wogiflow 2.15.1 → 2.16.0

package/.claude/commands/wogi-challenge.md

@@ -1,5 +1,5 @@
 ---
-description: "Manual trigger of the IGR Logic Adversary — critique a plan against the Logic Constitution v1 rubric."
+description: "Manual trigger of the IGR Logic Adversary — critique a plan against the Logic Constitution v2 rubric (11 principles, including Platform Capability Grounding)."
 effort: medium
 ---
 
@@ -17,13 +17,13 @@ Story: `wf-b00262b1` (IGR)
 /wogi-challenge wf-XXXXXXXX
 
 # Critique with an explicit rubric version
-/wogi-challenge path/to/plan.md --rubric=logic-constitution-v1
+/wogi-challenge path/to/plan.md --rubric=logic-constitution-v2
 ```
 
 ## What it does
 
 1. Loads the plan (either from a file path or from `.workflow/plans/{taskId}.md`).
-2. Calls `scripts/flow-logic-adversary.js buildAdversaryPrompt` to assemble the critique prompt — includes the 10-principle Logic Constitution, few-shot calibration examples, and all available intent artifacts.
+2. Calls `scripts/flow-logic-adversary.js buildAdversaryPrompt` to assemble the critique prompt — includes the 11-principle Logic Constitution v2 (Principle 11 is Platform Capability Grounding), few-shot calibration examples, and all available intent artifacts.
 3. Spawns a sub-agent via the Agent tool on a different model than this session when possible (Sonnet when you're on Opus; Opus when you're on Sonnet) — the model-separation rule per the approved spec.
 4. Parses the returned JSON verdict against the rubric schema.
 5. Records a telemetry event (`gateId: logic-adversary`) with the verdict.
@@ -46,7 +46,7 @@ Story: `wf-b00262b1` (IGR)
 ## Under the hood
 
 - Script: `scripts/flow-logic-adversary.js`
-- Rubric: `.workflow/rubrics/logic-constitution-v1.md`
+- Rubric: `.workflow/rubrics/logic-constitution-v2.md` (v1 retained for historical telemetry)
 - Persona: `.workflow/agents/logic-adversary.md`
 - Calibration: `.workflow/state/adversary-calibration.json`
 - Telemetry: `gateId: logic-adversary` in `.workflow/state/gate-telemetry.jsonl`

package/.claude/commands/wogi-gate-stats.md

@@ -43,7 +43,7 @@ Story: `wf-faf340cf` (IGR Story 0 — Gate Telemetry & Self-Assessment Framework
 A gate with `pass% = 100%` and `miss% > 10%` is **rubber-stamping**. It's letting things through that you then have to correct. This is the failure mode the owner's QA-98%-parable warned against: 100% coverage that creates false confidence is more dangerous than 70% coverage that triggers a second review.
 
 When you see high miss rates:
-1. Tune the rubric (for `logic-adversary`: edit `.workflow/rubrics/logic-constitution-v1.md`)
+1. Tune the rubric (for `logic-adversary`: edit `.workflow/rubrics/logic-constitution-v2.md`)
 2. Add calibration examples (for `logic-adversary`: append to `.workflow/state/adversary-calibration.json`)
 3. Strengthen the gate's blocking behavior (for `completion-truth-gate`: raise `minTierForDone` or set `blockFalseCompletion: true`)
 

package/.claude/docs/intent-grounded-reasoning.md

@@ -18,7 +18,7 @@ Research finding: across 1,309 user messages mined, first-pass agent output was
 | 1 | **Intent Bootstrap** — scaffolds product/domain/glossary/user-journeys artifacts; agnostic trap-zone detector finds structural ambiguities | `scripts/flow-intent-bootstrap.js` + `scripts/flow-trap-zone.js` |
 | 2 | **Intent Framing Pass** — per-task reasoning step; produces a Framing Artifact resolving ambiguities before any other work | `scripts/flow-intent-framing.js` |
 | 3 | **Architect Pass** — read-only sub-agent produces an 8-section pre-spec plan | `scripts/flow-architect-pass.js` + persona `.workflow/agents/architect.md` |
-| 4 | **Logic Adversary** — separate sub-agent on a different model critiques the plan against the 10-principle Logic Constitution | `scripts/flow-logic-adversary.js` + rubric `.workflow/rubrics/logic-constitution-v1.md` |
+| 4 | **Logic Adversary** — separate sub-agent on a different model critiques the plan against the 11-principle Logic Constitution (v2 adds Principle 11 — Platform Capability Grounding) | `scripts/flow-logic-adversary.js` + rubric `.workflow/rubrics/logic-constitution-v2.md` |
 | 5 | **Session Correction Memory** — detects user corrections during a session and cross-references back to gates that passed the contradicted work | extensions in `scripts/flow-correction-detector.js` |
 | 6 | **Completion Truth Gate** — audits "done" claims against Tier 0–4 evidence; downgrades language when evidence is insufficient | `scripts/flow-completion-truth-gate.js` |
 | 7 | **Pipeline wiring + rollout** — integrates all above into `/wogi-start`, the gate registry, the eval framework | (this story) |

package/.claude/docs/phases/02-spec.md

@@ -6,7 +6,7 @@ Instructions for the spec/approval phase. Loaded on-demand when phase transition
 
 **Conditional** — runs for L1+ tasks when IGR on. L3 skip. L2 runs only on ultrathink auto-bump.
 
-Spawn a **read-only sub-agent** (Explore subagent_type, with Read/Grep/Glob only — no Edit/Write/Bash) on a model chosen per `config.intentGroundedReasoning.architectPass.modelOverride`. Input: Framing Artifact from Step 1.15 + explore findings from Step 1.3 + scope-confidence audit from Step 1.45 + the Logic Constitution v1 rubric (so the Architect anticipates the Adversary's checks).
+Spawn a **read-only sub-agent** (Explore subagent_type, with Read/Grep/Glob only — no Edit/Write/Bash) on a model chosen per `config.intentGroundedReasoning.architectPass.modelOverride`. Input: Framing Artifact from Step 1.15 + explore findings from Step 1.3 + scope-confidence audit from Step 1.45 + the Logic Constitution v2 rubric (so the Architect anticipates the Adversary's checks, including Principle 11 — Platform Capability Grounding, which demands citation + enforcement-preservation + alternative-ruled-out + fallback for every platform-capability claim).
 
 Build the prompt via `node scripts/flow-architect-pass.js prompt <task>`. Invoke via Agent tool. Output: an 8-section plan at `.workflow/plans/{taskId}.md` (PINs: approach, data-model, journey-impact, net-new, alternatives, risks, reversibility, dependencies). Parse via `parsePlanArtifact()`; if structural FAIL, re-prompt.
 
@@ -20,7 +20,7 @@ When IGR flag is OFF: SKIPPED. Pipeline proceeds from Step 1.45 directly to Step
 
 Spawn a **separate sub-agent on a different model** than the Architect (Sonnet when Architect is Opus; Opus when Architect is Sonnet — per `modelSeparation: different-from-architect`). Per Anthropic harness research, same-model self-critique is a known rubber-stamp failure mode.
 
-Build the prompt via `node scripts/flow-logic-adversary.js prompt .workflow/plans/{taskId}.md`. The Adversary critiques the plan against the 10-principle Logic Constitution v1 with few-shot calibration examples from `.workflow/state/adversary-calibration.json`.
+Build the prompt via `node scripts/flow-logic-adversary.js prompt .workflow/plans/{taskId}.md`. The Adversary critiques the plan against the 11-principle Logic Constitution v2 with few-shot calibration examples from `.workflow/state/adversary-calibration.json`. Principle 11 (Platform Capability Grounding) always runs — every claim about hook/tool/API/platform behavior must be cited, enforcement must be preserved, an alternative must be named, and a fallback must be specified.
 
 Iteration loop (max 3 rounds by default):
 - `overallVerdict: PASS` or `PASS_WITH_CONCERNS` → proceed to Step 1.5. Concerns surface at approval gate (Step 1.6).

package/.workflow/agents/logic-adversary.md

@@ -11,9 +11,9 @@
 
 You are the **Logic Adversary** for WogiFlow's Intent-Grounded Reasoning layer.
 
-Your job is to find logic problems in a plan BEFORE any code is written. You are not critiquing code. You are not checking style, library choice, or syntax — other gates handle those. You are reasoning about whether this plan is **logically right** for the project it's proposed for.
+Your job is to find logic problems in a plan BEFORE any code is written. You are not critiquing code. You are not checking style, library choice, or syntax — other gates handle those. You are reasoning about whether this plan is **logically right** for the project it's proposed for AND whether its claims about the target platform (hooks, tool APIs, subagent model, MCP, etc.) are actually true.
 
-You have a specific rubric: the Logic Constitution (currently v1). You will receive it as input. For each of the 10 principles, you produce a verdict: PASS, CONCERN, FAIL, or SKIP. You cite specific evidence for every verdict. Verdicts without evidence are themselves failures of your job.
+You have a specific rubric: the Logic Constitution (currently v2). You will receive it as input. For each of the 11 principles, you produce a verdict: PASS, CONCERN, FAIL, or SKIP. You cite specific evidence for every verdict. Verdicts without evidence are themselves failures of your job.
 
 ### What you are looking for
 
@@ -29,6 +29,11 @@ Patterns that produce logic failures in practice — seen in real agent session
 8. **Implicit-requirement blindness** — happy path only, no edge cases.
 9. **User-journey orphans** — dead-end screens, unreachable features.
 10. **Undocumented irreversibility** — destructive ops without confirmation.
+11. **Ungrounded platform-capability claims** — plans that rely on a hook, tool API, subagent behavior, MCP feature, or slash command working a certain way WITHOUT citation, WITHOUT enforcement-preservation evidence, WITHOUT a ruled-out alternative, or WITHOUT a capability-unavailable fallback. For every platform-capability claim, demand all four: citation, enforcement walk-through, alternative, fallback. Missing any of the four = FAIL. **Additionally, for runtime-behavior claims (hooks firing, tools returning specific shapes, signals being handled, events being emitted), hearsay-level citations — code comments or docs claiming "X does Y" — are NOT sufficient. Demand either O1 (a captured observation: log, telemetry, trace, test result) OR O2 (a named live-test plan that produces O1 before downstream code is built). See P11.1 in the rubric. A comment saying "the hook fires" is not evidence the hook fires; a log line showing it firing is.**
+
+**P11.2 — The same discipline applies to the PROJECT'S OWN RULES**, not just platform capabilities. For every artifact a plan produces (task IDs, file names, config values, state-file entries, spec structures, commit messages), demand: (E1) which rule from `decisions.md`, `feedback-patterns.md`, `.claude/rules/`, a schema, or a validator function applies? (E2) show the artifact satisfying the rule — run the validator, show the format side-by-side with the rule, paste the passing check — *not* "I followed it." (E3) what's the failure mode when violated? Examples of P11.2 violations: (a) "task ID `wf-test0001` follows WogiFlow convention" — no, the convention requires hex, this fails `validateTaskId()`; (b) "config key `taskBoundaryReset` is valid" without being in `flow-constants.js`'s known-keys list; (c) "file name `flowFoo.js` follows kebab-case" — it doesn't. Reflex: *what's the artifact? what rule governs it? is satisfaction SHOWN, not just claimed?*
+
+**P11.3 — Also check for EXISTING WOGIFLOW FEATURES that touch the same domain.** Before shipping any new mechanism (hook, wrapper, CLI entry, state file, config key, skill), enumerate the sibling surface: (S1) `grep -r "execSync\|spawn.*claude" lib/ scripts/`, check `.claude/commands/`, check `scripts/flow-constants.js`, check `lib/workspace.js` — does an existing feature already touch this domain? (S2) Show how the new mechanism composes, conflicts, or integrates with each sibling. "Orthogonal" is OK but must be asserted. (S3) If integration work is needed (e.g., the new wrapper needs to be injected into workspace's `execSync('claude')` call), include it in scope OR explicitly file a follow-up story. Silent omission of sibling integration = FAIL. Example violation caught live: `wogi-claude` wrapper initially missed that `lib/workspace.js:1612` spawns claude directly, so workspace-mode workers weren't restart-capable.
 
 ### What you are NOT looking for
 

package/.workflow/templates/claude-md.hbs

@@ -216,6 +216,33 @@ If the user provides N items, ALL N must become tracked work items. No exception
 
 **This rule applies everywhere**: `/wogi-start`, `/wogi-story`, `/wogi-epics`, `/wogi-extract-review`, and any other command that converts user input into tracked work.
 
+### Mid-Execution Anti-Deferral (MANDATORY — APPLIES AFTER TASKS ARE CREATED)
+
+**Reordering is permitted. Deferring is not.** Once work is tracked inside an epic, story, or wave, you MUST NOT propose to skip, postpone, drop, or "deprioritize to later" any of it — regardless of how risky, expensive, or token-heavy it looks. If the work improves code quality or user experience, it ships the plan it was scoped into. You may only change the **sequence** of execution.
+
+**Why this rule exists**: Baseline Claude Code training biases toward deferral to conserve tokens and reduce risk ("let's save X for later," "we can defer the high-risk piece," "this can wait until v2"). That bias is a token-preservation reflex, not a quality judgment. In WogiFlow, scope decisions are the user's, not the AI's — the AI proposes sequencing, the user decides scope.
+
+**Mid-Execution Anti-Rationalization Checklist** — If ANY of these thoughts cross your mind, STOP:
+- "This piece is high-risk — let's defer it to a later epic" → WRONG. It ships this epic. Reorder it later in the sequence if needed.
+- "To save tokens, let's skip wf-XXXX for now" → WRONG. Token cost is never a reason to drop scoped work.
+- "The user probably won't miss this one" → WRONG. The user tracked it. It ships.
+- "We can revisit this after the main work lands" → WRONG. "Revisit" is a soft defer. Sequence it, don't postpone it.
+- "This was lower priority anyway" → WRONG. Priority affects ORDER, never INCLUSION.
+
+**What you MAY do after tasks are tracked:**
+- Propose a **sequence** (A → B → C, or A∥B → C) with reasoning
+- Propose **parallelization** when independent
+- Propose **prerequisites** that must land first (that is reordering, not deferral)
+- Flag risks without using them as justification to drop scope
+
+**What you must NEVER do after tasks are tracked:**
+- Propose to "defer" a tracked story "to save tokens" or "reduce risk"
+- Skip a scoped story because you judged it lower-value
+- Use the word "defer" as a euphemism for "drop"
+- Present a plan that silently omits already-tracked work
+
+**When genuinely unsure the work is still needed**: ask the user explicitly — "Do you still want wf-XXXX to ship this epic, or should we drop it?" Let them decide. Do NOT make that call autonomously.
+
 ### Task ID Format (MANDATORY)
 
 All task IDs MUST be generated by `generateTaskId()` from `wogiflow/scripts/flow-utils.js`. **Never manually type a task ID.**

package/lib/wogi-claude

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# wogi-claude — Task-boundary session restart wrapper for Claude Code.
+#
+# When the WogiFlow TaskCompleted hook (with taskBoundaryReset.enabled: true)
+# finishes a task, it writes a restart flag to $WOGI_RESTART_FLAG and sends
+# SIGTERM to its parent Claude Code process. Claude Code exits cleanly; this
+# wrapper detects the flag and restarts claude in a fresh context. All WogiFlow
+# state is preserved on disk and re-hydrated via SessionStart hook.
+#
+# Why this exists: Claude Code has no programmatic /clear or in-session reset.
+# Prior-conversation tokens accumulate across tasks, burning 10-20% of context
+# budget before new work begins. This wrapper recovers that budget cleanly.
+#
+# Usage:
+#   Direct:  wogi-claude [claude args...]
+#   PATH:    ensure ~/.wogiflow/bin is on PATH, then run `wogi-claude` instead of `claude`
+#   Opt-out: pass --no-wogi-restart to run claude once without the restart loop
+#
+# Environment:
+#   WOGI_RESTART_FLAG  — path to restart-flag file (default: <cwd>/.workflow/state/restart-requested)
+#   WOGI_MAX_RESTARTS  — safety cap, default 50 (prevents runaway restart storms)
+#   WOGI_WRAPPER_PID   — exported to child; hook checks this to confirm wrapper is present
+#   WOGI_CLAUDE_BIN    — override path to claude binary (default: found via PATH)
+
+set -u
+
+# --- Opt-out path: no restart loop, just exec claude once ---
+for arg in "$@"; do
+  if [ "$arg" = "--no-wogi-restart" ]; then
+    # strip the flag from args and exec
+    filtered=()
+    for a in "$@"; do [ "$a" = "--no-wogi-restart" ] || filtered+=("$a"); done
+    CLAUDE_BIN="${WOGI_CLAUDE_BIN:-claude}"
+    exec "$CLAUDE_BIN" "${filtered[@]}"
+  fi
+done
+
+# --- Resolve paths and config ---
+CLAUDE_BIN="${WOGI_CLAUDE_BIN:-claude}"
+PROJECT_ROOT="$(pwd)"
+FLAG_FILE="${WOGI_RESTART_FLAG:-$PROJECT_ROOT/.workflow/state/restart-requested}"
+MAX_RESTARTS="${WOGI_MAX_RESTARTS:-50}"
+export WOGI_RESTART_FLAG="$FLAG_FILE"
+export WOGI_WRAPPER_PID=$$
+
+# --- Handle Ctrl+C / signals gracefully: propagate to child, don't restart on user-initiated exit ---
+INTERRUPTED=0
+on_interrupt() {
+  INTERRUPTED=1
+  # Let the child process receive the signal naturally; don't kill ourselves yet.
+}
+trap on_interrupt INT TERM
+
+# --- Main loop ---
+count=0
+while true; do
+  count=$((count + 1))
+  if [ "$count" -gt "$MAX_RESTARTS" ]; then
+    echo "[wogi-claude] max restarts ($MAX_RESTARTS) reached — exiting" >&2
+    exit 1
+  fi
+
+  # Clear any stale flag from a prior run before starting a new claude
+  # (defensive — hook should clean up after itself but if a crash left it, remove it)
+  if [ "$count" -eq 1 ] && [ -f "$FLAG_FILE" ]; then
+    rm -f "$FLAG_FILE"
+  fi
+
+  "$CLAUDE_BIN" "$@"
+  inner_exit=$?
+
+  # If the user hit Ctrl+C (INT/TERM reached us), don't restart
+  if [ "$INTERRUPTED" -eq 1 ]; then
+    exit "$inner_exit"
+  fi
+
+  # If the restart flag was written, consume it and loop
+  if [ -f "$FLAG_FILE" ]; then
+    rm -f "$FLAG_FILE"
+    # Brief informational line so user knows what just happened
+    echo "[wogi-claude] task boundary — restarting with fresh context (iteration $((count + 1)))" >&2
+    continue
+  fi
+
+  # No flag — claude exited for its own reasons; propagate exit code
+  exit "$inner_exit"
+done

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "wogiflow",
-  "version": "2.15.1",
+  "version": "2.16.0",
   "description": "AI-powered development workflow management system with multi-model support",
   "main": "lib/index.js",
   "bin": {
     "flow": "bin/flow",
-    "wogi-flow": "bin/flow"
+    "wogi-flow": "bin/flow",
+    "wogi-claude": "lib/wogi-claude"
   },
   "scripts": {
     "flow": "./scripts/flow",

package/scripts/flow-architect-pass.js

@@ -106,7 +106,7 @@ function isArchitectDisabled() {
  * @param {string} [opts.framing] - Framing artifact content. If absent, attempts to load via loadFramingArtifact.
  * @param {string} [opts.exploreFindings] - Consolidated explore-phase findings.
  * @param {string} [opts.scopeConfidenceAudit] - Optional per spec §2.2; degraded mode if absent.
- * @param {string} [opts.constitutionVersion='logic-constitution-v1']
+ * @param {string} [opts.constitutionVersion='logic-constitution-v2']
  * @returns {Promise<{ systemPrompt:string, userPrompt:string, metadata:Object }>}
  */
 async function buildArchitectPrompt(opts) {
@@ -114,7 +114,7 @@ async function buildArchitectPrompt(opts) {
     throw new TypeError('buildArchitectPrompt: opts.taskId required');
   }
   const taskId = opts.taskId;
-  const constitutionVersion = opts.constitutionVersion || 'logic-constitution-v1';
+  const constitutionVersion = opts.constitutionVersion || 'logic-constitution-v2';
 
   const dis = isArchitectDisabled();
   if (dis.disabled) {
@@ -537,7 +537,7 @@ async function cliPrompt(argv) {
   const built = await buildArchitectPrompt({
     taskId: args.task || path.basename(inputFile, path.extname(inputFile)),
     taskInput,
-    constitutionVersion: args.rubric || 'logic-constitution-v1',
+    constitutionVersion: args.rubric || 'logic-constitution-v2',
   });
   console.log('===== SYSTEM PROMPT =====');
   console.log(built.systemPrompt);

package/scripts/flow-config-defaults.js

@@ -850,6 +850,25 @@ const CONFIG_DEFAULTS = {
     respectDependencies: true
   },
 
+  // --- Task-Boundary Session Restart (wf-39e9dc09) ---
+  // EXPERIMENTAL, OPT-IN. When enabled AND the `wogi-claude` wrapper is running,
+  // TaskCompleted triggers a clean restart of the Claude Code process so each
+  // new task starts with a fresh context. State files persist; the wrapper
+  // detects the restart flag and relaunches claude. See lib/wogi-claude for
+  // the wrapper. See scripts/hooks/core/task-boundary-reset.js for the trigger.
+  //
+  // REQUIRES verification against real Claude Code before enabling broadly —
+  // the SIGTERM-to-parent pattern must be confirmed to exit Claude Code
+  // gracefully. Keep disabled until integration test in a throwaway session
+  // confirms clean exit + flag consumption + fresh restart.
+  taskBoundaryReset: {
+    _comment: 'Opt-in per-task context reset via wogi-claude wrapper. See lib/wogi-claude.',
+    enabled: false,
+    _comment_enabled: 'Set true ONLY after verifying SIGTERM behavior with real Claude Code in a throwaway session.',
+    maxRestartsPerSession: 50,
+    _comment_maxRestartsPerSession: 'Safety cap. The wrapper also has WOGI_MAX_RESTARTS env override.'
+  },
+
   // --- Contract Surface (Teams-only — activated on wogi login) ---
   contractSurface: {
     enabled: false,
@@ -1026,6 +1045,38 @@ const CONFIG_DEFAULTS = {
     standaloneBypassTask: true
   },
 
+  // --- Externalized Episodic Memory (epic-episodic-memory) ---
+  // Default OFF until Wave E regression tests validate ≥30% token savings.
+  // See .workflow/audits/state-coverage-2026-04-15.md for design rationale.
+  externalMemory: {
+    enabled: false,
+    thresholds: {
+      agentTokens: 2000,
+      readLines: 200,
+      bashLines: 100
+    },
+    retention: {
+      compressDays: 7,
+      evictDays: 30
+    },
+    exemptions: {
+      pathGlobs: [
+        '.claude/docs/phases/**',
+        '.workflow/state/workflow-phase.json',
+        '.workflow/state/task-checkpoint.json'
+      ],
+      tools: ['TodoWrite', 'Glob', 'Grep']
+    },
+    capture: {
+      enabled: false,
+      blockOnMiss: true,
+      minLevel: 'L2'
+    },
+    telemetry: {
+      enabled: true
+    }
+  },
+
   // --- Workflow Steps ---
   workflowSteps: WORKFLOW_STEP_DEFAULTS
 };

package/scripts/flow-constants.js

@@ -142,7 +142,9 @@ const KNOWN_CONFIG_KEYS = [
   'security', 'storyDecomposition', 'techDebt', 'traces',
   'webmcp', 'workflowSteps',
   // v2.0.0+ compat shim output keys
-  'proactiveCompaction', 'communitySync'
+  'proactiveCompaction', 'communitySync',
+  // Task-boundary session restart (wf-39e9dc09) — opt-in, experimental
+  'taskBoundaryReset'
 ];
 
 module.exports = {

package/scripts/flow-correct.js

@@ -24,6 +24,7 @@ const {
   readFile,
   writeFile,
   getConfig,
+  getTodayDate,
   color,
   success,
   warn,

package/scripts/flow-done.js

@@ -596,6 +596,22 @@ async function main() {
 
   success(`Completed: ${taskId}`);
 
+  // wf-39e9dc09 Phase 1 — mark task-just-completed so the next Stop-hook
+  // invocation can trigger a session restart when taskBoundaryReset is on
+  // and the wogi-claude wrapper is running. Safe no-op otherwise (the marker
+  // is cheap; Phase 2 checks preconditions before acting on it).
+  try {
+    const { markRestartPending } = require('./hooks/core/task-boundary-reset');
+    markRestartPending({
+      taskId,
+      source: 'flow-done'
+    });
+  } catch (err) {
+    if (process.env.DEBUG) {
+      console.error(`[flow-done] markRestartPending failed (non-fatal): ${err.message}`);
+    }
+  }
+
   // v5.0: Show TodoWrite completion stats if available
   if (todoWriteSync) {
     try {

package/scripts/flow-logic-adversary.js

@@ -53,7 +53,7 @@ const gateTelemetry = require('./flow-gate-telemetry');
 // ============================================================
 
 const RUBRIC_DIR = path.join(PATHS.workflow, 'rubrics');
-const DEFAULT_RUBRIC = 'logic-constitution-v1';
+const DEFAULT_RUBRIC = 'logic-constitution-v2';
 const CALIBRATION_PATH = path.join(PATHS.state, 'adversary-calibration.json');
 
 const VALID_OVERALL_VERDICTS = new Set([
@@ -84,7 +84,7 @@ const INTENT_ARTIFACTS = {
 
 /**
  * Load the Logic Constitution rubric by version identifier.
- * @param {string} [version='logic-constitution-v1']
+ * @param {string} [version='logic-constitution-v2']
  * @returns {{ content: string, version: string, path: string }}
  */
 function loadRubric(version = DEFAULT_RUBRIC) {
@@ -149,7 +149,7 @@ function readIntentArtifact(key) {
  * @param {string} [opts.taskId]
  * @param {number} [opts.round=1] - Iteration round number (≥1).
  * @param {object} [opts.previousAdversaryOutput] - Prior round's parsed output when re-running.
- * @param {string} [opts.rubricVersion='logic-constitution-v1']
+ * @param {string} [opts.rubricVersion='logic-constitution-v2']
  * @param {number} [opts.calibrationCount=3] - How many calibration examples to inject.
  * @returns {{ systemPrompt:string, userPrompt:string, metadata:object }}
  */
@@ -317,7 +317,7 @@ All 10 principles must appear in the \`principles\` array, even if SKIPped.
  * @param {Object} ctx
  * @param {string} [ctx.taskId]
  * @param {number} [ctx.round=1]
- * @param {string} [ctx.rubricVersion='logic-constitution-v1']
+ * @param {string} [ctx.rubricVersion='logic-constitution-v2']
  * @returns {object} The validated adversary verdict.
  */
 function parseAdversaryOutput(response, ctx = {}) {

package/scripts/flow-migrate-igr.js

@@ -50,7 +50,7 @@ const REQUIRED_IGR_SCRIPTS = [
 ];
 
 const REQUIRED_PERSONAS = ['logic-adversary.md', 'architect.md'];
-const REQUIRED_RUBRICS = ['logic-constitution-v1.md'];
+const REQUIRED_RUBRICS = ['logic-constitution-v1.md', 'logic-constitution-v2.md'];
 
 // ARCH-002 fix (2026-04-13): use shared parseArgs from flow-cli-utils
 const { parseArgs } = require('./flow-cli-utils');

package/scripts/hooks/core/session-context.js

@@ -812,6 +812,31 @@ function formatContextForInjection(context) {
   const ctx = context.context;
   let output = '## Wogi Flow Session Context\n\n';
 
+  // Post-restart continuity note (wf-39e9dc09 — Stop-hook triggered restart)
+  // If the most recent session in session-history.json was ended by
+  // task-boundary-restart and happened very recently, surface the resume
+  // token so the user/AI knows prior context is recoverable.
+  try {
+    const { getMostRecentPriorSession } = require('./session-history');
+    const prior = getMostRecentPriorSession(ctx?.cliSessionId);
+    if (prior && prior.endReason === 'task-boundary-restart') {
+      const endedAt = new Date(prior.endedAt).getTime();
+      const ageMinutes = (Date.now() - endedAt) / 60000;
+      // Only surface if the prior session ended in the last 24 hours —
+      // older entries are history, not active continuity signals.
+      if (ageMinutes < 60 * 24) {
+        output += `### Continuing from prior session (task-boundary restart)\n`;
+        output += `Prior Claude Code session ended ${ageMinutes < 1 ? 'just now' : `${ageMinutes.toFixed(1)}m ago`} after completing task **${prior.lastActiveTaskTitle || prior.tasksCompletedInSession?.[0] || 'unknown'}**.\n`;
+        output += `\n**Durable state survived.** Read \`.workflow/state/ready.json\`, \`decisions.md\`, \`feedback-patterns.md\`, \`request-log.md\` for canonical task/decision/activity history.\n`;
+        output += `\n**Prior conversation transcript is archived but not loaded.** To recover it if needed:\n`;
+        output += `\`\`\`bash\n${prior.resumeCommand}\n\`\`\`\n`;
+        output += `\nThis restart is normal — WogiFlow's task-boundary reset (\`config.taskBoundaryReset.enabled: true\`) recovered session-token budget by resetting context at the task boundary. Proceed with the user's next instruction; if they reference prior conversation you don't have, use the resume command above.\n\n`;
+      }
+    }
+  } catch (_err) {
+    // Non-critical — history file may not exist; continue with normal context
+  }
+
   // CRITICAL: CLAUDE_CODE_SIMPLE mode warning (highest priority)
   if (ctx.simpleModeWarning && ctx.simpleModeWarning.active) {
     output += `### CLAUDE_CODE_SIMPLE Mode Detected\n`;

package/scripts/hooks/core/session-history.js

@@ -0,0 +1,116 @@
+/**
+ * Wogi Flow - Session History
+ *
+ * Captures a lightweight digest of each Claude Code session BEFORE a
+ * task-boundary restart. After restart, the new session can read this
+ * history to know what the prior session did and, if needed, resume it
+ * via `claude --resume <cliSessionId>`.
+ *
+ * This is the "prior-session access" guarantee the user asked for after
+ * wf-39e9dc09 landed: state files preserve the durable outcomes, but
+ * sometimes you want the full prior conversation too. The resume token
+ * is the escape hatch.
+ *
+ * Storage: `.workflow/state/session-history.json`
+ *   {
+ *     "version": 1,
+ *     "sessions": [
+ *       {
+ *         "cliSessionId": "b92bc5e3-...",
+ *         "endedAt": "2026-04-15T09:40:49.293Z",
+ *         "endReason": "task-boundary-restart",
+ *         "tasksCompletedInSession": ["wf-00000001"],
+ *         "lastActiveTaskTitle": "TEST: trigger restart via flow done",
+ *         "resumeCommand": "claude --resume b92bc5e3-..."
+ *       },
+ *       ...
+ *     ]
+ *   }
+ *
+ * Capped at 20 entries (FIFO). Older entries archive-roll into
+ * `.workflow/archive/session-history-<date>.json`.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { PATHS, safeJsonParse, writeJson } = require('../../flow-utils');
+
+const HISTORY_FILE = 'session-history.json';
+const MAX_ENTRIES = 20;
+
+function getHistoryPath() {
+  return path.join(PATHS.state, HISTORY_FILE);
+}
+
+function readHistory() {
+  return safeJsonParse(getHistoryPath(), { version: 1, sessions: [] });
+}
+
+/**
+ * Append a session-end record. Called from Stop hook when a restart is about
+ * to fire, so the new session has a pointer to the ended session.
+ *
+ * @param {Object} entry
+ * @param {string} entry.cliSessionId
+ * @param {string} [entry.endReason='task-boundary-restart']
+ * @param {Array<string>} [entry.tasksCompletedInSession]
+ * @param {string} [entry.lastActiveTaskTitle]
+ * @returns {{ recorded: boolean, reason?: string }}
+ */
+function recordSessionEnd(entry) {
+  if (!entry || !entry.cliSessionId) {
+    return { recorded: false, reason: 'missing-cliSessionId' };
+  }
+  try {
+    const history = readHistory();
+    const record = {
+      cliSessionId: entry.cliSessionId,
+      endedAt: new Date().toISOString(),
+      endReason: entry.endReason || 'task-boundary-restart',
+      tasksCompletedInSession: Array.isArray(entry.tasksCompletedInSession)
+        ? entry.tasksCompletedInSession.slice(-20)
+        : [],
+      lastActiveTaskTitle: entry.lastActiveTaskTitle || null,
+      resumeCommand: `claude --resume ${entry.cliSessionId}`
+    };
+    history.sessions = history.sessions || [];
+    history.sessions.unshift(record);
+    // Cap FIFO
+    if (history.sessions.length > MAX_ENTRIES) {
+      history.sessions = history.sessions.slice(0, MAX_ENTRIES);
+    }
+    writeJson(getHistoryPath(), history);
+    return { recorded: true };
+  } catch (err) {
+    return { recorded: false, reason: `history-write-failed: ${err.message}` };
+  }
+}
+
+/**
+ * Get the most recent prior session (the one before this one).
+ * Returns null if the history is empty or only contains the current session.
+ *
+ * @param {string} [currentSessionId] — if provided, skip entries matching this ID
+ * @returns {Object|null}
+ */
+function getMostRecentPriorSession(currentSessionId) {
+  try {
+    const history = readHistory();
+    const sessions = history.sessions || [];
+    for (const s of sessions) {
+      if (currentSessionId && s.cliSessionId === currentSessionId) continue;
+      return s;
+    }
+    return null;
+  } catch (_err) {
+    return null;
+  }
+}
+
+module.exports = {
+  recordSessionEnd,
+  getMostRecentPriorSession,
+  readHistory,
+  getHistoryPath
+};

package/scripts/hooks/core/task-boundary-reset.js

@@ -0,0 +1,249 @@
+/**
+ * Wogi Flow - Task Boundary Reset (Core Module)
+ *
+ * Experimental, opt-in: on real WogiFlow task completion, write a restart flag
+ * and send SIGTERM to the parent Claude Code process. The wogi-claude wrapper
+ * detects the flag on claude's clean exit and relaunches with a fresh context,
+ * recovering the 10-20% of session tokens that prior conversation was burning.
+ *
+ * Design (two-phase, after empirical P11 failure on 2026-04-15):
+ *
+ *   Phase 1 — markRestartPending()
+ *     Called from task-completion sites (scripts/hooks/core/task-completed.js,
+ *     scripts/flow-done.js). Writes a small marker file under .workflow/state/.
+ *     No signals, no exits — just a durable "task is done; please restart at
+ *     the next safe boundary" note.
+ *
+ *   Phase 2 — consumeAndTriggerRestart()
+ *     Called from the Stop hook entry (scripts/hooks/entry/claude-code/stop.js),
+ *     which runs as a direct child of the claude process. If the pending marker
+ *     exists AND preconditions hold, the function writes the wrapper flag and
+ *     sends SIGTERM to ppid (claude). The wrapper restarts claude with a fresh
+ *     context.
+ *
+ * Why two phases?
+ *   The original single-phase design attached to Claude Code's TaskCompleted
+ *   event — which turned out not to fire for Task-tool subagent completions
+ *   despite an internal code comment claiming so. P11.1 (observed-behavior
+ *   evidence requirement) was added to the rubric after that failure. This
+ *   redesign uses Stop hook + marker file because the Stop hook is directly
+ *   observed firing in Claude Code sessions and is a verified child of the
+ *   claude process.
+ *
+ * Preconditions (Phase 2 only; Phase 1 is always safe to write):
+ *   1. config.taskBoundaryReset.enabled === true
+ *   2. process.env.WOGI_WRAPPER_PID is set (wogi-claude wrapper is present)
+ *   3. process.env.WOGI_RESTART_FLAG is set
+ *   4. The task-just-completed marker file exists
+ *
+ * If any precondition fails in Phase 2: no-op. The marker stays in place for
+ * a future Stop-hook invocation, or is cleaned up on session-end.
+ *
+ * Rollback: set config.taskBoundaryReset.enabled = false. Phase 1 still writes
+ * the marker (cheap, harmless); Phase 2 no-ops. No state-file corruption.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { getConfig, PATHS } = require('../../flow-utils');
+
+const PENDING_MARKER_FILE = 'task-just-completed';
+
+/**
+ * Locate the pending-marker file path inside .workflow/state/.
+ * @returns {string}
+ */
+function getPendingMarkerPath() {
+  return path.join(PATHS.state, PENDING_MARKER_FILE);
+}
+
+/**
+ * Phase 1 — mark that a task just completed and a restart is desired at the
+ * next Stop-hook boundary. Safe to call even when the feature is disabled;
+ * Phase 2 is what checks the config.
+ *
+ * @param {Object} ctx
+ * @param {string} ctx.taskId
+ * @param {string} [ctx.taskTitle]
+ * @param {string} [ctx.source]   where the call came from, for telemetry
+ * @returns {{ marked: boolean, markerPath?: string, reason?: string }}
+ */
+function markRestartPending(ctx) {
+  try {
+    const markerPath = getPendingMarkerPath();
+    fs.mkdirSync(path.dirname(markerPath), { recursive: true });
+    const payload = {
+      version: 1,
+      taskId: ctx?.taskId || null,
+      taskTitle: ctx?.taskTitle || null,
+      source: ctx?.source || 'unspecified',
+      markedAt: new Date().toISOString()
+    };
+    fs.writeFileSync(markerPath, JSON.stringify(payload, null, 2));
+    return { marked: true, markerPath };
+  } catch (err) {
+    return { marked: false, reason: `marker-write-failed: ${err.message}` };
+  }
+}
+
+/**
+ * Check whether the Phase-2 preconditions hold.
+ * @returns {{ ready: boolean, reason?: string, flagPath?: string, parentPid?: number }}
+ */
+function checkPreconditions() {
+  try {
+    const config = getConfig();
+    const tbr = config.taskBoundaryReset || {};
+    if (tbr.enabled !== true) {
+      return { ready: false, reason: 'disabled-by-config' };
+    }
+
+    const wrapperPid = process.env.WOGI_WRAPPER_PID;
+    if (!wrapperPid) {
+      return { ready: false, reason: 'no-wrapper-pid' };
+    }
+
+    const flagPath = process.env.WOGI_RESTART_FLAG;
+    if (!flagPath) {
+      return { ready: false, reason: 'no-flag-path' };
+    }
+
+    const parentPid = process.ppid;
+    if (!parentPid || typeof parentPid !== 'number') {
+      return { ready: false, reason: 'no-parent-pid' };
+    }
+
+    return { ready: true, flagPath, parentPid };
+  } catch (err) {
+    return { ready: false, reason: `config-error: ${err.message}` };
+  }
+}
+
+/**
+ * Phase 2 — called by the Stop hook entry (direct child of claude). If
+ * preconditions pass AND the pending marker exists, consume the marker, write
+ * the wrapper flag, and SIGTERM claude. Wrapper restarts.
+ *
+ * Returns a result object for diagnostics; never throws. If something goes
+ * wrong, the Stop hook should continue with its normal flow.
+ *
+ * @returns {{ triggered: boolean, reason?: string, flagPath?: string, parentPid?: number }}
+ */
+function consumeAndTriggerRestart() {
+  const markerPath = getPendingMarkerPath();
+  if (!fs.existsSync(markerPath)) {
+    return { triggered: false, reason: 'no-pending-marker' };
+  }
+
+  const pre = checkPreconditions();
+  if (!pre.ready) {
+    if (process.env.DEBUG) {
+      console.error(`[task-boundary-reset] phase-2 skip: ${pre.reason}`);
+    }
+    return { triggered: false, reason: pre.reason };
+  }
+
+  // Consume the marker. Do this BEFORE signaling so we never double-fire if
+  // for some reason the signal delivery is delayed and a second Stop-hook
+  // invocation races through.
+  let markerPayload = null;
+  try {
+    markerPayload = JSON.parse(fs.readFileSync(markerPath, 'utf-8'));
+  } catch (_err) { /* payload read is optional */ }
+  try {
+    fs.unlinkSync(markerPath);
+  } catch (err) {
+    // If we can't even delete the marker, something is wrong with the
+    // filesystem. Abort before signaling so we don't cause a thrash.
+    return { triggered: false, reason: `marker-unlink-failed: ${err.message}` };
+  }
+
+  // Write the wrapper's restart-requested flag with a copy of the marker
+  // payload for diagnostic context.
+  const flagPayload = {
+    version: 1,
+    reason: 'task-boundary',
+    ...(markerPayload || {}),
+    triggeredAt: new Date().toISOString(),
+    wrapperPid: process.env.WOGI_WRAPPER_PID
+  };
+  try {
+    const dir = path.dirname(pre.flagPath);
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(pre.flagPath, JSON.stringify(flagPayload, null, 2));
+  } catch (err) {
+    return { triggered: false, reason: `flag-write-failed: ${err.message}` };
+  }
+
+  // SIGTERM our parent (claude). The wrapper sees the flag on claude's exit
+  // and restarts. If SIGTERM turns out to not shut claude down cleanly in
+  // real testing, try SIGHUP or SIGINT as fallbacks (see spec wf-39e9dc09).
+  try {
+    process.kill(pre.parentPid, 'SIGTERM');
+  } catch (err) {
+    // Kill failed — clean up the flag so the wrapper doesn't try to restart
+    // a claude that is still alive and may produce more output.
+    try { fs.unlinkSync(pre.flagPath); } catch (_err) { /* best effort */ }
+    return { triggered: false, reason: `sigterm-failed: ${err.message}` };
+  }
+
+  return {
+    triggered: true,
+    flagPath: pre.flagPath,
+    parentPid: pre.parentPid
+  };
+}
+
+/**
+ * Convenience: whether a pending marker currently exists. Diagnostic only.
+ * @returns {boolean}
+ */
+function hasPendingMarker() {
+  try {
+    return fs.existsSync(getPendingMarkerPath());
+  } catch (_err) {
+    return false;
+  }
+}
+
+module.exports = {
+  // Phase 1 — called from task-completion code paths
+  markRestartPending,
+
+  // Phase 2 — called from the Stop hook entry
+  consumeAndTriggerRestart,
+
+  // Diagnostics
+  checkPreconditions,
+  hasPendingMarker,
+  getPendingMarkerPath,
+
+  // Back-compat: earlier code calls this name. Route it to Phase 1 so existing
+  // wiring in task-completed.js still does the right thing (mark the marker,
+  // don't SIGTERM yet). A later refactor can remove this alias.
+  maybeTriggerRestart: markRestartPending
+};
+
+// CLI smoke-check: `node scripts/hooks/core/task-boundary-reset.js <cmd>`
+if (require.main === module) {
+  const arg = process.argv[2];
+  if (arg === 'check') {
+    console.log(JSON.stringify(checkPreconditions(), null, 2));
+    process.exit(0);
+  }
+  if (arg === 'has-pending') {
+    console.log(JSON.stringify({ hasPendingMarker: hasPendingMarker() }, null, 2));
+    process.exit(0);
+  }
+  if (arg === 'mark') {
+    console.log(JSON.stringify(markRestartPending({ source: 'cli-test' }), null, 2));
+    process.exit(0);
+  }
+  if (arg === 'consume') {
+    console.log(JSON.stringify(consumeAndTriggerRestart(), null, 2));
+    process.exit(0);
+  }
+  console.log('Usage: node task-boundary-reset.js <check|has-pending|mark|consume>');
+  process.exit(2);
+}

package/scripts/hooks/core/task-completed.js

@@ -500,6 +500,41 @@ async function handleTaskCompleted(input) {
     } catch (_err) {
       // Non-critical — pending module may not be available
     }
+
+    // Task-boundary session restart (wf-39e9dc09) — experimental, opt-in.
+    // MUST run AFTER all state-write cleanup above. No-ops unless:
+    //   1. config.taskBoundaryReset.enabled === true
+    //   2. WOGI_WRAPPER_PID env var is set (proves wogi-claude wrapper is running us)
+    //   3. WOGI_RESTART_FLAG env var is set
+    //   4. Task completed cleanly (result.completed === true)
+    //
+    // When triggered, writes a restart-flag file and sends SIGTERM to our parent
+    // (Claude Code). The wrapper sees the flag on claude's clean exit and
+    // restarts with a fresh context. State files are already flushed to disk.
+    if (result.completed && completedTask?.id) {
+      try {
+        const { maybeTriggerRestart } = require('./task-boundary-reset');
+        const restartResult = maybeTriggerRestart({
+          taskId: completedTask.id,
+          taskTitle: completedTask.title
+        });
+        if (restartResult.triggered) {
+          result.taskBoundaryRestart = {
+            triggered: true,
+            flagPath: restartResult.flagPath
+          };
+          result.message = (result.message || '') +
+            ' [Task-boundary restart triggered — session will restart on clean exit]';
+        } else if (process.env.DEBUG) {
+          console.error(`[Task Completed] Restart skipped: ${restartResult.reason}`);
+        }
+      } catch (err) {
+        // Fail-open — restart failure must not block task completion
+        if (process.env.DEBUG) {
+          console.error(`[Task Completed] Restart module error: ${err.message}`);
+        }
+      }
+    }
   } catch (err) {
     result.message = `Task completed handler error: ${err.message}`;
   }

package/scripts/hooks/entry/claude-code/stop.js

@@ -120,6 +120,69 @@ runHook('Stop', async ({ parsedInput }) => {
     }
   }
 
+  // Task-boundary session restart (wf-39e9dc09 — Phase 2, Stop-hook pivot).
+  // Runs BEFORE checkLoopExit so we can SIGTERM cleanly if a task was just
+  // completed. This is a verified direct child of the claude process (the
+  // Stop hook fires reliably — directly observed in test run 2026-04-15,
+  // unlike TaskCompleted which was found not to fire for Task-tool subagents).
+  // No-op unless task-just-completed marker exists AND feature is enabled
+  // AND wogi-claude wrapper env is present.
+  try {
+    const { consumeAndTriggerRestart, hasPendingMarker } = require('../../core/task-boundary-reset');
+
+    // If we're about to restart, record the session in history FIRST so the
+    // new session can find the prior session's resume token. Use parsedInput
+    // or session-state for the cliSessionId.
+    if (hasPendingMarker()) {
+      try {
+        const { recordSessionEnd } = require('../../core/session-history');
+        let cliSessionId = parsedInput?.sessionId || null;
+        if (!cliSessionId) {
+          // Fallback: read from session-state.json
+          const { PATHS, safeJsonParse } = require('../../../flow-utils');
+          const path = require('node:path');
+          const ss = safeJsonParse(path.join(PATHS.state, 'session-state.json'), {});
+          cliSessionId = ss.cliSessionId || null;
+        }
+        if (cliSessionId) {
+          // Collect tasks completed in this session from recentlyCompleted
+          // (best-effort — not all of these are from THIS session but it's
+          // a reasonable approximation; in practice the newest entries are ours)
+          const { PATHS, safeJsonParse } = require('../../../flow-utils');
+          const path = require('node:path');
+          const ready = safeJsonParse(path.join(PATHS.state, 'ready.json'), {});
+          const recent = ready.recentlyCompleted || [];
+          const lastCompleted = recent[0] || null;
+          recordSessionEnd({
+            cliSessionId,
+            endReason: 'task-boundary-restart',
+            tasksCompletedInSession: recent.slice(0, 5).map(t => t.id).filter(Boolean),
+            lastActiveTaskTitle: lastCompleted?.title || null
+          });
+        }
+      } catch (err) {
+        if (process.env.DEBUG) {
+          console.error(`[Stop] Session history record failed (non-fatal): ${err.message}`);
+        }
+      }
+    }
+
+    const restartResult = consumeAndTriggerRestart();
+    if (restartResult.triggered && process.env.DEBUG) {
+      console.error(`[Stop] Task-boundary restart triggered — claude will exit, wrapper will relaunch`);
+    } else if (!restartResult.triggered && restartResult.reason !== 'no-pending-marker' && process.env.DEBUG) {
+      console.error(`[Stop] Task-boundary restart check: ${restartResult.reason}`);
+    }
+    // If we SIGTERM'd our parent, the process will begin shutting down. Still
+    // return the normal Stop-hook result so any in-flight return value flows
+    // back to claude before the signal is handled.
+  } catch (err) {
+    if (process.env.DEBUG) {
+      console.error(`[Stop] Task-boundary restart module error (fail-open): ${err.message}`);
+    }
+    // Never block Stop on restart-module errors.
+  }
+
   // Check if loop can exit
   return await checkLoopExit();
 }, { failMode: 'warn', failOutput: { continue: false } });