wendkeep 0.76.5 → 0.76.7

package/CHANGELOG.md

@@ -4,6 +4,32 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.76.7] — 2026-08-22
+
+### Fixed
+
+- **Handoff causal no Stop.** Com `active_contexts` inicializado, work session, repository,
+  worktree, branch e change vêm do contexto chamador; payload divergente falha antes de CAS,
+  nota, outbox ou ledger e não publica estado parcial.
+- **Evidência da change correta.** O lifecycle coleta verdict, sensores e ADR apenas da change do
+  active context causal, sem reutilizar `change_slug` legado ou link global de uma sessão irmã.
+- **Recall automático escopado.** `UserPromptSubmit` permanece somente leitura, sem migrar pointer
+  ou registry; exclui evidência de sessão/change irmã ativa e preserva material global/histórico.
+  `/brain-recall` explícito segue global.
+- **Compatibilidade conservadora.** O comportamento anterior permanece somente quando o registry
+  ainda não possui nenhum campo do store contextual, inclusive quando `active_contexts` está vazio.
+
+## [0.76.6] — 2026-08-22
+
+### Fixed
+
+- **Task lease causal.** `operating_profile_task` passa a pertencer ao `active_contexts` da
+  worktree/work session; rotas temporárias irmãs não se sobrescrevem nem ampliam autorização.
+- **CLI e hooks escopados.** `profile route/status`, os hooks de operating profile e o consumo no
+  Stop resolvem a lease do chamador e preservam o sibling byte a byte por revision/CAS.
+- **Fallback legado fail-closed.** Vault sem registry contextual conserva a lease na sessão;
+  depois da inicialização, uma lease global não é copiada nem aplicada sem identidade provada.
+
 ## [0.76.5] — 2026-08-22
 
 ### Added

package/README.en.md

@@ -343,6 +343,11 @@ selects the caller explicitly. `CURRENT_DELIVERY` is only a derived projection w
 single, unambiguous context; hooks consult only the causal delivery, and an ID from another context
 fails with `WENDKEEP_DELIVERY_CONTEXT_MISMATCH`.
 
+`operating_profile_task` belongs to the causal work session's active context. `profile route` and
+`profile status --session <id>`, hooks, and Stop read/consume only that lease; a temporary route
+never crosses into a sibling. Legacy session fallback exists only without `active_contexts`;
+an initialized registry never copies a global authorization without proven identity.
+
 ```bash
 npx wendkeep delivery start release-0-74-0 --allow git:merge --allow git:push --allow publish --source-change <slug> --source-commit <sha> --session <id>
 npx wendkeep delivery status release-0-74-0 --session <id>
@@ -381,8 +386,8 @@ Hot memory now separates human authorship, operational state, and evidence:
 - **`SHARED_MEMORY.md` is bounded generated operational state.** The `Stop` hook turns the session handoff into sanitized events; the projector deterministically reduces the ledger and publishes a verifiable revision, cursor, and hash. Admission prioritizes critical operational state and never publishes beyond 48 lines/6 KiB; omitted events remain in the append-only authority and surface only as verifiable counts. Facts are `verified` only with local evidence; unsupported reports remain `reported`, and disagreements become candidates for human judgment.
 - **`MEMORY_EVENTS.jsonl` is the append-only authority.** `Stop` makes events durable in the outbox before acknowledging the attempt; the projector runs outside the registry lock and retries reuse the same IDs. Repeating an identical `event_id`/payload is a no-op; reusing the ID with different bytes is observable corruption.
 - **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event; promotion preserves the selected event's JSON type, session, activation/epoch, and source turn.
-- **Registers are scoped.** `git.local-head`, handoffs, verdicts, and change status carry project, work-session, change, branch, or worktree scope. Two branches do not create a global conflict; only events in the same scope and causal lineage may advance automatically.
-- **`EVIDENCE_INDEX.jsonl` is local recall.** Markdown is chunked by headings and blocks without requiring the Observer. Ranking combines BM25, exact phrases, field weights, authority, validity, bounded recency, and source diversity; `UserPromptSubmit` injects only relevant passages with provenance.
+- **Registers are scoped.** `git.local-head`, handoffs, verdicts, and change status carry project, work-session, change, branch, or worktree scope. Two branches do not create a global conflict; only events in the same scope and causal lineage may advance automatically. Once `active_contexts` is initialized, `Stop` derives `work_session_id`, `repository_id`, `worktree_id`, branch, and change from the causal active context; a divergent handoff fails before CAS, note, outbox, or ledger mutation. Legacy compatibility exists only without the contextual store.
+- **`EVIDENCE_INDEX.jsonl` is local recall.** Markdown is chunked by headings and blocks without requiring the Observer. Ranking combines BM25, exact phrases, field weights, authority, validity, bounded recency, and source diversity. The automatic `UserPromptSubmit` hook is read-only: it never migrates `CURRENT_CHANGE.md` or mutates the registry; it excludes passages owned by an active sibling session or change while preserving global and historical evidence. Explicit `/brain-recall` remains global.
 
 Artifacts stay under `.brain/` only. Sanitization strips secrets, tokens, local paths, transcripts, and harness payloads both before persistence and before injection. Events carry a `project_id`, and one vault never accepts another project's events.
 

package/README.md

@@ -343,6 +343,11 @@ selects the caller explicitly. `CURRENT_DELIVERY` is only a derived projection w
 single, unambiguous context; hooks consult only the causal delivery, and an ID from another context
 fails with `WENDKEEP_DELIVERY_CONTEXT_MISMATCH`.
 
+`operating_profile_task` belongs to the causal work session's active context. `profile route` and
+`profile status --session <id>`, hooks, and Stop read/consume only that lease; a temporary route
+never crosses into a sibling. Legacy session fallback exists only without `active_contexts`;
+an initialized registry never copies a global authorization without proven identity.
+
 ```bash
 npx wendkeep delivery start release-0-74-0 --allow git:merge --allow git:push --allow publish --source-change <slug> --source-commit <sha> --session <id>
 npx wendkeep delivery status release-0-74-0 --session <id>
@@ -381,8 +386,8 @@ Hot memory now separates human authorship, operational state, and evidence:
 - **`SHARED_MEMORY.md` is bounded generated operational state.** The `Stop` hook turns the session handoff into sanitized events; the projector deterministically reduces the ledger and publishes a verifiable revision, cursor, and hash. Admission prioritizes critical operational state and never publishes beyond 48 lines/6 KiB; omitted events remain in the append-only authority and surface only as verifiable counts. Facts are `verified` only with local evidence; unsupported reports remain `reported`, and disagreements become candidates for human judgment.
 - **`MEMORY_EVENTS.jsonl` is the append-only authority.** `Stop` makes events durable in the outbox before acknowledging the attempt; the projector runs outside the registry lock and retries reuse the same IDs. Repeating an identical `event_id`/payload is a no-op; reusing the ID with different bytes is observable corruption.
 - **`MEMORY_CANDIDATES.jsonl` is the curation queue.** Conflicts and legacy content are never silently promoted. `promote` and `reject` record the decision as a new event; promotion preserves the selected event's JSON type, session, activation/epoch, and source turn.
-- **Registers are scoped.** `git.local-head`, handoffs, verdicts, and change status carry project, work-session, change, branch, or worktree scope. Two branches do not create a global conflict; only events in the same scope and causal lineage may advance automatically.
-- **`EVIDENCE_INDEX.jsonl` is local recall.** Markdown is chunked by headings and blocks without requiring the Observer. Ranking combines BM25, exact phrases, field weights, authority, validity, bounded recency, and source diversity; `UserPromptSubmit` injects only relevant passages with provenance.
+- **Registers are scoped.** `git.local-head`, handoffs, verdicts, and change status carry project, work-session, change, branch, or worktree scope. Two branches do not create a global conflict; only events in the same scope and causal lineage may advance automatically. Once `active_contexts` is initialized, `Stop` derives `work_session_id`, `repository_id`, `worktree_id`, branch, and change from the causal active context; a divergent handoff fails before CAS, note, outbox, or ledger mutation. Legacy compatibility exists only without the contextual store.
+- **`EVIDENCE_INDEX.jsonl` is local recall.** Markdown is chunked by headings and blocks without requiring the Observer. Ranking combines BM25, exact phrases, field weights, authority, validity, bounded recency, and source diversity. The automatic `UserPromptSubmit` hook is read-only: it never migrates `CURRENT_CHANGE.md` or mutates the registry; it excludes passages owned by an active sibling session or change while preserving global and historical evidence. Explicit `/brain-recall` remains global.
 
 Artifacts stay under `.brain/` only. Sanitization strips secrets, tokens, local paths, transcripts, and harness payloads both before persistence and before injection. Events carry a `project_id`, and one vault never accepts another project's events.
 

package/docs/en/commands/memory.md

@@ -115,10 +115,17 @@ npx wendkeep validate-memory --vault <v2-vault>
   `change.<slug>.status` compete only inside the same scope. Automatic resolution still requires
   the same project and causal lineage; incompatible decisions, constraints, and blockers remain
   human-curated. An ambiguous key is omitted from SHARED without removing CORE or independent keys.
+  Once `active_contexts` is initialized, `Stop` derives `work_session_id`, `repository_id`,
+  `worktree_id`, branch, and `change_slug` from the causal active context. A divergent handoff
+  identity fails before CAS, note, outbox, or ledger mutation; legacy fallback exists only without
+  the contextual store.
 - `.brain/EVIDENCE_INDEX.jsonl` chunks documents by heading and block and records file, heading,
   type, change, session, work session, authority, date, validity, and hash. `/brain-recall` and the
   `UserPromptSubmit` hook use BM25, exact phrase, field weights, authority, validity, bounded
-  recency, and diversity to return the matching passage with provenance.
+  recency, and diversity to return the matching passage with provenance. Automatic recall is
+  read-only: it never migrates `CURRENT_CHANGE.md` or mutates the registry; it excludes rows owned
+  by an active sibling session or change while preserving global or historical rows with no active
+  owner. Explicit `/brain-recall` remains global.
 - Every memory path validates the physical topology of `.brain`, ledger, outbox, CORE, SHARED,
   candidates, registry, notes, backups, temporary files, and sidecars before reading or writing.
   Junctions, symlinks, reparse points, or hardlinks fail closed without touching external bytes.

package/docs/en/commands/operating-profiles.md

@@ -130,6 +130,12 @@ ownership to the native LLM harness.
   session identity.
 - `profile route` requires `--session` and `--reason`, accepts only the four adaptive profiles,
   and records lease id, reason, turn/sequence, and timestamp without touching persistent profiles.
+- `operating_profile_task` belongs to the causal session/work session's active context. `profile route`
+  creates and `profile status --session <id>` reads only that lease; hooks use the same caller
+  context and an accepted Stop consumes it by `lease_id` with revision/CAS without changing a sibling.
+- Legacy fallback of the lease in the session exists only without `active_contexts`. With an
+  initialized registry, a global lease absent from the context is neither copied nor applied;
+  missing, ambiguous, or stale context fails closed without a partial mutation.
 - `.wendkeep.json` stays on `schemaVersion: 1`; the additive field is, for example,
   `"harness": { "profile": "GOVERN" }`. A legacy binding without it also resolves to `GOVERN`.
 - A corrupt binding never means `OFF`. When the payload or legacy integration identifies one

package/docs/pt-BR/commands/memory.md

@@ -114,11 +114,17 @@ npx wendkeep validate-memory --vault <cofre-v2>
 - Registradores como `git.local-head`, `handoff.latest`, `quality.latest-*` e
   `change.<slug>.status` só competem dentro do mesmo escopo. Resolução automática ainda exige o
   mesmo projeto e linhagem causal; decisões, constraints e blockers incompatíveis permanecem sob
-  curadoria. Uma chave ambígua é omitida de SHARED sem remover CORE ou chaves independentes.
+  curadoria. Uma chave ambígua é omitida de SHARED sem remover CORE ou chaves independentes. Com
+  `active_contexts` inicializado, o `Stop` deriva `work_session_id`, `repository_id`, `worktree_id`,
+  branch e `change_slug` do active context causal. Identidade divergente no handoff falha antes de
+  CAS, nota, outbox ou ledger; o fallback legado só existe sem o store contextual.
 - `.brain/EVIDENCE_INDEX.jsonl` divide documentos por headings e blocos e registra arquivo,
   heading, tipo, change, sessão, work session, autoridade, data, validade e hash. `/brain-recall`
   e o hook `UserPromptSubmit` usam BM25, frase exata, pesos por campo, autoridade, validade,
-  recência limitada e diversidade para retornar o trecho do match com proveniência.
+  recência limitada e diversidade para retornar o trecho do match com proveniência. No recall
+  automático, o hook é somente leitura: não migra `CURRENT_CHANGE.md` nem altera o registry;
+  exclui linhas pertencentes a sessão ou change irmã ativa e preserva linhas globais ou históricas
+  sem owner ativo. `/brain-recall` explícito permanece global.
 - Toda rota de memória valida a topologia física de `.brain`, ledger, outbox, CORE, SHARED,
   candidates, registry, notas, backups, temporários e sidecars antes de ler ou escrever. Junction,
   symlink, reparse point ou hardlink falham fechados sem tocar bytes externos. Locks publicam owner

package/docs/pt-BR/commands/operating-profiles.md

@@ -131,6 +131,12 @@ harness nativo da LLM.
   projeto; com `--session`, grava override, origem e timestamp sem trocar a identidade da sessão.
 - `profile route` exige `--session` e `--reason`, aceita somente os quatro perfis adaptativos e
   grava `lease_id`, motivo, turno/sequência e timestamp sem tocar no perfil persistente.
+- `operating_profile_task` pertence ao active context da work session/sessão causal. `profile route`
+  cria e `profile status --session <id>` consulta somente essa lease; os hooks usam o mesmo contexto
+  do chamador e o Stop aceito consome por `lease_id` com revision/CAS, sem alterar o sibling.
+- O fallback legado de lease na sessão existe apenas sem `active_contexts`. Com o registry
+  inicializado, uma lease global ausente do contexto não é copiada nem aplicada; contexto
+  ausente, ambíguo ou stale falha fechado sem mutação parcial.
 - `.wendkeep.json` continua em `schemaVersion: 1`; o campo aditivo usa, por exemplo,
   `"harness": { "profile": "GOVERN" }`. Binding legado sem o campo também resolve `GOVERN`.
 - Binding corrompido nunca equivale a `OFF`. Quando o payload ou a integração legada identifica

package/hooks/active-context-handoff-evidence.mjs

@@ -0,0 +1,196 @@
+import { readSessionRegistry } from './obsidian-common.mjs';
+import { resolveActiveContext } from './active-context-store.mjs';
+import { resolveRuntimeActiveContext } from '../src/active-context-runtime.mjs';
+
+const IDENTITY_FIELDS = Object.freeze([
+  ['work_session_id', 'workSessionId'],
+  ['repository_id', 'repositoryId'],
+  ['worktree_id', 'worktreeId'],
+  ['branch', 'branch'],
+  ['change_slug', 'changeSlug'],
+]);
+
+function contextError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function text(value) {
+  return String(value ?? '').trim();
+}
+
+function contextsOf(registry) {
+  return registry?.active_contexts && typeof registry.active_contexts === 'object'
+    && !Array.isArray(registry.active_contexts)
+    ? registry.active_contexts : {};
+}
+
+export function activeContextRegistryInitialized(registry = {}) {
+  return Object.hasOwn(registry, 'active_contexts')
+    || Object.hasOwn(registry, 'active_contexts_schema')
+    || Object.hasOwn(registry, 'active_contexts_revision');
+}
+
+function assertAuthority(identity, context) {
+  if (!identity || !context || context.state !== 'active') {
+    throw contextError(
+      'WENDKEEP_ACTIVE_CONTEXT_NOT_FOUND',
+      'active context causal não foi resolvido antes do Stop',
+    );
+  }
+  for (const [contextField, identityField] of [
+    ['project_id', 'projectId'],
+    ['repository_id', 'repositoryId'],
+    ['worktree_id', 'worktreeId'],
+    ['work_session_id', 'workSessionId'],
+  ]) {
+    if (!text(context[contextField]) || text(context[contextField]) !== text(identity[identityField])) {
+      throw contextError(
+        'WENDKEEP_ACTIVE_CONTEXT_IDENTITY_MISMATCH',
+        `${contextField} do active context não corresponde à sessão causal`,
+      );
+    }
+  }
+  if (!text(context.branch) || text(context.branch) !== text(identity.branch)) {
+    throw contextError(
+      'WENDKEEP_ACTIVE_CONTEXT_IDENTITY_MISMATCH',
+      'branch do active context não corresponde à sessão causal',
+    );
+  }
+}
+
+export function resolveHandoffEvidenceAuthority(vaultBase, {
+  input = {},
+  sessionId = '',
+  projectRoot = input.cwd || process.cwd(),
+  registry = readSessionRegistry(vaultBase),
+  resolveCommand = resolveRuntimeActiveContext,
+  resolveContext = resolveActiveContext,
+} = {}) {
+  if (!activeContextRegistryInitialized(registry)) {
+    return { mode: 'legacy', identity: null, context: null };
+  }
+  const identity = resolveCommand({
+    vaultBase,
+    projectRoot,
+    sessionId,
+  });
+  if (!identity) {
+    throw contextError(
+      'WENDKEEP_ACTIVE_CONTEXT_NOT_FOUND',
+      'registry contextual inicializado sem identidade causal para o Stop',
+    );
+  }
+  const context = resolveContext(vaultBase, { ...identity, sessionId });
+  assertAuthority(identity, context);
+  return { mode: 'contextual', identity, context };
+}
+
+export function resolveReadOnlyEvidenceActiveContext({
+  vaultBase,
+  projectRoot = process.cwd(),
+  sessionId = '',
+} = {}) {
+  const authority = resolveHandoffEvidenceAuthority(vaultBase, {
+    input: { cwd: projectRoot },
+    projectRoot,
+    sessionId,
+  });
+  return authority.mode === 'contextual' ? authority.identity : null;
+}
+
+function suppliedShared(input) {
+  const supplied = input?.shared || input?.handoff?.shared;
+  return supplied && typeof supplied === 'object' && !Array.isArray(supplied)
+    ? { ...supplied }
+    : {};
+}
+
+function suppliedIdentityValues(input, shared, snake, camel) {
+  const direct = input?.shared && typeof input.shared === 'object' && !Array.isArray(input.shared)
+    ? input.shared : {};
+  const nested = input?.handoff?.shared && typeof input.handoff.shared === 'object'
+    && !Array.isArray(input.handoff.shared)
+    ? input.handoff.shared : {};
+  return [
+    shared[snake], shared[camel],
+    direct[snake], direct[camel],
+    nested[snake], nested[camel],
+    input?.[snake], input?.[camel],
+  ]
+    .map(text)
+    .filter(Boolean);
+}
+
+export function buildCausalSharedHandoff({ input = {}, entry = {}, authority } = {}) {
+  const shared = suppliedShared(input);
+  if (authority?.mode !== 'contextual') {
+    const workSessionId = text(
+      shared.work_session_id
+      || shared.workSessionId
+      || input.work_session_id
+      || input.workSessionId
+      || entry?.work_session_id,
+    );
+    if (!shared.work_session_id && workSessionId) shared.work_session_id = workSessionId;
+    return Object.keys(shared).length ? shared : null;
+  }
+
+  assertAuthority(authority.identity, authority.context);
+  const expected = {
+    workSessionId: text(authority.identity.workSessionId),
+    repositoryId: text(authority.identity.repositoryId),
+    worktreeId: text(authority.identity.worktreeId),
+    branch: text(authority.identity.branch || authority.context.branch),
+    changeSlug: text(authority.context.change_slug),
+  };
+  for (const [snake, camel] of IDENTITY_FIELDS) {
+    const suppliedValues = suppliedIdentityValues(input, shared, snake, camel);
+    if (suppliedValues.some((supplied) => supplied !== expected[camel])) {
+      throw contextError(
+        'WENDKEEP_HANDOFF_CONTEXT_MISMATCH',
+        `${snake} do handoff não corresponde ao active context causal`,
+      );
+    }
+    delete shared[camel];
+    if (expected[camel]) shared[snake] = expected[camel];
+    else delete shared[snake];
+  }
+  return Object.keys(shared).length ? shared : null;
+}
+
+export function causalChangeSlug(entry = {}, authority = {}) {
+  return authority?.mode === 'contextual'
+    ? text(authority.context?.change_slug)
+    : text(entry?.change_slug);
+}
+
+export function scopeEvidenceRows(rows, { activeContext = null, registry = {} } = {}) {
+  if (!Array.isArray(rows) || !activeContextRegistryInitialized(registry)) return rows;
+
+  const callerWorkSession = text(activeContext?.workSessionId ?? activeContext?.work_session_id);
+  const sessions = registry.sessions || {};
+  const activeContexts = Object.values(contextsOf(registry))
+    .filter((context) => context?.state === 'active');
+  const activeChangeOwners = new Map();
+  for (const context of activeContexts) {
+    const slug = text(context.change_slug);
+    if (slug) activeChangeOwners.set(slug, text(context.work_session_id));
+  }
+
+  return rows.filter((row) => {
+    const sessionId = text(row?.session_id);
+    const rowWorkSession = text(row?.work_session_id)
+      || text(sessionId && sessions[sessionId]?.work_session_id);
+    if (sessionId && !rowWorkSession) return false;
+    if (rowWorkSession && rowWorkSession !== callerWorkSession) return false;
+    if (rowWorkSession && !callerWorkSession) return false;
+
+    const changeSlug = text(row?.change_slug);
+    const owner = activeChangeOwners.get(changeSlug) || '';
+    if (owner && owner !== callerWorkSession) return false;
+    if (owner && !callerWorkSession) return false;
+    return true;
+  });
+}

package/hooks/active-context-store.mjs

@@ -139,6 +139,7 @@ export function mutateActiveContext(vaultBase, identity, updater, {
   expectedRevision,
   now = new Date().toISOString(),
   mutateRegistry = mutateSessionRegistry,
+  projectLegacy = true,
 } = {}) {
   const normalized = normalizeIdentity(identity);
   const key = activeContextKey(normalized);
@@ -191,8 +192,10 @@ export function mutateActiveContext(vaultBase, identity, updater, {
     registry.active_contexts = { ...contexts, [key]: next };
     return { key, context: structuredClone(next), registryRevision: registry.active_contexts_revision };
   });
-  projectLegacyActiveChange(vaultBase);
-  projectLegacyActiveDelivery(vaultBase);
+  if (projectLegacy) {
+    projectLegacyActiveChange(vaultBase);
+    projectLegacyActiveDelivery(vaultBase);
+  }
   return result;
 }
 

package/hooks/change-nag.mjs

@@ -15,11 +15,11 @@ import {
 } from './operating-profile-runtime.mjs';
 import { consumeSessionTaskOperatingProfile } from './operating-profile-task-store.mjs';
 
-export function nagDecision(input, vaultBase, { profile = 'GOVERN' } = {}) {
+export function nagDecision(input, vaultBase, { profile = 'GOVERN', context = null } = {}) {
   if (input && input.stop_hook_active) return null; // anti-loop: sempre primeiro
   const policy = hookProfilePolicy(profile);
   if (!policy.harness) return null;
-  const gate = quickGateState(vaultBase);
+  const gate = quickGateState(vaultBase, { context });
   if (!gate || !gate.openTasks) return null;
   const sid = input?.session_id || input?.sessionId || '';
   const sentinelId = profileSentinelId(sid, profile);
@@ -39,12 +39,16 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
       ? null
       : runtime.bindingError
         ? { decision: 'block', reason: profileRuntimeError(runtime.bindingError) }
-        : nagDecision(input, runtime.vaultBase, { profile: runtime.profile });
+        : nagDecision(input, runtime.vaultBase, {
+          profile: runtime.profile,
+          context: runtime.activeContext,
+        });
     if (!decision && runtime.taskLease?.state === 'active') {
       consumeSessionTaskOperatingProfile(
         runtime.vaultBase,
         runtime.identity?.canonicalConversationId || input?.session_id || input?.sessionId || '',
         runtime.taskLease.lease_id,
+        { context: runtime.activeContext },
       );
     }
     writeHookOutput(decision || {});

package/hooks/evidence-context.mjs

@@ -1,21 +1,29 @@
 #!/usr/bin/env node
 // UserPromptSubmit: bounded, read-only retrieval from the local evidence index.
 import { pathToFileURL } from 'node:url';
-import { readHookInput, writeHookOutput } from './obsidian-common.mjs';
+import { readHookInput, readSessionRegistry, writeHookOutput } from './obsidian-common.mjs';
 import { loadEvidenceIndex, recallEvidence, renderEvidenceContext } from './evidence-recall.mjs';
 import { sanitizeMemoryText } from './memory-schema.mjs';
 import { resolveHookOperatingProfile } from './operating-profile-runtime.mjs';
+import {
+  resolveReadOnlyEvidenceActiveContext,
+  scopeEvidenceRows,
+} from './active-context-handoff-evidence.mjs';
 import { isBootstrapPrompt } from '../packages/integrations/src/prompt-content.mjs';
 
 export function buildPromptEvidenceContext(vaultBase, prompt, {
-  topK = 3, maxBytes = 3072, rows = null,
+  topK = 3, maxBytes = 3072, rows = null, activeContext = null, registry = null,
 } = {}) {
   const query = sanitizeMemoryText(String(prompt || '')).trim();
   if (!query || isBootstrapPrompt(query)) return '';
   const evidence = rows || loadEvidenceIndex(vaultBase);
-  if (!evidence.length) return '';
+  const scoped = scopeEvidenceRows(evidence, {
+    activeContext,
+    registry: registry || readSessionRegistry(vaultBase),
+  });
+  if (!scoped.length) return '';
   return sanitizeMemoryText(renderEvidenceContext(
-    recallEvidence(evidence, query, { topK }),
+    recallEvidence(scoped, query, { topK }),
     { maxBytes },
   ));
 }
@@ -23,13 +31,20 @@ export function buildPromptEvidenceContext(vaultBase, prompt, {
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   try {
     const input = readHookInput();
-    const runtime = resolveHookOperatingProfile({ input });
+    const runtime = resolveHookOperatingProfile({
+      input,
+      activeContextResolver: resolveReadOnlyEvidenceActiveContext,
+    });
     if (runtime.bindingError) {
       writeHookOutput({});
     } else {
       const context = buildPromptEvidenceContext(
         runtime.vaultBase,
         input.prompt || input.user_prompt || '',
+        {
+          activeContext: runtime.activeContext,
+          registry: readSessionRegistry(runtime.vaultBase),
+        },
       );
       writeHookOutput(context ? {
         hookSpecificOutput: { hookEventName: 'UserPromptSubmit', additionalContext: context },

package/hooks/operating-profile-runtime.mjs

@@ -11,6 +11,8 @@ import {
 import { findProjectBinding, resolveProjectVault } from '../src/project-vault.mjs';
 import { readSessionRegistry } from './obsidian-common.mjs';
 import { resolveSessionIdentity } from './session-identity.mjs';
+import { resolveCommandActiveContext } from '../src/active-context-runtime.mjs';
+import { sessionTaskOperatingProfile } from './operating-profile-task-store.mjs';
 
 function bindingDiagnostic(error, configPath = '') {
   return {
@@ -131,6 +133,7 @@ export function resolveHookOperatingProfile({
   resolution = null,
   config = null,
   provider,
+  activeContextResolver = resolveCommandActiveContext,
 } = {}) {
   const initialResolution = resolution || resolveProjectVault({ input });
   const matched = matchingProjectBinding(initialResolution, input);
@@ -152,9 +155,26 @@ export function resolveHookOperatingProfile({
   const entry = identity.state === 'resolved'
     ? readSessionRegistry(vaultResolution.base).sessions?.[identity.canonicalConversationId] || null
     : null;
+  let activeContext = null;
+  let contextError = null;
+  if (!bindingError && identity.state === 'resolved') {
+    try {
+      activeContext = activeContextResolver({
+        vaultBase: vaultResolution.base,
+        projectRoot: input?.cwd || vaultResolution.projectRoot || process.cwd(),
+        sessionId: identity.canonicalConversationId,
+      });
+    } catch (error) {
+      contextError = bindingDiagnostic(error);
+    }
+  }
   const base = sessionOverride(entry) || project;
   const taskLease = evaluateTaskOperatingProfileLease(
-    entry?.operating_profile_task,
+    contextError ? null : sessionTaskOperatingProfile(
+      vaultResolution.base,
+      identity.canonicalConversationId || '',
+      { context: activeContext },
+    ),
     taskLeaseContext(entry, input, identity.canonicalConversationId || ''),
   );
   const selected = taskLease.state === 'active'
@@ -176,6 +196,8 @@ export function resolveHookOperatingProfile({
     baseProfile: base.profile,
     baseSource: base.source,
     taskLease,
+    activeContext,
+    ...(contextError ? { contextError } : {}),
     resolution: vaultResolution,
     ...(bindingError ? { bindingError } : {}),
   };

package/hooks/operating-profile-task-store.mjs

@@ -3,7 +3,8 @@ import { randomUUID } from 'node:crypto';
 import {
   createTaskOperatingProfileLease,
 } from '../src/operating-profile.mjs';
-import { mutateSessionRegistry } from './obsidian-common.mjs';
+import { mutateSessionRegistry, readSessionRegistry } from './obsidian-common.mjs';
+import { mutateActiveContext, resolveActiveContext } from './active-context-store.mjs';
 
 function isoTimestamp(now) {
   if (typeof now === 'string') return now;
@@ -17,33 +18,93 @@ function missingSessionError(sessionId) {
   return error;
 }
 
+function activeContextRequiredError() {
+  const error = new Error('active context causal é obrigatório quando o registry contextual está inicializado');
+  error.code = 'WENDKEEP_ACTIVE_CONTEXT_REQUIRED';
+  return error;
+}
+
+function hasActiveContextRegistry(registry) {
+  return Boolean(registry && (
+    Object.hasOwn(registry, 'active_contexts')
+    || Object.hasOwn(registry, 'active_contexts_schema')
+    || Object.hasOwn(registry, 'active_contexts_revision')
+  ));
+}
+
+function leaseFromSession(current, profile, { reason, leaseId, issuedAt, sessionId }) {
+  const turnId = typeof current.last_prompt_turn_id === 'string'
+    ? current.last_prompt_turn_id.trim()
+    : '';
+  const hasRegisteredTurn = Boolean(
+    turnId
+    && current.turn_sequences
+    && Object.hasOwn(current.turn_sequences, turnId)
+    && current.turn_sequences[turnId] === current.last_turn_sequence
+  );
+  return createTaskOperatingProfileLease({
+    profile,
+    reason,
+    sessionId,
+    turnId,
+    turnSequence: hasRegisteredTurn ? current.last_turn_sequence : undefined,
+    leaseId,
+    issuedAt,
+  });
+}
+
+export function sessionTaskOperatingProfile(vaultBase, sessionId, { context = null } = {}) {
+  if (context) {
+    try { return resolveActiveContext(vaultBase, context).operating_profile_task || null; }
+    catch (error) {
+      if (error?.code === 'WENDKEEP_ACTIVE_CONTEXT_NOT_FOUND') {
+        const registry = readSessionRegistry(vaultBase);
+        if (hasActiveContextRegistry(registry)) return null;
+        return registry.sessions?.[sessionId]?.operating_profile_task || null;
+      }
+      throw error;
+    }
+  }
+  const registry = readSessionRegistry(vaultBase);
+  if (hasActiveContextRegistry(registry)) return null;
+  return registry.sessions?.[sessionId]?.operating_profile_task || null;
+}
+
 export function setSessionTaskOperatingProfile(vaultBase, sessionId, profile, {
   reason,
   leaseId = randomUUID(),
   now,
+  context = null,
+  mutateContext = mutateActiveContext,
 } = {}) {
   const issuedAt = isoTimestamp(now);
+  if (context) {
+    let lease;
+    mutateContext(vaultBase, context, (active) => ({
+      ...active,
+      operating_profile_task: lease,
+      state: 'active',
+    }), {
+      now: issuedAt,
+      projectLegacy: false,
+      mutateRegistry: (base, mutator) => mutateSessionRegistry(base, (registry) => {
+        const sessions = registry.sessions || (registry.sessions = {});
+        if (!Object.hasOwn(sessions, sessionId)) throw missingSessionError(sessionId);
+        lease = leaseFromSession(sessions[sessionId], profile, {
+          reason, leaseId, issuedAt, sessionId,
+        });
+        return mutator(registry);
+      }),
+    });
+    return lease;
+  }
   return mutateSessionRegistry(vaultBase, (registry) => {
+    if (hasActiveContextRegistry(registry)) throw activeContextRequiredError();
     const sessions = registry.sessions || (registry.sessions = {});
     if (!Object.hasOwn(sessions, sessionId)) throw missingSessionError(sessionId);
     const current = sessions[sessionId];
-    const turnId = typeof current.last_prompt_turn_id === 'string'
-      ? current.last_prompt_turn_id.trim()
-      : '';
-    const hasRegisteredTurn = Boolean(
-      turnId
-      && current.turn_sequences
-      && Object.hasOwn(current.turn_sequences, turnId)
-      && current.turn_sequences[turnId] === current.last_turn_sequence
-    );
-    const lease = createTaskOperatingProfileLease({
-      profile,
-      reason,
-      sessionId,
-      turnId,
-      turnSequence: hasRegisteredTurn ? current.last_turn_sequence : undefined,
-      leaseId,
-      issuedAt,
+    const lease = leaseFromSession(current, profile, {
+      reason, leaseId, issuedAt, sessionId,
     });
     sessions[sessionId] = {
       ...current,
@@ -56,10 +117,53 @@ export function setSessionTaskOperatingProfile(vaultBase, sessionId, profile, {
 
 export function consumeSessionTaskOperatingProfile(vaultBase, sessionId, leaseId, {
   now,
+  context = null,
+  mutateContext = mutateActiveContext,
 } = {}) {
   if (!sessionId || !leaseId) return false;
   const consumedAt = isoTimestamp(now);
+  if (context) {
+    let current;
+    try { current = resolveActiveContext(vaultBase, context); }
+    catch (error) {
+      if (error?.code !== 'WENDKEEP_ACTIVE_CONTEXT_NOT_FOUND') throw error;
+      const registry = readSessionRegistry(vaultBase);
+      if (hasActiveContextRegistry(registry)) return false;
+      return consumeSessionTaskOperatingProfile(vaultBase, sessionId, leaseId, {
+        now: consumedAt,
+      });
+    }
+    const lease = current.operating_profile_task;
+    if (!lease || lease.state !== 'active' || lease.lease_id !== leaseId) return false;
+    let consumed = false;
+    try {
+      mutateContext(vaultBase, context, (active) => {
+        const activeLease = active.operating_profile_task;
+        if (!activeLease || activeLease.state !== 'active' || activeLease.lease_id !== leaseId) {
+          return active;
+        }
+        consumed = true;
+        return {
+          ...active,
+          operating_profile_task: {
+            ...activeLease,
+            state: 'consumed',
+            consumed_at: consumedAt,
+          },
+        };
+      }, {
+        expectedRevision: current.revision,
+        now: consumedAt,
+        projectLegacy: false,
+      });
+    } catch (error) {
+      if (error?.code === 'WENDKEEP_ACTIVE_CONTEXT_STALE') return false;
+      throw error;
+    }
+    return consumed;
+  }
   return mutateSessionRegistry(vaultBase, (registry) => {
+    if (hasActiveContextRegistry(registry)) throw activeContextRequiredError();
     const current = registry.sessions?.[sessionId];
     const lease = current?.operating_profile_task;
     if (!lease || lease.state !== 'active' || lease.lease_id !== leaseId) return false;

package/hooks/session-stop.mjs

@@ -19,6 +19,11 @@ import { mutateSessionNote } from './session-note-io.mjs';
 import { appendIterationOutcome } from './session-iteration-outcome.mjs';
 import { applyDerivedSections, provenanceSessions } from './derived-sections.mjs';
 import { buildSessionMemoryEvents, collectLifecycleEvidence } from './memory-handoff.mjs';
+import {
+  buildCausalSharedHandoff,
+  causalChangeSlug,
+  resolveHandoffEvidenceAuthority,
+} from './active-context-handoff-evidence.mjs';
 import { enqueueMemoryEvent, projectMemoryOutbox } from './memory-store.mjs';
 import { detectMemoryMode } from './memory-mode.mjs';
 import { sanitizeMemoryText } from './memory-schema.mjs';
@@ -521,21 +526,6 @@ function shouldFinalizeSession() {
   return process.env.OBSIDIAN_NO_AUTO_FINALIZE !== '1';
 }
 
-function sharedHandoffFromInput(input = {}, entry = {}) {
-  const supplied = input.shared || input.handoff?.shared;
-  const shared = supplied && typeof supplied === 'object' && !Array.isArray(supplied)
-    ? { ...supplied }
-    : {};
-  const workSessionId = shared.work_session_id
-    || shared.workSessionId
-    || input.work_session_id
-    || input.workSessionId
-    || entry?.work_session_id
-    || '';
-  if (!shared.work_session_id && workSessionId) shared.work_session_id = workSessionId;
-  return Object.keys(shared).length ? shared : null;
-}
-
 export function commitSessionMemory(vaultBase, handoff, { projectOptions = {} } = {}) {
   if (detectMemoryMode(vaultBase).mode === 'legacy') {
     return { status: 'legacy', eventCount: 0, eventIds: [], checkpoint: null };
@@ -1277,6 +1267,29 @@ export async function main({
   const tx = parseTranscript(identity.transcriptPath || input.transcript_path || input.transcriptPath);
   const requestedTurnId = String(input.turn_id || input.turnId || '');
   const sessionId = identity.canonicalConversationId;
+  let handoffEvidenceAuthority;
+  let sharedHandoff;
+  let activeContextChangeSlug;
+  try {
+    handoffEvidenceAuthority = resolveHandoffEvidenceAuthority(vaultBase, {
+      input,
+      sessionId,
+      projectRoot: input.cwd || process.cwd(),
+    });
+    sharedHandoff = buildCausalSharedHandoff({
+      input,
+      entry,
+      authority: handoffEvidenceAuthority,
+    });
+    activeContextChangeSlug = causalChangeSlug(entry, handoffEvidenceAuthority);
+  } catch (error) {
+    const detail = String(error?.message || 'active context causal indisponível');
+    process.stderr.write(`[wendkeep] Stop causal bloqueado: ${detail}\n`);
+    writeHookOutput({
+      systemMessage: `wendkeep: Stop bloqueado antes de publicar handoff/evidência: ${detail}`,
+    });
+    return;
+  }
   const finalizing = shouldFinalizeSession();
   const turnIdentity = resolveTurnIdentity(tx, requestedTurnId);
   if (!turnIdentity) {
@@ -1389,11 +1402,10 @@ export async function main({
     }
     const finalSummary = sessionFinalSummary(tx);
     const memoryEvidence = collectLifecycleEvidence(vaultBase, {
-      changeSlug: entry.change_slug,
+      changeSlug: activeContextChangeSlug,
       summary: finalSummary,
       noteRel: sessionRel,
     });
-    const sharedHandoff = sharedHandoffFromInput(input, entry);
     memoryHandoff = {
       projectId,
       identity,
@@ -1531,9 +1543,11 @@ export async function main({
   // grafo quando a change fechava antes do turno seguinte. Aqui sobrevive ao reopen e acumula toda
   // change que passou pela sessão (upsertListSection deduplica). Fail-quiet: nunca derruba o Stop.
   try {
-    const chgLink = entry.change_slug
-      ? `Change ativa: [[${getLocale(vaultBase).folders.changes}/${entry.change_slug}/proposta]]`
-      : activeChangeLink(vaultBase);
+    const chgLink = activeContextChangeSlug
+      ? `Change ativa: [[${getLocale(vaultBase).folders.changes}/${activeContextChangeSlug}/proposta]]`
+      : handoffEvidenceAuthority.mode === 'legacy'
+        ? activeChangeLink(vaultBase)
+        : '';
     const wl = (chgLink.match(/\[\[[^\]]+\]\]/) || [])[0];
     if (wl) {
       mutateSessionNote(sessionPath, (cur) => (

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.76.5",
+  "version": "0.76.7",
   "description": "Vault-first persistent memory for AI coding agents, with an optional profile-aware governance runtime: OFF, FLOW, GUIDE, GOVERN, or ASSURE. Local-first and agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "workspaces": [
@@ -42,7 +42,7 @@
   },
   "scripts": {
     "precheck": "node --check src/worktree.mjs && node --check src/context.mjs && node --check packages/vault/src/worktree-metadata.mjs",
-    "check": "node --check scripts/release.mjs && node --check scripts/release-plan.mjs && node --check scripts/release-provenance.mjs && node --check scripts/run-scope.mjs && node --check src/release-provenance.mjs && node --check bin/wendkeep.mjs && node --check packages/cli/src/index.mjs && node --check src/init.mjs && node --check src/doctor.mjs && node --check src/project-vault.mjs && node --check src/observer-auth.mjs && node --check src/observer-privacy.mjs && node --check src/observer-snapshot.mjs && node --check src/observer-store.mjs && node --check src/observer-memory.mjs && node --check src/observer-memory-publish.mjs && node --check src/observer-sql-store.mjs && node --check src/observer-sql-migrate.mjs && node --check src/observer-sql-publish.mjs && node --check src/observer-transcript-store.mjs && node --check src/observer-server.mjs && node --check src/observer.mjs && node --check src/observer-publish.mjs && node --check src/operating-profile.mjs && node --check src/profile.mjs && node --check src/flow.mjs && node --check src/work-kind.mjs && node --check src/delivery.mjs && node --check web/observer/app.mjs && node --check hooks/observer-publish.mjs && node --check hooks/evidence-context.mjs && node --check hooks/evidence-recall.mjs && node --check hooks/memory-scope.mjs && node --check hooks/operating-profile-runtime.mjs && node --check hooks/operating-profile-task-store.mjs && node --check hooks/flow-core.mjs && node --check hooks/flow-protected-policy.mjs && node --check hooks/git-snapshot.mjs && node --check hooks/vault-path-safety.mjs && node --check hooks/vault-runtime-store.mjs && node --check packages/harness/src/index.mjs && node --check packages/harness/src/flow-store.mjs && node --check packages/harness/src/operating-profile.mjs && node --check packages/harness/src/sensors-core.mjs && node --check packages/integrations/src/host-hooks.mjs && node --check packages/integrations/src/hook-envelope.mjs && node --check packages/integrations/src/prompt-content.mjs && node --check packages/integrations/src/transcript-usage.mjs && node --check packages/integrations/src/transcripts.mjs && node --check packages/integrations/src/session-identity.mjs && node --check packages/integrations/src/index.mjs && node --check packages/mcp/src/config.mjs && node --check packages/mcp/src/index.mjs && node --check packages/vault/src/index.mjs && node --check packages/vault/src/project-vault.mjs && node --check packages/vault/src/vault-path-safety.mjs && node --check packages/vault/src/locale.mjs && node --check packages/vault/src/memory-schema.mjs && node --check packages/vault/src/memory-mode.mjs && node --check packages/vault/src/memory-scope.mjs && node --check packages/vault/src/memory-candidate-policy.mjs && node --check packages/vault/src/evidence-recall.mjs && node --check packages/vault/src/memory-handoff.mjs && node --check packages/vault/src/memory-store.mjs && node --check packages/vault/src/validate-core.mjs && node --check packages/vault/src/validate-memory.mjs",
+    "check": "node --check scripts/release.mjs && node --check scripts/release-plan.mjs && node --check scripts/release-provenance.mjs && node --check scripts/run-scope.mjs && node --check src/release-provenance.mjs && node --check bin/wendkeep.mjs && node --check packages/cli/src/index.mjs && node --check src/init.mjs && node --check src/doctor.mjs && node --check src/project-vault.mjs && node --check src/observer-auth.mjs && node --check src/observer-privacy.mjs && node --check src/observer-snapshot.mjs && node --check src/observer-store.mjs && node --check src/observer-memory.mjs && node --check src/observer-memory-publish.mjs && node --check src/observer-sql-store.mjs && node --check src/observer-sql-migrate.mjs && node --check src/observer-sql-publish.mjs && node --check src/observer-transcript-store.mjs && node --check src/observer-server.mjs && node --check src/observer.mjs && node --check src/observer-publish.mjs && node --check src/operating-profile.mjs && node --check src/profile.mjs && node --check src/flow.mjs && node --check src/work-kind.mjs && node --check src/delivery.mjs && node --check web/observer/app.mjs && node --check hooks/observer-publish.mjs && node --check hooks/evidence-context.mjs && node --check hooks/active-context-handoff-evidence.mjs && node --check hooks/evidence-recall.mjs && node --check hooks/memory-scope.mjs && node --check hooks/operating-profile-runtime.mjs && node --check hooks/operating-profile-task-store.mjs && node --check hooks/flow-core.mjs && node --check hooks/flow-protected-policy.mjs && node --check hooks/git-snapshot.mjs && node --check hooks/vault-path-safety.mjs && node --check hooks/vault-runtime-store.mjs && node --check packages/harness/src/index.mjs && node --check packages/harness/src/flow-store.mjs && node --check packages/harness/src/operating-profile.mjs && node --check packages/harness/src/sensors-core.mjs && node --check packages/integrations/src/host-hooks.mjs && node --check packages/integrations/src/hook-envelope.mjs && node --check packages/integrations/src/prompt-content.mjs && node --check packages/integrations/src/transcript-usage.mjs && node --check packages/integrations/src/transcripts.mjs && node --check packages/integrations/src/session-identity.mjs && node --check packages/integrations/src/index.mjs && node --check packages/mcp/src/config.mjs && node --check packages/mcp/src/index.mjs && node --check packages/vault/src/index.mjs && node --check packages/vault/src/project-vault.mjs && node --check packages/vault/src/vault-path-safety.mjs && node --check packages/vault/src/locale.mjs && node --check packages/vault/src/memory-schema.mjs && node --check packages/vault/src/memory-mode.mjs && node --check packages/vault/src/memory-scope.mjs && node --check packages/vault/src/memory-candidate-policy.mjs && node --check packages/vault/src/evidence-recall.mjs && node --check packages/vault/src/memory-handoff.mjs && node --check packages/vault/src/memory-store.mjs && node --check packages/vault/src/validate-core.mjs && node --check packages/vault/src/validate-memory.mjs",
     "test": "node --test --test-concurrency=2",
     "test:core": "node scripts/run-scope.mjs core",
     "release": "node scripts/release.mjs",

package/src/profile.mjs

@@ -8,7 +8,11 @@ import {
   resolveOperatingProfile,
   setOperatingProfile,
 } from './operating-profile.mjs';
-import { setSessionTaskOperatingProfile } from '../hooks/operating-profile-task-store.mjs';
+import {
+  sessionTaskOperatingProfile,
+  setSessionTaskOperatingProfile,
+} from '../hooks/operating-profile-task-store.mjs';
+import { resolveCommandActiveContext } from './active-context-runtime.mjs';
 import { resolve } from 'node:path';
 import { findProjectBinding, resolveProjectVault, updateProjectBinding } from './project-vault.mjs';
 
@@ -163,12 +167,13 @@ function sessionProfile(vaultBase, sessionId, projectResolved) {
   return sessionBaseProfile(sessions[sessionId], projectResolved);
 }
 
-function sessionProfileStatus(vaultBase, sessionId, projectResolved) {
+function sessionProfileStatus(vaultBase, sessionId, projectResolved, { context = null } = {}) {
   const sessions = readSessionRegistry(vaultBase).sessions || {};
   if (!Object.hasOwn(sessions, sessionId)) throw new Error(`sessão não encontrada: ${sessionId}`);
   const entry = sessions[sessionId];
   const base = sessionBaseProfile(entry, projectResolved);
-  const taskLease = evaluateTaskOperatingProfileLease(entry.operating_profile_task, {
+  const taskLease = evaluateTaskOperatingProfileLease(
+    sessionTaskOperatingProfile(vaultBase, sessionId, { context }), {
     sessionId,
     turnId: entry.last_prompt_turn_id || '',
     turnSequence: entry.last_turn_sequence,
@@ -183,6 +188,15 @@ function sessionProfileStatus(vaultBase, sessionId, projectResolved) {
   };
 }
 
+function commandActiveContext(state, sessionId) {
+  if (!sessionId || state.resolved.bindingError) return null;
+  return resolveCommandActiveContext({
+    vaultBase: state.vaultBase,
+    projectRoot: state.resolved.projectRoot || process.cwd(),
+    sessionId,
+  });
+}
+
 function sessionOutputPayload(effective, sessionId) {
   return {
     profile: effective.profile,
@@ -213,8 +227,9 @@ export function runProfile(argv = []) {
   if (sub === 'status' || sub === 'show') {
     if (args.length > 1) return fail(`${sub} não aceita argumentos posicionais adicionais`);
     try {
+      const activeContext = sessionId ? commandActiveContext(state, sessionId) : null;
       const effective = sessionId
-        ? sessionProfileStatus(state.vaultBase, sessionId, projectResolved)
+        ? sessionProfileStatus(state.vaultBase, sessionId, projectResolved, { context: activeContext })
         : { profile: projectResolved.profile, source: projectResolved.source, scope: 'project' };
       output({
         ...(sessionId ? sessionOutputPayload(effective, sessionId) : {
@@ -235,11 +250,12 @@ export function runProfile(argv = []) {
     if (!reason) return fail('route requer --reason <text>');
     try {
       const base = sessionProfile(state.vaultBase, sessionId, projectResolved);
+      const activeContext = commandActiveContext(state, sessionId);
       const lease = setSessionTaskOperatingProfile(
         state.vaultBase,
         sessionId,
         args[1],
-        { reason },
+        { reason, context: activeContext },
       );
       output({
         profile: lease.profile,