total-recall-brain 3.44.0 → 3.46.0

package/src/core/ssss-operation-service.mjs

@@ -46,6 +46,7 @@ export function patchVfsDocument(vfsPath, patches, options = {}) {
     type: 'patch',
     ...envelopeBase(vfsPath, options),
     patches,
+    ...(options.expectedBeforeHash === undefined ? {} : { expected_before_hash: options.expectedBeforeHash }),
   }, options);
 }
 

package/src/core/startup-health.mjs

@@ -10,6 +10,23 @@ import { CLI_COMMANDS } from './cli-commands.mjs';
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
 export const cliEntry = path.join(packageRoot, 'bin/total-recall.mjs');
 
+/** Whether this package's dashboard bundle is as new as its frontend sources (the server rebuilds it). */
+async function defaultDashboardCheck() {
+  try {
+    const { checkDistFreshness, dashboardTargets } = await import('./dashboard-bundle.mjs');
+    if (!fs.existsSync(path.join(packageRoot, 'frontend', 'package.json'))) return { status: 'not-shipped' };
+    const result = await checkDistFreshness(dashboardTargets(packageRoot));
+    const status = result.ok ? 'current' : result.reason === 'missing-bundle' ? 'missing' : 'stale';
+    return {
+      status,
+      ...(result.bundle ? { built_at: new Date(result.bundle.mtimeMs).toISOString() } : {}),
+      ...(!result.ok && result.source ? { newer_source: path.relative(packageRoot, result.source.path) } : {}),
+    };
+  } catch (error) {
+    return { status: 'unknown', reason: error.message };
+  }
+}
+
 export function runBounded(binary, args, { cwd = process.cwd(), timeoutMs = 15000, maxBytes = 262144 } = {}) {
   return new Promise(resolve => {
     let child, output = '', stderr = '', size = 0, reason = null, settled = false, timer, escalation;
@@ -81,8 +98,8 @@ export function processIdentity(pidFile, hint, { alive = pid => { try { process.
 }
 
 /** The single installation-aware daemon observation for status and lifecycle. */
-export function observeDaemon(brainDir, { identity = processIdentity } = {}) {
-  const expected_entry = path.join(packageRoot, 'src', 'core', 'daemon-loop.mjs');
+export function observeDaemon(brainDir, { identity = processIdentity, expectedEntry = path.join(packageRoot, 'src', 'core', 'daemon-loop.mjs') } = {}) {
+  const expected_entry = expectedEntry;
   return { ...identity(path.join(brainDir, 'daemon.pid'), expected_entry), expected_entry, source: 'local-pid' };
 }
 
@@ -130,7 +147,8 @@ export async function fetchStartup(url, options = {}, fetchImpl = fetch) {
 }
 
 export async function startupHealth({ cwd = process.cwd(), brainDir, brainUrl = null, token = null, brainId = null, ensure = false,
-  appCheck = null, appStart = null, run = runBounded, fetchImpl = fetch, onDiskVersion = packageVersionOnDisk, listener = verifyListener, platform = process.platform, home = os.homedir(), identity = processIdentity } = {}) {
+  appCheck = null, appStart = null, run = runBounded, fetchImpl = fetch, onDiskVersion = packageVersionOnDisk, listener = verifyListener, platform = process.platform, home = os.homedir(), identity = processIdentity,
+  dashboardCheck = null, pluginChecks = null } = {}) {
   const actions = [];
   const serverFile = path.join(brainDir, 'server.pid');
   const report = { checked_at: new Date().toISOString(), server: { status: 'not-configured' }, brain: { status: 'unknown' }, daemon: { status: 'unknown' },
@@ -148,7 +166,12 @@ export async function startupHealth({ cwd = process.cwd(), brainDir, brainUrl =
       remoteDaemon = { status: body.daemon === 'running' ? 'running' : ['dead', 'stopped', 'not-started'].includes(body.daemon) ? 'stopped' : 'unknown', source: 'remote-health' };
       if (local) {
         const own = identity(serverFile, path.join(packageRoot, 'src', 'server', 'index.mjs'));
-        if (own.status !== 'running') return { status: own.status === 'conflict' ? 'conflict' : 'unknown', reason: 'server-process-unverified' };
+        if (own.status !== 'running') {
+          const actualRoot = own.entry?.endsWith(path.join('src', 'server', 'index.mjs'))
+            ? path.resolve(path.dirname(own.entry), '../..') : null;
+          return { status: own.status === 'conflict' ? 'conflict' : 'unknown',
+            reason: actualRoot ? `server runs from ${actualRoot}; expected ${packageRoot}; run total-recall server ensure` : 'server-process-unverified' };
+        }
         if (!await listener(own.pid, new URL(brainUrl), { run, cwd })) return { status: 'unknown', reason: 'server-listener-unverified' };
       }
       const drift = local && verdict.status === 'ready' ? serverCodeDrift(verdict.version, onDiskVersion()) : null;
@@ -230,6 +253,13 @@ export async function startupHealth({ cwd = process.cwd(), brainDir, brainUrl =
   }
   const { inspectRequiredPlugins } = await import('./required-plugins.mjs');
   report.required_plugins = inspectRequiredPlugins(brainDir);
+  // Reported, not part of readiness: a stale dashboard or unfinished work still
+  // leaves the runtime usable, but neither may stay invisible.
+  report.dashboard = await (dashboardCheck ?? defaultDashboardCheck)();
+  report.plugin_checks = await (pluginChecks ?? (async () => {
+    const { runPluginStartupChecks } = await import('./plugin-startup-checks.mjs');
+    return runPluginStartupChecks({ cwd });
+  }))();
   report.shared_ready = report.required_plugins.status === 'ready' && report.server.status === 'ready' && report.brain.status === 'ready' && report.daemon.status === 'running' && report.ssss.status === 'available';
   report.ready_scope = appCheck ? 'shared-and-declared-current-repo-app' : 'shared-runtime-only';
   report.ready = report.shared_ready && (!appCheck || report.app.status === 'ready');

package/src/core/surface.mjs

@@ -496,13 +496,8 @@ function injectDirectives(fileContent, rulesBlock) {
     return prependDirectives(authored, rulesBlock);
   }
   
-  let content = fileContent.trimEnd();
-  const baseline = '# 🔴 MANDATORY FIRST STEP ON EVERY TURN: TOTAL RECALL FIRST\n1. Run `total-recall --help` (or `node bin/total-recall.mjs --help`) to discover all tools, plugins, and commands.\n2. Read and follow .agent/skills/total-recall/SKILL.md before doing ANYTHING.\n3. Run `total-recall context "<task>"` and `total-recall recall "<topic>" --local` before any decision or action.\nTotal Recall is the mandatory working memory and toolset across all tasks and harnesses. Never skip this.';
-  if (!content.includes('total-recall/SKILL.md')) {
-    content = baseline + '\n\n' + content;
-  }
-  
-  return prependDirectives(content, rulesBlock);
+  // The managed block carries the start-here instructions; authored text stays as written.
+  return prependDirectives(fileContent.trimEnd(), rulesBlock);
 }
 
 function prependDirectives(authored, rulesBlock) {
@@ -516,14 +511,28 @@ function prependDirectives(authored, rulesBlock) {
 /**
  * Write or update a platform instruction shim with the pointer and active rules.
  */
+/**
+ * The whole managed part of every client entry file (ON-DEMAND-CONTEXT-01). It is static: no rule
+ * bodies, CLI list, plugin table or command list, so a rule or plugin change rewrites no repository.
+ * The rules for a task are compiled when the agent acknowledges preflight, and commands are looked
+ * up when needed.
+ */
+export const ENTRY_BLOCK = `# Total Recall: start here
+
+This repository uses Total Recall. Its rules are not copied into this file: they are compiled for your task when you acknowledge preflight.
+
+1. Read \`.agent/skills/total-recall/SKILL.md\`.
+2. Run \`total-recall tr-preflight --ack --task "<task>" --action read,edit,test\` and read everything it prints. Those are the rules for this task. Until it passes, working tools are denied.
+3. Route the task through Metaharness with \`total-recall meta-harness route "<task>" --json\` and follow the route.
+4. Look commands up only when you need them: \`total-recall --help\`, \`total-recall <namespace> --help\`, \`total-recall plugin library\`.`;
+
 async function writeShim(shimPath, skillsDir, nodes = [], { vaultDir, derivedDir, force = false } = {}) {
   const shimDir = path.dirname(shimPath);
-  const rulesBlock = await buildRulesBlock(skillsDir, nodes, { vaultDir, derivedDir, bootstrap: true });
-  const baseline = '# 🔴 MANDATORY FIRST STEP ON EVERY TURN: TOTAL RECALL FIRST\n1. Run `total-recall --help` (or `node bin/total-recall.mjs --help`) to discover all tools, plugins, and commands.\n2. Read and follow .agent/skills/total-recall/SKILL.md before doing ANYTHING.\n3. Run `total-recall context "<task>"` and `total-recall recall "<topic>" --local` before any decision or action.\nTotal Recall is the mandatory working memory and toolset across all tasks and harnesses. Never skip this.\n';
+  const rulesBlock = ENTRY_BLOCK;
   const mdcHeader = shimPath.endsWith('.mdc')
-    ? '---\ndescription: "Total Recall — Auto-generated behavioral memory surface."\nglobs:\nalwaysApply: true\n---\n\n'
+    ? '---\ndescription: "Total Recall — start here."\nglobs:\nalwaysApply: true\n---\n\n'
     : '';
-  const fullContent = prependDirectives(`${mdcHeader}${baseline}`, rulesBlock);
+  const fullContent = prependDirectives(mdcHeader, rulesBlock);
 
   try {
     const normShim = path.normalize(shimPath);
@@ -772,46 +781,50 @@ export async function compileSurface({ vaultDir, skillsDir, derivedDir, instruct
     ? mergeGlobalRuleNodes(nodes, getNodes(globalVault))
     : nodes;
 
-  // ── Incremental compilation: vault content hash check ──
-  // The global rules hash lives in its own file: vault-hash.txt is served by
-  // /api/vault/hash and must keep describing this vault alone.
+  // ── Each output has its own trigger (ON-DEMAND-CONTEXT-01) ──
+  // Entry files are static: they change only with the entry block or the client list.
+  // Indexes change only with this vault. The CLI index changes only with this brain's
+  // plugin catalog. A plugin or global-rule change therefore rewrites no repository's
+  // entry files and starts no embeddings pass; rules reach agents at preflight.
   const hashFile = path.join(derivedDir, 'vault-hash.txt');
   const currentHash = computeVaultHash(vaultDir);
-  const globalHashFile = path.join(derivedDir, 'global-rules-hash.txt');
-  const globalHash = globalVault && fs.existsSync(globalVault) ? computeVaultHash(globalVault) : '';
-  // Commands and skills feed the surface too; a change to either must recompile
-  // even when no memory node changed.
   const inputsHashFile = path.join(derivedDir, 'surface-inputs-hash.txt');
+  const cliHashFile = path.join(derivedDir, 'cli-index-hash.txt');
   const files = instructionFiles(instructionsFile, skillsDir);
   const surfaceDir = path.dirname(instructionsFile);
   const artifactsFile = path.join(derivedDir, 'surface-artifacts.json');
-  const inputsHash = sourceHash(SURFACE_SOURCE) + catalog.fingerprint + JSON.stringify(files) + surfaceInputsHash({ commandDirs: commandDirsFor(skillsDir), skillsDir });
-
-  if (!force && fs.existsSync(hashFile)) {
-    const storedHash = fs.readFileSync(hashFile, 'utf8').trim();
-    const storedGlobal = fs.existsSync(globalHashFile) ? fs.readFileSync(globalHashFile, 'utf8').trim() : '';
-    const storedInputs = fs.existsSync(inputsHashFile) ? fs.readFileSync(inputsHashFile, 'utf8').trim() : '';
-    if (storedHash === currentHash && storedGlobal === globalHash && storedInputs === inputsHash &&
-        instructionArtifactsMatch(files, surfaceDir, artifactsFile)) {
-      return {
-        nodesProcessed: nodes.length,
-        skillsInjected: 0,
-        semanticIndexed: 0,
-        semanticUnavailable: false,
-        skipped: true,
-        reason: 'vault-hash-unchanged'
-      };
-    }
+  const inputsHash = crypto.createHash('sha256').update(ENTRY_BLOCK).update(JSON.stringify(files.map(file => path.relative(surfaceDir, file)))).digest('hex');
+  const stored = file => (fs.existsSync(file) ? fs.readFileSync(file, 'utf8').trim() : null);
+  const entryCurrent = !force && stored(inputsHashFile) === inputsHash && instructionArtifactsMatch(files, surfaceDir, artifactsFile);
+  const vaultCurrent = !force && stored(hashFile) === currentHash;
+  const cliCurrent = !force && stored(cliHashFile) === catalog.fingerprint;
+
+  if (entryCurrent && vaultCurrent && cliCurrent) {
+    return {
+      nodesProcessed: nodes.length,
+      skillsInjected: 0,
+      semanticIndexed: 0,
+      semanticUnavailable: false,
+      skipped: true,
+      reason: 'vault-hash-unchanged'
+    };
   }
 
-  // 1. Write pointer and active rules to all instruction shims
-  const skillsInjected = await compilePointers(instructionsFile, skillsDir, ruleNodes, { vaultDir, derivedDir, force, files });
-
-  // 2. Build derived indexes (powers semantic search API)
   if (!fs.existsSync(derivedDir)) {
     fs.mkdirSync(derivedDir, { recursive: true });
   }
 
+  // 1. Entry files, only when the entry block or client list changed (or a file drifted).
+  const skillsInjected = entryCurrent ? 0 : await compilePointers(instructionsFile, skillsDir, ruleNodes, { vaultDir, derivedDir, force, files });
+  if (!entryCurrent) {
+    atomicWrite(inputsHashFile, inputsHash);
+    atomicWrite(artifactsFile, JSON.stringify({ version: 1, files: files.map(file => describeInstruction(file, surfaceDir)) }, null, 2));
+  }
+
+  // 2. Derived indexes, only when this vault changed.
+  let semanticResult = { indexed: 0, skipped: nodes.length, unavailable: false };
+  if (!vaultCurrent) {
+
   const graphIndex = nodes.map(n => ({
     slug: n.slug,
     title: n.title,
@@ -844,7 +857,7 @@ export async function compileSurface({ vaultDir, skillsDir, derivedDir, instruct
   //     caller could detect any of it.
   // Awaiting is cheap in steady state: buildEmbeddingsIndex skips nodes whose
   // content hash is unchanged, so only genuinely new or edited nodes cost a call.
-  let semanticResult = { indexed: 0, skipped: nodes.length, unavailable: true };
+  semanticResult = { indexed: 0, skipped: nodes.length, unavailable: true };
   if (!semantic || process.env.TR_EMBEDDINGS_DISABLED === '1') {
     logger.info('surface', 'Semantic embeddings explicitly disabled; local indexes updated.', { derivedDir });
   } else try {
@@ -869,9 +882,18 @@ export async function compileSurface({ vaultDir, skillsDir, derivedDir, instruct
     semanticResult = { indexed: 0, skipped: nodes.length, unavailable: true, error: err.message };
   }
 
-  // 3b. Build or update the CLI semantic index.
-  let cliIndexResult = { built: 0, skipped: 0, failed: 0 };
+  // 4. Generate Obsidian Canvas
   try {
+    generateCanvas(nodes, vaultDir);
+  } catch { /* non-fatal */ }
+
+  atomicWrite(hashFile, currentHash);
+  writeProjectionManifest(derivedDir, currentHash);
+  }
+
+  // 3. The CLI semantic index, only when this brain's plugin catalog changed.
+  let cliIndexResult = { built: 0, skipped: 0, failed: 0 };
+  if (!cliCurrent) try {
     const { buildCliSemanticIndex } = await import('./cli-semantic-index.mjs');
     const projectRoot = skillsDir ? path.dirname(path.dirname(skillsDir)) : process.cwd();
     cliIndexResult = await buildCliSemanticIndex({
@@ -884,22 +906,11 @@ export async function compileSurface({ vaultDir, skillsDir, derivedDir, instruct
     if (cliIndexResult.built > 0) {
       logger.info('surface', `CLI semantic index: ${cliIndexResult.built} indexed, ${cliIndexResult.skipped} skipped.`, { derivedDir });
     }
+    atomicWrite(cliHashFile, catalog.fingerprint);
   } catch (err) {
     logger.warn('surface', `CLI semantic index build non-fatal warning: ${err.message}`, { derivedDir });
   }
 
-  // 4. Generate Obsidian Canvas
-  try {
-    generateCanvas(nodes, vaultDir);
-  } catch { /* non-fatal */ }
-
-  // 5. Write vault hash + projection manifest
-  atomicWrite(hashFile, currentHash);
-  atomicWrite(globalHashFile, globalHash);
-  atomicWrite(inputsHashFile, inputsHash);
-  atomicWrite(artifactsFile, JSON.stringify({ version: 1, files: files.map(file => describeInstruction(file, surfaceDir)) }, null, 2));
-  writeProjectionManifest(derivedDir, currentHash);
-
   return {
     nodesProcessed: nodes.length,
     skillsInjected,

package/src/core/task-executors.mjs

@@ -1,4 +1,3 @@
-import { loadPluginModule as __loadOwnedPlugin } from './plugin-runtime.mjs';
 /**
  * Executor registry for daemon tasks.
  *
@@ -41,43 +40,18 @@ function policyCheck(task) {
 
 async function runDream(task, ctx) {
   const { runDreamCycle } = await import('./dream.mjs');
-  await runDreamCycle({
+  const result = await runDreamCycle({
     vaultDir: ctx.vaultDir,
     skillsDir: ctx.skillsDir,
     derivedDir: ctx.derivedDir,
     conflictsDir: ctx.conflictsDir,
     instructionsFile: ctx.instructionsFile,
+    runtimeConfig: ctx.runtimeConfig,
   });
+  if (result?.status !== 'success') return { success: false, error: result?.errors?.join('; ') || 'unsupported', executor: 'dream' };
   return { success: true, output: 'Dream cycle complete', executor: 'dream' };
 }
 
-async function runSessionIngest(task, ctx) {
-  const { scanAndIngest } = await import('./session-watcher.mjs');
-  const result = scanAndIngest(ctx.sessionsDir);
-  return {
-    success: true,
-    output: `Ingested ${result.ingested} new sessions`,
-    executor: 'session-ingest',
-  };
-}
-
-async function runSurfaceCompile(task, ctx) {
-  const { compileSurface } = await import('./surface.mjs');
-  await compileSurface({
-    vaultDir: ctx.vaultDir,
-    skillsDir: ctx.skillsDir,
-    derivedDir: ctx.derivedDir,
-    instructionsFile: ctx.instructionsFile,
-  });
-  return { success: true, output: 'Surface recompiled', executor: 'surface-compile' };
-}
-
-async function runPrune(task, ctx) {
-  const { autoPruneStorage } = await import('./dream.mjs');
-  autoPruneStorage(ctx.brainDir, ctx.vaultDir, ctx.conflictsDir);
-  return { success: true, output: 'Storage prune complete', executor: 'prune' };
-}
-
 async function runCustom(task, ctx) {
   const land = task.result?.land || 'inbox';
   const intent = task.intent || task.body || task.reason || task.slug;
@@ -89,8 +63,8 @@ async function runCustom(task, ctx) {
       message: `Custom task (log only): ${task.slug} — ${intent}`,
     });
     return {
-      success: true,
-      output: `Custom task recorded (no vault write): ${intent}`.slice(0, 500),
+      success: false,
+      error: 'unsupported',
       executor: 'custom',
     };
   }
@@ -207,7 +181,7 @@ async function runLegacyCategoryDispatch(task, ctx) {
   }
 
   if (category === 'system2-deliberation') {
-    if (process.env.TR_POWER_EXECUTORS !== '1' && !task._research_id) {
+    if (process.env.TR_POWER_EXECUTORS !== '1' && !task._research_id && !(task.created_by === 'automations' && task.payload?.scheduledIdle)) {
       return {
         success: false,
         error: 'system2-deliberation requires TR_POWER_EXECUTORS=1 (or research-queue phase)',
@@ -221,6 +195,7 @@ async function runLegacyCategoryDispatch(task, ctx) {
       inboxDir: path.join(BRAIN_DIR, 'memory-inbox', 'pending'),
       runtimeConfig,
     });
+    if (result.error || result.success === false) return { success: false, error: result.error || 'Inference failed', executor: 'system2' };
     return {
       success: true,
       output: `Inference complete: ${result.conclusions?.length || 0} conclusions`,
@@ -253,7 +228,9 @@ async function runLegacyCategoryDispatch(task, ctx) {
         vaultDir: VAULT_DIR,
         inboxDir: path.join(BRAIN_DIR, 'memory-inbox', 'pending'),
         runtimeConfig,
+        fromTurn: 1,
       });
+      if (result.error) return { success: false, error: result.error, executor: 'post-mortem' };
       return {
         success: true,
         output: `Post-mortem: ${result.nodesCreated || 0} nodes`,
@@ -280,6 +257,7 @@ async function runLegacyCategoryDispatch(task, ctx) {
         inboxDir: path.join(BRAIN_DIR, 'memory-inbox', 'pending'),
         runtimeConfig,
       });
+      if (result.error || result.success === false) return { success: false, error: result.error || 'Clarity review failed', executor: 'clarity' };
       return {
         success: true,
         output: `Clarity review: rewrote=${result.rewrote}`,
@@ -287,17 +265,8 @@ async function runLegacyCategoryDispatch(task, ctx) {
       };
     }
     if (String(task.slug || '').startsWith('memory-compaction-')) {
-      const { runMemoryCompaction } = await import('./fact-seeker.mjs');
-      const result = await runMemoryCompaction({
-        vaultDir: VAULT_DIR,
-        inboxDir: path.join(BRAIN_DIR, 'memory-inbox', 'pending'),
-        runtimeConfig,
-      });
-      return {
-        success: true,
-        output: `Compaction: ${result.consolidatedCount || 0} nodes`,
-        executor: 'compaction',
-      };
+      const { fileCleanupProposals } = await import('./cleanup-task.mjs');
+      return fileCleanupProposals(VAULT_DIR);
     }
     // generic maintenance: lease vacuum
     try {
@@ -324,10 +293,10 @@ async function runLegacyCategoryDispatch(task, ctx) {
     return { success: true, output: 'Maintenance complete', executor: 'maintenance' };
   }
 
-  if (category === 'exploration' || category === 'self-evaluation' || category === 'skill-engineering') {
+  if (category === 'self-evaluation' || category === 'skill-engineering') {
     return {
-      success: true,
-      output: `Acknowledged category ${category} (no-op in core mode)`,
+      success: false,
+      error: 'unsupported',
       executor: category,
     };
   }
@@ -335,7 +304,7 @@ async function runLegacyCategoryDispatch(task, ctx) {
   // Unknown — fail loud
   return {
     success: false,
-    error: `Unknown task executor/category: executor=${task.executor || 'null'} category=${category || 'null'} kind=${task.kind || 'null'} slug=${task.slug}`,
+    error: 'unsupported',
     executor: 'unknown',
   };
 }
@@ -375,7 +344,7 @@ async function runResearchLegacy(task, ctx) {
     // researched — so it is now a no-op (RESEARCH_SYSTEM2).
     const topic = String(task.target || '').trim();
     if (!topic || topic === 'global') {
-      return { success: true, output: 'No research topic on this task — nothing to research.', executor: 'research' };
+      return { success: false, error: 'unsupported', executor: 'research' };
     }
 
     // Prefer deep multi-source research when this came from the research queue
@@ -514,7 +483,7 @@ async function runResearchLegacy(task, ctx) {
       quarantineDir: path.join(BRAIN_DIR, 'memory-inbox', 'quarantine'),
     });
     if (result.skipped) {
-      return { success: true, output: `Conclusion writer: ${result.skipped}`, executor: 'research' };
+      return { success: false, error: 'unsupported', executor: 'research' };
     }
     return {
       success: true,
@@ -525,7 +494,7 @@ async function runResearchLegacy(task, ctx) {
 
   return {
     success: false,
-    error: `No research handler matched slug=${task.slug} category=${task.category}`,
+    error: 'unsupported',
     executor: 'research',
   };
 }
@@ -571,47 +540,39 @@ function findLatestResearchDraftSlug(inboxDir, topic) {
 
 // ─── Registry ───────────────────────────────────────────────────────────────────
 
-async function runSecretsRotationCheck(task, ctx) {
-  const { runSecretsRotationCheck: run } = await __loadOwnedPlugin('auth', 'secrets-rotate');
-  return run(ctx);
-}
-
-async function runSecretsExportEnv(task, ctx) {
-  const { runSecretsExportAll } = await __loadOwnedPlugin('auth', 'secrets-rotate');
-  return runSecretsExportAll(ctx);
+async function runSkillGap(task, ctx) {
+  const { requestSkillGap } = await import('./skill-gap.mjs');
+  const topic = task.payload?.topic || task.target || /topic "([^"]+)"/.exec(task.reason || '')?.[1];
+  const session = task.source_session || task.origin?.session_id;
+  return requestSkillGap(topic, task.payload?.evidence ||
+    (session ? `session://${session}` : null), { projectRoot: ctx.projectRoot || process.cwd() });
 }
 
-async function runSecretsRotationAssist(task, ctx) {
-  // Supervised: ensure prompt is present; does not auto-browser without agent session
-  const key = task.payload?.secret_key || task.slug?.replace(/^secret-rotate-/, '');
-  if (!key) {
-    return { success: false, error: 'missing secret_key', executor: 'secrets-rotation-assist' };
+async function runLessonReview(task, ctx) {
+  const { runPostMortem } = await import('./post-mortem.mjs');
+  const sessionPath = task.payload?.sessionPath || (task.target && path.join(ctx.sessionsDir, task.target));
+  if (!sessionPath) return { success: false, error: 'Lesson review requires a session transcript and turn range' };
+  const result = await runPostMortem(sessionPath, {
+    vaultDir: ctx.vaultDir, inboxDir: path.join(ctx.brainDir, 'memory-inbox', 'pending'), runtimeConfig: ctx.runtimeConfig,
+    // Scheduled snapshots already contain exactly the requested range.
+    fromTurn: task.payload?.sessionPath ? 1 : task.payload?.fromTurn,
+    toTurn: task.payload?.sessionPath ? Infinity : task.payload?.toTurn,
+    sourceRef: task.payload?.sessionId ? `${task.payload.sessionId}/turns/${task.payload.fromTurn}-${task.payload.toTurn}` : task.slug,
+    hold: task.payload?.hold === true,
+  });
+  if (result.error) return { success: false, error: result.error, executor: 'lesson-review' };
+  if (task.slug?.startsWith('lesson-review-')) {
+    const dir = path.join(ctx.brainDir, 'lesson-reviews');
+    fs.mkdirSync(dir, { recursive: true });
+    atomicWrite(path.join(dir, `${task.slug}.done`), new Date().toISOString());
   }
-  const { getBrowserRotateAssist } = await __loadOwnedPlugin('auth', 'secrets-rotate');
-  const assist = await getBrowserRotateAssist(ctx.brainDir, key);
-  return {
-    success: true,
-    output: `Browser rotation assist ready for ${key}. Console: ${assist.console_url || 'n/a'}. Use browser tools with human 2FA; then secret rotate --export-env.`,
-    executor: 'secrets-rotation-assist',
-    assist: {
-      key: assist.key,
-      console_url: assist.console_url,
-      docs_url: assist.docs_url,
-      overdue: assist.overdue,
-      // prompt available to agent; do not echo secrets
-      prompt: assist.prompt,
-    },
-  };
+  return { success: true, output: `Lesson review: ${result.patterns?.length || 0} patterns, ${result.facts?.length || 0} facts, ${result.skill_gaps?.length || 0} skill gaps, ${result.violations?.length || 0} violations`, executor: 'lesson-review' };
 }
 
 const EXECUTORS = {
-  'secrets-rotation-check': { id: 'secrets-rotation-check', run: runSecretsRotationCheck },
-  'secrets-export-env': { id: 'secrets-export-env', run: runSecretsExportEnv },
-  'secrets-rotation-assist': { id: 'secrets-rotation-assist', run: runSecretsRotationAssist },
+  'lesson-review': { id: 'lesson-review', run: runLessonReview },
+  'skill-manager': { id: 'skill-manager', run: runSkillGap },
   dream: { id: 'dream', run: runDream },
-  'session-ingest': { id: 'session-ingest', run: runSessionIngest },
-  'surface-compile': { id: 'surface-compile', run: runSurfaceCompile },
-  prune: { id: 'prune', run: runPrune },
   custom: { id: 'custom', run: runCustom },
   research: { id: 'research', run: runResearchLegacy },
   legacy: { id: 'legacy', run: runLegacyDispatch },
@@ -623,31 +584,16 @@ const EXECUTORS = {
 export function resolveExecutor(task) {
   const t = normalizeTask(task);
 
-  if (t.executor && EXECUTORS[t.executor]) {
-    return EXECUTORS[t.executor];
-  }
+  if (t.category === 'skill-engineering') return EXECUTORS['skill-manager'];
+  if (t.category === 'lesson-review' || t.category === 'self-evaluation') return EXECUTORS['lesson-review'];
+
+  // An explicit unsupported executor must never fall through to kind/category.
+  if (t.executor) return typeof t.executor === 'string' && Object.hasOwn(EXECUTORS, t.executor) ? EXECUTORS[t.executor] : null;
 
   // System / named slugs
   if (t.slug === 'dream' || String(t.slug || '').startsWith('dream-') || t.executor === 'dream') {
     return EXECUTORS.dream;
   }
-  if (String(t.slug || '').startsWith('session-ingest')) return EXECUTORS['session-ingest'];
-  if (String(t.slug || '').startsWith('surface-compile')) return EXECUTORS['surface-compile'];
-  if (String(t.slug || '').startsWith('prune-') || t.slug === 'prune') return EXECUTORS.prune;
-  if (String(t.slug || '').startsWith('secret-rotate-') || t.category === 'secrets-rotation') {
-    return EXECUTORS['secrets-rotation-assist'];
-  }
-  if (String(t.slug || '').startsWith('secrets-rotation-check') || t.executor === 'secrets-rotation-check') {
-    return EXECUTORS['secrets-rotation-check'];
-  }
-  if (String(t.slug || '').startsWith('secrets-export') || t.executor === 'secrets-export-env') {
-    return EXECUTORS['secrets-export-env'];
-  }
-
-  if (t.kind === 'custom' || t.category === 'custom' || t.executor === 'custom') {
-    return EXECUTORS.custom;
-  }
-
   // Known legacy categories still registered
   const legacyCategories = new Set([
     'conscious-enforcement',
@@ -658,13 +604,14 @@ export function resolveExecutor(task) {
     'proactive-research',
     'skill-engineering',
     'self-evaluation',
-    'exploration',
   ]);
 
   if (legacyCategories.has(t.category) || t._research_id || t._is_remote_vault_sync) {
     return EXECUTORS.legacy;
   }
 
+  if (t.category === 'custom' || (t.kind === 'custom' && !t.category)) return EXECUTORS.custom;
+
   if (t.kind === 'research') return EXECUTORS.research;
   if (t.kind === 'system' || t.kind === 'maintenance' || t.kind === 'memory') {
     return EXECUTORS.legacy;
@@ -691,11 +638,12 @@ export async function dispatchTask(task, ctx) {
       `Unknown task executor for slug=${normalized.slug} ` +
       `category=${normalized.category} kind=${normalized.kind} executor=${normalized.executor}`;
     logger.info({ subsystem: 'task-executors', message: msg });
-    return { success: false, error: msg, executor: 'unknown' };
+    return { success: false, error: 'unsupported', executor: 'unknown' };
   }
 
   try {
     const result = await executor.run(normalized, ctx);
+    if (!result || typeof result.success !== 'boolean') return { success: false, error: 'unsupported', executor: executor.id };
     return { ...result, executor: result.executor || executor.id };
   } catch (err) {
     return {