ruvnet-brain 4.7.20 → 4.7.22

package/plugin/scripts/continuation-gate.mjs

@@ -53,9 +53,11 @@ import { deferralAtStop } from './deferral-evidence.mjs';
 import { readSettledTranscript } from './turn-outcome-capture.mjs';
 import { continuationProjectIdentity, authorizedContinuationObjective, authorizedPromiseItems, assistantCommitmentOwned, setAssistantCommitmentState } from './continuation-objective.mjs';
 import {
-  auditCompletionClaims, readClaudeTurn, extractCommitments, claimClosesPromise,
+  auditCompletionClaims, readClaudeTurn, extractCommitments, promiseClosingClaim,
+  promiseEvidence, completionCorrectionText, outcomeAdvisoryText, completionCategory,
   PROMISE_KIND, PROMISE_CAP_OPEN,
 } from './completion-claim-evidence.mjs';
+import { writeAtomic } from './user-settings.mjs';
 
 const HOME = os.homedir();
 
@@ -181,7 +183,12 @@ function load() {
 function save(led) {
   try {
     fs.mkdirSync(path.dirname(LEDGER), { recursive: true });
-    fs.writeFileSync(LEDGER, JSON.stringify({ ...led, updated: new Date().toISOString() }, null, 2) + '\n');
+    // writeAtomic (not a bare writeFileSync): writeFileSync truncates the target before writing the
+    // new bytes, so a kill -9 / ENOSPC / EIO between those two steps leaves LEDGER empty — and load()'s
+    // catch-all JSON.parse failure then reads that as "nothing was ever committed", silently discarding
+    // every item a prior turn agreed to do, not just the one being added now. Same house pattern as
+    // user-settings.mjs's own writeAtomic(): temp-in-the-same-directory + fsync + rename.
+    writeAtomic(LEDGER, JSON.stringify({ ...led, updated: new Date().toISOString() }, null, 2) + '\n');
     return true;
   } catch { return false; /* the ledger is advisory — never break a turn over it */ }
 }
@@ -366,19 +373,28 @@ const HOST = process.env.RUVNET_HOOK_HOST === 'codex' ? 'codex' : 'claude';
  * COMPLETION CLAIMS (ADR-074 class `completion`, owner 2026-09-30: "You can never ever tell me
  * something is done and implemented without having tested it end to end"). Audited ONCE per Stop:
  * the verdict both requests a correction (below, under every loop guard) and is the only evidence
- * that may close a captured promise. Claude transcripts are parsed; Codex's rollout format is not
- * parsed anywhere in this repo, so on Codex only the answer-side half is enforced and the transcript
- * half is reported UNKNOWN (completion-claim-evidence.mjs header). Fails open: a throw is NONE.
+ * that may close a captured promise. Claude transcripts and Codex rollouts (through the shared
+ * nativeTurnLines reader, #423) are parsed; a Codex rollout that cannot be read or has no current-turn
+ * boundary stays UNKNOWN (completion-claim-evidence.mjs header). Fails open: a throw is NONE.
  */
+let completionTurnKey = null;
 const completion = (() => {
   const message = String(hookInput.last_assistant_message || '');
   if (!message || !hookInput.session_id) return { verdict: 'NONE', claims: [] };
   try {
-    const turn = HOST === 'claude' ? readClaudeTurn(hookInput.transcript_path) : null;
+    const turn = readClaudeTurn(hookInput.transcript_path, { host: HOST });
     // Claude always sends a JSONL transcript; one we cannot read is OUR failure, and a Stop hook
     // fails open on its own machinery (ADR-074 failure semantics) — never a correction request.
     // Missing native evidence stays UNKNOWN; it cannot silently validate a completion claim.
-    return auditCompletionClaims(message, { turn, host: HOST });
+    const audit = auditCompletionClaims(message, { turn, host: HOST });
+    // Turn identity for correction de-duplication (#425): the host's native id (Claude prompt_id, Codex
+    // turn_id), else the transcript record that opened this turn (uuid or position, never its text: a repeated
+    // "continue" is a new turn). Never a clock.
+    const native = HOST === 'codex' ? hookInput.turn_id : hookInput.prompt_id;
+    const opener = typeof native === 'string' && native.trim() ? `native:${native}`
+      : turn?.boundaryFound && turn.openerId ? `opener:${turn.openerId}` : '';
+    if (opener) completionTurnKey = crypto.createHash('sha256').update(JSON.stringify([hookInput.session_id, opener])).digest('hex').slice(0, 24);
+    return audit;
   } catch { return { verdict: 'NONE', claims: [] }; }
 })();
 
@@ -401,7 +417,7 @@ function promiseBookkeeping() {
     if (completion.verdict === 'PASS') {
       for (const item of led.items) {
         if (!assistantCommitmentOwned(item, hookInput.session_id, projectIdentity)) continue;
-        const claim = completion.claims.find((c) => claimClosesPromise(c.text, item.text));
+        const claim = promiseClosingClaim(completion, hookInput.last_assistant_message, item.text);
         if (!claim) continue;
         const verifiedCompletion = completion.verdict === 'PASS' && Boolean(claim);
         Object.assign(item, { done: verifiedCompletion, state: verifiedCompletion ? 'completed' : item.state, doneAt: at, completionEvidence: { claim: claim.text,
@@ -410,6 +426,12 @@ function promiseBookkeeping() {
         changed = true;
       }
     }
+    // #369: observed evidence moves a promise to `evidenced` (NOT done, never forced again); same session only.
+    for (const item of led.items) {
+      if (!assistantCommitmentOwned(item, hookInput.session_id, projectIdentity) || !(item.state === undefined || item.state === 'active')) continue;
+      const closureEvidence = promiseEvidence(completion, hookInput.last_assistant_message, item);
+      if (closureEvidence) { Object.assign(item, { state: 'evidenced', stateAt: at, closureEvidence }); changed = true; }
+    }
     const owned = led.items.filter((i) => assistantCommitmentOwned(i, hookInput.session_id, projectIdentity));
     const openKeys = new Set(owned.map((i) => i.key));
     let activeCount = owned.filter((i) => i.state === undefined || i.state === 'active').length;
@@ -422,6 +444,7 @@ function promiseBookkeeping() {
       led.items.push({ schemaVersion: 1, kind: PROMISE_KIND, text: promise.text, key: promise.key, done: false, state: 'active', at,
         projectId: pid, worktreeIds: [projectIdentity.worktreeId], sessionIds: [hookInput.session_id],
         capturedFrom: { sessionId: hookInput.session_id },
+        ...(promise.evidenceCommands ? { evidenceCommands: promise.evidenceCommands } : {}),
         authorization: { kind: 'owner-mandate', reference: 'i-will-is-a-contract-2026-09-15' } });
       changed = true;
     }
@@ -715,8 +738,18 @@ if (observations.length && STOP_NUDGES_FULL) console.error(JSON.stringify({ kind
   authority: false, items: observations.map(({ text, at }) => ({ text, at })) }));
 // ONE correction per turn: a single item however many claims the answer made; the stop_hook_active
 // exit and the cooldown lock below bound it to one request per stop episode.
-const completionWork = ['FAIL', 'UNKNOWN'].includes(completion.verdict) ? [{
-  text: `You claimed "${completion.claims[0].text.slice(0, 160)}" is done; ${completion.problems.join('; ')}. Run the real consumer path, or restate it as UNVERIFIED.`,
+// #425 (owner decision): an UNKNOWN whose ONLY problem is task scope — a check observed after the last
+// change, named in the answer, with what is NOT verified disclosed — is not a correction. The audit
+// recognizes check-scoped sentences only; it has no representation for a scoped task outcome, so
+// re-running checks or rewording cannot satisfy it. The verdict stays UNKNOWN (never PASS: it closes
+// no promise and grants no completion authority); under `full` the limitation is reported, not enforced.
+const scopeOnlyUnknown = completion.verdict === 'UNKNOWN' && completion.namesCheck === true
+  && completion.disclosesGaps === true
+  && ((completion.verification?.checks?.length || 0) + (completion.verification?.maskedChecks?.length || 0)) > 0;
+if (scopeOnlyUnknown && STOP_NUDGES_FULL) console.error(JSON.stringify({ kind: 'completion-scope-advisory',
+  authority: false, verdict: 'UNKNOWN', outcomes: completion.outcomes, text: outcomeAdvisoryText(completion) }));
+const completionWork = ['FAIL', 'UNKNOWN'].includes(completion.verdict) && !scopeOnlyUnknown ? [{
+  text: completionCorrectionText(completion),
   at: new Date(nowMs).toISOString(), derived: true, kind: 'completion-claim-integrity',
 }] : [];
 // DECISION RECORDS (ADR-105 §8, ADR-106): a turn that CREATED an ADR in an adopted project must also
@@ -815,7 +848,8 @@ function claimCooldown(now, windowMs) {
     if (Number.isFinite(prev) && (now - prev) < windowMs) return false; // fresh lock: someone forced recently
     fs.unlinkSync(LOCK);                                                 // stale: clear it so we can re-claim
   } catch { /* no lock yet */ }
-  try { fs.writeFileSync(LOCK, new Date(now).toISOString(), { flag: 'wx' }); return true; }
+  // A fresh install has no work-ledgers/ folder until the first save(); ENOENT here is not a lost race.
+  try { fs.mkdirSync(path.dirname(LOCK), { recursive: true }); fs.writeFileSync(LOCK, new Date(now).toISOString(), { flag: 'wx' }); return true; }
   catch { return false; }                                               // lost the race / cannot persist → fail closed
 }
 if (!claimCooldown(nowMs, COOLDOWN_MS)) process.exit(EXIT_ALLOW);
@@ -861,6 +895,36 @@ try {
   if (touched) fs.writeFileSync(FORCES, JSON.stringify(counts));
   if (retired.length) { save(led); forceable = forceable.filter((i) => !retired.includes(i)); }
 } catch { /* bookkeeping only: never break a turn */ }
+/**
+ * A completion correction is delivered at most once per native session + user turn + audit category (#425,
+ * sparkling). The marker is an exclusive-create file (the same primitive as the cooldown lock), so two racing
+ * Stop hooks cannot both deliver. Rewording or elapsed time does not rearm it; a new user turn does. With no
+ * turn identity the correction degrades to a non-blocking advisory carrying the ORIGINAL verdict (never PASS).
+ * This only ever removes a blocking item.
+ */
+try {
+  const item = forceable.find((i) => i.kind === 'completion-claim-integrity');
+  if (item) {
+    const category = completionCategory(completion);
+    let deliver = false;
+    if (!completionTurnKey) {
+      console.error(JSON.stringify({ kind: 'completion-correction-advisory', authority: false, verdict: completion.verdict,
+        category, reason: 'turn identity unavailable; a correction cannot be de-duplicated, so it is not enforced', text: item.text }));
+    } else {
+      const id = crypto.createHash('sha256').update(JSON.stringify([hookInput.session_id, completionTurnKey, category])).digest('hex').slice(0, 24);
+      const dir = `${LEDGER}.completion-delivered`;
+      try {
+        fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(path.join(dir, id), new Date(nowMs).toISOString(), { flag: 'wx' });
+        deliver = true;
+        for (const f of fs.readdirSync(dir)) {   // markers are only needed for the turn; keep a week
+          try { if (nowMs - fs.statSync(path.join(dir, f)).mtimeMs > 7 * 86_400_000) fs.rmSync(path.join(dir, f), { force: true }); } catch { /* raced */ }
+        }
+      } catch { /* already delivered this turn/category, or cannot persist: do not block */ }
+    }
+    if (!deliver) forceable = forceable.filter((i) => i !== item);
+  }
+} catch { forceable = forceable.filter((i) => i.kind !== 'completion-claim-integrity'); }
 if (!forceable.length) process.exit(EXIT_ALLOW);
 if (deferralState && forceable.some((i) => i.kind === 'no-deferral')) {
   try { for (const [k, v] of Object.entries(deferralState.counts)) if (nowMs - Date.parse(v?.at) > 7 * 86_400_000) delete deferralState.counts[k];

package/plugin/scripts/decision-gate.mjs

@@ -25,13 +25,12 @@ import { fileURLToPath } from 'node:url';
 // an install hint into the middle of a refusal reason, or manufactured stderr on an allow. Read the
 // signature, do not infer it from the name.
 import { resolveBash } from './hook-shim-bash.mjs';
-import { append as appendOutcome, actionKey, recordRefusal, resolve as resolveOutcome, sweepStale } from './decision-outcomes.mjs';
+import { append as appendOutcome, actionKey, recordRefusal, reportBudget, reportSelfSkipped, resolve as resolveOutcome, sweepStale } from './decision-outcomes.mjs';
 // Grok sends its own tool names (`write`) and a snake_case event; every policy below reads Claude's
 // shape. Normalised ONCE here, so the policies (four of them bash, matching tool_name textually) never
 // see a host-native spelling — the 4.4 measurement was a Grok write silently allowed. hook-input.mjs.
 import { normalizePayloadText } from './hook-input.mjs';
-
-const QUIET_FULL = String(process.env.RUVNET_STOP_NUDGES || '').toLowerCase() === 'full';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 const SCRIPTS_DIR = path.dirname(fileURLToPath(import.meta.url));
 const EVENT = process.argv[2] || '';
@@ -93,8 +92,8 @@ export const MIN_HEADROOM_MS = 3000;
  *
  * 1. ALLOW ON TIMEOUT. A policy still running at the budget is killed and the write is ALLOWED — a gate
  *    that blocks because it is slow is one users switch off. Never silent: the outcome ledger records
- *    `budget-exceeded` with the policies that did not vote, and ONE stderr line says the allow was a
- *    timeout, not a verdict (reportBudget below).
+ *    `budget-exceeded` with the policies that did not vote; a stderr line saying the allow was a timeout,
+ *    not a verdict, is printed only on a refusal or under RUVNET_STOP_NUDGES=full (decision-outcomes.mjs).
  *
  * 2. OVERSIZE: ONLY THE FIRST 64 KiB IS CHECKED. The host hands this gate the payload through
  *    hook-shim.mjs, which reads at most TRANSPORT_CAP_BYTES (its TABLE entry), and the bash policies cap
@@ -206,7 +205,7 @@ export function policiesFor(event, registry = REGISTRY, all = REFUSAL_POLICIES)
 /**
  * Resolved once per invocation by the runtime block below; null means no bash on this host.
  *
- * Declared HERE, and not next to runPolicy() where it reads more naturally: the `if (isMain())`
+ * Declared HERE, and not next to runPolicy() where it reads more naturally: the runtime
  * block runs during module evaluation, so a `let` declared after it sits in the temporal dead zone
  * and the assignment throws — the identical mistake `speechEventFor` was already a hoisted
  * `function` to avoid, recorded a few lines further down.
@@ -285,13 +284,14 @@ function payloadInput(payload) { return parsed(payload).tool_input || {}; }
 /**
  * The sub-event token unprompted-runtime switches on.
  *
- * A hoisted `function`, not a `const` arrow: the `if (isMain())` block below runs DURING module
+ * A hoisted `function`, not a `const` arrow: the runtime block below runs DURING module
  * evaluation, so an arrow declared after it sits in the temporal dead zone — it threw
  * `Cannot access 'speechEventFor' before initialization` on this gate's first live refusal.
  */
 function speechEventFor(event) { return event === 'bash' ? 'PreToolUse-bash' : 'PreToolUse-write'; }
 // ── Runtime ──────────────────────────────────────────────────────────────────────────────────────
-if (isMain()) {
+// isDirectInvocation never throws (entrypoint.mjs), so an importer cannot be crashed by this guard.
+if (isDirectInvocation(import.meta.url)) {
   const started = Date.now();
   const payload = normalizePayloadText(readPayload());
   const shape = classifyPayload(payload);
@@ -348,14 +348,14 @@ if (isMain()) {
     }
   } catch { /* a ledger must never break a tool call */ }
   };
-  reportSelfSkipped({ session, selfSkipped });
+  reportSelfSkipped({ event: EVENT, session, selfSkipped });
   if (decision.allow && shape.truncated) {
     // OVERSIZE POLICY (header): allowed on a check of the first TRANSPORT_CAP_BYTES only. Recorded, never silent.
     try { appendOutcome({ kind: 'payload-oversize', event: EVENT, session, bytesSeen: shape.bytes, capBytes: TRANSPORT_CAP_BYTES, tool: shape.tool, filePath: shape.filePath, ts: Date.now() }); } catch { /* a ledger must never break a tool call */ }
   }
   if (!decision.allow) {
     measureFinalDecision(false);
-    reportBudget({ session, unconsulted, trace, started, budgetMs, refused: true });
+    reportBudget({ event: EVENT, session, unconsulted, trace, started, budgetMs, refused: true });
     process.stderr.write(`${decision.reason}\n`);
     process.exit(REFUSE);
   }
@@ -373,65 +373,22 @@ if (isMain()) {
     if (speech.skipped === 'budget') unconsulted.push(SPEECH.id);
     if (speech.code === REFUSE) {
       measureFinalDecision(false, [...decision.refusals, SPEECH.id]);
-      reportBudget({ session, unconsulted, trace, started, budgetMs, refused: true });
+      reportBudget({ event: EVENT, session, unconsulted, trace, started, budgetMs, refused: true });
       process.stderr.write(`${(speech.stderr || '').trim()}\n`);
       process.exit(REFUSE);
     }
-    reportBudget({ session, unconsulted, trace, started, budgetMs });
+    reportBudget({ event: EVENT, session, unconsulted, trace, started, budgetMs });
     measureFinalDecision(true);
     const context = policyContext(results, speech.stdout || '');
     if (context) process.stdout.write(context);
     process.exit(ALLOW);
   }
-  reportBudget({ session, unconsulted, trace, started, budgetMs });
+  reportBudget({ event: EVENT, session, unconsulted, trace, started, budgetMs });
   measureFinalDecision(true);
   const context = policyContext([...results, ...unconsulted.filter((id) => !results.some((r) => r.id === id && r.skipped)).map((id) => ({ id, skipped: 'budget' }))]);
   if (context) process.stdout.write(context);
   process.exit(ALLOW);
 }
-/**
- * ── A BUDGET THAT CAN BE EXCEEDED SILENTLY FAILS OPEN WITHOUT SAYING SO ──────────────────────────
- *
- * The old loop did `break` when the budget ran out. Every remaining policy AND the speech chokepoint
- * were then skipped with no record anywhere — the gate allowed, and nothing distinguished "five
- * policies agreed this was fine" from "we ran out of time and stopped asking". That is this repo's
- * signature defect wearing a different hat: silence standing in for a measurement. degradation-watch
- * exists because a warning was printed and skimmed; this exists because nothing was printed at all.
- *
- * TWO CHANNELS, because each fails differently:
- *   · the outcome ledger (~/.config/ruvnet-brain/, survives `--update`) so a trip COMPOUNDS into
- *     evidence instead of scrolling past. `kind: 'budget-exceeded'` is inert in report()'s buckets —
- *     it counts neither as a refusal nor as a resolution, so it cannot move the obedience rate.
- *   · one stderr line, unconditionally, allow or refuse. Yes, that puts bytes on stderr during an
- *     exit-0 allow, which tests/unit/decision-gate.test.mjs asserts never happens on an ordinary
- *     write. That assertion is now a SECOND tripwire and is meant to be: after the parallel batch and
- *     the applicability skip, an ordinary write measures ~360ms against a 4000ms budget, so a trip
- *     there is not noise to be tolerated — it is the defect, and the suite should go red for it.
- */
-function reportBudget({ session, unconsulted, trace, started, budgetMs, refused = false }) {
-  const elapsed = Date.now() - started;
-  if (process.env.RUVNET_DECISION_TRACE === '1') {
-    process.stderr.write(`[decision-gate] ${EVENT} ${elapsed}ms budget=${budgetMs}ms ${JSON.stringify(trace)}\n`);
-  }
-  if (!unconsulted.length) return;
-  try {
-    appendOutcome({ kind: 'budget-exceeded', event: EVENT, session, unconsulted, elapsedMs: elapsed, budgetMs, ts: Date.now() });
-  } catch { /* a ledger must never break a tool call */ }
-  // Quiet by default (2026-10-15): the outcome is already in the ledger above. On an ALLOW, a stderr line only
-  // makes the host show a hook "error" for a decision that was made. It is kept when the action was refused
-  // and under RUVNET_STOP_NUDGES=full.
-  if (refused || QUIET_FULL) process.stderr.write(
-    `[decision-gate] ${budgetMs}ms budget exhausted after ${elapsed}ms — ${refused ? 'REFUSED; UNCONSULTED' : 'ALLOWED WITHOUT CONSULTING'}: `
-    + `${unconsulted.join(', ')}. These policies did not vote; ${refused ? 'another policy refused the action.' : 'this allow is a timeout, not a verdict.'}\n`,
-  );
-}
-/** Record and print each policy that skipped itself (exit 3), with its own one-line reason. */
-function reportSelfSkipped({ session, selfSkipped }) {
-  for (const r of selfSkipped) {
-    try { appendOutcome({ kind: 'policy-skipped', event: EVENT, session, policy: r.id, reason: r.reason, ts: Date.now() }); } catch { /* a ledger must never break a tool call */ }
-    if (QUIET_FULL) process.stderr.write(`[decision-gate] ${r.reason || `${r.id} skipped`} — ${r.id} did not vote; it supplied no authorization verdict.\n`);
-  }
-}
 /**
  * Run one policy as a CAPTURED child. Never lets its bytes touch the real streams.
  *
@@ -494,10 +451,3 @@ function readPayload() {
   if (process.stdin.isTTY) return '';
   try { return fs.readFileSync(0, 'utf8'); } catch { return ''; }
 }
-/** Never able to crash a caller that merely imported this (see tests/unit/entrypoint-guard-safety). */
-function isMain() {
-  try {
-    if (!process.argv[1]) return false;
-    return fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
-  } catch { return false; }
-}

package/plugin/scripts/decision-outcomes.mjs

@@ -118,6 +118,42 @@ function appendLocked(record, file, owns) {
 export function append(record, file = LEDGER, budget = {}) {
   return locked([file], owns => { appendLocked(record, file, owns); return true; }, false, budget);
 }
+/**
+ * ── A BUDGET THAT CAN BE EXCEEDED SILENTLY FAILS OPEN WITHOUT SAYING SO (decision-gate.mjs) ──────
+ *
+ * The gate's old loop did `break` when the budget ran out: every remaining policy AND the speech
+ * chokepoint were skipped with no record anywhere, and nothing distinguished "five policies agreed"
+ * from "we ran out of time and stopped asking" — silence standing in for a measurement.
+ *
+ * TWO CHANNELS, because each fails differently:
+ *   · this ledger (survives `--update`), ALWAYS, so a trip COMPOUNDS into evidence. `budget-exceeded`
+ *     and `policy-skipped` are inert in report()'s buckets, so they cannot move the obedience rate.
+ *   · one stderr line, ONLY when the action was refused or under RUVNET_STOP_NUDGES=full (quiet by
+ *     default since 2026-10-15): on an ALLOW a stderr line only makes the host show a hook "error" for
+ *     a decision that was made. tests/unit/write-gate-policy.test.mjs pins both modes.
+ */
+const STOP_NUDGES_FULL = () => String(process.env.RUVNET_STOP_NUDGES || '').toLowerCase() === 'full';
+export function reportBudget({ event, session, unconsulted, trace, started, budgetMs, refused = false }) {
+  const elapsed = Date.now() - started;
+  if (process.env.RUVNET_DECISION_TRACE === '1') {
+    process.stderr.write(`[decision-gate] ${event} ${elapsed}ms budget=${budgetMs}ms ${JSON.stringify(trace)}\n`);
+  }
+  if (!unconsulted.length) return;
+  try {
+    append({ kind: 'budget-exceeded', event, session, unconsulted, elapsedMs: elapsed, budgetMs, ts: Date.now() });
+  } catch { /* a ledger must never break a tool call */ }
+  if (refused || STOP_NUDGES_FULL()) process.stderr.write(
+    `[decision-gate] ${budgetMs}ms budget exhausted after ${elapsed}ms — ${refused ? 'REFUSED; UNCONSULTED' : 'ALLOWED WITHOUT CONSULTING'}: `
+    + `${unconsulted.join(', ')}. These policies did not vote; ${refused ? 'another policy refused the action.' : 'this allow is a timeout, not a verdict.'}\n`,
+  );
+}
+/** Record each policy that skipped itself (exit 3) with its own one-line reason; print it only under full nudges. */
+export function reportSelfSkipped({ event, session, selfSkipped }) {
+  for (const r of selfSkipped) {
+    try { append({ kind: 'policy-skipped', event, session, policy: r.id, reason: r.reason, ts: Date.now() }); } catch { /* a ledger must never break a tool call */ }
+    if (STOP_NUDGES_FULL()) process.stderr.write(`[decision-gate] ${r.reason || `${r.id} skipped`} — ${r.id} did not vote; it supplied no authorization verdict.\n`);
+  }
+}
 const stateFiles = files => ({ pending: files.pending || PENDING, ledger: files.ledger || LEDGER });
 const debtId = debt => debt.refusalId || createHash('sha256').update(JSON.stringify([debt.session, debt.key, debt.ts, debt.host || null, debt.projectId || null])).digest('hex');
 const validDebt = value => value && typeof value.session === 'string' && typeof value.key === 'string'

package/plugin/scripts/decision-recall-gate.mjs

@@ -16,7 +16,8 @@
  * AT MOST ONE REFUSAL PER PATH PER SESSION (the duplicate-gate shape): the retry is allowed and
  * recorded. Only in an adopted project (canonical `.swarm/memory.db` exists). Opt-outs win
  * (ADR-105 §7): RUVNET_DECISION_RECALL_GATE=off, RUVNET_AGENTDB_FIRST=off, the brain-off sentinel.
- * Fails open on its own errors.
+ * Fails open on its own errors, except a Git identity timeout, which exits 3 (skipped, with the reason) so the
+ * gate's ledger records that this ADR decision was not checked (D8, 4.7.21).
  */
 import fs from 'node:fs';
 import os from 'node:os';
@@ -25,9 +26,13 @@ import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { resolveProjectStore } from './project-store-resolver.mjs';
 import { isAdrPath, freshConsultReceipt, brainHomeOf } from './decision-record.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 const ALLOW = 0;
 const REFUSE = 2;
+/** decision-gate.mjs's code for "this policy could not decide, and says why on stderr". */
+const SKIPPED_SELF = 3;
+const GIT_TIMEOUT_MS = 400;
 const STATUS_LINE = /^\s*(?:status:\s*\S.*|\*\*Status\*\*\s*:.*)$/im;
 /** The document's status line, ignoring fenced code (a YAML example is not the ADR's status). */
 const STATUS_LINES = new RegExp(STATUS_LINE.source, 'gim');
@@ -87,6 +92,29 @@ function brainOff(env) {
 const ackFile = (brainHome) => path.join(brainHome, 'decision-recall-acks.json');
 function readAcks(file) { try { const o = JSON.parse(fs.readFileSync(file, 'utf8')); return o && typeof o === 'object' ? o : {}; } catch { return {}; } }
 
+/**
+ * Publish the ledger the way decision-record.mjs's own sibling (writeConsultReceipt) already does:
+ * temp file in the same directory, fsync, then rename. fs.writeFileSync on the real path truncates
+ * before it writes — a process killed between those two steps leaves an empty ledger, discarding
+ * every acknowledgment ever recorded, not just the one being added. rename() is atomic on POSIX, so
+ * a reader (or a crash) only ever sees the old complete ledger or the new complete one.
+ */
+function writeAcksAtomic(file, acks) {
+  const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
+  let fd;
+  try {
+    fd = fs.openSync(tmp, 'wx', 0o600);
+    fs.writeSync(fd, JSON.stringify(acks));
+    try { fs.fsyncSync(fd); } catch { /* filesystem without fsync (some network mounts) — proceed */ }
+    fs.closeSync(fd);
+    fd = null;
+    fs.renameSync(tmp, file);
+  } finally {
+    if (fd !== null) { try { fs.closeSync(fd); } catch { /* nothing to close */ } }
+    try { if (fs.existsSync(tmp)) fs.unlinkSync(tmp); } catch { /* leave the temp rather than throw over it */ }
+  }
+}
+
 /** The verdict. Returns { code, stderr?, stdout? }. */
 export function evaluate(payload, { env = process.env, now = Date.now() } = {}) {
   if (['off'].includes(String(env.RUVNET_DECISION_RECALL_GATE || '').toLowerCase())
@@ -94,7 +122,14 @@ export function evaluate(payload, { env = process.env, now = Date.now() } = {})
   const decision = adrDecisionIn(payload);
   if (!decision) return { code: ALLOW };
   let resolution;
-  try { resolution = resolveProjectStore({ projectDir: payload.cwd || process.cwd(), gitTimeoutMs: 400 }); } catch { return { code: ALLOW }; }
+  try { resolution = resolveProjectStore({ projectDir: payload.cwd || process.cwd(), gitTimeoutMs: GIT_TIMEOUT_MS }); } catch (error) {
+    // D8 (4.7.21): a Git timeout is not a verdict. Exit SKIPPED_SELF with the reason, so decision-gate records a
+    // `policy-skipped` ledger row for this ADR decision instead of the silent allow it used to be.
+    if (/timed out/i.test(String(error?.message))) {
+      return { code: SKIPPED_SELF, stderr: `decision-recall: Git project identity timed out after ${GIT_TIMEOUT_MS}ms; the ${decision.kind} ${decision.path} was not checked for an AgentDB consult.` };
+    }
+    return { code: ALLOW };
+  }
   try { if (!fs.statSync(resolution.canonicalAgentDbPath).isFile()) return { code: ALLOW }; } catch { return { code: ALLOW }; }
   const brainHome = brainHomeOf(env);
   const receipt = freshConsultReceipt({ projectRoot: resolution.projectRoot, brainHome, now });
@@ -108,13 +143,13 @@ export function evaluate(payload, { env = process.env, now = Date.now() } = {})
   const acks = readAcks(file);
   if (acks[key]) {
     acks[key].retriedAt = new Date(now).toISOString();
-    try { fs.writeFileSync(file, JSON.stringify(acks)); } catch { /* the ledger never blocks a write */ }
+    try { writeAcksAtomic(file, acks); } catch { /* the ledger never blocks a write */ }
     return { code: ALLOW, stdout: `This ${decision.kind} was written without an AgentDB consult (retry after one refusal). Record it afterwards with decision-record.mjs --record.` };
   }
   // Keep the ledger bounded: drop acknowledgements older than a week.
   for (const [k, v] of Object.entries(acks)) if (now - Date.parse(v?.at) > 7 * 86_400_000) delete acks[k];
   acks[key] = { at: new Date(now).toISOString(), kind: decision.kind };
-  try { fs.mkdirSync(path.dirname(file), { recursive: true }); fs.writeFileSync(file, JSON.stringify(acks), { mode: 0o600 }); } catch { return { code: ALLOW }; }
+  try { fs.mkdirSync(path.dirname(file), { recursive: true }); writeAcksAtomic(file, acks); } catch { return { code: ALLOW }; }
   const script = path.join(path.dirname(fileURLToPath(import.meta.url)), 'decision-record.mjs');
   return { code: REFUSE, stderr: [
     `⛔ BLOCKED (once) — ${decision.kind} ${decision.path}: run decision-record.mjs --consult "<topic>" first (AgentDB decisions unread).`,
@@ -127,7 +162,7 @@ export function evaluate(payload, { env = process.env, now = Date.now() } = {})
 }
 
 function isMain() {
-  try { return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); } catch { return false; }
+  try { return isDirectInvocation(import.meta.url); } catch { return false; }
 }
 if (isMain()) {
   let verdict = { code: ALLOW };

package/plugin/scripts/decision-record.mjs

@@ -26,11 +26,12 @@ import { fileURLToPath } from 'node:url';
 import { redactText } from './continuity-events.mjs';
 import { maskExcludedPaths } from './turn-capture-privacy.mjs';
 import { resolveTurnDb, readSettledTranscript } from './turn-outcome-capture.mjs';
-import { resolveProjectStore } from './project-store-resolver.mjs';
+import { resolveProjectStore, storeEncryptedAtRest, ENCRYPTED_STORE_REASON } from './project-store-resolver.mjs';
 import { resolveRuflo, rufloInvocation } from './ruflo-bin.mjs';
 import { rufloRunDir } from './ruflo-bin.mjs';
 import { currentTurnRecords } from './completion-claim-evidence.mjs';
 import { recordHookFailure } from './hook-failures.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 export const DECISION_SCHEMA = 'ruvnet-brain.decision-record';
 export const STATUSES = Object.freeze(['ratified', 'detected-unconfirmed']);
@@ -160,6 +161,10 @@ export function storeDecision({ ruflo, db, namespace, key, value, store = defaul
   const prior = readBack({ ruflo, db, namespace, key });
   if (typeof prior.content === 'string' && prior.content === value) return { state: 'already-stored', key };
   if (typeof prior.content === 'string' && prior.content && prior.content !== value) return { state: 'quarantined', key, reason: 'a different stored row holds this key' };
+  if (storeEncryptedAtRest(db)) { // #439: the native-only store below is refused on every attempt; say why instead
+    recordHookFailure({ hook: 'decision-record', event: 'record', error: `not recorded: ${ENCRYPTED_STORE_REASON}`.slice(0, 160) });
+    return { state: 'refused', key, reason: ENCRYPTED_STORE_REASON };
+  }
   const result = store({ ruflo, db, namespace, key, value });
   const back = readBack({ ruflo, db, namespace, key });
   if (result.status === 0 && back.content === value) return { state: 'committed', key };
@@ -300,7 +305,7 @@ export async function main(argv = process.argv.slice(2), { env = process.env, ou
     out.write(`decision-record: supersedes ${key} — ${String(row.what).slice(0, 120)}\n`);
   }
   const r = storeDecision({ ruflo, db: target.db, namespace, key: built.key, value: built.value, ...(store ? { store } : {}), ...(readBack ? { readBack } : {}) });
-  out.write(`decision-record: ${r.state} ${r.key} (namespace ${namespace})${r.reason ? ` — ${r.reason}` : ''}${r.state === 'refused' ? ` — NOT recorded (logged to hook-failures). A store that committed but did not read back may still hold it: run \`ruflo memory retrieve -k ${r.key} -n ${namespace} --path ${target.db}\` before re-running --record` : ''}\n`);
+  out.write(`decision-record: ${r.state} ${r.key} (namespace ${namespace})${r.reason ? ` — ${r.reason}` : ''}${r.state === 'refused' && r.reason === ENCRYPTED_STORE_REASON ? ' — NOT recorded (logged to hook-failures). Keep this project\'s store unencrypted to record decisions here' : ''}${r.state === 'refused' && r.reason !== ENCRYPTED_STORE_REASON ? ` — NOT recorded (logged to hook-failures). A store that committed but did not read back may still hold it: run \`ruflo memory retrieve -k ${r.key} -n ${namespace} --path ${target.db}\` before re-running --record` : ''}\n`);
   if (!['committed', 'already-stored'].includes(r.state)) return 3;
   let ok = true;
   for (const oldKey of built.record.supersedes) {
@@ -319,6 +324,6 @@ export async function main(argv = process.argv.slice(2), { env = process.env, ou
 }
 
 function isMain() {
-  try { return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(SCRIPT); } catch { return false; }
+  try { return isDirectInvocation(import.meta.url); } catch { return false; }
 }
 if (isMain()) main().then((code) => { process.exitCode = code; }, (e) => { process.stderr.write(`decision-record: ${e.message}\n`); process.exitCode = 1; });

package/plugin/scripts/degradation-watch.mjs

@@ -53,6 +53,7 @@ import path from 'node:path';
 // reading the code and believing it.
 import { fileURLToPath } from 'node:url';
 import { rufloRunDir } from './ruflo-bin.mjs';
+import { isDirectInvocation } from './entrypoint.mjs';
 
 /**
  * THE PROBE TARGET IS A SCRATCH DB, NOT THE PROJECT'S.
@@ -264,7 +265,7 @@ export function cachedDegradations(opts = {}) {
  * mechanism; the invariant this repo already paid for is that ONE process refuses a given tool call.
  */
 const isMain = (() => {
-  try { return process.argv[1] && fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url); }
+  try { return isDirectInvocation(import.meta.url); }
   catch { return false; }
 })();