total-recall-brain 3.41.4 → 3.41.6

package/scaffold/.agent/skills/total-recall/plugins/security/package.json

@@ -24,6 +24,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@gregiteen/ssss-cli": "0.14.3"
+    "@gregiteen/ssss-cli": "0.14.4"
+  },
+  "overrides": {
+    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.4"
   }
 }

package/src/cli/agent.mjs

@@ -2,6 +2,7 @@
 
 import { listAgents, spawnAgent, killAgent, getAgentLogs } from '../core/agent-manager.mjs';
 import { detectHarnesses } from '../core/meta-harness.mjs';
+import { checkReceipt, findRoot, ACK_COMMAND } from '../core/preflight-receipt.mjs';
 
 function printHelp() {
   console.log(`
@@ -33,7 +34,7 @@ Auth:
   else from the Total Recall secret store, so SSH/launchd sessions without a login keychain work.
 
 Available Harnesses:
-  agy, claude, codex, gemini
+  agy, claude, codex, dsh, hermes, openclaw
 
 Examples:
   npx total-recall agent list
@@ -144,6 +145,16 @@ export async function run(argv) {
       process.exit(1);
     }
 
+    if (!targetNode) {
+      const root = findRoot(cwd || process.cwd());
+      const receipt = checkReceipt(root);
+      if (!receipt.ok) {
+        console.error(`\n❌ Agent spawn refused by TR-PREFLIGHT gate: ${receipt.problems[0] || 'check failed'} (directory: ${root}).`);
+        console.error(`   Read the complete context capsule, then run: ${ACK_COMMAND}\n`);
+        process.exit(1);
+      }
+    }
+
     const nodeStr = targetNode ? ` on mesh node \x1b[1;33m${targetNode}\x1b[0m` : '';
     if (!isJson) console.log(`\n🚀 Spawning agent on harness: \x1b[1;36m${harness}\x1b[0m${nodeStr}...`);
     try {

package/src/cli/compact.mjs

@@ -0,0 +1,108 @@
+import { parseLayerFlag } from './agent-dir.mjs';
+import { loadContextNodes } from './context.mjs';
+import { curatedRules, selectRules } from '../core/context-policy.mjs';
+import { compactRules } from '../core/context-compactor.mjs';
+import { cosineSimilarity, getEmbedding, loadEmbeddingsIndex } from '../core/embeddings.mjs';
+import { legacyRuleContributions } from '../core/surface.mjs';
+
+const DEFAULT_BUDGET = 4000;
+const EMBED_TIMEOUT_MS = 8000;
+
+const USAGE = `Usage: total-recall compact "task" [--budget 4000] [--action edit,test] [--expand slug,slug] [--format text|json] [--project|--global]
+Fits the applicable rules into --budget estimated tokens, ranked against the task. Rules keep their own words: full text, a leading excerpt, or a slug under Referenced. Read any of them in full with --expand. The output is partial by design; \`total-recall context\` prints the complete capsule.`;
+
+function parseArgs(args) {
+  const options = { budget: DEFAULT_BUDGET, actions: [], expand: [], format: 'text' };
+  for (let i = 1; i < args.length; i++) {
+    const flag = args[i];
+    const value = args[++i];
+    if (flag === '--budget') options.budget = Number(value);
+    else if (flag === '--action') options.actions = value?.split(',').filter(Boolean) || [];
+    else if (flag === '--expand') options.expand = value?.split(',').filter(Boolean) || [];
+    else if (flag === '--format' && ['json', 'text'].includes(value)) options.format = value;
+    else throw new Error(`Unknown compact option: ${flag}`);
+  }
+  if (!Number.isFinite(options.budget) || options.budget < 1) throw new Error('--budget must be a positive number of tokens');
+  return options;
+}
+
+function loadVectors(derivedDirs) {
+  const vectors = {};
+  for (const dir of derivedDirs) {
+    try {
+      for (const [slug, entry] of Object.entries(loadEmbeddingsIndex(dir))) vectors[slug] ??= entry.embedding;
+    } catch { /* a brain without an index simply contributes no vectors */ }
+  }
+  return vectors;
+}
+
+async function embedTask(task) {
+  let timer;
+  const timeout = new Promise(resolve => { timer = setTimeout(() => resolve(null), EMBED_TIMEOUT_MS); });
+  try {
+    return await Promise.race([getEmbedding(task), timeout]);
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function lexicalScore(terms, text) {
+  if (!terms.length) return 0;
+  const haystack = text.toLowerCase();
+  return terms.filter(term => haystack.includes(term)).length / terms.length;
+}
+
+/** Rank the applicable rules against the task and fit them into `budget`. Shared by `compact` and `context`. */
+export async function compactNodes({ task, actions = [], budget, expand = [], complete = false, rank = true, nodes, skillsDir, derivedDirs, header }) {
+  const rules = selectRules(curatedRules(nodes), { actions, projectRoot: process.cwd() });
+  const vectors = loadVectors(derivedDirs);
+  const taskVector = rank ? await embedTask(task) : null;
+  const terms = String(task).toLowerCase().match(/[\p{L}\p{N}_-]{3,}/gu) || [];
+  const semantic = Boolean(taskVector);
+
+  const score = (slug, text) => semantic && vectors[slug] ? cosineSimilarity(taskVector, vectors[slug]) : lexicalScore(terms, text);
+  const items = rules.map(node => {
+    const body = (node._directive || node.body || node.content || '').trim();
+    return {
+      slug: node.slug, body, priority: node.priority, importance: node.importance,
+      text: node._directive ? `[${node.slug}] ${node._directive}` : `## ${node.title || node.slug} [${node.slug}]\n\n${body}`,
+      vector: vectors[node.slug], score: score(node.slug, `${node.title || ''} ${body}`),
+    };
+  });
+  for (const { id, text } of legacyRuleContributions(skillsDir)) {
+    items.push({ slug: id, body: text, text, score: lexicalScore(terms, text) });
+  }
+
+  const ranking = semantic ? 'semantic' : 'lexical';
+  return { ranking, ...compactRules(items, { budget, expand, complete, header: (counts, tokens) => header(counts, tokens, ranking) }) };
+}
+
+export default async function compact(args = []) {
+  if (!args.length || args.includes('--help') || args.includes('-h')) {
+    console.log(USAGE);
+    return;
+  }
+  const { layer, remainingArgs } = parseLayerFlag(args);
+  const task = remainingArgs[0];
+  const { budget, actions, expand, format } = parseArgs(remainingArgs);
+  const { nodes, skillsDir, derivedDirs } = loadContextNodes(layer);
+  const header = (counts, tokens, ranking) => [
+    `compacted:true tokens:${tokens} budget:${budget} rules:${counts.rules} full:${counts.full} summarized:${counts.summarized} referenced:${counts.referenced} duplicate:${counts.duplicate} omitted:${counts.omitted} ranking:${ranking}`,
+    'PARTIAL: read any rule in full with --expand <slug>; total-recall context prints the complete capsule.',
+  ].join('\n');
+
+  let result;
+  try {
+    result = await compactNodes({ task, actions, budget, expand, nodes, skillsDir, derivedDirs, header });
+  } catch (error) {
+    console.log(error.requiredBudget ? `compacted:false reason:budget-too-small budget:${budget} required_budget:${error.requiredBudget}` : `compacted:false reason:${error.message}`);
+    process.exitCode = 2;
+    return;
+  }
+  const { context, counts, tokens, tiers, ranking } = result;
+  console.log(format === 'json'
+    ? JSON.stringify({ compacted: true, ranking, budget, tokens, counts, tiers, context })
+    : context);
+}

package/src/cli/connect.mjs

@@ -14,18 +14,24 @@ export const CLIENTS = {
   vscode: {
     label: 'VS Code Copilot',
     mode: 'file',
+    enforcement: 'advisory',
+    enforcementReason: 'No tool hook mechanism; rules provided via copilot-instructions.md',
     target: path.join('.github', 'copilot-instructions.md'),
     render: instructions => `<!-- Total Recall — auto-generated by \`npx total-recall connect vscode\` -->\n<!-- Do not edit; re-run connect to refresh -->\n\n${instructions}`
   },
   pi: {
     label: 'Pi Coding Agent',
     mode: 'global-symlink',
+    enforcement: 'enforced (unverified live)',
+    enforcementReason: 'tool_call extension blocks unreceipted tool calls with exit 2',
     globalTarget: path.join(os.homedir(), '.pi', 'agent', 'AGENTS.md'),
     localTarget: 'AGENTS.md',
   },
   hermes: {
     label: 'Hermes Agent',
     mode: 'symlink',
+    enforcement: 'enforced',
+    enforcementReason: 'pre_tool_call hook denies unreceipted tool calls with exit 2',
     // Hermes loads the AGENTS.md chain (git root to cwd) as context files.
     // ~/.hermes/memories/MEMORY.md is the agent's own notes store, read only
     // from HERMES_HOME; Total Recall never writes it.
@@ -35,6 +41,8 @@ export const CLIENTS = {
   'hermes-agent': {
     label: 'Hermes Agent',
     mode: 'symlink',
+    enforcement: 'enforced',
+    enforcementReason: 'pre_tool_call hook denies unreceipted tool calls with exit 2',
     // Hermes loads the AGENTS.md chain (git root to cwd) as context files.
     // ~/.hermes/memories/MEMORY.md is the agent's own notes store, read only
     // from HERMES_HOME; Total Recall never writes it.
@@ -44,6 +52,8 @@ export const CLIENTS = {
   dsh: {
     label: 'DeepSeek Harness (dsh)',
     mode: 'dsh',
+    enforcement: 'enforced',
+    enforcementReason: 'PreToolUse hook denies unreceipted tool calls with exit 2',
     globalMemoryPath: path.join(os.homedir(), '.dsh', 'memory', 'MEMORY.md'),
     globalUserPath:   path.join(os.homedir(), '.dsh', 'memory', 'user.md'),
     localTarget: 'AGENTS.md',
@@ -60,6 +70,8 @@ export const CLIENTS = {
   'deepseek-harness': {
     label: 'DeepSeek Harness',
     mode: 'dsh',
+    enforcement: 'enforced',
+    enforcementReason: 'PreToolUse hook denies unreceipted tool calls with exit 2',
     globalMemoryPath: path.join(os.homedir(), '.dsh', 'memory', 'MEMORY.md'),
     globalUserPath:   path.join(os.homedir(), '.dsh', 'memory', 'user.md'),
     localTarget: 'AGENTS.md',
@@ -69,12 +81,16 @@ export const CLIENTS = {
   openclaw: {
     label: 'OpenClaw',
     mode: 'openclaw',
+    enforcement: 'enforced',
+    enforcementReason: 'before_tool_call hook denies unreceipted tool calls with exit 2',
     memoryTarget: 'MEMORY.md',
     agentsTarget: 'AGENTS.md',
   },
   cursor: {
     label: 'Cursor',
     mode: 'file',
+    enforcement: 'enforced (unverified live)',
+    enforcementReason: 'hooks.json failClosed PreToolUse hook denies unreceipted tool calls',
     target: path.join('.cursor', 'rules', 'total-recall.mdc'),
     render: instructions => [
       '---',
@@ -89,6 +105,8 @@ export const CLIENTS = {
   cline: {
     label: 'Cline',
     mode: 'file',
+    enforcement: 'enforced (unverified live)',
+    enforcementReason: 'beforeTool hook cancels unreceipted tool calls',
     // Cline uses a .clinerules/ directory (primary); plain markdown, no frontmatter.
     target: path.join('.clinerules', 'total-recall.md'),
     render: instructions => instructions,
@@ -98,6 +116,8 @@ export const CLIENTS = {
   'claude-code': {
     label: 'Claude Code',
     mode: 'symlink',
+    enforcement: 'enforced',
+    enforcementReason: 'PreToolUse hook denies unreceipted tool calls with exit 2',
     target: 'CLAUDE.md',
     writeSlashCommands: true,
     installHooks: true,
@@ -108,6 +128,8 @@ export const CLIENTS = {
   codex: {
     label: 'Codex',
     mode: 'symlink',
+    enforcement: 'enforced',
+    enforcementReason: 'hooks.json PreToolUse hook denies unreceipted tool calls with exit 2',
     target: 'AGENTS.md',
     // Codex discovers repository skills in <project>/.agents/skills.
     skillsProjection: { scope: 'project', dir: path.join('.agents', 'skills') }
@@ -115,6 +137,8 @@ export const CLIENTS = {
   grok: {
     label: 'Grok Build (xAI)',
     mode: 'symlink',
+    enforcement: 'enforced (unverified live)',
+    enforcementReason: 'hooks/ PreToolUse hook denies unreceipted tool calls with exit 2',
     target: 'AGENTS.md',
     // Grok discovers repository skills in <project>/.agents/skills.
     skillsProjection: { scope: 'project', dir: path.join('.agents', 'skills') }
@@ -122,34 +146,46 @@ export const CLIENTS = {
   muse: {
     label: 'Muse Code',
     mode: 'symlink',
+    enforcement: 'advisory',
+    enforcementReason: 'No tool hook mechanism; rules provided via context files',
     target: 'AGENTS.md'
   },
   replit: {
     label: 'Replit Agent',
     mode: 'file',
+    enforcement: 'advisory',
+    enforcementReason: 'No tool hook mechanism; rules provided via context files',
     target: 'replit.md',
     render: instructions => `<!-- Total Recall — auto-generated by \`npx total-recall connect replit\` -->\n<!-- Do not edit; re-run connect to refresh -->\n\n${instructions}`
   },
   lovable: {
     label: 'Lovable',
     mode: 'symlink',
+    enforcement: 'advisory',
+    enforcementReason: 'No tool hook mechanism; rules provided via context files',
     target: 'AGENTS.md'
   },
   windsurf: {
     label: 'Windsurf / Devin Desktop',
     mode: 'file',
+    enforcement: 'enforced (unverified live)',
+    enforcementReason: 'hooks.json PreToolUse hook denies unreceipted tool calls with exit 2',
     target: path.join('.windsurf', 'rules', 'total-recall.md'),
     render: instructions => instructions
   },
   devin: {
     label: 'Devin Desktop',
     mode: 'file',
+    enforcement: 'enforced (unverified live)',
+    enforcementReason: 'hooks.json PreToolUse hook denies unreceipted tool calls with exit 2',
     target: path.join('.devin', 'rules', 'total-recall.md'),
     render: instructions => instructions
   },
   antigravity: {
     label: 'Antigravity',
     mode: 'symlink',
+    enforcement: 'enforced',
+    enforcementReason: 'PreToolUse hook denies unreceipted tool calls with exit 2',
     target: '.agents/rules/AGENTS.md',
     // Antigravity reads workspace skills from .agents/skills and exposes native /name invocation
     skillsProjection: { scope: 'project', dir: path.join('.agents', 'skills') }
@@ -157,6 +193,8 @@ export const CLIENTS = {
   aider: {
     label: 'Aider',
     mode: 'file',
+    enforcement: 'dispatch-only',
+    enforcementReason: 'No pre-tool hooks; preflight enforced when invoked via Total Recall dispatch',
     target: '.aider.rules.md',
     render: instructions => instructions,
     after: [
@@ -169,17 +207,23 @@ export const CLIENTS = {
   'http-api': {
     label: 'HTTP host app',
     mode: 'api',
+    enforcement: 'advisory',
+    enforcementReason: 'HTTP API integration; caller enforces preflight',
     // Any HTTP host: OpenAI-compatible API + PAT. Not tied to a product repo.
   },
   obsidian: {
     label: 'Obsidian',
     mode: 'vault',
+    enforcement: 'advisory',
+    enforcementReason: 'Direct vault projection; no agent execution harness',
     // Symlinks memory-vault into the Obsidian vault as "Total Recall/"
     folderName: 'Total Recall'
   },
   generic: {
     label: 'Generic OpenAI-Compatible Client',
-    mode: 'api'
+    mode: 'api',
+    enforcement: 'advisory',
+    enforcementReason: 'Generic client; no native pre-tool enforcement'
   }
 };
 
@@ -358,6 +402,8 @@ function registerClient(brainDir, clientName, preset, projectionPath) {
   registry.clients[clientName] = {
     label: preset.label,
     mode: preset.mode,
+    enforcement: preset.enforcement || 'advisory',
+    enforcementReason: preset.enforcementReason || null,
     projectionPath: projectionPath || null,
     connectedAt: new Date().toISOString()
   };
@@ -755,12 +801,18 @@ export default async function connect(args) {
     client: opts.client,
     label: preset.label,
     mode: preset.mode,
+    enforcement: preset.enforcement || 'advisory',
+    enforcement_reason: preset.enforcementReason || null,
     brain_config_path: brainConfigPath,
     api: details,
     projection: null,
     notes: []
   };
 
+  if (preset.enforcement === 'advisory' || preset.enforcement === 'dispatch-only') {
+    result.notes.push(`  ℹ️  Enforcement tier: ${preset.enforcement} — ${preset.enforcementReason}`);
+  }
+
   if (preset.mode === 'file') {
     const instructions = readInstructions(cwd, agentDir);
     if (!instructions) {
@@ -949,6 +1001,9 @@ export default async function connect(args) {
   }
 
   console.log(`\n  Total Recall connected: ${preset.label}`);
+  if (preset.enforcement) {
+    console.log(`  Enforcement: ${preset.enforcement} (${preset.enforcementReason || ''})`);
+  }
   if (result.projection) {
     const action = result.projection.action;
     const target = result.projection.targetPath;

package/src/cli/context.mjs

@@ -2,15 +2,64 @@ import path from 'node:path';
 import { getBothBrains, parseLayerFlag } from './agent-dir.mjs';
 import { getNodes } from '../core/vault-cache.mjs';
 import { mergeGlobalRuleNodes, legacyRuleContributions } from '../core/surface.mjs';
-import { compileContext, capsuleResponse, renderCapsule } from '../core/context-compiler.mjs';
+import { compileContext, capsuleResponse, renderCapsule, PREFLIGHT_NOTICE } from '../core/context-compiler.mjs';
 import { isBrainEnabled } from '../core/brain-registry.mjs';
 import { surfaceInputsHash } from '../core/command-surface.mjs';
 import { readConfigValue } from './config.mjs';
 import { recordCapsule } from '../core/context-telemetry.mjs';
 
+/** About 28 KB: harnesses save output over about 30 KB to a file instead of showing it, which agents then cannot read (audit C-005, F-019). */
+export const CAPSULE_LIMIT = 7000;
+const JSON_ESCAPE_SHARE = 0.97;
+const JSON_WRAPPER_TOKENS = 128;
+
+/** The merged rule nodes a capsule draws from, for the selected layer. */
+export function loadContextNodes(layer) {
+  const brains = getBothBrains();
+  const own = layer !== 'global' && brains.project && isBrainEnabled(brains.project.brainDir) ? brains.project.brainDir : null;
+  const global = layer !== 'project' && brains.global && isBrainEnabled(brains.global.brainDir) ? brains.global.brainDir : null;
+  if (!own && !global) throw new Error('No enabled brain in selected scope');
+  const nodes = own ? mergeGlobalRuleNodes(getNodes(path.join(own, 'memory-vault')), global ? getNodes(path.join(global, 'memory-vault')) : []) :
+    getNodes(path.join(global, 'memory-vault')).map(n => ({ ...n, _layer: 'global' }));
+  return { nodes, skillsDir: path.dirname(own || global),
+    derivedDirs: [own, global].filter(Boolean).map(dir => path.join(dir, 'memory-derived')) };
+}
+
+/** The first lines of an automatically compacted capsule. `rules verify` measures with it too, so both agree on what fits. */
+export const compactedHeader = (version, budget) => (counts, tokens, ranking) => [
+  `ready:true compacted:true tokens:${tokens} budget:${budget} version:${version} rules:${counts.rules} full:${counts.full} summarized:${counts.summarized} referenced:${counts.referenced} duplicate:${counts.duplicate} ranking:${ranking}`,
+  PREFLIGHT_NOTICE,
+  `COMPACTED: every rule below still applies. Read a referenced rule with: total-recall compact "<task>" --expand <slug>`,
+].join('\n');
+
+/** Compact the over-budget capsule, or explain the budget it needs. `fullRequired` is what the uncompacted capsule would take. */
+async function printCompacted({ query, actions, budget, format, version, fullRequired, nodes, skillsDir, derivedDirs }) {
+  const { compactNodes } = await import('./compact.mjs');
+  // JSON escaping and its wrapper count against the budget too.
+  const target = format === 'json' ? Math.floor(budget * JSON_ESCAPE_SHARE) - JSON_WRAPPER_TOKENS : budget;
+  const header = compactedHeader(version, budget);
+  let result;
+  try {
+    result = await compactNodes({ task: query, actions, budget: Math.max(target, 1), complete: true, nodes, skillsDir, derivedDirs, header });
+  } catch (error) {
+    if (!error.requiredBudget) throw error;
+    const floor = format === 'json' ? Math.ceil((error.requiredBudget + JSON_WRAPPER_TOKENS) / JSON_ESCAPE_SHARE) : error.requiredBudget;
+    const requiredBudget = Math.min(fullRequired, floor);
+    console.log(format === 'json'
+      ? JSON.stringify({ ready: false, reason: 'budget-overflow', context: '', stats: { version, budget, required_budget: requiredBudget, overage: requiredBudget - budget, rules: error.ruleCount, token_measurement: 'estimated_chars_divided_by_four' } })
+      : `ready:false reason:budget-overflow budget:${budget} required_budget:${requiredBudget} overage:${requiredBudget - budget} rules:${error.ruleCount} version:${version}\nThis budget cannot hold all ${error.ruleCount} applicable rules even compacted; \`total-recall rules audit\` lists them by size. Retry with --budget ${requiredBudget}; do not act until ready:true.`);
+    process.exitCode = 2;
+    return;
+  }
+  console.log(format === 'json'
+    ? JSON.stringify({ ready: true, compacted: true, ranking: result.ranking, context: result.context, counts: result.counts,
+      stats: { version, budget, total_tokens: result.tokens, token_measurement: 'estimated_chars_divided_by_four' } })
+    : result.context);
+}
+
 export default async function context(args = []) {
   if (!args.length || args.includes('--help')) {
-    console.log('Usage: total-recall context "task" [--action edit,test,publish] [--budget 4000] [--format text|json] [--knowledge] [--debug] [--project|--global]\nLocal rules only by default. Unknown applicability is required. Overflow exits 2; do not act until the complete output fits. --knowledge adds supporting documents; --debug exposes inventories within the same budget. Refresh on task/action/project or policy changes.');
+    console.log(`Usage: total-recall context "task" [--action edit,test,publish] [--budget ${CAPSULE_LIMIT}] [--format text|json] [--knowledge] [--debug] [--project|--global]\nLocal rules only by default. Unknown applicability is required. Over budget, the capsule compacts automatically: absolute rules keep at least a summary and every other rule keeps at least its slug. Configured budgets are capped at ${CAPSULE_LIMIT}; pass a larger --budget to print the full capsule. Exit 2 means the budget cannot hold every rule; do not act until ready:true. --knowledge adds supporting documents; --debug exposes inventories within the same budget. Refresh on task/action/project or policy changes.`);
     return;
   }
   const { layer, remainingArgs } = parseLayerFlag(args);
@@ -24,7 +73,7 @@ export default async function context(args = []) {
     }
     return undefined;
   })();
-  let actions = [], budget = configuredBudget ?? 4000, format = 'text', includeKnowledge = false, debug = false;
+  let actions = [], budget = Math.min(configuredBudget ?? CAPSULE_LIMIT, CAPSULE_LIMIT), format = 'text', includeKnowledge = false, debug = false;
   for (let i = 1; i < remainingArgs.length; i++) {
     const flag = remainingArgs[i];
     if (flag === '--knowledge') { includeKnowledge = true; continue; }
@@ -35,14 +84,8 @@ export default async function context(args = []) {
     else if (flag === '--format' && ['json', 'text'].includes(value)) format = value;
     else throw new Error(`Unknown context option: ${flag}`);
   }
-  const brains = getBothBrains();
-  const own = layer !== 'global' && brains.project && isBrainEnabled(brains.project.brainDir) ? brains.project.brainDir : null;
-  const global = layer !== 'project' && brains.global && isBrainEnabled(brains.global.brainDir) ? brains.global.brainDir : null;
-  if (!own && !global) throw new Error('No enabled brain in selected scope');
-  const nodes = own ? mergeGlobalRuleNodes(getNodes(path.join(own, 'memory-vault')), global ? getNodes(path.join(global, 'memory-vault')) : []) :
-    getNodes(path.join(global, 'memory-vault')).map(n => ({ ...n, _layer: 'global' }));
-  const skillsDir = path.dirname(own || global);
-  const derivedDir = own ? path.join(own, 'memory-derived') : (global ? path.join(global, 'memory-derived') : null);
+  const { nodes, skillsDir, derivedDirs } = loadContextNodes(layer);
+  const derivedDir = derivedDirs[0];
   const result = await compileContext({ query, actions, nodes, includeKnowledge, budget: { total: budget }, projectRoot: process.cwd(),
     derivedDir, contributions: legacyRuleContributions(skillsDir), versionInputs: surfaceInputsHash({ skillsDir }) });
   if (debug && format === 'text') throw new Error('--debug requires --format json');
@@ -55,18 +98,7 @@ export default async function context(args = []) {
     derivedDir, action: actions, query, consumer: 'cli',
   });
   if (!response.ready && !debug) {
-    // Admission failed: emitting bodies here makes each budget retry load the
-    // same rules again. Keep the full set in the compiler/API, and admit it only
-    // after the caller explicitly raises the budget or curates applicability.
-    const requiredBudget = response.stats.total_tokens + 32;
-    const diagnostic = { ready: false, reason: 'budget-overflow', context: '', stats: {
-      version: response.stats.version, required_count: response.stats.required_count,
-      budget, required_budget: requiredBudget,
-      token_measurement: 'estimated_chars_divided_by_four',
-    } };
-    console.log(format === 'json' ? JSON.stringify(diagnostic) :
-      `ready:false reason:budget-overflow budget:${budget} required_budget:${requiredBudget} required_rules:${response.stats.required_count} version:${response.stats.version}\nRetry with --budget ${requiredBudget}; do not act until ready:true.\nTo shorten the rules for good: total-recall rules audit, then rules draft/apply.`);
-    process.exitCode = 2;
+    await printCompacted({ query, actions, budget, format, version: response.stats.version, fullRequired: response.stats.total_tokens + 32, nodes, skillsDir, derivedDirs });
     return;
   }
   console.log(renderCapsule(response, format));

package/src/cli/doctor.mjs

@@ -204,13 +204,16 @@ export default async function doctor() {
 
   if (agents.length > 0) {
     let healthyCount = 0;
+    const { HARNESS_SPECS } = await import('../core/meta-harness.mjs').catch(() => ({ HARNESS_SPECS: {} }));
     for (const agent of agents) {
       const exists = commandExists(agent.binary);
+      const spec = HARNESS_SPECS[agent.name] || HARNESS_SPECS[agent.binary];
+      const enfTier = spec?.enforcement || 'advisory';
       if (exists) {
-        logOk(`Agent ${agent.name.padEnd(8)}: Available (Binary: ${agent.binary})`);
+        logOk(`Agent ${agent.name.padEnd(8)}: Available (Binary: ${agent.binary}) [${enfTier}]`);
         healthyCount++;
       } else {
-        logWarn(`Agent ${agent.name.padEnd(8)}: NOT FOUND in PATH (Binary: ${agent.binary})`);
+        logWarn(`Agent ${agent.name.padEnd(8)}: NOT FOUND in PATH (Binary: ${agent.binary}) [${enfTier}]`);
         warnings++;
       }
     }

package/src/cli/forget.mjs

@@ -33,6 +33,8 @@ function printHelp() {
 }
 
 export default async function forget(args) {
+  // Checked first: a destructive command must never act on a request for help.
+  if (args.includes('--help') || args.includes('-h')) { printHelp(); return; }
   const { layer: explicitLayer, remainingArgs } = parseLayerFlag(args);
 
   // Check for --project-all