total-recall-brain 3.43.3 → 3.45.0

package/src/core/surface.mjs

@@ -496,13 +496,8 @@ function injectDirectives(fileContent, rulesBlock) {
     return prependDirectives(authored, rulesBlock);
   }
   
-  let content = fileContent.trimEnd();
-  const baseline = '# 🔴 MANDATORY FIRST STEP ON EVERY TURN: TOTAL RECALL FIRST\n1. Run `total-recall --help` (or `node bin/total-recall.mjs --help`) to discover all tools, plugins, and commands.\n2. Read and follow .agent/skills/total-recall/SKILL.md before doing ANYTHING.\n3. Run `total-recall context "<task>"` and `total-recall recall "<topic>" --local` before any decision or action.\nTotal Recall is the mandatory working memory and toolset across all tasks and harnesses. Never skip this.';
-  if (!content.includes('total-recall/SKILL.md')) {
-    content = baseline + '\n\n' + content;
-  }
-  
-  return prependDirectives(content, rulesBlock);
+  // The managed block carries the start-here instructions; authored text stays as written.
+  return prependDirectives(fileContent.trimEnd(), rulesBlock);
 }
 
 function prependDirectives(authored, rulesBlock) {
@@ -516,14 +511,28 @@ function prependDirectives(authored, rulesBlock) {
 /**
  * Write or update a platform instruction shim with the pointer and active rules.
  */
+/**
+ * The whole managed part of every client entry file (ON-DEMAND-CONTEXT-01). It is static: no rule
+ * bodies, CLI list, plugin table or command list, so a rule or plugin change rewrites no repository.
+ * The rules for a task are compiled when the agent acknowledges preflight, and commands are looked
+ * up when needed.
+ */
+export const ENTRY_BLOCK = `# Total Recall: start here
+
+This repository uses Total Recall. Its rules are not copied into this file: they are compiled for your task when you acknowledge preflight.
+
+1. Read \`.agent/skills/total-recall/SKILL.md\`.
+2. Run \`total-recall tr-preflight --ack --task "<task>" --action read,edit,test\` and read everything it prints. Those are the rules for this task. Until it passes, working tools are denied.
+3. Route the task through Metaharness with \`total-recall meta-harness route "<task>" --json\` and follow the route.
+4. Look commands up only when you need them: \`total-recall --help\`, \`total-recall <namespace> --help\`, \`total-recall plugin library\`.`;
+
 async function writeShim(shimPath, skillsDir, nodes = [], { vaultDir, derivedDir, force = false } = {}) {
   const shimDir = path.dirname(shimPath);
-  const rulesBlock = await buildRulesBlock(skillsDir, nodes, { vaultDir, derivedDir, bootstrap: true });
-  const baseline = '# 🔴 MANDATORY FIRST STEP ON EVERY TURN: TOTAL RECALL FIRST\n1. Run `total-recall --help` (or `node bin/total-recall.mjs --help`) to discover all tools, plugins, and commands.\n2. Read and follow .agent/skills/total-recall/SKILL.md before doing ANYTHING.\n3. Run `total-recall context "<task>"` and `total-recall recall "<topic>" --local` before any decision or action.\nTotal Recall is the mandatory working memory and toolset across all tasks and harnesses. Never skip this.\n';
+  const rulesBlock = ENTRY_BLOCK;
   const mdcHeader = shimPath.endsWith('.mdc')
-    ? '---\ndescription: "Total Recall — Auto-generated behavioral memory surface."\nglobs:\nalwaysApply: true\n---\n\n'
+    ? '---\ndescription: "Total Recall — start here."\nglobs:\nalwaysApply: true\n---\n\n'
     : '';
-  const fullContent = prependDirectives(`${mdcHeader}${baseline}`, rulesBlock);
+  const fullContent = prependDirectives(mdcHeader, rulesBlock);
 
   try {
     const normShim = path.normalize(shimPath);
@@ -620,7 +629,7 @@ const CLIENT_SHIMS = {
   'hermes-agent':     ['AGENTS.md'],
   dsh:                ['AGENTS.md'],
   'deepseek-harness': ['AGENTS.md'],
-  openclaw:           ['MEMORY.md', 'AGENTS.md']
+  openclaw:           ['AGENTS.md']
 };
 
 /**
@@ -739,13 +748,13 @@ async function compilePointers(instructionsFile, skillsDir, nodes = [], { vaultD
  */
 /**
  * The rule nodes a project's instruction surfaces are built from: the global
- * brain's rules plus the project's own. A project node with the same slug
+ * brain's rules plus the project's own. A project rule with the same slug
  * wins, so a repo can override a global rule; everything else in the global
  * vault stays search-only. Without this every repo carried only its own vault,
  * and a rule saved with `remember --global` reached no repo at all.
  */
 export function mergeGlobalRuleNodes(projectNodes, globalNodes) {
-  const own = new Set(projectNodes.map((n) => n.slug));
+  const own = new Set(projectNodes.filter((n) => RULE_CATEGORIES.has(n.category)).map((n) => n.slug));
   const inherited = globalNodes
     .filter((n) => RULE_CATEGORIES.has(n.category) && !own.has(n.slug))
     .map((n) => ({ ...n, _layer: 'global' }));
@@ -772,46 +781,50 @@ export async function compileSurface({ vaultDir, skillsDir, derivedDir, instruct
     ? mergeGlobalRuleNodes(nodes, getNodes(globalVault))
     : nodes;
 
-  // ── Incremental compilation: vault content hash check ──
-  // The global rules hash lives in its own file: vault-hash.txt is served by
-  // /api/vault/hash and must keep describing this vault alone.
+  // ── Each output has its own trigger (ON-DEMAND-CONTEXT-01) ──
+  // Entry files are static: they change only with the entry block or the client list.
+  // Indexes change only with this vault. The CLI index changes only with this brain's
+  // plugin catalog. A plugin or global-rule change therefore rewrites no repository's
+  // entry files and starts no embeddings pass; rules reach agents at preflight.
   const hashFile = path.join(derivedDir, 'vault-hash.txt');
   const currentHash = computeVaultHash(vaultDir);
-  const globalHashFile = path.join(derivedDir, 'global-rules-hash.txt');
-  const globalHash = globalVault && fs.existsSync(globalVault) ? computeVaultHash(globalVault) : '';
-  // Commands and skills feed the surface too; a change to either must recompile
-  // even when no memory node changed.
   const inputsHashFile = path.join(derivedDir, 'surface-inputs-hash.txt');
+  const cliHashFile = path.join(derivedDir, 'cli-index-hash.txt');
   const files = instructionFiles(instructionsFile, skillsDir);
   const surfaceDir = path.dirname(instructionsFile);
   const artifactsFile = path.join(derivedDir, 'surface-artifacts.json');
-  const inputsHash = sourceHash(SURFACE_SOURCE) + catalog.fingerprint + JSON.stringify(files) + surfaceInputsHash({ commandDirs: commandDirsFor(skillsDir), skillsDir });
-
-  if (!force && fs.existsSync(hashFile)) {
-    const storedHash = fs.readFileSync(hashFile, 'utf8').trim();
-    const storedGlobal = fs.existsSync(globalHashFile) ? fs.readFileSync(globalHashFile, 'utf8').trim() : '';
-    const storedInputs = fs.existsSync(inputsHashFile) ? fs.readFileSync(inputsHashFile, 'utf8').trim() : '';
-    if (storedHash === currentHash && storedGlobal === globalHash && storedInputs === inputsHash &&
-        instructionArtifactsMatch(files, surfaceDir, artifactsFile)) {
-      return {
-        nodesProcessed: nodes.length,
-        skillsInjected: 0,
-        semanticIndexed: 0,
-        semanticUnavailable: false,
-        skipped: true,
-        reason: 'vault-hash-unchanged'
-      };
-    }
+  const inputsHash = crypto.createHash('sha256').update(ENTRY_BLOCK).update(JSON.stringify(files.map(file => path.relative(surfaceDir, file)))).digest('hex');
+  const stored = file => (fs.existsSync(file) ? fs.readFileSync(file, 'utf8').trim() : null);
+  const entryCurrent = !force && stored(inputsHashFile) === inputsHash && instructionArtifactsMatch(files, surfaceDir, artifactsFile);
+  const vaultCurrent = !force && stored(hashFile) === currentHash;
+  const cliCurrent = !force && stored(cliHashFile) === catalog.fingerprint;
+
+  if (entryCurrent && vaultCurrent && cliCurrent) {
+    return {
+      nodesProcessed: nodes.length,
+      skillsInjected: 0,
+      semanticIndexed: 0,
+      semanticUnavailable: false,
+      skipped: true,
+      reason: 'vault-hash-unchanged'
+    };
   }
 
-  // 1. Write pointer and active rules to all instruction shims
-  const skillsInjected = await compilePointers(instructionsFile, skillsDir, ruleNodes, { vaultDir, derivedDir, force, files });
-
-  // 2. Build derived indexes (powers semantic search API)
   if (!fs.existsSync(derivedDir)) {
     fs.mkdirSync(derivedDir, { recursive: true });
   }
 
+  // 1. Entry files, only when the entry block or client list changed (or a file drifted).
+  const skillsInjected = entryCurrent ? 0 : await compilePointers(instructionsFile, skillsDir, ruleNodes, { vaultDir, derivedDir, force, files });
+  if (!entryCurrent) {
+    atomicWrite(inputsHashFile, inputsHash);
+    atomicWrite(artifactsFile, JSON.stringify({ version: 1, files: files.map(file => describeInstruction(file, surfaceDir)) }, null, 2));
+  }
+
+  // 2. Derived indexes, only when this vault changed.
+  let semanticResult = { indexed: 0, skipped: nodes.length, unavailable: false };
+  if (!vaultCurrent) {
+
   const graphIndex = nodes.map(n => ({
     slug: n.slug,
     title: n.title,
@@ -844,7 +857,7 @@ export async function compileSurface({ vaultDir, skillsDir, derivedDir, instruct
   //     caller could detect any of it.
   // Awaiting is cheap in steady state: buildEmbeddingsIndex skips nodes whose
   // content hash is unchanged, so only genuinely new or edited nodes cost a call.
-  let semanticResult = { indexed: 0, skipped: nodes.length, unavailable: true };
+  semanticResult = { indexed: 0, skipped: nodes.length, unavailable: true };
   if (!semantic || process.env.TR_EMBEDDINGS_DISABLED === '1') {
     logger.info('surface', 'Semantic embeddings explicitly disabled; local indexes updated.', { derivedDir });
   } else try {
@@ -869,9 +882,18 @@ export async function compileSurface({ vaultDir, skillsDir, derivedDir, instruct
     semanticResult = { indexed: 0, skipped: nodes.length, unavailable: true, error: err.message };
   }
 
-  // 3b. Build or update the CLI semantic index.
-  let cliIndexResult = { built: 0, skipped: 0, failed: 0 };
+  // 4. Generate Obsidian Canvas
   try {
+    generateCanvas(nodes, vaultDir);
+  } catch { /* non-fatal */ }
+
+  atomicWrite(hashFile, currentHash);
+  writeProjectionManifest(derivedDir, currentHash);
+  }
+
+  // 3. The CLI semantic index, only when this brain's plugin catalog changed.
+  let cliIndexResult = { built: 0, skipped: 0, failed: 0 };
+  if (!cliCurrent) try {
     const { buildCliSemanticIndex } = await import('./cli-semantic-index.mjs');
     const projectRoot = skillsDir ? path.dirname(path.dirname(skillsDir)) : process.cwd();
     cliIndexResult = await buildCliSemanticIndex({
@@ -884,22 +906,11 @@ export async function compileSurface({ vaultDir, skillsDir, derivedDir, instruct
     if (cliIndexResult.built > 0) {
       logger.info('surface', `CLI semantic index: ${cliIndexResult.built} indexed, ${cliIndexResult.skipped} skipped.`, { derivedDir });
     }
+    atomicWrite(cliHashFile, catalog.fingerprint);
   } catch (err) {
     logger.warn('surface', `CLI semantic index build non-fatal warning: ${err.message}`, { derivedDir });
   }
 
-  // 4. Generate Obsidian Canvas
-  try {
-    generateCanvas(nodes, vaultDir);
-  } catch { /* non-fatal */ }
-
-  // 5. Write vault hash + projection manifest
-  atomicWrite(hashFile, currentHash);
-  atomicWrite(globalHashFile, globalHash);
-  atomicWrite(inputsHashFile, inputsHash);
-  atomicWrite(artifactsFile, JSON.stringify({ version: 1, files: files.map(file => describeInstruction(file, surfaceDir)) }, null, 2));
-  writeProjectionManifest(derivedDir, currentHash);
-
   return {
     nodesProcessed: nodes.length,
     skillsInjected,

package/src/core/task-context.mjs

@@ -9,7 +9,9 @@ import fs from 'node:fs';
 const hash = text => crypto.createHash('sha256').update(String(text)).digest('hex');
 const STOP = new Set('a an and are as at be before by can do for from how i in is it of on or our should so that the their this to use we what when which with you'.split(' '));
 export const taskTerms = task => [...new Set((String(task).toLowerCase().match(/[\p{L}\p{N}_-]{3,}/gu) || []).filter(term => !STOP.has(term)))];
-const overlap = (terms, text) => terms.filter(term => String(text).toLowerCase().includes(term)).length / Math.max(1, terms.length);
+// Task terms contain only letters, digits, underscores and hyphens. Hyphens also delimit source-reference segments.
+const taskMatchers = task => taskTerms(task).map(term => new RegExp(`(?<![\\p{L}\\p{N}_])${term}(?![\\p{L}\\p{N}_])`, 'iu'));
+const overlap = (matchers, text) => matchers.filter(matcher => matcher.test(text)).length / Math.max(1, matchers.length);
 export const summarizeRetrieval = summary => summary ? { mode: summary.mode, selected: summary.selected,
   candidates: summary.candidates || 0, providers: (summary.coverage || []).map(row => row.provider),
   ...(summary.duplicatePassages ? { duplicatePassages: summary.duplicatePassages } : {}),
@@ -18,11 +20,11 @@ export const summarizeRetrieval = summary => summary ? { mode: summary.mode, sel
 
 /** Preserve the best matching line and bounded neighboring text, including a match late in a long body. */
 export function extractTaskPassage(text, task, { maxChars = 1000, anchorLine } = {}) {
-  const lines = String(text || '').split('\n'), terms = taskTerms(task);
+  const lines = String(text || '').split('\n'), matchers = taskMatchers(task);
   let anchor = Number.isInteger(anchorLine) ? Math.max(0, Math.min(lines.length - 1, anchorLine - 1)) : 0;
   if (!Number.isInteger(anchorLine)) {
     let best = -1;
-    lines.forEach((line, index) => { const score = overlap(terms, line); if (score > best) { best = score; anchor = index; } });
+    lines.forEach((line, index) => { const score = overlap(matchers, line); if (score > best) { best = score; anchor = index; } });
   }
   let start = Math.max(0, anchor - 2), end = Math.min(lines.length, anchor + 3);
   while (lines.slice(start, end).join('\n').length > maxChars && (start < anchor || end > anchor + 1)) {
@@ -32,8 +34,7 @@ export function extractTaskPassage(text, task, { maxChars = 1000, anchorLine } =
   let passage = lines.slice(start, end).join('\n');
   let startColumn = 1;
   if (passage.length > maxChars) {
-    const lower = passage.toLowerCase();
-    const hits = terms.map(term => lower.indexOf(term)).filter(index => index >= 0);
+    const hits = matchers.map(matcher => passage.search(matcher)).filter(index => index >= 0);
     const focus = hits.length ? Math.min(...hits) : 0;
     const offset = Math.max(0, Math.min(passage.length - maxChars, focus - Math.floor(maxChars / 3)));
     passage = passage.slice(offset, offset + maxChars); startColumn += offset;
@@ -50,8 +51,8 @@ function renderEvidence(item) {
 export async function retrieveTaskKnowledge({ query, nodes = [], derivedDir, indexScopes,
   projectRoot = process.cwd(), actions = [], semantic = true, budget = 1200, limit = 6,
   embedding = getEmbedding, loadIndex = loadEmbeddingsIndex, providers = retrievePluginContext } = {}) {
-  const terms = taskTerms(query);
-  if (!terms.length) return { contributions: [], summary: { mode: 'none', selected: 0, diagnostics: [], coverage: [] }, queryVector: null };
+  const matchers = taskMatchers(query);
+  if (!matchers.length) return { contributions: [], summary: { mode: 'none', selected: 0, diagnostics: [], coverage: [] }, queryVector: null };
   const diagnostics = [], indexes = new Map();
   const scopes = indexScopes || (derivedDir ? [{ layer: '*', derivedDir }] : []);
   for (const scope of scopes) {
@@ -77,7 +78,7 @@ export async function retrieveTaskKnowledge({ query, nodes = [], derivedDir, ind
     if (stale) staleVectors++;
     const valid = !stale && Array.isArray(entry?.embedding) && Array.isArray(queryVector) && entry.embedding.length === queryVector.length;
     if (valid) vectors++;
-    const lexical = overlap(terms, `${node.title || ''}\n${body}`);
+    const lexical = overlap(matchers, `${node.title || ''}\n${body}`);
     const similarity = valid ? cosineSimilarity(queryVector, entry.embedding) : 0;
     const score = valid ? Math.max(0, similarity) * .75 + lexical * .25 : lexical * .7;
     return { node, layer, body, score, relevant: lexical > 0 || similarity >= .35 };

package/src/core/task-executors.mjs

@@ -1,4 +1,3 @@
-import { loadPluginModule as __loadOwnedPlugin } from './plugin-runtime.mjs';
 /**
  * Executor registry for daemon tasks.
  *
@@ -41,43 +40,18 @@ function policyCheck(task) {
 
 async function runDream(task, ctx) {
   const { runDreamCycle } = await import('./dream.mjs');
-  await runDreamCycle({
+  const result = await runDreamCycle({
     vaultDir: ctx.vaultDir,
     skillsDir: ctx.skillsDir,
     derivedDir: ctx.derivedDir,
     conflictsDir: ctx.conflictsDir,
     instructionsFile: ctx.instructionsFile,
+    runtimeConfig: ctx.runtimeConfig,
   });
+  if (result?.status !== 'success') return { success: false, error: result?.errors?.join('; ') || 'unsupported', executor: 'dream' };
   return { success: true, output: 'Dream cycle complete', executor: 'dream' };
 }
 
-async function runSessionIngest(task, ctx) {
-  const { scanAndIngest } = await import('./session-watcher.mjs');
-  const result = scanAndIngest(ctx.sessionsDir);
-  return {
-    success: true,
-    output: `Ingested ${result.ingested} new sessions`,
-    executor: 'session-ingest',
-  };
-}
-
-async function runSurfaceCompile(task, ctx) {
-  const { compileSurface } = await import('./surface.mjs');
-  await compileSurface({
-    vaultDir: ctx.vaultDir,
-    skillsDir: ctx.skillsDir,
-    derivedDir: ctx.derivedDir,
-    instructionsFile: ctx.instructionsFile,
-  });
-  return { success: true, output: 'Surface recompiled', executor: 'surface-compile' };
-}
-
-async function runPrune(task, ctx) {
-  const { autoPruneStorage } = await import('./dream.mjs');
-  autoPruneStorage(ctx.brainDir, ctx.vaultDir, ctx.conflictsDir);
-  return { success: true, output: 'Storage prune complete', executor: 'prune' };
-}
-
 async function runCustom(task, ctx) {
   const land = task.result?.land || 'inbox';
   const intent = task.intent || task.body || task.reason || task.slug;
@@ -89,8 +63,8 @@ async function runCustom(task, ctx) {
       message: `Custom task (log only): ${task.slug} — ${intent}`,
     });
     return {
-      success: true,
-      output: `Custom task recorded (no vault write): ${intent}`.slice(0, 500),
+      success: false,
+      error: 'unsupported',
       executor: 'custom',
     };
   }
@@ -207,7 +181,7 @@ async function runLegacyCategoryDispatch(task, ctx) {
   }
 
   if (category === 'system2-deliberation') {
-    if (process.env.TR_POWER_EXECUTORS !== '1' && !task._research_id) {
+    if (process.env.TR_POWER_EXECUTORS !== '1' && !task._research_id && !(task.created_by === 'automations' && task.payload?.scheduledIdle)) {
       return {
         success: false,
         error: 'system2-deliberation requires TR_POWER_EXECUTORS=1 (or research-queue phase)',
@@ -221,6 +195,7 @@ async function runLegacyCategoryDispatch(task, ctx) {
       inboxDir: path.join(BRAIN_DIR, 'memory-inbox', 'pending'),
       runtimeConfig,
     });
+    if (result.error || result.success === false) return { success: false, error: result.error || 'Inference failed', executor: 'system2' };
     return {
       success: true,
       output: `Inference complete: ${result.conclusions?.length || 0} conclusions`,
@@ -253,7 +228,9 @@ async function runLegacyCategoryDispatch(task, ctx) {
         vaultDir: VAULT_DIR,
         inboxDir: path.join(BRAIN_DIR, 'memory-inbox', 'pending'),
         runtimeConfig,
+        fromTurn: 1,
       });
+      if (result.error) return { success: false, error: result.error, executor: 'post-mortem' };
       return {
         success: true,
         output: `Post-mortem: ${result.nodesCreated || 0} nodes`,
@@ -280,6 +257,7 @@ async function runLegacyCategoryDispatch(task, ctx) {
         inboxDir: path.join(BRAIN_DIR, 'memory-inbox', 'pending'),
         runtimeConfig,
       });
+      if (result.error || result.success === false) return { success: false, error: result.error || 'Clarity review failed', executor: 'clarity' };
       return {
         success: true,
         output: `Clarity review: rewrote=${result.rewrote}`,
@@ -287,17 +265,8 @@ async function runLegacyCategoryDispatch(task, ctx) {
       };
     }
     if (String(task.slug || '').startsWith('memory-compaction-')) {
-      const { runMemoryCompaction } = await import('./fact-seeker.mjs');
-      const result = await runMemoryCompaction({
-        vaultDir: VAULT_DIR,
-        inboxDir: path.join(BRAIN_DIR, 'memory-inbox', 'pending'),
-        runtimeConfig,
-      });
-      return {
-        success: true,
-        output: `Compaction: ${result.consolidatedCount || 0} nodes`,
-        executor: 'compaction',
-      };
+      const { fileCleanupProposals } = await import('./cleanup-task.mjs');
+      return fileCleanupProposals(VAULT_DIR);
     }
     // generic maintenance: lease vacuum
     try {
@@ -324,10 +293,10 @@ async function runLegacyCategoryDispatch(task, ctx) {
     return { success: true, output: 'Maintenance complete', executor: 'maintenance' };
   }
 
-  if (category === 'exploration' || category === 'self-evaluation' || category === 'skill-engineering') {
+  if (category === 'self-evaluation' || category === 'skill-engineering') {
     return {
-      success: true,
-      output: `Acknowledged category ${category} (no-op in core mode)`,
+      success: false,
+      error: 'unsupported',
       executor: category,
     };
   }
@@ -335,7 +304,7 @@ async function runLegacyCategoryDispatch(task, ctx) {
   // Unknown — fail loud
   return {
     success: false,
-    error: `Unknown task executor/category: executor=${task.executor || 'null'} category=${category || 'null'} kind=${task.kind || 'null'} slug=${task.slug}`,
+    error: 'unsupported',
     executor: 'unknown',
   };
 }
@@ -375,7 +344,7 @@ async function runResearchLegacy(task, ctx) {
     // researched — so it is now a no-op (RESEARCH_SYSTEM2).
     const topic = String(task.target || '').trim();
     if (!topic || topic === 'global') {
-      return { success: true, output: 'No research topic on this task — nothing to research.', executor: 'research' };
+      return { success: false, error: 'unsupported', executor: 'research' };
     }
 
     // Prefer deep multi-source research when this came from the research queue
@@ -514,7 +483,7 @@ async function runResearchLegacy(task, ctx) {
       quarantineDir: path.join(BRAIN_DIR, 'memory-inbox', 'quarantine'),
     });
     if (result.skipped) {
-      return { success: true, output: `Conclusion writer: ${result.skipped}`, executor: 'research' };
+      return { success: false, error: 'unsupported', executor: 'research' };
     }
     return {
       success: true,
@@ -525,7 +494,7 @@ async function runResearchLegacy(task, ctx) {
 
   return {
     success: false,
-    error: `No research handler matched slug=${task.slug} category=${task.category}`,
+    error: 'unsupported',
     executor: 'research',
   };
 }
@@ -571,47 +540,39 @@ function findLatestResearchDraftSlug(inboxDir, topic) {
 
 // ─── Registry ───────────────────────────────────────────────────────────────────
 
-async function runSecretsRotationCheck(task, ctx) {
-  const { runSecretsRotationCheck: run } = await __loadOwnedPlugin('auth', 'secrets-rotate');
-  return run(ctx);
-}
-
-async function runSecretsExportEnv(task, ctx) {
-  const { runSecretsExportAll } = await __loadOwnedPlugin('auth', 'secrets-rotate');
-  return runSecretsExportAll(ctx);
+async function runSkillGap(task, ctx) {
+  const { requestSkillGap } = await import('./skill-gap.mjs');
+  const topic = task.payload?.topic || task.target || /topic "([^"]+)"/.exec(task.reason || '')?.[1];
+  const session = task.source_session || task.origin?.session_id;
+  return requestSkillGap(topic, task.payload?.evidence ||
+    (session ? `session://${session}` : null), { projectRoot: ctx.projectRoot || process.cwd() });
 }
 
-async function runSecretsRotationAssist(task, ctx) {
-  // Supervised: ensure prompt is present; does not auto-browser without agent session
-  const key = task.payload?.secret_key || task.slug?.replace(/^secret-rotate-/, '');
-  if (!key) {
-    return { success: false, error: 'missing secret_key', executor: 'secrets-rotation-assist' };
+async function runLessonReview(task, ctx) {
+  const { runPostMortem } = await import('./post-mortem.mjs');
+  const sessionPath = task.payload?.sessionPath || (task.target && path.join(ctx.sessionsDir, task.target));
+  if (!sessionPath) return { success: false, error: 'Lesson review requires a session transcript and turn range' };
+  const result = await runPostMortem(sessionPath, {
+    vaultDir: ctx.vaultDir, inboxDir: path.join(ctx.brainDir, 'memory-inbox', 'pending'), runtimeConfig: ctx.runtimeConfig,
+    // Scheduled snapshots already contain exactly the requested range.
+    fromTurn: task.payload?.sessionPath ? 1 : task.payload?.fromTurn,
+    toTurn: task.payload?.sessionPath ? Infinity : task.payload?.toTurn,
+    sourceRef: task.payload?.sessionId ? `${task.payload.sessionId}/turns/${task.payload.fromTurn}-${task.payload.toTurn}` : task.slug,
+    hold: task.payload?.hold === true,
+  });
+  if (result.error) return { success: false, error: result.error, executor: 'lesson-review' };
+  if (task.slug?.startsWith('lesson-review-')) {
+    const dir = path.join(ctx.brainDir, 'lesson-reviews');
+    fs.mkdirSync(dir, { recursive: true });
+    atomicWrite(path.join(dir, `${task.slug}.done`), new Date().toISOString());
   }
-  const { getBrowserRotateAssist } = await __loadOwnedPlugin('auth', 'secrets-rotate');
-  const assist = await getBrowserRotateAssist(ctx.brainDir, key);
-  return {
-    success: true,
-    output: `Browser rotation assist ready for ${key}. Console: ${assist.console_url || 'n/a'}. Use browser tools with human 2FA; then secret rotate --export-env.`,
-    executor: 'secrets-rotation-assist',
-    assist: {
-      key: assist.key,
-      console_url: assist.console_url,
-      docs_url: assist.docs_url,
-      overdue: assist.overdue,
-      // prompt available to agent; do not echo secrets
-      prompt: assist.prompt,
-    },
-  };
+  return { success: true, output: `Lesson review: ${result.patterns?.length || 0} patterns, ${result.facts?.length || 0} facts, ${result.skill_gaps?.length || 0} skill gaps, ${result.violations?.length || 0} violations`, executor: 'lesson-review' };
 }
 
 const EXECUTORS = {
-  'secrets-rotation-check': { id: 'secrets-rotation-check', run: runSecretsRotationCheck },
-  'secrets-export-env': { id: 'secrets-export-env', run: runSecretsExportEnv },
-  'secrets-rotation-assist': { id: 'secrets-rotation-assist', run: runSecretsRotationAssist },
+  'lesson-review': { id: 'lesson-review', run: runLessonReview },
+  'skill-manager': { id: 'skill-manager', run: runSkillGap },
   dream: { id: 'dream', run: runDream },
-  'session-ingest': { id: 'session-ingest', run: runSessionIngest },
-  'surface-compile': { id: 'surface-compile', run: runSurfaceCompile },
-  prune: { id: 'prune', run: runPrune },
   custom: { id: 'custom', run: runCustom },
   research: { id: 'research', run: runResearchLegacy },
   legacy: { id: 'legacy', run: runLegacyDispatch },
@@ -623,31 +584,16 @@ const EXECUTORS = {
 export function resolveExecutor(task) {
   const t = normalizeTask(task);
 
-  if (t.executor && EXECUTORS[t.executor]) {
-    return EXECUTORS[t.executor];
-  }
+  if (t.category === 'skill-engineering') return EXECUTORS['skill-manager'];
+  if (t.category === 'lesson-review' || t.category === 'self-evaluation') return EXECUTORS['lesson-review'];
+
+  // An explicit unsupported executor must never fall through to kind/category.
+  if (t.executor) return typeof t.executor === 'string' && Object.hasOwn(EXECUTORS, t.executor) ? EXECUTORS[t.executor] : null;
 
   // System / named slugs
   if (t.slug === 'dream' || String(t.slug || '').startsWith('dream-') || t.executor === 'dream') {
     return EXECUTORS.dream;
   }
-  if (String(t.slug || '').startsWith('session-ingest')) return EXECUTORS['session-ingest'];
-  if (String(t.slug || '').startsWith('surface-compile')) return EXECUTORS['surface-compile'];
-  if (String(t.slug || '').startsWith('prune-') || t.slug === 'prune') return EXECUTORS.prune;
-  if (String(t.slug || '').startsWith('secret-rotate-') || t.category === 'secrets-rotation') {
-    return EXECUTORS['secrets-rotation-assist'];
-  }
-  if (String(t.slug || '').startsWith('secrets-rotation-check') || t.executor === 'secrets-rotation-check') {
-    return EXECUTORS['secrets-rotation-check'];
-  }
-  if (String(t.slug || '').startsWith('secrets-export') || t.executor === 'secrets-export-env') {
-    return EXECUTORS['secrets-export-env'];
-  }
-
-  if (t.kind === 'custom' || t.category === 'custom' || t.executor === 'custom') {
-    return EXECUTORS.custom;
-  }
-
   // Known legacy categories still registered
   const legacyCategories = new Set([
     'conscious-enforcement',
@@ -658,13 +604,14 @@ export function resolveExecutor(task) {
     'proactive-research',
     'skill-engineering',
     'self-evaluation',
-    'exploration',
   ]);
 
   if (legacyCategories.has(t.category) || t._research_id || t._is_remote_vault_sync) {
     return EXECUTORS.legacy;
   }
 
+  if (t.category === 'custom' || (t.kind === 'custom' && !t.category)) return EXECUTORS.custom;
+
   if (t.kind === 'research') return EXECUTORS.research;
   if (t.kind === 'system' || t.kind === 'maintenance' || t.kind === 'memory') {
     return EXECUTORS.legacy;
@@ -691,11 +638,12 @@ export async function dispatchTask(task, ctx) {
       `Unknown task executor for slug=${normalized.slug} ` +
       `category=${normalized.category} kind=${normalized.kind} executor=${normalized.executor}`;
     logger.info({ subsystem: 'task-executors', message: msg });
-    return { success: false, error: msg, executor: 'unknown' };
+    return { success: false, error: 'unsupported', executor: 'unknown' };
   }
 
   try {
     const result = await executor.run(normalized, ctx);
+    if (!result || typeof result.success !== 'boolean') return { success: false, error: 'unsupported', executor: executor.id };
     return { ...result, executor: result.executor || executor.id };
   } catch (err) {
     return {

package/src/core/validated-write.mjs

@@ -15,6 +15,8 @@ import { processOperationAsync } from './operation-validator.mjs';
 import { safeStringify, isSafeVaultName } from './vault.mjs';
 import { invalidate } from './vault-cache.mjs';
 
+export const supportsExpectedBeforeHash = true;
+
 /**
  * Normalize a vault node so package universal frontmatter + TR memory v2 pass.
  */
@@ -101,6 +103,7 @@ function buildEnvelope(node, options = {}) {
   const {
     workspaceId = 'default',
     idempotencyKey,
+    expectedBeforeHash,
     dryRun = false,
     path: pathOverride,
   } = options;
@@ -124,6 +127,7 @@ function buildEnvelope(node, options = {}) {
     path: vfsPath,
     workspace_id: workspaceId,
     content,
+    ...(expectedBeforeHash === undefined ? {} : { expected_before_hash: expectedBeforeHash }),
     dry_run: !!dryRun,
     actor: { role: options.agentRole || 'system' },
   };
@@ -152,6 +156,7 @@ export async function writeNodeValidatedAsync(node, vaultDir, options = {}) {
     agentRole,
     leaseStore,
     eventLogDir,
+    allowLong: options.allowLong === true,
   });
 
   if (result.success && !dryRun) {

package/src/core/vault-files.mjs

@@ -8,6 +8,12 @@ export function isSafeVaultName(name) {
 
 export function atomicWrite(filePath, content) {
   const tmpPath = `${filePath}.tmp.${process.pid}`;
-  fs.writeFileSync(tmpPath, content, 'utf8');
-  fs.renameSync(tmpPath, filePath);
+  try {
+    fs.writeFileSync(tmpPath, content, 'utf8');
+    fs.renameSync(tmpPath, filePath);
+  } catch (error) {
+    // A leftover copy is untracked and unignored, so a commit of everything would publish it.
+    fs.rmSync(tmpPath, { force: true });
+    throw error;
+  }
 }

package/src/core/vault.mjs

@@ -33,7 +33,7 @@ function stripUndefined(obj) {
  * @returns {string}        The serialized markdown with frontmatter
  */
 export function safeStringify(content, data) {
-  return matter.stringify(content ?? '', stripUndefined(data ?? {}));
+  return matter.stringify({ content: content ?? '', data: stripUndefined(data ?? {}) });
 }
 
 /**