observe normalized lifecycle transitions independently of the write-refusal and grounding matchers; the body enforces canonical identity, consent and bounded non-authoritative semantic observations.",
-      "retiredBy": "not retired - owner automatic AgentDB mandate 2026-10-03"
-    },
-    {
-      "layer": "plugin",
-      "event": "SubagentStop",
-      "matcher": "*",
-      "reason": "Observe normalized lifecycle transitions independently of the write-refusal and grounding matchers; the body enforces canonical identity, consent and bounded non-authoritative semantic observations.",
-      "retiredBy": "not retired - owner automatic AgentDB mandate 2026-10-03"
-    },
-    {
-      "layer": "codex",
-      "event": "PreToolUse",
-      "matcher": "*",
-      "reason": "Canonical observation owner sees tool transitions before normalization; bounded body selects substantive observations. The independent anchored decision and grounding matchers remain unchanged.",
-      "retiredBy": "not retired - automatic memory mandate 2026-10-03"
-    },
     {
       "layer": "codex",
       "event": "PostToolUse",
@@ -552,13 +438,6 @@
       "reason": "Explicit supported Codex lifecycle registration, corresponding to the host-filtered continuity policy; its enforcing handler and live registration are checked independently.",
       "retiredBy": "not retired - canonical continuity host parity"
     },
-    {
-      "layer": "codex",
-      "event": "SubagentStop",
-      "matcher": "*",
-      "reason": "Explicit supported Codex lifecycle registration, corresponding to the host-filtered continuity policy; its enforcing handler and live registration are checked independently.",
-      "retiredBy": "not retired - canonical continuity host parity"
-    },
     {
       "layer": "codex",
       "event": "PreCompact",

package/plugin/hooks/hooks.json

@@ -1,5 +1,5 @@
 {
-  "description": "RuvNet Brain lifecycle plane. The broad legacy routing, learning, and release interceptors remain retired. What is automatic is exactly: SessionStart restores the canonical project checkpoint; UserPromptSubmit runs the single unprompted-speech chokepoint, ground-ruvnet grounding injection, and a capacity-aware context hint for clearly large independent work. The capacity hook uses bounded CPU/memory-pressure evidence, never starts agents, and tells the coordinator to check live tools and clamp to the runtime cap; it is not user-facing speech. ground-ruvnet remains a directive to the model, not speech — ADR-040 §Amendment 2026-09-11. PreToolUse runs decision-gate's write route, the ONE process that may refuse a Write/Edit/MultiEdit/NotebookEdit/apply_patch (ADR-067, composing ground-before-write per ADR-0012); PostToolUse on a successful search_ruvnet mints the grounding stamp that opens that gate. grounding-turn-mark (UserPromptSubmit) records that the grounding directive fired this turn, and grounding-turn-gate (Stop) forces continuation if the final answer asserts a rUv capability and no search_ruvnet call was recorded since. Stop also runs the ledger-scoped continuation handler and captures a project snapshot; PreCompact and SessionEnd capture a project snapshot. Every capture is bounded and fails open; only decision-gate may block on exit code, and it fails open on its own errors — the Stop stdout envelopes are advisory at the shim boundary but keep the agent working. Automatic normalized project observations are captured at prompt, pre-tool, post-tool and child completion; Claude also observes PostToolUseFailure. Queued memory is silent (the normal state at prompt and tool boundaries); a stuck queue (queued work older than 10 minutes), an unwritable queue and a hook that failed or timed out internally are disclosed; this does not establish synchronous ADR-073 conformance or native Grok recall. SessionStart has an 8-second measured replay/restore envelope. Issue377: consent-eligible learning captures only fixed workflow metadata; lifecycle recovery schedules one finite worker. Original records remain retained with hash-bound acknowledgments. Native delivery must be separately evidenced; registration is not proof. Amended 2026-10-11 (ADR-106): learning capture and recovery no longer have their own registrations; session-snapshot PostToolUse captures in-process, and session-start and session-snapshot SessionEnd schedule learn-flush detached, with learningContext() owning consent and brain-off. A failed advisory body is recorded by the shim and summarized once at SessionStart. decision-gate also consults decision-recall (a new ADR or ADR status change needs a fresh AgentDB consult) and continuation-gate asks once for a decision record after a new ADR.",
+  "description": "RuvNet Brain lifecycle plane. The broad legacy routing, learning, and release interceptors remain retired. Lifecycle memory only CALLS ruflo (owner ruling 2026-10-12, ADR-106): there is no hand-rolled store, queue, journal or outbox. SessionStart restores the newest project-state-current-* checkpoint (and a newer project-state-auto-* one) and lists lesson keys by exact-key `ruflo memory list|retrieve`, and summarizes hook failures once. UserPromptSubmit runs the single unprompted-speech chokepoint, ground-ruvnet grounding injection (with one bounded AgentDB recall search), a capacity-aware context hint, and grounding-turn-mark. PreToolUse runs decision-gate's write route, the ONE process that may refuse a Write/Edit/MultiEdit/NotebookEdit/apply_patch (ADR-067, ADR-0012); PostToolUse on a successful search_ruvnet mints the grounding stamp that opens that gate, and session-snapshot PostToolUse writes an opted-in learning observation with `ruflo memory store`. Stop runs the continuation gate, writes the turn outcome with `ruflo memory store` in namespace turns proven by exact-key readback, and runs grounding-turn-gate. PreCompact and SessionEnd store one append-only project-state-auto-<ms> checkpoint with exact-key readback and start `ruflo memory distill run`. Every body is advisory and fails open except decision-gate; a refused or unverified ruflo write, or a body stopped by the shim watchdog, is one row in hook-failures.jsonl, summarized at the next SessionStart.",
   "hooks": {
     "SessionStart": [
       {
@@ -17,11 +17,6 @@
       {
         "matcher": "*",
         "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/hook-shim.mjs\" session-snapshot UserPromptSubmit || true",
-            "timeout": 10
-          },
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/hook-shim.mjs\" unprompted-speech UserPromptSubmit",
@@ -46,16 +41,6 @@
       }
     ],
     "PreToolUse": [
-      {
-        "matcher": "*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/hook-shim.mjs\" session-snapshot PreToolUse || true",
-            "timeout": 10
-          }
-        ]
-      },
       {
         "matcher": "^(Write|Edit|MultiEdit|NotebookEdit|apply_patch)$",
         "hooks": [
@@ -134,30 +119,6 @@
           }
         ]
       }
-    ],
-    "SubagentStop": [
-      {
-        "matcher": "*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/hook-shim.mjs\" session-snapshot SubagentStop || true",
-            "timeout": 10
-          }
-        ]
-      }
-    ],
-    "PostToolUseFailure": [
-      {
-        "matcher": "*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/hook-shim.mjs\" session-snapshot PostToolUseFailure || true",
-            "timeout": 10
-          }
-        ]
-      }
     ]
   }
 }