wendkeep 0.20.1 → 0.22.0

package/CHANGELOG.md

@@ -4,6 +4,62 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.22.0] — 2026-07-08
+
+Hardening — 10 audit-confirmed bugs fixed (each survived an adversarial refuter).
+
+### Fixed
+- **Archive trusted stale evidence**: `verify` now seals `evidencia.json` with a `.evidence-hash`
+  (the `tarefas.md` hash it ran against); the archive gate rejects evidence gone stale (a sensor
+  task added/edited after the last green verify). `src/verify.mjs`, `src/change.mjs`.
+- **Archiving a non-active change wiped the active pointer**: `archiveChange` now only clears
+  `CURRENT_CHANGE` when the archived slug IS the active one. `hooks/change-core.mjs`.
+- **Non-atomic archive**: a destination-exists guard fails BEFORE promoting specs (same-day slug
+  reuse no longer half-promotes `07-Specs` then errors on the move); `renameSync` wrapped.
+- **Archived proposta kept `status: active`** → flipped to `status: archived` on archive.
+- **Import dropped Codex sessions whose `session_meta` exceeded 16KB** (~31% in production): the
+  reader now grows the buffer to the first newline instead of a fixed prefix. `hooks/import-sessions.mjs`.
+- **Cost was silently $0 for untabled models**: `normalizeModelName` strips a `[1m]` context tag
+  generically (so `claude-opus-4-8[1m]` prices), `claude-sonnet-5` added, plus approximate Codex
+  `gpt-5.4`/`gpt-5.3-codex` aliases. `hooks/token-usage.mjs`, `hooks/pricing.json`.
+- **Imported session titles came from harness meta-prompts** ("Generate a concise title…"): those
+  utility prompts are now filtered in both parsers' `shouldIgnoreUserText`.
+- **Session↔change link died on reopen**: the change wikilink moved from an append after
+  `## Encerramento` (stripped every turn) to a durable `## Mudanças` section before it, which
+  accumulates every change the session touched. `hooks/session-stop.mjs`.
+- **`init --force` duplicated every hook group**: now refreshes the managed entry in place instead
+  of appending a second identical group. `src/init.mjs`.
+- **Injected DIGEST carried dead wikilinks**: `buildBrainDigest` now keeps only targets that
+  resolve to a real note and drops truncated placeholders. `hooks/brain-core.mjs`.
+
+### Changed
+- **Docs coherence**: `--help` moved `--top` from `import` to `cost`, gave `import` its real flags
+  (`--source`/`--stamp-ids`/`--from`/`--codex-from`/`--limit`/`--dry-run`, "Claude + Codex"), and
+  added `verify [--deep]`. README dropped the stale "v0.1" framing, fixed the 5→6 skill list
+  (adds `wk-verify`), made the `docs/` link absolute, and documented the `<wk_process>` router +
+  the G0 scaffold gate.
+
+## [0.21.0] — 2026-07-08
+
+Process enforcement — fixes from a real planning failure (production session): the model planned
+in chat, never invoked the wk-* skills, left the change scaffold raw and archived it with
+`--force`, minting a bogus ADR.
+
+### Added
+- **`<wk_process>` router injected every session** (brain-inject): the enforcement layer the
+  skills were missing. Plan → wk-brainstorming + wk-planning; record → `change new` + FILL
+  proposta/design/tarefas; implement → wk-tdd; close → verify + wk-verify + archive. States
+  explicitly that `archive --force` is the user's call, never the agent's. Localized (pt-BR/en).
+- **G0 — anti-scaffold gate**: `change archive` now blocks when proposta/design/tarefas still
+  carry the scaffold placeholders (`(motivo da mudança)`, `(abordagem técnica)`,
+  `(primeira tarefa)` + en variants) — an unfilled scaffold is not a completed change.
+  `--force` still escapes (human hatch); new `scaffoldPlaceholders(dir)` in change-core.
+
+### Fixed
+- **session-ensure now stamps `session_id`** in the notes it creates — the 4th note-creation
+  path, missed in 0.18.0 (it has its own skeleton builder). Notes born from UserPromptSubmit
+  (no SessionStart, e.g. resumed windows) were coming out without identity.
+
 ## [0.20.1] — 2026-07-06
 
 ### Changed

package/README.md

@@ -4,7 +4,7 @@
 
 **A persistent‑memory harness for AI coding agents, built on your Obsidian vault.** Every Claude Code / Codex session is captured turn‑by‑turn into local Markdown — with token/cost tracking, auto‑extracted decisions, bugs and learnings, and a curated memory layer injected back at the start of the next session. On top of that memory core sits a native, zero‑dependency **change lifecycle** (spec → change → TDD → sensor‑gated archive) that keeps intent, work and proof wikilinked in one graph. 100% local, open‑core.
 
-> Status: `v0.1` — extracted from a system in daily production use. The capture engine, cost tracking and graph wiring are battle‑tested; the cross‑platform installer (`wendkeep init`) is the new part. See [`docs/`](docs/) for the project's strategy and decision log.
+> Extracted from a system in daily production use: the capture engine, cost tracking and graph wiring are battle‑tested; the cross‑platform installer (`wendkeep init`) and the native change loop are the newer parts. See [`docs/`](https://github.com/rogersialves/wendkeep/tree/main/docs) for the project's strategy and decision log.
 
 ---
 
@@ -49,7 +49,7 @@ npx wendkeep init
    Control with `--companions <csv>` or `--no-companions`. The Claude Code plugin layer (`extraKnownMarketplaces` + `enabledPlugins`) is wired as a bonus where the companion has one.
 5. Install a **color system** into the vault's `.obsidian/`: a CSS snippet that accents notes by type (session/decision/bug/learning, via the `cssclasses` the hooks emit) plus graph color groups by folder. Non-destructive merge into `appearance.json`/`graph.json`; skip with `--no-colors`.
 6. Seed the **curated memory layer**: `.brain/CORE.md` (the hand-curated hot layer, with the 3 required sections) and `.brain/COMPACTION_PROTOCOL.md` (the protocol guide). The auto layers (`DIGEST.md`, `index.jsonl`) are generated by the hooks. Validate the curated layer with `wendkeep validate-memory` (cap 25 lines, 3 sections, no secrets/PII).
-7. Seed the **definitions + skills layer**: `.brain/agents/` + `.brain/skills/` (versioned source of truth), including the native process skills `wk-workflow` / `wk-tdd` / `wk-debugging` / `wk-brainstorming` / `wk-planning`. `init` runs `wendkeep sync-defs` for you, delivering them to `.codex/agents/` + `.claude/skills/` (re‑run `sync-defs` after editing `.brain`).
+7. Seed the **definitions + skills layer**: `.brain/agents/` + `.brain/skills/` (versioned source of truth), including the native process skills `wk-workflow` / `wk-tdd` / `wk-debugging` / `wk-brainstorming` / `wk-planning` / `wk-verify` (some ship bundled templates, e.g. `wk-verify`'s `verdict-template.json` + reviewer prompt). `init` runs `wendkeep sync-defs` for you, delivering them to `.codex/agents/` + `.claude/skills/` (re‑run `sync-defs` after editing `.brain`).
 8. Seed the **change/spec lifecycle**: the `07-Specs/` + `08-Mudanças/` folders and a native `wendkeep.sensors.json` (a `validate-memory` sensor plus one per detected `package.json` script). Drives `wendkeep change` / `wendkeep verify` — see **Change lifecycle** below.
 
 ```bash
@@ -170,14 +170,16 @@ agent session ──hooks──▶ wendkeep ──▶ Markdown in vault ──
    (Claude/Codex)        (Node)      (02-Sessões/…)        (CORE+DIGEST, backlinks)
 ```
 
-The agent's settings.json points each hook at `npx wendkeep hook …`. On `Stop`, wendkeep parses the session transcript, appends the turn, updates the token/cost table, and (idempotently) emits any decision/bug/learning notes. On the next `SessionStart`, the curated memory is injected back into context.
+The agent's settings.json points each hook at `npx wendkeep hook …`. On `Stop`, wendkeep parses the session transcript, appends the turn, updates the token/cost table, and (idempotently) emits any decision/bug/learning notes. On every `SessionStart`, `brain-inject` injects back the curated memory (CORE + DIGEST), the active change, project lessons, and a `<wk_process>` router that routes any non‑trivial task through the a2 loop (plan → `change new` + fill the scaffold → TDD → verify → archive).
 
-## Known limitations (`v0.1`)
+The archive **gate** blocks unless: the change scaffold is filled (G0), no task is open (G1), every declared critical sensor is green (with fresh evidence), and — when the change declares `[req:]` — an independent `verdict.json` covers them. `--force` is the human escape hatch; the agent is instructed never to use it on its own.
+
+## Notes & roadmap
 
 - **Vault folder names default to Portuguese** (`02-Sessões`, `04-Decisões`, …). Pass `wendkeep init --locale en` for an English vault (`02-Sessions`, `04-Decisions`, English scaffold/skills). The locale is a vault property, locked at init; parsers are bilingual so mixed content never breaks.
 - **Search is keyword/frontmatter scoring**, not on‑device embeddings (that's on the roadmap).
 - **Transcript formats are agent‑internal** and can change between agent versions; parsing is isolated but may need updates.
-- Installer wires **Claude Code** settings + `.mcp.json`. Codex hooks run on the same scripts but are not auto‑wired yet.
+- Installer wires **Claude Code** settings + `.mcp.json`. Codex hooks run on the same scripts but are not auto‑wired yet (import already covers past Codex sessions via `--source codex`).
 
 ## License
 

package/bin/wendkeep.mjs

@@ -48,9 +48,14 @@ Usage:
   wendkeep spec <sub>          Living specs: list | show <capability>.
   wendkeep sensors <sub>       list | add <id> "<command>" [--severity --type --report].
   wendkeep cost [opts]         Aggregate AI-coding spend across the vault's sessions.
-  wendkeep import [opts]       Backfill: import this project's past Claude sessions into the vault.
                            --since <date> · --top [N] (priciest sessions) · --json.
-  wendkeep verify [--change s] Run a change's task sensors + record evidence (the gate).
+  wendkeep import [opts]       Backfill: import this project's past Claude + Codex sessions into
+                           the vault (deduped by session_id). --source all|claude|codex (default
+                           all) · --stamp-ids (backfill session_id in existing notes) ·
+                           --from <dir> · --codex-from <dir> · --since <date> · --limit N ·
+                           --dry-run · --json.
+  wendkeep verify [--deep] [--change s]  Run a change's task sensors + record evidence (the gate);
+                           --deep assembles the verification package for the wk-verify pass.
   wendkeep lesson add "t" "l"   Record a project-local lesson (injected at SessionStart).
   wendkeep validate-memory [path]  Validate .brain/CORE.md against the compaction
                            protocol (cap 25, 3 sections, no secrets/PII). Uses

package/hooks/brain-core.mjs

@@ -1,7 +1,7 @@
 // .agent/hooks/brain-core.mjs
 // Camada fria do brain: indexa o frontmatter das notas de sessão (0 token LLM).
-import { readdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { basename, join } from 'node:path';
 import { ensureDir, stripYamlQuotes, toVaultRelative } from './obsidian-common.mjs';
 import { getLocale } from './locale.mjs';
 
@@ -123,10 +123,26 @@ export function buildBrainDigest(vaultBase, rows = null) {
     return out;
   };
 
-  const decisions = pick('decisions', DIGEST_CAPS.decisions).sort((a, b) => adrNumber(b) - adrNumber(a));
+  // The digest is INJECTED into every session, so a dead wikilink is dead weight in the model's
+  // context. Keep only targets that resolve to a real note (by vault-relative path or basename)
+  // and drop placeholder paths (a truncated `…` from a summary line). `pick` collects extra so
+  // caps still fill after filtering.
+  const known = new Set();
+  for (const r of data) {
+    const rel = String(r.file || '').replace(/\.md$/i, '');
+    if (rel) { known.add(rel); known.add(basename(rel)); }
+  }
+  const resolves = (p) => {
+    const t = String(p || '').replace(/\.md$/i, '').trim();
+    if (!t || t.includes('...') || t.includes('…')) return false;
+    return known.has(t) || known.has(basename(t)) || existsSync(join(vaultBase, `${t}.md`));
+  };
+  const pickLive = (kind, max) => pick(kind, max * 4).filter(resolves).slice(0, max);
+
+  const decisions = pickLive('decisions', DIGEST_CAPS.decisions).sort((a, b) => adrNumber(b) - adrNumber(a));
   const sessions = byDateDesc.slice(0, DIGEST_CAPS.sessions);
-  const bugs = pick('bugs', DIGEST_CAPS.bugs);
-  const learnings = pick('learnings', DIGEST_CAPS.learnings);
+  const bugs = pickLive('bugs', DIGEST_CAPS.bugs);
+  const learnings = pickLive('learnings', DIGEST_CAPS.learnings);
 
   const lines = ['<!-- AUTO-GERADO por brain-core.mjs (0 token LLM). NÃO editar. Rebuild: node .agent/hooks/brain-reindex.mjs -->'];
   for (const d of decisions) lines.push(`- Decisão: [[${d}]]`);

package/hooks/brain-inject.mjs

@@ -9,6 +9,36 @@ import { getVaultBase, readHookInput, writeHookOutput } from './obsidian-common.
 import { brainDir } from './brain-core.mjs';
 import { buildActiveChangeInjection } from './change-core.mjs';
 import { buildLessonsInjection } from './lessons-core.mjs';
+import { getLocale } from './locale.mjs';
+
+// The process ROUTER — the enforcement layer. The wk-* skills are passive files; without a
+// standing instruction the model plans in chat, leaves the change scaffold raw and forces the
+// gate (seen in production: change archived with `(primeira tarefa)` open, via --force). This
+// block is injected EVERY session so planning always routes through the a2 loop.
+function processRouter(localeId) {
+  if (localeId === 'en') {
+    return [
+      '<wk_process>',
+      'Spec-driven process (mandatory for any non-trivial task):',
+      '1. Plan: skill wk-brainstorming (approved design) → wk-planning (task plan).',
+      '2. Record: `wendkeep change new <slug>` and FILL 08-Changes/<slug>/ — proposta.md (why/what), design.md (the approved approach), tarefas.md (the plan\'s tasks, `- [ ] N.N` with [req:ID]/[sensor:id]). Never leave the scaffold placeholders.',
+      '3. Implement: wk-tdd per task; tick `- [x]` as you finish. Something broke? wk-debugging.',
+      '4. Close: `wendkeep verify` (+ `--deep` + skill wk-verify) → `wendkeep change archive`.',
+      'NEVER `archive --force` on your own — a red gate means pending work; --force is the user\'s call, not yours.',
+      '</wk_process>',
+    ].join('\n');
+  }
+  return [
+    '<wk_process>',
+    'Processo spec-driven (obrigatório em tarefa não-trivial):',
+    '1. Planejar: skill wk-brainstorming (design aprovado) → wk-planning (plano de tarefas).',
+    '2. Registrar: `wendkeep change new <slug>` e PREENCHA 08-Mudanças/<slug>/ — proposta.md (porquê/o quê), design.md (a abordagem aprovada), tarefas.md (as tarefas do plano, `- [ ] N.N` com [req:ID]/[sensor:id]). Nunca deixe os placeholders do scaffold.',
+    '3. Implementar: wk-tdd por tarefa; marque `- [x]` ao concluir. Quebrou algo? wk-debugging.',
+    '4. Fechar: `wendkeep verify` (+ `--deep` + skill wk-verify) → `wendkeep change archive`.',
+    'PROIBIDO `archive --force` por conta própria — gate vermelho significa trabalho pendente; --force é decisão do usuário, não sua.',
+    '</wk_process>',
+  ].join('\n');
+}
 
 const MAX_LINES = 45; // CORE ≤25 + DIGEST ≤15 + folga; salvaguarda se o CORE crescer à mão
 
@@ -26,9 +56,10 @@ export function buildInjection(vaultBase) {
     lines.push('*…truncado pelo budget — fonte completa: .brain/CORE.md + .brain/DIGEST.md*');
   }
   const brain = ['<brain_memory>', ...lines, pointer, '</brain_memory>'].join('\n');
+  const router = processRouter(getLocale(vaultBase).id);
   const change = buildActiveChangeInjection(vaultBase);
   const lessons = buildLessonsInjection(vaultBase);
-  return [brain, change, lessons].filter(Boolean).join('\n');
+  return [brain, router, change, lessons].filter(Boolean).join('\n');
 }
 
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {

package/hooks/change-core.mjs

@@ -53,6 +53,25 @@ ${en ? '(behaviour / scenarios)' : '(comportamento / cenários)'}
   return { proposta, design, tarefas, specDelta };
 }
 
+// Scaffold placeholder markers per file (pt + en, mirrors renderChangeScaffold). A change whose
+// proposta/design/tarefas still carry these was never actually planned — archiving it mints a
+// bogus ADR and pollutes _arquivo (seen in production). The archive gate blocks on them.
+const SCAFFOLD_MARKERS = [
+  ['proposta.md', ['(motivo da mudança)', '(escopo da mudança)', '(reason for the change)', '(scope of the change)']],
+  ['design.md', ['(abordagem técnica)', '(technical approach)']],
+  ['tarefas.md', ['(primeira tarefa)', '(first task)']],
+];
+
+export function scaffoldPlaceholders(dir) {
+  const found = [];
+  for (const [file, markers] of SCAFFOLD_MARKERS) {
+    let content = '';
+    try { content = readFileSync(join(dir, file), 'utf8'); } catch { continue; }
+    for (const m of markers) if (content.includes(m)) found.push(`${file}: ${m}`);
+  }
+  return found;
+}
+
 export function activeChange(vaultBase) {
   try {
     const m = readFileSync(join(vaultBase, POINTER), 'utf8').match(/^change:\s*(.+)$/m);
@@ -203,8 +222,16 @@ export function archiveChange(vaultBase, slug, { gate = gateGreen, dateStr, adrN
   if (!verdict.ok) return { ok: false, failing: verdict.failing || [] };
 
   const destRel = join(chDir, ARCHIVE_DIR, `${dateStr}-${slug}`);
+  const destAbs = join(vaultBase, destRel);
   const changeWikilink = wikilinkFromRel(join(destRel, 'proposta'));
 
+  // Atomicity guard: fail BEFORE promoting specs if the destination already exists (e.g. a slug
+  // reused after a same-day archive). Otherwise promoteSpecs would commit to 07-Specs and the
+  // later renameSync would fail, leaving a half-archived state.
+  if (existsSync(destAbs)) {
+    return { ok: false, failing: [`destino de arquivo já existe: ${destRel} — renomeie o slug ou remova o arquivo antigo`] };
+  }
+
   // Promote spec deltas into the living 07-Specs BEFORE moving (deltas live in src).
   let promoted = [];
   let specWarnings = [];
@@ -221,7 +248,18 @@ export function archiveChange(vaultBase, slug, { gate = gateGreen, dateStr, adrN
   try { reqIds = [...new Set(parseTasks(readFileSync(join(src, 'tarefas.md'), 'utf8')).map((t) => t.req).filter(Boolean))]; } catch { /* sem tarefas */ }
 
   ensureDir(join(vaultBase, chDir, ARCHIVE_DIR));
-  renameSync(src, join(vaultBase, destRel));
+  try {
+    renameSync(src, destAbs);
+  } catch (error) {
+    return { ok: false, failing: [`falha ao mover a mudança para ${destRel}: ${error.message} (07-Specs pode ter sido promovido — verifique)`] };
+  }
+
+  // Flip the archived proposta's frontmatter status so it no longer reads as active.
+  try {
+    const pp = join(destAbs, 'proposta.md');
+    const c = readFileSync(pp, 'utf8').replace(/^status:\s*active\s*$/m, 'status: archived');
+    writeFileSync(pp, c, 'utf8');
+  } catch { /* proposta ilegível — segue */ }
 
   const [year] = String(dateStr).split('-');
   const adrDirRel = join(loc.folders.decisions, year);
@@ -249,6 +287,8 @@ tags:
 Mudança ${changeWikilink} concluída e arquivada.${capLine}${reqLine}
 `, 'utf8');
 
-  clearActiveChange(vaultBase);
+  // Only clear the pointer when the archived change IS the active one — archiving some other
+  // slug explicitly must not blank the pointer of a different, still-active change.
+  if (activeChange(vaultBase) === slug) clearActiveChange(vaultBase);
   return { ok: true, failing: [], archivedRel: destRel, adrRel, promoted, specWarnings };
 }

package/hooks/import-sessions.mjs

@@ -97,15 +97,39 @@ function readPrefix(path, bytes = 4096) {
   }
 }
 
+// Read the first physical line in full, growing the buffer until a newline is found (capped).
+// A fixed prefix truncated any rollout whose session_meta line exceeded the window, silently
+// dropping that session from discovery — Codex meta lines can be large (env, git, instructions).
+function readFirstLine(path, maxBytes = 4 * 1024 * 1024) {
+  let fd;
+  try {
+    fd = openSync(path, 'r');
+    const chunk = Buffer.alloc(65536);
+    let acc = '';
+    let pos = 0;
+    while (pos < maxBytes) {
+      const n = readSync(fd, chunk, 0, chunk.length, pos);
+      if (n <= 0) break;
+      acc += chunk.slice(0, n).toString('utf-8');
+      const nl = acc.indexOf('\n');
+      if (nl >= 0) return acc.slice(0, nl);
+      pos += n;
+    }
+    return acc; // single-line file, or gave up at the cap
+  } catch {
+    return '';
+  } finally {
+    if (fd !== undefined) { try { closeSync(fd); } catch { /* already closed */ } }
+  }
+}
+
 // Pull the session_meta payload (id + cwd). session_meta is line 1 of a rollout.
 function readSessionMeta(path) {
-  for (const line of readPrefix(path, 16384).split('\n')) {
-    if (!line.trim()) continue;
-    let e;
-    try { e = JSON.parse(line); } catch { return null; } // partial/oversized first line -> skip
-    return e.type === 'session_meta' ? (e.payload || {}) : null;
-  }
-  return null;
+  const line = readFirstLine(path);
+  if (!line.trim()) return null;
+  let e;
+  try { e = JSON.parse(line); } catch { return null; }
+  return e.type === 'session_meta' ? (e.payload || {}) : null;
 }
 
 // The `session_id` recorded in a note's frontmatter (empty when absent).

package/hooks/pricing.json

@@ -30,6 +30,13 @@
       "cachedInput": 0.3,
       "output": 15
     },
+    "claude-sonnet-5": {
+      "label": "Claude Sonnet 5 API",
+      "provider": "anthropic",
+      "input": 3,
+      "cachedInput": 0.3,
+      "output": 15
+    },
     "claude-haiku-4.5": {
       "label": "Claude Haiku 4.5 API",
       "provider": "anthropic",

package/hooks/session-ensure.mjs

@@ -35,7 +35,7 @@ function sessionIdFromInput(input) {
   return input.session_id || input.sessionId || input.codex_session_id || '';
 }
 
-function buildSessionContent({ relPath, now, summary = 'session', reason = 'Sessão criada automaticamente pelo hook UserPromptSubmit.' }) {
+function buildSessionContent({ relPath, now, summary = 'session', sessionId = '', reason = 'Sessão criada automaticamente pelo hook UserPromptSubmit.' }) {
   const date = formatDate(now);
   const startedAt = formatLocalIso(now);
   const titleTime = formatTime(now).slice(0, 5);
@@ -48,6 +48,7 @@ date: ${date}
 started_at: ${startedAt}
 ended_at:
 provider: ${provider.id}
+session_id: ${sessionId ? yamlQuote(sessionId) : ''}
 status: active
 summary: ${yamlQuote(summary)}
 cssclasses:
@@ -267,7 +268,7 @@ function createSession({ vaultBase, sessionId, input, now }) {
   const summary = sessionSummaryFromInput(input);
   const { absPath, relPath } = allocateSessionPath(vaultBase, now, summary);
   const startedAt = formatLocalIso(now);
-  writeFileSync(absPath, buildSessionContent({ relPath, now, summary }), 'utf-8');
+  writeFileSync(absPath, buildSessionContent({ relPath, now, summary, sessionId }), 'utf-8');
   writeControl(vaultBase, {
     status: 'active',
     session_file: relPath,

package/hooks/session-stop.mjs

@@ -53,7 +53,11 @@ function shouldIgnoreUserText(text) {
     || /^# AGENTS\.md instructions/.test(trimmed)
     || trimmed.startsWith('<permissions instructions>')
     || trimmed.includes('You are Codex, a coding agent')
-    || trimmed.startsWith('## Memory');
+    || trimmed.startsWith('## Memory')
+    // Harness utility meta-prompts (title generation, classifiers) — not real user turns; they
+    // were leaking into note titles/summaries on import.
+    || /^Generate a concise( UI)? title/i.test(trimmed)
+    || /^You are a helpful assistant\. You will be presented with a user prompt/i.test(trimmed);
 }
 
 function addUnique(list, value) {
@@ -1086,12 +1090,18 @@ function main() {
     findLinkedDerivedNotes(vaultBase, sessionRel),
   );
   finalizeSessionFile(sessionPath, tx, created, endedAt);
-  // Link bidirecional sessão↔change ativa no grafo Obsidian. Fail-quiet: nunca derruba o Stop.
+  // Link durável sessão↔change: uma seção "Mudanças" ANTES de `## Encerramento`. O append antigo
+  // (após o Encerramento) era apagado a cada reopen por stripClosingSection, perdendo a aresta do
+  // grafo quando a change fechava antes do turno seguinte. Aqui sobrevive ao reopen e acumula toda
+  // change que passou pela sessão (upsertListSection deduplica). Fail-quiet: nunca derruba o Stop.
   try {
     const chgLink = activeChangeLink(vaultBase);
-    if (chgLink) {
-      const cur = readFileSync(sessionPath, 'utf8');
-      if (!cur.includes(chgLink)) writeFileSync(sessionPath, `${cur.trimEnd()}\n\n${chgLink}\n`, 'utf8');
+    const wl = (chgLink.match(/\[\[[^\]]+\]\]/) || [])[0];
+    if (wl) {
+      let cur = readFileSync(sessionPath, 'utf8');
+      cur = ensureSection(cur, 'Mudanças', '\n## Encerramento');
+      cur = upsertListSection(cur, 'Mudanças', [`- ${wl}`], null);
+      writeFileSync(sessionPath, cur, 'utf8');
     }
   } catch { /* nunca derruba o Stop */ }
   writeControl(vaultBase, {

package/hooks/token-usage.mjs

@@ -41,6 +41,13 @@ const DEFAULT_PRICE_REFERENCE = {
     cachedInput: 0.3,
     output: 15,
   },
+  'claude-sonnet-5': {
+    label: 'Claude Sonnet 5 API',
+    provider: 'anthropic',
+    input: 3,
+    cachedInput: 0.3,
+    output: 15,
+  },
   'claude-haiku-4.5': {
     label: 'Claude Haiku 4.5 API',
     provider: 'anthropic',
@@ -79,6 +86,14 @@ const MODEL_ALIASES = {
   'gpt-5.5': 'gpt-5.5',
   'gpt-5_5': 'gpt-5.5',
   'openai/gpt-5.5': 'gpt-5.5',
+  // Older/adjacent Codex model ids: priced approximately at the gpt-5.5 tier until confirmed
+  // (better a close estimate than a silent $0). Codex sessions surface these via session_meta.
+  'gpt-5.4': 'gpt-5.5',
+  'gpt-5-4': 'gpt-5.5',
+  'gpt-5.4-mini': 'gpt-5.5',
+  'gpt-5.3-codex': 'gpt-5.5',
+  'gpt-5.3': 'gpt-5.5',
+  'openai/gpt-5.4': 'gpt-5.5',
   'claude-opus-4.7': 'claude-opus-4.7',
   'claude-opus-4-7': 'claude-opus-4.7',
   'anthropic/claude-opus-4.7': 'claude-opus-4.7',
@@ -91,6 +106,9 @@ const MODEL_ALIASES = {
   'claude-sonnet-4-6': 'claude-sonnet-4.6',
   'anthropic/claude-sonnet-4.6': 'claude-sonnet-4.6',
   'anthropic/claude-sonnet-4-6': 'claude-sonnet-4.6',
+  'claude-sonnet-5': 'claude-sonnet-5',
+  'claude-sonnet-5-0': 'claude-sonnet-5',
+  'anthropic/claude-sonnet-5': 'claude-sonnet-5',
   'claude-haiku-4.5': 'claude-haiku-4.5',
   'claude-haiku-4-5': 'claude-haiku-4.5',
   'claude-haiku-4-5-20251001': 'claude-haiku-4.5',
@@ -191,7 +209,9 @@ export function addUsage(target, usage) {
 
 function normalizeModelName(model) {
   const clean = String(model || 'unknown').trim() || 'unknown';
-  const lower = clean.toLowerCase();
+  // Strip a trailing context-window tag (e.g. `claude-opus-4-8[1m]`, `claude-fable-5[1m]`) so the
+  // 1M variant of ANY model maps to its base price instead of falling through to $0.
+  const lower = clean.toLowerCase().replace(/\[[^\]]*\]$/, '');
   if (MODEL_ALIASES[lower]) return MODEL_ALIASES[lower];
   // Fallback: remove sufixo de data (ex.: claude-opus-4-8-20260528) e tenta de novo.
   const noDate = lower.replace(/-\d{8}$/, '');
@@ -280,7 +300,9 @@ function shouldIgnoreUserText(text) {
     || text.startsWith('<command-name>')
     || text.startsWith('<ide_')
     || text.startsWith('## Memory')
-    || text.includes('You are Codex, a coding agent');
+    || text.includes('You are Codex, a coding agent')
+    || /^Generate a concise( UI)? title/i.test(text)
+    || /^You are a helpful assistant\. You will be presented with a user prompt/i.test(text);
 }
 
 function emptyParseResult(transcriptPath) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.20.1",
+  "version": "0.22.0",
   "description": "A persistent-memory harness for AI coding agents on your Obsidian vault: turn-by-turn session capture plus a native, zero-dependency spec→change→verify→archive loop (sensor-gated, independent verdict, mutation discrimination). Local-first, agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "bin": {

package/src/change.mjs

@@ -8,6 +8,7 @@ import {
   parseTasks,
   setTaskDone,
   archiveChange,
+  scaffoldPlaceholders,
 } from '../hooks/change-core.mjs';
 import { evaluateGate, requiredSensors } from '../hooks/sensors-core.mjs';
 import { evaluateVerdict, tasksHashOf, parseSpecsList, parseDelta, parseRequirements, applyDelta } from '../hooks/spec-core.mjs';
@@ -154,6 +155,13 @@ export function runChange(argv) {
     if (!slug) { process.stderr.write('wendkeep change archive: missing <slug> and no active change\n'); process.exit(2); }
     // Real gate (Pilar C): every sensor a task declared must be green in evidencia.json.
     const gate = (dir) => {
+      // G0: um scaffold nunca preenchido não é uma mudança concluída — arquivar geraria um
+      // ADR falso. Bloqueia antes de qualquer outro check (o --force ainda escapa, mas a
+      // regra injetada proíbe o agente de usá-lo sem o usuário pedir).
+      const placeholders = scaffoldPlaceholders(dir);
+      if (placeholders.length && !rest.includes('--force')) {
+        return { ok: false, failing: [`scaffold não preenchido (${placeholders.join('; ')}) — preencha proposta/design/tarefas com o design e o plano antes de arquivar`] };
+      }
       let tarefasMd = '';
       try { tarefasMd = readFileSync(join(dir, 'tarefas.md'), 'utf8'); } catch { /* no tasks */ }
       const tasks = parseTasks(tarefasMd);
@@ -163,6 +171,15 @@ export function runChange(argv) {
         return { ok: false, failing: [`${open.length} tarefa(s) aberta(s) (ex.: ${open[0].id} ${open[0].text}) — conclua ou use --force`] };
       }
       const required = requiredSensors(tasks);
+      // Evidence freshness: block if tarefas.md changed since verify sealed the evidence
+      // (e.g. a sensor task added/edited after the last green verify).
+      if (required.length) {
+        let evHash = '';
+        try { evHash = readFileSync(join(dir, '.evidence-hash'), 'utf8').trim(); } catch { /* pre-seal evidence */ }
+        if (evHash && evHash !== tasksHashOf(tarefasMd)) {
+          return { ok: false, failing: ['evidência stale (tarefas.md mudou desde o último verify) — rode `wendkeep verify` de novo'] };
+        }
+      }
       const reqIds = [...new Set(tasks.map((t) => t.req).filter(Boolean))];
       let evidence = [];
       try { evidence = JSON.parse(readFileSync(join(dir, 'evidencia.json'), 'utf8')); } catch { /* no evidence */ }

package/src/init.mjs

@@ -104,8 +104,17 @@ export function mergeSettings(existing, { vaultPath, withMcp, force, companions
   for (const h of allSpecs) {
     const command = h.command ?? hookCommand(h.name);
     const groups = Array.isArray(s.hooks[h.event]) ? [...s.hooks[h.event]] : [];
-    const present = groups.some((g) => (g.hooks || []).some((x) => x.command === command));
-    if (present && !force) {
+    const owning = groups.find((g) => (g.hooks || []).some((x) => x.command === command));
+    if (owning) {
+      // Already wired: never add a duplicate group (the old `if (present && !force)` fell through
+      // under --force and appended a second identical group). Under --force, refresh the managed
+      // entry's fields in place — without disturbing any sibling hooks the user grouped with it.
+      if (force) {
+        const hk = owning.hooks.find((x) => x.command === command);
+        hk.timeout = h.timeout;
+        if (h.statusMessage) hk.statusMessage = h.statusMessage;
+        if (h.matcher && (owning.hooks || []).length === 1) owning.matcher = h.matcher;
+      }
       s.hooks[h.event] = groups;
       continue;
     }

package/src/verify.mjs

@@ -38,6 +38,9 @@ export function runVerify(argv) {
   const sensors = loadSensors(projectRoot);
   const evidence = runSensors(sensors, ids, { cwd: projectRoot });
   writeFileSync(join(changeDir, 'evidencia.json'), `${JSON.stringify(evidence, null, 2)}\n`, 'utf8');
+  // Freshness seal: bind this evidence to the tarefas.md it was produced against, so the archive
+  // gate can reject evidence gone stale (a sensor task added after this verify run).
+  writeFileSync(join(changeDir, '.evidence-hash'), tasksHashOf(tarefas), 'utf8');
 
   // Mutation survivors -> fix tasks (Wave B), bounded at 3 rounds then escalate. A surviving
   // mutant always fails verify (exit 1): the suite does not discriminate yet. A clean report