wendkeep 0.76.5 → 0.76.6

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.76.6] — 2026-08-22
+
+### Fixed
+
+- **Task lease causal.** `operating_profile_task` passa a pertencer ao `active_contexts` da
+  worktree/work session; rotas temporárias irmãs não se sobrescrevem nem ampliam autorização.
+- **CLI e hooks escopados.** `profile route/status`, os hooks de operating profile e o consumo no
+  Stop resolvem a lease do chamador e preservam o sibling byte a byte por revision/CAS.
+- **Fallback legado fail-closed.** Vault sem registry contextual conserva a lease na sessão;
+  depois da inicialização, uma lease global não é copiada nem aplicada sem identidade provada.
+
 ## [0.76.5] — 2026-08-22
 
 ### Added

package/README.en.md

@@ -343,6 +343,11 @@ selects the caller explicitly. `CURRENT_DELIVERY` is only a derived projection w
 single, unambiguous context; hooks consult only the causal delivery, and an ID from another context
 fails with `WENDKEEP_DELIVERY_CONTEXT_MISMATCH`.
 
+`operating_profile_task` belongs to the causal work session's active context. `profile route` and
+`profile status --session <id>`, hooks, and Stop read/consume only that lease; a temporary route
+never crosses into a sibling. Legacy session fallback exists only without `active_contexts`;
+an initialized registry never copies a global authorization without proven identity.
+
 ```bash
 npx wendkeep delivery start release-0-74-0 --allow git:merge --allow git:push --allow publish --source-change <slug> --source-commit <sha> --session <id>
 npx wendkeep delivery status release-0-74-0 --session <id>

package/README.md

@@ -343,6 +343,11 @@ selects the caller explicitly. `CURRENT_DELIVERY` is only a derived projection w
 single, unambiguous context; hooks consult only the causal delivery, and an ID from another context
 fails with `WENDKEEP_DELIVERY_CONTEXT_MISMATCH`.
 
+`operating_profile_task` belongs to the causal work session's active context. `profile route` and
+`profile status --session <id>`, hooks, and Stop read/consume only that lease; a temporary route
+never crosses into a sibling. Legacy session fallback exists only without `active_contexts`;
+an initialized registry never copies a global authorization without proven identity.
+
 ```bash
 npx wendkeep delivery start release-0-74-0 --allow git:merge --allow git:push --allow publish --source-change <slug> --source-commit <sha> --session <id>
 npx wendkeep delivery status release-0-74-0 --session <id>

package/docs/en/commands/operating-profiles.md

@@ -130,6 +130,12 @@ ownership to the native LLM harness.
   session identity.
 - `profile route` requires `--session` and `--reason`, accepts only the four adaptive profiles,
   and records lease id, reason, turn/sequence, and timestamp without touching persistent profiles.
+- `operating_profile_task` belongs to the causal session/work session's active context. `profile route`
+  creates and `profile status --session <id>` reads only that lease; hooks use the same caller
+  context and an accepted Stop consumes it by `lease_id` with revision/CAS without changing a sibling.
+- Legacy fallback of the lease in the session exists only without `active_contexts`. With an
+  initialized registry, a global lease absent from the context is neither copied nor applied;
+  missing, ambiguous, or stale context fails closed without a partial mutation.
 - `.wendkeep.json` stays on `schemaVersion: 1`; the additive field is, for example,
   `"harness": { "profile": "GOVERN" }`. A legacy binding without it also resolves to `GOVERN`.
 - A corrupt binding never means `OFF`. When the payload or legacy integration identifies one

package/docs/pt-BR/commands/operating-profiles.md

@@ -131,6 +131,12 @@ harness nativo da LLM.
   projeto; com `--session`, grava override, origem e timestamp sem trocar a identidade da sessão.
 - `profile route` exige `--session` e `--reason`, aceita somente os quatro perfis adaptativos e
   grava `lease_id`, motivo, turno/sequência e timestamp sem tocar no perfil persistente.
+- `operating_profile_task` pertence ao active context da work session/sessão causal. `profile route`
+  cria e `profile status --session <id>` consulta somente essa lease; os hooks usam o mesmo contexto
+  do chamador e o Stop aceito consome por `lease_id` com revision/CAS, sem alterar o sibling.
+- O fallback legado de lease na sessão existe apenas sem `active_contexts`. Com o registry
+  inicializado, uma lease global ausente do contexto não é copiada nem aplicada; contexto
+  ausente, ambíguo ou stale falha fechado sem mutação parcial.
 - `.wendkeep.json` continua em `schemaVersion: 1`; o campo aditivo usa, por exemplo,
   `"harness": { "profile": "GOVERN" }`. Binding legado sem o campo também resolve `GOVERN`.
 - Binding corrompido nunca equivale a `OFF`. Quando o payload ou a integração legada identifica

package/hooks/active-context-store.mjs

@@ -139,6 +139,7 @@ export function mutateActiveContext(vaultBase, identity, updater, {
   expectedRevision,
   now = new Date().toISOString(),
   mutateRegistry = mutateSessionRegistry,
+  projectLegacy = true,
 } = {}) {
   const normalized = normalizeIdentity(identity);
   const key = activeContextKey(normalized);
@@ -191,8 +192,10 @@ export function mutateActiveContext(vaultBase, identity, updater, {
     registry.active_contexts = { ...contexts, [key]: next };
     return { key, context: structuredClone(next), registryRevision: registry.active_contexts_revision };
   });
-  projectLegacyActiveChange(vaultBase);
-  projectLegacyActiveDelivery(vaultBase);
+  if (projectLegacy) {
+    projectLegacyActiveChange(vaultBase);
+    projectLegacyActiveDelivery(vaultBase);
+  }
   return result;
 }
 

package/hooks/change-nag.mjs

@@ -15,11 +15,11 @@ import {
 } from './operating-profile-runtime.mjs';
 import { consumeSessionTaskOperatingProfile } from './operating-profile-task-store.mjs';
 
-export function nagDecision(input, vaultBase, { profile = 'GOVERN' } = {}) {
+export function nagDecision(input, vaultBase, { profile = 'GOVERN', context = null } = {}) {
   if (input && input.stop_hook_active) return null; // anti-loop: sempre primeiro
   const policy = hookProfilePolicy(profile);
   if (!policy.harness) return null;
-  const gate = quickGateState(vaultBase);
+  const gate = quickGateState(vaultBase, { context });
   if (!gate || !gate.openTasks) return null;
   const sid = input?.session_id || input?.sessionId || '';
   const sentinelId = profileSentinelId(sid, profile);
@@ -39,12 +39,16 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
       ? null
       : runtime.bindingError
         ? { decision: 'block', reason: profileRuntimeError(runtime.bindingError) }
-        : nagDecision(input, runtime.vaultBase, { profile: runtime.profile });
+        : nagDecision(input, runtime.vaultBase, {
+          profile: runtime.profile,
+          context: runtime.activeContext,
+        });
     if (!decision && runtime.taskLease?.state === 'active') {
       consumeSessionTaskOperatingProfile(
         runtime.vaultBase,
         runtime.identity?.canonicalConversationId || input?.session_id || input?.sessionId || '',
         runtime.taskLease.lease_id,
+        { context: runtime.activeContext },
       );
     }
     writeHookOutput(decision || {});

package/hooks/operating-profile-runtime.mjs

@@ -11,6 +11,8 @@ import {
 import { findProjectBinding, resolveProjectVault } from '../src/project-vault.mjs';
 import { readSessionRegistry } from './obsidian-common.mjs';
 import { resolveSessionIdentity } from './session-identity.mjs';
+import { resolveCommandActiveContext } from '../src/active-context-runtime.mjs';
+import { sessionTaskOperatingProfile } from './operating-profile-task-store.mjs';
 
 function bindingDiagnostic(error, configPath = '') {
   return {
@@ -152,9 +154,26 @@ export function resolveHookOperatingProfile({
   const entry = identity.state === 'resolved'
     ? readSessionRegistry(vaultResolution.base).sessions?.[identity.canonicalConversationId] || null
     : null;
+  let activeContext = null;
+  let contextError = null;
+  if (!bindingError && identity.state === 'resolved') {
+    try {
+      activeContext = resolveCommandActiveContext({
+        vaultBase: vaultResolution.base,
+        projectRoot: input?.cwd || vaultResolution.projectRoot || process.cwd(),
+        sessionId: identity.canonicalConversationId,
+      });
+    } catch (error) {
+      contextError = bindingDiagnostic(error);
+    }
+  }
   const base = sessionOverride(entry) || project;
   const taskLease = evaluateTaskOperatingProfileLease(
-    entry?.operating_profile_task,
+    contextError ? null : sessionTaskOperatingProfile(
+      vaultResolution.base,
+      identity.canonicalConversationId || '',
+      { context: activeContext },
+    ),
     taskLeaseContext(entry, input, identity.canonicalConversationId || ''),
   );
   const selected = taskLease.state === 'active'
@@ -176,6 +195,8 @@ export function resolveHookOperatingProfile({
     baseProfile: base.profile,
     baseSource: base.source,
     taskLease,
+    activeContext,
+    ...(contextError ? { contextError } : {}),
     resolution: vaultResolution,
     ...(bindingError ? { bindingError } : {}),
   };

package/hooks/operating-profile-task-store.mjs

@@ -3,7 +3,8 @@ import { randomUUID } from 'node:crypto';
 import {
   createTaskOperatingProfileLease,
 } from '../src/operating-profile.mjs';
-import { mutateSessionRegistry } from './obsidian-common.mjs';
+import { mutateSessionRegistry, readSessionRegistry } from './obsidian-common.mjs';
+import { mutateActiveContext, resolveActiveContext } from './active-context-store.mjs';
 
 function isoTimestamp(now) {
   if (typeof now === 'string') return now;
@@ -17,33 +18,93 @@ function missingSessionError(sessionId) {
   return error;
 }
 
+function activeContextRequiredError() {
+  const error = new Error('active context causal é obrigatório quando o registry contextual está inicializado');
+  error.code = 'WENDKEEP_ACTIVE_CONTEXT_REQUIRED';
+  return error;
+}
+
+function hasActiveContextRegistry(registry) {
+  return Boolean(registry && (
+    Object.hasOwn(registry, 'active_contexts')
+    || Object.hasOwn(registry, 'active_contexts_schema')
+    || Object.hasOwn(registry, 'active_contexts_revision')
+  ));
+}
+
+function leaseFromSession(current, profile, { reason, leaseId, issuedAt, sessionId }) {
+  const turnId = typeof current.last_prompt_turn_id === 'string'
+    ? current.last_prompt_turn_id.trim()
+    : '';
+  const hasRegisteredTurn = Boolean(
+    turnId
+    && current.turn_sequences
+    && Object.hasOwn(current.turn_sequences, turnId)
+    && current.turn_sequences[turnId] === current.last_turn_sequence
+  );
+  return createTaskOperatingProfileLease({
+    profile,
+    reason,
+    sessionId,
+    turnId,
+    turnSequence: hasRegisteredTurn ? current.last_turn_sequence : undefined,
+    leaseId,
+    issuedAt,
+  });
+}
+
+export function sessionTaskOperatingProfile(vaultBase, sessionId, { context = null } = {}) {
+  if (context) {
+    try { return resolveActiveContext(vaultBase, context).operating_profile_task || null; }
+    catch (error) {
+      if (error?.code === 'WENDKEEP_ACTIVE_CONTEXT_NOT_FOUND') {
+        const registry = readSessionRegistry(vaultBase);
+        if (hasActiveContextRegistry(registry)) return null;
+        return registry.sessions?.[sessionId]?.operating_profile_task || null;
+      }
+      throw error;
+    }
+  }
+  const registry = readSessionRegistry(vaultBase);
+  if (hasActiveContextRegistry(registry)) return null;
+  return registry.sessions?.[sessionId]?.operating_profile_task || null;
+}
+
 export function setSessionTaskOperatingProfile(vaultBase, sessionId, profile, {
   reason,
   leaseId = randomUUID(),
   now,
+  context = null,
+  mutateContext = mutateActiveContext,
 } = {}) {
   const issuedAt = isoTimestamp(now);
+  if (context) {
+    let lease;
+    mutateContext(vaultBase, context, (active) => ({
+      ...active,
+      operating_profile_task: lease,
+      state: 'active',
+    }), {
+      now: issuedAt,
+      projectLegacy: false,
+      mutateRegistry: (base, mutator) => mutateSessionRegistry(base, (registry) => {
+        const sessions = registry.sessions || (registry.sessions = {});
+        if (!Object.hasOwn(sessions, sessionId)) throw missingSessionError(sessionId);
+        lease = leaseFromSession(sessions[sessionId], profile, {
+          reason, leaseId, issuedAt, sessionId,
+        });
+        return mutator(registry);
+      }),
+    });
+    return lease;
+  }
   return mutateSessionRegistry(vaultBase, (registry) => {
+    if (hasActiveContextRegistry(registry)) throw activeContextRequiredError();
     const sessions = registry.sessions || (registry.sessions = {});
     if (!Object.hasOwn(sessions, sessionId)) throw missingSessionError(sessionId);
     const current = sessions[sessionId];
-    const turnId = typeof current.last_prompt_turn_id === 'string'
-      ? current.last_prompt_turn_id.trim()
-      : '';
-    const hasRegisteredTurn = Boolean(
-      turnId
-      && current.turn_sequences
-      && Object.hasOwn(current.turn_sequences, turnId)
-      && current.turn_sequences[turnId] === current.last_turn_sequence
-    );
-    const lease = createTaskOperatingProfileLease({
-      profile,
-      reason,
-      sessionId,
-      turnId,
-      turnSequence: hasRegisteredTurn ? current.last_turn_sequence : undefined,
-      leaseId,
-      issuedAt,
+    const lease = leaseFromSession(current, profile, {
+      reason, leaseId, issuedAt, sessionId,
     });
     sessions[sessionId] = {
       ...current,
@@ -56,10 +117,53 @@ export function setSessionTaskOperatingProfile(vaultBase, sessionId, profile, {
 
 export function consumeSessionTaskOperatingProfile(vaultBase, sessionId, leaseId, {
   now,
+  context = null,
+  mutateContext = mutateActiveContext,
 } = {}) {
   if (!sessionId || !leaseId) return false;
   const consumedAt = isoTimestamp(now);
+  if (context) {
+    let current;
+    try { current = resolveActiveContext(vaultBase, context); }
+    catch (error) {
+      if (error?.code !== 'WENDKEEP_ACTIVE_CONTEXT_NOT_FOUND') throw error;
+      const registry = readSessionRegistry(vaultBase);
+      if (hasActiveContextRegistry(registry)) return false;
+      return consumeSessionTaskOperatingProfile(vaultBase, sessionId, leaseId, {
+        now: consumedAt,
+      });
+    }
+    const lease = current.operating_profile_task;
+    if (!lease || lease.state !== 'active' || lease.lease_id !== leaseId) return false;
+    let consumed = false;
+    try {
+      mutateContext(vaultBase, context, (active) => {
+        const activeLease = active.operating_profile_task;
+        if (!activeLease || activeLease.state !== 'active' || activeLease.lease_id !== leaseId) {
+          return active;
+        }
+        consumed = true;
+        return {
+          ...active,
+          operating_profile_task: {
+            ...activeLease,
+            state: 'consumed',
+            consumed_at: consumedAt,
+          },
+        };
+      }, {
+        expectedRevision: current.revision,
+        now: consumedAt,
+        projectLegacy: false,
+      });
+    } catch (error) {
+      if (error?.code === 'WENDKEEP_ACTIVE_CONTEXT_STALE') return false;
+      throw error;
+    }
+    return consumed;
+  }
   return mutateSessionRegistry(vaultBase, (registry) => {
+    if (hasActiveContextRegistry(registry)) throw activeContextRequiredError();
     const current = registry.sessions?.[sessionId];
     const lease = current?.operating_profile_task;
     if (!lease || lease.state !== 'active' || lease.lease_id !== leaseId) return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.76.5",
+  "version": "0.76.6",
   "description": "Vault-first persistent memory for AI coding agents, with an optional profile-aware governance runtime: OFF, FLOW, GUIDE, GOVERN, or ASSURE. Local-first and agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "workspaces": [

package/src/profile.mjs

@@ -8,7 +8,11 @@ import {
   resolveOperatingProfile,
   setOperatingProfile,
 } from './operating-profile.mjs';
-import { setSessionTaskOperatingProfile } from '../hooks/operating-profile-task-store.mjs';
+import {
+  sessionTaskOperatingProfile,
+  setSessionTaskOperatingProfile,
+} from '../hooks/operating-profile-task-store.mjs';
+import { resolveCommandActiveContext } from './active-context-runtime.mjs';
 import { resolve } from 'node:path';
 import { findProjectBinding, resolveProjectVault, updateProjectBinding } from './project-vault.mjs';
 
@@ -163,12 +167,13 @@ function sessionProfile(vaultBase, sessionId, projectResolved) {
   return sessionBaseProfile(sessions[sessionId], projectResolved);
 }
 
-function sessionProfileStatus(vaultBase, sessionId, projectResolved) {
+function sessionProfileStatus(vaultBase, sessionId, projectResolved, { context = null } = {}) {
   const sessions = readSessionRegistry(vaultBase).sessions || {};
   if (!Object.hasOwn(sessions, sessionId)) throw new Error(`sessão não encontrada: ${sessionId}`);
   const entry = sessions[sessionId];
   const base = sessionBaseProfile(entry, projectResolved);
-  const taskLease = evaluateTaskOperatingProfileLease(entry.operating_profile_task, {
+  const taskLease = evaluateTaskOperatingProfileLease(
+    sessionTaskOperatingProfile(vaultBase, sessionId, { context }), {
     sessionId,
     turnId: entry.last_prompt_turn_id || '',
     turnSequence: entry.last_turn_sequence,
@@ -183,6 +188,15 @@ function sessionProfileStatus(vaultBase, sessionId, projectResolved) {
   };
 }
 
+function commandActiveContext(state, sessionId) {
+  if (!sessionId || state.resolved.bindingError) return null;
+  return resolveCommandActiveContext({
+    vaultBase: state.vaultBase,
+    projectRoot: state.resolved.projectRoot || process.cwd(),
+    sessionId,
+  });
+}
+
 function sessionOutputPayload(effective, sessionId) {
   return {
     profile: effective.profile,
@@ -213,8 +227,9 @@ export function runProfile(argv = []) {
   if (sub === 'status' || sub === 'show') {
     if (args.length > 1) return fail(`${sub} não aceita argumentos posicionais adicionais`);
     try {
+      const activeContext = sessionId ? commandActiveContext(state, sessionId) : null;
       const effective = sessionId
-        ? sessionProfileStatus(state.vaultBase, sessionId, projectResolved)
+        ? sessionProfileStatus(state.vaultBase, sessionId, projectResolved, { context: activeContext })
         : { profile: projectResolved.profile, source: projectResolved.source, scope: 'project' };
       output({
         ...(sessionId ? sessionOutputPayload(effective, sessionId) : {
@@ -235,11 +250,12 @@ export function runProfile(argv = []) {
     if (!reason) return fail('route requer --reason <text>');
     try {
       const base = sessionProfile(state.vaultBase, sessionId, projectResolved);
+      const activeContext = commandActiveContext(state, sessionId);
       const lease = setSessionTaskOperatingProfile(
         state.vaultBase,
         sessionId,
         args[1],
-        { reason },
+        { reason, context: activeContext },
       );
       output({
         profile: lease.profile,