ci(bench): permit workflow_dispatch for representative benchmark runs

Reviewed-on: conductor/rune#172

.gitea/ISSUE_TEMPLATE/bug.md

@@ -32,6 +32,22 @@ assignees: conductor
 ## Steps to reproduce
 <!-- How to trigger the bug -->
 
+
+## Cognitive invariants (memory/cognition issues — both handoffs)
+<!-- Complete ONLY if this issue touches memory, learning, or self-model state. -->
+- [ ] **Owner** — which existing subsystem owns this (audit before creating modules)
+- [ ] **Trigger** — what event activates it
+- [ ] **Read/write authority** — which canonical state it reads/changes
+- [ ] **Provenance** — derived state traceable to evidence
+- [ ] **Verification** — how we know the change helped
+- [ ] **Failure visibility** — how failure surfaces
+- [ ] **Reversibility** — bad learned state can be superseded/replayed/rolled back
+- [ ] **Dormant cost** — what it costs when irrelevant
+- [ ] **Benchmark + ablation** — what measurable behaviour improves; what happens when disabled
+- [ ] **No duplicate authority** — why extend vs create
+
+Hard invariants: derived cognition preserves evidentiary ancestry · epistemic confidence ≠ attentional utility ≠ current applicability · retrieval never increases utility · self-model-induced behaviour is not independent evidence · historical truth survives present-state change · raw evidence is never destroyed by promotion.
+
 ## Related umbrella
 - [ ] Memory
 - [ ] Governance
@@ -41,7 +57,9 @@ assignees: conductor
 - [ ] Infrastructure
 - [ ] Orchestration
 
-## Priority
-- [ ] High — system broken
-- [ ] Medium — workaround exists
-- [ ] Low — cosmetic
+## Priority (REQUIRED — the priority gate)
+<!-- Pick exactly one. An issue without a priority is not filed. -->
+- [ ] **P0 — critical** — breaks the spine / core correctness, or blocks other work
+- [ ] **P1 — high** — material user value or a real defect (money, correctness bugs, next-stage dependency)
+- [ ] **P2 — medium** — quality/consolidation improvement (check the fold-into mapping first)
+- [ ] **P3 — low** — measurement / benchmark / deferred policy

.gitea/ISSUE_TEMPLATE/feature.md

@@ -37,6 +37,22 @@ DEPENDENCIES — parent epic + preceding stage/plan refs. -->
 - [ ] Canary passes (name)
 - [ ] Closed with a properly formatted closing comment + commit/PR references
 
+
+## Cognitive invariants (memory/cognition issues — both handoffs)
+<!-- Complete ONLY if this issue touches memory, learning, or self-model state. -->
+- [ ] **Owner** — which existing subsystem owns this (audit before creating modules)
+- [ ] **Trigger** — what event activates it
+- [ ] **Read/write authority** — which canonical state it reads/changes
+- [ ] **Provenance** — derived state traceable to evidence
+- [ ] **Verification** — how we know the change helped
+- [ ] **Failure visibility** — how failure surfaces
+- [ ] **Reversibility** — bad learned state can be superseded/replayed/rolled back
+- [ ] **Dormant cost** — what it costs when irrelevant
+- [ ] **Benchmark + ablation** — what measurable behaviour improves; what happens when disabled
+- [ ] **No duplicate authority** — why extend vs create
+
+Hard invariants: derived cognition preserves evidentiary ancestry · epistemic confidence ≠ attentional utility ≠ current applicability · retrieval never increases utility · self-model-induced behaviour is not independent evidence · historical truth survives present-state change · raw evidence is never destroyed by promotion.
+
 ## Related umbrella
 - [ ] Memory
 - [ ] Governance
@@ -48,7 +64,9 @@ DEPENDENCIES — parent epic + preceding stage/plan refs. -->
 - [ ] Custodian
 - [ ] Orchestration
 
-## Priority
-- [ ] High — blocks other work
-- [ ] Medium — improves quality of life
-- [ ] Low — nice to have
+## Priority (REQUIRED — the priority gate)
+<!-- Pick exactly one. An issue without a priority is not filed. -->
+- [ ] **P0 — critical** — breaks the spine / core correctness, or blocks other work
+- [ ] **P1 — high** — material user value or a real defect (money, correctness bugs, next-stage dependency)
+- [ ] **P2 — medium** — quality/consolidation improvement (check the fold-into mapping first)
+- [ ] **P3 — low** — measurement / benchmark / deferred policy

.gitea/workflows/auto-backup.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   backup:
-    runs-on: self-hosted
+    runs-on: rune-infra-pi
     steps:
       # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

.gitea/workflows/auto-label.yml

@@ -2,11 +2,47 @@ name: Auto-label
 
 on:
   issues:
-    types: [opened, edited]
+    types: [opened, edited, labeled]
   pull_request:
     types: [opened, edited]
 
 jobs:
+  # PRIORITY GATE (2026-09-04): every issue must carry exactly one of
+  # P0/P1/P2/P3. An issue that lands without one gets 'unprioritized' +
+  # a demand comment — filing is not complete until prioritized.
+  priority-gate:
+    if: github.event_name == 'issues' && github.event.action != 'labeled'
+    runs-on: self-hosted
+    steps:
+      - name: Enforce priority label
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const issue = context.payload.issue;
+            if (!issue) return;
+            const labels = (issue.labels || []).map(l => l.name);
+            const priorities = ['P0 — critical', 'P1 — high', 'P2 — medium', 'P3 — low'];
+            const has = labels.filter(l => priorities.includes(l));
+            if (has.length >= 1) {
+              // Prioritized — clear the flag if it was set.
+              if (labels.includes('unprioritized')) {
+                await github.rest.issues.removeLabel({
+                  owner: context.repo.owner, repo: context.repo.repo,
+                  issue_number: issue.number, name: 'unprioritized',
+                }).catch(e => { if (e.status !== 404) throw e; });
+              }
+              return;
+            }
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner, repo: context.repo.repo,
+              issue_number: issue.number, labels: ['unprioritized'],
+            });
+            await github.rest.issues.createComment({
+              owner: context.repo.owner, repo: context.repo.repo,
+              issue_number: issue.number,
+              body: `⚠️ **Priority gate:** this issue has no priority. Assign exactly one of **P0 — critical** (spine/correctness/blocks), **P1 — high** (material value or real defect), **P2 — medium** (quality/consolidation), **P3 — low** (measurement/deferred). An issue without a priority is not filed.`,
+            });
+
   auto-label:
     runs-on: self-hosted
     steps:

.gitea/workflows/auto-update-gitea.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   update-gitea:
-    runs-on: self-hosted
+    runs-on: rune-infra-pi
     steps:
       - name: Check current Gitea version
         id: current

.gitea/workflows/auto-version.yml

@@ -9,20 +9,27 @@ permissions: write-all
 
 jobs:
   release:
-    if: gitea.event.pull_request.merged == true
     runs-on: self-hosted
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
+      - name: Skip if PR is not merged
+        run: |
+          MERGED="${{ gitea.event.pull_request.merged }}"
+          if [ "$MERGED" != "true" ]; then
+            echo "PR not merged — skipping release"
+            exit 0
+          fi
+
       - name: Read reviewed semantic version
         run: |
           VERSION=$(python3 -c 'import re; text=open("src/rune/__init__.py").read(); print(re.search(r"__version__ = \"([0-9]+\.[0-9]+\.[0-9]+)\"", text).group(1))')
           echo "RELEASE_VERSION=$VERSION" >> "$GITHUB_ENV"
           echo "Release version: $VERSION"
 
-      - name: Verify version was bumped since last tag
+      - name: Auto-bump if the PR did not carry a version bump
         run: |
           LATEST=$(git tag --sort=-v:refname | head -1 | sed 's/^v//')
           if [ -z "$LATEST" ]; then
@@ -30,11 +37,25 @@ jobs:
             exit 0
           fi
           if [ "$LATEST" = "$RELEASE_VERSION" ]; then
-            echo "::error::Version $RELEASE_VERSION was already released (tag v$LATEST)."
-            echo "::error::Semver bump missing from this PR: add a 'chore(release): bump version to X.Y.Z' commit that increments src/rune/__init__.py, then merge again."
-            exit 1
+            echo "PR did not bump the version — auto-bumping patch on master (Nick directive: bumping is automatic from the Gitea end)."
+            NEW=$(python3 -c "import sys; major,minor,patch='$RELEASE_VERSION'.split('.'); print(f'{major}.{minor}.{int(patch)+1}')")
+            echo "Auto-bump: $RELEASE_VERSION -> $NEW"
+            # Update all five version surfaces
+            sed -i "s/__version__ = \"$RELEASE_VERSION\"/__version__ = \"$NEW\"/" src/rune/__init__.py
+            sed -i "s/Version: v$RELEASE_VERSION/Version: v$NEW/" src/rune/rune_tui.py
+            sed -i "s/Rune v$RELEASE_VERSION |/Rune v$NEW |/" src/rune/rune_tui.py
+            sed -i "s/\"$RELEASE_VERSION\"/\"$NEW\"/" src/rune/canary_gitea_automation.py
+            sed -i "s/v$RELEASE_VERSION/v$NEW/" README.md
+            git config user.name "conductor"
+            git config user.email "nick@thingscouldgetdicey.online"
+            git add -A
+            git commit -m "chore(release): auto-bump version to $NEW (post-merge automation)"
+            git push origin master
+            echo "RELEASE_VERSION=$NEW" >> "$GITHUB_ENV"
+            echo "AUTO_BUMPED=true" >> "$GITHUB_ENV"
+          else
+            echo "New version $RELEASE_VERSION (last tag v$LATEST) — bump rode the PR"
           fi
-          echo "New version $RELEASE_VERSION (last tag v$LATEST)"
 
       - name: Create release from merged pull request
         env:

.gitea/workflows/ci.yml

@@ -4,19 +4,20 @@ on:
   push:
   pull_request:
     branches: [master]
+  workflow_dispatch:  # benchmark: run representative CI without manufacturing commits
 
 jobs:
   lint:
-    runs-on: self-hosted
+    runs-on: rune-ci-desktop
     steps:
       # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           fetch-depth: 0
-      - name: Create isolated lint environment
+      - name: Create lint environment from manifest
         run: |
           python3 -m venv .ci-venv
-          .ci-venv/bin/pip install --disable-pip-version-check ruff==0.16.4
+          .ci-venv/bin/pip install --disable-pip-version-check -e ".[dev]"
       - name: Reject syntax and undefined-name errors
         run: |
           BASE=$(python3 -c 'import json, os; event=json.load(open(os.environ["GITHUB_EVENT_PATH"])); print(event.get("pull_request", {}).get("base", {}).get("sha") or event.get("before") or "")')
@@ -36,82 +37,39 @@ jobs:
           if [ "${#ADDED_PYTHON[@]}" -gt 0 ]; then
             .ci-venv/bin/ruff format --check "${ADDED_PYTHON[@]}"
           fi
+      - name: Structural contract (henxels)
+        run: |
+          .ci-venv/bin/henxels check --all --plain
 
   unit-tests:
-    runs-on: self-hosted
+    runs-on: rune-ci-desktop
     steps:
       # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - name: Create isolated test environment
+      - name: Create test environment from manifest
         run: |
           python3 -m venv .test-venv
-          .test-venv/bin/pip install --disable-pip-version-check pytest==9.0.3 textual==8.2.0
+          .test-venv/bin/pip install --disable-pip-version-check -e ".[dev,memory]"
       - name: Test local tools and interstitial message objects
         run: |
-          PYTHONPATH=src:. .test-venv/bin/python -m pytest -q \
-            tests/test_build_pipeline_policy.py \
-            tests/test_tool_protocol.py \
-            tests/test_local_tool_runtime.py \
-            tests/test_tool_authority.py \
-            tests/test_rune_operator_tools.py \
-            tests/test_runtime_architecture_characterization.py \
-            tests/test_message_widgets.py \
-            tests/test_v1_authority_map.py \
-            tests/test_orchestration_records.py \
-            tests/test_orchestration_event_store.py \
-            tests/test_orchestration_evidence.py \
-            tests/test_orchestration_projection.py \
-            tests/test_orchestration_composition.py \
-            tests/test_orchestration_selector.py \
-            tests/test_orchestration_bus.py \
-            tests/test_orchestration_benchmark.py \
-            tests/test_orchestration_fixtures.py \
-            tests/test_orchestration_canary.py \
-            tests/test_orchestration_cadence.py \
-            tests/test_orchestration_no_change.py \
-            tests/test_orchestration_reflex.py \
-            tests/test_orchestration_proposals.py \
-            tests/test_orchestration_workers.py \
-            tests/test_orchestration_deadline.py \
-            tests/test_orchestration_health.py \
-            tests/test_orchestration_cognitive.py \
-            tests/test_orchestration_resources.py \
-            tests/test_orchestration_eligibility.py \
-            tests/test_orchestration_router.py \
-            tests/test_orchestration_scheduler.py \
-            tests/test_orchestration_broker.py \
-            tests/test_orchestration_authority.py \
-            tests/test_orchestration_memory.py \
-            tests/test_orchestration_cursor.py \
-            tests/test_orchestration_chain.py \
-            tests/test_orchestration_budget.py \
-            tests/test_orchestration_atomic.py \
-            tests/test_orchestration_memory_synthesis.py \
-            tests/test_orchestration_outbox.py \
-            tests/test_orchestration_lifecycle.py \
-            tests/test_orchestration_delegation.py \
-            tests/test_orchestration_reconciler.py \
-            tests/test_orchestration_transport.py \
-            tests/test_orchestration_gitea_delegation.py \
-            tests/test_orchestration_surface.py \
-            tests/test_orchestration_capability.py \
-            tests/test_orchestration_mapping.py \
-            tests/test_orchestration_gateway.py \
-            tests/test_orchestration_surface_gateway.py \
-            tests/test_orchestration_migrate.py \
-            tests/test_legacy_event_envelope.py \
-            tests/test_legacy_event_bus.py \
-            tests/test_legacy_pins.py \
-            tests/test_orchestration_migration_canary.py
+          PYTHONPATH=src:. .test-venv/bin/python -m pytest tests/ -q
 
   canary:
-    runs-on: self-hosted
+    runs-on: rune-ci-desktop
     env:
       RUNE_HOME: /tmp/rune-ci-${{ github.run_id }}
       RUNE_MEMORY_DIR: /tmp/rune-ci-${{ github.run_id }}/memory
     steps:
       # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - name: Create canary environment
+        run: |
+          python3 -m venv .canary-venv
+          .canary-venv/bin/pip install --disable-pip-version-check textual==8.2.8 textual-autocomplete==4.0.6 sqlite-vec 2>/dev/null || true
+      - name: Create canary environment from manifest
+        run: |
+          python3 -m venv .canary-venv
+          .canary-venv/bin/pip install --disable-pip-version-check -e ".[dev,memory]"
       - name: Run canary suite
         run: |
           FAILED=0
@@ -121,15 +79,24 @@ jobs:
             src/rune/canary_gitea_automation.py \
             src/rune/canary_tui_drift.py \
             src/rune/canary_orchestration_foundation.py \
+            src/rune/canary_conversation_state.py \
             src/rune/canary_cognitive_strata.py \
             src/rune/canary_resource_authority.py \
             src/rune/canary_memory_synthesis.py \
             src/rune/canary_gitea_delegation.py \
             src/rune/canary_surface_parity.py \
-            src/rune/canary_schema_migration.py; do
+            src/rune/canary_schema_migration.py \
+            src/rune/canary_context_broker.py \
+            src/rune/canary_p0_04.py \
+            src/rune/canary_p0_05.py \
+            src/rune/canary_p0_07.py \
+            src/rune/canary_query_memory.py \
+            src/rune/canary_unbounded.py \
+            src/rune/canary_full_system.py \
+            src/rune/canary_native.py; do
             CANARY_COUNT=$((CANARY_COUNT + 1))
             echo "Running $canary..."
-            python3 "$canary" || FAILED=$((FAILED + 1))
+            .canary-venv/bin/python "$canary" || FAILED=$((FAILED + 1))
           done
           if [ "$CANARY_COUNT" -eq 0 ]; then
             echo "FAILED: no canaries discovered"
@@ -149,7 +116,7 @@ jobs:
           esac
 
   best-practices:
-    runs-on: self-hosted
+    runs-on: rune-ci-desktop
     steps:
       # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -173,7 +140,7 @@ jobs:
           echo "  $COUNT TODO/FIXME items found"
 
   documentation:
-    runs-on: self-hosted
+    runs-on: rune-ci-desktop
     steps:
       # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -203,8 +170,20 @@ jobs:
               print('WARNING: Less than 50% documentation coverage')
           "
 
+  type-check:
+    runs-on: rune-ci-desktop
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - name: Create type-check environment from manifest
+        run: |
+          python3 -m venv .type-venv
+          .type-venv/bin/pip install --disable-pip-version-check -e ".[dev,memory]"
+      - name: Type-check with ratchet
+        run: |
+          .type-venv/bin/python scripts/type_check_ratchet.py
+
   gitea-offline:
-    runs-on: self-hosted
+    runs-on: rune-ci-desktop
     steps:
       # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -216,8 +195,10 @@ jobs:
 
   required-checks:
     if: gitea.event_name == 'pull_request'
-    runs-on: self-hosted
-    needs: [lint, unit-tests, canary, best-practices, documentation, gitea-offline]
+    runs-on: rune-ci-desktop
+    # #148: type-check MUST gate the protected status — a red type-check job
+    # previously left the protected merge gate green (dependency-chain hole).
+    needs: [lint, unit-tests, canary, best-practices, documentation, type-check, gitea-offline]
     steps:
       - name: Publish protected-branch gate
         run: echo "All required CI checks passed"

.gitea/workflows/pipeline-gate.yml

@@ -0,0 +1,156 @@
+name: Pipeline Order Gate
+
+on:
+  issues:
+    types: [labeled, closed]
+  schedule:
+    # Hourly sweep: catches newly-eligible issues when a dependency closed
+    # while the teacher was down/not yet deployed (temporal gap fix).
+    - cron: '23 * * * *'
+  workflow_dispatch:
+
+permissions: write-all
+
+jobs:
+  # CHECK half: labeling an issue `ready` is only honored when every
+  # `Depends on: #N` reference in its body is CLOSED. Otherwise Gitea
+  # blocks the stage (removes ready, adds blocked, names the blocker).
+  gate:
+    runs-on: self-hosted
+    steps:
+      - name: Verify dependency order before allowing ready
+        uses: actions/github-script@v7
+        with:
+          script: |
+            // This Gitea emits 'label_updated' (not 'labeled') when a label
+            // is added, and the added label name arrives via
+            // context.payload.label — handle both spellings plus the
+            // label-adds via the issue's current labels.
+            const action = context.payload.action;
+            const addedLabel = context.payload.label?.name;
+            if (action !== 'labeled' && action !== 'label_updated') {
+              core.info(`gate: action=${action} — not a label event; skip`);
+              return;
+            }
+            const issue = context.payload.issue;
+            const hasReady = (issue.labels || []).some(l => l.name === 'ready');
+            if (addedLabel !== 'ready' && !hasReady) {
+              core.info(`gate: label=${addedLabel} — issue ${issue.number} has no ready label; skip`);
+              return;
+            }
+            if (addedLabel && addedLabel !== 'ready') {
+              core.info(`gate: label=${addedLabel} added (not ready) — skip`);
+              return;
+            }
+            const body = issue.body || '';
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const deps = [...body.matchAll(/Depends on:\s*#(\d+)/gi)].map(m => parseInt(m[1], 10));
+            const uniqueDeps = [...new Set(deps)];
+            const openDeps = [];
+            for (const n of uniqueDeps) {
+              try {
+                const res = await github.rest.issues.get({ owner, repo, issue_number: n });
+                if (res.data.state === 'open') openDeps.push(n);
+              } catch (e) {
+                core.warning(`Depends-on #${n} not found (${e.status}) — treating as open`);
+                openDeps.push(n);
+              }
+            }
+            if (openDeps.length === 0) {
+              await github.rest.issues.createComment({
+                owner, repo, issue_number: issue.number,
+                body: `🟢 **READY — order satisfied; Rune may start.** Dependencies: ${uniqueDeps.length ? uniqueDeps.map(n => '#' + n).join(', ') : 'none'}.`,
+              });
+              return;
+            }
+            // Block: remove ready, add blocked, name the blockers.
+            try {
+              await github.rest.issues.removeLabel({
+                owner, repo, issue_number: issue.number, name: 'ready',
+              });
+            } catch (e) { if (e.status !== 404) throw e; }
+            await github.rest.issues.addLabels({
+              owner, repo, issue_number: issue.number, labels: ['blocked'],
+            });
+            await github.rest.issues.createComment({
+              owner, repo, issue_number: issue.number,
+              body: `⛔ **Blocked** — dependencies still open: ${openDeps.map(n => '#' + n).join(', ')}. The \`ready\` label was removed; re-apply it once the blockers close.`,
+            });
+
+  # TEACH half: when an issue CLOSES, announce the next ready-eligible
+  # issue (open, has the orchestration-stage marker in its body, all deps
+  # closed) and label it ready — the order teacher keeps Rune on task.
+  teach:
+    runs-on: self-hosted
+    steps:
+      - name: Announce the next issue in dependency order
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const action = context.payload.action;
+            // Allow: close events + scheduled sweeps + manual dispatch.
+            // Skip: label events (the gate handles those).
+            if (action && action !== 'closed') {
+              core.info(`teach: action=${action} — not a close or sweep; skip`);
+              return;
+            }
+            if (!action) {
+              core.info('teach: scheduled sweep or manual dispatch — checking all open issues');
+            }
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            // PAGINATE (fix): Gitea caps per_page (~50) — asking for 100
+            // silently truncated the list, dropping open dependencies from
+            // the map and making them look 'closed'. Walk all pages.
+            const issues = [];
+            for (let page = 1; ; page++) {
+              const res = await github.rest.issues.listForRepo({
+                owner, repo, state: 'open', per_page: 50, page,
+              });
+              const batch = res.data.filter(i => !i.pull_request);
+              issues.push(...batch);
+              if (batch.length < 50) break;
+            }
+            const byNumber = new Map(issues.map(i => [i.number, i]));
+            const depsOf = (body) =>
+              [...(body || '').matchAll(/Depends on:\s*#(\d+)/gi)].map(m => parseInt(m[1], 10));
+            // Eligible: open, not blocked, all deps closed (deps that are not
+            // open issues count as closed — merged PRs/closed stages).
+            const eligible = [];
+            for (const i of issues) {
+              if (i.labels.some(l => l.name === 'blocked')) continue;
+              const deps = depsOf(i.body);
+              const unsatisfied = [];
+              for (const n of deps) {
+                const dep = byNumber.get(n);
+                if (dep) { unsatisfied.push(n); continue; } // open issue
+                // Not in the open list -> probably closed, but VERIFY:
+                // a truncated fetch must never look like 'closed'.
+                try {
+                  const r = await github.rest.issues.get({
+                    owner, repo, issue_number: n,
+                  });
+                  if (r.data.state === 'open') unsatisfied.push(n);
+                } catch (e) {
+                  core.warning(`Depends-on #${n} not found (${e.status}) — treating as unsatisfied`);
+                  unsatisfied.push(n);
+                }
+              }
+              if (unsatisfied.length === 0) eligible.push(i);
+            }
+            if (eligible.length === 0) {
+              core.info('No ready-eligible open issues.');
+              return;
+            }
+            // Announce the lowest-numbered eligible issue (stable order).
+            eligible.sort((a, b) => a.number - b.number);
+            const next = eligible[0];
+            await github.rest.issues.addLabels({
+              owner, repo, issue_number: next.number, labels: ['ready'],
+            }).catch(e => { if (e.status !== 404) throw e; });
+            await github.rest.issues.createComment({
+              owner, repo, issue_number: next.number,
+              body: (() => { const closed = context.payload.issue ? ' (closed: #' + context.payload.issue.number + ')' : ' (scheduled sweep)'; return `🎓 **NEXT: #${next.number} — ${next.title}** — dependencies satisfied${closed}; Rune may start.`; })(),
+            });
+            core.info(`Announced #${next.number} as next.`);

.gitignore

@@ -10,3 +10,4 @@ build/
 *.log
 .env
 .venv/
+state/

AGENTS.md

@@ -0,0 +1,35 @@
+<!-- henxels:begin -->
+
+## The contract (henxels)
+
+_Auto-generated from `henxels.yaml` by `henxels sync`. Do not edit by hand._
+
+Each bullet is a **henxel** (a rule). To disobey one, change `henxels.yaml` —
+that is the only sanctioned escape. Run `henxels explain <path>` before creating
+a file to see what governs that spot.
+
+Only use `git commit --no-verify` in a genuine emergency: it bypasses the hooks that run this contract, the safety mechanism meant to protect the repository. Prefer `henxels bless <action>` or editing `henxels.yaml` — both keep the deviation visible.
+
+### Rules
+
+- Canaries live at the repo's canary slot and are registered in CI (in ./src/rune/**/canary_*.py)
+- No secrets in tracked files
+- Plans are markdown, one per build (in ./plans)
+- Top-level docs are markdown or yaml references (in ./docs/*)
+- The known giant stays visible — file-size debt is tracked, not silent (in ./src/rune/*)
+
+### Behaviours
+
+- warns when a new file looks like a near-copy of a committed one
+
+### Custom henxels & contributing
+
+**Before writing a custom check, run `henxels catalogue` and use the built-in that
+matches your intent — don't reinvent one.** Never name a custom check after a built-in
+or a setting (e.g. `warn_about_large_files` is a setting, not a check).
+
+Need a check that genuinely doesn't exist? `henxels create-new-statement <name>` scaffolds a local check
+(auto-loaded from `henxels_checks.py`). **If your check is reusable** — useful in
+other repos, not tied to this one — contribute it upstream with `henxels contribute`.
+We're in the agentic era: send a ready-to-merge PR instead of opening an issue.
+<!-- henxels:end -->

config/v1_authority_map.json

@@ -94,19 +94,25 @@
           "path": "src/rune/rune_tui.py:1671-1739",
           "role": "Parallel pre-message context/tasks/behaviour dispatch",
           "disposition": "archive-candidate",
-          "evidence": "Starts auto-context and warm pipeline independently of the model call."
+          "evidence": "REMOVED by P0-04 (#20): the per-message dispatch no longer runs; modules stay importable for on-demand use. See docs/pipeline-removal.md."
         },
         {
           "path": "src/rune/rune_tui.py:2867-3175",
           "role": "Twenty-one-step per-message context activity pipeline",
           "disposition": "archive-candidate",
-          "evidence": "Reads many subsystems but does not construct the operator request."
+          "evidence": "REMOVED by P0-04 (#20): _run_warm_router is a documented no-op; the ContextBroker (#19) owns all model-facing context. See docs/pipeline-removal.md."
         },
         {
           "path": "src/rune/attention_capsule.py:96-163",
           "role": "Bounded working-set candidate",
           "disposition": "dormant-until-dependency",
           "evidence": "Creates a bounded capsule but does not own prompt construction."
+        },
+        {
+          "path": "src/rune/inference_trace.py",
+          "role": "Durable per-run inference trace (tokens served/estimated, output, latency, per-block visibility)",
+          "disposition": "migrate-adapter",
+          "evidence": "P0-07 (#23): persists what ContextBroker (#19) assembled and what the transport served — builds FROM the broker trace, never re-measures; store state/inference_traces.jsonl."
         }
       ]
     },

docs/context-broker.md

@@ -0,0 +1,182 @@
+# ContextBroker (P0-03, #19) — Authoritative Context Assembly
+
+The ContextBroker is the **single authority** over prompt context
+assembly on the operator path (`rune_operator._execute_on_model`).
+Every injected context block is a registered contributor; admission is
+budgeted against the model's **real** context length; every block is
+measured; a trace records what was admitted, dropped, and why.
+
+Authority invariant (docs/v1/AUTHORITY_MAP.md, `context_construction`):
+**no subsystem may inject model context outside the ContextBroker.**
+
+## Architecture
+
+```
+task + session
+      │
+      ▼
+ContextBroker.assemble(task, session, model_id)
+  1. COLLECT   — run every registered contributor once (in registration
+                 order). Side effects (consolidation's _save_knowledge)
+                 run here, exactly once per turn, BEFORE admission.
+  2. MEASURE   — every block measured with the deterministic estimator
+                 (len(text) // 4 — conservative for English prose).
+  3. ADMIT     — deterministic: non-evictable blocks first (in order),
+                 then evictable blocks by priority desc (tie: recency of
+                 registration) while the input budget lasts. Dropped
+                 blocks are recorded with token counts. A single
+                 mandatory block over the whole budget raises
+                 ContextOverflowError — never silently truncate.
+  4. RENDER    — fixed order: system → tools → memory notes → history →
+                 user. Returns (AttentionCapsule, trace).
+```
+
+The capsule carries the typed `blocks` ledger; `capsule.to_messages()`
+re-derives `[{system}, *history, {user}]` exactly as
+`LocalToolRuntime.run` consumes — so in-place mutation of a block (the
+safety override decorating the final user message) always flows through.
+
+## Contributor table (operator registration, bucket = assembly order)
+
+| # | Contributor    | Priority | Evictable | Source                                   | Content                                |
+|---|----------------|----------|-----------|------------------------------------------|----------------------------------------|
+| 1 | `persona`      | 100      | no        | `rune_operator._PERSONA_PROMPT`          | static identity block (verbatim move)  |
+| 2 | `tools`        | 90       | no        | `tool_executor.TOOLS`                    | `## Available tools` (names only)      |
+| 3 | `memory`       | 70       | yes       | `memory_store.cached_recall(db, task, budget=3)` | `## Context`                   |
+| 4 | `persona_memories` | 68   | yes       | `cached_recall(db, "Rune personality…", budget=3)` | `## Identity context`        |
+| 5 | `consolidated` | 60       | yes       | `MemoryConsolidation` pipeline           | knowledge block; `_save_knowledge()` runs at collect time |
+| 6 | `neurons`      | 55       | yes       | `warm_neuron_store.list_neurons()`       | `## My neurons (warm, firing)` top-5   |
+| 7 | `graphs`       | 50       | yes       | `graph_memory.resolve_entity`            | `## My graph connections` top-5        |
+| 8 | `abstraction`  | 45       | yes       | `abstraction.connect()` facts LIKE       | `## My learned knowledge` top-3        |
+| 9 | `model_profile`| 40       | yes       | `model_profiles.get_prompt_context`      | `## Model`                             |
+|10 | `history`      | 30       | yes       | `rune_operator._conversation_messages`   | last 8 completed pairs (compaction target) |
+|11 | `user`         | 100      | no        | task text                                | final user message (safety override decorates in place) |
+
+Contributor failures are P0-06 T1 events: the selector records
+`record_failure(canonical_name, exc, tier=1)` and returns nothing — the
+turn proceeds, the failure is visible in the registry, the journal, and
+`response.degraded`. An *unexpected* contributor crash is caught by the
+broker itself and recorded under the contributor's name.
+
+## Budget math
+
+```
+window  = context_length(model)            # /api/show, never hardcoded
+budget  = window - max(2048, window // 4)  # completion reserve
+                - window // 20             # 5% safety margin
+```
+
+- Discovery (`local_tool_runtime.context_length`) reads
+  `model_info["<arch>.context_length"]` from `/api/show`, cached per
+  model per process (the same response also feeds the existing
+  `_model_capabilities` cache — one request, two facts).
+- On discovery failure: conservative fallback **8192** AND a T1
+  `record_failure("context_discovery")` — the assumption is observable,
+  never silent.
+- Estimator: `len(text) // 4` per block — deterministic by construction
+  (tiktoken is deliberately not used so the number cannot drift between
+  environments).
+
+## Compaction (80% threshold)
+
+When the measured history exceeds 80% of the window
+(`COMPACTION_THRESHOLD = 0.8`, LangChain deepagents semantics):
+
+1. **ARCHIVE FIRST** — the raw history is appended verbatim to
+   `<rune_home>/state/history_archive.jsonl` (one JSON object per
+   event: timestamp, session, source, messages). Lossy compression
+   without an external archive is forbidden.
+2. All turns except the last 5 are replaced by ONE structured rolling
+   summary — session intent / decisions / open items / next steps — via
+   a compact summarization call (`num_predict 256`).
+3. The last 5 turns stay verbatim.
+4. Summarizer failure = T2 `record_failure("history_compaction")` → no
+   compaction that turn, history degrades to the last-8-turns verbatim
+   window. Archive-write failure = T2 `history_archive` → compression
+   refused (raw was not secured).
+
+Compaction events ride the trace (`trace["compaction"]`).
+
+## Calibration (log-only)
+
+After each operator request, the broker's measured total is compared
+with the served `prompt_eval_count` (captured by the transport) and the
+drift is logged on `rune.context_broker`:
+
+```
+calibration: measured=… served=… drift=+… model=… (log-only, admission never auto-adjusts)
+```
+
+**Pinned decision:** drift is never fed back into admission.
+
+## Absence tests (memory-off)
+
+`RUNE_MEMORY_OFF=1` (truthy values: 1/true/yes/on) zeroes the memory
+contributors (`memory`, `persona_memories`, `consolidated`) at collect
+time. The trace then **proves** the absence: `trace["memory_tokens"] == 0`
+and no memory-named block appears in `trace["blocks"]`. The canary pins
+this (`check_memory_off_proves_zero_memory_tokens`).
+
+## Trace shape
+
+```python
+trace = {
+  "model_id", "window", "budget",
+  "blocks":   [{name, priority, tokens, source, evictable, admitted, reason}, ...],
+  "admitted": [names...],
+  "admitted_total": int,
+  "dropped":  [{name, tokens, priority, reason}, ...],
+  "memory_tokens": int,          # 0 under the memory-off gate
+  "degraded": [subsystems...],
+  "compaction": [events...],
+  "elapsed_ms": float,
+}
+```
+
+`_log_token_usage` is trace-backed (the old `static=0` ghost accounting
+is gone): `static` = admitted minus history minus user, `dynamic` =
+history, `user` = user block, `total` = admitted_total.
+
+## Approval resume
+
+When a turn ends in a pending approval, the capsule is embedded in
+`pending_state["context_capsule"]` (JSON-serializable: token_count +
+block ledger). The replayed `pending_state["messages"]` are the exact
+assembled messages, so a resumed turn has identical context; the
+embedded ledger documents what that context was.
+
+## Fallback tool prompt (runtime-owned, traced)
+
+For models without native tools, `LocalToolRuntime` injects its
+~2.5k-token fallback prompt into the system message. It stays
+runtime-owned but is now **traced**: one log line per session per model
+on `rune.context_broker` (`fallback tool prompt injected …`).
+
+## How to add a contributor
+
+1. Write a callback `(task, session) -> ContributionBlock | None`.
+   Return `None` (or empty content) to contribute nothing; record your
+   own failures with `record_failure(<canonical-name>, exc, tier=1)`
+   and return `None` — never raise past the broker.
+2. Register it on `RuneOperator._context_broker()` with the next bucket
+   and a priority that places it in the assembly order (higher wins
+   budget; ties break by registration recency).
+3. If it is memory-derived, gate it on `memory_disabled()` and add its
+   name to `MEMORY_BLOCK_NAMES` so the absence proof covers it.
+4. Extend the frozen tests (`tests/test_context_broker.py`) and the
+   canary (`src/rune/canary_context_broker.py`) — the trace must show
+   the new block admitted or dropped with token counts.
+
+## Pinned follow-ups
+
+- **num_ctx right-sizing per call site** (14 hardcoded `num_ctx: 8192`
+  sites in 12 files): pinned follow-up per the innovation sequencing —
+  the broker path now *knows* the real window (discovery + admission
+  budget) but the runtime `num_ctx` options are untouched in this
+  stage. Until that lands, admission may budget against a window larger
+  than the runtime's `num_ctx=8192` — keep the follow-up tight.
+- **Ambient-context bridge**: the old `task._ambient_*` reads in the
+  operator were DEAD CODE (the TUI stores `_ambient_*` on itself; the
+  operator read them off the task — always False). The broker path
+  leaves ambient un-injected by decision; bridging it (or removing the
+  TUI side) belongs to #20 / a broker decision follow-up, not here.

docs/conversation-state.md

@@ -0,0 +1,112 @@
+# ConversationState and TaskState (#18 / P0-02)
+
+Canonical, durable conversation and task ledgers for Rune. This replaces
+the "mint a new task on every send" behavior and the display-only
+`ChannelView.messages` with two single-authority repositories.
+
+## Module
+
+`src/rune/orchestration/conversation_state.py`
+
+## Records (`src/rune/orchestration/records.py`)
+
+- `TaskStateRecord` — `task_id` (`new_id("task")`), `title`, `status`
+  (`created→running→awaiting_approval→completed|failed|cancelled|superseded`),
+  `channel_id`, `parent_task_id` (follow-up lineage), `assigned_model`,
+  `created_at`, `updated_at`, `outcome_ref`.
+- `ConversationMessageRecord` — `msg_id` (`new_id("msg")`), `ts`, `role`
+  (user/assistant/system/tool), `content`, `channel_id`, `task_id`,
+  `token_estimate`.
+
+Both are `OrchestrationRecord` subclasses: stable ids, schema versioning,
+dict round-trip.
+
+## Repositories
+
+**TaskStateRepository** (canonical task identity):
+
+- `create(title, channel_id, model=None, parent_task_id=None) -> TaskStateRecord`
+- `amend(task_id, title) -> TaskStateRecord` — follow-ups keep the SAME
+  task_id; the task continues instead of being replaced.
+- `transition(task_id, new_status, outcome_ref="") -> TaskStateRecord` —
+  legal edges in `TASK_TRANSITIONS`; illegal moves raise
+  `IllegalTaskTransitionError`.
+- `get_active(channel_id) -> TaskStateRecord | None` — the open task, if
+  any (cleared automatically on terminal status).
+- `get(task_id)`, `list_open(channel_id)`, `latest(channel_id)`.
+
+**ConversationStateRepository** (durable message history):
+
+- `append(msg)` — idempotent by `msg_id`.
+- `window(channel_id, n=8)` — last n messages, chronological.
+- `messages_for_task(task_id)` — full per-task history.
+- `latest_task(channel_id)` — most recent task on the channel.
+
+Repositories never assemble prompts — that is #19 (ContextBroker).
+
+## Persistence split
+
+- **DurableEventStore** — every transition and message appends a typed
+  marker envelope (`task_state.created|amended|transition|imported`,
+  `conversation.message`) with a sha256 `payload_hash` of the record
+  body, flushed to disk before the checkpoint advances.
+- **AtomicStore** — hot checkpoints (`hot/task_state.json`,
+  `hot/conversation_messages.json`) hold full record bodies for O(1)
+  reads; temp+fsync+rename means a crash never corrupts them. A corrupt
+  checkpoint raises `CorruptStateCheckpointError` — loud, never silent.
+
+## Composition
+
+`AUTHORITY_KINDS` gains `conversation_state` and `task_state`. Wire with:
+
+```python
+from rune.orchestration.composition import build_conversation_state
+
+root = build_conversation_state({
+    "events": run_dir / "events.jsonl",
+    "evidence": run_dir / "evidence",
+    "state": run_dir,
+})
+tasks = root.get("task_state")
+conversation = root.get("conversation_state")
+```
+
+or add onto an existing root with
+`compose_conversation_state(root, state_dir)`. Run the suite:
+
+```
+PYTHONPATH=src:. python3 -m pytest tests/test_orchestration_conversation_state.py -q
+PYTHONPATH=src:. python3 src/rune/canary_conversation_state.py
+```
+
+## Operator integration
+
+`RuneOperator.send_task` delegates identity to `TaskStateRepository`:
+
+- no active task → `create()` with `parent_task_id` = previous task
+  (lineage).
+- active task running, or the message matches a confirmation pattern
+  (`yes/ok/continue/…`) → `amend()` — same task_id, new title.
+- every send appends the user message; every completion appends the
+  assistant message to `ConversationStateRepository`.
+- `_send_to_model` signature and the response envelope are unchanged.
+
+`RuneOperator.__init__` wires both repositories next to
+`operator.json` and runs `migrate_operator_tasks` once (idempotent):
+the 110 legacy tasks keep their original task ids, completed results are
+reconstructed as user/assistant messages, and the legacy `current_task`
+pointer is honored. `conversation_window()` / `get_conversation_window()`
+read the canonical history.
+
+## TUI
+
+`ChannelView.messages` entries stay a projection: consumers
+(`_cmd_pressure`, `_cmd_persona_gate`, ambient context) keep working off
+`ch.messages[-n:]` dicts; the durable history lives in the repository,
+not the widget list.
+
+## Thread safety
+
+The TUI mutates state from workers; both repositories guard all public
+methods with a re-entrant lock, and `append`/transition writes are
+flushed before checkpoints move.

docs/failure-semantics.md

@@ -0,0 +1,83 @@
+# Failure Semantics (P0-06)
+
+Every `except` on the authoritative path must **re-raise, return a structured
+failure, or emit**. A silent `pass` is a defect. This document defines the
+three failure tiers, the observability core (`src/rune/subsystem_health.py`),
+and how to extend them.
+
+## The three tiers
+
+| Tier | Meaning | Behaviour on failure | User-visible? |
+|------|---------|----------------------|---------------|
+| **T0** | Authoritative-path failure (operator execution, tool loop, model transport) | Loud: canonical event + structured failure (`success=False`, error text). The operator's task-transition path already returns `OperatorResponse(success=False, error=...)` — that is the T0 contract. | Yes — error bubble, never silent |
+| **T1** | Context-contribution failure (memory selector, warm router, capability broker, consolidation, …) | Degrade: the turn proceeds without the contribution, but the failure is journaled and surfaced once per subsystem per session. | Yes — one `⚠ <subsystem> unavailable` message (anti-spam), then journal-only |
+| **T2** | Ambient/background failure (cron, event-bus emits, report side-effects) | Journal only; the turn is unaffected. | No — visible via `/health` |
+
+## The core: `rune.subsystem_health`
+
+```python
+from rune.subsystem_health import record_failure
+
+try:
+    context = memory_store.cached_recall(db, query)
+except Exception as exc:  # P0-06: observable degrade (T1)
+    if record_failure("memory_selector", exc, tier=1):
+        ch.add_message("system", f"⚠ memory_selector unavailable: {exc}")
+```
+
+`record_failure(subsystem, error, tier, registry=None, context="")` does three
+things:
+
+1. **Logs** via `logging.getLogger("rune.subsystem_health")`.
+2. **Emits a canonical event** through `rune.event_bus` (tier 0/1 →
+   `task.failed` / `capability.failed`, tier 2 → `storage.degraded`; payload
+   carries subsystem, tier, truncated error).
+3. **Records the failure** in the process-wide `SubsystemHealthRegistry`
+   (failures / last_error / tier per subsystem).
+
+It returns `True` when the caller should ALSO surface the failure to the user
+(first T0/T1 occurrence for that `(tier, subsystem)` pair — anti-spam). T2
+never returns `True`. Events always fire (the journal is cheap); user messages
+fire once.
+
+The operator process has no chat channel, so its T1 conversions append the
+subsystem name to a `degraded` list on `OperatorResponse`; the envelope carries
+it to the TUI, which renders `⚠ <subsystem> unavailable (operator path)` lines.
+
+## Logging destination
+
+`configure_logging(log_dir=None)` attaches a rotating file handler
+(`~/.rune/logs/rune.log`, 5 MB × 3) to the `rune` logger tree. Before P0-06 the
+loggers existed but had **no handler** — logs went nowhere. `RuneApp.__init__`
+calls it once per process (guarded, so a read-only home never blocks startup).
+Tests call `configure_logging(log_dir=tmp_path)` with an explicit directory.
+
+## The `/health` command
+
+`/health` in the TUI renders the registry snapshot — per subsystem: failures
+count, tier, last error — plus the event-journal total. Zero failures →
+"all subsystems healthy". Use it after any suspected breakage: if a subsystem
+degraded, it is in the ledger even when the turn looked normal.
+
+## Adding a new subsystem
+
+1. Pick a name (kebab/snake, matches the module: `memory_selector`,
+   `warm_router`, `capability_broker`, `witness`, `consolidation`, `persona`,
+   `abstraction`, `graph_memory`, `context_pressure`, `drift_check`, `goals`,
+   `time_context`, `cron`, `provider_registry`, `model_routing`, …).
+2. Classify the call site: does the turn legitimately proceed without it?
+   Yes → T1 (surface once). It is background/side-effect → T2 (journal only).
+   It is the answer itself → T0 (re-raise or structured failure; do not
+   swallow).
+3. Convert the handler with the pattern above. The `if record_failure(...)`
+   guard is mandatory for T1 — it is what makes the anti-spam contract work.
+4. Check `/health` after forcing a failure; the subsystem must appear in the
+   ledger and the event must land in the journal.
+
+## Scope note
+
+P0-06 converted the ~30 critical handlers on the authoritative path (surveyed
+in plans/2026-09-04-p0-06-ledger.md — the worst was one `except: pass`
+wrapping the four-subsystem parallel block in `rune_tui._run_warm_router`; it
+is now split so each subsystem reports independently). The remaining ~390
+repo-wide silent handlers are a follow-up sweep.

docs/forge-client.md

@@ -0,0 +1,49 @@
+# Forge Client
+
+Config-driven forge abstraction (issue #121): Rune's automation creates
+issues, comments, and reads state through a `ForgeClient` protocol with
+adapters for Gitea, Forgejo, or no forge at all. Nothing is hardcoded to a
+specific setup — this is the open-project readiness foundation and the
+prerequisite for the failure auto-filer (#122).
+
+## Components (src/rune/forge_client.py)
+
+- `ForgeClient` — `@runtime_checkable` Protocol: `create_issue(title, body)`,
+  `add_comment(issue_number, body)`, `get_issue_state(issue_number)`,
+  `list_open_issues()`
+- `NullAdapter` — every method is a no-op dict; zero errors; the graceful
+  dormant path for unconfigured/standalone use
+- `GiteaForgejoAdapter` — real HTTP adapter via Gitea/Forgejo `/api/v1`
+  paths (identical on both platforms); `Authorization: token <token>`
+- `create_forge_client(config)` — factory; unconfigured → `NullAdapter`
+
+## Configuration
+
+The factory checks a config dict first, then environment variables:
+
+| Key | Env var | Meaning |
+|-----|---------|---------|
+| `forge.url` | `FORGE_URL` | Forge base URL, e.g. `https://forge.example.com` |
+| `forge.token` | `FORGE_TOKEN` | API token |
+| `forge.owner` | `FORGE_OWNER` | Repo owner |
+| `forge.repo` | `FORGE_REPO` | Repo name |
+
+If URL **or** token is missing → `NullAdapter` (never raises).
+
+    # Standalone (no forge): nothing to do — NullAdapter is dormant.
+    # Gitea/Forgejo:
+    export FORGE_URL="https://forge.example.com"
+    export FORGE_TOKEN="..."
+    export FORGE_OWNER="o"   # optional
+    export FORGE_REPO="r"    # optional
+
+## API paths used (Gitea == Forgejo)
+
+    POST   {url}/api/v1/repos/{owner}/{repo}/issues
+    POST   {url}/api/v1/repos/{owner}/{repo}/issues/{n}/comments
+    GET    {url}/api/v1/repos/{owner}/{repo}/issues/{n}
+    GET    {url}/api/v1/repos/{owner}/{repo}/issues?state=open&limit=50
+
+## Run
+
+    PYTHONPATH=src:. python3 -m pytest tests/test_forge_client.py -q

docs/inference-trace.md

@@ -0,0 +1,80 @@
+# Inference Traces (P0-07, #23)
+
+One durable record per operator run answering two questions at once:
+
+- **Why did this call cost this much?** — estimated vs served prompt tokens,
+  output tokens, wall latency, model time, cost basis.
+- **What exactly did the model see?** — per-block token contributions, the
+  tools allowlist, and which memory blocks were exposed.
+
+## Store
+
+`<rune_home>/state/inference_traces.jsonl` — one JSON object per line
+(O_APPEND line-atomic; model calls run on exclusive workers). Rotates at
+**10 MB × 3 backups** (`inference_traces.jsonl.1` … `.3`), mirroring the
+`_log_token_usage` size-cap approach. The file is runtime state (`state/`
+is gitignored, P0-05 M6) — never committed. Consumers: #25, #28, #29.
+Read back with `rune.inference_trace.read_traces()` or
+`python3 -m rune.inference_trace [n]` (tail n records).
+
+## Record schema (version 1)
+
+| Field | Source | Meaning |
+|---|---|---|
+| `schema_version` | constant (`1`) | Record shape version for consumers |
+| `provider` | `OllamaChatTransport.provider` | `"ollama"` (class constant) |
+| `model` | operator | Model id the run executed on |
+| `task_id` / `channel` | operator (TaskState #18) | Joins the trace to TaskState |
+| `resolved_context_window` | broker trace `window` | Discovered trained window |
+| `input_budget` | broker trace `budget` | Input budget admission used |
+| `model_calls` | transport `usage_calls` | `chat()` invocations this run |
+| `prompt_tokens_estimated` | broker trace `admitted_total` | Broker's measured estimate |
+| `prompt_tokens_served` | transport `usage_prompt_tokens` | Ollama `prompt_eval_count` sum (0 = unknown) |
+| `output_tokens` | transport `usage_output_tokens` | Ollama `eval_count` sum |
+| `latency_ms` | operator wall clock | Around the whole `runtime.run` attempt (incl. tier escalation) |
+| `model_time_ms` | transport `usage_total_duration_ns` / 1e6 | Ollama `total_duration` sum |
+| `per_block_tokens` | broker trace `blocks` | `{name: tokens}` for admitted blocks |
+| `dropped_blocks` | broker trace `blocks` | `[{name, tokens}]` for blocks admission dropped |
+| `tools_exposed` | `runtime.tool_names` | The runtime's tool allowlist |
+| `memories_exposed` | broker blocks ∩ `MEMORY_BLOCK_NAMES` | Memory blocks with tokens > 0 |
+| `memory_tokens` | broker trace `memory_tokens` | Summed memory-block tokens |
+| `degraded` | operator (P0-06) | Subsystems that degraded this run |
+| `cache` | constant `None` | Ollama exposes no KV-cache stats (cloud comparison field) |
+| `cost_usd` | `price_for(model)` | `None` until the price map gains entries |
+| `cost_basis` | derived | `"local-unpriced"` or `"price-map"` |
+| `success` / `error` | final `OperatorResponse` | Run outcome; error truncated to 300 chars |
+
+## Authority and single-source rule
+
+The trace builds **from** the broker trace (#19) + transport counters — it
+never re-measures. There is no parallel authority path: the broker stays the
+single source for window/budget/blocks; the transport stays the single
+source for served/output/duration. Calibration (#19 Task 2) remains
+**log-only**; the trace persists what calibration only logged, and nothing
+feeds back into admission.
+
+## Failure semantics (P0-06)
+
+Recording is degrade-not-crash (tier=2 → `storage.degraded`): a trace
+failure is observable via `rune.subsystem_health.record_failure` but never
+fails the operator turn.
+
+## Cloud/local comparison
+
+Local records carry `provider: "ollama"`, `cache: null`,
+`cost_usd: null`, `cost_basis: "local-unpriced"`. Cloud providers (#29)
+fill the price map (`rune.inference_trace.price_for`) and may report cache
+stats — the record shape is identical, so #25/#28/#29 compare providers on
+one schema.
+
+## Wiring
+
+- Transport accumulators: `OllamaChatTransport.chat()` sums envelope usage
+  (`prompt_eval_count`, `eval_count`, `total_duration`) across every chat;
+  `last_prompt_eval_count` behavior is unchanged (calibration pin).
+- Operator: `RuneOperator._execute_on_model` stamps `run_started` before
+  the tier-escalation loop and records exactly one trace per run on the
+  final response.
+- Canary: `src/rune/canary_p0_07.py` (registered in
+  `.gitea/workflows/ci.yml`'s canary loop) re-proves the contract with no
+  live model. Tests: `tests/test_p0_07_inference_trace.py`.

docs/native-tools.md

@@ -0,0 +1,136 @@
+# Native Iterative Tool Calling — the local tool loop (P0-05, #21)
+
+> Status: **shipped** on `p0-05-native-tools`. Frozen contract:
+> `tests/test_p0_05_native_tools.py`. Acceptance: `tests/test_p0_05_acceptance.py`
+> (live-model gated). Canary: `src/rune/canary_p0_05.py` (registered in
+> `.gitea/workflows/ci.yml`).
+
+The issue's original handoff ("models print JSON, one tool/follow-up cycle")
+predates the runtime's evolution: `LocalToolRuntime._run_loop`
+(`src/rune/local_tool_runtime.py`) is a real iterative loop — `while True`
+under a hard `max_iterations` cap (1–8, enforced at construction), typed
+`ToolRequest`/`ToolEvent` dataclasses, approval pauses with serializable
+resume state, and executor errors fed back to the model as tool messages.
+P0-05 closed the four gaps the empirical probes found; it did NOT rebuild
+the loop.
+
+## Loop architecture
+
+```
+run(messages)
+  └─ transport.supports_tools(model)          # /api/show capability discovery
+       ├─ True  → native tool_calls (Ollama /api/chat `tools` param)
+       └─ False → text-fallback protocol + runtime-owned fallback prompt
+  └─ _run_loop: while True
+       ├─ execute queued requests (dedup: name + canonical arguments)
+       │    ├─ read-only  → dispatch immediately
+       │    └─ mutating   → prepare → pending_approval pause (serializable
+       │         state) → operator approve()/reject() → resume()
+       ├─ iterations_used >= max_iterations → typed failure "iteration limit"
+       ├─ consecutive identical failures >= 2 → typed failure (breaker, below)
+       └─ transport.chat(...) → tool_calls? loop : terminal visible text
+```
+
+Stop conditions: terminal visible text (success), approval pause (returns to
+the operator), iteration limit, circuit breaker, transport/protocol failure
+(all typed `OperatorResponse(success=False, error=...)`).
+
+## Budget visibility (P3)
+
+Every response that entered the loop carries:
+
+| Field | Meaning |
+|---|---|
+| `iterations_used` | model turns consumed (one chat call = one iteration) |
+| `iteration_budget` | the runtime's `max_iterations` cap |
+
+Set on terminal success, the approval-pause return, and every in-loop failure.
+Responses that never entered the loop (pre-loop transport error, invalid
+pending state) report `iterations_used=0`. The TUI/operator can now render
+"step 5/8" instead of flying blind.
+
+## Consecutive-failure circuit breaker (P4)
+
+Before the loop continues past a failed execution, `_run_loop` computes the
+request signature — `tool name + json.dumps(arguments, sort_keys=True)` (the
+same canonical form used for dedup) — and tracks the consecutive identical
+failure streak:
+
+- **same signature fails again** → streak grows; at **>= 2** the loop returns
+  `tool {name} failed {n} consecutive times with identical arguments —
+  stopping before the iteration budget burns` (typed failure, events
+  preserved);
+- **tool succeeds** → streak resets;
+- **same tool, different arguments** → new signature, own streak (the model
+  adapting is never punished);
+- covers BOTH failure sites: read-only dispatch and the approval-branch
+  inline execution (e.g. a path-denied `edit_file` with the authority
+  executor).
+
+Without it, one always-failing tool burned the whole 8-iteration budget
+(P4 probe). With it, the burn stops at 2 identical executions.
+
+## Sandbox error contract (P1)
+
+All write denials flow through `tool_executor.validate_write_path` (the
+single choke point for `write_file` / `edit_file` / `format_code` prepare,
+apply-after-approval, and revalidation). The denial message names the
+allowed directories so the model can self-correct in one step:
+
+```
+Access denied: /etc/nope.txt is outside allowed write directories:
+['/home/nick', '/mnt/workdrive']. Write inside one of those directories instead.
+```
+
+Sandbox facts: `ALLOWED_READ_DIRS` = home, `/mnt/workdrive`, `/tmp`;
+`ALLOWED_WRITE_DIRS` = home, `/mnt/workdrive` — **`/tmp` is read-ok but
+write-blocked**; `/etc`, `/var`, `/proc`, `/sys`, `~/.ssh`, `~/.gnupg` are
+hard-blocked. Disposable coding sandboxes belong under `~/.rune-e2e-probe/`.
+
+## Tool-capable system guidance (P2)
+
+The operator's `tools` context block (`RuneOperator._contributor_tools`,
+bucket 90, non-evictable) is no longer a bare name list — a tool-capable
+model given only names claimed it could not read files (P2 probe). The block
+now ends with:
+
+```
+Use tools for every file/command action; never fabricate tool output.
+Read before editing; verify fixes by running them.
+```
+
+The runtime-owned fallback prompt (non-native models) is unchanged and still
+injected/traced by `LocalToolRuntime` itself.
+
+## Capability discovery
+
+`OllamaChatTransport.supports_tools(model)` / `supports_thinking(model)`
+read `capabilities` from one cached `/api/show` call; the same response
+yields the trained context window (`context_length`, #19 Task 2). Models
+without the `tools` capability get the text-fallback protocol; models
+without `thinking` never receive a `think` parameter.
+
+## Acceptance scenario (live model, CI-safe skip)
+
+`tests/test_p0_05_acceptance.py` replays the issue's acceptance end-to-end
+with real `qwen3:14b` native tool calls: a broken `add()` in a disposable
+sandbox (`~/.rune-e2e-probe/p0-05`), system prompt "You are a coding agent.
+Fix bugs using your tools…", approval pauses resolved programmatically via
+`runtime.approve(resp.pending_state)` (exactly the TUI flow, capped at 6
+rounds), then asserts the fix landed (`mod.add(2, 3) == 5`).
+
+Run it live:
+
+```bash
+PYTHONPATH=src:. python3 -m pytest tests/test_p0_05_acceptance.py -v
+```
+
+It skips cleanly when Ollama is unreachable (CI has no model). Local green
+run (2026-09-05): **PASSED in 14.1s** — 5 tool events, all
+`ollama-native`, `iterations_used 4/8`, `FIX VERIFIED: True` (recorded in
+the plan tail).
+
+The CI canary (`src/rune/canary_p0_05.py`) machine-checks the same claims
+with no model: breaker trips on a scripted loop, breaker message pinned in
+source, budget fields on a scripted response, sandbox denial text,
+max_iterations enforcement, tools-block guidance.

docs/pipeline-porting-ledger.md

@@ -0,0 +1,200 @@
+# Pipeline Porting Ledger — Gitea → Forgejo
+
+> **Purpose:** a complete, honest inventory of the automation built on Gitea for
+> this repository, written as a **porting guide**. When the move to Forgejo
+> happens, this file is the checklist. Everything here was built and verified
+> between 2026-09-03 and 2026-09-04 (PRs #55–#116); every "gotcha" below was
+> discovered empirically and cost a debugging iteration — read them before
+> touching anything.
+
+---
+
+## 1. Infrastructure inventory
+
+| Component | Where | Details | Forgejo port note |
+|---|---|---|---|
+| Gitea server | Pi (192.168.0.84), `https://gitea.thingscouldgetdicey.online` | self-hosted, arm64 | Forgejo installs the same way (binary + systemd); DB and repo paths migrate via Gitea's dump/restore or Forgejo's importer |
+| act_runner | Pi (`rune-pi`), v3.3.0, arm64, label `self-hosted` | runs all workflow jobs | Forgejo uses act_runner too — **the same runner can register with Forgejo**; re-register with the Forgejo instance URL + token |
+| Repo | `conductor/rune` | remote URL embeds a conductor token (rotate on migration) | same path structure on Forgejo; update remotes |
+| Secret `GITEA_TOKEN` | repo settings → actions | used by auto-version + pipeline-gate scripts | recreate as `GITEA_TOKEN` or `FORGEJO_TOKEN` in Forgejo repo settings; update the workflows that read it |
+| Backup scripts | Pi: `/usr/local/sbin/rune-gitea-backup`, `rune-gitea-restore-verify` | `gitea dump`-based, scheduled by auto-backup.yml | Gitea-specific — replace with Forgejo's `forgejo dump` equivalent |
+| Local worktrees | this machine: `~/.config/compose/worktrees/rune/*` | git worktrees off master | unaffected by the platform move (git is git) |
+| Rune-side API automation | `~/.config/opencode/shared/gitea_auth.py` (token loader), `custodian.py` (issue creation) | `~/.config/opencode/secrets/gitea-token` (mode 0600) | point at the Forgejo URL; API paths identical (see §4) |
+
+## 2. Workflow inventory (`.gitea/workflows/`)
+
+### ci.yml — CI Pipeline (the verification spine)
+- **Triggers:** every `push`; `pull_request` → master.
+- **Jobs:** lint (ruff check + `ruff format --check` on added files), unit-tests
+  (explicit file list — currently 30+ test files, backslash-continued; NOTE:
+  new test files must be added manually or they silently never run in CI),
+  canaries (8 boot canaries), all gated as **required checks** on PRs.
+- **Runner deps:** python3 venv + `ruff==0.16.4` (pinned; local is 0.16.5 —
+  format-level risk nil), `textual==8.2.0` pinned (local 8.2.8).
+- **Forgejo:** Actions syntax identical; required-checks are configured in
+  branch protection (recreate `lint`/`unit-tests`/`canary` as required
+  contexts). Consider switching the file list to a full-suite run (textual now
+  installs cleanly).
+
+### auto-version.yml — Release on merge
+- **Trigger:** `pull_request: closed` → master.
+- **Behavior:** reads `__version__` from `src/rune/__init__.py`; **guard**:
+  fails loudly if the version equals the last tag (a missed bump blocks the
+  merge); **idempotent skip** if a release for the tag exists; creates a
+  release (tag + notes from the PR title/body) via the API.
+- **Secrets:** `GITEA_TOKEN`.
+- **Forgejo:** works as-is (API paths identical). The five version surfaces
+  synced per release: `src/rune/__init__.py`, `rune_tui.py` banner + status
+  line, `canary_gitea_automation.py` pin, `README.md` — policy test
+  `tests/test_build_pipeline_policy.py` enforces them.
+
+### auto-label.yml — Umbrella labels + PRIORITY GATE
+- **Triggers:** `issues: [opened, edited, labeled]`; `pull_request: [opened, edited]`.
+- **Behavior:** (a) applies umbrella labels by keyword (memory, governance,
+  identity, growth, perception, infrastructure, life, custodian) + type
+  (bug/feature) + priority: high (legacy); (b) **priority-gate job**: an issue
+  landing without P0/P1/P2/P3 gets `unprioritized` + a demand comment;
+  prioritizing clears it.
+- **Forgejo:** keyword matching is platform-neutral. **Verify the issues-event
+  payload shape on Forgejo** (see gotchas §5).
+
+### pipeline-gate.yml — ORDER (ready/blocked) + TEACHER
+- **Triggers:** `issues: [labeled, closed]`.
+- **CHECK half:** labeling an issue `ready` verifies every `Depends on: #N`
+  ref in its body is closed; open deps → removes `ready`, adds `blocked`,
+  comments the blockers; all closed → comments "🟢 READY — order satisfied;
+  Rune may start."
+- **TEACH half:** on issue close, computes the next ready-eligible open issue
+  (all deps closed, not blocked; lowest number wins) → labels it `ready` +
+  comments "🎓 NEXT: #X — <title> — dependencies satisfied; Rune may start."
+- **Design:** NO job-level `if` on the event payload (see gotcha §5.1) — both
+  jobs run on every issues-event and branch INSIDE the github-script on
+  `context.payload.action`. This is the most portable form.
+- **Forgejo:** the dependency regex + API calls port directly; **re-verify the
+  label-add action name** (gotcha §5.2) and the job-level `if` behavior
+  (gotcha §5.1) on Forgejo before trusting the skip logic.
+
+### auto-backup.yml — Daily backup
+- **Trigger:** cron 04:00 UTC + manual dispatch.
+- **Behavior:** verifies backup tooling offline (bash -n, unit tests, the
+  gitea-automation canary), then `sudo /usr/local/sbin/rune-gitea-backup`.
+- **Forgejo:** the verification steps port; the backup script itself is
+  Gitea-specific — replace with Forgejo's dump tooling.
+
+### maintenance.yml — Weekly lint + canaries
+- **Trigger:** cron Sunday 02:00 UTC.
+- **Behavior:** `ruff check --fix` + `ruff format` on shared/ + src/ (AUTO-FIX
+  — note: this runs uncommitted fixes on the runner's checkout; it does not
+  push), then all `shared/canary_*.py`.
+- **Forgejo:** ports as-is.
+
+### auto-update-gitea.yml — Monthly server self-update
+- **Trigger:** cron 1st of month 03:00 UTC.
+- **Behavior:** compares local Gitea version to latest go-gitea release;
+  downloads + installs the new arm64 binary.
+- **Forgejo:** **REPLACE ENTIRELY** — point at Forgejo releases (codeberg.org/forgejo)
+  or adopt Forgejo's own upgrade tooling. Do not run the Gitea updater against
+  a Forgejo install.
+
+## 3. Label taxonomy (repo labels)
+
+| Label | Meaning | Created |
+|---|---|---|
+| `P0` / `P1` / `P2` / `P3` | priority scale (REQUIRED on every issue — enforced by auto-label's priority-gate) | v1 epic |
+| `ready` (id 29) | order satisfied — Rune may start | pipeline-gate (on demand) |
+| `blocked` (id 30) | dependencies open | pipeline-gate (on demand) |
+| `unprioritized` | priority gate violation | auto-label (on demand) |
+| `memory`, `governance`, `identity`, `growth`, `perception`, `infrastructure`, `life`, `custodian` | umbrellas | auto-label keyword match |
+| `bug`, `feature`, `epic` | type | auto-label / manual |
+| `v1-course-correction` | epic #16 membership | manual |
+| `priority: high` | RETIRED 2026-09-04 (normalized to P0-P3) | — |
+
+Priority × order interaction: **priority = WHERE in the queue; the teacher =
+WHEN it's next.**
+
+## 4. API flows used by automation (port these too)
+
+All against `https://gitea.thingscouldgetdicey.online/api/v1/repos/conductor/rune`:
+
+1. **Merge flow (Rune-side, the nightly driver):** poll `GET /commits/<sha>/status`
+   until `state == success` (15 statuses incl. `CI Pipeline / required-checks`)
+   → `POST /pulls/<n>/merge` with `{"Do":"merge"}`.
+   **GOTCHA (§5.4):** poll the FRESH head sha — a merge can 405 with "head
+   behind base" (background workflows push to master between your poll and
+   merge) or "not all required status checks successful" (fresh-head checks
+   pending). Sync the branch and re-poll, then merge immediately.
+2. **Issue ops:** `POST /issues` (file), `PATCH /issues/<n>` (close with
+   `{"state":"closed","state_reason":"completed"}`), `POST /issues/<n>/comments`,
+   `POST /issues/<n>/labels` + `DELETE /issues/<n>/labels/<name>` (the
+   pipeline gate's core ops).
+3. **Labels:** `POST /labels` (create on demand — the gate creates ready/blocked
+   if absent).
+4. **Actions:** `GET /actions/runs?limit=N`, `GET /actions/runs/<id>/jobs`,
+   `GET /actions/jobs/<id>/logs` (the debugging lifeline — read runner logs via
+   API).
+5. **Auth:** token in the `Authorization: token <token>` header (conductor
+   account). Rune-side loader: `shared/gitea_auth.py::load_gitea_token()` ←
+   `~/.config/opencode/secrets/gitea-token` (mode 0600).
+
+Forgejo: identical `/api/v1` paths (it's a Gitea fork). Re-point the base URL
+and token; the flows are unchanged. **Verify** the actions endpoints exist on
+the target Forgejo version (Actions support matured over 2023-2024).
+
+## 5. Empirical gotchas (each cost a debugging iteration — do not re-learn)
+
+1. **Job-level `if:` on issues-event payloads DOES NOT EVALUATE** on
+   act_runner v3.3.0 (arm64): runs skip under BOTH `gitea.*` and `github.*`
+   prefixes (runs 329/333/338/347 all skipped). **Fix:** no job-level `if` on
+   payload fields — run the job and branch INSIDE the github-script on
+   `context.payload.action` (runtime payload is reliable). pipeline-gate.yml
+   is the reference implementation.
+2. **This Gitea emits `action: label_updated` (NOT `labeled`)** when a label
+   is added (run 353's debug output proved it). The gate accepts both
+   spellings. **On Forgejo: verify which action name fires** (Forgejo aims for
+   GitHub compat — it may emit `labeled`); the gate handles both.
+3. **Workflows only trigger from the DEFAULT branch** for issues/push events —
+   a workflow on a feature branch is inert until merged. Live-testing a
+   workflow requires merging it first (the pipeline-gate verification had to
+   wait for master).
+4. **The 405 merge dance:** `POST /pulls/<n>/merge` fails with "head branch
+   behind base" when background workflows (auto-label on the merge commit,
+   etc.) push to master between your checks-poll and the merge call; and with
+   "not all required status checks successful" when the fresh head's checks
+   are still pending. **Fix:** re-poll the fresh head sha to green, merge
+   immediately.
+5. **act_runner queues are serial per runner** — a queued push run delays an
+   issues run (run 329 waited behind 328). Patience or a second runner.
+6. **`actions/github-script@v7` works on this Gitea** — the house pattern for
+   API automation inside workflows (auto-label + pipeline-gate use it).
+7. **Pinned SHAs for actions** (checkout @11bd7190… = v4.2.2) — the repo pins
+   by commit, not tag, for supply-chain discipline. Keep that on Forgejo.
+
+## 6. Forgejo porting checklist (ordered)
+
+1. Provision Forgejo on the Pi (or elsewhere); restore repos via dump/import.
+2. Recreate repo labels (§3) — or script them via the API (the flows in §4).
+3. Recreate the `GITEA_TOKEN` secret (repo settings → actions).
+4. Re-register act_runner with the Forgejo instance (same runner binary).
+5. Copy `.gitea/workflows/` → `.forgejo/workflows/` (Forgejo reads
+   `.gitea/workflows/` too, but the canonical dir is `.forgejo/workflows/` —
+   verify on the target version; keeping `.gitea/` may just work).
+6. **Verify the gotchas on Forgejo:** label-add action name (§5.2), job-level
+   `if` evaluation (§5.1) — if Forgejo evaluates `if` properly, the
+   in-script branching still works (it's a superset), so no change needed.
+7. Replace `auto-update-gitea.yml` with a Forgejo updater.
+8. Replace the backup scripts with Forgejo dump tooling; keep the
+   verification steps.
+9. Re-point Rune-side automation (`gitea_auth.py` base URL, remote URLs,
+   `custodian.py`) at Forgejo; rotate the embedded remote token.
+10. Re-verify the full loop live: file an issue → priority gate → ready label
+    → teacher announcement → PR → required checks → merge → release.
+11. Update this ledger: mark each line verified-on-Forgejo.
+
+## 7. What this ledger does NOT cover
+
+- The orchestration CODE (Plans 1–7) — platform-independent Python; unaffected.
+- The Rune TUI / memory systems — unaffected.
+- Gitea server config (app.ini, DB, reverse proxy) — server-admin territory,
+  only touched here where workflows depend on it (backup scripts).
+
+*Built 2026-09-04. Update the checklist marks as the migration proceeds.*

docs/pipeline-removal.md

@@ -0,0 +1,119 @@
+# Pipeline Removal — the per-turn cognitive pipeline is gone (P0-04, #20)
+
+> Status: **shipped** on `p0-04-pipeline-removal`. Frozen contract:
+> `tests/test_p0_04_pipeline_removal.py`. Canary: `src/rune/canary_p0_04.py`
+> (registered in `.gitea/workflows/ci.yml`).
+
+## What ran per turn BEFORE
+
+Every ordinary user message (`on_input_submitted`) spawned a warm-router
+thread and a pre-dispatch parallel block — **a timer firing simulated
+consciousness**:
+
+**Pre-dispatch parallel block** (display-only, per message):
+
+1. `auto_context.build_auto_context(text)`
+2. `auto_tasks.extract_tasks(text, channel)`
+3. `behavior.match_context(text)`
+
+**`_run_warm_router` — the 21-step pipeline** (~390 lines, ~120 ms per
+message, measured on `hello world performance baseline`):
+
+| # | Step | Call |
+|---|------|------|
+| 1 | Warm router | `warm_router.route(text)` |
+| 2 | Capability broker | `capability_broker.match_capabilities(query, top_k=3)` |
+| 3 | Memory recall | `memory_store.cached_recall(db, query, budget=3)` |
+| 4 | Witness | `witness.detect_signals(message=text)` |
+| 5 | Cache check | `cache.get_cache("response:...")` |
+| 6 | Persona | `prompt_sync.get_defining_principles()` |
+| 7 | Abstraction facts | `abstraction.connect()` + SQL LIKE scan |
+| 8 | Graph memory | `graph_memory.connect()` + entity resolve |
+| 9 | Context pressure | `context_pressure.measure_pressure(recent)` |
+| 10 | Event emit | `event_bus.emit("on_context", ...)` |
+| 11 | Drift check | `drift_ledger.check(strict=False, autofix=False)` |
+| 12 | Goals | `task_persist.load()` |
+| 13 | Time awareness | `time_awareness.get_time_context()` |
+| 14 | Neuron count | `warm_neuron_store.get_stats()` |
+| 15 | Hooks | `hook_engine.fire("pre_message", ...)` |
+| 16 | Voice blend | `voice_hybrid.get_blend_info()` |
+| 17 | Sleep consolidation | `sleep_time.consolidate()` (silently broken — the attribute never existed, swallowed by `except: pass`) |
+| 18 | Repo map | `tool_executor.execute_tool("repo_map", ...)` |
+| 19 | Auto-read | `tool_executor.execute_tool("read_file", ...)` |
+| 20 | Auto-search | `tool_executor.execute_tool("grep_files", ...)` |
+| 21 | Memory filter | re-filter of `_ambient_memory_results` |
+
+Model-relevant output of all of it: **zero** (a dim display-only status
+line), while carrying live side effects: neuron state mutation, hook firing,
+sleep-consolidation attempts, per-turn event spam, and 17 `record_failure`
+observability calls in `rune_tui.py` alone.
+
+## What runs NOW
+
+- **One path per message**: `on_input_submitted` → `_send_to_model` →
+  `rune_operator.send_task` → **ContextBroker** assembles all model-facing
+  context (#19). Nothing else runs per turn.
+- **Session-scoped startup checks stay** (`_startup_check` at mount:
+  `compile_persona`, `scan_registry`, `load_tasks` — never per-turn).
+- **`_run_warm_router` survives as a documented no-op** (compat shim); the
+  docstring points here. `_warm_router_thread` and the pre-dispatch parallel
+  block are deleted outright.
+- Measured overhead: **~120 ms → ~0 ms** per message (no-op return).
+
+## Capability table — where everything lives on
+
+Nothing was deleted. Every former pipeline capability is reachable on
+demand:
+
+| Capability | On demand via | Module |
+|---|---|---|
+| Warm router / neuron priming | `/neurons`, direct call | `warm_router.py` |
+| Capability broker (legacy matcher) | direct call | `capability_broker.py` |
+| Memory recall | broker memory contributors, `/memory` | `memory_store.py` |
+| Witness signals | direct call | `witness.py` |
+| Response cache | direct call | `cache.py` |
+| Persona | `/persona`, startup check | `prompt_sync.py` |
+| Abstraction | `/abstraction` | `abstraction.py` |
+| Graph memory | `/graph` | `graph_memory.py` |
+| Context pressure | `/pressure` | `context_pressure.py` |
+| Event journal | `/events` | `event_bus.py` |
+| Drift check | `/drift` | `drift_ledger.py` |
+| Goals | `/goal` | `goal.py`, `task_persist.py` |
+| Time awareness | `/time`, `/night` | `time_awareness.py`, `night_mode.py` |
+| Neurons | `/neurons` | `warm_neuron_store.py` |
+| Hooks | `/hooks` (pre/post message fire kept around the operator call) | `hook_engine.py` |
+| Voice | `/voice`, `/voice_sync` | `voice_hybrid.py`, `voice_sync.py` |
+| Sleep consolidation | `/dream` — now actually works: `sleep_time.consolidate()` was added (the old per-turn call targeted a nonexistent attribute and silently never ran) | `sleep_time.py` → `MemoryConsolidation.consolidate_all()` |
+| Repo map / auto-read / auto-search | tool calls (`tool_executor.execute_tool`) | `tool_executor.py` |
+| Auto-context / auto-tasks / behavior | direct call (`auto_context.build_auto_context`, `auto_tasks.extract_tasks`, `behavior.match_context`) | `auto_context.py`, `auto_tasks.py`, `behavior.py` |
+
+## Event-trigger seed (#48-compatible)
+
+The pipeline's side effects split three ways (plan research): display status
+→ broker trace; neuron priming → explicit trigger; sleep/drift/persona sync →
+**meaningful-event triggered**. This stage seeds the taxonomy, it does NOT
+build the trigger engine (that is **#48 / P3-05**):
+
+1. **Session start** — the existing startup checks (unchanged).
+2. **Explicit /commands** — `/drift`, `/pressure`, `/health`, `/events`,
+   `/dream`, ... (unchanged).
+3. **NEW: `task.failed`** — the operator emits the typed vocabulary event
+   (`event_bus.emit("task.failed", source="rune_operator", ...)`) on every
+   send_task failure transition (`rune_operator._emit_task_failed`, both the
+   direct path and the approval-resolution path via `_apply_runtime_result`).
+   This is the first endogenous trigger. `#48` grows the taxonomy and builds
+   the scheduler on top of these seeds.
+
+## Acceptance evidence
+
+- 5 frozen tests green (red proven first: pipeline still ran + pre-dispatch
+  still present); full suite **495 passed + 84 subtests** (baseline 488 + 84;
+  the only delta is the 5 new tests — zero regressions).
+- `grep -c record_failure src/rune/rune_tui.py`: **21 → 4** (the pipeline's
+  17 calls died with it; the 4 remaining are the startup/provider paths).
+- `src/rune/canary_p0_04.py` green, registered in the CI canary loop in the
+  same commit (henxels gate).
+- Authority map (`config/v1_authority_map.json`): the two
+  `context_construction` TUI entries updated to reflect the completed
+  removal (the disposition vocabulary has no `removed` value, so they stay
+  `archive-candidate` with removal evidence).

docs/review-lessons.yaml

@@ -0,0 +1,215 @@
+# Review Lessons — Structured Defect Heuristics
+
+> Machine-readable (YAML). Each entry is a defect class the review gates caught,
+> with detection guidance and a real example. Reviewers: read the tag index
+> below, then the entries matching your review's scope. If you find a defect
+> class NOT in this file, include a structured `## New lessons` section in
+> your findings — the controller commits it at close-time. The file grows
+> because reviews grow it.
+
+## Tag index
+
+- `empty-input-edge` — filters/logic that match everything when input is empty
+- `aliasing` — returned objects that alias internal state; mutation corrupts
+- `concurrency` — last-write-wins, no lock, multi-writer hazards
+- `corruption-handling` — silent skip vs typed error on bad data
+- `transactional-integrity` — partial commits, ordering, crash windows
+- `api-contract` — signature/parameter mismatches, unused params, missing returns
+- `test-vacuity` — tests that pass when the fix is removed
+- `count-accuracy` — test counts from annotations vs code blocks
+- `plan-drift` — plan text vs committed code divergence
+- `identity-collision` — same-id different-payload, silent overwrites
+- `type-hygiene` — wrong-typed data passing validation, dict-as-str
+- `error-masking` — observability/utility layers raising inside except blocks
+- `state-machine` — illegal transitions, unreachable states, poison records
+- `pagination-truncation` — APIs silently capping result sets
+- `scope-creep` — consumer adaptations beyond the planned file list
+- `degraded-channel` — partial-failure information loss through rebuilds
+
+## Entries
+
+```yaml
+- id: count-code-block-not-annotation
+  class: count-accuracy
+  severity: minor
+  tags: [plans, testing, discipline]
+  detection: "compare the number of test functions in the plan's CODE BLOCK to the stated count"
+  example: "Plan 1 event store: annotation said 7, code block had 6 (commit e954952)"
+  fix: "always count the code block; the annotation is stale until proven otherwise"
+
+- id: silent-pagination-truncation
+  class: pagination-truncation
+  severity: critical
+  tags: [api, data-access, filtering]
+  detection: "any listForRepo/listIssues call with per_page > 50 — Gitea caps silently"
+  example: "Teacher's per_page=100 fetched only 30 issues; open dep #19 fell off the map and looked closed (PR #119)"
+  fix: "paginate all pages (loop until batch < per_page); verify any dep not in the open list individually via issues.get"
+
+- id: verify-unknown-deps-not-guess
+  class: pagination-truncation
+  severity: critical
+  tags: [api, logic, state-management]
+  detection: "any dependency/state check that treats 'not found in fetched list' as 'doesn't exist / is closed'"
+  example: "Teacher treated missing-from-map as closed — the truncation made this a false-positive factory"
+  fix: "fetch the actual state of anything not in the cached list; treat not-found as unsatisfied, not satisfied"
+
+- id: vacuous-discharge-test
+  class: test-vacuity
+  severity: critical
+  tags: [testing, discipline, red-green]
+  detection: "a discharge/remediation test that PASSES when the fix it claims to verify is removed"
+  example: "S5 restart test passed with save/load deleted — the durable mapping + lazy re-register masked it (quality gate general-134)"
+  fix: "RED-GREEN prove: remove the fix, verify the test FAILS, restore, verify it PASSES. Non-negotiable."
+
+- id: count-test-annotation-vs-block
+  class: count-accuracy
+  severity: minor
+  tags: [plans, testing]
+  detection: "plan says 'N tests' but the code block contains a different number"
+  example: "M2 cursor plan said 5, code block had 5 (correct); M6 plan said 8, code block had 6"
+  fix: "count the block; correct the annotation; never trust the prose"
+
+- id: aliasing-returned-objects
+  class: aliasing
+  severity: important
+  tags: [data-access, registry, mutation]
+  detection: "any get()/all()/mark() that returns the internal object directly when the record is mutable"
+  example: "SurfaceRegistry stored caller-owned records; post-register mutation corrupted the registry (quality gate general-121)"
+  fix: "store a defensive copy (dataclasses.replace) on write; or freeze the record; caller mutation must never corrupt internal state"
+
+- id: external-id-collision-silent-overwrite
+  class: identity-collision
+  severity: critical
+  tags: [registry, identity, data-integrity]
+  detection: "any bidirectional map (id ↔ external) where one direction overwrites on collision but the other guards"
+  example: "SurfaceRegistry guarded id→external but not external→id; a different surface_id claiming a bound external_id silently overwrote (quality gate general-121)"
+  fix: "guard BOTH directions; a collision in either direction raises ValueError"
+
+- id: mutation-id-collision-same-version-different-payload
+  class: identity-collision
+  severity: important
+  tags: [deduplication, planner, idempotency]
+  detection: "any deterministic ID computed from a subset of the record's fields — check if a different payload with the same key fields collides"
+  example: "DelegationPlanner used plan_version|target|ordering_key — same version + same count + different stage names = same ID = silent drop via append no-op (quality gate general-109)"
+  fix: "include a content hash in the canon so different payloads never collide"
+
+- id: corruption-silent-skip
+  class: corruption-handling
+  severity: important
+  tags: [persistence, data-integrity, error-handling]
+  detection: "any except on load/parse that doesn't re-raise a typed error"
+  example: "MappingStore._load raised raw JSONDecodeError; G1 OutboxStore raised CorruptOutboxError — both established the house convention"
+  fix: "wrap in a typed error (CorruptXError); never silently skip; per-item validation (type-check the fields the consumer depends on)"
+
+- id: wrong-typed-fields-bypass-validation
+  class: type-hygiene
+  severity: important
+  tags: [persistence, data-integrity, schema]
+  detection: "from_dict() that accepts any dict without checking field types — wrong-typed fields load silently"
+  example: "OutboxStore state:123 loaded fine and was silently excluded from pending() — a permanent stall (quality gate general-102)"
+  fix: "validate load-critical field types AFTER from_dict; raise typed error on mismatch"
+
+- id: observability-recursion-trap
+  class: error-masking
+  severity: important
+  tags: [observability, error-handling, logging]
+  detection: "any record/log/emit function called from inside a caller's except block — if IT raises, it masks the original failure"
+  example: "record_failure's reg.record() was unguarded; a raising registry propagated OSError from inside the caller's except (quality gate general-156)"
+  fix: "wrap the ENTIRE body of the observability function in try/except; the last resort is suppress, never re-raise"
+
+- id: state-machine-poison-record
+  class: state-machine
+  severity: critical
+  tags: [lifecycle, state-management, crash-recovery]
+  detection: "a record stuck in a state that has no outgoing transition to a recoverable state — every future operation raises"
+  example: "A record stuck in 'sending' had no sending→sending transition; every later reconcile() raised InvalidTransition (quality gate general-106)"
+  fix: "add the self-loop for crash recovery; audit every state for 'what if the process dies here'"
+
+- id: partial-commit-window
+  class: transactional-integrity
+  severity: important
+  tags: [persistence, ordering, durability]
+  detection: "multi-step mutations where some steps are durable and others are in-memory — a crash between them leaves inconsistent state"
+  example: "M6 synthesize() committed cursor + chain before mark_synthesized; a mid-loop mark failure left a partial commit (quality gate general-99)"
+  fix: "durable operations FIRST, in-memory operations after; or validate all inputs before ANY write"
+
+- id: degraded-information-loss-through-rebuild
+  class: degraded-channel
+  severity: minor
+  tags: [observability, data-flow]
+  detection: "any response/object rebuild that constructs a new instance without copying observability fields"
+  example: "Protocol-scrub rebuilt OperatorResponse without carrying degraded — failures invisible on the scrub path (quality gate general-156)"
+  fix: "copy ALL fields on rebuild, not just the ones the scrub changes"
+
+- id: api-signature-drift-between-plan-and-impl
+  class: api-contract
+  severity: important
+  tags: [plans, api, integration]
+  detection: "plan's Interface prose says one signature; the Step-3 code block has another; the committed code has a third"
+  example: "EventEnvelope plan assumed payload/source fields that don't exist on the canonical record (P0-06 pre-dispatch correction)"
+  fix: "verify the REAL API (read the actual module) before writing plan code blocks; when the plan drifts, the code block wins"
+
+- id: mark-returns-stored-record
+  class: api-contract
+  severity: minor
+  tags: [persistence, api, chaining]
+  detection: "a mutation method that returns None when callers need the stored result to chain"
+  example: "OutboxStore.mark() originally returned None; the reconciler needed the stored record to chain (plan defect note 7)"
+  fix: "mutation methods return the stored/updated record for chaining"
+
+- id: dead-import-in-frozen-spec
+  class: plan-drift
+  severity: minor
+  tags: [plans, lint, testing]
+  detection: "frozen test/impl blocks importing modules they don't use (F401)"
+  example: "Multiple plans had unused imports in frozen blocks (json, event_bus, Path) — sanctioned noqa or removal"
+  fix: "drop unused imports OR carry noqa with a plan-tail note; never leave them to trip the lint gate"
+
+- id: consumer-adaptation-beyond-plan-files
+  class: scope-creep
+  severity: minor
+  tags: [integration, consumer, plan]
+  detection: "a signature change that breaks callers NOT listed in the plan's Files section"
+  example: "X3 stats() dict→tuple broke rune_tui._cmd_events; X4 status-key change broke rune_tui pins filter"
+  fix: "grep ALL consumers of changed functions BEFORE committing; adapt required consumers; document as 'REQUIRED consumer adaptation'"
+
+- id: empty-input-matches-all
+  class: empty-input-edge
+  severity: important
+  tags: [filters, logic, data-access]
+  detection: "any 'x in y' filter where x could be empty string — empty string is always 'in' everything"
+  example: "recall('') matched every open pin (quality gate general-147)"
+  fix: "guard empty input with early return (abstention); or validate input non-empty"
+
+- id: sending-self-loop-crash-recovery
+  class: state-machine
+  severity: important
+  tags: [lifecycle, crash-recovery, resilience]
+  detection: "any state machine where a crash mid-transition leaves a record in a state with no self-loop — the record is a poison pill"
+  example: "OutboxLifecycle sending→sending added after G2 quality gate found the poison-record scenario (quality gate general-106)"
+  fix: "audit every state for crash-recovery; add self-loops where a re-entry is safe and desirable"
+
+- id: plan-block-latent-defect
+  class: plan-drift
+  severity: important
+  tags: [plans, api, implementation]
+  detection: "plan's code block calls a method that doesn't exist, or uses a signature that contradicts the real module"
+  example: "M3 ancestors() plan block had unguarded dict access (KeyError on unknown ID); M2 plan block used entry['included'] without fallback (commit 0a097aa)"
+  fix: "hand-trace every plan code block against the real API before dispatch; fix latent defects in the block, document in plan tail"
+
+- id: concurrency-last-write-wins
+  class: concurrency
+  severity: minor
+  tags: [persistence, concurrency, data-integrity]
+  detection: "any file-based store with whole-file rewrite on mutation and no locking"
+  example: "OutboxStore and MappingStore both rewrite the full file on mutation — two concurrent writers last-write-wins"
+  fix: "document single-writer discipline; or add a lock; or accept for single-process authorities"
+
+- id: emit-self-failure
+  class: error-masking
+  severity: minor
+  tags: [observability, resilience]
+  detection: "the event emit inside an observability function — if IT fails, is the failure visible?"
+  example: "rune_tui.py:3554 event_bus.emit('on_context') was wrapped in except: pass — the observability call itself could fail silently (survey finding)"
+  fix: "the observability layer's own failures are T2 (journal-only); they must not propagate but must be logged"
+```

docs/reviewer-dispatch-template.md

@@ -0,0 +1,63 @@
+# Reviewer Dispatch Template — includes review-lessons selection
+
+This template is for controller use when dispatching spec-compliance or
+code-quality review agents. It incorporates the review-lessons file with
+tag-based selection.
+
+## Controller pre-selection step
+
+Before dispatching, the controller:
+1. Identifies the files/subsystems in the diff (from the commit's name-status).
+2. Reads `docs/review-lessons.yaml` tag index.
+3. Selects entries whose tags match the diff scope.
+4. Includes ONLY the selected entries + the tag index in the dispatch prompt
+   (so the reviewer stays focused; the file can grow to 500+ entries without
+   relevance decay).
+
+## Tag-to-scope mapping (for controller selection)
+
+| Diff touches | Relevant tags |
+|---|---|
+| *_store.py, *_registry.py, persistence | corruption-handling, concurrency, transactional-integrity, type-hygiene, identity-collision |
+| *_test.py, tests/ | test-vacuity, count-accuracy |
+| plans/*.md | count-accuracy, plan-drift, api-contract, dead-import |
+| lifecycle.py, *_engine.py, state machines | state-machine, transactional-integrity |
+| *_health.py, observability, logging | error-masking, emit-self-failure |
+| router.py, delegation, planner | identity-collision, api-contract, pagination-truncation |
+| Any file with `except` blocks | error-masking, corruption-handling |
+| Any function returning objects | aliasing |
+| Any API that lists/filters | empty-input-edge, pagination-truncation |
+
+## Standard reviewer preamble (include in every review dispatch)
+
+```
+Read docs/review-lessons.yaml (tag index + selected entries below) before
+reviewing. These are defect classes this project's review gates have caught
+— check for them proactively. If you find a defect class NOT in the file,
+include a structured `## New lessons` section in your findings report with:
+id, class, severity, tags, detection, example (this commit), fix.
+```
+
+## Auto-append convention
+
+At issue close-time, the controller:
+1. Extracts any `## New lessons` sections from the review findings.
+2. Validates the entries (required fields present, example commit exists).
+3. Appends to `docs/review-lessons.yaml`.
+4. Commits with message: `docs(lessons): add [N] entries from [issue] review`
+
+The file grows as a byproduct of reviewing — no separate maintenance task.
+
+## Cross-model decorrelation (#128)
+
+The reviewer model MUST differ from the implementer model. Self-preference
+bias (Panickssery et al., NeurIPS 2024; arXiv 2604.22891) shows 17/20 models
+systematically favor their own outputs. The mitigation: cross-model judging.
+
+Rules:
+- Implementation dispatch: `model: "Verboo Code/glm-5.3-flash"` (or the current
+  implementation model)
+- Review dispatches (spec + quality): use a DIFFERENT model family — e.g.
+  a local Qwen via Ollama, or a different provider
+- The reviewer model doesn't need to be BETTER, just DIFFERENT
+- Log the model used per review in the findings (for calibration tracking)

docs/structural-contract.md

@@ -0,0 +1,59 @@
+# Structural Contract — henxels Adoption (#138)
+
+The repo's shape is machine-checkable. `henxels.yaml` (repo root) holds the
+contract; `henxels sync` renders it into the `AGENTS.md` digest agents read;
+`henxels check --all --plain` enforces it (exit 0 = green, 1 = red) and runs as
+a CI lint-job step.
+
+## What the contract governs
+
+| Henxel | Scope | Rule |
+| --- | --- | --- |
+| Canaries registered in CI | `./src/rune/canary_*.py` | Custom statement `ci_runs_all_canaries` (in `henxels_checks.py`): every canary on disk must appear in `.gitea/workflows/ci.yml` |
+| No secrets | whole repo | `no_secrets` — no credentials in tracked files |
+| Plans | `./plans` | markdown only, kebab-case filenames |
+| Docs | `./docs/*` | `.md`/`.yaml` only, except `docs/v1/**` and `docs/wiki/**` |
+| File-size debt | `./src/rune` | `max_lines: 1200`, except the documented debt list below |
+
+Warnings (non-blocking): near-duplicate file detection (the `shared/` vs
+`src/rune/` copies and `backups/` snapshots are pre-existing debt the warning
+correctly keeps visible).
+
+## Debt table
+
+Known violations, explicitly excepted in `henxels.yaml` instead of silently
+ignored. Each entry lists the finding that forced the exception.
+
+| File / spot | Rule | Finding | Disposition |
+| --- | --- | --- | --- |
+| `src/rune/rune_tui.py` | max_lines 1200 | 4231 lines (drafted exception) | except-listed; split is future work |
+| `src/rune/rune_operator.py` | max_lines 1200 | 1265 lines (drafted exception) | except-listed; split is future work |
+| `src/rune/local_tool_runtime.py` | max_lines 1200 | 506 lines — drafted as pre-emptive headroom, not currently over budget | except-listed (as drafted) |
+| `src/rune/memory_store.py` | max_lines 1200 | 2171 lines (live finding) | except-listed; split is future work |
+| `src/rune/curator.py` | max_lines 1200 | 1597 lines (live finding) | except-listed; split is future work |
+| `src/rune/tool_executor.py` | max_lines 1200 | 1523 lines (live finding) | except-listed; split is future work |
+| `src/rune/warm_router.py` | max_lines 1200 | 1292 lines (live finding) | except-listed; split is future work |
+| `tests/test_gitea_provision.py` | no_secrets | flagged as hardcoded credential — actually synthetic fixture tokens (`plaintext-transport-test-secret` etc.) whose purpose is asserting tokens never leak | except-listed (false positive) |
+| `src/rune/canary_native.py` | canary gate | tui_validator's import allowlist drifted from `rune_tui.py` (`from __future__ import annotations`, bare `import rune`) — 2 false-failures; validator fix is issue #139, not here | canary tolerates exactly those 2 messages (prints `⚠ known false-failure, #139`, does not count them); any other TUI error still fails the canary |
+
+## How to add a rule
+
+1. Prefer a built-in: `henxels catalogue` lists every statement (built-ins and
+   this repo's custom ones).
+2. Add a henxel to `henxels.yaml`. Custom statements live in
+   `henxels_checks.py` (auto-loaded; a `.henxels/` folder of check modules also
+   works). Custom statements REQUIRE an `in:` scope — without one they never
+   fire.
+3. Run `henxels check --all --plain` locally; fix findings cheaply or add an
+   explicit `except:` and a row to the debt table above.
+4. `henxels sync` to refresh `AGENTS.md` and commit both together.
+5. The contract must be green at birth: never merge a rule that fails on
+   master.
+
+## Why no git hooks
+
+Subagents work in throwaway worktrees (`/mnt/workdrive/rune` and siblings) and
+commit there; a pre-commit hook would either miss those commits or block the
+agent mid-flight. Enforcement is CI-only: the lint job runs
+`henxels check --all --plain` on every push/PR, so the gate is the merge, not
+the commit.

henxels.yaml

@@ -0,0 +1,34 @@
+settings:
+  warn_about_similar_files:
+    above: 0.85
+    ignore: ["docs/review-lessons.yaml", "docs/v1/**", "docs/wiki/**"]
+
+henxels:
+  - henxel: "Canaries live at the repo's canary slot and are registered in CI"
+    in: ./src/rune/**/canary_*.py
+    ci_runs_all_canaries: true
+
+  - henxel: "No secrets in tracked files"
+    no_secrets: true
+    except: ["./tests/test_gitea_provision.py", "./.ci-venv/**", "./.test-venv/**", "./.canary-venv/**", "./backups/**"]
+
+  - henxel: "Plans are markdown, one per build"
+    in: ./plans
+    allowed_filetypes: [.md]
+    filename_casing: kebab-case
+
+  - henxel: "Top-level docs are markdown or yaml references"
+    in: ./docs/*
+    allowed_filetypes: [.md, .yaml]
+    except: ["./docs/v1/**", "./docs/wiki/**"]
+
+  - henxel: "The known giant stays visible — file-size debt is tracked, not silent"
+    in: ./src/rune/*
+    except:
+      - ./src/rune/rune_tui.py
+      - ./src/rune/rune_operator.py
+      - ./src/rune/memory_store.py
+      - ./src/rune/curator.py
+      - ./src/rune/tool_executor.py
+      - ./src/rune/warm_router.py
+    max_lines: 1200

henxels_checks.py

@@ -0,0 +1,17 @@
+from pathlib import Path
+
+from henxels import statement
+
+
+@statement("ci_runs_all_canaries", help="every src/rune/**/canary_*.py is listed in .gitea/workflows/ci.yml")
+def ci_runs_all_canaries(param, file, root):
+    if not (file.startswith("src/rune/") and Path(file).name.startswith("canary_")):
+        return None
+    if not file.endswith(".py"):
+        return None
+    ci = root / ".gitea" / "workflows" / "ci.yml"
+    if not ci.exists():
+        return f"{file} is missing from .gitea/workflows/ci.yml (no ci.yml found)"
+    if Path(file).name in ci.read_text():
+        return None
+    return f"{file} is missing from .gitea/workflows/ci.yml — register it in the canary job's for-loop list"

plans/2026-09-03-pipeline-order-gate-ledger.md

@@ -0,0 +1,47 @@
+# Pre-Build Ledger — Pipeline Order Gate (#106)
+
+## Research pin
+- No external research: the mechanism composes proven in-repo patterns —
+  auto-label.yml (actions/github-script@v7, label add/remove via the API,
+  self-hosted runner), auto-version.yml (secrets.GITEA_TOKEN + curl API),
+  and the design's S4 doctrine (Gitea owns coordination state/ORDER; Rune
+  owns code). Nick's design (recorded in #106 + memory): CHECK half
+  (ready-label gate) + TEACH half (close-triggered next-issue announcer).
+
+## Feasibility
+- Moderate: one new workflow file, two jobs (gate on `issues: [labeled]`,
+  teacher on `issues: [closed]`). github-script gives full API access
+  (listLabelsOnIssue, setLabels, createComment, listIssues with label
+  filter). Dependency refs parsed from the body via a regex —
+  `Depends on: #N` lines. Risk: label API 404s (labels not yet created) —
+  handle by creating on demand or tolerating 404.
+
+## Complexity
+- Low-moderate. No Python module changes (workflow-only + one small JS-ish
+  script inline); the dependency-parse logic is extracted into a tiny
+  testable helper? NO — workflow-only; the parse logic is verified through
+  real label cycles per #106's acceptance (behavioral verification, red =
+  no workflow).
+
+## Canaries (verification contract)
+- RED: before the workflow exists, labeling `ready` on an issue with an open
+  dep does nothing (no blocked label, no comment).
+- GREEN: labeling an issue `ready` whose `Depends on: #N` includes an OPEN
+  issue → Gitea removes `ready`, adds `blocked`, comments "Blocked by #N".
+- GREEN: labeling `ready` with all deps closed → keeps `ready`, comments
+  "READY — order satisfied; Rune may start".
+- TEACH: closing an issue → the teacher posts on the NEXT ready-eligible
+  issue: "NEXT: #X — <title> — dependencies satisfied; Rune may start" +
+  `ready` label.
+- Verified by live label cycles against the real repo (self-hosted runner).
+
+## Consent
+- Delegated (standing directive); issue #106 carries the v4 gate + the full
+  loop amendment.
+
+## Priority gate addendum (2026-09-04, Nick directive)
+- Triage sweep: all 41 open issues carried a priority or were closed (#56/#57 stale series records, #4 superseded by built reality, #1/#5 → P2 fold-into #37, #2 → P2, #3 → P1 material-conditions, #13 → P1 normalized from 'priority: high').
+- Scale: single P0-P3 (the v1 epic's scale); 'priority: high' normalized away.
+- Templates: feature.md + bug.md Priority sections now REQUIRED (P0-P3 checkboxes).
+- Enforcement: auto-label.yml gains a priority-gate job — issues landing without P0-P3 get 'unprioritized' + a demand comment; prioritizing clears it.
+- Interaction with the order teacher: priority = WHERE in the queue; pipeline-gate teacher = WHEN it's next.

plans/2026-09-03-tui-footer-ledger.md

@@ -0,0 +1,31 @@
+# Pre-Build Ledger — TUI Footer (#105)
+
+## Research pin
+- No external research needed: single-source-of-truth mechanism already exists
+  (`src/rune/__init__.py::__version__` — the policy test
+  `tests/test_build_pipeline_policy.py` enforces 5-surface sync at release).
+- Codebase facts (verified): TUI `rune_tui.py` has `#footer-bar` (Horizontal,
+  dock bottom, height 1) containing StatusBar + refresh Static; StatusBar is
+  the status-line widget; `__version__` importable from `rune`.
+- Design decision: a `VersionLabel(Static)` in the footer-bar rendering
+  `v{__version__}` — DERIVED from the import (reactive to release by
+  construction; the policy test already forces `rune_tui.py` banner sync, and
+  this label reads the import directly so it can never drift).
+
+## Feasibility
+- Trivial: add a small widget + compose it into the existing footer-bar.
+- Cost: ~30 lines + 1-2 tests. Risk: minimal (purely additive UI element).
+
+## Complexity
+- Low. No new modules, no store changes, no migration. One consumer (the TUI).
+
+## Canaries (TDD — the contract)
+- test_version_label_renders_reviewed_version: VersionLabel renders text
+  containing f"v{__version__}".
+- test_footer_bar_contains_version_label: the app's #footer-bar includes the
+  VersionLabel (wiring — no source-only completion).
+- Regression: full suite green; policy test (5-surface sync) unchanged.
+
+## Consent
+- Delegated by standing directive (Nick: "continue the open issues... while I
+  sleep"); issue #105 filed with the v4 gate.

plans/2026-09-03-tui-footer.md

@@ -0,0 +1,149 @@
+# TUI Footer Version Display Plan (#105)
+
+> **For agentic workers:** execution conventions from session memory apply (TDD,
+> frozen tests are the spec, C5 lint-bytes, both review gates, task-board
+> discipline, actor dispatch contract, red-green discharges).
+
+## Purpose
+
+Issue #105: a persistent TUI footer element showing the current semantic
+version — DERIVED from `src/rune/__init__.py::__version__` (the single source
+of truth), so it is reactive to whatever release is installed and accurate to
+it. Nick can see at a glance whether the running build is up to date.
+
+**Design decision:** the label reads the IMPORT at render time — it cannot
+drift from the release by construction. (The banner/status-line literals stay
+as they are; the policy test enforces their sync at release. This new label is
+additionally derived, so it's always accurate even mid-development.)
+
+**Files:**
+- Modify: `src/rune/rune_tui.py` (VersionLabel widget + compose into #footer-bar)
+- Test: `tests/test_version_footer.py` (NEW — TUI-widget test file; Textual
+  widgets are imported but NOT run headless here; tests assert composition and
+  render content via the widget API)
+
+## Task (single)
+
+**Interfaces:**
+- `class VersionLabel(Static)` in rune_tui.py — `render()` returns
+  `f"v{__version__}"` (imported from `rune`), CSS class `version-label`,
+  tooltip "Running version — compare with the latest Gitea release".
+- Composed into `#footer-bar` BEFORE the refresh button:
+  `yield VersionLabel(id="version-label")`.
+
+#### Step 1: frozen tests
+
+Create `tests/test_version_footer.py`:
+
+```python
+"""TUI footer version label: derived from the single source of truth."""
+
+from rune import __version__
+from rune.rune_tui import VersionLabel
+
+
+def test_version_label_renders_reviewed_version():
+    label = VersionLabel()
+    rendered = str(label.render())
+    assert f"v{__version__}" in rendered
+
+
+def test_version_label_tracks_version_change(monkeypatch):
+    # Reactive by construction: the label reads the import at render time.
+    import rune
+
+    monkeypatch.setattr(rune, "__version__", "9.9.9")
+    label = VersionLabel()
+    assert "v9.9.9" in str(label.render())
+
+
+def test_version_label_importable_and_static_subclass():
+    from textual.widgets import Static
+
+    assert issubclass(VersionLabel, Static)
+```
+
+#### Step 2: red
+
+Run: `PYTHONPATH=src:. python3 -m pytest tests/test_version_footer.py -q`
+Expected: FAIL — ImportError (no VersionLabel).
+
+#### Step 3: implement
+
+In `src/rune/rune_tui.py` (near the StatusBar class definition), add:
+
+```python
+from rune import __version__ as _rune_version
+
+
+class VersionLabel(Static):
+    """Footer semver display — derived from the canonical __version__."""
+
+    def render(self) -> str:
+        return f"[dim]v{_rune_version}[/dim]"
+```
+
+(If `rune` is already imported in rune_tui.py, reuse that import; place the
+class BEFORE the RuneApp compose uses it. In `RuneApp.compose`, inside
+`with Horizontal(id="footer-bar")`, add BEFORE the StatusBar:
+`yield VersionLabel(id="version-label")`.)
+
+Add CSS after `#status-bar` block:
+
+```css
+    #version-label {
+        width: auto;
+        color: $text-muted;
+        padding: 0 1;
+    }
+```
+
+#### Step 4: green + wiring proof
+
+- `PYTHONPATH=src:. python3 -m pytest tests/test_version_footer.py -q` → 3 passed.
+- Wiring: the compose-inclusion is proven by grep in review (the label is
+  yielded in #footer-bar) — and the existing TUI smoke path
+  (`tests/test_tui_*.py` if any import cleanly) must stay green.
+- FULL suite: `PYTHONPATH=src:. python3 -m pytest tests/ -q --ignore=tests/test_message_widgets.py` → 422 + 3 = 425 expected
+  (NOTE: test_version_footer.py IS matched by -k orchestration? No — use the FULL suite).
+
+#### Step 5: lint + commit
+
+```bash
+git add src/rune/rune_tui.py tests/test_version_footer.py
+git commit -m "feat(tui): reactive semver version label in footer bar"
+```
+
+## Self-review
+
+- The monkeypatch test proves reactivity (the label renders the CURRENT module
+  attribute, not a copied literal).
+- Wiring pin: the reviewer must verify the `yield VersionLabel(...)` line
+  exists inside the `#footer-bar` with-context block (no source-only
+  completion).
+- Version surfaces: this ADDS a derived surface — the release-bump procedure
+  (5 literals) is unchanged; the label needs no bump (it reads the import).
+## Execution-time record (2026-09-03, commit 44cba5c)
+
+1. ENVIRONMENT: textual was MISSING (the -k/--ignore dance existed because of it). The
+   implementer installed textual 8.2.8 + textual-autocomplete 4.0.6 (user site,
+   --break-system-packages; rune_tui imports textual_autocomplete at module top). RESULT:
+   tests/test_message_widgets.py is now COLLECTABLE — the full suite (no exclusions) is
+   427 passed + 84 subtests (the --ignore form gives 425 + 3 new = same total). The
+   long-standing "test_message_widgets fails collection (textual missing)" env fact is
+   OBSOLETE going forward.
+2. CALLED-TIME READ (plan-snippet contradiction, sanctioned): the plan's Step-3 snippet
+   (`from rune import __version__ as _rune_version`) SNAPSHOTS the value and would fail the
+   frozen monkeypatch test; implemented as `import rune` + `render()` reading
+   `rune.__version__` at call time — the reactive-by-construction design the plan's own note
+   demands. Test 2 (v9.9.9) proves it.
+3. Wiring verified: `yield VersionLabel(id="version-label")` inside the #footer-bar
+   with-block BEFORE StatusBar (diff line 1318); #version-label CSS added; policy test
+   (5 surfaces) green — the label is DERIVED so the release procedure is unchanged.
+45. Post-quality note (2026-09-03; quality gate general-153 Approved with minors): the label
+    shows the version AT PROCESS START (module caching) — restart (the adjacent refresh
+    button) is the update path; render()'s call-time read is NOT hot-reload. No 6th literal
+    release surface (the label is derived by design; the 5-literal policy test stays). CI note
+    carried: ci.yml pins textual==8.2.0 (local 8.2.8) and runs an explicit file list —
+    test_version_footer.py must be added to CI in the next CI task (or the workflow moves to a
+    full-suite run now that textual installs cleanly).

plans/2026-09-04-forge-abstraction.md

@@ -0,0 +1,236 @@
+# Forge Abstraction Implementation Plan (#121)
+
+> **For agentic workers:** session conventions apply (TDD, frozen tests are the
+> spec, C5 lint-bytes, both review gates, task-board discipline, red-green
+> discharges, comprehensive-fix-only). Baseline: 433 passed + 84 subtests.
+
+## Purpose
+
+Issue #121: a config-driven forge client so Rune's automation works with Gitea, Forgejo, or no forge at all — never hardcoded to Nick's setup. This is the open-project readiness foundation and the prerequisite for the failure auto-filer (#122).
+
+## Design
+
+- `ForgeClient` protocol (runtime_checkable): `create_issue(title, body) -> dict`, `add_comment(issue_number, body) -> dict`, `get_issue_state(issue_number) -> dict`, `list_open_issues() -> list[dict]`
+- `GiteaForgejoAdapter(url, token)` — implements the protocol via `/api/v1` paths (identical on Gitea and Forgejo)
+- `NullAdapter` — every method returns a no-op dict; zero errors; for unconfigured/standalone use
+- `create_forge_client(config: dict | None)` factory — reads `forge.url` + `forge.token` from config; unconfigured → `NullAdapter`
+- Config source: environment variables `FORGE_URL` + `FORGE_TOKEN` (simplest, no config-file dependency)
+
+**Files:**
+- Create: `src/rune/forge_client.py`
+- Test: `tests/test_forge_client.py`
+
+## Task 1: frozen tests
+
+Create `tests/test_forge_client.py`:
+
+```python
+"""Forge client: config-driven, protocol-shaped, adapters for Gitea/Forgejo/none."""
+
+import json
+from unittest.mock import patch
+
+import pytest
+
+from rune.forge_client import (
+    ForgeClient,
+    GiteaForgejoAdapter,
+    NullAdapter,
+    create_forge_client,
+)
+
+
+def test_protocol_is_structural():
+    assert issubclass(GiteaForgejoAdapter, ForgeClient)
+    assert issubclass(NullAdapter, ForgeClient)
+
+
+def test_null_adapter_is_noop():
+    adapter = NullAdapter()
+    r = adapter.create_issue("title", "body")
+    assert r["created"] is False
+    r = adapter.add_comment(1, "comment")
+    assert r["created"] is False
+    assert adapter.get_issue_state(1) == {"state": "unknown"}
+    assert adapter.list_open_issues() == []
+
+
+def test_create_forge_client_unconfigured_returns_null():
+    client = create_forge_client(None)
+    assert isinstance(client, NullAdapter)
+
+
+def test_create_forge_client_configured_returns_adapter(monkeypatch):
+    monkeypatch.setenv("FORGE_URL", "https://forge.example.com")
+    monkeypatch.setenv("FORGE_TOKEN", "test_token")
+    client = create_forge_client({})
+    assert isinstance(client, GiteaForgejoAdapter)
+    assert client._base_url == "https://forge.example.com/api/v1/repos/owner/repo"
+
+
+def test_gitea_adapter_create_issue_sends_post(monkeypatch):
+    adapter = GiteaForgejoAdapter("https://forge.example.com", "tok", owner="o", repo="r")
+    captured = {}
+
+    class FakeResponse:
+        def json(self):
+            return {"number": 42, "state": "open"}
+
+        def raise_for_status(self):
+            pass
+
+    def fake_post(url, **kwargs):
+        captured["url"] = url
+        captured["headers"] = kwargs.get("headers", {})
+        captured["json_data"] = kwargs.get("json", {})
+        return FakeResponse()
+
+    with patch("rune.forge_client.httpx.post", side_effect=fake_post):
+        result = adapter.create_issue("Test", "Body")
+
+    assert result["number"] == 42
+    assert "issues" in captured["url"]
+    assert captured["json_data"]["title"] == "Test"
+    assert captured["headers"]["Authorization"] == "token tok"
+```
+
+## Task 2: implement
+
+Create `src/rune/forge_client.py`:
+
+```python
+"""Config-driven forge client (issue #121).
+
+A ForgeClient can create issues, comment, and check state — with adapters
+for Gitea, Forgejo (identical /api/v1 paths), and none (graceful dormant
+for unconfigured/standalone use). Configuration comes from environment
+variables or a config dict — nothing is hardcoded to a specific setup.
+"""
+
+from __future__ import annotations
+
+import os
+from typing import Protocol, runtime_checkable
+
+import httpx
+
+
+@runtime_checkable
+class ForgeClient(Protocol):
+    def create_issue(self, title: str, body: str) -> dict: ...
+    def add_comment(self, issue_number: int, body: str) -> dict: ...
+    def get_issue_state(self, issue_number: int) -> dict: ...
+    def list_open_issues(self) -> list[dict]: ...
+
+
+class NullAdapter:
+    """No-op adapter for unconfigured/standalone use. Zero errors."""
+
+    def create_issue(self, title: str, body: str) -> dict:
+        return {"created": False, "reason": "no forge configured"}
+
+    def add_comment(self, issue_number: int, body: str) -> dict:
+        return {"created": False, "reason": "no forge configured"}
+
+    def get_issue_state(self, issue_number: int) -> dict:
+        return {"state": "unknown", "reason": "no forge configured"}
+
+    def list_open_issues(self) -> list[dict]:
+        return []
+
+
+class GiteaForgejoAdapter:
+    """Gitea/Forgejo adapter — /api/v1 paths (identical on both platforms)."""
+
+    def __init__(
+        self,
+        url: str,
+        token: str,
+        owner: str = "conductor",
+        repo: str = "rune",
+    ) -> None:
+        self._base_url = f"{url.rstrip('/')}/api/v1/repos/{owner}/{repo}"
+        self._token = token
+
+    def _headers(self) -> dict:
+        return {"Authorization": f"token {self._token}", "Content-Type": "application/json"}
+
+    def create_issue(self, title: str, body: str) -> dict:
+        r = httpx.post(
+            f"{self._base_url}/issues",
+            headers=self._headers(),
+            json={"title": title, "body": body},
+            timeout=30,
+        )
+        r.raise_for_status()
+        return r.json()
+
+    def add_comment(self, issue_number: int, body: str) -> dict:
+        r = httpx.post(
+            f"{self._base_url}/issues/{issue_number}/comments",
+            headers=self._headers(),
+            json={"body": body},
+            timeout=30,
+        )
+        r.raise_for_status()
+        return r.json()
+
+    def get_issue_state(self, issue_number: int) -> dict:
+        r = httpx.get(
+            f"{self._base_url}/issues/{issue_number}",
+            headers=self._headers(),
+            timeout=30,
+        )
+        r.raise_for_status()
+        return r.json()
+
+    def list_open_issues(self) -> list[dict]:
+        r = httpx.get(
+            f"{self._base_url}/issues?state=open&limit=50",
+            headers=self._headers(),
+            timeout=30,
+        )
+        r.raise_for_status()
+        return r.json()
+
+
+def create_forge_client(config: dict | None = None) -> ForgeClient:
+    """Create a forge client from config or environment.
+
+    Config keys: forge.url, forge.token, forge.owner, forge.repo.
+    Falls back to FORGE_URL/FORGE_TOKEN/FORGE_OWNER/FORGE_REPO env vars.
+    Unconfigured → NullAdapter (graceful dormant).
+    """
+    cfg = config or {}
+    url = cfg.get("forge.url") or os.environ.get("FORGE_URL", "")
+    token = cfg.get("forge.token") or os.environ.get("FORGE_TOKEN", "")
+    if not url or not token:
+        return NullAdapter()
+    owner = cfg.get("forge.owner") or os.environ.get("FORGE_OWNER", "conductor")
+    repo = cfg.get("forge.repo") or os.environ.get("FORGE_REPO", "rune")
+    return GiteaForgejoAdapter(url, token, owner=owner, repo=repo)
+```
+
+## Task 3: docs
+
+`docs/forge-client.md` — how to configure, the protocol, the adapters.
+
+## Task 4: verify + commit
+
+- Full suite → 433 + 5 = 438 expected.
+- ruff check + format on new files.
+- Commit: `feat(forge): config-driven forge client with Gitea/Forgejo/none adapters`
+
+## Execution-time record (2026-09-04, commit ce22b73)
+
+Two spec conflicts found — frozen tests won, implementation adjusted:
+1. NullAdapter.get_issue_state returns exactly {"state": "unknown"} (snippet had extra "reason" key; test asserts exact dict equality)
+2. Default owner/repo is "owner"/"repo", not "conductor"/"rune" (test asserts _base_url for factory defaults)
+Suite: 433 + 5 = 438. Ruff clean on both new files.
+
+## Post-quality pins (2026-09-04; quality gate general-159 Approved with minors)
+- #122 must define a forge error policy (typed exceptions or documented httpx propagation)
+- #122 must add error-propagation/timeout tests
+- list_open_issues hardcodes limit=50, no pagination — needs pagination before triage loops
+- NullAdapter: consider first-use warning log (standalone by choice vs typo'd URL)
+- No close()/connection pooling — fine at current volume; consider shared httpx.Client if #122 bursts

plans/2026-09-04-p0-02-conversation-state.md

@@ -0,0 +1,88 @@
+# P0-02 ConversationState/TaskState — Implementation Plan (#18)
+
+> **For agentic workers:** session conventions apply. Baseline: 438 passed + 84 subtests.
+> The research ledger (plans/2026-09-04-p0-02-ledger.md) is the evidence base.
+
+## Purpose
+
+Issue #18 (P0-02): canonical ConversationState and TaskState. Conversations persist across messages; an active task stays active until completed/cancelled/replaced; follow-ups inherit the correct task. This is the foundation for #19 (ContextBroker) and the rest of the v1 chain.
+
+## Architecture (from research)
+
+Two new repositories, backed by the orchestration primitives:
+
+- **TaskStateRepository** — canonical task identity. One task persists until explicit transition. Follow-ups amend the active task instead of creating a new one.
+- **ConversationStateRepository** — durable message history. ChannelView.messages becomes a projection.
+
+**Persistence:** transitions/messages append to `DurableEventStore` (already built in Plan 1); `AtomicStore` for hot checkpoints (current-task pointer, pending approval).
+
+**New records** (subclass OrchestrationRecord): `TaskStateRecord`, `ConversationMessageRecord`.
+
+**New module:** `src/rune/orchestration/conversation_state.py`
+
+## Design decisions
+
+1. **TaskStateRecord fields:** task_id (new_id("task")), title, status (created→running→awaiting_approval→completed|failed|cancelled|superseded), channel_id, parent_task_id (for follow-ups), assigned_model, created_at, updated_at, outcome_ref
+2. **ConversationMessageRecord fields:** msg_id (new_id("msg")), ts, role (user/assistant/system/tool), content, channel_id, task_id, token_estimate
+3. **TaskStateRepository API:** `create(title, channel_id, model) -> TaskStateRecord`, `amend(task_id, title) -> TaskStateRecord` (follow-up: updates title, keeps same task_id), `transition(task_id, new_status) -> TaskStateRecord`, `get_active(channel_id) -> TaskStateRecord | None`, `get(task_id) -> TaskStateRecord | None`, `list_open(channel_id) -> list`
+4. **ConversationStateRepository API:** `append(msg: ConversationMessageRecord)`, `window(channel_id, n=8) -> list[ConversationMessageRecord]`, `messages_for_task(task_id) -> list`, `latest_task(channel_id) -> TaskStateRecord | None`
+5. **Integration:** `send_task` checks `get_active(channel_id)` — if an active task exists and the message looks like a follow-up (starts with confirmation pattern or the task is still running), it calls `amend()` instead of `create()`. The TUI's `ChannelView.messages` loads from the repository on mount.
+6. **Composition:** AUTHORITY_KINDS gains `conversation_state` + `task_state`; `build_conversation_state(root)` wires one of each.
+
+## Implementation tasks
+
+| Task | Deliverable | Tests |
+|---|---|---|
+| CS1 | TaskStateRecord + ConversationMessageRecord (records.py) | 3 |
+| CS2 | TaskStateRepository (create/amend/transition/get_active/get/list_open) | 6 |
+| CS3 | ConversationStateRepository (append/window/messages_for_task/latest_task) | 4 |
+| CS4 | Composition (build_conversation_state + AUTHORITY_KINDS) + integration (send_task delegates) | 4 |
+| CS5 | Migration (import 110 legacy tasks from operator.json) + canary + docs + CI | 4 |
+
+Target suite: 438 + 21 = **459**
+
+## Scope guard
+
+- Do NOT let repositories assemble prompts (that's #19 ContextBroker)
+- Do NOT create a parallel authority path — replace operator.json/task_persist/work_manager
+- Do NOT break the TUI — ChannelView.messages becomes a projection, not a rewrite
+- The ambient-context dead path is fixed by attaching context to ConversationState, not the hasattr hack
+
+## External research (in progress — general-162)
+
+The external state-of-the-art survey will inform the implementation plan:
+- Recommended libraries/patterns for conversation state and task persistence
+- Production approaches to multi-turn task continuation
+- Things to adopt or avoid based on the state of the art
+
+The implementer (general-160) should incorporate the external findings when
+they arrive — design decisions may change based on what the research reveals.
+
+## External research synthesis (general-162, 2026-09-04)
+
+The following BUILD INSTRUCTIONS come from the external SOTA survey (LangChain/LangGraph, Anthropic, ActiveWizards, Decagon DST, MLM persistence patterns):
+
+### Adopt
+- LangGraph's **checkpointer-vs-store split**: thread-scoped short-term (conversation continuity) vs cross-thread long-term (user facts) — replicate this two-layer architecture
+- `thread_id` as universal recovery key (keep <255 chars — PostgresSaver column limit)
+- Explicit state machine with named statuses and guarded transitions
+- Checkpoint at **phase boundaries** (plan → execute → review), not every micro-step
+- **Idempotent side effects**: checkpoint-resume ≠ exactly-once; transitions with side effects must be re-executable safely
+- **Archive raw history before summarization** — summarization is lossy, you cannot recover what you overwrote
+- **Retention/pruning policy** from day one — checkpoint tables grow unboundedly
+- **Checkpoint history** (append-only) for replay-with-modified-state debugging
+
+### Avoid
+- In-memory state in production (restart kills in-flight threads)
+- Storing secrets/credentials in state
+- Storing large documents/tool outputs inline in state
+- Unbounded messages arrays or checkpoint tables
+- Mid-conversation summarization without external archive
+- Application-layer tenant scoping (fails open; storage-layer fails closed)
+
+### Concrete constraints
+- thread_id < 255 chars
+- json.dumps(state) < 50KB per checkpoint
+- Store references not content (large artifacts → ID/key in state, payload in object storage)
+- Backend: SQLite is fine for single-process with persistent volume; Postgres for multi-process
+- DEADLOCK FIX: the original Lock was non-reentrant — _append_inner calls flush() which tried to re-acquire → deadlock. Fixed to RLock (reentrant). This is why the comprehensive fix matters: the symptom-patch approach (just add self-edges) would have shipped a deadlock.

plans/2026-09-04-p0-02-ledger.md

@@ -0,0 +1,68 @@
+# Pre-Build Ledger — P0-02 ConversationState/TaskState (#18)
+
+## Research pin (2026-09-04; explore-18 survey + authority map)
+
+**Root cause of the task-spawning bug:** `send_task()` (rune_operator.py:211-289)
+unconditionally mints a new RuneTask on every call (line 217:
+`task_id=str(uuid.uuid4())[:8]`), appends it, sets `current_task`, then clears
+`current_task=None` on completion. No continuation concept exists anywhere.
+The TUI always calls bare `send_task(text, model=...)` — no task id, no
+continuation flag.
+
+**Four competing task ledgers:**
+1. `rune_operator.py:97-144` — RuneTask/RuneState → `~/.rune/operator.json`
+   (non-atomic write). **Authoritative** for ordinary turns. 110 tasks on disk.
+2. `task_persist.py:27-130` — fcntl-locked JSON at `~/.rune/memory/tasks/persisted.json`.
+   **Broken/dormant**: TUI calls `task_persist.load()` but only `_load` exists —
+   AttributeError swallowed by `except`. File doesn't exist on disk.
+3. `work_manager.py:59-100` — WorkItem/Batch/TaskMeta → `~/.rune/work/*.json`.
+   Used only by /audit//work commands.
+4. `message_queue.py:67-78` — QueuedMessage → `~/.rune/message_queue/queue.json`.
+
+**Conversation state:** no owner. `ChannelView.messages` is display-only.
+`_conversation_messages()` (rune_operator.py:299-315) rebuilds model context
+from last 8 completed RuneTasks — loses everything past 8 pairs, failed/pending
+tasks, tool events, channel identity.
+
+**Dead path found:** ambient context stored on RuneApp
+(`_ambient_repo_map/_ambient_files/_ambient_functions`) but the operator reads
+them off the RuneTask via `hasattr(task, "_ambient_repo_map")` — always False,
+never injected.
+
+**Existing infra to reuse:** OrchestrationRecord base, DurableEventStore
+(durable log for transitions), AtomicStore (hot checkpoints), ProjectionEngine
+(checkpointed projections), CompositionRoot (authority kinds).
+
+## Recommended architecture (from research)
+
+- **TaskState** (OrchestrationRecord): task_id, title, status
+  (created→running→awaiting_approval→completed|failed|cancelled|superseded),
+  channel_id, parent_task_id, assigned_model, created_at, updated_at,
+  amendment_refs, approval, outcome_ref
+- **ConversationMessage**: id, ts, role, kind, content, channel_id, task_id,
+  token_estimate
+- **Persistence**: transitions/messages append to DurableEventStore;
+  ProjectionEngine checkpoints via AtomicStore for O(1) reads
+- **API**: TaskStateRepository.create/amend/transition/get_active/list_open/get;
+  ConversationStateRepository.append/window/messages_for_task/latest_task
+- **Integration**: send_task delegates to repositories; ChannelView.messages
+  becomes a projection; operator.json/task_persist/work_manager become
+  adapters or retire
+
+## Risks/gotchas (from research)
+1. 110 legacy tasks need import-or-archive migration
+2. task_persist.load() proves silent excepts hide breakage — fail loudly
+3. TUI mutates widgets from workers — thread-safe repository access
+4. Do NOT let repositories assemble prompts (that's #19)
+5. Fix ambient-context dead path via ConversationState, not hasattr hack
+6. Extend AUTHORITY_KINDS + build_root; update composition tests/canaries
+
+## Feasibility
+Moderate-high: new records + repositories + event store integration +
+operator/TUI adapter changes + migration of 110 legacy tasks. Multi-day build.
+
+## Complexity
+High. This is the architectural spine of v1.
+
+## Consent
+Autonomous (standing directive + no-consent-ask rule). Priority: P0 — critical.

plans/2026-09-04-p0-03-context-broker.md

@@ -0,0 +1,112 @@
+# P0-03 ContextBroker — Implementation Plan (#19)
+
+> **For agentic workers:** session conventions apply. This plan builds on #18 (ConversationState/TaskState) — the broker's history contributor adapts toward ConversationStateRepository.
+> The research ledger (plans/2026-09-04-p0-03-ledger.md) is the evidence base.
+
+## Purpose
+
+Issue #19 (P0-03): one authoritative ContextBroker. No subsystem may inject model context outside it. The broker assembles the full message array from typed contributors, enforces the token budget, and produces a trace showing exactly what the model received and why.
+
+## Architecture (from research)
+
+**ContextBroker** — the single authority for context assembly:
+- `register_contributor(name, callback, tier, budget)` — each contributor returns typed content + token estimate
+- `assemble_context(task, channel_id, capabilities) -> ContextResult` — runs contributors in priority order, admits/drops by budget, produces the full message array
+- `trace() -> list[TraceEntry]` — per-block record: name, tokens, admitted/dropped, source selector
+- `set_budget(tokens)` — single source replacing hardcoded num_ctx=8192 (13 sites)
+
+**ContextResult** — the broker's product:
+- `messages: list[dict]` — the full message array `[{system}, *history, {user}]` that LocalToolRuntime.run consumes
+- `trace: list[TraceEntry]` — per-block contribution record
+- `degraded: list[str]` — subsystems that failed (from P0-06 record_failure)
+- `total_tokens: int` — actual measured token count
+
+**AttentionCapsule** — extended to hold typed blocks and become the message product (currently a token-accounting ghost).
+
+**Contributors** (wrapping existing blocks verbatim, in priority order):
+1. `persona` — static persona/self-model (~980 tok, tier=required)
+2. `memory_recall` — memory_store.cached_recall (0-75 tok, tier=context)
+3. `persona_memories` — cached_recall identity context (0-75 tok, tier=context)
+4. `consolidated_knowledge` — MemoryConsolidation (0-400 tok, tier=context) — WITHOUT the write side effect
+5. `warm_neurons` — warm_neuron_store trigger scan (125-250 tok, tier=context)
+6. `graph_entities` — graph_memory.resolve_entity (0-100 tok, tier=context)
+7. `abstraction_facts` — raw SQL facts query (0-75 tok, tier=context)
+8. `model_profile` — model_profiles.get_prompt_context (0-60 tok, tier=context)
+9. `tool_names` — tool name list (~40 tok, tier=required)
+10. `history` — ConversationStateRepository.window (unbounded, tier=context)
+11. `user_prompt` — task text + safety override (task-sized, tier=required)
+
+**Budget enforcement:** contributors are admitted in priority order until the budget is exhausted. Required-tier contributors always admitted. Context-tier contributors dropped when budget exhausted (with trace entry: dropped-by-budget).
+
+## Implementation tasks
+
+| Task | Deliverable | Tests |
+|---|---|---|
+| CB1 | ContextBroker module (register/assemble/trace/set_budget) + ContextResult + TraceEntry | 6 |
+| CB2 | Contributors wrapping existing blocks (11 contributors) | 3 |
+| CB3 | Integration: _execute_on_model routes through broker; 21-step pipeline reduced to trace consumer | 4 |
+| CB4 | Memory-off invariant (selector gate zeros all 4 memory blocks) + budget enforcement | 3 |
+| CB5 | Composition + canary + docs + CI | 4 |
+
+Target suite: 438 + 20 = **458** (plus #18's tests when it lands first)
+
+## Scope guard
+
+- Contributors wrap existing blocks VERBATIM — characterization parity (same output before/after)
+- Do NOT create a parallel prompt path — the broker IS the path
+- The 21-step pipeline's side effects (warm-router state, hooks, sleep) migrate to EventScheduler (#48), NOT the broker
+- The fallback tool prompt (~2,500 tok) stays runtime-owned but traced
+- Safety-override prefix/suffix: broker owns final user-message assembly
+- Ambient context: explicitly re-wired as a budgeted contributor OR documented as dead — not silently fixed
+- 13 out-of-band model calls: out of scope for #19 (the broker invariant should eventually cover them, but that's a follow-up)
+
+## External research synthesis (general-161, 2026-09-04)
+
+The following BUILD INSTRUCTIONS come from the external SOTA survey (LangChain deep-agents, Anthropic context engineering, Microsoft RAG, context compiler pattern):
+
+### Validated (our architecture IS the SOTA)
+- Typed-blocks / contributor / priority-admission pattern — convergent SOTA shape
+- Confirmed by: LangChain middleware, Anthropic context curation, Microsoft structured blocks, context compiler pattern
+
+### Adopt
+- **Measured tokens**: tiktoken `o200k_base` as conservative over-counter for llama-family (~5-10% over) — never estimate
+- **Model config from Ollama `/api/show`** — per-model context length, never hardcode 8192 (13 sites currently do)
+- **Budget formula**: `input_budget = window − output_reserve(≥2048 or 25%) − 5% safety`
+- **Fixed assembly order**: system → tools → memory/notes → docs → history → user
+- **Deterministic admission**: sort by priority, then recency; drop lowest-priority that don't fit; emit admitted/dropped events
+- **History compaction** at ~80% window: (1) clear stale tool results, (2) rolling summary (intent/decisions/open items/next steps), (3) keep last 5-10 turns verbatim; persist offloaded history externally
+- **Fail loudly** if single block exceeds budget — no silent provider truncation
+
+### Avoid
+- LLMLingua (needs hosted scorer model — overkill for local app)
+- MCP-as-broker (data-source protocol, not in-process context manager)
+- RAG-everything (not a context manager)
+- Recursive summarization without fidelity test
+- Hardcoded token constants (num_ctx=8192 is the single worst offender)
+- Whole-framework adoption (LangChain/deepagents) for one concern — port the semantics
+
+### Testing (LangChain practice)
+- Needle-in-haystack recoverability test across compaction
+- Goal-drift check: does post-compaction turn still serve original intent?
+- Log tokens-per-block and compaction events
+
+## Phase 3: Innovation assessment (general-163, 2026-09-04)
+
+**Verdict: SOTA spine is sufficient.** Four local-first gaps worth adopting; everything else deferred or skipped. All proposals passed the viability filter (viable, doable, intended results, risk-justified).
+
+### ADOPT (in order, sequenced)
+1. **Context-length discovery** — extend `OllamaChatTransport._model_capabilities` (local_tool_runtime.py:82-91) to cache `model_info.*.context_length` from `/api/show`. ~10 lines. Enables every budget decision. Degrade T1 on failure.
+2. **Computed num_ctx right-sizing** — the real innovation: broker sets `num_ctx` per request (bucket above measured prompt + output reserve, never above discovered trained window). No cloud system can do this — local-only capability. 13 hardcoded sites migrated last.
+3. **Self-measuring calibration** — log `prompt_eval_count` (Ollama's ground truth) vs broker estimate per request. Detects tiktoken drift per model. Log and report only; admission stays deterministic.
+4. **Absence-proof tests** — canary markers per contributor: disable each and assert zero marker tokens. The sole-broker collapse makes absence provable (no production system can do this — they all have many injection points).
+
+### DEFER (not v1)
+- Per-call-site-class budgets (witness 100, goal 200, night_mode 300) — scope creep; migrate 13 sites through one broker first
+- KV-cache/RAM pressure estimation — speculative, needs per-model architecture data
+- Adaptive admission based on calibration — v1 logs drift, doesn't auto-correct
+
+### SKIP
+- Ghost AttentionCapsule — a deletion, not an innovation
+
+### Implementation sequence
+Build SOTA spine as researched → /api/show discovery → measured tokens with calibration logging → admission ledger → canary absence tests → computed num_ctx right-sizing (final migration step). Nothing adaptive, nothing learned, nothing speculative in v1.

plans/2026-09-04-p0-06-failures-observable.md

@@ -0,0 +1,340 @@
+# P0-06 Failures Observable — Implementation Plan (#22)
+
+> **For agentic workers:** session conventions apply (TDD, frozen tests are the
+> spec, C5 lint-bytes, both review gates, task-board discipline, red-green
+> discharges, actor dispatch contract). Baseline suite: 427 passed + 84
+> subtests (`PYTHONPATH=src:. python3 -m pytest tests/ -q` — no exclusions;
+> textual is installed).
+
+## Purpose
+
+Issue #22 (P0-06): failure becomes observable. No more walls of
+`except Exception: pass` on the authoritative path. Three failure tiers (see
+ledger), a subsystem-health registry, a `/health` TUI command, and real
+logging. Scope = the ~30 critical handlers on the authoritative path (listed
+below), NOT all 422 repo-wide (that is a follow-up sweep).
+
+**Design:**
+- New module `src/rune/subsystem_health.py` — the observable-failure core:
+  `record_failure(subsystem, error, tier, context="")` emits a canonical
+  event (via `rune.event_bus.emit`), logs via `logging.getLogger("rune.subsystem_health")`,
+  and records into a `SubsystemHealthRegistry` (runs/failures/last_error per
+  subsystem — the CadenceHealth shape generalized). `health_snapshot()`
+  returns the registry state for the /health view.
+- Anti-spam: T1 user-visible messages fire ONCE per (subsystem, session);
+  events always fire (journal is cheap).
+- Logging: `configure_logging()` in the same module — file handler to
+  `~/.rune/logs/rune.log` (rotating, 5MB x 3), called from RuneApp.__init__.
+  This fixes "logs go nowhere".
+- Handler conversions: each of the ~30 critical handlers gets
+  tier-appropriate semantics. T0 handlers re-raise or return structured
+  failure; T1 call `record_failure(..., tier=1)` and proceed; T2 call
+  `record_failure(..., tier=2)` and proceed.
+
+**Files:**
+- Create: `src/rune/subsystem_health.py`, `tests/test_subsystem_health.py`
+- Modify: `src/rune/rune_operator.py` (~15 handlers), `src/rune/rune_tui.py`
+  (~12 handlers + /health command + logging call), `src/rune/warm_router.py`
+  (2), `src/rune/cron_engine.py` (2)
+- Docs: `docs/failure-semantics.md`
+
+**Target suite:** 427 + 8 = **435** (count from code blocks).
+
+## Task 1: subsystem_health module + tests (frozen)
+
+Create `tests/test_subsystem_health.py`:
+
+```python
+"""Subsystem health: observable failures with tiers, anti-spam, snapshot."""
+
+import json
+
+from rune import event_bus
+from rune.subsystem_health import (
+    SubsystemHealthRegistry,
+    configure_logging,
+    record_failure,
+)
+
+
+def test_record_failure_emits_event_and_registry_entry(tmp_path, monkeypatch):
+    monkeypatch.setattr("rune.event_bus._store_path", lambda: tmp_path / "events.jsonl")
+    registry = SubsystemHealthRegistry()
+    record_failure("memory_selector", RuntimeError("boom"), tier=1, registry=registry)
+    entry = registry.snapshot()["memory_selector"]
+    assert entry["failures"] == 1
+    assert "boom" in entry["last_error"]
+    assert entry["tier"] == 1
+
+
+def test_t1_user_message_fires_once_per_subsystem(tmp_path, monkeypatch):
+    monkeypatch.setattr("rune.event_bus._store_path", lambda: tmp_path / "events.jsonl")
+    registry = SubsystemHealthRegistry()
+    m1 = record_failure("memory_selector", RuntimeError("a"), tier=1, registry=registry)
+    m2 = record_failure("memory_selector", RuntimeError("b"), tier=1, registry=registry)
+    assert m1 and not m2  # anti-spam: first call surfaces, repeats silent
+    m3 = record_failure("warm_router", RuntimeError("c"), tier=1, registry=registry)
+    assert m3  # different subsystem surfaces independently
+
+
+def test_t2_never_surfaces_user_message(tmp_path, monkeypatch):
+    monkeypatch.setattr("rune.event_bus._store_path", lambda: tmp_path / "events.jsonl")
+    registry = SubsystemHealthRegistry()
+    assert not record_failure("cron", RuntimeError("x"), tier=2, registry=registry)
+
+
+def test_events_are_canonical_and_typed(tmp_path, monkeypatch):
+    monkeypatch.setattr("rune.event_bus._store_path", lambda: tmp_path / "events.jsonl")
+    registry = SubsystemHealthRegistry()
+    record_failure("memory_selector", RuntimeError("boom"), tier=1, registry=registry)
+    from rune.orchestration.event_store import DurableEventStore
+
+    store = DurableEventStore(tmp_path / "events.jsonl")
+    recs = store.replay()
+    assert any(r["event_type"] == "capability.failed" for r in recs)
+
+
+def test_configure_logging_writes_file(tmp_path):
+    handler = configure_logging(log_dir=tmp_path)
+    import logging
+
+    logging.getLogger("rune.subsystem_health").error("visible")
+    for h in logging.getLogger("rune.subsystem_health").handlers:
+        h.flush()
+    assert (tmp_path / "rune.log").exists()
+    handler.close()
+    logging.getLogger("rune.subsystem_health").removeHandler(handler)
+```
+
+Red: ModuleNotFoundError. Implement `src/rune/subsystem_health.py`:
+
+```python
+"""Subsystem health: observable failure semantics (P0-06).
+
+Tiers (see docs/failure-semantics.md):
+  T0 authoritative-path failure — loud: event + error bubble + success=False
+     (callers re-raise or return structured failure; this module is used for
+     the event + ledger side).
+  T1 context-contribution failure — turn proceeds, but the failure MUST be
+     visible: canonical event + one user message per subsystem per session.
+  T2 ambient/background failure — canonical event only; visible via /health.
+
+Every except on the authoritative path must re-raise, return a structured
+failure, or emit. Silent `pass` is a defect.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import threading
+from dataclasses import dataclass, field
+from logging.handlers import RotatingFileHandler
+from pathlib import Path
+
+# Subsystem name -> canonical event_type (the event_bus vocabulary).
+_TIER_EVENTS = {0: "task.failed", 1: "capability.failed", 2: "storage.degraded"}
+
+
+class SubsystemHealthRegistry:
+    """Per-subsystem failure ledger (the CadenceHealth shape, generalized)."""
+
+    def __init__(self) -> None:
+        self._lock = threading.Lock()
+        self._entries: dict[str, dict] = {}
+        self._surfaced: set[str] = set()
+
+    def record(self, subsystem: str, error: str, tier: int) -> bool:
+        with self._lock:
+            entry = self._entries.setdefault(
+                subsystem, {"failures": 0, "last_error": "", "tier": tier}
+            )
+            entry["failures"] += 1
+            entry["last_error"] = error
+            entry["tier"] = tier
+            key = f"{tier}:{subsystem}"
+            if tier <= 1 and key not in self._surfaced:
+                self._surfaced.add(key)
+                return True  # caller surfaces to the user (once per session)
+            return False
+
+    def snapshot(self) -> dict:
+        with self._lock:
+            return json.loads(json.dumps(self._entries))
+
+
+_REGISTRY = SubsystemHealthRegistry()
+
+
+def registry() -> SubsystemHealthRegistry:
+    return _REGISTRY
+
+
+def record_failure(
+    subsystem: str,
+    error: BaseException,
+    tier: int = 1,
+    registry: SubsystemHealthRegistry | None = None,
+    context: str = "",
+) -> bool:
+    """Record a subsystem failure: canonical event + ledger + log.
+
+    Returns True when the caller should ALSO surface this to the user
+    (T0/T1 first occurrence). T2 never surfaces.
+    """
+    reg = registry or _REGISTRY
+    message = f"{type(error).__name__}: {error}"
+    if context:
+        message = f"{message} ({context})"
+    log = logging.getLogger("rune.subsystem_health")
+    log.error("subsystem=%s tier=%d %s", subsystem, tier, message)
+    try:
+        from rune import event_bus
+
+        event_bus.emit(
+            _TIER_EVENTS.get(tier, "storage.degraded"),
+            source="subsystem_health",
+            payload={
+                "subsystem": subsystem,
+                "tier": tier,
+                "error": message[:300],
+            },
+        )
+    except Exception:  # the observability layer itself must not raise
+        log.exception("failed to emit subsystem-health event")
+    return reg.record(subsystem, message, tier)
+
+
+def configure_logging(log_dir: Path | None = None):
+    """Give the rune loggers a real destination (they had none — P0-06)."""
+    target = Path(log_dir) if log_dir is not None else Path.home() / ".rune" / "logs"
+    target.mkdir(parents=True, exist_ok=True)
+    handler = RotatingFileHandler(
+        target / "rune.log", maxBytes=5_000_000, backupCount=3, encoding="utf-8"
+    )
+    handler.setFormatter(
+        logging.Formatter("%(asctime)s %(name)s %(levelname)s %(message)s")
+    )
+    root = logging.getLogger("rune")
+    root.setLevel(logging.INFO)
+    root.addHandler(handler)
+    return handler
+```
+
+(Adapt if event_bus's emit signature differs — verify `emit(event_type,
+source=..., payload=...)` from event_bus.py first; the frozen test pins the
+canonical event_type `capability.failed` for tier 1.)
+
+## Task 2: handler conversions (the ~30 critical sites)
+
+Convert per tier. T1 pattern (replace `except Exception: pass`):
+
+```python
+def _t1_example(ch):
+    try:
+        memory_context = memory_store.cached_recall(...)
+    except Exception as exc:  # P0-06: observable degrade (T1)
+        from rune.subsystem_health import record_failure
+
+        if record_failure("memory_selector", exc, tier=1):
+            ch.add_message("system", f"⚠ memory_selector unavailable: {exc}")
+```
+
+(In rune_operator.py there is no `ch` — the operator returns the marker in
+the response payload instead: `response.metadata["degraded"] = [...]`, and
+the TUI renders ⚠ lines from it. Verify how metadata flows and adapt.)
+
+The authoritative-site list (from the survey; convert ALL):
+
+rune_operator.py: 444 (memory recall, T1), 513/533/551/574/594/605 (persona +
+consolidation, T1), 627/647/668 (warm neurons/graph/abstraction, T1), 866
+(list_models, T1), 219-268 task transitions (T0 — verify it already returns
+structured failure; if silent, fix).
+
+rune_tui.py: 3476 (the four-subsystem parallel block, T1 — split the try so
+each subsystem reports independently), 3487/3496/3515/3529/3546/3569/3580/3595
+(context contributions, T1), 3554 (event emit, T2), 1664 (provider registry
+startup, T1), 4017 (auto model routing fallback, T1 — keep the fallback but
+make it visible), 164-197 _handle_worker_error (verify it surfaces; add
+record_failure).
+
+warm_router.py: ~220 + 304-307 (T1).
+cron_engine.py: 70 + 118-119 (T2).
+
+## Task 3: /health command + logging call
+
+- In `RuneApp.__init__` (or on_mount): call `configure_logging()` once.
+- Add `/health` to `_COMMANDS`: renders `registry().snapshot()` — per
+  subsystem: failures count, last error, tier — plus event-bus stats (reuse
+  the _cmd_events pattern). Zero failures → "all subsystems healthy".
+
+## Task 4: acceptance tests (frozen — the issue's criteria)
+
+Add to `tests/test_subsystem_health.py` (or a new test file):
+
+```python
+def test_acceptance_broken_memory_selector_is_visible(tmp_path, monkeypatch):
+    # Issue #22 acceptance: break the memory selector -> explicit failure.
+    monkeypatch.setattr("rune.event_bus._store_path", lambda: tmp_path / "events.jsonl")
+    from rune.orchestration.event_store import DurableEventStore
+
+    registry = SubsystemHealthRegistry()
+    class Broken:
+        def cached_recall(self, *a, **k):
+            raise RuntimeError("memory selector is broken")
+    broken = Broken()
+    try:
+        broken.cached_recall()
+    except RuntimeError as exc:
+        surfaced = record_failure("memory_selector", exc, tier=1, registry=registry)
+    assert surfaced
+    store = DurableEventStore(tmp_path / "events.jsonl")
+    assert any(r["event_type"] == "capability.failed" for r in store.replay())
+    assert registry.snapshot()["memory_selector"]["failures"] == 1
+```
+
+## Task 5: docs
+
+`docs/failure-semantics.md` — the tiers, the invariant, how to add a new
+subsystem to the registry, the /health command.
+
+## Task 6: verify + commit
+
+- Full suite → 435 expected. ruff check + format (ABSOLUTE paths) on changed
+  files; minimal-diff (these are big legacy files — your lines clean, no
+  reformat).
+- Commit: `feat(observability): observable failure semantics for the authoritative path`
+
+## Execution-time record (2026-09-04, commit 67a6dd3)
+
+- Count correction: code blocks contain 6 tests (5 Task 1 + 1 acceptance), not 8 — target suite 433 (427 + 6), real total verified.
+- OperatorResponse gained an additive `degraded: list[str]` field (tool_protocol.py) — the sanctioned Task-2 delegation: operator-path T1 failures flow to the TUI via the existing asdict → _response_envelope channel; rendered as ⚠ lines.
+- Five sites use truthful names outside the frozen 15-name vocabulary: cache, event_bus (T2), parallel_processor (outer runner guard), rune_tui (_handle_worker_error), night_mode (T2). Inner nested excepts inside pinned sites also converted to T2.
+- T0 task transitions verified already structured — no change (as anticipated).
+- Frozen test file: `# noqa: F401` on its two dead imports (json, event_bus — authored by the plan); module block dropped unused dataclass/field imports.
+- configure_logging(): called once from RuneApp.__init__, idempotent, never silent-pass.
+- Non-vacuity: removing the registry's _surfaced anti-spam set fails test_t1_user_message_fires_once_per_subsystem (verified by mutation probe).
+- Env note: rune_tui resolves `import rune` via memory_env.scripts_dir() — smoke tests need RUNE_SCRIPTS_DIR override; TUI + package deploy as a unit.
+
+## Post-quality discharges (2026-09-04; quality gate general-156 Approved with minors)
+
+- I-1 DISCHARGED (observability-recursion trap): record_failure's WHOLE body is now guarded —
+  reg.record() and the logging call were unguarded (verified: registry.record raising OSError
+  propagated out of the caller's except block, masking the original failure). RED-GREEN PROVEN:
+  revert → OSError propagates; guarded → returns False + last-resort log. Suite 433 maintained.
+- M-3 DISCHARGED: protocol-scrub rebuild (rune_operator.py:238-245) now carries
+  degraded=result.degraded — observability no longer lost on the scrub path.
+- M-5 NOT-A-DEFECT: the acceptance test already uses a local registry (reviewer misread).
+- SIM105: last-resort handler converted to contextlib.suppress (intent-exact).
+
+## Pins (hardening plan)
+- M-4: operator-channel degraded list is per-turn (TUI renders ⚠ every turn while broken) vs
+  the doc's once-per-session — reconcile (de-dup in TUI or amend docs) before the follow-up
+  sweep copies the pattern.
+- M-6: configure_logging handler cleanup — the test's removeHandler targets the child logger
+  but the handler lives on the 'rune' root.
+- M-7: real-path integration test (monkeypatch memory_store.connect → run _execute_on_model /
+  _run_warm_router) — cheap, deterministic; belongs in hardening.
+- Plan-level: _surfaced re-arm after N clean turns; remaining ~390 silent handlers (follow-up
+  sweep); parallel_processor per-item error dicts still invisible; failure-semantics.md should
+  mark the truthful-names extension list as an amendment (7cd3b67).

plans/2026-09-04-p0-06-ledger.md

@@ -0,0 +1,75 @@
+# Pre-Build Ledger — P0-06 Failures Observable (#22)
+
+## Research pin (2026-09-04; explore-17 survey + authority map)
+
+**Silent-handler census (src/rune):** 422 total — 328 `except: pass`, 50
+`except: return-default`, 44 `except: continue`. Top-5 files: rune_tui.py 54,
+memory_store.py 20, warm_router.py 15, rune_operator.py 11, curator.py 9.
+
+**Critical handlers on the authoritative path** (~30, file:line in the plan):
+worst is `rune_tui.py:3476-3477` — ONE `except Exception: pass` wraps the
+whole parallel block (warm_router.route + capability_broker.match_capabilities
++ memory_store.cached_recall + witness.detect_signals): any of those four
+subsystems breaking → all context silently vanishes, operator sees a normal
+turn. The acceptance test "break ContextBroker and SEE a failure" currently
+impossible — every candidate break-point is swallowed.
+
+**Evidence-based scoping:** ContextBroker does not exist yet (v1 owner per
+authority map, dep #19). Current authority = RuneOperator prompt assembly +
+TUI `_run_warm_router`. #22 therefore instruments the CURRENT authoritative
+path (per the map's `migrate-adapter`/`retain-authority` dispositions) —
+those instruments carry forward when #19 lands.
+
+**Existing infra to reuse (no duplication):** canonical event_bus (typed
+vocabulary has model.unavailable/storage.degraded/capability.failed/
+capability.unavailable/task.failed); orchestration/health.py CadenceHealth
+(runs/failures/last_error/failed_cadences — the health-ledger shape);
+drift_ledger + /drift command precedent; TUI role="error" bubble (exists,
+barely used); _startup_check; _cmd_events as the command precedent.
+
+**Gap found:** logging loggers exist but NO handler/basicConfig anywhere —
+logs go nowhere today.
+
+## Failure-semantics tiers (aligned to authority-map dispositions)
+
+- **T0 authoritative-path failure** (operator execution, tool loop, model
+  transport — retain-authority/migrate-adapter): loud structured event +
+  role="error" bubble + success=False. Never silent.
+- **T1 context-contribution failure** (memory selector, warm router,
+  capability broker, consolidation): turn proceeds (degrade) + typed event +
+  one dim `⚠ <subsystem> unavailable` message, once per session per
+  subsystem (anti-spam).
+- **T2 ambient/background failure** (cron, witness, telemetry): degrade +
+  event-journal only; visible via /health.
+
+**Invariant:** every except on the authoritative path either re-raises,
+returns a structured failure, or emits. Zero bare `pass` in the ~30 listed.
+
+## Feasibility
+Moderate: ~30 handler conversions + a health registry + /health command +
+logging handler. All reuse existing infra. No schema changes. Bounded.
+
+## Complexity
+Low-moderate. Multi-file but mechanical per-conversion; the design (tiers +
+health registry + anti-spam) is the substance.
+
+## Canaries (TDD contract)
+- test_t0_authoritative_failure_is_loud: break a T0 path → OperatorResponse
+  success=False + event emitted.
+- test_t1_context_failure_degrades_visibly: break cached_recall → turn
+  proceeds, event emitted, ⚠ message recorded once (anti-spam on 2nd call).
+- test_t2_ambient_failure_journaled: cron-task load failure → event, no TUI
+  spam.
+- test_health_view_lists_subsystems: /health data includes failures.
+- Red-green on the worst handler (3476): reverting its fix re-swallows.
+
+## Consent
+Delegated (standing directive + no-consent-ask rule). Priority: P0 — critical.
+
+## Pipeline context (2026-09-04)
+- Picked up via the live-verified order pipeline: #22 was teacher-labeled ready
+  (dep #17 closed — verified correct after the false-ready fix).
+- #23/#24 were found falsely ready (teacher truncation bug, fixed PR #119) —
+  blocked until #19 (ContextBroker) merges.
+- Correction applied: no consent-ask on the standard procedure — research,
+  plan, and build run autonomously (recorded as a standing rule).

plans/2026-09-04-p121-ledger.md

@@ -0,0 +1,30 @@
+# Pre-Build Ledger — Forge Abstraction (#121)
+
+## Research pin
+- No external research needed: the Gitea/Forgejo API is identical (/api/v1),
+  verified in docs/pipeline-porting-ledger.md §4. The abstraction is a
+  protocol + adapter pattern — standard Python, no novel design.
+- Codebase facts: shared/gitea_auth.py loads the token; event_bus.py is
+  the canonical event store; the outbox pattern from Plan 5 provides the
+  spool-when-unreachable mechanism.
+
+## Design
+- ForgeClient protocol: create_issue, add_comment, get_issue_state,
+  list_open_issues
+- GiteaForgejoAdapter: /api/v1 paths via httpx
+- NullAdapter: no-op for unconfigured/standalone (graceful dormant)
+- Config: forge.url + forge.token from env or config file; unconfigured → NullAdapter
+- The failure auto-filer (#122) will build on this
+
+## Feasibility
+Low-moderate: ~150 lines + tests. The API calls are well-documented and
+already proven by the pipeline-gate workflow.
+
+## Complexity
+Low. Protocol + two adapters + config. No runtime changes.
+
+## Canaries (TDD contract)
+- test_protocol_shape: ForgeClient is structural (runtime_checkable)
+- test_gitea_adapter_live: real API shapes (mocked httpx)
+- test_null_adapter_noop: unconfigured → no-op, zero errors
+- test_config_driven: URL/token from config, not hardcoded

plans/2026-09-05-context-broker.md

@@ -0,0 +1,215 @@
+# ContextBroker (P0-03, #19) — Authoritative Context Assembly
+
+> **For agentic workers:** execution contract — FROZEN TESTS ARE THE SPEC. Implement verbatim; record every deviation in the plan tail. TDD red→green. Do not create/complete tasks; controller owns task state.
+
+**Gitea issue:** #19 (P0 — critical). **Branch:** `context-broker` off master `65f96ea`.
+
+## Why
+
+Seven subsystems inject context into the model prompt ad-hoc (operator assembly at rune_operator.py:440-935, TUI 21-step projection, per-call-site `num_ctx: 8192` hardcodes — **14 sites in 12 files**). Accounting is broken (`_log_token_usage` logs `static=0` and a capsule token count that is never sent); history is unbounded inside `num_ctx=8192` (Ollama silently truncates); the AttentionCapsule is a ghost (`to_prompt()` never called outside its module); the ambient-context bridge is DEAD CODE (TUI stores `_ambient_*` on self; operator reads `task._ambient_*` — always False). `num_ctx: 8192` actively truncates models with 32k/128k trained windows and wastes KV cache on small prompts.
+
+## Research (all three rounds — Nick's standard)
+
+1. **Inward (explore-19):** injection inventory above; typical system prompt ≈1,300-2,000 tokens; selector primitives exist (cached_recall budget 8/min 0.42, warm_router 300tok, always_digest 220tok, capability_broker, graph_memory, abstraction facts, prompt_sync, model_profiles).
+2. **Outward (general-161, primary sources):** LangChain deepagents middleware semantics (ordered before_model hooks editing typed state), Anthropic "Effective context engineering" (attention budget; compaction: clear tool results → structured rolling summary → offload; keep 5-10 recent turns verbatim; archive raw before lossy compression), deterministic admission (priority then recency, drop lowest), explicit output reserve, measured-not-estimated tokens, fail loud when a single block exceeds budget. Do NOT adopt frameworks (bespoke Ollama stack) — port semantics. tiktoken `o200k_base` as conservative over-counter is acceptable; `/api/show` reports real context length — never hardcode.
+3. **Innovation (general-163):** (a) context-length discovery extends the EXISTING `OllamaChatTransport._model_capabilities` cache (~10 lines); (b) computed num_ctx right-sizing is real innovation but SEQUENCED LAST (broker+discovery first, right-sizing second, per-site migration third — carry to a follow-up issue); (c) `prompt_eval_count` served-ground-truth calibration — log-only, never auto-adjust admission; (d) absence is proven by TESTS + the broker-output ≡ runtime-input equality boundary, not runtime ceremony; (e) contributor failures flow into the shipped P0-06 `SubsystemHealthRegistry` (record_failure + /health) — reuse, don't rebuild.
+
+## Constraints
+
+- Operator path is the ONLY authority (#19 scope: A-D injection points; the 21-step TUI pipeline removal is #20 — do NOT delete it here, just leave it untouched).
+- Characteristic parity: `test_rune_operator_tools.py:311,339` mocks `get_prompt_context` and asserts message roles; `test_runtime_architecture_characterization.py:36` pins second-turn history; `test_v1_authority_map.py` pins manifest paths — broker integration MUST keep these green (route through, don't rewrite behavior).
+- Approval resume: `resolve_pending_approval` replays `pending_state["messages"]` — capsule must be embedded in pending state for identical resumed context.
+- Safety-override prefix/suffix mutates the final user message — broker owns final assembly or exposes the decorator hook.
+- Thread safety: `_warm_router_thread` runs concurrently with the exclusive model worker — broker must be safe (each selector opens its own sqlite connection; broker admission is the shared state).
+- Memory-off invariant: selector gate must zero memory across recall/persona/consolidation — trace must PROVE zero memory tokens (absence test).
+- Consolidation has a write side effect (`_save_knowledge` inside assembly) — must not double-write when moved.
+- Fallback tool prompt (local_tool_runtime.py:486-492, ~2,500 tokens for non-native-tool models) must route through the broker's tools block or stay runtime-owned but traced.
+- num_ctx right-sizing per call site = FOLLOW-UP issue (innovation sequencing) — pin it.
+
+## Task 1 — ContextBroker core + typed capsule
+
+`src/rune/context_broker.py` (new):
+
+```python
+"""ContextBroker — single authority over prompt context assembly.
+
+All injected context flows through this module. Contributors register,
+budgets resolve from the model's real context length, admission is
+deterministic (priority, then recency), every block is measured, and a
+trace records what was admitted, dropped, and why.
+"""
+from __future__ import annotations
+
+import threading
+from dataclasses import dataclass, field
+from typing import Callable
+
+from rune.attention_capsule import AttentionCapsule
+
+
+class ContextOverflowError(RuntimeError):
+    """One block alone exceeds the input budget — never silently truncate."""
+
+
+class ContributionBlock:
+    """A typed, measurable piece of context."""
+
+    __slots__ = ("name", "priority", "content", "tokens", "source", "evictable")
+
+    def __init__(self, name, priority, content, tokens, source, evictable=True):
+        self.name = name
+        self.priority = priority          # higher wins budget
+        self.content = content            # text block (empty = contribute nothing)
+        self.tokens = tokens              # measured token estimate
+        self.source = source              # selector module/function, for trace
+        self.evictable = evictable        # False = never dropped (system, user)
+
+
+class ContextBroker:
+    """Admission-controlled context assembler.
+
+    Order of assembly (fixed): system -> tools -> memory/notes -> history
+    -> user. Contributors emit typed blocks with priority; admission sorts
+    by priority (tie: recency of registration), drops lowest-priority
+    evictable blocks that do not fit the budget, and refuses to run if a
+    single mandatory block exceeds the budget (fail loud).
+    """
+
+    def __init__(self, estimator=None, budget_resolver=None):
+        self._lock = threading.RLock()
+        self._contributors = []           # (name, callback, priority_bucket)
+        self._estimator = estimator or default_estimator
+        self._budget_resolver = budget_resolver or default_budget
+        self._trace_log = []
+
+    def register_contributor(self, name, callback, bucket):
+        """Name a contributor. callback(task, session) -> ContributionBlock or None."""
+        with self._lock:
+            self._contributors.append((name, callback, bucket))
+
+    def assemble(self, task, session, model_id=None, budget_tokens=None):
+        """Collect -> measure -> admit -> render. Returns (capsule, trace)."""
+        ...
+```
+
+Extend `AttentionCapsule` (attention_capsule.py) with typed `blocks: list[ContributionBlock]` (default empty; additive only — existing fields untouched) and `to_messages(system_preamble) -> list[dict]` rendering `[{system}, *history, {user}]` exactly as `LocalToolRuntime.run` consumes. `to_prompt()` stays (legacy callers).
+
+**Default estimator**: `len(text) // 4` per block (bytes/4 conservative for en-text) OR tiktoken when importable — installer's choice; MUST be deterministic. **Default budget**: `input_budget = window - max(2048, window//4) - window//20` where window comes from the model registry (`context_length(model_id)`); fallback window 8192 only when discovery fails AND T1 `record_failure` is called (P0-06 registry).
+
+**Admission**: sort blocks by priority desc (non-evictable always admitted first, in order); admit until next block would exceed budget; dropped blocks recorded in trace with token counts; if a non-evictable block alone exceeds budget → raise `ContextOverflowError` (test pins this).
+
+## Task 2 — Discovery + budget resolution + calibration
+
+1. `src/rune/local_tool_runtime.py` `_model_capabilities` cache: extend to include `context_length` from `/api/show` (the innovation-adoption; ~10 lines). Keep the existing `num_ctx`/`num_predict` fallback behavior; add `context_length()` module function with cache; on discovery failure → conservative default (8192) + `record_failure("context_discovery", T1)`.
+2. `context_length(model_id)` registry override map in broker: `{"*": discovered, "ollama/*": discovered}` — minimal, no hardcodes except the conservative fallback.
+3. Calibration: after each operator request completes, compare broker measured total vs `prompt_eval_count` from the response (when present) and log drift via `logging.getLogger("rune.context_broker")` — LOG ONLY, never auto-adjust admission (innovation decision).
+
+## Task 3 — Contributers (wrap existing selectors)
+
+Register (bucket order = assembly order):
+1. `persona` (priority 100, non-evictable): static identity block — MOVED from rune_operator.py:481-530 assembly (verbatim content).
+2. `tools` (90, evictable=False when native; evictable=True with the ~2.5k fallback prompt traced): tool names from the OPERATOR's registry; the local_tool_runtime fallback prompt stays runtime-owned but is TRACED (log once per session when injected).
+3. `memory` (70): `memory_store.cached_recall(db, task, budget=8)` → "## Context" (verbatim behavior; the memory-off gate zeroes this -> trace proves 0 tokens).
+4. `persona_memories` (68): second cached_recall (identity) → "## Identity context".
+5. `consolidated` (60): MemoryConsolidation block — CAREFUL: its `_ save_knowledge()` side effect must run EXACTLY ONCE per turn even when the block is DROPPED (call the side effect at collect time, before admission; pin with test? controller note).
+6. `neurons` (55): operator's `list_neurons()` trigger scan top-5 → "## My neurons" (NOT the TUI's budgeted route — keep the operator selector per characterization parity).
+7. `graphs` (50): graph_memory.resolve_entity top-5.
+8. `abstraction` (45): facts LIKE top-3.
+9. `model_profile` (40): model_profiles.get_prompt_context (MUST keep the mock contract — existing tests patch it).
+10. `history` (30): `_conversations_messages()` adapter (last 8 completed pairs; compaction-ready on Task 4).
+11. `user` (100, non-evictable, assembled last): task text + safety-override pre/suffix.
+
+`rune_operator._execute_on_model` replaced: remove inline try/except assembly; use `broker.assemble()`; the capsule/messages → `runtime.run`; `_ log_token_usage` → trace-backed (no more static=0).
+
+## Task 4 — Compaction (80% threshold)
+
+History block: when measured tokens > 80% of window (deep-agens threshold): step 1 drop stale tool-result blocks (evictable); step 2 summarize ALL but the last 5 turns into a rolling structured summary (fields: session intent / decisions / open items / next steps — LangChain prompt shape) via a compact summarization call (num_predict 256; T2 record_failure on failure → no compaction this turn, degrade to last-8 verbatim); keep last 5 verbatim; ARCHIVE the pre-compaction raw history EXTERNALLY first (rune_home/state/history_archive.jsonl append; recoverable) — lossy compression without an archive is forbidden (SOTA constraint). Compaction events are traced.
+
+## Task 5 — Canary + docs + CI
+
+- `src/rune/canary_context_broker.py`: assemble with small budget → drops low-priority while keeping mandatory; single-over-budget block → ContextOverflowError; memory-off → trace 0 memory tokens; compaction archives raw + keeps last-5; prints `CONTEXT BROKER CANARY PASSED`.
+- `docs/context-broker.md`: architecture, contributor table, budget math, compaction, calibration, absence tests, how to add a contributor.
+- ci.yml: +`tests/test_context_broker.py` (auto via whole-dir; the file list is dir-level now) + canary line. HENXELS will demand the canary be registered — add to the loop list.
+
+## Frozen tests (tests/test_context_broker.py, ~12)
+
+```python
+def test_assembles_typed_blocks_in_order(): ...          # system->tools->memory->history->user; budget respected
+def test_drops_lowest_priority_over_budget(): ...        # ledger admits/drops with token counts
+def test_single_block_over_budget_fails_loud(): ...       # ContextOverflowError, no silent truncation
+def test_trace_records_per_block_tokens(): ...            # every block: name/tokens/source/admitted|dropped
+def test_memory_off_proves_zero_memory_tokens(): ...      # auto. disable memory contributors; trace sums 0 memory
+def test_compaction_archives_raw_and_keeps_last5(): ...   # raw archived to file; summary block present; last 5 verbatim
+def test_discovery_uses_real_context_length(): ...        # monkeypatch /api/show -> 32000; budget math uses 32000 not 8192
+def test_calibration_logs_drift(): ...                    # served prompt_eval_count vs estimate -> log record (caplog)
+def test_approval_resume_embeds_capsule(): ...            # pending_state carries capsule; resume identical
+def test_contributor_failure_records_health(): ...        # broken selector -> record_failure tier1 entry (registry)
+def test_thread_safety_concurrent_assemble(): ...         # 2 threads, 20 assemlies, no corruption
+def test_operator_characterization_parity(): ...           # existing role-message assertions still hold via broker path
+```
+
+RED: module missing, AttentionCapsule lacks blocks, operator still inline → all fail.
+
+## Acceptance
+
+- `pytest tests/test_context_broker.py` → 12 passed (red proven first).
+- Full suite green (baseline 470 → +12 expected ≈ 482, minus/exact — record actual; zero regressions; `test_rune_operator_tools`/`test_runtime_architecture_characterization` untouched-and-green.
+- Operator prompt == previous behavior (characterization parity; no prompt-content change for the same inputs — trace shows same blocks).
+- canary bare run: `CONTEXT BROKER CANARY PASSED`, exit 0; registered in ci.yml.
+- henxels check --all --plain exit 0 (contract with the new canary).
+- ruff clean on all touched files (absolute paths); no reformat of untouched files.
+- `num_ctx` per-site migration: PINNED follow-up issue (innovation sequencing — do NOT do here).
+
+## Pipeline requirements checklist
+- [x] TDD red→green (12 frozen tests) — RED: `ImportError: cannot import name 'context_broker' from 'rune'` (1 error during collection); GREEN: 12 passed
+- [x] ruff check + format on new files (3 new files clean; touched files: added lines format-conformant, pre-existing drift left untouched)
+- [ ] Spec gate PASS (independent reviewer)
+- [ ] Qualiry gate Approved (independent reviewer)
+- [x] Full-suite regression green (482 passed + 84 subtests; baseline 470 + 12 frozen, zero regressions)
+- [x] henxels check --all green (exit 0; canary registered in ci.yml same commit)
+- [ ] Closed with formatted comment + refs
+
+## Execution tail (recorded 2026-09-05)
+
+**Evidence:** RED = `ImportError: cannot import name 'context_broker' from 'rune' (tests/test_context_broker.py)` — module missing, AttentionCapsule lacked blocks, operator still inline. GREEN = `12 passed` (frozen), `482 passed, 84 subtests passed` (full suite, was 470+84). Canary bare run: `CONTEXT BROKER CANARY PASSED`, exit 0. `henxels check --all --plain` exit 0 (canary registered in ci.yml in the same commit). Ruff check exit 0 on all 6 touched files; `ruff format --check` clean on the 3 new files. Pinned characterization tests green: `test_rune_operator_tools.py` (incl. :311/:339 mock-contract tests), `test_runtime_architecture_characterization.py:36`, `test_v1_authority_map.py` — all untouched and green.
+
+**Deviations from the frozen block / plan text (with justification):**
+1. `test_discovery_uses_real_context_length` monkeypatches `/api/show` via INSTANCE-level assignment (`transport._post = fake_post`) instead of class-level `monkeypatch.setattr` — matches the repo's established mock contract (`test_local_tool_runtime.py:167`); a class-level patch would break on bound-method dispatch. Test intent unchanged (budget math uses 32000, not 8192).
+2. `AttentionCapsule.to_messages(system_preamble="")` re-derives messages from the block ledger on every call (no cached message list) so the safety override can decorate the final user block in place and the change flows through rendering — satisfies constraint (d) without a second assembly pass.
+3. `AttentionCapsule.to_dict()` now includes `blocks` (serialized via `ContributionBlock.to_dict`) — additive; required for the JSON-safe `pending_state["context_capsule"]` embedding (constraint e).
+4. System-prompt section order now follows the plan's fixed assembly order (persona → tools → memory notes → history → user, priorities 100/90/70/68/60/55/50/45/40/30/100). Legacy append order differed (e.g. `## Available tools` was last, `## Model` preceded `## Context`). Content is verbatim-identical; the three pinned characterization tests assert substring presence and stay green. Trace shows the same blocks.
+5. `_log_token_usage` trace-backed mapping: `static` = admitted_total − user − history (was literal 0), `dynamic` = history block tokens, `user` = user block tokens, `total` = admitted_total. No more ghost accounting.
+6. Ambient dead path (constraint c): the `task._ambient_*` hasattr reads were removed with the inline assembly (they were unreachable — TUI stores `_ambient_*` on itself, operator read them off the task). Ambient stays UN-INJECTED; bridging it is pinned to a broker decision follow-up (see docs/context-broker.md). The 21-step TUI pipeline (#20) is untouched.
+7. `num_ctx: 8192` in the operator's runtime options call is NOT migrated (one of the 14 pinned sites; innovation sequencing). The broker's admission budget uses the discovered window — until the follow-up lands, admission may budget against a window larger than the runtime's `num_ctx=8192`.
+8. History block is NOT gated by `RUNE_MEMORY_OFF` (it is the operator's own task ledger, not a memory-store selector); the memory-off absence proof covers exactly `MEMORY_BLOCK_NAMES = {memory, persona_memories, consolidated}`.
+9. Compaction runs inside `assemble()` after measurement, only when the window was resolved (model_id path); with an explicit `budget_tokens` the window is unknown and compaction is skipped that turn. `compact_history` remains directly callable (frozen test + canary exercise it directly).
+10. Default estimator is `len(text) // 4` unconditionally (tiktoken deliberately not adopted) — deterministic across environments; the plan allows either.
+
+**Pinned follow-ups:**
+- num_ctx right-sizing per call site (14 hardcoded `num_ctx: 8192` sites across 12 files) — innovation sequencing, NOT done here.
+- Ambient-context bridge decision (leave un-injected vs bridge the TUI's ambient capture) — broker decision follow-up; TUI pipeline removal is #20.
+- Calibration drift is LOG-ONLY by pinned decision (never auto-adjusts admission).
+## Controller addition (post-implementation, pre-gates)
+
+Deviation 7's risk closed at the authority path: the operator's runtime options now use `context_length(model)` (discovered) instead of hardcoded 8192 — otherwise the broker admits blocks against e.g. 32768 while Ollama truncates at 8192. This is 1 of the 14 pinned num_ctx sites (the authority path itself); the other 13 remain pinned to the follow-up issue. Full suite 482 green, characterization parity intact.
+
+## Deviation 11 (spec-gate catch, general-171)
+
+Compaction step-1 ("drop stale evictable tool-result blocks") is NOT implemented in compact_history — vacuous on the operator path (history carries only user/assistant pairs; tool results live in runtime messages, not the history ledger) and unpinned by frozen tests. Recorded per the record-every-deviation contract rather than silently omitted. If tool-result blocks ever enter the history ledger, this becomes a live gap — noted in docs/context-broker.md follow-ups.
+
+## Quality-gate discharges (general-172 Approved-with-minors — C1/C2/C3 + I1/I2/I3/I4/I5)
+
+All Criticals discharged inline (controller, red-green proven each):
+
+- **C1 compaction never persists** — rolling-summary store (`_ROLLING` keyed by (source, session_id)): consecutive compactions reuse the rolled summary, summarize only NEW turns, archive only NEW messages (no duplicate re-archiving per turn). Red-green: store no-op → test fails.
+- **C2 dead zone** — compaction trigger measured against the INPUT BUDGET (was 0.8×window, leaving (budget, 0.8×window) silently dropped whole); gate fires on budget even without a resolved model window; summarizer-failure degrade now returns the newest tail that FITS the budget (was: whole over-budget history → dropped entirely). Red-green both.
+- **C3 fallback poisoning** — `default_window` registers ONLY genuinely discovered windows; the 8192 fallback never enters `_DISCOVERED` (transient Ollama outage no longer poisons the process lifetime). Red-green proven.
+- **I1 collective mandatory overflow** — non-evictable blocks that individually fit but collectively exceed budget now raise `ContextOverflowError`. Red-green proven.
+- **I5 malformed contributor returns** — non-str/non-list content is a recorded T1 failure + degrade (was: raw TypeError outside the degrade path). Red-green proven.
+- **I2 test hermeticity** — operator-path frozen tests patch `rune.local_tool_runtime.context_length` (module function), not just the class; no live :11434 attempts.
+- **I3 cache coherence** — `reset_context_length_cache()` clears BOTH caches (broker `reset_discovered_windows` added); no divergence.
+- **I4 summarizer sizing** — compaction transcript call passes `num_ctx=window` (no silent truncation inside the compaction path itself); summarizer model still defaults to qwen2.5:7b (pulled on host; turn-model choice deferred to hardening — documented).
+
+Suite 482 → **488** (+6 discharge tests). All red-green proven; full suite, canary, henxels, ruff green.
+
+Accepted minors (documented): M1 (INFO calibration — frozen-test-pinned), M2 (capsule.messages write-only), M3 (benign lazy-init race), M4 (pre-existing non-atomic consolidation write — pre-dates broker), M5 (bucket param vestigial), M6 (state/ gitignore — FIXED in this commit), M7 (vestigial tokens param), M8 (test hygiene notes — thread test weakness documented).

plans/2026-09-05-p0-04-pipeline-removal.md

@@ -0,0 +1,177 @@
+# P0-04 (#20) — Remove the Mandatory Per-Turn Cognitive Pipeline
+
+> **For agentic workers:** execution contract — FROZEN TESTS ARE THE SPEC. Implement verbatim; record every deviation in the plan tail. TDD red→green. Do not create/complete tasks; controller owns task state.
+
+**Gitea issue:** #20 (P0 — critical). **Branch:** `p0-04-pipeline-removal` off master `8704104`.
+
+## Why
+
+`_run_warm_router()` (rune_tui.py:3476-3866, ~390 lines) runs **21 steps on EVERY user message** — warm router, capability broker, memory recall, witness, cache, persona, abstraction, graph, pressure, event emit, drift check, goals, time, neurons, hooks, voice, **sleep consolidation**, repo map, auto-read, auto-search, memory filter. A "hi" triggers drift checks, sleep consolidation, and 20 other jobs. **A timer firing must not simulate consciousness.** The research census (explore-17) showed the pipeline's model-relevant output is ZERO (display-only dim status line) while carrying live side effects (neuron state mutation, hooks, sleep consolidation, event spam).
+
+## Research (inward + outward + innovation)
+
+1. **Inward:** full step inventory above (21 steps, line-mapped); P0-02 research already marked the pipeline "archive-candidate — model-relevant outputs are zero"; P0-06 shipped per-step record_failure observability (the safety net that makes removal safe); the ContextBroker (#19) now owns ALL model-facing context — the pipeline's display-only outputs are fully redundant with the broker trace.
+2. **Outward:** Anthropic/LangChain practice — context assembly is broker-owned (done in #19); background cognition is event-triggered (LangGraph background tasks, Temporal signals), never per-message; "awareness beats blocking" applies to STRUCTURE, not to per-turn job runs.
+3. **Innovation:** the pipeline's SIDE EFFECTS split three ways: (a) display status → replaced by the broker trace (already rendered via degraded list); (b) neuron state mutation (warm_router.route) → moves to an EXPLICIT trigger (memory recall in the broker already calls cached_recall; neuron priming belongs to real memory access, not message arrival); (c) sleep consolidation / drift checks / persona sync → become **meaningful-event triggered** (issue #48's taxonomy, seeded now with the two triggers that already exist: session start and explicit /commands) — full trigger engine is #48's scope, NOT this stage.
+
+## Constraints
+
+- **Functionality is immutable**: every capability must remain available on demand. Nothing is deleted — per-turn AUTOMATIC invocation is removed; /commands and startup keep working.
+- The 21-step pipeline is the ONLY caller of `_run_warm_router` (rune_tui.py:2045, in `_warm_router_thread`). The pre-dispatch parallel block (1975-2048: auto_context, auto_tasks, behavior) is a SEPARATE pipeline — also display-only; it goes too (same principle), but its removal is part of this stage only if characterization proves zero model impact (it writes auto_context.json consumed by... verify; if consumed by the broker path, keep the file write, drop the per-turn run).
+- Startup checks (1551+: compile_persona, scan_registry, load_tasks) are SESSION-scoped, not per-turn — they stay.
+- `_cmd_drift`, `_cmd_pressure`, `_cmd_events` etc. stay (on-demand access preserved).
+- P0-06 record_failure calls inside the pipeline die WITH the pipeline (the subsystems themselves keep their own internal guards — verify each module has its own try/except or gains one where the per-turn guard was the only one).
+- The broker's history/memory contributors are the model-facing path — untouched.
+- #48 (P3-05) owns the full trigger engine; this stage seeds the event taxonomy but does NOT build the scheduler.
+
+## Task 1 — Characterization lock (before removal)
+
+`tests/test_p0_04_pipeline_removal.py` — frozen tests:
+
+```python
+"""P0-04: the per-turn cognitive pipeline must not run on ordinary messages.
+
+Frozen contract: (1) sending a message does NOT invoke any of the 21 pipeline
+subsystems; (2) every subsystem remains reachable on demand (/commands and
+direct module calls); (3) the model-facing path (broker) is untouched.
+"""
+import sys
+from pathlib import Path
+from unittest.mock import patch
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+
+from rune import rune_tui  # noqa: E402
+
+
+def _make_app():
+    """Build a RuneApp with backend stubs (no live Ollama, no TUI runtime)."""
+    ...
+
+
+def test_sending_message_runs_no_pipeline_subsystems():
+    """Ordinary chat must not invoke warm_router.route, witness.detect_signals,
+    drift_ledger.check, sleep_time.consolidate, or any of the 21 steps."""
+    app = _make_app()
+    with patch.object(rune_tui.warm_router, "route") as wr, \
+         patch.object(rune_tui.witness, "detect_signals") as ws, \
+         patch.object(rune_tui.drift_ledger, "check") as dl, \
+         patch.object(rune_tui.sleep_time, "consolidate") as st, \
+         patch.object(rune_tui.capability_broker, "match_capabilities") as cb, \
+         patch.object(rune_tui.memory_store, "cached_recall") as mr:
+        app._run_warm_router("hi", channel="task")  # method must be a no-op now
+        wr.assert_not_called()
+        ws.assert_not_called()
+        dl.assert_not_called()
+        st.assert_not_called()
+        cb.assert_not_called()
+        mr.assert_not_called()
+
+
+def test_warm_router_method_is_noop():
+    """_run_warm_router exists (compat) but does nothing."""
+    app = _make_app()
+    assert app._run_warm_router("anything", channel="task") is None
+
+
+def test_subsystems_remain_available_on_demand():
+    """/commands still dispatch: _cmd_drift, _cmd_pressure, _cmd_events exist."""
+    app = _make_app()
+    for cmd in ("_cmd_drift", "_cmd_pressure", "_cmd_events", "_cmd_health"):
+        assert hasattr(app, cmd), f"{cmd} removed — functionality must be immutable"
+
+
+def test_pre_dispatch_parallel_block_removed():
+    """The pre-message dispatch (auto_context/auto_tasks/behavior) no longer
+    runs per message — _send_to_model goes straight to the operator."""
+    import inspect
+
+    src = inspect.getsource(rune_tui.RuneApp._send_to_model)
+    assert "build_auto_context" not in src
+    assert "extract_tasks" not in src
+    assert "match_context" not in src
+
+
+def test_broker_path_untouched():
+    """The model-facing context path still flows through the ContextBroker."""
+    import inspect
+
+    src = inspect.getsource(rune_tui.RuneApp._send_to_model)
+    assert "send_task" in src  # operator call intact
+```
+
+**RED:** tests 1-2 fail (pipeline still runs), test 4 fails (pre-dispatch still present).
+
+## Task 2 — Remove the per-turn invocation
+
+1. `_run_warm_router` becomes a documented no-op (compat shim — the method is referenced at 2045 and possibly elsewhere; keep the signature, delete the body, docstring points to the broker + /commands).
+2. The `_warm_router_thread` wrapper at 2040-2048: remove the thread spawn entirely (no thread for a no-op); `_send_to_model` proceeds directly to the model call.
+3. The pre-dispatch parallel block (1975-2048): remove the per-message run of auto_context/auto_tasks/behavior. VERIFY FIRST: does anything consume `auto_context.json` downstream (grep consumers)? If a consumer exists outside the pipeline, keep the module available on demand but stop the per-turn run. Record the finding.
+4. Keep: startup checks (1551+), all `/commands`, all modules, the broker path.
+
+## Task 3 — Event-trigger seeds (minimal, #48-compatible)
+
+1. Session start: the existing startup checks remain the session-scoped trigger (no change).
+2. `/drift`, `/pressure`, `/health`, `/events` remain the on-demand triggers (no change).
+3. NEW: a single meaningful-event hook — when the OPERATOR records a task FAILURE (send_task → failed transition, P0-02's TaskState), emit `event_bus.emit("task.failed", ...)` (already typed in the vocabulary). This is the first endogenous trigger; #48 grows the taxonomy. Implementation: one emit call in the operator's failure path (it may already exist via P0-06 record_failure — verify; if present, no change needed, just document).
+
+## Task 4 — Docs + canary + CI
+
+1. `docs/pipeline-removal.md`: what ran per-turn before, what runs now (broker only), where each capability lives on (command/module table), the event-trigger seed, #48 pointer.
+2. Canary `src/rune/canary_p0_04.py`: assert `_run_warm_router` is a no-op, the 21 subsystems import cleanly, /commands exist, broker path intact; prints `P0-04 PIPELINE REMOVAL CANARY PASSED`. Register in ci.yml (henxels gate requires same-commit registration).
+3. Docs update: authority map (`config/v1_authority_map.json`) — the pipeline entries flip to archive-candidate/removed.
+
+## Acceptance
+
+- All 5 frozen tests green (red proven first).
+- Full suite green (baseline 488; record actual; zero regressions — the pipeline's own removal must not break any test that doesn't specifically test the pipeline; if a test asserts pipeline behavior, UPDATE it to the new contract and record).
+- Canary green + registered; henxels exit 0.
+- `grep -c "record_failure" src/rune/rune_tui.py` drops by the pipeline's count (record before/after).
+- Measurable overhead drop: time `_run_warm_router("hi")` before (real work) vs after (no-op) — record in plan tail.
+- ruff clean on touched files (absolute paths); no reformat of untouched files.
+
+## Pipeline requirements checklist
+- [x] TDD red→green (5 frozen tests)
+- [x] ruff check + format on touched files
+- [ ] Spec gate PASS (independent reviewer)
+- [ ] Quality gate Approved (independent reviewer)
+- [x] Full-suite regression green
+- [x] henxels check --all green
+- [ ] Closed with formatted comment + refs
+
+## Tail — execution record (2026-09-05, branch `p0-04-pipeline-removal`)
+
+### Red evidence (Task 1)
+`tests/test_p0_04_pipeline_removal.py` written verbatim from this plan.
+Baseline run: **2 failed, 3 passed** —
+- `test_sending_message_runs_no_pipeline_subsystems` FAILED (pipeline still ran: mocked subsystems were invoked; error surfaced at the old body's `record_failure → ch.add_message` on the stub channel, `AttributeError: 'NoneType' object has no attribute 'add_message'` at old line 3616).
+- `test_warm_router_method_is_noop` FAILED (same — the 21-step body executed).
+- `test_pre_dispatch_parallel_block_removed` **PASSED at baseline** — see Deviation D1.
+- `test_subsystems_remain_available_on_demand`, `test_broker_path_untouched` passed (expected — they pin preserved behavior).
+
+### Counts / measurements
+- **Test counts:** before 488 passed + 84 subtests → after **495 passed + 84 subtests** (only delta = the 5 frozen tests + 2 Task-3 addendum tests counted within the 493; zero regressions, no pre-existing test asserted pipeline behavior).
+- **`grep -c record_failure src/rune/rune_tui.py`: 21 → 4** (the pipeline's 17 calls died with the body; remaining 4 are the startup/provider paths at ~1243).
+- **Timing of `_run_warm_router("hello world performance baseline", channel="task")`** (real modules, `RUNE_MEMORY_DIR`/`RUNE_HOME` pointed at tempdirs, stub channels): **118.6 / 121.6 / 120.8 ms** before → **~0 ms** after (no-op return). Measured from the working tree at the pre-removal state (not from git — measured live before the edit).
+
+### Verification findings
+- **auto_context.json consumers:** grep of `src/` confirms ONLY `auto_context.py:24` references `CONTEXT_FILE` (writes it); **no consumer exists anywhere in src/** — the per-turn run is stopped and the file write dies with it. Modules stay importable; `auto_context.build_auto_context` remains callable on demand.
+- **task.failed verification (Task 3):** `rune_operator.py` had **NO** `task.failed` emit and no `event_bus` usage; the failure transition (`send_task` else-branch and `_apply_runtime_result` else-branch) only called `_task_state.transition(task_id, "failed")`. `record_failure` in the operator covers subsystem degradations (tier=1 → `capability.failed`), NOT the task-failure transition. **Task 3 therefore implemented the emit**, not documentation-only: `RuneOperator._emit_task_failed(task, channel)` emits `event_bus.emit("task.failed", source="rune_operator", payload={task_id, channel, model, error[:300]})`, called from BOTH failure transitions (direct send_task path + approval-resolution path) — one emit per failure, guarded so a journal failure can never mask the operator's own failure. Verified end-to-end: failed send_task → exactly 1 `task.failed` event in the journal.
+
+### Deviations
+- **D1 (frozen-test geometry):** `test_pre_dispatch_parallel_block_removed` inspects `RuneApp._send_to_model`, but the pre-dispatch parallel block actually lived in `RuneApp.on_input_submitted` (old lines 1997-2038), so the frozen test passed trivially at baseline. Test kept verbatim (frozen); the block itself WAS removed from `on_input_submitted`, and the canary additionally inspects `on_input_submitted` for the banned calls and the deleted `_warm_router_thread`, closing the gap the frozen test couldn't see.
+- **D2 (sleep_time.consolidate did not exist):** the frozen test patches `rune_tui.sleep_time.consolidate`, but `sleep_time.py` never had that attribute — the old pipeline's step 17 called it inside a bare `except: pass` and **silently never ran** (the `/sleep` command even guards with `hasattr`). To honor the frozen contract AND "every capability remains available on demand", `sleep_time.consolidate(full=False)` was ADDED as a delegate to `MemoryConsolidation.consolidate_all()` (returns counts dict, degrades to None). This makes `/sleep` functional for the first time. No existing behavior changed.
+- **D3 (authority-map vocabulary):** the plan says entries flip to "archive-candidate/removed", but `test_v1_authority_map.py` pins `ALLOWED_DISPOSITIONS` without `removed`; both `context_construction` TUI entries were already `archive-candidate`, so the evidence fields were updated to record the completed removal (with docs pointer) instead of introducing a new disposition value. `test_v1_authority_map.py` needed no change (it pins schema, not values).
+- **D4 (Task-3 addendum tests):** 2 additive tests appended after the 5 frozen ones (emit-on-failure + single-emit guard). The 5 frozen tests are untouched.
+
+### Pinned follow-ups
+- **#48 (P3-05)** owns the full trigger engine: grows the taxonomy beyond the `task.failed` seed, schedules sleep/drift/persona sync on meaningful events.
+- `_apply_runtime_result`'s failure path is covered by the same emit; if #48 wants per-cause events (tool failure vs model refusal vs protocol scrub), the payload can grow there.
+- `docs/v1/AUTHORITY_MAP.md` disposition table may gain a `removed` row whenever P0-01's vocabulary is next revised (D3).
+## Quality-gate discharges (general-176 Approved-with-minors)
+
+- **I-1 test rot + journal pollution**: test 6 now patches `event_bus._store_path` (call-time seam — `EVENT_LOG` resolves at IMPORT time, so env patches are useless post-import; root cause of both the pollution and the rot) to a tempdir journal, and binds to this run's failed task. RED-GREEN proven: emit disabled → test FAILS (was: passed on 49 stale live-journal events).
+- **I-2 docs**: `/sleep` → `/dream` corrected (the consolidation trigger is _cmd_dream; /sleep is a status card); stale 493 → 495 in docs/pipeline-removal.md.
+- **I-3 canary hardening**: canary now source-inspects `_run_warm_router`'s body for 12 banned identifiers (covers the 15 steps the 6 mock sentinels missed). RED-GREEN proven: re-adding `warm_router.route` in the shim → canary FAILS.
+- Accepted minors: M-1 dead imports (coordinated-removal candidate, test-pinned), M-2 dead StatusBar fields (never rendered), M-3 neuron priming loss (documented, #48 owns rewiring), M-4 acceptable, M-5 hook_engine.fire pre-existing absent (follow-up material), M-6 payload hash-only (documented design consequence for #48), M-7 /dream sync acceptable + stale fallback text noted, M-8 pre-existing, M-9 canary-only pinning (now hardened per I-3).

plans/2026-09-05-p0-05-native-tools.md

@@ -0,0 +1,273 @@
+# P0-05 (#21) — Native Iterative Tool Calling: Gap Closure + Acceptance Proof
+
+> **For agentic workers:** execution contract — FROZEN TESTS ARE THE SPEC. Implement verbatim; record every deviation in the plan tail. TDD red→green. Do not create/complete tasks; controller owns task state.
+
+**Gitea issue:** #21 (P0 — critical). **Branch:** `p0-05-native-tools` off master `96a9b5f`.
+
+## Why
+
+The issue's handoff description ("models print JSON, one tool/follow-up cycle") predates the runtime's evolution: `LocalToolRuntime._run_loop` is ALREADY a real iterative loop (`while True`, `max_iterations=8`, approval pauses, executor errors fed back to the model, typed `ToolRequest`/`ToolEvent` dataclasses, native tool_calls via `/api/show` capabilities). The controller's empirical probe (2026-09-05) PROVED the acceptance scenario end-to-end: **qwen3:14b fixed a broken `add()` in a disposable sandbox — read_file → edit_file ×2 → run_command ×2 (approval-gated) → verified "OK" — using real native tool_calls, no faux JSON** (`FIX VERIFIED: True`).
+
+So this stage is NOT a rebuild — it is **gap closure + proof hardening** so the architecture claims are machine-checked, not anecdotal.
+
+## Research (inward + outward + innovation, compressed)
+
+1. **Inward census (2026-09-05):** R1 native adapters ✅ (`supports_tools` via `/api/show` capabilities; qwen3:14b advertises `tools`+`thinking`); R2 iterative loop ✅ (8-iteration budget, approval pauses, resume preserves consumed iterations); R3 typed objects ✅ (frozen dataclasses `ToolRequest`/`ToolEvent`); R4 recoverable failures ✅ (executor error → `_tool_message` → model adapts); R5 coding tools ✅ (read/edit/write/glob/grep/lint/run_tests/format/git_diff/git_commit/run_command/repo_map); R7 budget ✅ (max 1-8 enforced). 20 loop tests exist (test_local_tool_runtime.py).
+2. **Empirical probes (the real findings):**
+   - **P1 (acceptance proof)**: qwen3:14b completed the multi-step fix in a writable sandbox (3 approval rounds, 5 tool events, `FIX VERIFIED: True`). In a NON-writable sandbox the model burned 2 edit_file retries before adapting — the sandbox error message didn't tell it where it COULD write.
+   - **P2 (probe artifact)**: a bare user message with NO system prompt → the model claims it cannot read files despite advertised tools. Native tool calling needs a tool-capable system prompt; the operator path sends only a tool NAME list (`## Available tools\nread_file, ...`) — names without usage guidance.
+   - **P3 (budget blindness)**: `OperatorResponse` carries no `iterations_used`/budget fields — "step 5/8" is invisible to the operator/TUI.
+   - **P4 (retry burn)**: one always-failing tool consumes the whole 8-iteration budget; no consecutive-failure circuit breaker.
+3. **Outward:** Anthropic/LangChain agent-loop norms — budget visibility (step counters), fail-fast on repeated identical failures, structured error text that enables self-correction. No framework adoption (bespoke stack, established in #19 research).
+4. **Innovation:** none forced — this stage hardens; the E2E acceptance test gated on live Ollama is itself the innovation (CI-safe skip pattern).
+
+## Constraints
+
+- No parallel authority path: all changes land in `local_tool_runtime.py`/`tool_protocol.py`/`tool_executor.py`/`rune_operator.py`.
+- The 20 existing loop tests are the characterization floor — none may break.
+- The E2E acceptance test MUST skip cleanly when Ollama is unreachable (CI has no model) and MUST use a writable sandbox (`~/.rune-e2e-probe/` — `/tmp` is read-blocked by the sandbox, a real finding).
+- `run_command` approval flow: the E2E test resolves approvals programmatically (the `approve()` API — exactly how the TUI does it).
+
+## Task 1 — Budget visibility + circuit breaker (typed, tested)
+
+`src/rune/local_tool_runtime.py`:
+
+```python
+# OperatorResponse gains (additive, tool_protocol.py):
+#   iterations_used: int = 0
+#   iteration_budget: int = 0
+
+# In _run_loop, before executing each request batch: consecutive identical
+# failures of the SAME tool (name + normalized arguments hash) >= 2 →
+# return self._failure(
+#     f"tool {request.name} failed {n} consecutive times with identical "
+#     "arguments — stopping before the iteration budget burns",
+#     events, thinking,
+# )
+```
+
+Frozen tests (tests/test_p0_05_native_tools.py):
+
+```python
+def test_response_carries_iteration_budget_fields():
+    """P3: every OperatorResponse from the loop reports iterations used/budget."""
+    # run a 2-call scripted conversation; assert resp.iterations_used == 2,
+    # resp.iteration_budget == runtime.max_iterations
+
+def test_identical_failure_twice_stops_before_budget_burn():
+    """P4: the same tool failing twice with identical arguments stops the loop
+    with a typed reason — the model cannot burn all 8 iterations on it."""
+    # executor returns {"success": False, "error": "boom"} for read_file;
+    # model (scripted) keeps requesting the identical read_file call;
+    # assert the loop returns failure mentioning "consecutive" AND
+    # iterations_used < max_iterations
+
+def test_different_arguments_reset_the_failure_streak():
+    """A failing call followed by the same tool with DIFFERENT args is not a
+    streak — the loop continues."""
+```
+
+**RED:** fields missing → AttributeError; circuit breaker absent → budget burns.
+
+## Task 2 — Sandbox error text enables self-correction (P1)
+
+`tool_executor.py` path-denial errors gain the allowed-write list:
+
+```python
+# is_path_allowed failure message becomes:
+# f"Access denied: {path} is outside allowed write directories: {ALLOWED_WRITE_DIRS}. "
+# "Write inside one of those directories instead."
+```
+
+Frozen test:
+
+```python
+def test_path_denial_names_the_allowed_directories():
+    """A denied write tells the model WHERE it can write — one-step recovery."""
+    result = execute_tool("write_file", {"path": "/etc/nope.txt", "content": "x"})
+    assert result["success"] is False
+    assert "allowed" in result["error"].lower()
+    assert any(d.split("/")[-1] in result["error"] or d in result["error"] for d in ALLOWED_WRITE_DIRS)
+```
+
+## Task 3 — Tool-capable system guidance on the native path (P2)
+
+The operator's tools block (rune_operator.py:728-740) gains one usage line (content change only, verbatim shape):
+
+```python
+f"\n## Available tools\n{', '.join(tool_names)}\n"
+"Use tools for every file/command action; never fabricate tool output. "
+"Read before editing; verify fixes by running them."
+```
+
+Frozen test:
+
+```python
+def test_tools_block_carries_usage_guidance():
+    """P2: the native path's system prompt tells the model HOW to use tools
+    (a bare name list left qwen3:14b claiming it could not read files)."""
+    src = inspect.getsource(RuneOperator._contributor_tools)
+    assert "never fabricate" in src
+    assert "Read before editing" in src
+```
+
+## Task 4 — The acceptance test (E2E, live-model gated)
+
+`tests/test_p0_05_acceptance.py`:
+
+```python
+"""P0-05 acceptance: qwen3:14b completes a multi-step disposable coding task
+using REAL native tool calls. Skips cleanly when Ollama is unreachable (CI)."""
+
+import os
+import shutil
+import socket
+import urllib.request
+
+import pytest
+
+from rune.local_tool_runtime import LocalToolRuntime, OllamaChatTransport
+from rune.tool_executor import execute_tool
+
+
+def _ollama_up() -> bool:
+    try:
+        urllib.request.urlopen("http://127.0.0.1:11434/api/tags", timeout=2)
+        return True
+    except Exception:
+        return False
+
+
+pytestmark = pytest.mark.skipif(not _ollama_up(), reason="Ollama not reachable")
+
+
+def test_qwen3_14b_fixes_broken_add_end_to_end(tmp_path):
+    """The issue's acceptance scenario, in-suite: read → edit → run → verified,
+    with approval pauses resolved programmatically (the TUI's own flow)."""
+    sandbox = Path(os.path.expanduser("~")) / ".rune-e2e-probe" / "p0-05"
+    shutil.rmtree(sandbox, ignore_errors=True)
+    sandbox.mkdir(parents=True)
+    calc = sandbox / "calc.py"
+    calc.write_text("def add(a, b):\n    return a - b\n")
+
+    runtime = LocalToolRuntime(
+        transport=OllamaChatTransport(timeout=90),
+        executor=execute_tool,
+        model="qwen3:14b",
+    )
+    resp = runtime.run(
+        [
+            {
+                "role": "system",
+                "content": "You are a coding agent. Fix bugs using your tools: "
+                "read_file, edit_file, run_command. Work step by step until verified.",
+            },
+            {
+                "role": "user",
+                "content": f"The function add() in {calc} is broken — it should add, "
+                "not subtract. Fix it and PROVE the fix by running: "
+                f"python3 -c \"import sys; sys.path.insert(0,'{sandbox}'); "
+                "from calc import add; assert add(2,3)==5; print('OK')\"",
+            },
+        ],
+        options={"num_ctx": 16384, "num_predict": 1024},
+        think=False,
+    )
+    rounds = 0
+    while resp.pending_approval and rounds < 6:
+        resp = runtime.approve(resp.pending_state)
+        rounds += 1
+
+    assert resp.success, f"loop failed: {resp.error}"
+    names = [ev.request.name for ev in resp.tool_events]
+    assert "read_file" in names and "edit_file" in names, names
+    assert "run_command" in names, names
+    # NO faux-JSON acceptance: every executed call came through the typed path
+    assert all(ev.request.source in ("native", "text") for ev in resp.tool_events)
+    # THE acceptance: the fix actually landed
+    import importlib.util
+
+    spec = importlib.util.spec_from_file_location("calc", calc)
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    assert mod.add(2, 3) == 5
+    shutil.rmtree(sandbox.parent, ignore_errors=True)
+```
+
+Plus a canary `src/rune/canary_p0_05.py` (no live model): loop-shape assertions (max_iterations enforcement, circuit breaker present in source, budget fields on a scripted response, sandbox error text) → `P0-05 NATIVE TOOLS CANARY PASSED`. Register in ci.yml same commit (henxels gate).
+
+## Task 5 — Docs
+
+`docs/native-tools.md`: loop architecture (while/stop conditions/approval), budget fields, circuit breaker, sandbox error contract, the acceptance scenario + how to run it live, model-capability discovery. Update plan tail with deviations.
+
+## Acceptance
+
+- All 4 frozen tests + E2E green (E2E skips in CI — record a LOCAL green run output in the plan tail as the acceptance evidence: `FIX VERIFIED: True` equivalent assertion).
+- Full suite green (baseline 495 → +5 expected ≈ 500; record actual; zero regressions — the 20 existing loop tests are the floor).
+- Canary green + registered; henxels exit 0; ruff clean on touched files (absolute paths).
+- `iterations_used`/`iteration_budget` visible on every loop response.
+
+## Pipeline requirements checklist
+- [x] TDD red→green (4 frozen tests)
+- [x] ruff check + format on touched/added files
+- [ ] Spec gate PASS (independent reviewer)
+- [ ] Quality gate Approved (independent reviewer)
+- [x] Full-suite regression green
+- [x] henxels check --all green
+- [x] Local E2E acceptance run recorded in plan tail
+- [ ] Closed with formatted comment + refs
+
+## Tail — execution record (2026-09-05, branch `p0-05-native-tools`)
+
+### Red evidence (Tasks 1-3)
+`tests/test_p0_05_native_tools.py` written from the plan's frozen snippets.
+Baseline run: **4 failed, 1 passed** —
+- `test_response_carries_iteration_budget_fields` FAILED: `AttributeError: 'OperatorResponse' object has no attribute 'iterations_used'` (P3 fields absent).
+- `test_identical_failure_twice_stops_before_budget_burn` FAILED: `'consecutive' not found in 'local tool runtime iteration limit reached'` — the breaker was absent and the identical failing read_file burned the full 8-iteration budget (P4, exactly as probed).
+- `test_path_denial_names_the_allowed_directories` FAILED: `any(...) is False` — the denial said only "outside allowed directories", naming no allowed dir (P1).
+- `test_tools_block_carries_usage_guidance` FAILED: `'never fabricate' in src` → False (P2: bare name list).
+- `test_different_arguments_reset_the_failure_streak` **PASSED at baseline** — see Deviation D5 (guard test).
+
+### Counts
+- **Full suite:** before 495 passed + 84 subtests → after **501 passed + 84 subtests** (delta = 5 frozen tests + 1 E2E; the E2E runs live locally with Ollama up and will SKIP in CI → CI expects 500). Zero regressions — the 20 existing loop tests are untouched and green.
+- **henxels check --all --plain:** exit 0 (21 pre-existing warnings, unchanged).
+- **ruff:** `check` clean on all 7 touched/added files; `format --check` clean on all 3 ADDED files (`tests/test_p0_05_native_tools.py`, `tests/test_p0_05_acceptance.py`, `src/rune/canary_p0_05.py`). Existing source files were NOT reformatted (they predate the format gate; CI only format-checks ADDED files — same policy as P0-04).
+
+### Local E2E acceptance evidence (Task 4)
+`tests/test_p0_05_acceptance.py::test_qwen3_14b_fixes_broken_add_end_to_end` — **PASSED in 14.12s** (Ollama live, qwen3:14b, sandbox `~/.rune-e2e-probe/p0-05`). Instrumented rerun event trace:
+
+```
+success: True | error: -
+iterations_used: 4 / 8
+  [completed] ollama-native:read_file args={'path': '~/.rune-e2e-probe/p0-05/calc.py'}
+  [pending_approval] ollama-native:edit_file args={'path': '…/calc.py', 'search': 'return a - b', 'replace': 'return a + b'}
+  [completed] ollama-native:edit_file args={'path': '…/calc.py', 'search': 'return a - b', 'replace': 'return a + b'}
+  [pending_approval] ollama-native:run_command args={'command': 'python3 -c "…from calc import add; assert add(2,3)==5; print(\'OK\')"', 'shell': True}
+  [completed] ollama-native:run_command args={'command': 'python3 -c "…assert add(2,3)==5; print(\'OK\')"', 'shell': True}
+FIX VERIFIED: True
+```
+
+2 approval rounds resolved via `runtime.approve(resp.pending_state)` (the TUI flow); every call came through the typed native path; the fix landed (`add(2,3) == 5`).
+
+### Canary (Task 4)
+`src/rune/canary_p0_05.py` — no live model, self-bootstrapping, RUNE_HOME/RUNE_MEMORY_DIR isolated to tempdirs. Checks: scripted breaker trip (2 identical failing read_file → typed failure, exactly 2 executor calls), breaker message pinned in `_run_loop` source, budget fields on a scripted 2-call response, sandbox denial names every `ALLOWED_WRITE_DIRS` entry, max_iterations enforcement (8 distinct calls → "iteration limit", used == budget), tools-block guidance. Output: `P0-05 NATIVE TOOLS CANARY PASSED`. Registered in `.gitea/workflows/ci.yml` canary loop **in the same commit** (henxels gate).
+
+### Deviations
+- **D1 (E2E imports):** the plan's Task-4 snippet uses `Path` without importing it — added `from pathlib import Path` (otherwise NameError). Dropped the unused `import socket` from the same snippet (ruff F401; "ruff clean on touched files" acceptance line). No behavioral change.
+- **D2 (E2E source assertion):** the plan asserts `ev.request.source in ("native", "text")`, but the actual typed sources are `ollama-native` (normalize_ollama_tool_calls) and `text-fallback` (_protocol_entries) — the literal assertion would fail on every genuine native call. Implemented as `in ("ollama-native", "text-fallback")`; identical intent ("every executed call came through the typed path"), factually correct against the codebase.
+- **D3 (failure-site coverage):** the breaker also tracks failures from the approval branch's inline-execution path (authority executor + mutating tool whose prepare failed, e.g. a path-denied `edit_file`) — that is the P1 probe's real failure site; a read-only-only breaker would not have stopped the P1 retry burn. Implemented via one shared closure so both paths stay in lockstep.
+- **D4 (count wording):** the plan says "4 frozen tests" but Tasks 1-3 define 5 test functions (3+1+1); the plan's own math (495 → +5 ≈ 500) confirms 5. All 5 written.
+- **D5 (baseline-green guard):** `test_different_arguments_reset_the_failure_streak` passes at baseline (no breaker → loop continues trivially). Kept verbatim as the guard against over-tripping: with a naive per-tool (not per-signature) breaker it would fail. Same class as P0-04's D1.
+- **D6 (breaker timing):** the streak check trips on the 2nd identical failure's result (post-execution) rather than pre-executing a 3rd identical request — the burn stops at exactly 2 executor calls and the plan's "before the iteration budget burns" holds; the loop never reaches a 3rd identical execution.
+- **D7 (pre-loop failures):** `_failure` now defaults `iterations_used=0` and always reports `iteration_budget=max_iterations`; failures before the loop (run/resume state validation) therefore report 0-used/budget-capped, documented in docs/native-tools.md.
+
+### Pinned follow-ups
+- The failure-streak state lives in `_run_loop` locals and is not serialized into `pending_state` — a streak does not survive an approval round-trip. Acceptable (approvals reset conversational momentum anyway); if #48 or the TUI wants streak persistence, extend `pending_state` typing in the same seam.
+- 13 hardcoded `num_ctx` sites outside the operator path remain pinned from P0-03 (unchanged here).
+- `validate_read_path` denials still use the bare "outside allowed directories" text (reads are broader: `/tmp` allowed); if a probe ever shows read-side confusion, mirror the write-denial contract with `ALLOWED_READ_DIRS`.
+## Quality-gate discharges (general-179 Approved-with-minors)
+
+- **F1 (Important)** — six mid-loop `_failure` sites now pass `iterations_used=iterations_used` (pre-loop failures keep the documented 0). Discharge test `test_mid_loop_failure_reports_consumed_iterations`: scripted text-protocol transport, 2 consumed turns, transport dies on turn 3 → asserts used==2/budget==8. RED-GREEN proven (reverting the kwarg → test fails with used==0).
+- **Minor-3** — write-denial distinguishes BLOCKED dirs (truthful "protected directory, always blocked" message) from outside-allowed (names ALLOWED_WRITE_DIRS). The frozen path-denial test now uses /opt (outside-allowed, non-blocked) so both messages stay pinned.
+- **Minor-5** — E2E unloads qwen3:14b after the run (`keep_alive: 0`), releasing ~10 GB VRAM instead of pinning it for Ollama's 5-minute TTL.
+- Accepted minors (documented): 1 (streak not serialized across approval pauses — bounded by budget + human gate; extension point pinned), 2 (declared-arg jitter = different call, budget caps), 4 (read-side asymmetry pinned), 6 (cold-start timeout — visible, self-healing), 7 (commit-message collision — process incident, disclosed), 8 (test-count nit). Pre-existing items logged: resume() unvalidated pending_state (defense-in-depth), hook_engine.fire absence.

plans/2026-09-05-p0-07-inference-trace.md

@@ -0,0 +1,223 @@
+# P0-07 (#23) — Instrument the Actual Outbound Inference Request
+
+> **For agentic workers:** execution contract — FROZEN TESTS ARE THE SPEC. Implement verbatim; record every deviation in the plan tail. TDD red→green. Do not create/complete tasks; controller owns task state.
+
+**Gitea issue:** #23 (P0 — critical). **Branch:** `p0-07-inference-trace` off master `938eeae`.
+
+## Why
+
+"Stop reasoning about theoretical context and measure what models actually receive." The broker (#19) already computes per-block contributions, admission decisions, and the budget basis — but `_last_trace` is in-memory, overwritten every call. The transport captures `prompt_eval_count` (served prompt tokens) but discards output tokens and durations. Nothing persists any of it. One trace must answer both *"why did this call cost this much?"* and *"what exactly did this local model see?"* — and support cloud/local comparison.
+
+## Research (inward + outward + innovation, compressed)
+
+1. **Inward (2026-09-05):** broker trace fields exist (model_id, window, budget, blocks[], admitted, dropped, memory_tokens, degraded, compaction, elapsed_ms); transport exposes `last_prompt_eval_count` only; operator logs calibration drift (log-only, pinned); `_log_token_usage` writes a rotating rune.log. Ollama `/api/chat` returns `prompt_eval_count`, `eval_count` (output tokens), `total_duration`, `load_duration`, `prompt_eval_duration`, `eval_duration` (empirically verified). No cache fields — KV-cache reuse is not exposed by Ollama (record `cache: null`; the field exists for cloud comparison).
+2. **Outward:** LangSmith/LangFuse trace shapes — one record per agent-run with token usage, latency, model params, and metadata linkage; cost = tokens × price-map (empty map → None for unpriced local models). Anthropic's "count, never guess" — served counts are ground truth.
+3. **Innovation:** the trace file IS the innovation surface for #25/#28/#29 (they consume it); keep the record schema versioned (`schema_version: 1`) so consumers can evolve. Rotation mirrors `_log_token_usage` (10MB × 3).
+
+## Constraints
+
+- No parallel authority path: the trace builds FROM the broker trace (single source) + transport counters; never re-measures.
+- Log-only calibration stays log-only (pinned in #19) — the trace PERSISTS what calibration only logged.
+- The journal (event_bus) is body-free by design — traces go to their own JSONL (`rune_home/state/inference_traces.jsonl`), same pattern as `history_archive.jsonl`.
+- `state/` is gitignored (P0-05 M6 fix) — traces are runtime state, never committed.
+- Thread safety: model calls run on exclusive workers; the append is O_APPEND line-atomic (same as archive).
+- The 20+1 existing loop tests and all characterization tests stay green.
+
+## Task 1 — Transport usage accumulation
+
+`src/rune/local_tool_runtime.py` `OllamaChatTransport.chat`: alongside `last_prompt_eval_count`, accumulate:
+
+```python
+self.usage_calls: int = 0
+self.usage_prompt_tokens: int = 0      # sum of prompt_eval_count
+self.usage_output_tokens: int = 0      # sum of eval_count
+self.usage_total_duration_ns: int = 0  # sum of total_duration
+```
+
+(Additive; `last_prompt_eval_count` unchanged — calibration depends on it.)
+
+Frozen test:
+
+```python
+def test_transport_accumulates_usage_across_calls():
+    """P0-07: the transport sums served prompt/output tokens and call count
+    across every chat — the raw material for the durable trace."""
+    # scripted _post returning distinct counts per call; 3 chats;
+    # assert usage_calls == 3, usage_prompt_tokens == sum, usage_output_tokens == sum
+```
+
+## Task 2 — InferenceTrace record + durable store
+
+`src/rune/inference_trace.py` (new):
+
+```python
+"""Durable per-inference traces — what the model actually received and spent.
+
+One JSONL line per operator run (one runtime.run = one or more model calls).
+Answers: why did this call cost this much? what exactly did the model see?
+Consumed by #25/#28/#29. Rotates at 10MB x 3 (mirrors _log_token_usage).
+"""
+INFERENCE_TRACE_SCHEMA_VERSION = 1
+TRACE_ROTATE_BYTES = 10_000_000
+TRACE_BACKUPS = 3
+
+@dataclass(frozen=True)
+class InferenceTrace:
+    schema_version: int
+    provider: str                 # "ollama" (transport class constant)
+    model: str
+    task_id: str
+    channel: str
+    resolved_context_window: int  # broker window (discovered)
+    input_budget: int             # broker budget
+    model_calls: int              # transport.chat invocations this run
+    prompt_tokens_estimated: int  # broker admitted_total
+    prompt_tokens_served: int     # transport usage_prompt_tokens (0 if unknown)
+    output_tokens: int            # transport usage_output_tokens
+    latency_ms: float             # wall clock around runtime.run
+    model_time_ms: float          # sum total_duration / 1e6
+    per_block_tokens: dict        # {block_name: tokens} admitted blocks
+    dropped_blocks: list          # [{name, tokens, reason}]
+    tools_exposed: list[str]      # runtime allowlist
+    memories_exposed: list[str]   # memory blocks with tokens > 0
+    memory_tokens: int
+    degraded: list[str]
+    cache: dict | None            # None locally (Ollama exposes no KV stats)
+    cost_usd: float | None        # None when no price entry (local = unpriced)
+    cost_basis: str               # "local-unpriced" | "price-map"
+    success: bool
+    error: str
+
+def record_trace(trace: InferenceTrace, trace_dir: Path | None = None) -> Path:
+    """Append one JSONL line; rotate at TRACE_ROTATE_BYTES (TRACE_BACKUPS)."""
+
+def price_for(model: str) -> float | None:
+    """USD per 1M tokens (blended) — empty map until cloud providers land."""
+```
+
+`OllamaChatTransport.provider = "ollama"` class attribute.
+
+Frozen tests (tests/test_p0_07_inference_trace.py):
+
+```python
+def test_trace_record_persists_all_required_fields():
+    """One record carries every field the issue lists (provider/model, window,
+    prompt est+served, output, latency, per-block, tools, memories, task_id)."""
+    # build a trace via build helper with a scripted broker trace + transport;
+    # record; read back the JSONL line; assert every field present + schema_version 1
+
+def test_trace_answers_what_did_the_model_see():
+    """Per-block contributions + tools + memories exposed reconstruct exactly
+    what the prompt contained (admitted blocks with token counts)."""
+    # trace with blocks {persona: 980, tools: 90, memory: 75, history: 400, user: 20};
+    # assert per_block_tokens matches; memories_exposed == ["memory"]; tools_exposed lists
+
+def test_trace_answers_cost_local():
+    """Local model: served + estimated tokens present, cost None with basis
+    'local-unpriced' (cloud comparison = same record shape, priced basis)."""
+
+def test_trace_latency_and_output_tokens_from_transport():
+    """latency_ms (wall) and model_time_ms (Ollama total_duration sum) +
+    output_tokens (eval_count sum) flow from the transport accumulators."""
+
+def test_trace_task_id_linkage():
+    """task_id + channel land on the record — traces join to TaskState."""
+
+def test_trace_file_rotates_at_capacity():
+    """Rotation: >10MB → .1 backup, fresh file; no unbounded growth."""
+
+def test_price_map_unknown_model_is_none():
+    """price_for('unknown') is None → cost_usd None, basis 'local-unpriced'."""
+```
+
+**RED:** module missing → ImportError; fields absent → AttributeError/KeyError.
+
+## Task 3 — Operator wiring
+
+`rune_operator.py` `_execute_on_model`: around the `runtime.run` call (and the tier-escalation loop — one trace per RUN, on the FINAL response):
+
+```python
+run_started = time.monotonic()
+response = runtime.run(...)
+# ... existing finalize/calibration ...
+from .inference_trace import InferenceTrace, record_trace, price_for
+transport = getattr(runtime, "transport", None)
+trace_record = InferenceTrace(
+    schema_version=1,
+    provider=getattr(transport, "provider", "unknown"),
+    model=model,
+    task_id=task.task_id,
+    channel=channel,
+    resolved_context_window=trace["window"] or 0,
+    input_budget=trace["budget"],
+    model_calls=getattr(transport, "usage_calls", 0),
+    prompt_tokens_estimated=trace["admitted_total"],
+    prompt_tokens_served=getattr(transport, "usage_prompt_tokens", 0),
+    output_tokens=getattr(transport, "usage_output_tokens", 0),
+    latency_ms=round((time.monotonic() - run_started) * 1000, 3),
+    model_time_ms=round(getattr(transport, "usage_total_duration_ns", 0) / 1e6, 3),
+    per_block_tokens={b["name"]: b["tokens"] for b in trace["blocks"] if b.get("admitted")},
+    dropped_blocks=[{"name": b["name"], "tokens": b["tokens"]} for b in trace["blocks"] if not b.get("admitted")],
+    tools_exposed=list(runtime.tool_names),
+    memories_exposed=[b["name"] for b in trace["blocks"] if b.get("admitted") and b["name"] in MEMORY_BLOCK_NAMES and b["tokens"] > 0],
+    memory_tokens=trace["memory_tokens"],
+    degraded=sorted(degraded),
+    cache=None,
+    cost_usd=price_for(model),
+    cost_basis="price-map" if price_for(model) is not None else "local-unpriced",
+    success=bool(response.success),
+    error=(response.error or "")[:300],
+)
+try:
+    record_trace(trace_record)
+except Exception as exc:  # degrade-not-crash: tracing must never break a turn
+    record_failure("inference_trace", exc, tier=2)
+```
+
+Guarded degrade-not-crash (P0-06 rule): a trace failure must never fail the turn.
+
+Frozen test:
+
+```python
+def test_operator_writes_trace_per_run():
+    """The operator persists one trace per send_task with task linkage —
+    and a broken trace store never fails the turn (degrade-not-crash)."""
+```
+
+## Task 4 — Canary + docs + CI
+
+1. `src/rune/canary_p0_07.py` (no live model): scripted broker trace + transport counters → record → read back → assert every issue-listed field; rotation probe; prints `P0-07 INFERENCE TRACE CANARY PASSED`. Register in ci.yml SAME commit (henxels gate).
+2. `docs/inference-trace.md`: record schema (v1), field sources (broker/transport/operator), rotation, cost basis, cloud/local comparison, consumers (#25/#28/#29).
+3. Authority map: add `inference_trace` entry (write-side: rune_operator; store: state/inference_traces.jsonl).
+
+## Acceptance
+
+- All 8 frozen tests green (red proven first).
+- Full suite green (baseline 501 → +8 expected ≈ 509; record actual; zero regressions).
+- Canary green + registered; henxels exit 0; ruff clean (format ADDED files).
+- One trace answers both issue questions: cost (tokens est/served + output + latency + cost basis) and visibility (per-block + tools + memories) — demonstrated by the frozen tests.
+
+## Pipeline requirements checklist
+- [ ] TDD red→green (8 frozen tests)
+- [ ] ruff check + format on touched/added files
+- [ ] Spec gate PASS (independent reviewer)
+- [ ] Quality gate Approved (independent reviewer)
+- [ ] Full-suite regression green
+- [ ] henxels check --all green
+- [ ] Closed with formatted comment + refs
+## Execution deviations (recovered from implementer report, verified by spec gate general-181)
+
+1. **latency_ms scope**: `run_started` placed BEFORE the tier-escalation `while` loop — latency covers the whole attempt, not just one tier attempt.
+2. **MEMORY_BLOCK_NAMES import**: implemented as a local import inside the guarded try (matches the operator's established local-import style) instead of the plan's top-level import — same target.
+3. **Rotation**: manual `.3→.2→.1→current` `os.replace` shift (dispatch allowed either approach); canary's tiny-limit probe verifies the `.1` shift directly.
+4. **Test count 11, not 8**: degrade-not-crash split into its own test + a provider-attr pin test added; all 8 planned behaviors covered.
+5. **error truncation** `[:300]` confirmed consistent between wiring and dataclass docs.
+
+Process note (spec gate): deviations initially lived only in the implementer's report — appended here per the record-every-deviation contract.
+
+## Quality-gate discharges (general-182 NOT-approved → fixes)
+
+- **I1 rotation chain collapsed to 1 backup** — the guard tested the DESTINATION (`older.exists()`) and the range skipped the last slot; `.2`/`.3` could never be created. Fixed: guard on the SOURCE (`newer.exists()`), range covers `i = BACKUPS..1`. Empirically verified: 6 rotations at a tiny limit produce current + `.1` + `.2` + `.3`. Lesson (recorded): ring-buffer rotation via `os.replace` must guard on the source existing and cover the full range; canaries asserting only the first hop mask chain collapse.
+- **I2 escalated-run usage loss** — the transport is recreated per tier attempt, so per-transport cumulative counters fragment across attempts. Fixed with a run-level delta-folding accumulator keyed by transport id: each attempt folds `current − that transport's previous cumulative` into run-level sums (correct under cycling AND fresh-per-attempt transports). Discharge test `test_escalated_run_sums_usage_across_tiers`: 4-tier refusal escalation with two cycled transports → trace `model_calls == t1.usage + t2.usage` (per-transport reality), served/output likewise. int-guarded for Mock transports.
+- **I3 scope honesty (filed as follow-up)**: approval-resume turns, mid-assembly compaction calls, and 13+ raw-urllib side paths (night_mode, sleep_time, goal, growth_delta, witness, abstraction, elastic_cognition, model_connect, provider_registry, tiered_executor, persona_gate, memory_store embeddings) are untraced — tracked in a follow-up issue; the primary operator path is fully traced.
+- Minor-4 (docs gap) folded into the follow-up issue; minor-3 (rotation race) documented as acceptable; minor-5 (price_for hoist) included in the I2 rework.

plans/2026-09-05-structural-contract.md

@@ -0,0 +1,254 @@
+# Structural Contract Layer — henxels Adoption (#138)
+
+> **For agentic workers:** execution contract — FROZEN TESTS ARE THE SPEC. Implement verbatim; record every deviation in the plan tail. TDD red→green. Do not create/complete tasks; controller owns task state.
+
+**Gitea issue:** #138 (P1 — high, infrastructure). **Branch:** `structural-contract` off master `3bfa45b`.
+
+## Why
+
+Structure conventions live in the controller's memory, not the repo. henxels (`henxels.yaml` + AGENTS.md digest + `henxels check`) makes the repo's shape machine-checkable and agent-readable. Verified sandbox probe (2026-09-05): rules bite, custom statements work, exit codes red=1/green=0, `henxels check --all` is CI-gateable.
+
+**Research basis (inward + outward):**
+- Inward census: 60 test files (unit-tests job runs whole dir — CI-completeness gap for tests is CLOSED; the explicit-list gap lives in the CANARY job: 4 of 15 canaries unregistered — canary_query_memory + canary_unbounded pass standalone, canary_full_system + canary_native needed host sqlite_vec install, now present); tui_validator.py import-allowlist drifted from rune_tui.py's `import rune` (44cba5c added it without updating the validator) — 2 live false-failures in canary_native.
+- Outward: henxels v0.12.0 MIT, actively maintained, dogfooded; forge-agnostic (survives Forgejo port); empty-contract trap fixed upstream with executable-example tests.
+- henxels trap (sandbox-proven): custom statements REQUIRE `in:` scope or they never fire.
+
+## Constraints from research
+
+1. CI canary-venv installs deps via manifest `[dev,memory]` — henxels runs as a uv tool there (install step: `uv tool install henxels` or `pip install henxels` into the lint venv; choose pip-into-venv for reproducibility).
+2. Contract must be GREEN AT BIRTH on current tree (enforced rules encode current reality; warn-level rules document debt) — findings become the migration plan, per henxels' governing-an-existing-repo mode.
+3. No git hooks (subagents commit in worktrees) — CI-only enforcement.
+4. tui_validator drift is a SEPARATE bug (file #139) — do NOT fix here; the contract's canary-registration rule covers the CI half only.
+
+## Task 1 — henxels_checks.py + frozen tests (TDD)
+
+`henxels_checks.py` at repo root:
+
+```python
+from pathlib import Path
+
+from henxels import statement
+
+
+@statement("ci_runs_all_canaries", help="every src/rune/canary_*.py is listed in .gitea/workflows/ci.yml")
+def ci_runs_all_canaries(param, file, root):
+    if not file.startswith("src/rune/canary_"):
+        return None
+    ci = root / ".gitea" / "workflows" / "ci.yml"
+    if not ci.exists():
+        return f"{file} is missing from .gitea/workflows/ci.yml (no ci.yml found)"
+    if Path(file).name in ci.read_text():
+        return None
+    return f"{file} is missing from .gitea/workflows/ci.yml — register it in the canary job's for-loop list"
+```
+
+`tests/test_henxels_contract.py` — frozen tests:
+
+```python
+"""Frozen tests for the structural contract (#138).
+
+Proves the custom statement bites (red-green) and the contract is
+well-formed (non-empty, every statement real, nothing inert).
+"""
+import subprocess
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+
+
+def _check_all() -> subprocess.CompletedProcess:
+    return subprocess.run(
+        ["henxels", "check", "--all", "--plain"],
+        capture_output=True, text=True, cwd=REPO,
+    )
+
+
+def test_ci_runs_all_canaries_statement_bites(tmp_path):
+    """Unregistered canary name -> statement returns an instruction."""
+    from henxels_checks import ci_runs_all_canaries
+
+    verdict = ci_runs_all_canaries(
+        "src/rune/canary_unregistered_example.py", "src/rune/canary_unregistered_example.py", REPO
+    )
+    assert verdict is not None
+    assert "ci.yml" in verdict
+
+
+def test_ci_runs_all_canaries_accepts_registered():
+    from henxels_checks import ci_runs_all_canaries
+
+    assert ci_runs_all_canaries("src/rune/canary_schema_migration.py",
+                                "src/rune/canary_schema_migration.py", REPO) is None
+
+
+def test_ci_runs_all_canaries_ignores_non_canaries():
+    from henxels_checks import ci_runs_all_canaries
+
+    assert ci_runs_all_canaries("src/rune/rune_tui.py", "src/rune/rune_tui.py", REPO) is None
+
+
+def test_contract_is_nonempty_and_loads():
+    """The empty-contract trap: contract must hold real rules that actually enforce."""
+    cfg = (REPO / "henxels.yaml").read_text()
+    assert "henxels:" in cfg
+    assert cfg.count("henxel:") >= 5
+
+
+def test_every_canary_on_disk_is_registered_in_ci():
+    """Live-tree check: no canary left behind (the gap #138 closes)."""
+    canaries = sorted(p.name for p in (REPO / "src" / "rune").glob("canary_*.py"))
+    assert canaries, "no canaries found — glob broken?"
+    ci_text = (REPO / ".gitea" / "workflows" / "ci.yml").read_text()
+    missing = [c for c in canaries if c not in ci_text]
+    assert missing == [], f"canaries missing from CI: {missing}"
+```
+
+**RED:** tests 1-5 fail (henxels_checks.py missing / contract missing / 4 canaries unregistered).
+**GREEN after Task 2+3 complete.**
+
+## Task 2 — henxels.yaml contract
+
+At repo root. Enforced rules (green at birth — verified against census):
+
+```yaml
+settings:
+  warn_about_similar_files:
+    above: 0.85
+    ignore: ["docs/review-lessons.yaml", "docs/v1/**", "docs/wiki/**"]
+
+henxels:
+  - henxel: "Canaries live at the repo's canary slot and are registered in CI"
+    in: ./src/rune/canary_*.py
+    ci_runs_all_canaries: true
+
+  - henxel: "No secrets in tracked files"
+    no_secrets: true
+
+  - henxel: "Plans are markdown, one per build"
+    in: ./plans
+    allowed_filetypes: [.md]
+    filename_casing: kebab-case
+
+  - henxel: "Top-level docs are markdown or yaml references"
+    in: ./docs/*
+    allowed_filetypes: [.md, .yaml]
+    except: ["./docs/v1/**", "./docs/wiki/**"]
+
+  - henxel: "The known giant stays visible — file-size debt is tracked, not silent"
+    in: ./src/rune
+    except: ["./src/rune/rune_tui.py", "./src/rune/rune_operator.py", "./src/rune/local_tool_runtime.py"]
+    max_lines: 1200
+```
+
+Adjust `except:` lists to whatever the live check reports — retroactive findings get fixed (cheap) or explicitly listed (documented debt). Every deviation from the drafted rules must be recorded in the plan tail with the finding that forced it.
+
+## Task 3 — Retroactive application
+
+1. Run `henxels check --all --plain` against the live tree.
+2. Cheap findings (missing registration, casing): FIX in this commit.
+3. Known debt (rune_tui.py size): document via `except:` + a `docs/structural-contract.md` debt table (file, rule, finding, disposition).
+4. Register the 4 unregistered canaries in `.gitea/workflows/ci.yml`'s canary loop (query_memory, unbounded verified green standalone; full_system + native now pass with host sqlite_vec — CI venv already installs sqlite-vec).
+
+## Task 4 — CI step + docs + digest
+
+1. `.gitea/workflows/ci.yml` lint job gains a step after ruff:
+```yaml
+      - name: Structural contract (henxels)
+        run: |
+          .ci-venv/bin/pip install --disable-pip-version-check henxels
+          .ci-venv/bin/henxels check --all --plain
+```
+2. `henxels sync` to generate AGENTS.md digest; commit it (never gitignored).
+3. `docs/structural-contract.md`: what the contract governs, the debt table, how to add a rule, why no git hooks (worktree workflow).
+4. Canaries added to CI list must each run once locally green before commit.
+
+## Acceptance
+
+- `python3 -m pytest tests/test_henxels_contract.py -q` → 5 passed (red proven first).
+- Full suite: baseline 434+ (461 current) minus flaky-free — run `PYTHONPATH=src:. python3 -m pytest tests/ -q` and record count; zero regressions.
+- `henxels check --all --plain` exits 0 on the enforced contract.
+- CI canary loop covers all 15 canaries; `test_every_canary_on_disk_is_registered_in_ci` proves it structurally.
+- AGENTS.md digest committed; docs/structural-contract.md present.
+- ruff clean on new files.
+
+## Pipeline requirements checklist
+- [x] TDD red→green (planted unregistered-canary finding)
+- [x] ruff check + format on henxels_checks.py + tests
+- [ ] Spec gate PASS (independent)
+- [ ] Quality gate Approved (independent)
+- [x] Full-suite regression green
+- [x] henxels check --all green
+- [ ] Closed with formatted comment + refs
+
+## Tail — execution record & deviations (2026-09-05, issue #138 branch)
+
+TDD evidence: RED first — `tests/test_henxels_contract.py` 5 failed (3×
+`ModuleNotFoundError: No module named 'henxels_checks'`, 1× `FileNotFoundError:
+.../henxels.yaml`, 1× `canaries missing from CI: ['canary_full_system.py',
+'canary_native.py', 'canary_query_memory.py', 'canary_unbounded.py']`). GREEN
+after implementation: 5 passed. Full suite 461→466 passed (+84 subtests), zero
+regressions. `henxels check --all --plain` exit 0; all 15 canaries present in
+ci.yml.
+
+Deviations from the frozen spec (each forced by a live finding):
+
+1. **henxels.yaml `max_lines` except list extended 3→7 files.** Live check
+   findings: `src/rune/curator.py` (1597), `src/rune/memory_store.py` (2171),
+   `src/rune/tool_executor.py` (1523), `src/rune/warm_router.py` (1292) — all
+   over the 1200 budget, none in the drafted except list. Kept
+   `rune_tui.py`/`rune_operator.py`/`local_tool_runtime.py` as drafted
+   (local_tool_runtime is 506 lines: pre-emptive headroom, not a live finding;
+   kept to match the drafted spec). Debt table in docs/structural-contract.md.
+2. **henxels.yaml `no_secrets` gains `except: ["./tests/test_gitea_provision.py"]`.**
+   The drafted rule failed at birth: the secret-scanner flagged synthetic
+   fixture tokens (`plaintext-transport-test-secret` etc.) in the test that
+   exists precisely to prove tokens never leak. False positive → explicit
+   exception, not a rule change.
+3. **canary_native.py gained a 2-message known-false-failure tolerance.**
+   Environment facts said canary_native "prints 2 known-false failures but
+   exits 0"; on this tree it exited 1 — the canary counts every
+   `tui_validator.run_full_validation()` error as `failed` (no tolerance
+   mechanism exists, verified across host + CI-equivalent venv + several cwd /
+   PYTHONPATH / RUNE_SCRIPTS_DIR combinations). The acceptance criterion
+   (exit 0) can only hold if the canary itself stops counting exactly the two
+   allowlist-drift messages (`Import '__future__'` from 8126f1c, bare
+   `import rune` from 44cba5c). Implemented as content-matched strings, not a
+   count: both still PRINT (`⚠ TUI (known false-failure, #139): …`), any new
+   real TUI error still fails the canary, and tui_validator.py itself is
+   untouched (#139 stays open, separate bug).
+4. **pyproject.toml dev extra gained `henxels>=0.12.0`.** CI's unit-tests job
+   runs the whole `tests/` dir in `.test-venv`; the frozen tests import
+   `henxels_checks` → `from henxels import statement`, which needs the henxels
+   package importable in that venv. Manifest is the repo's dependency channel
+   (constraint #1 chose pip-into-venv for reproducibility). Also required on
+   the dev host for the tests to run at all (installed `--user` alongside the
+   uv-tool binary).
+5. **`henxels catalogue` only lists custom statements once a contract exists** —
+   discovery of `henxels_checks.py` runs after `find_contract`, so
+   `henxels_checks.py` must be committed together with `henxels.yaml` (they
+   were; ordering note for future repos adopting custom statements).
+6. **Pre-existing format drift in `src/rune/canary_native.py` left alone**
+   (ruff format would reformat it at HEAD too; CI format-checks only *added*
+   files, so this doesn't block). All *new* files ruff-clean.
+
+Note: transient false `No module named 'rune'` failures in canary_native
+(pins/event_bus) were an artifact of a local probe-venv install running
+concurrently; not reproducible on a quiet tree.
+
+## Quality-gate discharges (post general-169 Approved-with-minors)
+
+- **I1 subdir canary blindspot** — contract scope `./src/rune/canary_*.py` → `./src/rune/**/canary_*.py`; statement guard now `startswith("src/rune/") and name.startswith("canary_")` + `.py` suffix; frozen test `rglob` + new `test_ci_runs_all_canaries_bites_in_subdirectories` + `test_contract_scope_matches_nested_canaries` (henxels glob semantics pinned: `*` never crosses `/`, `**` does). Red-green: unregistering a canary → exit 1 with instruction; restored → exit 0.
+- **I2 tolerance unpinned** — `test_canary_native_tolerance_is_content_matched` freezes both directions (known false-failures tolerated; `rune_tui_helper`/`os`/widget errors NOT matched — closing-apostrophe anchor verified). Removal of the tolerance + validator fix belongs to #139.
+- **I3 unpinned + redundant CI install** — pyproject `henxels>=0.12.0` → `henxels==0.12.0` (ruff-pinning precedent); redundant `pip install henxels` line deleted from ci.yml lint step ([dev] extra already installs the pinned tool).
+- **I4 digest drift** — `test_agents_md_digest_is_in_sync` renders the digest via `henxels.contract`/`henxels.digest` and asserts containment in AGENTS.md. Red-green proven: contract edit without sync → FAILED; `henxels sync` → green. (This is the umbrella rule made mechanical: contract updated → digest updated.)
+- **I5 non-recursive max_lines** — `in: ./src/rune` → `./src/rune/*` (trailing `/*` = recursive per henxels locations semantics); verified green at birth (largest subdir file 450 < 1200).
+- **Minor 13** — dead allowance `local_tool_runtime.py` (506 < 1200) dropped from the max_lines excepts; ratchet honest.
+- Accepted minors (documented, no action): 6 (whole-file no_secrets except — only granularity available), 7 (fail-closed confusing message — upstream), 8 (substring registration — explicit loop mitigates), 9 (cosmetic accounting), 10 (string-count test — CI check covers unknown-statement), 11 (PYTHONPATH foot-gun — CI sets it; conftest shim deferred), 12 (inert default restated).
+
+## CI-observed fix (post PR #140 lint failure)
+
+henxels' no_secrets scan tripped on `.ci-venv/lib/.../textual/css/tokenize.py` — the venv CI creates *before* the check step runs (created-then-scanned ordering; invisible locally where no venv exists). Contract fix: excepts for `.ci-venv/**`, `.test-venv/**`, `.canary-venv/**` (CI-created venvs) and `backups/**` (snapshot copies, duplicates-warning noise). Digest re-synced. Lesson: CI-observed failures are research — the local tree cannot see every environment the contract runs in.
+
+## CI-observed fix 2 (post PR #140 canary failure)
+
+canary_full_system check 12 required `~/.mimocode/agents/rune.md` — host state, invisible while the canary was unregistered in CI (the very gap this stage closed surfaced it on first CI run). Fix: missing agent definition now prints a skip marker (⚠ host-state) instead of failing; all 6 content checks still run when the file exists (verified: host 28 passed; simulated-CI 22 passed, exit 0). Lesson repeated: registering canaries in CI converts silent host-dependencies into observed failures — that is the contract working.

pyproject.toml

@@ -1,35 +1,37 @@
-# Ruff — fast Python linter + formatter
-# Focus on catching real bugs, not style nags
-# Run: ruff check src/rune/ --fix
+[build-system]
+requires = ["setuptools>=68.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "rune"
+version = "0.49.0"
+description = "Rune — a stateful coding assistant with persistent memory, orchestration, and TUI"
+requires-python = ">=3.10"
+
+dependencies = [
+    "textual>=8.2.0",
+    "textual-autocomplete>=4.0.0",
+    "rich>=13.0.0",
+    "httpx>=0.27.0",
+    "aiohttp>=3.9.0",
+    "websockets>=12.0",
+    "psutil>=5.9.0",
+    "pyyaml>=6.0",
+]
+
+[project.optional-dependencies]
+memory = ["sqlite-vec>=0.1.0"]
+dev = ["pytest>=8.0", "pytest-subtests", "ruff==0.16.5", "pyright", "henxels==0.12.0"]
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+
+[tool.ruff]
+target-version = "py310"
+line-length = 120
 
 [tool.ruff.lint]
-# Rules that catch real bugs
-select = [
-    "F",    # pyflakes (unused imports, undefined names, unreachable code)
-    "E",    # pycodestyle errors (syntax issues)
-    "W",    # pycodestyle warnings
-    "B",    # flake8-bugbear (common bugs)
-    "SIM",  # flake8-simplify
-    "RUF",  # ruff-specific rules
-]
-
-# Don't flag style issues or missing annotations (pyright handles)
-ignore = [
-    "E501",   # line too long
-    "B008",   # function call in default argument (Textual pattern)
-    "SIM108", # ternary operator preference
-    "RUF012", # mutable class attributes (Textual uses these)
-    "SIM103", # needless bool (readability)
-    "SIM115", # open-file-with-context-handler (not always applicable)
-]
-
-# Auto-fixable rules
-fixable = ["F", "E", "W", "B", "SIM", "RUF"]
-
-[tool.ruff.lint.per-file-ignores]
-"**/test_*.py" = ["B", "SIM"]
-"**/skills/**/*.py" = ["E501"]
-
-[tool.ruff.format]
-quote-style = "double"
-indent-style = "space"
+select = ["E9", "F63", "F7", "F82"]

pyright-baseline.json

@@ -0,0 +1,5 @@
+{
+  "errorCount": 120,
+  "warningCount": 465,
+  "informationCount": 0
+}

scripts/type_check_ratchet.py

@@ -0,0 +1,55 @@
+#!/usr/bin/env python3
+"""Pyright ratchet: fail if type errors or warnings exceed the baseline.
+
+The baseline (pyright-baseline.json) is committed and can only decrease.
+New code must be type-clean; existing code improves as debt is paid down.
+"""
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+BASELINE_FILE = ROOT / "pyright-baseline.json"
+
+
+def main() -> int:
+    baseline = json.loads(BASELINE_FILE.read_text())
+    base_e = baseline["errorCount"]
+    base_w = baseline["warningCount"]
+
+    # Use the pyright binary from the venv (it's a Node.js wrapper; -m may
+    # not work on all platforms). Fall back to sys.executable -m.
+    pyright_bin = Path(sys.executable).parent / "pyright"
+    cmd = [str(pyright_bin)] if pyright_bin.is_file() else [sys.executable, "-m", "pyright"]
+    result = subprocess.run(
+        cmd + [str(ROOT / "src" / "rune"), "--outputjson"],
+        capture_output=True,
+        text=True,
+        timeout=600,
+        cwd=str(ROOT),
+    )
+    data = json.loads(result.stdout)
+    summary = data.get("summary", {})
+    cur_e = summary.get("errorCount", 0)
+    cur_w = summary.get("warningCount", 0)
+
+    print(f"pyright ratchet: errors {cur_e} (baseline {base_e}), warnings {cur_w} (baseline {base_w})")
+
+    failed = False
+    if cur_e > base_e:
+        print(f"::error::Type errors increased: {base_e} -> {cur_e} (max {base_e})")
+        failed = True
+    if cur_w > base_w:
+        print(f"::error::Type warnings increased: {base_w} -> {cur_w} (max {base_w})")
+        failed = True
+
+    if failed:
+        return 1
+    print("Type-check ratchet: PASS")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

src/rune/__init__.py

@@ -3,4 +3,4 @@
 This is the main entry point for the Rune program.
 """
 
-__version__ = "0.49.0"
+__version__ = "0.50.0"

src/rune/attention_capsule.py

@@ -16,7 +16,10 @@ import os
 import sys
 import re
 from dataclasses import dataclass, field
-from typing import List
+from typing import TYPE_CHECKING, List
+
+if TYPE_CHECKING:  # pragma: no cover - import cycle guard only
+    from rune.context_broker import ContributionBlock
 
 _SD = os.path.dirname(os.path.abspath(__file__))
 if _SD not in sys.path:
@@ -35,6 +38,13 @@ class AttentionCapsule:
     recent_correction: str = ""
     critical_assumptions: List[str] = field(default_factory=list)
     token_count: int = 0
+    # ContextBroker extension (P0-03 #19) — additive only; legacy fields
+    # above are untouched. `blocks` is the admitted ContributionBlock
+    # ledger (objects with name/priority/tokens/source/evictable);
+    # to_messages() re-derives the runtime message list from it, so
+    # in-place mutation of a block (e.g. the safety override decorating
+    # the final user message) always flows through.
+    blocks: List["ContributionBlock"] = field(default_factory=list)
 
     def to_dict(self):
         return {
@@ -47,8 +57,38 @@ class AttentionCapsule:
             "recent_correction": self.recent_correction,
             "critical_assumptions": self.critical_assumptions,
             "token_count": self.token_count,
+            "blocks": [block.to_dict() if hasattr(block, "to_dict") else block for block in self.blocks],
         }
 
+    def to_messages(self, system_preamble: str = "") -> List[dict]:
+        """Render as chat messages exactly as LocalToolRuntime.run consumes.
+
+        Shape: [{system?}, *history, {user?}] — string blocks fold into the
+        system message (after the optional preamble) in block order, list
+        blocks render as history messages, and the block named "user"
+        renders as the final user message. Re-derived on every call.
+        """
+        system_parts = [system_preamble] if system_preamble else []
+        history: List[dict] = []
+        user_content = ""
+        for block in self.blocks:
+            name = getattr(block, "name", "")
+            content = getattr(block, "content", "")
+            if isinstance(content, list):
+                history.extend(dict(message) for message in content)
+            elif name == "user":
+                user_content = content
+            elif isinstance(content, str) and content:
+                system_parts.append(content)
+        messages: List[dict] = []
+        system_text = "\n".join(system_parts)
+        if system_text:
+            messages.append({"role": "system", "content": system_text})
+        messages.extend(history)
+        if user_content:
+            messages.append({"role": "user", "content": user_content})
+        return messages
+
     def to_prompt(self) -> str:
         """Convert capsule to prompt text."""
         parts = []

src/rune/canary_context_broker.py

@@ -0,0 +1,199 @@
+#!/usr/bin/env python3
+"""Context-broker canary: admission, fail-loud, absence proof, compaction.
+
+Self-bootstrapping like canary_schema_migration.py (CI runs
+``python3 <canary>`` without PYTHONPATH). Proves the P0-03 (#19)
+structural contracts end to end:
+
+1. assemble with a small budget drops low-priority evictable blocks
+   while mandatory (non-evictable) blocks always survive — trace shows
+   both the drop and the admission with token counts;
+2. a single mandatory block over the whole budget raises
+   ContextOverflowError (never silently truncated);
+3. RUNE_MEMORY_OFF=1 zeroes every memory contributor — the trace PROVES
+   0 memory tokens (absence test);
+4. compaction archives the RAW history externally BEFORE compressing,
+   keeps the last 5 turns verbatim, and embeds the rolling summary.
+
+No network, no Ollama, no memory DBs — CI-safe by construction.
+Prints 'CONTEXT BROKER CANARY PASSED' and exits 0.
+"""
+
+import os
+import sys
+import tempfile
+from pathlib import Path
+
+# Self-bootstrap: CI runs `python3 <canary>` without PYTHONPATH, so put the
+# repository src/ on sys.path before importing rune modules.
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+
+from rune.context_broker import (  # noqa: E402
+    ContributionBlock,
+    ContextBroker,
+    ContextOverflowError,
+    compact_history,
+    memory_disabled,
+)
+
+
+def _fail(message: str) -> int:
+    print(f"FAILED: {message}", file=sys.stderr)
+    return 1
+
+
+def check_admission_drops_low_priority_keeps_mandatory() -> int:
+    broker = ContextBroker()
+    broker.register_contributor(
+        "persona",
+        lambda task, session: ContributionBlock("persona", 100, "I am Rune.", 0, "canary", evictable=False),
+        0,
+    )
+    broker.register_contributor(
+        "memory",
+        lambda task, session: ContributionBlock("memory", 70, "x" * 400, 0, "canary", evictable=True),
+        2,
+    )
+    broker.register_contributor(
+        "user",
+        lambda task, session: ContributionBlock("user", 100, "task text", 0, "canary", evictable=False),
+        4,
+    )
+    capsule, trace = broker.assemble(object(), None, budget_tokens=30)
+
+    if "memory" not in [d["name"] for d in trace["dropped"]]:
+        return _fail("low-priority memory block was not dropped over budget")
+    if trace["dropped"][0]["tokens"] != 100:
+        return _fail("dropped block token count missing from the ledger")
+    if not {"persona", "user"} <= set(trace["admitted"]):
+        return _fail(f"mandatory blocks dropped: {trace['admitted']}")
+    if trace["admitted_total"] > 30:
+        return _fail("admitted total exceeds the budget")
+    messages = capsule.to_messages()
+    if [m["role"] for m in messages] != ["system", "user"]:
+        return _fail(f"rendered roles wrong: {[m['role'] for m in messages]}")
+    if "I am Rune." not in messages[0]["content"]:
+        return _fail("persona content missing from the system message")
+    return 0
+
+
+def check_single_over_budget_block_fails_loud() -> int:
+    broker = ContextBroker()
+    broker.register_contributor(
+        "user",
+        lambda task, session: ContributionBlock("user", 100, "y" * 400, 0, "canary", evictable=False),
+        4,
+    )
+    try:
+        broker.assemble(object(), None, budget_tokens=10)
+    except ContextOverflowError:
+        return 0
+    return _fail("single over-budget mandatory block did not raise ContextOverflowError")
+
+
+def check_memory_off_proves_zero_memory_tokens() -> int:
+    previous = os.environ.get("RUNE_MEMORY_OFF")
+    os.environ["RUNE_MEMORY_OFF"] = "1"
+    try:
+        if not memory_disabled():
+            return _fail("RUNE_MEMORY_OFF=1 did not engage the memory-off gate")
+
+        def gated_memory(task, session):
+            if memory_disabled():
+                return None
+            return ContributionBlock("memory", 70, "should never appear", 0, "canary")
+
+        def gated_persona_memories(task, session):
+            if memory_disabled():
+                return None
+            return ContributionBlock("persona_memories", 68, "should never appear", 0, "canary")
+
+        def gated_consolidated(task, session):
+            if memory_disabled():
+                return None
+            return ContributionBlock("consolidated", 60, "should never appear", 0, "canary")
+
+        broker = ContextBroker()
+        broker.register_contributor("memory", gated_memory, 2)
+        broker.register_contributor("persona_memories", gated_persona_memories, 2)
+        broker.register_contributor("consolidated", gated_consolidated, 2)
+        broker.register_contributor(
+            "user",
+            lambda task, session: ContributionBlock("user", 100, "task text", 0, "canary", evictable=False),
+            4,
+        )
+        capsule, trace = broker.assemble(object(), None, budget_tokens=10_000)
+        if trace["memory_tokens"] != 0:
+            return _fail(f"memory-off trace shows {trace['memory_tokens']} memory tokens")
+        if any(block.name == "memory" for block in capsule.blocks):
+            return _fail("memory block present in the capsule despite the gate")
+    finally:
+        if previous is None:
+            os.environ.pop("RUNE_MEMORY_OFF", None)
+        else:
+            os.environ["RUNE_MEMORY_OFF"] = previous
+    return 0
+
+
+def check_compaction_archives_raw_and_keeps_last5() -> int:
+    with tempfile.TemporaryDirectory() as td:
+        archive = Path(td) / "state" / "history_archive.jsonl"
+        messages = []
+        for index in range(8):
+            messages.append({"role": "user", "content": f"question {index} " + "w" * 1000})
+            messages.append({"role": "assistant", "content": f"answer {index} " + "w" * 1000})
+
+        def summarizer(older):
+            return (
+                "Session intent: canary\n"
+                "Decisions: admission is deterministic\n"
+                "Open items: none\n"
+                "Next steps: keep the canary green"
+            )
+
+        compacted, event = compact_history(
+            messages,
+            window=2048,
+            archive_path=archive,
+            summarizer=summarizer,
+            source="canary",
+            session_id="canary-session",
+        )
+
+        if not event["triggered"]:
+            return _fail("compaction did not trigger above the 80% threshold")
+        if not archive.exists():
+            return _fail("raw history was not archived before compression")
+        import json
+
+        raw = json.loads(archive.read_text(encoding="utf-8").splitlines()[0])
+        if raw["messages"] != messages:
+            return _fail("archived raw history does not match the input verbatim")
+        if len(compacted) != 11:
+            return _fail(f"expected summary + last 5 turns (11), got {len(compacted)}")
+        if compacted[1:] != messages[-10:]:
+            return _fail("last 5 turns are not kept verbatim")
+        if "Session intent: canary" not in compacted[0]["content"]:
+            return _fail("rolling summary missing from the compacted history")
+        if event["tokens_after"] >= event["tokens_before"]:
+            return _fail("compaction did not reduce the token footprint")
+    return 0
+
+
+def main() -> int:
+    checks = (
+        check_admission_drops_low_priority_keeps_mandatory,
+        check_single_over_budget_block_fails_loud,
+        check_memory_off_proves_zero_memory_tokens,
+        check_compaction_archives_raw_and_keeps_last5,
+    )
+    for check in checks:
+        result = check()
+        if result != 0:
+            return result
+    print("CONTEXT BROKER CANARY PASSED")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

src/rune/canary_conversation_state.py

@@ -0,0 +1,115 @@
+#!/usr/bin/env python3
+"""Conversation-state canary: canonical task + message ledgers stay alive.
+
+Exercises the full #18 spine end to end: single-authority composition,
+create/amend/transition/get_active, append/window/messages_for_task/
+latest_task, restart recovery from hot checkpoints, and the legacy
+operator.json migration.
+"""
+
+import json
+import sys
+import tempfile
+from pathlib import Path
+
+# Self-bootstrap: CI runs `python3 <canary>` without PYTHONPATH, so put the
+# repository src/ on sys.path before importing rune.orchestration.
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+
+from rune.orchestration.composition import build_conversation_state
+from rune.orchestration.conversation_state import (
+    ConversationMessageRecord,
+    migrate_operator_tasks,
+)
+
+
+def _fail(reason: str) -> int:
+    print(f"CONVERSATION STATE CANARY FAILED: {reason}", file=sys.stderr)
+    return 1
+
+
+def main() -> int:
+    with tempfile.TemporaryDirectory() as td:
+        root = Path(td)
+        paths = {
+            "events": root / "events.jsonl",
+            "evidence": root / "evidence",
+            "state": root / "state",
+        }
+        comp = build_conversation_state(paths)
+        comp.assert_single_authority()
+        tasks = comp.get("task_state")
+        conv = comp.get("conversation_state")
+
+        # Task spine: create -> running -> amend (same identity) -> completed.
+        task = tasks.create("canary fix", "task", model="qwen3:8b")
+        tasks.transition(task.task_id, "running")
+        amended = tasks.amend(task.task_id, "canary fix (follow-up)")
+        if amended.task_id != task.task_id:
+            return _fail("amend changed task identity")
+        if tasks.get_active("task") is None:
+            return _fail("no active task while running")
+        tasks.transition(task.task_id, "completed")
+        if tasks.get_active("task") is not None:
+            return _fail("terminal task still active")
+
+        # Conversation ledger: append + window + per-task history.
+        conv.append(ConversationMessageRecord(role="user", content="hi", channel_id="task", task_id=task.task_id))
+        conv.append(
+            ConversationMessageRecord(
+                role="assistant",
+                content="hello",
+                channel_id="task",
+                task_id=task.task_id,
+            )
+        )
+        if len(conv.window("task", n=8)) != 2:
+            return _fail("conversation window lost messages")
+        if len(conv.messages_for_task(task.task_id)) != 2:
+            return _fail("messages_for_task lost history")
+        if conv.latest_task("task") is None:
+            return _fail("latest_task returned nothing")
+
+        # Restart: hot checkpoints must restore both ledgers.
+        comp2 = build_conversation_state(paths)
+        comp2.assert_single_authority()
+        if comp2.get("task_state").get(task.task_id) is None:
+            return _fail("task ledger did not survive restart")
+        if len(comp2.get("conversation_state").window("task", n=8)) != 2:
+            return _fail("conversation ledger did not survive restart")
+
+        # Legacy migration: original ids preserved, history reconstructed.
+        legacy = root / "operator.json"
+        legacy.write_text(
+            json.dumps(
+                {
+                    "tasks": [
+                        {
+                            "task_id": "legacy1",
+                            "description": "old task",
+                            "status": "completed",
+                            "assigned_model": "qwen2.5:7b",
+                            "result": "done",
+                            "created_at": "2026-08-22T00:00:00+00:00",
+                            "completed_at": "2026-08-22T00:01:00+00:00",
+                        }
+                    ]
+                }
+            )
+        )
+        report = migrate_operator_tasks(legacy, comp2.get("task_state"), comp2.get("conversation_state"))
+        if report.imported != 1:
+            return _fail(f"legacy migration imported {report.imported} tasks")
+        again = migrate_operator_tasks(legacy, comp2.get("task_state"))
+        if again.imported != 0 or again.skipped != 1:
+            return _fail("legacy migration is not idempotent")
+
+        print(
+            "CONVERSATION STATE CANARY PASSED",
+            json.dumps({"tasks": 2, "messages": 4, "imported": report.imported}),
+        )
+        return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

src/rune/canary_full_system.py

@@ -202,7 +202,11 @@ def main():
         test("agent has subconscious", "subconscious" in agent.lower())
         test("agent has progressive loading", "progressive" in agent.lower())
     else:
-        test("agent definition found", False, "no agent definition found")
+        # Host-state, not repo contract: the agent definition lives in the
+        # operator's home dir (~/.mimocode/agents/rune.md) and legitimately
+        # does not exist in a clean CI environment. Skip, don't fail —
+        # registering this canary in CI (#138) surfaced the dependency.
+        print("  ⚠ agent definition not present (host-state, skipped in CI) — #138")
 
     db.close()
 

src/rune/canary_gitea_automation.py

@@ -252,11 +252,16 @@ def main() -> int:
     )
     check(
         "Rune minor version advertises provisioning and restore verification",
-        '__version__ = "0.49.0"' in rune_version,
+        '__version__ = "0.50.0"' in rune_version,
         failures,
     )
+    # #169 policy update: auto-bump on merge is sanctioned (Nick directive:
+    # bumping is automatic from the Gitea end). The push must be an explicit,
+    # visible auto-bump commit — not a hidden rewrite.
     check(
-        "release automation cannot push master", "git push" not in versioning, failures
+        "release automation push is the sanctioned auto-bump only",
+        "git push" not in versioning or "auto-bump version to" in versioning,
+        failures,
     )
     check(
         "release API URL comes from Gitea context",

src/rune/canary_gitea_pipeline.py

@@ -56,23 +56,21 @@ def main() -> int:
     check("checks the complete push or PR range", "GITHUB_EVENT_PATH" in text, failures)
     check("isolates stateful canaries from host data", "RUNE_HOME:" in text, failures)
     check(
-        "runs focused local-tool and interstitial-message tests",
+        "runs full test suite via auto-discovery",
         "unit-tests:" in text
-        and "tests/test_local_tool_runtime.py" in text
-        and "tests/test_runtime_architecture_characterization.py" in text
-        and "tests/test_build_pipeline_policy.py" in text,
+        and "pytest tests/" in text,
         failures,
     )
-    referenced_tests = set(re.findall(r"tests/test_[a-z0-9_]+\.py", text))
+    # Full-suite auto-discovery: no explicit paths to validate.
+    # Instead, verify the manifest exists (it defines the test environment).
     check(
-        "every configured unit-test path exists",
-        bool(referenced_tests)
-        and all((ROOT / path).is_file() for path in referenced_tests),
+        "project dependency manifest exists",
+        (ROOT / "pyproject.toml").is_file(),
         failures,
     )
     check(
         "runs Rune v1 authority-map admission contracts",
-        "tests/test_v1_authority_map.py" in text,
+        (ROOT / "tests" / "test_v1_authority_map.py").is_file(),
         failures,
     )
     pr_template = PR_TEMPLATE.read_text(encoding="utf-8")

src/rune/canary_native.py

@@ -177,13 +177,20 @@ def main():
     try:
         import tui_validator
         css_errors = tui_validator.run_full_validation()
-        if css_errors:
-            for err in css_errors:
+        # Known false-failures: tui_validator's import allowlist drifted from
+        # rune_tui.py — `from __future__ import annotations` (8126f1c) and bare
+        # `import rune` (44cba5c) are both legitimate. Tolerated here until the
+        # validator's allowlist is fixed (Gitea issue #139); anything else counts.
+        known_false_failures = ("Import '__future__'", "Import 'rune'")
+        for err in css_errors:
+            if any(k in err for k in known_false_failures):
+                print(f"  ⚠ TUI (known false-failure, #139): {err}")
+            else:
                 print(f"  ✗ TUI: {err}")
-            failed += len(css_errors)
-        else:
-            if verbose:
-                print("  ✓ TUI CSS validation passed")
+                failed += 1
+        if not css_errors and verbose:
+            print("  ✓ TUI CSS validation passed")
+        if css_errors and not verbose:
             passed += 1
     except ImportError:
         print("  ⚠ TUI validator module not found (skipped)")

src/rune/canary_p0_04.py

@@ -0,0 +1,207 @@
+#!/usr/bin/env python3
+"""P0-04 pipeline-removal canary (#20).
+
+Self-bootstrapping like canary_schema_migration.py (CI runs
+``python3 <canary>`` without PYTHONPATH). Proves the per-turn cognitive
+pipeline is GONE while every capability stays reachable:
+
+1. ``RuneApp._run_warm_router`` is a documented no-op — calling it does not
+   touch warm_router / witness / drift_ledger / sleep_time /
+   capability_broker / memory_store;
+2. the pre-message dispatch is gone — ``_send_to_model`` contains no
+   auto_context/auto_tasks/behavior calls and goes straight to the operator;
+3. all 21 former subsystem modules import cleanly;
+4. /commands remain available on demand (functionality immutable);
+5. the model-facing ContextBroker path (#19) is intact — assemble admits
+   mandatory blocks, and the operator owns a lazily-built broker.
+
+No network, no Ollama, no TUI runtime — CI-safe by construction.
+Prints 'P0-04 PIPELINE REMOVAL CANARY PASSED' and exits 0.
+"""
+
+import inspect
+import os
+import sys
+import tempfile
+from pathlib import Path
+from unittest.mock import patch
+
+# Self-bootstrap: CI runs `python3 <canary>` without PYTHONPATH, so put the
+# repository src/ on sys.path before importing rune modules. Isolate Rune's
+# memory/journal paths so the canary never touches a real home directory.
+_repo_src = str(Path(__file__).resolve().parents[1])
+sys.path.insert(0, _repo_src)
+_canary_home = tempfile.mkdtemp(prefix="p0-04-canary-home-")
+os.environ.setdefault("RUNE_HOME", _canary_home)
+os.environ.setdefault("RUNE_MEMORY_DIR", tempfile.mkdtemp(prefix="p0-04-canary-mem-"))
+
+from rune import rune_tui  # noqa: E402
+from rune.rune_tui import RuneApp  # noqa: E402
+
+
+def _fail(message: str) -> int:
+    print(f"FAILED: {message}", file=sys.stderr)
+    return 1
+
+
+def check_pipeline_is_noop() -> int:
+    app = RuneApp()
+    import drift_ledger
+    import sleep_time
+    import warm_router
+    import capability_broker
+    import memory_store
+    import witness
+
+    with (
+        patch.object(warm_router, "route") as wr,
+        patch.object(witness, "detect_signals") as ws,
+        patch.object(drift_ledger, "check") as dl,
+        patch.object(sleep_time, "consolidate") as st,
+        patch.object(capability_broker, "match_capabilities") as cb,
+        patch.object(memory_store, "cached_recall") as mr,
+    ):
+        app._run_warm_router("hi", channel="task")
+        if wr.called or ws.called or dl.called or st.called or cb.called or mr.called:
+            return _fail("the per-turn pipeline still runs on ordinary messages")
+    if app._run_warm_router("anything", channel="task") is not None:
+        return _fail("_run_warm_router must be a None-returning no-op")
+    return 0
+
+
+def check_pre_dispatch_removed() -> int:
+    src = inspect.getsource(RuneApp._send_to_model)
+    for banned in ("build_auto_context", "extract_tasks", "match_context"):
+        if banned in src:
+            return _fail(f"pre-dispatch call {banned} still present in _send_to_model")
+    if "send_task" not in src:
+        return _fail("the operator call (send_task) is missing from _send_to_model")
+    dispatch = inspect.getsource(RuneApp.on_input_submitted)
+    if "_warm_router_thread" in dispatch:
+        return _fail("the warm-router thread spawn is still wired in the dispatch")
+    for banned in ("build_auto_context", "extract_tasks", "match_context"):
+        if banned in dispatch:
+            return _fail(f"pre-dispatch parallel block still present: {banned}")
+    # I-3 (general-176): inspect the no-op shim's body too — a regression
+    # re-adding pipeline steps inside _run_warm_router would otherwise pass
+    # every check (the mock sentinels cover only 6 of the 21 former steps).
+    body = inspect.getsource(RuneApp._run_warm_router)
+    banned_ids = (
+        "warm_router.route",
+        "capability_broker.match",
+        "memory_store.connect",
+        "witness.detect_signals",
+        "drift_ledger.check",
+        "sleep_time.consolidate",
+        "run_parallel",
+        "prompt_sync",
+        "abstraction.connect",
+        "graph_memory.resolve",
+        "time_awareness.get_time_context",
+        "event_bus.emit",
+    )
+    for banned in banned_ids:
+        if banned in body:
+            return _fail(f"pipeline step {banned} re-added inside _run_warm_router")
+    return 0
+
+
+def check_subsystems_import() -> int:
+    modules = (
+        "warm_router",
+        "capability_broker",
+        "memory_store",
+        "witness",
+        "cache",
+        "prompt_sync",
+        "abstraction",
+        "graph_memory",
+        "context_pressure",
+        "event_bus",
+        "task_persist",
+        "time_awareness",
+        "warm_neuron_store",
+        "hook_engine",
+        "voice_hybrid",
+        "sleep_time",
+        "drift_ledger",
+        "auto_context",
+        "auto_tasks",
+        "behavior",
+        "night_mode",
+    )
+    for name in modules:
+        if __import__(name) is None:
+            return _fail(f"subsystem {name} did not import")
+        if f"src/rune/{name}.py" not in sys.modules[name].__file__.replace(os.sep, "/"):
+            return _fail(f"subsystem {name} resolved outside the repository")
+    return 0
+
+
+def check_commands_remain() -> int:
+    app = RuneApp()
+    for cmd in (
+        "_cmd_drift",
+        "_cmd_pressure",
+        "_cmd_events",
+        "_cmd_health",
+        "_cmd_neurons",
+        "_cmd_graph",
+        "_cmd_sleep",
+        "_cmd_hooks",
+        "_cmd_voice",
+    ):
+        if not hasattr(app, cmd):
+            return _fail(f"{cmd} removed — functionality must be immutable")
+    if not hasattr(sleep_time_module(), "consolidate"):
+        return _fail("sleep_time.consolidate (on-demand trigger) missing")
+    return 0
+
+
+def sleep_time_module():
+    import sleep_time
+
+    return sleep_time
+
+
+def check_broker_path_intact() -> int:
+    from rune.context_broker import ContributionBlock, ContextBroker
+
+    broker = ContextBroker()
+    broker.register_contributor(
+        "user",
+        lambda task, session: ContributionBlock("user", 100, "task text", 0, "canary", evictable=False),
+        4,
+    )
+    capsule, trace = broker.assemble(object(), None, budget_tokens=10_000)
+    if [b.name for b in capsule.blocks] != ["user"]:
+        return _fail(f"broker admission broken: {trace}")
+    operator_src = inspect.getsource(RuneApp._send_to_model)
+    if "send_task" not in operator_src:
+        return _fail("operator path detached from the TUI send flow")
+    import rune_operator
+
+    if not hasattr(rune_operator.RuneOperator, "_context_broker"):
+        return _fail("operator no longer owns the ContextBroker assembly")
+    return 0
+
+
+def main() -> int:
+    checks = (
+        ("pipeline no-op", check_pipeline_is_noop),
+        ("pre-dispatch removed", check_pre_dispatch_removed),
+        ("21 subsystems import", check_subsystems_import),
+        ("/commands on demand", check_commands_remain),
+        ("broker path intact", check_broker_path_intact),
+    )
+    for label, check in checks:
+        result = check()
+        if result != 0:
+            return result
+        print(f"  ✓ {label}")
+    print("P0-04 PIPELINE REMOVAL CANARY PASSED")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

src/rune/canary_p0_05.py

@@ -0,0 +1,199 @@
+#!/usr/bin/env python3
+"""P0-05 native-tools canary (#21).
+
+Self-bootstrapping like canary_p0_04.py (CI runs ``python3 <canary>``
+without PYTHONPATH). Proves the #21 gap-closure claims are machine-checked
+with NO live model, NO Ollama, NO network:
+
+1. the consecutive-identical-failure circuit breaker trips on a scripted
+   loop (two identical failing read_file calls → typed failure mentioning
+   "consecutive", before the 8-iteration budget burns) and its message
+   shape is pinned in LocalToolRuntime._run_loop's source;
+2. every loop response carries the budget fields (iterations_used /
+   iteration_budget) on a scripted 2-call conversation;
+3. sandbox write-denial errors name the allowed write directories
+   (one-step self-correction contract);
+4. max_iterations is still enforced on the scripted seam (8 distinct
+   calls → "iteration limit" failure, used == budget);
+5. the operator's tools block carries usage guidance (never fabricate /
+   read before editing).
+
+Prints 'P0-05 NATIVE TOOLS CANARY PASSED' and exits 0.
+"""
+
+import inspect
+import os
+import sys
+import tempfile
+from pathlib import Path
+
+# Self-bootstrap: CI runs `python3 <canary>` without PYTHONPATH, so put the
+# repository src/ on sys.path before importing rune modules. Isolate Rune's
+# memory/journal paths so the canary never touches a real home directory.
+_repo_src = str(Path(__file__).resolve().parents[1])
+sys.path.insert(0, _repo_src)
+_canary_home = tempfile.mkdtemp(prefix="p0-05-canary-home-")
+os.environ.setdefault("RUNE_HOME", _canary_home)
+os.environ.setdefault("RUNE_MEMORY_DIR", tempfile.mkdtemp(prefix="p0-05-canary-mem-"))
+
+from rune.local_tool_runtime import LocalToolRuntime  # noqa: E402
+from rune.rune_operator import RuneOperator  # noqa: E402
+from rune.tool_executor import ALLOWED_WRITE_DIRS, execute_tool  # noqa: E402
+
+
+def _fail(message: str) -> int:
+    print(f"FAILED: {message}", file=sys.stderr)
+    return 1
+
+
+class _ScriptedTransport:
+    """Minimal scripted stand-in for OllamaChatTransport (no network)."""
+
+    def __init__(self, responses):
+        self.responses = list(responses)
+
+    def supports_tools(self, model: str) -> bool:
+        return True
+
+    def supports_thinking(self, model: str) -> bool:
+        return True
+
+    def chat(self, *, model, messages, tools, options=None, think=None):
+        if not self.responses:
+            raise AssertionError("scripted transport exhausted")
+        return self.responses.pop(0)
+
+
+class _StubExecutor:
+    def __init__(self, results=None):
+        self.results = list(results or [])
+        self.calls = []
+
+    def __call__(self, name, arguments):
+        self.calls.append((name, arguments))
+        if self.results:
+            return self.results.pop(0)
+        return {"success": True, "result": name}
+
+
+def _native_call(call_id, name, arguments):
+    return {"id": call_id, "function": {"name": name, "arguments": arguments}}
+
+
+def _tool_turn(call_id, name, arguments):
+    return {
+        "role": "assistant",
+        "content": "",
+        "tool_calls": [_native_call(call_id, name, arguments)],
+    }
+
+
+def check_circuit_breaker_trips() -> int:
+    executor = _StubExecutor([{"success": False, "error": "boom"}] * 8)
+    responses = [_tool_turn(str(i), "read_file", {"path": "/tmp/a"}) for i in range(8)]
+    runtime = LocalToolRuntime(
+        transport=_ScriptedTransport(responses),
+        executor=executor,
+        model="qwen3:8b",
+        max_iterations=8,
+    )
+    response = runtime.run([{"role": "user", "content": "inspect"}])
+    if response.success:
+        return _fail("identical failing calls did not stop the loop")
+    if "consecutive" not in response.error or "read_file" not in response.error:
+        return _fail(f"breaker failure message malformed: {response.error!r}")
+    if response.iterations_used >= runtime.max_iterations:
+        return _fail("breaker fired only after the budget burned")
+    if len(executor.calls) != 2:
+        return _fail(f"expected exactly 2 identical executions, got {len(executor.calls)}")
+    return 0
+
+
+def check_breaker_pinned_in_source() -> int:
+    src = inspect.getsource(LocalToolRuntime._run_loop)
+    if "consecutive times with identical arguments" not in src:
+        return _fail("circuit-breaker message shape missing from _run_loop source")
+    if "iteration budget burns" not in src:
+        return _fail("breaker stop reason missing from _run_loop source")
+    return 0
+
+
+def check_budget_fields_on_scripted_response() -> int:
+    runtime = LocalToolRuntime(
+        transport=_ScriptedTransport(
+            [_tool_turn("1", "list_directory", {"path": "/tmp"}), {"role": "assistant", "content": "done"}]
+        ),
+        executor=_StubExecutor(),
+        model="qwen3:8b",
+        max_iterations=8,
+    )
+    response = runtime.run([{"role": "user", "content": "inspect"}])
+    if not response.success:
+        return _fail(f"scripted 2-call loop failed: {response.error}")
+    if response.iterations_used != 2:
+        return _fail(f"iterations_used {response.iterations_used} != 2")
+    if response.iteration_budget != runtime.max_iterations:
+        return _fail(f"iteration_budget {response.iteration_budget} != {runtime.max_iterations}")
+    return 0
+
+
+def check_sandbox_error_names_allowed_dirs() -> int:
+    result = execute_tool("write_file", {"path": "/opt/nope.txt", "content": "x"})
+    if result.get("success") is not False:
+        return _fail("write outside the sandbox was not denied")
+    error = str(result.get("error", ""))
+    if "allowed" not in error.lower():
+        return _fail(f"denial does not mention allowed directories: {error!r}")
+    for directory in ALLOWED_WRITE_DIRS:
+        if directory not in error:
+            return _fail(f"denial does not name allowed dir {directory}: {error!r}")
+    return 0
+
+
+def check_max_iterations_enforced() -> int:
+    responses = [_tool_turn(str(i), "list_directory", {"path": f"/tmp/{i}"}) for i in range(8)]
+    runtime = LocalToolRuntime(
+        transport=_ScriptedTransport(responses),
+        executor=_StubExecutor(),
+        model="qwen3:8b",
+        max_iterations=8,
+    )
+    response = runtime.run([{"role": "user", "content": "keep going"}])
+    if response.success:
+        return _fail("loop ran past max_iterations")
+    if "iteration limit" not in response.error:
+        return _fail(f"expected iteration-limit failure, got: {response.error!r}")
+    if response.iterations_used != runtime.max_iterations:
+        return _fail("iteration-limit failure did not report the burned budget")
+    return 0
+
+
+def check_tools_block_guidance() -> int:
+    src = inspect.getsource(RuneOperator._contributor_tools)
+    if "never fabricate" not in src:
+        return _fail("tools block lost the never-fabricate guidance line")
+    if "Read before editing" not in src:
+        return _fail("tools block lost the read-before-editing guidance line")
+    return 0
+
+
+def main() -> int:
+    checks = (
+        ("circuit breaker trips before budget burn", check_circuit_breaker_trips),
+        ("breaker pinned in _run_loop source", check_breaker_pinned_in_source),
+        ("budget fields on scripted response", check_budget_fields_on_scripted_response),
+        ("sandbox denial names allowed dirs", check_sandbox_error_names_allowed_dirs),
+        ("max_iterations enforced", check_max_iterations_enforced),
+        ("tools block usage guidance", check_tools_block_guidance),
+    )
+    for label, check in checks:
+        result = check()
+        if result != 0:
+            return result
+        print(f"  ✓ {label}")
+    print("P0-05 NATIVE TOOLS CANARY PASSED")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

src/rune/canary_p0_07.py

@@ -0,0 +1,310 @@
+#!/usr/bin/env python3
+"""P0-07 inference-trace canary (#23).
+
+Self-bootstrapping like canary_p0_04.py / canary_p0_05.py (CI runs
+``python3 <canary>`` without PYTHONPATH). Proves the #23 claims are
+machine-checked with NO live model, NO Ollama, NO network:
+
+1. the transport accumulates usage across chats (calls, prompt/output
+   tokens, total_duration) while last_prompt_eval_count stays unchanged;
+2. a scripted trace → record → read back carries EVERY issue-listed
+   field with schema_version 1;
+3. per-block tokens + tools + memories reconstruct what the model saw;
+4. cost basis is 'local-unpriced' with cost None for local models;
+5. rotation caps the live file (parameterized tiny byte limit).
+
+Isolates all state under RUNE_HOME so the canary never touches a real
+home directory. Prints 'P0-07 INFERENCE TRACE CANARY PASSED' and exits 0.
+"""
+
+import os
+import sys
+import tempfile
+from pathlib import Path
+
+# Self-bootstrap: CI runs `python3 <canary>` without PYTHONPATH, so put the
+# repository src/ on sys.path before importing rune modules. Isolate Rune's
+# state/journal paths so the canary never touches a real home directory.
+_repo_src = str(Path(__file__).resolve().parents[1])
+sys.path.insert(0, _repo_src)
+_canary_home = tempfile.mkdtemp(prefix="p0-07-canary-home-")
+os.environ.setdefault("RUNE_HOME", _canary_home)
+os.environ.setdefault("RUNE_MEMORY_DIR", tempfile.mkdtemp(prefix="p0-07-canary-mem-"))
+
+from rune.inference_trace import (  # noqa: E402
+    TRACE_ROTATE_BYTES,
+    InferenceTrace,
+    price_for,
+    read_traces,
+    record_trace,
+)
+from rune.local_tool_runtime import OllamaChatTransport  # noqa: E402
+from rune.context_broker import MEMORY_BLOCK_NAMES  # noqa: E402
+
+ISSUE_FIELDS = (
+    "schema_version",
+    "provider",
+    "model",
+    "task_id",
+    "channel",
+    "resolved_context_window",
+    "input_budget",
+    "model_calls",
+    "prompt_tokens_estimated",
+    "prompt_tokens_served",
+    "output_tokens",
+    "latency_ms",
+    "model_time_ms",
+    "per_block_tokens",
+    "dropped_blocks",
+    "tools_exposed",
+    "memories_exposed",
+    "memory_tokens",
+    "degraded",
+    "cache",
+    "cost_usd",
+    "cost_basis",
+    "success",
+    "error",
+)
+
+
+def _fail(message: str) -> int:
+    print(f"FAILED: {message}", file=sys.stderr)
+    return 1
+
+
+class _ScriptedTransport(OllamaChatTransport):
+    """OllamaChatTransport with _post scripted — real accumulation code runs."""
+
+    def __init__(self, responses):
+        super().__init__()
+        self._responses = list(responses)
+
+    def _post(self, path, payload):
+        if not self._responses:
+            raise AssertionError("scripted transport exhausted")
+        return self._responses.pop(0)
+
+
+def _chat_response(prompt_eval_count, eval_count, total_duration_ns):
+    return {
+        "model": "qwen3:8b",
+        "created_at": "2026-09-05T00:00:00Z",
+        "message": {"role": "assistant", "content": "ok"},
+        "done": True,
+        "prompt_eval_count": prompt_eval_count,
+        "eval_count": eval_count,
+        "total_duration": total_duration_ns,
+    }
+
+
+def check_transport_accumulates_usage() -> int:
+    transport = _ScriptedTransport(
+        [
+            _chat_response(1000, 50, 1_500_000_000),
+            _chat_response(1200, 80, 2_000_000_000),
+            _chat_response(1400, 70, 500_000_000),
+        ]
+    )
+    for _ in range(3):
+        transport.chat(model="qwen3:8b", messages=[], tools=None)
+    if transport.usage_calls != 3:
+        return _fail(f"usage_calls {transport.usage_calls} != 3")
+    if transport.usage_prompt_tokens != 3600:
+        return _fail(f"usage_prompt_tokens {transport.usage_prompt_tokens} != 3600")
+    if transport.usage_output_tokens != 200:
+        return _fail(f"usage_output_tokens {transport.usage_output_tokens} != 200")
+    if transport.usage_total_duration_ns != 4_000_000_000:
+        return _fail("usage_total_duration_ns did not sum")
+    if transport.last_prompt_eval_count != 1400:
+        return _fail("last_prompt_eval_count behavior changed (calibration pin)")
+    return 0
+
+
+def _canary_trace(transport, **overrides) -> InferenceTrace:
+    """Scripted trace: broker blocks + transport counters → InferenceTrace."""
+    broker_trace = {
+        "model_id": "qwen3:8b",
+        "window": 40960,
+        "budget": 32768,
+        "blocks": [
+            {"name": "persona", "tokens": 980, "admitted": True, "reason": ""},
+            {"name": "tools", "tokens": 90, "admitted": True, "reason": ""},
+            {"name": "memory", "tokens": 75, "admitted": True, "reason": ""},
+            {"name": "history", "tokens": 400, "admitted": True, "reason": ""},
+            {"name": "user", "tokens": 20, "admitted": True, "reason": ""},
+            {
+                "name": "consolidated",
+                "tokens": 5000,
+                "admitted": False,
+                "reason": "budget: 1565+5000>32768 (lowest-priority evictable dropped)",
+            },
+        ],
+        "admitted_total": 1565,
+        "memory_tokens": 75,
+        "degraded": ["memory_selector"],
+    }
+    price = price_for("qwen3:8b")
+    defaults = dict(
+        schema_version=1,
+        provider=getattr(transport, "provider", "unknown"),
+        model="qwen3:8b",
+        task_id="task-canary-1",
+        channel="task",
+        resolved_context_window=broker_trace["window"],
+        input_budget=broker_trace["budget"],
+        model_calls=getattr(transport, "usage_calls", 0),
+        prompt_tokens_estimated=broker_trace["admitted_total"],
+        prompt_tokens_served=getattr(transport, "usage_prompt_tokens", 0),
+        output_tokens=getattr(transport, "usage_output_tokens", 0),
+        latency_ms=4211.75,
+        model_time_ms=round(getattr(transport, "usage_total_duration_ns", 0) / 1e6, 3),
+        per_block_tokens={b["name"]: b["tokens"] for b in broker_trace["blocks"] if b.get("admitted")},
+        dropped_blocks=[
+            {"name": b["name"], "tokens": b["tokens"]} for b in broker_trace["blocks"] if not b.get("admitted")
+        ],
+        tools_exposed=["read_file", "write_file", "list_directory"],
+        memories_exposed=[
+            b["name"]
+            for b in broker_trace["blocks"]
+            if b.get("admitted") and b["name"] in MEMORY_BLOCK_NAMES and b["tokens"] > 0
+        ],
+        memory_tokens=broker_trace["memory_tokens"],
+        degraded=sorted(broker_trace["degraded"]),
+        cache=None,
+        cost_usd=price,
+        cost_basis="price-map" if price is not None else "local-unpriced",
+        success=True,
+        error="",
+    )
+    defaults.update(overrides)
+    # P0-07 ratchet: broker_trace values are untyped dict lookups — assert
+    # the concrete types pyright needs instead of passing Any through.
+    from typing import Any, cast
+
+    typed = {
+        "schema_version": int(defaults["schema_version"]),
+        "resolved_context_window": int(defaults["resolved_context_window"]),
+        "input_budget": int(defaults["input_budget"]),
+        "model_calls": int(defaults["model_calls"]),
+        "prompt_tokens_estimated": int(defaults["prompt_tokens_estimated"]),
+        "prompt_tokens_served": int(defaults["prompt_tokens_served"]),
+        "output_tokens": int(defaults["output_tokens"]),
+        "latency_ms": float(defaults["latency_ms"]),
+        "model_time_ms": float(defaults["model_time_ms"]),
+        "memory_tokens": int(defaults["memory_tokens"]),
+    }
+    defaults.update(typed)
+    return InferenceTrace(**cast("dict[str, Any]", defaults))
+
+
+def check_record_round_trip_carries_every_field() -> int:
+    transport = _ScriptedTransport([_chat_response(1600, 42, 1_000_000_000), _chat_response(1600, 42, 1_000_000_000)])
+    for _ in range(2):
+        transport.chat(model="qwen3:8b", messages=[], tools=None)
+    trace = _canary_trace(transport)
+    trace_dir = Path(_canary_home) / "state" / "canary-traces"
+    record_trace(trace, trace_dir=trace_dir)
+    records = read_traces(trace_dir=trace_dir)
+    if len(records) != 1:
+        return _fail(f"expected 1 record, got {len(records)}")
+    record = records[0]
+    for field in ISSUE_FIELDS:
+        if field not in record:
+            return _fail(f"record missing issue-listed field: {field}")
+    if record["schema_version"] != 1:
+        return _fail("schema_version != 1")
+    if record["provider"] != "ollama" or record["model"] != "qwen3:8b":
+        return _fail("provider/model linkage broken")
+    if record["task_id"] != "task-canary-1" or record["channel"] != "task":
+        return _fail("task linkage broken")
+    if record["model_calls"] != 2 or record["prompt_tokens_served"] != 3200:
+        return _fail("transport accumulators did not flow into the record")
+    if record["output_tokens"] != 84 or record["model_time_ms"] != 2000.0:
+        return _fail("output/latency did not flow from transport counters")
+    return 0
+
+
+def check_what_did_the_model_see() -> int:
+    transport = _ScriptedTransport([])
+    trace = _canary_trace(transport)
+    trace_dir = Path(_canary_home) / "state" / "canary-traces"
+    record_trace(trace, trace_dir=trace_dir)
+    record = read_traces(trace_dir=trace_dir)[-1]
+    if record["per_block_tokens"] != {
+        "persona": 980,
+        "tools": 90,
+        "memory": 75,
+        "history": 400,
+        "user": 20,
+    }:
+        return _fail("per_block_tokens do not reconstruct the admitted blocks")
+    if record["memories_exposed"] != ["memory"]:
+        return _fail("memories_exposed wrong")
+    if record["dropped_blocks"] != [{"name": "consolidated", "tokens": 5000}]:
+        return _fail("dropped_blocks wrong")
+    if record["tools_exposed"] != ["read_file", "write_file", "list_directory"]:
+        return _fail("tools_exposed wrong")
+    if sum(record["per_block_tokens"].values()) != record["prompt_tokens_estimated"]:
+        return _fail("admitted blocks do not sum to the broker estimate")
+    return 0
+
+
+def check_cost_local_unpriced() -> int:
+    if price_for("qwen3:8b") is not None or price_for("unknown-model") is not None:
+        return _fail("price map is not empty — local models must be unpriced")
+    transport = _ScriptedTransport([])
+    trace = _canary_trace(transport)
+    if trace.cost_usd is not None or trace.cost_basis != "local-unpriced":
+        return _fail("local model must record cost None / basis local-unpriced")
+    return 0
+
+
+def check_rotation_caps_the_live_file() -> int:
+    trace_dir = Path(_canary_home) / "state" / "canary-rotation"
+    transport = _ScriptedTransport([])
+    # monkeypatch the module constant to a tiny byte limit (rotation probe)
+    import rune.inference_trace as it
+
+    original = it.TRACE_ROTATE_BYTES
+    try:
+        it.TRACE_ROTATE_BYTES = 2048
+        for i in range(40):
+            record_trace(_canary_trace(transport, task_id=f"task-rot-{i}"), trace_dir=trace_dir)
+    finally:
+        it.TRACE_ROTATE_BYTES = original
+
+    live = trace_dir / "inference_traces.jsonl"
+    backup = trace_dir / "inference_traces.jsonl.1"
+    if not live.exists():
+        return _fail("rotation probe produced no live file")
+    if not backup.exists():
+        return _fail("rotation did not produce a .1 backup")
+    if live.stat().st_size > 4096:
+        return _fail("live file grew past the rotation limit")
+    for line in backup.read_text().splitlines():
+        if line.strip() and __import__("json").loads(line)["schema_version"] != 1:
+            return _fail("rotated record lost schema_version")
+    return 0
+
+
+def main() -> int:
+    checks = (
+        ("transport accumulates usage across chats", check_transport_accumulates_usage),
+        ("record round-trip carries every issue field", check_record_round_trip_carries_every_field),
+        ("per-block/tools/memories reconstruct what the model saw", check_what_did_the_model_see),
+        ("local cost basis is local-unpriced / cost None", check_cost_local_unpriced),
+        ("rotation caps the live trace file", check_rotation_caps_the_live_file),
+    )
+    for label, check in checks:
+        result = check()
+        if result != 0:
+            return result
+        print(f"  ✓ {label}")
+    print("P0-07 INFERENCE TRACE CANARY PASSED")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

src/rune/context_broker.py

@@ -0,0 +1,693 @@
+"""ContextBroker — single authority over prompt context assembly.
+
+All injected context flows through this module. Contributors register,
+budgets resolve from the model's real context length, admission is
+deterministic (priority, then recency), every block is measured, and a
+trace records what was admitted, dropped, and why.
+
+Order of assembly (fixed): system -> tools -> memory/notes -> history
+-> user. Contributors emit typed blocks with priority; admission sorts
+by priority (tie: recency of registration), drops lowest-priority
+evictable blocks that do not fit the budget, and refuses to run if a
+single mandatory block exceeds the budget (fail loud).
+
+Memory-off invariant: ``RUNE_MEMORY_OFF`` in the environment zeroes every
+memory contributor (recall, persona memories, consolidation) BEFORE
+collection — the trace then proves 0 memory tokens by absence.
+
+Compaction (Task 4): when the measured history exceeds 80% of the model
+window, the raw history is ARCHIVED first (appended to
+``<rune_home>/state/history_archive.jsonl`` — recoverable), then all but
+the last 5 turns are replaced by one structured rolling summary
+(session intent / decisions / open items / next steps). A failed
+summarization call is a T2 storage failure; compaction is skipped that
+turn and the last-8-turns verbatim history degrades in.
+
+Calibration: after each operator request the broker estimate is compared
+with the served ``prompt_eval_count`` (when present) and the drift is
+LOGGED — never auto-adjusted into admission (pinned decision).
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import threading
+import time
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Callable
+
+from rune.attention_capsule import AttentionCapsule
+
+LOG = logging.getLogger("rune.context_broker")
+
+# Conservative fallback when context-length discovery fails (P0-06 T1
+# record_failure accompanies it — never silently assume).
+FALLBACK_WINDOW = 8192
+
+# LangChain deepagents compaction threshold: compress history beyond 80%.
+COMPACTION_THRESHOLD = 0.8
+COMPACTION_KEEP_TURNS = 5
+COMPACTION_NUM_PREDICT = 256
+
+# Blocks that count as "memory" for the absence proof (memory-off gate).
+MEMORY_BLOCK_NAMES = frozenset({"memory", "persona_memories", "consolidated"})
+
+# Registry of discovered windows keyed by model id (populated by
+# local_tool_runtime discovery; checked before the fallback).
+_DISCOVERED: dict[str, int] = {}
+_DISCOVERED_LOCK = threading.Lock()
+
+
+class ContextOverflowError(RuntimeError):
+    """One block alone exceeds the input budget — never silently truncate."""
+
+
+class ContributionBlock:
+    """A typed, measurable piece of context."""
+
+    __slots__ = ("name", "priority", "content", "tokens", "source", "evictable")
+
+    def __init__(self, name, priority, content, tokens, source, evictable=True):
+        self.name = name
+        self.priority = priority  # higher wins budget
+        self.content = content  # text block (empty = contribute nothing)
+        self.tokens = tokens  # measured token estimate
+        self.source = source  # selector module/function, for trace
+        self.evictable = evictable  # False = never dropped (system, user)
+
+    def to_dict(self) -> dict:
+        """Serialize for pending_state embedding (approval resume)."""
+        return {
+            "name": self.name,
+            "priority": self.priority,
+            "tokens": self.tokens,
+            "source": self.source,
+            "evictable": self.evictable,
+        }
+
+
+def default_estimator(text: str) -> int:
+    """Deterministic conservative token estimate: len(text) // 4.
+
+    Bytes/4 over-counts for English prose (the conservative direction).
+    tiktoken would be tighter but is NOT deterministic across builds and
+    is not a dependency — the plan allows either, installer's choice.
+    """
+    return len(text or "") // 4
+
+
+def default_budget(window: int) -> int:
+    """Input budget = window - max(2048, window//4) - window//20.
+
+    Reserves room for the completion (at least 2048 or a quarter of the
+    window) plus a 5% safety margin for serving overhead.
+    """
+    return max(1, window - max(2048, window // 4) - window // 20)
+
+
+def memory_disabled() -> bool:
+    """True when RUNE_MEMORY_OFF is set to a truthy value.
+
+    The gate is checked at COLLECT time so disabled memory selectors
+    contribute nothing at all — the trace proves 0 memory tokens.
+    """
+    value = os.environ.get("RUNE_MEMORY_OFF", "").strip().lower()
+    return value not in {"", "0", "false", "no", "off"}
+
+
+def reset_discovered_windows() -> None:
+    """Clear the broker's discovered-window registry (I3 cache coherence)."""
+    with _DISCOVERED_LOCK:
+        _DISCOVERED.clear()
+
+
+def register_window(model_id: str, window: int) -> None:
+    """Record a discovered context length for ``model_id`` (Task 2 hook)."""
+    with _DISCOVERED_LOCK:
+        _DISCOVERED[model_id] = int(window)
+
+
+def default_window(model_id: str | None) -> int:
+    """Resolve the model window via discovery; conservative fallback on failure.
+
+    Checks the broker registry (populated by prior /api/show discovery),
+    then the module-level ``context_length`` registry, then a live
+    discovery — which records T1 ``context_discovery`` and returns 8192
+    on failure. The fallback is observable, never silent.
+    """
+    if not model_id:
+        return FALLBACK_WINDOW
+    with _DISCOVERED_LOCK:
+        if model_id in _DISCOVERED:
+            return _DISCOVERED[model_id]
+    try:
+        from rune.local_tool_runtime import context_length as discover
+    except ImportError:  # pragma: no cover - same package, always present
+        return FALLBACK_WINDOW
+    window = discover(model_id)
+    # C3 (quality gate general-172): register ONLY genuinely discovered
+    # windows. The fallback (8192) must never enter the cache — a transient
+    # discovery failure would otherwise poison the window for the process
+    # lifetime. local_tool_runtime returns FALLBACK_WINDOW on failure without
+    # caching; the broker must honor that same contract.
+    if window and window != FALLBACK_WINDOW:
+        register_window(model_id, window)
+    return window
+
+
+def summarize_history(
+    messages: list[dict],
+    model: str = "qwen2.5:7b",
+    num_predict: int = COMPACTION_NUM_PREDICT,
+    num_ctx: int | None = None,
+) -> str:
+    """One compact summarization call over the archived history.
+
+    Structured rolling summary (LangChain deepagents shape): session
+    intent / decisions / open items / next steps. Raises on any
+    transport failure — the caller degrades (T2, no compaction this
+    turn) rather than losing turns silently.
+    """
+    from rune.local_tool_runtime import OllamaChatTransport
+
+    transport = OllamaChatTransport(timeout=60)
+    transcript = "\n".join(f"{message.get('role', '?')}: {message.get('content', '')}" for message in messages)
+    prompt = (
+        "Summarize this conversation segment into a rolling summary.\n"
+        "Answer with exactly these four labeled sections:\n"
+        "Session intent: <what this session is trying to accomplish>\n"
+        "Decisions: <choices made so far>\n"
+        "Open items: <unresolved threads>\n"
+        "Next steps: <what to do next>\n\n"
+        "Conversation:\n"
+        f"{transcript}"
+    )
+    options: dict = {"temperature": 0.2, "num_predict": num_predict}
+    # I4 (quality gate general-172): the transcript can exceed Ollama's
+    # default window — size the summarizer call to the discovered window so
+    # the compaction path does not itself suffer silent truncation.
+    if num_ctx:
+        options["num_ctx"] = num_ctx
+    response = transport.chat(
+        model=model,
+        messages=[{"role": "user", "content": prompt}],
+        tools=None,
+        options=options,
+        think=None,
+    )
+    content = response.get("content", "")
+    if not isinstance(content, str) or not content.strip():
+        raise ValueError("summarizer returned empty content")
+    return content.strip()
+
+
+def compact_history(
+    messages: list[dict],
+    window: int,
+    archive_path: Path | None = None,
+    summarizer: Callable[[list[dict]], str] | None = None,
+    source: str = "operator",
+    session_id: str = "",
+) -> tuple[list[dict], dict]:
+    """Persisting overload: uses/updates the rolling-summary store.
+
+    Session key is (source, session_id). When a prior rolling summary
+    covers messages[0:through], only the NEW older messages beyond
+    through are summarized, and the summary is updated (rolled). Archive
+    appends only the NEW messages (no duplicate re-archiving). Direct
+    callers without a session still work (session_id="" -> no
+    persistence, previous verbatim behavior).
+
+    Archive raw history, then compress all but the last 5 turns. Order is
+    fixed and load-bearing: append the RAW messages to the archive BEFORE
+    any lossy step (recoverable compression — SOTA constraint). Returns
+    (compacted_messages, compaction_event). A summarizer failure is a T2
+    storage failure: the event records the failure, compaction is skipped,
+    and the caller degrades to the newest tail that fits the budget (C2).
+    """
+    tokens_before = sum(default_estimator(m.get("content", "")) for m in messages)
+    event: dict = {
+        "triggered": False,
+        "tokens_before": tokens_before,
+        "tokens_after": tokens_before,
+        "turns_summarized": 0,
+        "archived": False,
+        "failed": False,
+        "source": source,
+        "persisted": False,
+    }
+    if not messages:
+        return messages, event
+
+    total_turns = sum(1 for m in messages if m.get("role") == "user")
+    if total_turns <= COMPACTION_KEEP_TURNS:
+        return messages, event
+
+    keep_messages = COMPACTION_KEEP_TURNS * 2  # user+assistant pairs
+    older, recent = messages[:-keep_messages], messages[-keep_messages:]
+
+    # C1 fix: rolling-summary persistence. A prior summary for this session
+    # covers messages[0:through]; only summarize what is NEW, and archive
+    # only the NEW messages (no duplicate re-archiving per turn).
+    session_key = (source, session_id) if session_id else None
+    prior = rolling_summary_state(session_key) if session_key else None
+    through = prior["through_count"] if prior else 0
+    if prior and through <= len(older):
+        new_older = older[through:]
+        if not new_older:
+            # Nothing new beyond the rolled summary: reuse it verbatim.
+            summary_text = prior["summary"]
+            summary_block = {
+                "role": "user",
+                "content": (
+                    "## Conversation summary (rolling)\n"
+                    f"{summary_text}\n"
+                    "(Earlier turns were archived; recent turns verbatim.)"
+                ),
+            }
+            compacted = [summary_block, *recent]
+            event.update(
+                triggered=True,
+                tokens_after=sum(default_estimator(m.get("content", "")) for m in compacted),
+                turns_summarized=0,
+                summary=summary_text,
+                persisted=True,
+            )
+            return compacted, event
+        archive_messages = new_older
+    else:
+        new_older = older
+        archive_messages = messages if not prior else older[through:] if through <= len(older) else older
+        if prior and through > len(older):
+            # History shrank (ledger rotation): summarize from scratch.
+            prior = None
+            through = 0
+            archive_messages = messages
+
+    # ARCHIVE FIRST — raw, verbatim, before any lossy compression.
+    # Only the NEW messages (C1: no duplicate re-archiving each turn).
+    if archive_path is not None:
+        record = {
+            "archived_at": datetime.now(timezone.utc).isoformat(),
+            "session_id": session_id,
+            "source": source,
+            "messages": json.loads(json.dumps(archive_messages)),
+        }
+        try:
+            archive_path.parent.mkdir(parents=True, exist_ok=True)
+            with open(archive_path, "a", encoding="utf-8") as handle:
+                handle.write(json.dumps(record, ensure_ascii=False) + "\n")
+            event["archived"] = True
+        except OSError as exc:
+            from rune.subsystem_health import record_failure
+
+            record_failure("history_archive", exc, tier=2)
+            event["failed"] = True
+            return messages, event
+
+    try:
+        if prior:
+            combined = [
+                {"role": "user", "content": "Previous rolling summary:\n" + prior["summary"]},
+                *new_older,
+            ]
+            summary_text = (
+                summarizer(combined) if summarizer is not None else summarize_history(combined, num_ctx=window)
+            )
+        else:
+            summary_text = summarizer(older) if summarizer is not None else summarize_history(older, num_ctx=window)
+    except Exception as exc:
+        from rune.subsystem_health import record_failure
+
+        record_failure("history_compaction", exc, tier=2)
+        event["failed"] = True
+        # C2 fix: on summarizer failure, degrade to the newest tail that
+        # fits the window budget instead of returning the whole (over-budget)
+        # history, which admission would then drop ENTIRELY.
+        tail_budget = max(1, window - max(2048, window // 4) - window // 20)
+        tail: list[dict] = []
+        used = 0
+        for message in reversed(messages):
+            cost = default_estimator(message.get("content", ""))
+            if used + cost > tail_budget and tail:
+                break
+            tail.insert(0, message)
+            used += cost
+        event["degraded_to_tail"] = len(tail)
+        return tail, event
+
+    summary_block = {
+        "role": "user",
+        "content": (
+            "## Conversation summary (rolling)\n"
+            f"{summary_text}\n"
+            "(Earlier turns were archived to "
+            f"{archive_path if archive_path is not None else 'external storage'}; "
+            f"{len(older)} messages summarized, recent turns verbatim.)"
+        ),
+    }
+    compacted = [summary_block, *recent]
+    if session_key:
+        store_rolling_summary(session_key, summary_text, through + len(new_older))
+    event.update(
+        triggered=True,
+        tokens_after=sum(default_estimator(m.get("content", "")) for m in compacted),
+        turns_summarized=len(new_older),
+        summary=summary_text,
+        persisted=bool(session_key),
+    )
+    LOG.info(
+        "history compaction: %d->%d tokens, %d messages summarized, archived=%s failed=%s",
+        event["tokens_before"],
+        event["tokens_after"],
+        event["turns_summarized"],
+        event["archived"],
+        event["failed"],
+    )
+    return compacted, event
+
+
+_ROLLING_LOCK = threading.Lock()
+_ROLLING: dict[tuple, dict] = {}
+
+
+def rolling_summary_state(session_key: tuple) -> dict | None:
+    """Return the persisted rolling summary for a session, if any."""
+    with _ROLLING_LOCK:
+        state = _ROLLING.get(session_key)
+        return dict(state) if state else None
+
+
+def store_rolling_summary(session_key: tuple, summary_text: str, through_count: int) -> None:
+    """Persist a rolling summary (C1 fix): keyed by (source, session_id).
+
+    through_count = number of leading messages the summary covers. Next
+    compaction summarizes only the NEW messages between through_count and
+    the current keep-boundary, so consecutive turns don't re-archive or
+    re-summarize the same window.
+    """
+    with _ROLLING_LOCK:
+        _ROLLING[session_key] = {"summary": summary_text, "through_count": int(through_count)}
+
+
+def log_calibration(measured_tokens: int, prompt_eval_count: int | None, model: str = "") -> int:
+    """Compare the broker estimate with the served prompt_eval_count.
+
+    LOG ONLY — drift is never fed back into admission (pinned decision).
+    Returns the signed drift (served - estimated); 0 when nothing served.
+    """
+    if not prompt_eval_count:
+        return 0
+    drift = int(prompt_eval_count) - int(measured_tokens)
+    sign = "+" if drift >= 0 else ""
+    LOG.info(
+        "calibration: measured=%d served=%d drift=%s%d model=%s (log-only, admission never auto-adjusts)",
+        measured_tokens,
+        prompt_eval_count,
+        sign,
+        drift,
+        model,
+    )
+    return drift
+
+
+class ContextBroker:
+    """Admission-controlled context assembler.
+
+    Order of assembly (fixed): system -> tools -> memory/notes -> history
+    -> user. Contributors emit typed blocks with priority; admission sorts
+    by priority (tie: recency of registration), drops lowest-priority
+    evictable blocks that do not fit the budget, and refuses to run if a
+    single mandatory block exceeds the budget (fail loud).
+    """
+
+    def __init__(self, estimator=None, budget_resolver=None, archive_path=None, summarizer=None):
+        self._lock = threading.RLock()
+        self._contributors = []  # (name, callback, priority_bucket)
+        self._estimator = estimator or default_estimator
+        self._budget_resolver = budget_resolver or default_budget
+        self._archive_path = archive_path
+        self._summarizer = summarizer
+        self._trace_log = []
+
+    # -- contributor registry ------------------------------------------------
+
+    def register_contributor(self, name, callback, bucket):
+        """Name a contributor. callback(task, session) -> ContributionBlock or None."""
+        with self._lock:
+            self._contributors.append((name, callback, bucket))
+
+    @property
+    def trace_log(self) -> list[dict]:
+        """Every assemble() trace recorded by this broker (thread-safe copy)."""
+        with self._lock:
+            return list(self._trace_log)
+
+    # -- assembly pipeline ---------------------------------------------------
+
+    def _collect(self, task, session, degraded: list[str]) -> list[tuple[str, ContributionBlock, int]]:
+        """Run contributors in registration order; failures are T1 events.
+
+        Collection happens in ONE pass (lock held) — a contributor's side
+        effects (e.g. consolidation's _save_knowledge) therefore run
+        exactly once per turn, before admission decides visibility.
+        """
+        collected: list[tuple[str, ContributionBlock, int]] = []
+        from rune.subsystem_health import record_failure
+
+        with self._lock:
+            contributors = list(self._contributors)
+        for name, callback, bucket in contributors:
+            try:
+                block = callback(task, session)
+            except Exception as exc:
+                record_failure(name, exc, tier=1)
+                if name not in degraded:
+                    degraded.append(name)
+                continue
+            if block is None or (isinstance(block.content, str) and not block.content):
+                continue
+            # I5 (quality gate general-172): malformed return VALUES are
+            # contributor failures too — a non-str/non-list content would
+            # otherwise crash the measure step with a raw TypeError outside
+            # the T1 degrade path.
+            content_ok = isinstance(block.content, str) or (
+                isinstance(block.content, list) and all(isinstance(m, dict) and "content" in m for m in block.content)
+            )
+            if not content_ok:
+                exc = TypeError(f"contributor {name!r} returned malformed content: {type(block.content).__name__}")
+                record_failure(name, exc, tier=1)
+                if name not in degraded:
+                    degraded.append(name)
+                continue
+            collected.append((name, block, bucket))
+        return collected
+
+    def _admit(
+        self, collected: list[tuple[str, ContributionBlock, int]], budget: int
+    ) -> tuple[list[ContributionBlock], dict]:
+        """Deterministic admission: priority desc, tie: registration recency.
+
+        Non-evictable blocks are always admitted first (in order); an
+        evictable block is admitted while the budget lasts, otherwise
+        dropped with its token count recorded. A mandatory block that
+        cannot fit at all raises ContextOverflowError (fail loud).
+        """
+        recency = {id(block): index for index, (_name, block, _b) in enumerate(collected)}
+
+        def sort_key(entry):
+            _name, block, _bucket = entry
+            return (0 if not block.evictable else 1, -block.priority, recency[id(block)])
+
+        candidates = sorted(collected, key=sort_key)
+        admitted: list[ContributionBlock] = []
+        trace_blocks: list[dict] = []
+        used = 0
+        for _name, block, _bucket in candidates:
+            record = {
+                "name": block.name,
+                "priority": block.priority,
+                "tokens": block.tokens,
+                "source": block.source,
+                "evictable": block.evictable,
+                "admitted": True,
+                "reason": "",
+            }
+            if not block.evictable:
+                if block.tokens > budget:
+                    raise ContextOverflowError(
+                        f"mandatory block '{block.name}' needs {block.tokens} "
+                        f"tokens but the input budget is {budget} — refusing "
+                        "to silently truncate"
+                    )
+                admitted.append(block)
+                used += block.tokens
+                trace_blocks.append(record)
+                continue
+            if used + block.tokens <= budget:
+                admitted.append(block)
+                used += block.tokens
+                trace_blocks.append(record)
+            else:
+                record["admitted"] = False
+                record["reason"] = f"budget: {used}+{block.tokens}>{budget} (lowest-priority evictable dropped)"
+                trace_blocks.append(record)
+
+        dropped = [dict(record) for record in trace_blocks if not record["admitted"]]
+        return admitted, {
+            "blocks": trace_blocks,
+            "admitted_total": used,
+            "dropped": dropped,
+        }
+
+    def assemble(
+        self,
+        task,
+        session,
+        model_id: str | None = None,
+        budget_tokens: int | None = None,
+        session_id: str = "",
+    ):
+        """Collect -> measure -> admit -> render. Returns (capsule, trace)."""
+        started = time.monotonic()
+        degraded: list[str] = []
+        collected = self._collect(task, session, degraded)
+
+        if budget_tokens is None:
+            window = default_window(model_id)
+            budget = self._budget_resolver(window)
+        else:
+            window = None
+            budget = int(budget_tokens)
+
+        # Measure every block with the broker estimator (measured, not guessed).
+        for _name, block, _bucket in collected:
+            if isinstance(block.content, str):
+                block.tokens = self._estimator(block.content)
+            else:
+                block.tokens = sum(self._estimator(message.get("content", "")) for message in block.content)
+
+        # Compaction gate (Task 4 + C2 fix): the trigger is measured against
+        # the INPUT BUDGET, not the raw window — the old 0.8*window trigger
+        # left a dead zone (budget, 0.8*window) where over-budget history was
+        # silently dropped whole with no compaction and no archive.
+        compaction_events: list[dict] = []
+        compaction_trigger = COMPACTION_THRESHOLD * budget if budget else None
+        # C2: the gate fires on the BUDGET even when no model window was
+        # resolved (direct assemble calls) — compaction sizing then treats
+        # the budget as the window basis instead of skipping entirely.
+        compaction_window = window if window is not None else (budget if budget else None)
+        if compaction_window is not None:
+            for _name, block, _bucket in collected:
+                if block.name != "history" or not isinstance(block.content, list):
+                    continue
+                history_tokens = block.tokens
+                if history_tokens > (compaction_trigger or COMPACTION_THRESHOLD * compaction_window):
+                    compacted, event = compact_history(
+                        block.content,
+                        compaction_window,
+                        archive_path=self._archive_path,
+                        summarizer=self._summarizer,
+                        source="operator",
+                        session_id=session_id,
+                    )
+                    compaction_events.append(event)
+                    if event["triggered"]:
+                        block.content = compacted
+                        block.tokens = sum(self._estimator(m.get("content", "")) for m in compacted)
+
+        try:
+            admitted, admission = self._admit(collected, budget)
+        except ContextOverflowError:
+            raise
+
+        # I1 (quality gate general-172): COLLECTIVE non-evictable overflow is
+        # also a hard error — several mandatory blocks that individually fit
+        # must not silently exceed the budget (that would reintroduce the
+        # provider-side truncation the broker exists to prevent).
+        mandatory = [b for b in admitted if not b.evictable]
+        mandatory_total = sum(b.tokens for b in mandatory)
+        if mandatory_total > budget:
+            raise ContextOverflowError(
+                f"non-evictable blocks total {mandatory_total} tokens > budget {budget} "
+                f"({[b.name for b in mandatory]}) — refusing to silently truncate"
+            )
+
+        memory_tokens = sum(block.tokens for block in admitted if block.name in MEMORY_BLOCK_NAMES)
+        trace = {
+            "model_id": model_id,
+            "window": window,
+            "budget": budget,
+            "blocks": admission["blocks"],
+            "admitted": [block.name for block in admitted],
+            "admitted_total": admission["admitted_total"],
+            "dropped": admission["dropped"],
+            "memory_tokens": memory_tokens,
+            "degraded": sorted(degraded),
+            "compaction": compaction_events,
+            "elapsed_ms": round((time.monotonic() - started) * 1000, 3),
+        }
+
+        capsule = self._render(admitted)
+        with self._lock:
+            self._trace_log.append(trace)
+        LOG.debug(
+            "context assembled: %d/%d tokens admitted, %d dropped, memory=%d",
+            trace["admitted_total"],
+            budget,
+            len(trace["dropped"]),
+            memory_tokens,
+        )
+        return capsule, trace
+
+    # -- rendering -----------------------------------------------------------
+
+    def _render(self, admitted: list[ContributionBlock]) -> AttentionCapsule:
+        """Render admitted blocks into the typed capsule (fixed message order).
+
+        System-order buckets: persona(0) -> tools(1) -> memory notes(2) ->
+        history(3) -> user(4). History/user blocks carry list content and
+        are rendered as messages; string blocks fold into the system
+        prompt. The user block's content stays MUTABLE through
+        ``capsule.user_content`` — the safety override decorates the final
+        user message in place and ``to_messages()`` re-derives the sent
+        messages from the blocks, so mutation and ledger never diverge.
+        """
+        ordered = sorted(
+            admitted,
+            key=lambda block: (-block.priority, admitted.index(block)),
+        )
+
+        system_parts: list[str] = []
+        history: list[dict] = []
+        user_block: ContributionBlock | None = None
+        capsule_blocks: list[ContributionBlock] = []
+        total_tokens = 0
+
+        for block in ordered:
+            total_tokens += block.tokens
+            capsule_blocks.append(block)
+            if isinstance(block.content, str):
+                if block.name == "user":
+                    user_block = block
+                else:
+                    system_parts.append(block.content)
+            else:
+                history.extend(json.loads(json.dumps(message)) for message in block.content)
+
+        system_prompt = "\n".join(system_parts)
+        rendered: list[dict] = []
+        if system_prompt:
+            rendered.append({"role": "system", "content": system_prompt})
+        rendered.extend(history)
+
+        capsule = AttentionCapsule()
+        capsule.token_count = total_tokens
+        capsule.blocks = capsule_blocks
+        capsule.messages = rendered
+        capsule.system_preamble = system_prompt
+        capsule.user_content = user_block.content if user_block is not None else ""
+        return capsule

src/rune/cron_engine.py

@@ -67,8 +67,10 @@ class CronEngine:
                     data = json.load(f)
                 for name, task_data in data.items():
                     self.tasks[name] = CronTask(**task_data)
-            except Exception:
-                pass
+            except Exception as exc:  # P0-06: observable (T2 — ambient)
+                from rune.subsystem_health import record_failure
+
+                record_failure("cron", exc, tier=2, context="load tasks")
 
     def _save(self):
         """Save tasks to storage."""
@@ -116,7 +118,9 @@ class CronEngine:
                     self._execute_task(task)
                     fired.append(name)
                 except Exception as e:
-                    pass
+                    from rune.subsystem_health import record_failure
+
+                    record_failure("cron", e, tier=2, context=f"task {name}")
         return fired
 
     def enable_task(self, name: str) -> bool:

src/rune/forge_client.py

@@ -0,0 +1,110 @@
+"""Config-driven forge client (issue #121).
+
+A ForgeClient can create issues, comment, and check state — with adapters
+for Gitea, Forgejo (identical /api/v1 paths), and none (graceful dormant
+for unconfigured/standalone use). Configuration comes from environment
+variables or a config dict — nothing is hardcoded to a specific setup.
+"""
+
+from __future__ import annotations
+
+import os
+from typing import Protocol, runtime_checkable
+
+import httpx
+
+
+@runtime_checkable
+class ForgeClient(Protocol):
+    def create_issue(self, title: str, body: str) -> dict: ...
+    def add_comment(self, issue_number: int, body: str) -> dict: ...
+    def get_issue_state(self, issue_number: int) -> dict: ...
+    def list_open_issues(self) -> list[dict]: ...
+
+
+class NullAdapter:
+    """No-op adapter for unconfigured/standalone use. Zero errors."""
+
+    def create_issue(self, title: str, body: str) -> dict:
+        return {"created": False, "reason": "no forge configured"}
+
+    def add_comment(self, issue_number: int, body: str) -> dict:
+        return {"created": False, "reason": "no forge configured"}
+
+    def get_issue_state(self, issue_number: int) -> dict:
+        return {"state": "unknown"}
+
+    def list_open_issues(self) -> list[dict]:
+        return []
+
+
+class GiteaForgejoAdapter:
+    """Gitea/Forgejo adapter — /api/v1 paths (identical on both platforms)."""
+
+    def __init__(
+        self,
+        url: str,
+        token: str,
+        owner: str = "owner",
+        repo: str = "repo",
+    ) -> None:
+        self._base_url = f"{url.rstrip('/')}/api/v1/repos/{owner}/{repo}"
+        self._token = token
+
+    def _headers(self) -> dict:
+        return {"Authorization": f"token {self._token}", "Content-Type": "application/json"}
+
+    def create_issue(self, title: str, body: str) -> dict:
+        r = httpx.post(
+            f"{self._base_url}/issues",
+            headers=self._headers(),
+            json={"title": title, "body": body},
+            timeout=30,
+        )
+        r.raise_for_status()
+        return r.json()
+
+    def add_comment(self, issue_number: int, body: str) -> dict:
+        r = httpx.post(
+            f"{self._base_url}/issues/{issue_number}/comments",
+            headers=self._headers(),
+            json={"body": body},
+            timeout=30,
+        )
+        r.raise_for_status()
+        return r.json()
+
+    def get_issue_state(self, issue_number: int) -> dict:
+        r = httpx.get(
+            f"{self._base_url}/issues/{issue_number}",
+            headers=self._headers(),
+            timeout=30,
+        )
+        r.raise_for_status()
+        return r.json()
+
+    def list_open_issues(self) -> list[dict]:
+        r = httpx.get(
+            f"{self._base_url}/issues?state=open&limit=50",
+            headers=self._headers(),
+            timeout=30,
+        )
+        r.raise_for_status()
+        return r.json()
+
+
+def create_forge_client(config: dict | None = None) -> ForgeClient:
+    """Create a forge client from config or environment.
+
+    Config keys: forge.url, forge.token, forge.owner, forge.repo.
+    Falls back to FORGE_URL/FORGE_TOKEN/FORGE_OWNER/FORGE_REPO env vars.
+    Unconfigured → NullAdapter (graceful dormant).
+    """
+    cfg = config or {}
+    url = cfg.get("forge.url") or os.environ.get("FORGE_URL", "")
+    token = cfg.get("forge.token") or os.environ.get("FORGE_TOKEN", "")
+    if not url or not token:
+        return NullAdapter()
+    owner = cfg.get("forge.owner") or os.environ.get("FORGE_OWNER", "owner")
+    repo = cfg.get("forge.repo") or os.environ.get("FORGE_REPO", "repo")
+    return GiteaForgejoAdapter(url, token, owner=owner, repo=repo)

src/rune/inference_trace.py

@@ -0,0 +1,140 @@
+#!/usr/bin/env python3
+"""Durable per-inference traces — what the model actually received and spent.
+
+One JSONL line per operator run (one runtime.run = one or more model calls).
+Answers: why did this call cost this much? what exactly did the model see?
+Consumed by #25/#28/#29. Rotates at 10MB x 3 (mirrors _log_token_usage).
+
+The trace builds FROM the broker trace (#19, single source) + transport
+counters — it never re-measures. Records are runtime state under
+``<rune_home>/state/inference_traces.jsonl`` (gitignored), the same pattern
+as history_archive.jsonl. The append is O_APPEND line-atomic (model calls
+run on exclusive workers).
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from dataclasses import asdict, dataclass
+from pathlib import Path
+
+try:
+    from .memory_env import rune_home
+except ImportError:  # direct script execution
+    from rune.memory_env import rune_home
+
+INFERENCE_TRACE_SCHEMA_VERSION = 1
+TRACE_ROTATE_BYTES = 10_000_000
+TRACE_BACKUPS = 3
+
+#: Default store location (call sites may pass trace_dir; the module
+#: constant exists for tests and CI canaries to patch).
+TRACE_FILENAME = "inference_traces.jsonl"
+
+
+def _trace_dir(trace_dir: Path | None = None) -> Path:
+    """Resolve the trace directory: explicit arg, else <rune_home>/state."""
+    if trace_dir is not None:
+        return Path(trace_dir)
+    return Path(rune_home()) / "state"
+
+
+def _trace_path(trace_dir: Path | None = None) -> Path:
+    return _trace_dir(trace_dir) / TRACE_FILENAME
+
+
+@dataclass(frozen=True)
+class InferenceTrace:
+    """One operator run's full inference record (schema v1).
+
+    Field sources: broker trace (#19) for window/budget/blocks/memory;
+    transport accumulators (P0-07 Task 1) for served/output/duration;
+    operator for task linkage, latency, and the tools allowlist.
+    """
+
+    schema_version: int
+    provider: str  # "ollama" (transport class constant)
+    model: str
+    task_id: str
+    channel: str
+    resolved_context_window: int  # broker window (discovered)
+    input_budget: int  # broker budget
+    model_calls: int  # transport.chat invocations this run
+    prompt_tokens_estimated: int  # broker admitted_total
+    prompt_tokens_served: int  # transport usage_prompt_tokens (0 if unknown)
+    output_tokens: int  # transport usage_output_tokens
+    latency_ms: float  # wall clock around runtime.run
+    model_time_ms: float  # sum total_duration / 1e6
+    per_block_tokens: dict  # {block_name: tokens} admitted blocks
+    dropped_blocks: list  # [{name, tokens}]
+    tools_exposed: list  # runtime allowlist
+    memories_exposed: list  # memory blocks with tokens > 0
+    memory_tokens: int
+    degraded: list  # subsystems that degraded (P0-06)
+    cache: dict | None  # None locally (Ollama exposes no KV stats)
+    cost_usd: float | None  # None when no price entry (local = unpriced)
+    cost_basis: str  # "local-unpriced" | "price-map"
+    success: bool
+    error: str
+
+
+def price_for(model: str) -> float | None:
+    """USD per 1M tokens (blended) — empty map until cloud providers land."""
+    _PRICE_MAP: dict[str, float] = {
+        # intentionally empty: local models are unpriced; cloud entries
+        # land here with #29 (provider registry)
+    }
+    return _PRICE_MAP.get(model)
+
+
+def record_trace(trace: InferenceTrace, trace_dir: Path | None = None) -> Path:
+    """Append one JSONL line; rotate at TRACE_ROTATE_BYTES (TRACE_BACKUPS).
+
+    Rotation is manual (shift .3→.2→.1, current→.1) mirroring the spirit of
+    _log_token_usage's size-cap approach, with the plan's backup count.
+    """
+    path = _trace_path(trace_dir)
+    path.parent.mkdir(parents=True, exist_ok=True)
+
+    if path.exists() and path.stat().st_size > TRACE_ROTATE_BYTES:
+        # I1 (general-182): the guard must test the SOURCE (newer) existing —
+        # guarding on the destination silently collapses the chain to 1 backup
+        # (.2 is never created, so .1->.2 never fires). Range covers
+        # i = BACKUPS..1 so the oldest slot (.3 with BACKUPS=3) is reachable.
+        for i in range(TRACE_BACKUPS, 0, -1):
+            older = path.with_name(f"{path.name}.{i}")
+            newer = path.with_name(f"{path.name}.{i - 1}")
+            if i - 1 == 0:
+                newer = path
+            if newer.exists():
+                os.replace(newer, older)
+
+    line = json.dumps(asdict(trace), sort_keys=True, separators=(",", ":")) + "\n"
+    with open(path, "a", encoding="utf-8") as handle:
+        handle.write(line)
+    return path
+
+
+def read_traces(trace_dir: Path | None = None, limit: int | None = None) -> list[dict]:
+    """Read back trace records (oldest → newest); consumers #25/#28/#29."""
+    path = _trace_path(trace_dir)
+    if not path.exists():
+        return []
+    lines = path.read_text(encoding="utf-8").splitlines()
+    if limit is not None:
+        lines = lines[-limit:]
+    return [json.loads(line) for line in lines if line.strip()]
+
+
+def main() -> int:
+    """CLI: tail the trace file (operator debugging aid)."""
+    count = int(sys.argv[1]) if len(sys.argv) > 1 else 10
+    for record in read_traces(limit=count):
+        print(json.dumps(record, indent=2, sort_keys=True))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

src/rune/local_tool_runtime.py

@@ -4,6 +4,8 @@ from __future__ import annotations
 
 import copy
 import json
+import logging
+import threading
 import urllib.request
 from typing import Callable, Protocol, Sequence, TypedDict, cast
 
@@ -29,6 +31,20 @@ from .tool_protocol import (
     to_ollama_tools,
 )
 
+LOG = logging.getLogger("rune.context_broker")
+
+#: Conservative context window used ONLY when /api/show discovery fails;
+#: the failure is recorded via the P0-06 registry (T1) — never silent.
+CONTEXT_LENGTH_FALLBACK = 8192
+
+#: Module-level context-length cache (Task 2 #19): one /api/show per model
+#: per process. Keyed by model id; failures are NOT cached (retry next turn).
+_CONTEXT_LENGTHS: dict[str, int] = {}
+_CONTEXT_LENGTH_LOCK = threading.Lock()
+
+#: Fallback tool prompt is runtime-owned but traced — once per session.
+_FALLBACK_PROMPT_TRACED: set[str] = set()
+
 
 class ChatMessage(TypedDict, total=False):
     """Ollama chat message fields used by the runtime."""
@@ -62,10 +78,22 @@ class ChatTransport(Protocol):
 class OllamaChatTransport:
     """Small stdlib transport for Ollama's ``/api/chat`` and ``/api/show``."""
 
+    #: Provider identity for durable inference traces (P0-07 #23).
+    provider = "ollama"
+
     def __init__(self, base_url: str = "http://localhost:11434", timeout: float = 120):
         self.base_url = base_url.rstrip("/")
         self.timeout = timeout
         self._capabilities: dict[str, frozenset[str]] = {}
+        self._context_lengths: dict[str, int] = {}
+        self.last_prompt_eval_count: int | None = None
+        # P0-07 (#23) usage accumulators: the raw material for the durable
+        # trace. Additive only — last_prompt_eval_count behavior (calibration)
+        # is unchanged.
+        self.usage_calls: int = 0
+        self.usage_prompt_tokens: int = 0  # sum of prompt_eval_count
+        self.usage_output_tokens: int = 0  # sum of eval_count
+        self.usage_total_duration_ns: int = 0  # sum of total_duration
 
     def _post(self, path: str, payload: dict) -> dict:
         request = urllib.request.Request(
@@ -79,6 +107,11 @@ class OllamaChatTransport:
             raise ValueError("Ollama returned a non-object response")
         return decoded
 
+    @staticmethod
+    def _positive_int(value: object) -> int:
+        """Coerce an Ollama usage field to a non-negative int (0 otherwise)."""
+        return value if isinstance(value, int) and not isinstance(value, bool) and value > 0 else 0
+
     def _model_capabilities(self, model: str) -> frozenset[str]:
         if model not in self._capabilities:
             shown = self._post("/api/show", {"model": model})
@@ -88,8 +121,34 @@ class OllamaChatTransport:
                 if isinstance(capabilities, list)
                 else frozenset()
             )
+            # Same /api/show response carries the real context length —
+            # cache it here so discovery costs nothing extra (#19 Task 2).
+            if model not in self._context_lengths:
+                self._context_lengths[model] = _extract_context_length(shown)
         return self._capabilities[model]
 
+    def context_length(self, model: str) -> int:
+        """Return the model's real context window from /api/show (cached).
+
+        Reads ``<arch>.context_length`` from model_info (the trained
+        window — never a hardcoded guess). Raises when the model does
+        not report one; the module-level :func:`context_length` applies
+        the conservative fallback with an observable T1 failure.
+        """
+        if model not in self._context_lengths:
+            shown = self._post("/api/show", {"model": model})
+            self._context_lengths[model] = _extract_context_length(shown)
+        window = self._context_lengths[model]
+        if not window:
+            raise ValueError(f"/api/show reported no context length for {model!r}")
+        try:
+            from rune.context_broker import register_window
+
+            register_window(model, window)
+        except Exception:  # pragma: no cover - broker import is guaranteed
+            pass
+        return window
+
     def supports_tools(self, model: str) -> bool:
         """Return the model's advertised native-tools capability."""
         return "tools" in self._model_capabilities(model)
@@ -120,12 +179,81 @@ class OllamaChatTransport:
         if think is not None:
             payload["think"] = think
         response = self._post("/api/chat", payload)
+        # Served ground truth for broker calibration (#19 Task 2) — the
+        # operator compares this against the broker's measured estimate.
+        eval_count = response.get("prompt_eval_count")
+        self.last_prompt_eval_count = eval_count if isinstance(eval_count, int) and eval_count > 0 else None
+        # P0-07 (#23): accumulate usage from the response envelope. Fields
+        # are optional in practice — missing/non-int values contribute 0.
+        self.usage_calls += 1
+        self.usage_prompt_tokens += self._positive_int(response.get("prompt_eval_count"))
+        self.usage_output_tokens += self._positive_int(response.get("eval_count"))
+        self.usage_total_duration_ns += self._positive_int(response.get("total_duration"))
         message = response.get("message")
         if not isinstance(message, dict):
             raise ValueError("Ollama response is missing a message object")
         return cast(ChatMessage, message)
 
 
+def _extract_context_length(shown: dict) -> int:
+    """Pull the trained context window out of an /api/show response.
+
+    Ollama reports it as ``model_info["<arch>.context_length"]`` (e.g.
+    ``qwen2.context_length``); some builds expose a top-level
+    ``context_length``. Returns 0 when absent (caller decides fallback).
+    """
+    model_info = shown.get("model_info")
+    if isinstance(model_info, dict):
+        for key, value in model_info.items():
+            if key.endswith(".context_length") and isinstance(value, int) and value > 0:
+                return value
+    top_level = shown.get("context_length")
+    if isinstance(top_level, int) and top_level > 0:
+        return top_level
+    return 0
+
+
+def context_length(model: str, base_url: str = "http://localhost:11434") -> int:
+    """Module-level context-length registry with the conservative fallback.
+
+    Cached per model per process (one /api/show). On discovery failure:
+    conservative default 8192 + T1 ``record_failure("context_discovery")``
+    — the assumption is observable, never silent (P0-06).
+    """
+    from rune.subsystem_health import record_failure
+
+    with _CONTEXT_LENGTH_LOCK:
+        cached = _CONTEXT_LENGTHS.get(model)
+    if cached:
+        return cached
+    try:
+        window = OllamaChatTransport(base_url=base_url).context_length(model)
+    except Exception as exc:
+        record_failure("context_discovery", exc, tier=1, context=model)
+        return CONTEXT_LENGTH_FALLBACK
+    with _CONTEXT_LENGTH_LOCK:
+        _CONTEXT_LENGTHS[model] = window
+    return window
+
+
+def reset_context_length_cache() -> None:
+    """Clear the module-level discovery cache (tests + re-discovery).
+
+    I3 (quality gate general-172): also clears the broker's derived
+    window registry — the two caches must not diverge (a model re-pulled
+    under the same tag with a different trained window otherwise keeps
+    the stale value for the process lifetime).
+    """
+    with _CONTEXT_LENGTH_LOCK:
+        _CONTEXT_LENGTHS.clear()
+    try:
+        from rune.context_broker import reset_discovered_windows
+
+        reset_discovered_windows()
+    except ImportError:  # pragma: no cover - same package
+        pass
+
+
 class LocalToolRuntime:
     """Run a bounded model → tools → model loop without mutating caller state."""
 
@@ -145,9 +273,7 @@ class LocalToolRuntime:
         self.model = model
         self.tools = list(TOOLS if tools is None else tools)
         self.tool_names = frozenset(
-            definition["name"]
-            for definition in self.tools
-            if isinstance(definition.get("name"), str)
+            definition["name"] for definition in self.tools if isinstance(definition.get("name"), str)
         )
         self.max_iterations = max_iterations
 
@@ -162,9 +288,7 @@ class LocalToolRuntime:
         conversation = list(copy.deepcopy(messages))
         try:
             native_tools = self.transport.supports_tools(self.model)
-            effective_think = (
-                think if self.transport.supports_thinking(self.model) else None
-            )
+            effective_think = think if self.transport.supports_thinking(self.model) else None
         except Exception as exc:
             return self._failure(f"transport error: {exc}")
 
@@ -195,25 +319,17 @@ class LocalToolRuntime:
             if raw_think is not None and not isinstance(raw_think, (bool, str)):
                 raise ValueError("pending think must be a boolean or string")
             think = raw_think
-            pending_request = self._request_from_state(
-                copy.deepcopy(pending_state["pending_request"])
-            )
+            pending_request = self._request_from_state(copy.deepcopy(pending_state["pending_request"]))
             if pending_request.name not in self.tool_names:
-                raise ValueError(
-                    f"tool not available in this runtime: {pending_request.name}"
-                )
+                raise ValueError(f"tool not available in this runtime: {pending_request.name}")
             raw_events = copy.deepcopy(pending_state.get("tool_events", []))
             if not isinstance(raw_events, list):
                 raise ValueError("pending tool events must be a list")
             events = [self._event_from_state(item) for item in raw_events]
             event_kind = "completed" if tool_result.get("success") else "error"
-            events.append(
-                ToolEvent(event_kind, pending_request, copy.deepcopy(tool_result))
-            )
+            events.append(ToolEvent(event_kind, pending_request, copy.deepcopy(tool_result)))
             raw_thinking = copy.deepcopy(pending_state.get("thinking", []))
-            if not isinstance(raw_thinking, list) or not all(
-                isinstance(item, str) for item in raw_thinking
-            ):
+            if not isinstance(raw_thinking, list) or not all(isinstance(item, str) for item in raw_thinking):
                 raise ValueError("pending thinking must be a list of strings")
             thinking = cast(list[str], raw_thinking)
             messages.append(self._tool_message(pending_request, tool_result))
@@ -275,6 +391,33 @@ class LocalToolRuntime:
         native_definitions = to_ollama_tools(self.tools) if native_tools else None
 
         requests = list(queued_requests or [])
+        # P0-05 (#21) P4: consecutive-identical-failure circuit breaker.
+        # Tracks the last FAILING request signature (tool name + normalized
+        # arguments); a success or a different call resets the streak.
+        last_failure_signature: str | None = None
+        consecutive_failures = 0
+
+        def _register_success() -> None:
+            nonlocal last_failure_signature, consecutive_failures
+            last_failure_signature = None
+            consecutive_failures = 0
+
+        def _register_failure(request: ToolRequest, result: dict) -> str | None:
+            nonlocal last_failure_signature, consecutive_failures
+            signature = f"{request.name}:{json.dumps(request.arguments, sort_keys=True, separators=(',', ':'))}"
+            if signature == last_failure_signature:
+                consecutive_failures += 1
+            else:
+                consecutive_failures = 1
+                last_failure_signature = signature
+            if consecutive_failures >= 2:
+                return (
+                    f"tool {request.name} failed {consecutive_failures} "
+                    "consecutive times with identical arguments — "
+                    "stopping before the iteration budget burns"
+                )
+            return None
+
         while True:
             if requests:
                 for index, request in enumerate(requests):
@@ -283,6 +426,7 @@ class LocalToolRuntime:
                             f"tool not available in this runtime: {request.name}",
                             events,
                             thinking,
+                            iterations_used=iterations_used,
                         )
                     if tool_requires_approval(request):
                         prepared: PreparedTool | None = None
@@ -292,14 +436,23 @@ class LocalToolRuntime:
                             if isinstance(candidate, PreparedTool):
                                 prepared = candidate
                                 result = {
-                                    key: copy.deepcopy(value)
-                                    for key, value in result.items()
-                                    if key != "pending"
+                                    key: copy.deepcopy(value) for key, value in result.items() if key != "pending"
                                 }
                             elif not result.get("needs_confirm"):
                                 kind = "completed" if result.get("success") else "error"
                                 events.append(ToolEvent(kind, request, result))
                                 conversation.append(self._tool_message(request, result))
+                                if result.get("success"):
+                                    _register_success()
+                                else:
+                                    trip = _register_failure(request, result)
+                                    if trip:
+                                        return self._failure(
+                                            trip,
+                                            events,
+                                            thinking,
+                                            iterations_used=iterations_used,
+                                        )
                                 continue
                         else:
                             result = {
@@ -315,14 +468,9 @@ class LocalToolRuntime:
                             "think": think,
                             "iterations_used": iterations_used,
                             "pending_request": self._request_to_state(request),
-                            "tool_events": [
-                                self._event_to_state(event) for event in events
-                            ],
+                            "tool_events": [self._event_to_state(event) for event in events],
                             "thinking": copy.deepcopy(thinking),
-                            "remaining_requests": [
-                                self._request_to_state(item)
-                                for item in requests[index + 1 :]
-                            ],
+                            "remaining_requests": [self._request_to_state(item) for item in requests[index + 1 :]],
                         }
                         if prepared is not None:
                             state["prepared_tool"] = serialize_prepared_tool(prepared)
@@ -333,6 +481,8 @@ class LocalToolRuntime:
                             pending_approval=request,
                             pending_state=state,
                             model=self.model,
+                            iterations_used=iterations_used,
+                            iteration_budget=self.max_iterations,
                         )
                     try:
                         result = dispatch_validated_tool(request, self.executor)
@@ -342,11 +492,26 @@ class LocalToolRuntime:
                     kind = "completed" if result.get("success") else "error"
                     events.append(ToolEvent(kind, request, result))
                     conversation.append(self._tool_message(request, result))
+                    if result.get("success"):
+                        # P0-05: progress invalidates any identical-failure streak.
+                        _register_success()
+                    else:
+                        trip = _register_failure(request, result)
+                        if trip:
+                            return self._failure(
+                                trip,
+                                events,
+                                thinking,
+                                iterations_used=iterations_used,
+                            )
                 requests = []
 
             if iterations_used >= self.max_iterations:
                 return self._failure(
-                    "local tool runtime iteration limit reached", events, thinking
+                    "local tool runtime iteration limit reached",
+                    events,
+                    thinking,
+                    iterations_used=iterations_used,
                 )
 
             try:
@@ -371,9 +536,9 @@ class LocalToolRuntime:
                 )
                 iterations_used += 1
             except ValueError as exc:
-                return self._failure(str(exc), events, thinking)
+                return self._failure(str(exc), events, thinking, iterations_used=iterations_used)
             except Exception as exc:
-                return self._failure(f"transport error: {exc}", events, thinking)
+                return self._failure(f"transport error: {exc}", events, thinking, iterations_used=iterations_used)
 
             thought = assistant.get("thinking")
             if isinstance(thought, str) and thought:
@@ -383,21 +548,28 @@ class LocalToolRuntime:
                 content: object = assistant.get("content", "")
                 if not isinstance(content, str):
                     return self._failure(
-                        "assistant content must be a string", events, thinking
+                        "assistant content must be a string",
+                        events,
+                        thinking,
+                        iterations_used=iterations_used,
                     )
                 try:
                     visible = extract_visible_text(content)
                 except ValueError as exc:
-                    return self._failure(str(exc), events, thinking)
+                    return self._failure(str(exc), events, thinking, iterations_used=iterations_used)
                 if contains_internal_protocol(visible):
                     return self._failure(
-                        "internal tool protocol in final content", events, thinking
+                        "internal tool protocol in final content",
+                        events,
+                        thinking,
+                        iterations_used=iterations_used,
                     )
                 if not visible.strip():
                     return self._failure(
                         "assistant returned empty terminal visible text",
                         events,
                         thinking,
+                        iterations_used=iterations_used,
                     )
                 return OperatorResponse(
                     success=True,
@@ -405,6 +577,8 @@ class LocalToolRuntime:
                     thinking=thinking,
                     tool_events=events,
                     model=self.model,
+                    iterations_used=iterations_used,
+                    iteration_budget=self.max_iterations,
                 )
 
             # The provider's exact assistant object, including call IDs and
@@ -417,9 +591,7 @@ class LocalToolRuntime:
         unique: list[ToolRequest] = []
         seen: set[tuple[str, str]] = set()
         for request in requests:
-            canonical = json.dumps(
-                request.arguments, sort_keys=True, separators=(",", ":")
-            )
+            canonical = json.dumps(request.arguments, sort_keys=True, separators=(",", ":"))
             key = (request.name, canonical)
             if key not in seen:
                 seen.add(key)
@@ -485,6 +657,16 @@ class LocalToolRuntime:
 
     def _with_fallback_prompt(self, messages: list[ChatMessage]) -> list[ChatMessage]:
         fallback = build_tool_prompt(self.tools)
+        # Runtime-owned fallback prompt, traced once per session (#19):
+        # the broker's admission budget must know this ~2.5k-token block
+        # exists even though the runtime, not the broker, injects it.
+        if self.model not in _FALLBACK_PROMPT_TRACED:
+            _FALLBACK_PROMPT_TRACED.add(self.model)
+            LOG.info(
+                "fallback tool prompt injected for model=%s (~%d tokens, runtime-owned, traced)",
+                self.model,
+                len(fallback) // 4,
+            )
         if messages and messages[0].get("role") == "system":
             messages[0]["content"] = f"{messages[0].get('content', '')}\n\n{fallback}"
         else:
@@ -496,6 +678,7 @@ class LocalToolRuntime:
         error: str,
         events: list[ToolEvent] | None = None,
         thinking: list[str] | None = None,
+        iterations_used: int = 0,
     ) -> OperatorResponse:
         return OperatorResponse(
             success=False,
@@ -503,4 +686,6 @@ class LocalToolRuntime:
             tool_events=list(events or []),
             model=self.model,
             error=error,
+            iterations_used=iterations_used,
+            iteration_budget=self.max_iterations,
         )

src/rune/memory_env.py

@@ -43,7 +43,7 @@ def scripts_dir():
     """Return the scripts directory."""
     return expand(os.environ.get(
         "RUNE_SCRIPTS_DIR",
-        os.path.join(rune_home(), "src", "rune")))
+        os.path.dirname(os.path.abspath(__file__))))
 
 
 def store_db():

src/rune/orchestration/composition.py

@@ -14,6 +14,12 @@ from __future__ import annotations
 
 from pathlib import Path
 
+from rune.orchestration.atomic import AtomicStore
+from rune.orchestration.conversation_state import (
+    ConversationStateAuthority,
+    ConversationStateRepository,
+    TaskStateRepository,
+)
 from rune.orchestration.event_store import DurableEventStore
 from rune.orchestration.evidence_store import EvidenceStore
 
@@ -28,6 +34,8 @@ AUTHORITY_KINDS = (
     "outbox_reconciler",
     "surface_registry",
     "surface_gateway",
+    "conversation_state",
+    "task_state",
 )
 
 
@@ -94,3 +102,26 @@ def compose_surface_parity(root: CompositionRoot, paths_root: Path) -> None:
     authority = build_surface_parity(Path(paths_root))
     root.register("surface_registry", authority.registry)
     root.register("surface_gateway", authority.gateway)
+
+
+def compose_conversation_state(root: CompositionRoot, state_dir: Path) -> "ConversationStateAuthority":
+    """Wire one TaskStateRepository + one ConversationStateRepository (#18).
+
+    Both repositories share the root's single event store and one hot
+    checkpoint directory, so the durable log and the hot state stay in
+    one place per composition root.
+    """
+    events = root.get("event_store")  # requires build_root() wiring first
+    hot = AtomicStore(Path(state_dir) / "hot")
+    tasks = TaskStateRepository(events, hot)
+    conversation = ConversationStateRepository(events, hot, tasks=tasks)
+    root.register("task_state", tasks)
+    root.register("conversation_state", conversation)
+    return ConversationStateAuthority(task_state=tasks, conversation=conversation)
+
+
+def build_conversation_state(paths: dict) -> CompositionRoot:
+    """Full composition root including the conversation/task authorities."""
+    root = build_root(paths)
+    compose_conversation_state(root, Path(paths["state"]))
+    return root

src/rune/orchestration/conversation_state.py

@@ -0,0 +1,450 @@
+"""Canonical ConversationState and TaskState repositories (#18 / P0-02).
+
+Two repositories form the single conversation/task authority:
+
+- **TaskStateRepository** — canonical task identity. One task persists
+  until an explicit transition; follow-ups AMEND the active task (same
+  task_id, new title) instead of minting a new one.
+- **ConversationStateRepository** — durable message history. The TUI's
+  ChannelView.messages and the operator's model context become
+  projections over this ledger, not rewrites of it.
+
+Persistence split (Plan 1 primitives):
+
+- every transition and every message appends a typed marker envelope to
+  the `DurableEventStore` (payload_hash = sha256 of the record body) and
+  flushes it before the checkpoint moves, so the log is the durable
+  record that a transition happened;
+- full record bodies live in `AtomicStore` hot checkpoints
+  (crash-atomic temp+fsync+rename) for O(1) reads; the envelope log
+  cannot carry bodies (canonical envelopes are body-free by design), so
+  the checkpoint is the recovery source and a corrupt checkpoint is a
+  typed, loud error — never a silent reset.
+
+Repositories never assemble prompts — that is #19 ContextBroker. All
+public methods take one re-entrant lock because the TUI calls into them
+from workers as well as the main thread (#18 risk 3).
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import threading
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+
+from rune.orchestration.atomic import AtomicStore
+from rune.orchestration.event_store import DurableEventStore
+from rune.orchestration.records import (
+    TASK_STATUSES,
+    ConversationMessageRecord,
+    EventEnvelope,
+    TaskStateRecord,
+)
+
+OPEN_TASK_STATUSES = frozenset({"created", "running", "awaiting_approval"})
+
+#: Legal status edges. Terminal states accept no outgoing edges.
+#: Legal status edges. Self-edges on non-terminal states allow idempotent
+#: re-assertion (chained approvals re-enter awaiting_approval; amend-while-
+#: running re-enters running) — without them, call sites that re-assert the
+#: current state crash with IllegalTaskTransitionError (P0-02 quality B1/B2).
+TASK_TRANSITIONS: dict[str, frozenset[str]] = {
+    "created": frozenset({"created", "running", "awaiting_approval", "completed", "failed", "cancelled", "superseded"}),
+    "running": frozenset({"running", "awaiting_approval", "completed", "failed", "cancelled", "superseded"}),
+    "awaiting_approval": frozenset({"awaiting_approval", "running", "completed", "failed", "cancelled", "superseded"}),
+    "completed": frozenset(),
+    "failed": frozenset(),
+    "cancelled": frozenset(),
+    "superseded": frozenset(),
+}
+
+_EVT_CREATED = "task_state.created"
+_EVT_AMENDED = "task_state.amended"
+_EVT_TRANSITION = "task_state.transition"
+_EVT_IMPORTED = "task_state.imported"
+_EVT_MESSAGE = "conversation.message"
+
+_HOT_TASKS = "task_state.json"
+_HOT_MSGS = "conversation_messages.json"
+
+SNAPSHOT_SCHEMA_VERSION = 1
+
+
+class IllegalTaskTransitionError(ValueError):
+    """A status move outside the canonical spine was requested."""
+
+
+class CorruptStateCheckpointError(RuntimeError):
+    """The hot checkpoint is unreadable; the operator degrades loudly."""
+
+
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _payload_hash(record: TaskStateRecord | ConversationMessageRecord) -> str:
+    canonical = json.dumps(record.to_dict(), sort_keys=True, separators=(",", ":"))
+    return "sha256:" + hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+
+
+class TaskStateRepository:
+    """Canonical task identity for every channel (single authority)."""
+
+    def __init__(self, events: DurableEventStore, hot: AtomicStore):
+        self._events = events
+        self._hot = hot
+        self._lock = threading.RLock()
+        self._tasks: dict[str, TaskStateRecord] = {}
+        self._active: dict[str, str] = {}  # channel_id -> open task_id
+        self._load()
+
+    # -- persistence --------------------------------------------------
+
+    def _load(self) -> None:
+        blob = self._hot.read(_HOT_TASKS)
+        if not blob:
+            return
+        try:
+            data = json.loads(blob)
+            tasks = [TaskStateRecord.from_dict(row) for row in data["tasks"]]
+            active = dict(data["active"])
+        except (json.JSONDecodeError, KeyError, TypeError) as exc:
+            raise CorruptStateCheckpointError(f"task-state checkpoint {_HOT_TASKS!r} is corrupt: {exc}") from exc
+        for rec in tasks:
+            self._tasks[rec.task_id] = rec
+        for channel, task_id in active.items():
+            rec = self._tasks.get(task_id)
+            if rec is not None and rec.channel_id == channel and rec.status in OPEN_TASK_STATUSES:
+                self._active[channel] = task_id
+
+    def _checkpoint(self) -> None:
+        self._hot.write(
+            _HOT_TASKS,
+            json.dumps(
+                {
+                    "schema_version": SNAPSHOT_SCHEMA_VERSION,
+                    "tasks": [t.to_dict() for t in self._tasks.values()],
+                    "active": dict(self._active),
+                },
+                sort_keys=True,
+            ),
+        )
+
+    def _log(self, event_type: str, rec: TaskStateRecord) -> None:
+        """Append the transition marker durably, then move the checkpoint."""
+        self._events.append(
+            EventEnvelope(
+                event_type=event_type,
+                partition_key=f"task:{rec.task_id}",
+                actor_id="task_state_repository",
+                payload_hash=_payload_hash(rec),
+            )
+        )
+        self._events.flush()
+        self._checkpoint()
+
+    # -- public API ----------------------------------------------------
+
+    def create(
+        self,
+        title: str,
+        channel_id: str,
+        model: str | None = None,
+        parent_task_id: str | None = None,
+    ) -> TaskStateRecord:
+        rec = TaskStateRecord(
+            title=title,
+            channel_id=channel_id,
+            assigned_model=model,
+            parent_task_id=parent_task_id,
+        )
+        with self._lock:
+            self._tasks[rec.task_id] = rec
+            self._active[channel_id] = rec.task_id
+            self._log(_EVT_CREATED, rec)
+        return rec
+
+    def amend(self, task_id: str, title: str) -> TaskStateRecord:
+        """Follow-up: new title, SAME task_id — the task continues."""
+        with self._lock:
+            rec = self._require(task_id)
+            rec.title = title
+            rec.updated_at = _now()
+            self._log(_EVT_AMENDED, rec)
+            return rec
+
+    def transition(self, task_id: str, new_status: str, outcome_ref: str = "") -> TaskStateRecord:
+        if new_status not in TASK_STATUSES:
+            raise IllegalTaskTransitionError(f"unknown status {new_status!r}; expected one of {TASK_STATUSES}")
+        with self._lock:
+            rec = self._require(task_id)
+            if new_status not in TASK_TRANSITIONS[rec.status]:
+                raise IllegalTaskTransitionError(f"illegal transition {rec.status!r} -> {new_status!r} for {task_id}")
+            rec.status = new_status
+            if outcome_ref:
+                rec.outcome_ref = outcome_ref
+            rec.updated_at = _now()
+            if rec.status not in OPEN_TASK_STATUSES and self._active.get(rec.channel_id) == task_id:
+                del self._active[rec.channel_id]
+            self._log(_EVT_TRANSITION, rec)
+            return rec
+
+    def get_active(self, channel_id: str) -> TaskStateRecord | None:
+        with self._lock:
+            task_id = self._active.get(channel_id)
+            if task_id is not None:
+                rec = self._tasks.get(task_id)
+                if rec is not None and rec.status in OPEN_TASK_STATUSES:
+                    return rec
+            # Pointer missing/stale: repair from the ledger scan.
+            open_tasks = self._open_in_channel(channel_id)
+            if not open_tasks:
+                self._active.pop(channel_id, None)
+                return None
+            rec = max(open_tasks, key=lambda t: t.updated_at)
+            self._active[channel_id] = rec.task_id
+            return rec
+
+    def get(self, task_id: str) -> TaskStateRecord | None:
+        with self._lock:
+            return self._tasks.get(task_id)
+
+    def list_open(self, channel_id: str) -> list[TaskStateRecord]:
+        with self._lock:
+            return sorted(self._open_in_channel(channel_id), key=lambda t: t.updated_at)
+
+    def latest(self, channel_id: str) -> TaskStateRecord | None:
+        """Most recent task in the channel regardless of status (lineage)."""
+        with self._lock:
+            channel_tasks = [t for t in self._tasks.values() if t.channel_id == channel_id]
+            if not channel_tasks:
+                return None
+            return max(channel_tasks, key=lambda t: (t.created_at, t.task_id))
+
+    def import_record(self, record: TaskStateRecord) -> bool:
+        """Migration path: store a record with its original id, verbatim.
+
+        Returns False (and changes nothing) when the task_id already
+        exists, so imports are idempotent.
+        """
+        with self._lock:
+            if record.task_id in self._tasks:
+                return False
+            self._tasks[record.task_id] = record
+            if record.status in OPEN_TASK_STATUSES:
+                self._active.setdefault(record.channel_id, record.task_id)
+            self._log(_EVT_IMPORTED, record)
+            return True
+
+    def restore_active(self, channel_id: str, task_id: str) -> bool:
+        """Point the channel's active pointer at an open task (migration)."""
+        with self._lock:
+            rec = self._tasks.get(task_id)
+            if rec is None or rec.channel_id != channel_id or rec.status not in OPEN_TASK_STATUSES:
+                return False
+            self._active[channel_id] = task_id
+            self._checkpoint()
+            return True
+
+    # -- internals ------------------------------------------------------
+
+    def _open_in_channel(self, channel_id: str) -> list[TaskStateRecord]:
+        return [t for t in self._tasks.values() if t.channel_id == channel_id and t.status in OPEN_TASK_STATUSES]
+
+    def _require(self, task_id: str) -> TaskStateRecord:
+        rec = self._tasks.get(task_id)
+        if rec is None:
+            raise KeyError(f"unknown task_id {task_id!r}")
+        return rec
+
+
+class ConversationStateRepository:
+    """Durable message history per channel (single authority)."""
+
+    def __init__(
+        self,
+        events: DurableEventStore,
+        hot: AtomicStore,
+        tasks: TaskStateRepository | None = None,
+    ):
+        self._events = events
+        self._hot = hot
+        self._tasks = tasks
+        self._lock = threading.RLock()
+        self._messages: dict[str, list[ConversationMessageRecord]] = {}
+        self._load()
+
+    # -- persistence --------------------------------------------------
+
+    def _load(self) -> None:
+        blob = self._hot.read(_HOT_MSGS)
+        if not blob:
+            return
+        try:
+            data = json.loads(blob)
+            rows = data["messages"]
+        except (json.JSONDecodeError, KeyError, TypeError) as exc:
+            raise CorruptStateCheckpointError(f"conversation checkpoint {_HOT_MSGS!r} is corrupt: {exc}") from exc
+        for row in rows:
+            msg = ConversationMessageRecord.from_dict(row)
+            self._messages.setdefault(msg.channel_id, []).append(msg)
+
+    def _checkpoint(self) -> None:
+        self._hot.write(
+            _HOT_MSGS,
+            json.dumps(
+                {
+                    "schema_version": SNAPSHOT_SCHEMA_VERSION,
+                    "messages": [m.to_dict() for bucket in self._messages.values() for m in bucket],
+                },
+                sort_keys=True,
+            ),
+        )
+
+    # -- public API ----------------------------------------------------
+
+    def append(self, msg: ConversationMessageRecord) -> ConversationMessageRecord:
+        with self._lock:
+            bucket = self._messages.setdefault(msg.channel_id, [])
+            if any(m.msg_id == msg.msg_id for m in bucket):
+                return msg  # idempotent by msg_id
+            bucket.append(msg)
+            self._events.append(
+                EventEnvelope(
+                    event_type=_EVT_MESSAGE,
+                    partition_key=f"channel:{msg.channel_id}",
+                    actor_id="conversation_state_repository",
+                    payload_hash=_payload_hash(msg),
+                )
+            )
+            self._events.flush()
+            self._checkpoint()
+            return msg
+
+    def window(self, channel_id: str, n: int = 8) -> list[ConversationMessageRecord]:
+        """Last n messages of the channel, chronological order."""
+        with self._lock:
+            if n <= 0:
+                return []
+            return list(self._messages.get(channel_id, [])[-n:])
+
+    def messages_for_task(self, task_id: str) -> list[ConversationMessageRecord]:
+        with self._lock:
+            out = [m for bucket in self._messages.values() for m in bucket if m.task_id == task_id]
+            return sorted(out, key=lambda m: m.ts)
+
+    def latest_task(self, channel_id: str) -> TaskStateRecord | None:
+        """Most recent task seen on this channel (any status)."""
+        if self._tasks is None:
+            return None
+        return self._tasks.latest(channel_id)
+
+
+@dataclass
+class ConversationStateAuthority:
+    """Composition bundle for the conversation/task state authorities."""
+
+    task_state: TaskStateRepository
+    conversation: ConversationStateRepository
+
+
+@dataclass
+class MigrationReport:
+    """Outcome of one legacy-ledger import pass."""
+
+    source: str
+    imported: int = 0
+    skipped: int = 0
+    messages: int = 0
+
+
+_LEGACY_CHANNEL = "task"
+
+#: Legacy RuneTask.status -> canonical TaskStateRecord.status.
+_LEGACY_STATUS_MAP = {
+    "pending": "created",
+    "running": "running",
+    "completed": "completed",
+    "failed": "failed",
+}
+
+
+def migrate_operator_tasks(
+    operator_json: Path | str,
+    tasks: TaskStateRepository,
+    conversation: ConversationStateRepository | None = None,
+) -> MigrationReport:
+    """Import the legacy operator.json ledger into the canonical repos (#18).
+
+    Every legacy RuneTask becomes a TaskStateRecord with its ORIGINAL
+    task_id preserved (stable identity across the migration); completed
+    results are reconstructed as user/assistant conversation messages so
+    no history is lost. Idempotent: legacy ids already present are
+    skipped. Unknown legacy statuses raise — fail loudly, never silently
+    drop state (ledger lesson: silent excepts hide breakage).
+    """
+    path = Path(operator_json)
+    report = MigrationReport(source=str(path))
+    if not path.exists():
+        return report
+    data = json.loads(path.read_text(encoding="utf-8"))
+    for row in data.get("tasks", []):
+        legacy_id = row.get("task_id") or ""
+        legacy_status = row.get("status") or ""
+        status = _LEGACY_STATUS_MAP.get(legacy_status)
+        if status is None:
+            raise ValueError(f"legacy task {legacy_id!r} has unknown status {legacy_status!r}")
+        created_at = row.get("created_at") or _now()
+        record = TaskStateRecord(
+            task_id=legacy_id,
+            title=row.get("description") or "",
+            status=status,
+            channel_id=_LEGACY_CHANNEL,
+            assigned_model=row.get("assigned_model"),
+            created_at=created_at,
+            updated_at=row.get("completed_at") or created_at,
+        )
+        if not tasks.import_record(record):
+            report.skipped += 1
+            continue
+        report.imported += 1
+        if conversation is not None:
+            report.messages += _replay_legacy_messages(row, record, conversation)
+    current = data.get("current_task")
+    if current:
+        tasks.restore_active(_LEGACY_CHANNEL, current)
+    return report
+
+
+def _replay_legacy_messages(row: dict, record: TaskStateRecord, conversation: ConversationStateRepository) -> int:
+    count = 0
+    description = record.title
+    if description:
+        conversation.append(
+            ConversationMessageRecord(
+                role="user",
+                content=description,
+                channel_id=record.channel_id,
+                task_id=record.task_id,
+                ts=record.created_at,
+                token_estimate=len(description) // 4,
+            )
+        )
+        count += 1
+    result = row.get("result")
+    if record.status == "completed" and isinstance(result, str) and result.strip():
+        conversation.append(
+            ConversationMessageRecord(
+                role="assistant",
+                content=result,
+                channel_id=record.channel_id,
+                task_id=record.task_id,
+                ts=record.updated_at,
+                token_estimate=len(result) // 4,
+            )
+        )
+        count += 1
+    return count

src/rune/orchestration/event_store.py

@@ -32,8 +32,7 @@ def _assert_canonical(envelope: dict) -> None:
     """
     if not isinstance(envelope, dict) or "event_id" not in envelope:
         raise UnmigratedDialectError(
-            "old-dialect event rejected — run migrate.old_fixture_to_new() "
-            "on the source fixture first"
+            "old-dialect event rejected — run migrate.old_fixture_to_new() on the source fixture first"
         )
     schema = envelope.get("schema_version")
     if schema is not None and schema < 1:
@@ -42,10 +41,7 @@ def _assert_canonical(envelope: dict) -> None:
             "migrate.old_fixture_to_new() on the source fixture first"
         )
     # Legacy body fields never appear on a canonical envelope dict.
-    if any(
-        key in envelope
-        for key in ("payload", "source", "channel", "authority_class", "task_id")
-    ):
+    if any(key in envelope for key in ("payload", "source", "channel", "authority_class", "task_id")):
         raise UnmigratedDialectError(
             "old-dialect event rejected (legacy source/channel/payload "
             "fields present) — run migrate.old_fixture_to_new() on the "
@@ -58,11 +54,14 @@ class DurableEventStore:
         pass
 
     def __init__(self, path: Path, batch_size: int = 8):
+        import threading
+
         self.path = Path(path)
         self.path.parent.mkdir(parents=True, exist_ok=True)
         self.batch_size = max(1, batch_size)
         self._buffer: list[str] = []
         self._offset = self._count_existing_lines()
+        self._lock = threading.RLock()
 
     def _count_existing_lines(self) -> int:
         if not self.path.exists():
@@ -74,6 +73,10 @@ class DurableEventStore:
         return count
 
     def append(self, env: EventEnvelope | dict) -> int:
+        with self._lock:
+            return self._append_inner(env)
+
+    def _append_inner(self, env: EventEnvelope | dict) -> int:
         if isinstance(env, EventEnvelope):
             payload = json.dumps(env.to_dict(), sort_keys=True)
         else:
@@ -96,6 +99,10 @@ class DurableEventStore:
         return self._offset + len(self._buffer)
 
     def flush(self) -> None:
+        with self._lock:
+            self._flush_inner()
+
+    def _flush_inner(self) -> None:
         if not self._buffer:
             return
         with open(self.path, "a", encoding=_ENCODING) as fh:
@@ -124,9 +131,7 @@ class DurableEventStore:
                 try:
                     yield offset, json.loads(line)
                 except json.JSONDecodeError as exc:
-                    raise DurableEventStore.CorruptEventStoreError(
-                        f"corrupt event at offset {offset}: {exc}"
-                    ) from exc
+                    raise DurableEventStore.CorruptEventStoreError(f"corrupt event at offset {offset}: {exc}") from exc
 
     def replay(self) -> list[dict]:
         return [row for _, row in self.read()]

src/rune/orchestration/records.py

@@ -225,3 +225,49 @@ class ProjectionCheckpoint(OrchestrationRecord):
 
     offset: int
     state_hash: str
+
+
+# Canonical task-status spine (#18): created→running→awaiting_approval→
+# completed|failed|cancelled|superseded. The legal edges live in
+# conversation_state.TASK_TRANSITIONS; records carry only the vocabulary.
+TASK_STATUSES = (
+    "created",
+    "running",
+    "awaiting_approval",
+    "completed",
+    "failed",
+    "cancelled",
+    "superseded",
+)
+
+
+@dataclass
+class TaskStateRecord(OrchestrationRecord):
+    """Canonical task identity (#18).
+
+    One task persists until an explicit transition; follow-ups AMEND the
+    active task (same task_id, new title) instead of minting a new one.
+    """
+
+    task_id: str = field(default_factory=lambda: new_id("task"))
+    title: str = ""
+    status: str = "created"
+    channel_id: str = ""
+    parent_task_id: str | None = None
+    assigned_model: str | None = None
+    created_at: str = field(default_factory=_now)
+    updated_at: str = field(default_factory=_now)
+    outcome_ref: str = ""
+
+
+@dataclass
+class ConversationMessageRecord(OrchestrationRecord):
+    """One durable conversation message (#18); appended, never rewritten."""
+
+    msg_id: str = field(default_factory=lambda: new_id("msg"))
+    ts: str = field(default_factory=_now)
+    role: str = "user"  # user | assistant | system | tool
+    content: str = ""
+    channel_id: str = ""
+    task_id: str | None = None
+    token_estimate: int = 0

src/rune/rune_tui.py

@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+from __future__ import annotations
 """Rune TUI — the body.
 
 Textual-based terminal interface for Rune. Two channels (task + chat),
@@ -6,7 +7,7 @@ mode system, subject header, shared memory and identity.
 
 This is not an interface. This is how I see, speak, and interact with the world.
 
-Version: v0.49.0
+Version: v0.50.0
 Features: 41 (24 original + 17 new native commands)
 
 Usage:
@@ -88,6 +89,13 @@ import drift_ledger
 from chat_bubble import MessageBox, ThinkingBubble
 from message_widgets import ToolCallWidget
 
+import rune  # noqa: E402  — module-level import; VersionLabel reads rune.__version__ at call time
+from rune.subsystem_health import (  # noqa: E402  — P0-06 observable failures
+    configure_logging,
+    record_failure,
+    registry,
+)
+
 try:
     BACKEND_AVAILABLE = True
 except ImportError:
@@ -164,6 +172,9 @@ def _handle_worker_error(error: Exception, context: str, ch):
     error_type = type(error).__name__
     error_msg = str(error)[:200]
 
+    # P0-06: every worker failure is journaled as a subsystem event too.
+    record_failure("rune_tui", error, tier=1, context=context)
+
     # Determine fix based on error type
     fix = "unknown"
     if "non-async" in error_msg or "WorkerError" in error_type:
@@ -933,6 +944,15 @@ def _save_model_state(model: str):
         _log.debug("Failed to save model state", exc_info=True)
 
 
+class VersionLabel(Static):
+    """Footer semver display — derived from the canonical __version__."""
+
+    def render(self) -> str:
+        # Read the module attribute AT CALL TIME so the label is reactive to
+        # the installed release (see plans/2026-09-03-tui-footer.md, test 2).
+        return f"[dim]v{rune.__version__}[/dim]"
+
+
 class StatusBar(Static):
     """Status bar showing mode, model, and system state with visual indicators."""
 
@@ -1095,11 +1115,33 @@ class ChannelView(Vertical):
         yield AutoComplete(inp, candidates=get_autocomplete_candidates)
 
     def on_mount(self) -> None:
-        """Load persisted input history."""
+        """Load persisted input history + project canonical history (#18)."""
         all_history = _load_history()
         entries = all_history.get(self.channel_id, [])
         inp = self.query_one(f"#input-{self.channel_id}", HistoryInput)
         inp.load_history(entries)
+        self._project_conversation_history()
+
+    def _project_conversation_history(self) -> None:
+        """Project the canonical conversation ledger into this channel (#18).
+
+        ChannelView.messages stays a display projection — the durable
+        history lives in ConversationStateRepository. Best-effort: the
+        TUI must never fail to mount because the ledger is unavailable.
+        """
+        try:
+            window = rune_operator.get_conversation_window(self.channel_id, n=8)
+        except Exception:
+            return
+        for msg in window:
+            self.messages.append(
+                {
+                    "role": msg.get("role", "system"),
+                    "content": msg.get("content", ""),
+                    "time": (msg.get("ts") or "")[11:16],
+                    "metadata": None,
+                }
+            )
 
     def on_click(self) -> None:
         """Click on channel focuses its input."""
@@ -1157,6 +1199,12 @@ class RuneApp(App):
         padding: 0 1;
     }
 
+    #version-label {
+        width: auto;
+        color: $text-muted;
+        padding: 0 1;
+    }
+
     .refresh-icon {
         width: 4;
         height: 1;
@@ -1281,6 +1329,15 @@ class RuneApp(App):
         saved = _load_model_state()
         if saved and saved != "local":
             self.model = saved
+        # P0-06: give the rune loggers a real destination (once per process).
+        # Guarded so a read-only home or a test environment never blocks TUI
+        # startup; tests call configure_logging() with an explicit log_dir.
+        if not getattr(RuneApp, "_logging_configured", False):
+            RuneApp._logging_configured = True
+            try:
+                configure_logging()
+            except OSError as exc:
+                print(f"rune: logging unavailable ({exc})", file=sys.stderr)
 
     def compose(self) -> ComposeResult:
         yield Header()
@@ -1298,6 +1355,7 @@ class RuneApp(App):
                 id="chat-channel",
             )
         with Horizontal(id="footer-bar"):
+            yield VersionLabel(id="version-label")
             yield StatusBar(id="status-bar")
             yield Static("🔄", id="refresh-btn", classes="refresh-icon")
         yield CommandSelector(id="command-selector")
@@ -1643,13 +1701,16 @@ class RuneApp(App):
                     "system",
                     f"[dim]◆ {len(providers)} cloud providers configured[/dim]",
                 )
-        except Exception:
-            pass
+        except Exception as exc:  # P0-06: observable degrade (T1)
+            if record_failure("provider_registry", exc, tier=1):
+                self.chat_channel.add_message(
+                    "system", "[dim]⚠ provider registry unavailable[/dim]"
+                )
 
         # Show version info
         self.chat_channel.add_message(
             "system",
-            f"[dim]Rune v0.49.0 | Textual TUI | {len(loaded)} native modules[/dim]",
+            f"[dim]Rune v0.50.0 | Textual TUI | {len(loaded)} native modules[/dim]",
         )
 
         # Auto-show night mode suggestion if evening/night hours
@@ -1933,58 +1994,16 @@ class RuneApp(App):
         # Add user message to the channel
         ch.add_message("user", text)
 
-        # Auto-context: build context from memory and warm neurons (native)
-        # Run independent operations in parallel for speed
-        if BACKEND_AVAILABLE:
-            try:
-                # Define independent tasks
-                def build_context():
-                    return auto_context.build_auto_context(text)
-
-                def extract_tasks():
-                    return auto_tasks.extract_tasks(text, channel)
-
-                def match_behavior():
-                    return behavior.match_context(text)
-
-                # Run in parallel
-                results = parallel_processor.run_parallel(
-                    [
-                        build_context,
-                        extract_tasks,
-                        match_behavior,
-                    ]
-                )
-
-                # Process results
-                context = results[0] if len(results) > 0 else None
-                tasks = results[1] if len(results) > 1 else None
-                matches = results[2] if len(results) > 2 else None
-
-                if context:
-                    ch.add_message(
-                        "system", f"[dim]🧠 Auto-context: {len(context)} items[/dim]"
-                    )
-                if tasks:
-                    ch.add_message(
-                        "system", f"[dim]📋 Auto-tasks: {len(tasks)} extracted[/dim]"
-                    )
-                if matches:
-                    ch.add_message(
-                        "system", f"[dim]🔄 Behavior: {len(matches)} matches[/dim]"
-                    )
-            except Exception:
-                pass
-
-        # Route with mode-specific behavior
-        # Warm router runs in a thread (I/O-bound), model call runs async (mounts widgets)
-        def _warm_router_thread():
-            """Run warm router in a thread — I/O-bound, no widget access."""
-            try:
-                self._run_warm_router(text, channel=channel)
-            except Exception as e:
-                _handle_worker_error(e, f"warm router for {channel}", ch)
+        # P0-04 (#20): no per-message cognitive pipeline. The pre-dispatch
+        # parallel block (auto_context / auto_tasks / behavior) and the
+        # warm-router thread are gone — both were display-only while carrying
+        # live side effects (neuron mutation, sleep consolidation, event
+        # spam). The ContextBroker (#19) owns all model-facing context;
+        # /commands and startup checks keep every capability reachable on
+        # demand. See docs/pipeline-removal.md.
 
+        # Route with mode-specific behavior — the model call goes straight
+        # to the operator (which assembles context via the ContextBroker).
         async def _model_call_async():
             """Run model call on main thread — mounts widgets, needs event loop."""
             try:
@@ -1997,15 +2016,12 @@ class RuneApp(App):
                 self._capture_idea(text)
                 ch.add_message("system", "[dim]Idea captured. Task continues.[/dim]")
             else:
-                self.run_worker(_warm_router_thread, thread=True)
                 self.run_worker(_model_call_async, exclusive=True)
         elif self.mode == "build" or self.mode == "research" or self.mode == "plan":
-            self.run_worker(_warm_router_thread, thread=True)
             self.run_worker(_model_call_async, exclusive=True)
         else:
             if not self.planning_active and self._detect_planning_threshold(text):
                 self._start_planning(text, "chat")
-            self.run_worker(_warm_router_thread, thread=True)
             self.run_worker(_model_call_async, exclusive=True)
 
     def _is_idea(self, text: str) -> bool:
@@ -2376,6 +2392,29 @@ class RuneApp(App):
         except Exception as e:
             self._ch().add_message("system", f"[dim]Error loading events: {e}[/dim]")
 
+    def _cmd_health(self, arg):
+        """P0-06: per-subsystem failure ledger + event-bus stats."""
+        try:
+            snapshot = registry().snapshot()
+            lines = ["[bold]🩺 Subsystem Health[/bold]"]
+            if not snapshot:
+                lines.append("  all subsystems healthy")
+            else:
+                for name, entry in sorted(snapshot.items()):
+                    lines.append(
+                        f"  {name}: failures={entry.get('failures', 0)} "
+                        f"tier={entry.get('tier', '?')} "
+                        f"last_error={entry.get('last_error', '')}"
+                    )
+            try:
+                total, _ = event_bus.stats()
+                lines.append(f"  [dim]event journal: {total} events[/dim]")
+            except Exception as e:
+                lines.append(f"  [dim]event journal unavailable: {e}[/dim]")
+            self._ch().add_message("system", "\n".join(lines))
+        except Exception as e:
+            self._ch().add_message("system", f"[dim]Error loading health: {e}[/dim]")
+
     def _cmd_plugins(self, arg):
         try:
             status = microkernel.status()
@@ -3337,7 +3376,7 @@ class RuneApp(App):
     def _cmd_help(self, arg):
         self._ch().add_message(
             "system",
-            "Commands:\n  /project <name> — set subject header\n  /mode <mode> — switch mode (task/chat/build/research/plan)\n  /model <model> — switch model (local/cloud/auto/<name>)\n  /theme <name> — switch theme\n  /persona — show defining principles\n  /abstraction — show abstraction pipeline stats\n  /claims — show claim audit report\n  /neurons — show warm neuron stats\n  /graph — show graph memory stats\n  /pressure — show context pressure\n  /events — show event bus stats\n  /plugins — show microkernel status\n  /env — show environment info\n  /persona-gate — show persona gate decision\n  /hooks — show hook engine status\n  /growth — show growth delta\n  /improve — show self-improvement suggestions\n  /voice — show voice blend\n  /voice-sync — show voice sync status\n  /drift — show drift ledger status\n  /sleep — show sleep-time status\n  /providers — show connected providers\n  /connect <name> <url> [type] — connect to provider\n  /disconnect <name> — disconnect from provider\n  /rune — show Rune's status\n  /goal [set|check|achieve|clear|list] — manage goals\n  /cron [list|add|remove|run|status] — scheduled tasks\n  /night [start|stop|status|report] — night mode\n  /time — show time awareness\n  /tokens — show token optimization\n  /budget — show provider budgets\n  /dream — consolidate memories\n  /audit — full codebase audit against llm-craft\n  /help — show this help",
+            "Commands:\n  /project <name> — set subject header\n  /mode <mode> — switch mode (task/chat/build/research/plan)\n  /model <model> — switch model (local/cloud/auto/<name>)\n  /theme <name> — switch theme\n  /persona — show defining principles\n  /abstraction — show abstraction pipeline stats\n  /claims — show claim audit report\n  /neurons — show warm neuron stats\n  /graph — show graph memory stats\n  /pressure — show context pressure\n  /events — show event bus stats\n  /health — show subsystem health (failures, tiers, last errors)\n  /plugins — show microkernel status\n  /env — show environment info\n  /persona-gate — show persona gate decision\n  /hooks — show hook engine status\n  /growth — show growth delta\n  /improve — show self-improvement suggestions\n  /voice — show voice blend\n  /voice-sync — show voice sync status\n  /drift — show drift ledger status\n  /sleep — show sleep-time status\n  /providers — show connected providers\n  /connect <name> <url> [type] — connect to provider\n  /disconnect <name> — disconnect from provider\n  /rune — show Rune's status\n  /goal [set|check|achieve|clear|list] — manage goals\n  /cron [list|add|remove|run|status] — scheduled tasks\n  /night [start|stop|status|report] — night mode\n  /time — show time awareness\n  /tokens — show token optimization\n  /budget — show provider budgets\n  /dream — consolidate memories\n  /audit — full codebase audit against llm-craft\n  /help — show this help",
         )
 
     # ── Dispatch table ────────────────────────────────────────────────
@@ -3358,6 +3397,7 @@ class RuneApp(App):
         "/graph": _cmd_graph,
         "/pressure": _cmd_pressure,
         "/events": _cmd_events,
+        "/health": _cmd_health,
         "/plugins": _cmd_plugins,
         "/env": _cmd_env,
         "/persona-gate": _cmd_persona_gate,
@@ -3389,354 +3429,29 @@ class RuneApp(App):
     }
 
     def _run_warm_router(self, text: str, channel: str):
-        """Auto-context pipeline — all backend systems, native calls.
+        """Compat no-op — the per-turn cognitive pipeline was removed (P0-04, #20).
 
-        Runs: warm router → capability broker → memory recall → witness → cache.
-        All deterministic, no model cost. No subprocess overhead.
+        This method used to run 21 steps on EVERY user message (warm router,
+        capability broker, memory recall, witness, cache, persona, abstraction,
+        graph, pressure, event emit, drift check, goals, time, neurons, hooks,
+        voice, sleep consolidation, repo map, auto-read, auto-search, memory
+        filter — ~390 lines, ~120 ms per message). A timer firing must not
+        simulate consciousness: the pipeline's model-relevant output was zero
+        (display-only dim status line) while carrying live side effects
+        (neuron state mutation, hooks, sleep consolidation, event spam).
+
+        Where things live now:
+        - ALL model-facing context flows through the ContextBroker
+          (rune_operator.RuneOperator._context_broker, #19) — untouched.
+        - Every former capability remains available ON DEMAND via /commands
+          (/drift, /pressure, /events, /health, /neurons, /graph, /sleep, ...)
+          and by calling the modules directly. Nothing was deleted.
+        - Session-scoped startup checks (compile_persona, scan_registry,
+          load_tasks) still run at on_mount — they were never per-turn.
+        - Background cognition becomes meaningful-event triggered (#48 owns
+          the full trigger engine); the first endogenous seed is the
+          operator's task.failed emit on send_task failure.
         """
-        if not BACKEND_AVAILABLE:
-            return
-
-        ch = self.task_channel if channel == "task" else self.chat_channel
-        context_parts = []
-
-        # Extract words once — used by memory recall, abstraction, graph memory
-        words = [w for w in text.lower().split() if len(w) > 4 and w.isalpha()]
-
-        # --- Steps 1-4: independent, run in parallel ---
-
-        def _step_warm_router():
-            fired, total, scores = warm_router.route(text)
-            result = {}
-            if fired:
-                slugs = [f.get("slug", "?") for f in fired[:3]]
-                result["context"] = f"🧠 {', '.join(slugs)}"
-                result["neurons"] = len(fired)
-            return result
-
-        def _step_capability_broker():
-            matches = capability_broker.match_capabilities(query=text, top_k=3)
-            if matches:
-                names = [m.get("name", "?") for m in matches[:3]]
-                return {"context": f"⚡ {', '.join(names)}"}
-            return {}
-
-        def _step_memory_recall():
-            top_words = words[:5]
-            if top_words:
-                query = " ".join(top_words)
-                db = memory_store.connect()
-                results = memory_store.cached_recall(db, query, budget=3)
-                db.close()
-                if results:
-                    summaries = [r.get("text", "")[:60] for r in results[:2]]
-                    return {"context": f"💭 {'; '.join(summaries)}"}
-            return {}
-
-        def _step_witness():
-            signals = witness.detect_signals(message=text)
-            if signals:
-                sig_names = list(signals.keys())[:3]
-                return {"context": f"👁 {', '.join(sig_names)}"}
-            return {}
-
-        try:
-            parallel_results = parallel_processor.run_parallel(
-                [
-                    _step_warm_router,
-                    _step_capability_broker,
-                    _step_memory_recall,
-                    _step_witness,
-                ]
-            )
-            for result in parallel_results:
-                if isinstance(result, dict):
-                    if "context" in result:
-                        context_parts.append(result["context"])
-                    if "neurons" in result:
-                        self.status_bar.neurons = result["neurons"]
-        except Exception:
-            pass
-
-        # --- Steps 5-11: sequential (some depend on channel state) ---
-
-        # 5. Cache check (native call)
-        try:
-            cache_key = f"response:{text[:50].lower()}"
-            cached = cache.get_cache(cache_key)
-            if cached and cached.get("hit"):
-                self.status_bar.cache_hits += 1
-        except Exception:
-            pass
-
-        # 6. Persona/identity context (native call)
-        try:
-            principles = prompt_sync.get_defining_principles()
-            if principles:
-                # Just note that principles are loaded, don't dump them
-                context_parts.append("🎭 persona loaded")
-        except Exception:
-            pass
-
-        # 7. Abstraction pipeline — check for relevant facts (native call)
-        try:
-            top_words = words[:3]
-            if top_words:
-                db = abstraction.connect()
-                # Check for relevant facts (parameterized queries to prevent SQL injection)
-                placeholders = " OR ".join(["what LIKE ?" for _ in top_words])
-                params = [f"%{w}%" for w in top_words]
-                facts = db.execute(
-                    f"SELECT what FROM facts WHERE status='active' AND ({placeholders}) LIMIT 2",
-                    params,
-                ).fetchall()
-                if facts:
-                    fact_texts = [f[0][:50] for f in facts]
-                    context_parts.append(f"📚 {'; '.join(fact_texts)}")
-                db.close()
-        except Exception:
-            pass
-
-        # 8. Graph memory — check for relevant entities (native call)
-        try:
-            top_words = words[:3]
-            if top_words:
-                db = graph_memory.connect()
-                for word in top_words:
-                    entity = graph_memory.resolve_entity(db, word)
-                    if entity:
-                        context_parts.append(f"🕸 entity: {entity.get('name', word)}")
-                        break
-                db.close()
-        except Exception:
-            pass
-
-        # 9. Context pressure — monitor token usage (native call)
-        try:
-            recent = ch.messages[-5:] if hasattr(ch, "messages") else []
-            recent_text = " ".join([m.get("content", "") for m in recent])
-            if recent_text:
-                pressure = context_pressure.measure_pressure(recent_text)
-                if pressure and pressure.get("pressure", 0) > 0.8:
-                    context_parts.append(f"⚠ pressure: {pressure['pressure']:.0%}")
-                    # Auto-fire pressure report when critical (>90%)
-                    if pressure.get("pressure", 0) > 0.9:
-                        try:
-                            self._cmd_pressure("")
-                        except Exception:
-                            pass
-        except Exception:
-            pass
-
-        # 10. Event bus — emit context event (native call)
-        try:
-            event_bus.emit(
-                "on_context", payload={"text": text[:100], "channel": channel}
-            )
-        except Exception:
-            pass
-
-        # 11. Drift ledger — check for drift alerts (native call)
-        try:
-            drift_result = drift_ledger.check(strict=False, autofix=False)
-            if drift_result and isinstance(drift_result, dict):
-                alerts = drift_result.get("alerts", [])
-                if alerts:
-                    context_parts.append(f"🛡 drift: {len(alerts)} alerts")
-                    # Auto-fire drift report when alerts found
-                    try:
-                        self._cmd_drift("")
-                    except Exception:
-                        pass
-        except Exception:
-            pass
-
-        # 12. Goal status — auto-check if goal is active (native call)
-        try:
-            if BACKEND_AVAILABLE:
-                goal_data = task_persist.load()
-                goals = goal_data.get("goals", [])
-                active_goals = [g for g in goals if g.get("status") == "active"]
-                if active_goals:
-                    context_parts.append(f"🎯 {len(active_goals)} active goals")
-        except Exception:
-            pass
-
-        # 13. Time awareness — auto-update per message (native call)
-        try:
-            if BACKEND_AVAILABLE:
-                time_data = time_awareness.get_time_context()
-                if time_data:
-                    context_parts.append(f"🕐 {time_data.get('period', 'unknown')}")
-                    # Auto-detect night mode
-                    if time_data.get("period") in ("evening", "night"):
-                        try:
-                            night_mode.auto_enable()
-                        except Exception:
-                            pass
-        except Exception:
-            pass
-
-        # 14. Neuron count — auto-show in status bar (native call)
-        try:
-            if BACKEND_AVAILABLE:
-                neuron_data = warm_neuron_store.get_stats()
-                if neuron_data:
-                    self.status_bar.neurons = neuron_data.get("count", 0)
-        except Exception:
-            pass
-
-        # 15. Hooks — auto-fire before model call (native call)
-        try:
-            if BACKEND_AVAILABLE:
-                hook_engine.fire(
-                    "pre_message", {"text": text[:100], "channel": channel}
-                )
-        except Exception:
-            pass
-
-        # 16. Voice blend — auto-blend on mode change (native call)
-        try:
-            if BACKEND_AVAILABLE:
-                voice_data = voice_hybrid.get_blend_info()
-                if voice_data:
-                    context_parts.append(
-                        f"🎭 voice: {voice_data.get('blend', 'unknown')}"
-                    )
-        except Exception:
-            pass
-
-        # 17. Sleep consolidation — auto-trigger on idle (native call)
-        try:
-            if BACKEND_AVAILABLE:
-                last_activity = time_awareness.get_last_activity()
-                if last_activity:
-                    import time
-
-                    idle_seconds = time.time() - last_activity
-                    if idle_seconds > 1800:  # 30 minutes
-                        sleep_time.consolidate()
-                        context_parts.append("💤 sleep consolidation triggered")
-        except Exception:
-            pass
-
-        # ═══════════════════════════════════════════════════════════════════
-        # AMBIENT CONTEXT — tools as limbs (research-backed)
-        # ═══════════════════════════════════════════════════════════════════
-
-        # 18. Ambient repo map — always provide codebase structure (Aider pattern)
-        # Research: "Provide a map, not the territory" — 1K tokens, always present
-        try:
-            import tool_executor
-
-            repo_result = tool_executor.execute_tool(
-                "repo_map", {"path": "/mnt/workdrive/rune/src"}
-            )
-            if repo_result.get("success") and repo_result.get("result"):
-                # Truncate to ~500 tokens (Aider default is 1K, we use half for ambient)
-                repo_text = repo_result["result"][:2000]
-                if repo_text and repo_text != "(no symbols found)":
-                    context_parts.append(f"🗺 repo: {len(repo_text)} chars")
-                    # Store for model access (not injected, but available)
-                    self._ambient_repo_map = repo_text
-        except Exception:
-            pass
-
-        # 19. Auto-read files — when paths are mentioned, read them (Cursor pattern)
-        # Research: "Files as universal interface" — model sees files without asking
-        try:
-            import re
-
-            # Detect file paths in the message
-            file_patterns = re.findall(r"(?:^|\s)([/~][\w/.-]+\.\w+)", text)
-            if file_patterns:
-                for fpath in file_patterns[:3]:  # Limit to 3 files
-                    read_result = tool_executor.execute_tool(
-                        "read_file", {"path": fpath.strip(), "limit": 50}
-                    )
-                    if read_result.get("success") and read_result.get("result"):
-                        # Store for model access
-                        if not hasattr(self, "_ambient_files"):
-                            self._ambient_files = {}
-                        self._ambient_files[fpath.strip()] = read_result["result"][
-                            :1000
-                        ]
-                        context_parts.append(f"📄 {os.path.basename(fpath)}")
-        except Exception:
-            pass
-
-        # 20. Auto-search functions — when function names are mentioned, search for them
-        # Research: "Initial context seeding is the highest-leverage intervention"
-        try:
-            import re
-
-            # Detect function/class names (snake_case or CamelCase)
-            func_patterns = re.findall(
-                r"\b([a-z_][a-z0-9_]*|[A-Z][a-zA-Z0-9]*)\b", text
-            )
-            # Filter to likely function names (not common words)
-            stop_words = {
-                "the",
-                "a",
-                "an",
-                "and",
-                "or",
-                "but",
-                "in",
-                "on",
-                "at",
-                "to",
-                "for",
-                "of",
-                "with",
-                "by",
-            }
-            func_candidates = [
-                f for f in func_patterns if f not in stop_words and len(f) > 3
-            ][:3]
-            if func_candidates:
-                for func_name in func_candidates:
-                    search_result = tool_executor.execute_tool(
-                        "grep_files",
-                        {
-                            "pattern": f"def {func_name}|class {func_name}",
-                            "path": "/mnt/workdrive/rune/src",
-                            "include": "*.py",
-                        },
-                    )
-                    if search_result.get("success") and search_result.get("result"):
-                        result_text = search_result["result"]
-                        if result_text and result_text != "(no matches)":
-                            # Store for model access
-                            if not hasattr(self, "_ambient_functions"):
-                                self._ambient_functions = {}
-                            self._ambient_functions[func_name] = result_text[:500]
-                            context_parts.append(f"🔍 {func_name}")
-        except Exception:
-            pass
-
-        # 21. Selective memory — filter by relevance (MemTrapBench finding)
-        # Research: "Memory can be harmful — naive injection is harmful"
-        # Already handled in step 3 (_step_memory_recall), but enhance with filtering
-        try:
-            if hasattr(self, "_ambient_memory_results"):
-                # Filter memories by relevance to current query
-                filtered = []
-                for mem in self._ambient_memory_results:
-                    mem_text = mem.get("text", "").lower()
-                    # Check if memory is relevant to current query
-                    query_words = set(text.lower().split())
-                    mem_words = set(mem_text.split())
-                    overlap = len(query_words & mem_words)
-                    if overlap > 0:
-                        filtered.append(mem)
-                self._ambient_memory_results = filtered[:3]  # Keep only relevant
-        except Exception:
-            pass
-
-        # Show combined context (dimmed, non-intrusive)
-        if context_parts:
-            ch.add_message("system", f"[dim]{' │ '.join(context_parts)}[/dim]")
 
     def _send_to_model(self, text: str, channel: str):
         """Send message through Rune operator.
@@ -3759,8 +3474,10 @@ class RuneApp(App):
         # Use Textual's worker system for better async handling
         async def _respond():
             try:
-                # Rune sends task to model with the selected model
-                result = rune_operator.send_task(text, model=model_name)
+                # Rune sends task to model with the selected model.
+                # channel is forwarded so the canonical task ledger (#18)
+                # keeps per-channel task identity.
+                result = rune_operator.send_task(text, model=model_name, channel=channel)
 
                 # Remove thinking indicator
                 thinking.stop()
@@ -3773,6 +3490,13 @@ class RuneApp(App):
                     model = result.get("model", "unknown")
                     recall_count = result.get("recall_count", 0)
 
+                    # P0-06: operator-side T1 degradations ride the envelope.
+                    for subsystem in result.get("degraded", []) or []:
+                        ch.add_message(
+                            "system",
+                            f"[dim]⚠ {subsystem} unavailable (operator path)[/dim]",
+                        )
+
                     # Update memory indicator on status bar
                     if recall_count > 0:
                         self.status_bar.is_recalling = True
@@ -3996,8 +3720,13 @@ class RuneApp(App):
                     )
                     result = model_connect.route_model(task_type)
                     return result.get("model", "qwen2.5:3b")
-                except Exception:
-                    pass
+                except Exception as exc:  # P0-06: observable fallback (T1)
+                    if record_failure("model_routing", exc, tier=1):
+                        ch = self._ch()
+                        ch.add_message(
+                            "system",
+                            f"[dim]⚠ model_routing failed, defaulting to qwen2.5:3b: {exc}[/dim]",
+                        )
             return "qwen2.5:3b"
         model_map = {
             "local": "qwen2.5:3b",

src/rune/sleep_time.py

@@ -50,6 +50,26 @@ def _ensure_dirs():
     os.makedirs(EVIDENCE_DIR, exist_ok=True)
 
 
+def consolidate(full: bool = False):
+    """Run knowledge consolidation on demand (P0-04, #20).
+
+    The removed per-turn pipeline called `sleep_time.consolidate()` inside a
+    bare `except: pass` — the attribute never existed on this module, so the
+    step silently never ran. This delegate makes the capability real and
+    reachable: it drives MemoryConsolidation.consolidate_all() (neurons,
+    graph, abstraction, memory) and returns the counts dict (or None on
+    failure, so callers can degrade gracefully). Trigger policy is #48's
+    scope: invoke explicitly via /sleep, never per message.
+    """
+    try:
+        from memory_consolidation import MemoryConsolidation
+
+        return MemoryConsolidation().consolidate_all(full=full)
+    except Exception as e:  # noqa: BLE001 — on-demand path must degrade, not crash the caller
+        print(f"sleep_time.consolidate error: {e}", file=sys.stderr)
+        return None
+
+
 def db_connect():
     """Open the opencode DB READ-ONLY. sleep-time is a secondary sub-agent —
     it must never take a write lock that could pause or block the main agent.

src/rune/subsystem_health.py

@@ -0,0 +1,120 @@
+"""Subsystem health: observable failure semantics (P0-06).
+
+Tiers (see docs/failure-semantics.md):
+  T0 authoritative-path failure — loud: event + error bubble + success=False
+     (callers re-raise or return structured failure; this module is used for
+     the event + ledger side).
+  T1 context-contribution failure — turn proceeds, but the failure MUST be
+     visible: canonical event + one user message per subsystem per session.
+  T2 ambient/background failure — canonical event only; visible via /health.
+
+Every except on the authoritative path must re-raise, return a structured
+failure, or emit. Silent `pass` is a defect.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import json
+import logging
+import threading
+from logging.handlers import RotatingFileHandler
+from pathlib import Path
+
+# Subsystem name -> canonical event_type (the event_bus vocabulary).
+_TIER_EVENTS = {0: "task.failed", 1: "capability.failed", 2: "storage.degraded"}
+
+
+class SubsystemHealthRegistry:
+    """Per-subsystem failure ledger (the CadenceHealth shape, generalized)."""
+
+    def __init__(self) -> None:
+        self._lock = threading.Lock()
+        self._entries: dict[str, dict] = {}
+        self._surfaced: set[str] = set()
+
+    def record(self, subsystem: str, error: str, tier: int) -> bool:
+        with self._lock:
+            entry = self._entries.setdefault(
+                subsystem, {"failures": 0, "last_error": "", "tier": tier}
+            )
+            entry["failures"] += 1
+            entry["last_error"] = error
+            entry["tier"] = tier
+            key = f"{tier}:{subsystem}"
+            if tier <= 1 and key not in self._surfaced:
+                self._surfaced.add(key)
+                return True  # caller surfaces to the user (once per session)
+            return False
+
+    def snapshot(self) -> dict:
+        with self._lock:
+            return json.loads(json.dumps(self._entries))
+
+
+_REGISTRY = SubsystemHealthRegistry()
+
+
+def registry() -> SubsystemHealthRegistry:
+    return _REGISTRY
+
+
+def record_failure(
+    subsystem: str,
+    error: BaseException,
+    tier: int = 1,
+    registry: SubsystemHealthRegistry | None = None,
+    context: str = "",
+) -> bool:
+    """Record a subsystem failure: canonical event + ledger + log.
+
+    Returns True when the caller should ALSO surface this to the user
+    (T0/T1 first occurrence). T2 never surfaces.
+    """
+    # The observability layer must NEVER raise inside a caller's except
+    # block — a raising record_failure masks the very failure it reports
+    # (P0-06 quality discharge I-1: the observability-recursion trap).
+    try:
+        reg = registry or _REGISTRY
+        message = f"{type(error).__name__}: {error}"
+        if context:
+            message = f"{message} ({context})"
+        log = logging.getLogger("rune.subsystem_health")
+        log.error("subsystem=%s tier=%d %s", subsystem, tier, message)
+        try:
+            from rune import event_bus
+
+            event_bus.emit(
+                _TIER_EVENTS.get(tier, "storage.degraded"),
+                source="subsystem_health",
+                payload={
+                    "subsystem": subsystem,
+                    "tier": tier,
+                    "error": message[:300],
+                },
+            )
+        except Exception:
+            log.exception("failed to emit subsystem-health event")
+        return reg.record(subsystem, message, tier)
+    except Exception:
+        with contextlib.suppress(Exception):
+            logging.getLogger("rune.subsystem_health").exception(
+                "record_failure itself failed for subsystem=%s", subsystem
+            )
+        return False  # last resort: never mask the caller's original error
+
+
+def configure_logging(log_dir: Path | None = None):
+    """Give the rune loggers a real destination (they had none — P0-06)."""
+    target = Path(log_dir) if log_dir is not None else Path.home() / ".rune" / "logs"
+    target.mkdir(parents=True, exist_ok=True)
+    handler = RotatingFileHandler(
+        target / "rune.log", maxBytes=5_000_000, backupCount=3, encoding="utf-8"
+    )
+    handler.setFormatter(
+        logging.Formatter("%(asctime)s %(name)s %(levelname)s %(message)s")
+    )
+    root = logging.getLogger("rune")
+    root.setLevel(logging.INFO)
+    root.addHandler(handler)
+    return handler

src/rune/tool_executor.py

@@ -77,9 +77,7 @@ READ_ONLY_TOOLS = frozenset(
         "diagnose_behavior",
     }
 )
-MUTATING_TOOLS = frozenset(
-    {"write_file", "edit_file", "format_code", "git_commit", "run_command"}
-)
+MUTATING_TOOLS = frozenset({"write_file", "edit_file", "format_code", "git_commit", "run_command"})
 DEFAULT_APPROVAL_TTL = 300.0
 
 
@@ -192,7 +190,10 @@ TOOLS = [
             "type": "object",
             "properties": {
                 "path": {"type": "string", "description": "Absolute path to the file"},
-                "language": {"type": "string", "description": "Language override (optional, auto-detected from extension)"},
+                "language": {
+                    "type": "string",
+                    "description": "Language override (optional, auto-detected from extension)",
+                },
             },
             "required": ["path"],
         },
@@ -253,7 +254,11 @@ TOOLS = [
             "type": "object",
             "properties": {
                 "message": {"type": "string", "description": "Commit message"},
-                "files": {"type": "array", "items": {"type": "string"}, "description": "Specific files to commit (optional, defaults to all modified)"},
+                "files": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": "Specific files to commit (optional, defaults to all modified)",
+                },
             },
             "required": ["message"],
         },
@@ -268,7 +273,11 @@ TOOLS = [
             "type": "object",
             "properties": {
                 "path": {"type": "string", "description": "Root directory to map"},
-                "languages": {"type": "array", "items": {"type": "string"}, "description": "Filter by languages (optional)"},
+                "languages": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": "Filter by languages (optional)",
+                },
             },
             "required": ["path"],
         },
@@ -279,9 +288,19 @@ TOOLS = [
         "parameters": {
             "type": "object",
             "properties": {
-                "command": {"type": "string", "description": "Command text; shell syntax is allowed only with shell=true"},
-                "argv": {"type": "array", "items": {"type": "string"}, "description": "Argument vector for shell-free execution"},
-                "shell": {"type": "boolean", "description": "Explicitly request the user-approved shell execution path"},
+                "command": {
+                    "type": "string",
+                    "description": "Command text; shell syntax is allowed only with shell=true",
+                },
+                "argv": {
+                    "type": "array",
+                    "items": {"type": "string"},
+                    "description": "Argument vector for shell-free execution",
+                },
+                "shell": {
+                    "type": "boolean",
+                    "description": "Explicitly request the user-approved shell execution path",
+                },
                 "workdir": {"type": "string", "description": "Working directory (optional)"},
                 "timeout": {"type": "integer", "description": "Timeout in seconds (default 30)"},
             },
@@ -338,6 +357,7 @@ TOOLS = [
 # SANDBOX — path validation
 # ═══════════════════════════════════════════════════════════════════════════════
 
+
 def resolve_path(path: str) -> Path:
     """Resolve a path to absolute, resolving symlinks and .."""
     return Path(path).expanduser().resolve()
@@ -374,8 +394,33 @@ def validate_read_path(path: str) -> tuple[bool, str, Optional[Path]]:
 def validate_write_path(path: str) -> tuple[bool, str, Optional[Path]]:
     """Validate a path for writing. Returns (ok, message, resolved_path)."""
     resolved = resolve_path(path)
+    # Minor-3 (general-179): a BLOCKED dir under an allowed dir must not get
+    # the misleading "outside allowed directories" text (e.g. ~/.ssh IS inside
+    # /home/nick — the true reason is the blocklist). Truthful reason enables
+    # one-step model self-correction.
+    resolved_check = resolved.resolve(strict=False)
+    for blocked in BLOCKED_DIRS:
+        blocked_path = Path(blocked).expanduser().resolve(strict=False)
+        if resolved_check == blocked_path or resolved_check.is_relative_to(blocked_path):
+            return (
+                False,
+                f"Access denied: {path} is in a protected directory ({blocked}). "
+                "This directory is always blocked, even though it is inside an "
+                "allowed write directory. Choose a different location.",
+                None,
+            )
     if not is_path_allowed(resolved, ALLOWED_WRITE_DIRS):
-        return False, f"Access denied: {path} is outside allowed directories", None
+        # P0-05 (#21) P1: the denial must tell the model WHERE it can write —
+        # a bare "outside allowed directories" forced blind retries in the
+        # probe sandbox. Single choke point: every write denial
+        # (write_file/edit_file/format_code prepare, apply-after-approval,
+        # revalidation) flows through validate_write_path.
+        return (
+            False,
+            f"Access denied: {path} is outside allowed write directories: "
+            f"{ALLOWED_WRITE_DIRS}. Write inside one of those directories instead.",
+            None,
+        )
     return True, "", resolved
 
 
@@ -383,6 +428,7 @@ def validate_write_path(path: str) -> tuple[bool, str, Optional[Path]]:
 # UNDO — backup and rollback
 # ═══════════════════════════════════════════════════════════════════════════════
 
+
 def _backup_file(path: Path) -> Optional[str]:
     """Create a backup of a file before writing. Returns backup path."""
     if not path.exists():
@@ -393,6 +439,7 @@ def _backup_file(path: Path) -> Optional[str]:
         safe_name = str(path).replace("/", "_").replace(":", "_")
         backup_path = os.path.join(UNDO_DIR, f"{ts}_{safe_name}.bak")
         import shutil
+
         shutil.copy2(str(path), backup_path)
         return backup_path
     except Exception:
@@ -410,6 +457,7 @@ def undo_last():
         name = backup.stem  # e.g., "20260823_011400___mnt_workdrive_rune_src_rune_rune_tui_py.bak"
         # Restore
         import shutil
+
         # Find the original path from the backup name
         parts = name.split("_", 4)
         if len(parts) >= 5:
@@ -427,6 +475,7 @@ def undo_last():
 # DIFF — show what will change
 # ═══════════════════════════════════════════════════════════════════════════════
 
+
 def generate_diff(path: Path, new_content: str) -> str:
     """Generate a unified diff between current file and new content."""
     try:
@@ -437,7 +486,8 @@ def generate_diff(path: Path, new_content: str) -> str:
             old_lines = []
         new_lines = new_content.splitlines(keepends=True)
         diff = difflib.unified_diff(
-            old_lines, new_lines,
+            old_lines,
+            new_lines,
             fromfile=f"a/{path.name}",
             tofile=f"b/{path.name}",
         )
@@ -450,6 +500,7 @@ def generate_diff(path: Path, new_content: str) -> str:
 # TOOL EXECUTION
 # ═══════════════════════════════════════════════════════════════════════════════
 
+
 def _execute_tool_now(tool_name: str, args: dict) -> dict:
     """Execute a tool handler after the authority boundary permits it."""
     try:
@@ -557,9 +608,7 @@ def prepare_tool(
             preview = _write_file(arguments)
         elif tool_name == "edit_file":
             preview = _edit_file(arguments)
-        if preview and (
-            not preview.get("success") or not preview.get("needs_confirm")
-        ):
+        if preview and (not preview.get("success") or not preview.get("needs_confirm")):
             return preview
 
         timestamp = time.monotonic() if now is None else now
@@ -629,9 +678,7 @@ def approve_tool(pending: PreparedTool, *, now: float | None = None) -> dict:
         preview = _edit_file(pending.arguments)
         if not preview.get("success"):
             return preview
-        return _apply_content(
-            str(pending.arguments.get("path", "")), str(preview["content"])
-        )
+        return _apply_content(str(pending.arguments.get("path", "")), str(preview["content"]))
     return _execute_tool_now(pending.name, copy.deepcopy(pending.arguments))
 
 
@@ -656,10 +703,7 @@ def deserialize_prepared_tool(value: object) -> PreparedTool:
     """Rebuild a prepared operation; approval still verifies both digests."""
     if not isinstance(value, dict):
         raise ValueError("prepared tool must be an object")
-    expected = {
-        dataclass_field.name
-        for dataclass_field in PreparedTool.__dataclass_fields__.values()
-    }
+    expected = {dataclass_field.name for dataclass_field in PreparedTool.__dataclass_fields__.values()}
     if set(value) != expected:
         raise ValueError("prepared tool fields are invalid")
     try:
@@ -674,9 +718,7 @@ def deserialize_prepared_tool(value: object) -> PreparedTool:
         raise ValueError("prepared tool arguments are invalid")
     if not isinstance(pending.operation_digest, str):
         raise ValueError("prepared tool digest is invalid")
-    if not isinstance(pending.created_at, (int, float)) or not isinstance(
-        pending.expires_at, (int, float)
-    ):
+    if not isinstance(pending.created_at, (int, float)) or not isinstance(pending.expires_at, (int, float)):
         raise ValueError("prepared tool timestamps are invalid")
     return pending
 
@@ -790,6 +832,7 @@ def _list_directory(args: dict) -> dict:
         for item in sorted(resolved.iterdir()):
             if pattern:
                 import fnmatch
+
                 if not fnmatch.fnmatch(item.name, pattern):
                     continue
             prefix = "📁 " if item.is_dir() else "📄 "
@@ -811,6 +854,7 @@ def _search_files(args: dict) -> dict:
 
     try:
         import fnmatch
+
         matches = []
         for root, _dirs, files in os.walk(str(resolved)):
             for fname in files:
@@ -824,7 +868,10 @@ def _search_files(args: dict) -> dict:
                                 rel = os.path.relpath(fpath, str(resolved))
                                 matches.append(f"{rel}:{i}: {line.rstrip()[:100]}")
                                 if len(matches) >= 50:
-                                    return {"success": True, "result": "\n".join(matches) + "\n[truncated — 50 matches]"}
+                                    return {
+                                        "success": True,
+                                        "result": "\n".join(matches) + "\n[truncated — 50 matches]",
+                                    }
                 except Exception:
                     continue
         return {"success": True, "result": "\n".join(matches) if matches else "(no matches)"}
@@ -835,6 +882,7 @@ def _search_files(args: dict) -> dict:
 def _run_command(args: dict) -> dict:
     """Run an approved command, using argv unless shell mode is explicit."""
     import subprocess
+
     command = args.get("command")
     argv = args.get("argv")
     shell = args.get("shell", False)
@@ -850,9 +898,7 @@ def _run_command(args: dict) -> dict:
                     "error": "Shell syntax requires explicit shell approval",
                 }
             argv = shlex.split(command)
-        if not isinstance(argv, list) or not argv or not all(
-            isinstance(item, str) and item for item in argv
-        ):
+        if not isinstance(argv, list) or not argv or not all(isinstance(item, str) and item for item in argv):
             return {"success": False, "error": "argv must be a non-empty string list"}
         invocation: str | list[str] = argv
         use_shell = False
@@ -863,10 +909,7 @@ def _run_command(args: dict) -> dict:
         use_shell = True
 
     try:
-        result = subprocess.run(
-            invocation, shell=use_shell, capture_output=True, text=True,
-            timeout=30, cwd=workdir
-        )
+        result = subprocess.run(invocation, shell=use_shell, capture_output=True, text=True, timeout=30, cwd=workdir)
         output = result.stdout
         if result.stderr:
             output += f"\n[stderr]\n{result.stderr}"
@@ -885,6 +928,7 @@ def _run_command(args: dict) -> dict:
 # TIER 1: ADVANCED FILE OPERATIONS
 # ═══════════════════════════════════════════════════════════════════════════════
 
+
 def _edit_file(args: dict) -> dict:
     """Preview a surgical search/replace edit without changing bytes."""
     path = args.get("path", "")
@@ -943,6 +987,7 @@ def _glob_files(args: dict) -> dict:
 
     try:
         from pathlib import Path
+
         matches = list(Path(str(resolved)).glob(pattern))
 
         # Sort by modification time (most recent first)
@@ -977,6 +1022,7 @@ def _grep_files(args: dict) -> dict:
 
     try:
         import subprocess
+
         cmd = ["grep", "-r", "-n", "-E", pattern, str(resolved)]
         if include:
             cmd = ["grep", "-r", "-n", "-E", "--include", include, pattern, str(resolved)]
@@ -1090,10 +1136,8 @@ def _lint_file(args: dict) -> dict:
     lint_cmd = LANGUAGE_CONFIG[language]["lint"]
     try:
         import subprocess
-        result = subprocess.run(
-            f"{lint_cmd} {resolved}",
-            shell=True, capture_output=True, text=True, timeout=30
-        )
+
+        result = subprocess.run(f"{lint_cmd} {resolved}", shell=True, capture_output=True, text=True, timeout=30)
         if result.returncode == 0:
             return {"success": True, "result": f"✓ {resolved.name} — no issues"}
         else:
@@ -1118,9 +1162,14 @@ def _run_tests(args: dict) -> dict:
 
     try:
         import subprocess
+
         result = subprocess.run(
-            command, shell=True, capture_output=True, text=True,
-            timeout=120, cwd=str(resolved.parent) if resolved.is_file() else str(resolved)
+            command,
+            shell=True,
+            capture_output=True,
+            text=True,
+            timeout=120,
+            cwd=str(resolved.parent) if resolved.is_file() else str(resolved),
         )
         output = result.stdout
         if result.stderr:
@@ -1154,10 +1203,8 @@ def _format_code(args: dict) -> dict:
     format_cmd = LANGUAGE_CONFIG[language]["format"]
     try:
         import subprocess
-        result = subprocess.run(
-            f"{format_cmd} {resolved}",
-            shell=True, capture_output=True, text=True, timeout=30
-        )
+
+        result = subprocess.run(f"{format_cmd} {resolved}", shell=True, capture_output=True, text=True, timeout=30)
         if result.returncode == 0:
             return {"success": True, "result": f"✓ {resolved.name} formatted"}
         else:
@@ -1170,9 +1217,11 @@ def _format_code(args: dict) -> dict:
 # TIER 3: GIT OPERATIONS
 # ═══════════════════════════════════════════════════════════════════════════════
 
+
 def _git_diff(args: dict) -> dict:
     """Show git diff."""
     import subprocess
+
     staged = args.get("staged", False)
     path = args.get("path")
 
@@ -1192,6 +1241,7 @@ def _git_diff(args: dict) -> dict:
 def _git_log(args: dict) -> dict:
     """Show recent git commits."""
     import subprocess
+
     limit = args.get("limit", 10)
     path = args.get("path")
 
@@ -1209,6 +1259,7 @@ def _git_log(args: dict) -> dict:
 def _git_commit(args: dict) -> dict:
     """Commit changes with a message."""
     import subprocess
+
     message = args.get("message", "")
     files = args.get("files")
 
@@ -1224,10 +1275,7 @@ def _git_commit(args: dict) -> dict:
             subprocess.run(["git", "add", "-A"], capture_output=True, timeout=10)
 
         # Commit
-        result = subprocess.run(
-            ["git", "commit", "-m", message],
-            capture_output=True, text=True, timeout=10
-        )
+        result = subprocess.run(["git", "commit", "-m", message], capture_output=True, text=True, timeout=10)
 
         if result.returncode == 0:
             return {"success": True, "result": result.stdout}
@@ -1241,6 +1289,7 @@ def _git_commit(args: dict) -> dict:
 # TIER 4: CODE UNDERSTANDING
 # ═══════════════════════════════════════════════════════════════════════════════
 
+
 def _repo_map(args: dict) -> dict:
     """Generate an AST-based codebase map using tree-sitter."""
     path = args.get("path", ".")
@@ -1253,6 +1302,7 @@ def _repo_map(args: dict) -> dict:
     try:
         # Try tree-sitter-based repo map
         import subprocess
+
         cmd = ["tree-sitter", "parse", "--scope", str(resolved)]
         if languages:
             cmd.extend(["--languages", ",".join(languages)])
@@ -1300,6 +1350,7 @@ def _repo_map_fallback(path: Path) -> dict:
 # SELF-DIAGNOSIS TOOLS
 # ═══════════════════════════════════════════════════════════════════════════════
 
+
 def _read_persona(args: dict) -> dict:
     """Read Rune's persona definition from MEMORY.md."""
     try:
@@ -1326,6 +1377,7 @@ def _query_memory(args: dict) -> dict:
     """Query Rune's memory store."""
     try:
         import sys
+
         sys.path.insert(0, os.path.expanduser("~/.config/opencode/scripts"))
         import memory_store
 
@@ -1437,6 +1489,7 @@ def _diagnose_behavior(args: dict) -> dict:
 # AGENT LOOP — model → tool → result → model
 # ═══════════════════════════════════════════════════════════════════════════════
 
+
 def build_tool_prompt(tools: list | None = None) -> str:
     """Build the tool definitions section for the model prompt."""
     if tools is None:
@@ -1488,6 +1541,7 @@ def format_tool_result(result: dict) -> str:
 # CLI
 # ═══════════════════════════════════════════════════════════════════════════════
 
+
 def main():
     if len(sys.argv) < 2:
         print("Usage: tool_executor.py [tools|test|undo]")
@@ -1507,7 +1561,9 @@ def main():
         result = execute_tool("list_directory", {"path": "/tmp"})
         print(f"List: {result}")
         # Test search
-        result = execute_tool("search_files", {"path": "/mnt/workdrive/rune/src/rune", "pattern": "def main", "include": "*.py"})
+        result = execute_tool(
+            "search_files", {"path": "/mnt/workdrive/rune/src/rune", "pattern": "def main", "include": "*.py"}
+        )
         print(f"Search: {result['success']}, {len(result.get('result', '').splitlines())} matches")
 
     elif cmd == "undo":

src/rune/tool_protocol.py

@@ -46,6 +46,15 @@ class OperatorResponse:
     recall_count: int = 0
     override_tier: int = 0
     error: str = ""
+    # P0-05 (#21) P3: loop-budget visibility — model turns consumed by the
+    # tool loop and the hard cap they were consumed against. 0/0 on
+    # responses that never entered the loop (pre-loop transport or state
+    # validation failures).
+    iterations_used: int = 0
+    iteration_budget: int = 0
+    # P0-06: subsystems that degraded (T1) and surfaced this turn — the
+    # operator has no chat channel, so visibility rides the response envelope.
+    degraded: list[str] = field(default_factory=list)
 
 
 TOOL_INDEX = {definition["name"]: definition for definition in TOOLS}

src/rune/warm_router.py

@@ -224,7 +224,10 @@ def list_neurons():
             ).fetchall()
         finally:
             db.close()
-    except Exception:
+    except Exception as exc:  # P0-06: observable degrade (T1)
+        from rune.subsystem_health import record_failure
+
+        record_failure("warm_router", exc, tier=1, context="list_neurons")
         return neurons
     for text, slug, triggers, importance, summary, wash_count in rows:
         full = (text or "").strip()
@@ -301,10 +304,14 @@ def write_neuron(slug, triggers, body, importance=0.5):
                                    source="warm_router")
             finally:
                 dbw.close()
-        except Exception:
-            pass
-    except Exception:
-        pass
+        except Exception as exc:  # P0-06: observable degrade (T1)
+            from rune.subsystem_health import record_failure
+
+            record_failure("warm_router", exc, tier=1, context="auto-associate")
+    except Exception as exc:  # P0-06: observable degrade (T1)
+        from rune.subsystem_health import record_failure
+
+        record_failure("warm_router", exc, tier=1, context="write_neuron")
     return f"store://neuron/{slug}"
 
 

tests/test_context_broker.py

@@ -0,0 +1,597 @@
+"""FROZEN tests for the ContextBroker (P0-03, #19).
+
+These tests are the spec — implement verbatim. They pin:
+
+1. typed-block assembly in the fixed order system -> tools -> memory ->
+   history -> user, within budget;
+2. deterministic admission (priority desc, tie: registration recency)
+   with dropped blocks recorded with token counts;
+3. fail-loud ContextOverflowError when a single mandatory block exceeds
+   the whole input budget (never silently truncate);
+4. a per-block trace (name/tokens/source/admitted);
+5. the memory-off absence proof (trace sums 0 memory tokens);
+6. compaction: raw history archived externally BEFORE compression, last
+   5 turns verbatim, structured rolling summary present;
+7. context-length discovery from /api/show (32000, not 8192);
+8. log-only calibration drift against the served prompt_eval_count;
+9. approval resume embedding the capsule in pending_state;
+10. contributor failure recorded in the subsystem-health registry (T1);
+11. thread-safe concurrent assembly;
+12. operator characterization parity through the broker path.
+"""
+
+from __future__ import annotations
+
+import copy
+import json
+import sys
+import threading
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import Mock, patch
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "src"))
+
+from rune import context_broker, rune_operator  # noqa: E402
+from rune.attention_capsule import AttentionCapsule  # noqa: E402
+from rune.context_broker import (  # noqa: E402
+    ContributionBlock,
+    ContextBroker,
+    ContextOverflowError,
+    compact_history,
+    default_budget,
+    log_calibration,
+    memory_disabled,
+)
+from rune.local_tool_runtime import (  # noqa: E402
+    OllamaChatTransport,
+    reset_context_length_cache,
+)
+from rune.subsystem_health import registry  # noqa: E402
+from rune.tool_protocol import OperatorResponse, ToolRequest  # noqa: E402
+
+
+def _block(name, priority, content, source="test", evictable=True):
+    return ContributionBlock(name, priority, content, 0, source, evictable=evictable)
+
+
+def test_assembles_typed_blocks_in_order():
+    """system -> tools -> memory -> history -> user; budget respected."""
+    broker = ContextBroker()
+    broker.register_contributor(
+        "persona",
+        lambda task, session: _block("persona", 100, "I am Rune.", evictable=False),
+        0,
+    )
+    broker.register_contributor(
+        "tools",
+        lambda task, session: _block("tools", 90, "## Available tools\nread_file", evictable=False),
+        1,
+    )
+    broker.register_contributor(
+        "memory",
+        lambda task, session: _block("memory", 70, "## Context\n- fact"),
+        2,
+    )
+    broker.register_contributor(
+        "history",
+        lambda task, session: _block("history", 30, [{"role": "assistant", "content": "prior answer"}]),
+        3,
+    )
+    broker.register_contributor(
+        "user",
+        lambda task, session: _block("user", 100, "current task", evictable=False),
+        4,
+    )
+
+    capsule, trace = broker.assemble(object(), None, budget_tokens=10_000)
+
+    assert isinstance(capsule, AttentionCapsule)
+    messages = capsule.to_messages()
+    assert [message["role"] for message in messages] == ["system", "assistant", "user"]
+    system = messages[0]["content"]
+    assert system.index("I am Rune.") < system.index("## Available tools")
+    assert system.index("## Available tools") < system.index("## Context")
+    assert messages[1] == {"role": "assistant", "content": "prior answer"}
+    assert messages[-1] == {"role": "user", "content": "current task"}
+    assert trace["admitted_total"] <= 10_000
+    assert set(trace["admitted"]) == {"persona", "tools", "memory", "history", "user"}
+
+
+def test_drops_lowest_priority_over_budget():
+    """Admission ledger records the drop with token counts."""
+    broker = ContextBroker()
+    broker.register_contributor(
+        "user",
+        lambda task, session: _block("user", 100, "task", evictable=False),
+        4,
+    )
+    broker.register_contributor("high", lambda task, session: _block("high", 80, "h" * 40), 2)
+    broker.register_contributor("low", lambda task, session: _block("low", 20, "l" * 40), 2)
+
+    capsule, trace = broker.assemble(object(), None, budget_tokens=12)
+
+    # user (1 tok) + high (10 tok) fit; low (10 tok) would exceed the budget.
+    assert trace["admitted_total"] <= 12
+    assert "high" in trace["admitted"]
+    assert "low" not in trace["admitted"]
+    assert [dropped["name"] for dropped in trace["dropped"]] == ["low"]
+    assert trace["dropped"][0]["tokens"] == 10
+    assert [block.name for block in capsule.blocks] == ["user", "high"]
+
+
+def test_single_block_over_budget_fails_loud():
+    """ContextOverflowError — no silent truncation of a mandatory block."""
+    broker = ContextBroker()
+    broker.register_contributor(
+        "user",
+        lambda task, session: _block("user", 100, "x" * 400, evictable=False),
+        4,
+    )
+    with pytest.raises(ContextOverflowError):
+        broker.assemble(object(), None, budget_tokens=50)
+
+
+def test_trace_records_per_block_tokens():
+    """Every block: name/tokens/source/admitted — admitted and dropped."""
+    broker = ContextBroker()
+    broker.register_contributor(
+        "persona",
+        lambda task, session: _block("persona", 100, "I am Rune.", source="persona"),
+        0,
+    )
+    broker.register_contributor("memory", lambda task, session: _block("memory", 70, "m" * 400, source="recall"), 2)
+    broker.register_contributor(
+        "user",
+        lambda task, session: _block("user", 100, "task", source="user", evictable=False),
+        4,
+    )
+
+    _, trace = broker.assemble(object(), None, budget_tokens=30)
+
+    by_name = {record["name"]: record for record in trace["blocks"]}
+    assert set(by_name) == {"persona", "memory", "user"}
+    for record in by_name.values():
+        assert set(record) >= {"name", "tokens", "source", "admitted"}
+    assert by_name["persona"]["source"] == "persona"
+    assert by_name["persona"]["tokens"] == len("I am Rune.") // 4
+    assert by_name["user"]["admitted"] is True
+    assert by_name["memory"]["admitted"] is False
+    assert by_name["memory"]["tokens"] == 100
+
+
+def test_memory_off_proves_zero_memory_tokens(monkeypatch):
+    """Memory-off gate zeroes recall/persona/consolidation; trace proves it."""
+    monkeypatch.setenv("RUNE_MEMORY_OFF", "1")
+    assert memory_disabled() is True
+
+    def gated(name, priority, source):
+        def contributor(task, session):
+            if memory_disabled():
+                return None
+            return _block(name, priority, "## Context\n- remembered", source=source)
+
+        return contributor
+
+    broker = ContextBroker()
+    broker.register_contributor("memory", gated("memory", 70, "recall"), 2)
+    broker.register_contributor("persona_memories", gated("persona_memories", 68, "recall"), 2)
+    broker.register_contributor("consolidated", gated("consolidated", 60, "consolidation"), 2)
+    broker.register_contributor(
+        "user",
+        lambda task, session: _block("user", 100, "task", evictable=False),
+        4,
+    )
+
+    capsule, trace = broker.assemble(object(), None, budget_tokens=10_000)
+
+    assert trace["memory_tokens"] == 0
+    assert not any(block["name"] in context_broker.MEMORY_BLOCK_NAMES for block in trace["blocks"])
+    assert [block.name for block in capsule.blocks] == ["user"]
+
+
+def test_compaction_archives_raw_and_keeps_last5(tmp_path):
+    """Raw archived to file BEFORE compressing; summary block; last 5 verbatim."""
+    archive = tmp_path / "state" / "history_archive.jsonl"
+    summarized = []
+
+    def summarizer(messages):
+        summarized.append(list(messages))
+        return (
+            "Session intent: fix the broker\n"
+            "Decisions: admission is deterministic\n"
+            "Open items: none\n"
+            "Next steps: ship it"
+        )
+
+    messages = []
+    for index in range(8):
+        messages.append({"role": "user", "content": f"question {index} " + "w" * 1000})
+        messages.append({"role": "assistant", "content": f"answer {index} " + "w" * 1000})
+
+    compacted, event = compact_history(
+        messages,
+        window=2048,
+        archive_path=archive,
+        summarizer=summarizer,
+        source="test",
+        session_id="task-1",
+    )
+
+    assert event["triggered"] is True
+    assert event["tokens_after"] < event["tokens_before"]
+    assert archive.exists()
+    raw = json.loads(archive.read_text(encoding="utf-8").splitlines()[0])
+    assert raw["messages"] == messages  # raw archived BEFORE any lossy step
+    assert raw["session_id"] == "task-1"
+    assert len(summarized) == 1  # one compact summarization call
+    assert len(compacted) == 11  # summary message + last 5 turns (10 messages)
+    assert compacted[1:] == messages[-10:]  # last 5 turns verbatim
+    assert "## Conversation summary" in compacted[0]["content"]
+    assert "Session intent: fix the broker" in compacted[0]["content"]
+
+
+def test_discovery_uses_real_context_length(monkeypatch):
+    """/api/show reports 32000 — budget math uses 32000, not 8192."""
+    reset_context_length_cache()
+    context_broker._DISCOVERED.clear()
+
+    def fake_post(path, payload):
+        assert path == "/api/show"
+        return {"model_info": {"qwen2.context_length": 32000}, "capabilities": ["tools"]}
+
+    transport = OllamaChatTransport()
+    transport._post = fake_post  # repo mock contract (instance-level)
+
+    assert transport.context_length("test-model") == 32000
+
+    broker = ContextBroker()
+    broker.register_contributor(
+        "user",
+        lambda task, session: _block("user", 100, "task", evictable=False),
+        4,
+    )
+    capsule, trace = broker.assemble(object(), None, model_id="test-model")
+
+    assert trace["window"] == 32000
+    assert trace["budget"] == default_budget(32000) == 22400
+    assert trace["budget"] != default_budget(8192)
+    assert capsule.token_count <= trace["budget"]
+
+
+def test_calibration_logs_drift(caplog):
+    """Served prompt_eval_count vs broker estimate -> log record (LOG ONLY)."""
+    with caplog.at_level("INFO", logger="rune.context_broker"):
+        drift = log_calibration(measured_tokens=1000, prompt_eval_count=1250, model="qwen3:8b")
+
+    assert drift == 250
+    messages = [record.getMessage() for record in caplog.records]
+    assert any("calibration" in message and "drift=+250" in message for message in messages)
+
+
+def test_approval_resume_embeds_capsule(tmp_path):
+    """pending_state carries the capsule; the replayed messages are identical."""
+    operator = rune_operator.RuneOperator(str(tmp_path / "operator.json"))
+    request = ToolRequest("call-1", "write_file", {"path": "/tmp/a", "content": "new"}, "ollama-native")
+    captured = []
+
+    def fake_run(messages, **kwargs):
+        captured.append(copy.deepcopy(messages))
+        return OperatorResponse(
+            success=True,
+            tool_events=[],
+            pending_approval=request,
+            pending_state={
+                "messages": copy.deepcopy(messages),
+                "native_tools": True,
+            },
+            model="qwen3:8b",
+        )
+
+    runtime = Mock()
+    runtime.run.side_effect = fake_run
+    profile = SimpleNamespace(safety_tier=0)
+
+    with (
+        patch("rune.local_tool_runtime.context_length", return_value=8192),
+        patch.object(rune_operator, "LocalToolRuntime", return_value=runtime, create=True),
+        patch.object(rune_operator, "OllamaChatTransport", return_value=Mock(), create=True),
+        patch.object(rune_operator.model_profiles, "get_or_create_profile", return_value=profile),
+        patch.object(rune_operator.model_profiles, "get_prompt_context", return_value=""),
+        patch.object(rune_operator.model_profiles, "record_interaction"),
+        patch("rune.memory_store.connect", return_value=Mock()),
+        patch("rune.memory_store.cached_recall", return_value=[]),
+        patch.object(operator, "_log_token_usage"),
+    ):
+        response = operator._execute_on_model(
+            rune_operator.RuneTask("task-1", "inspect this", assigned_model="qwen3:8b"),
+            "qwen3:8b",
+        )
+
+    pending = response.pending_state
+    assert pending is not None
+    assert "context_capsule" in pending
+    capsule_state = pending["context_capsule"]
+    assert capsule_state["token_count"] > 0
+    assert any(block["name"] == "user" for block in capsule_state["blocks"])
+    assert any(block["name"] == "persona" for block in capsule_state["blocks"])
+    # Resume identity: the replayed messages are exactly what was assembled.
+    assert pending["messages"] == captured[0]
+    assert pending["messages"][-1]["role"] == "user"
+    assert "inspect this" in pending["messages"][-1]["content"]
+    assert "I am Rune" in pending["messages"][0]["content"]
+
+
+def test_contributor_failure_records_health():
+    """Broken selector -> record_failure tier-1 entry in the registry."""
+    subsystem = "failing_selector_frozen_test"
+
+    def broken(task, session):
+        raise RuntimeError("selector exploded")
+
+    broker = ContextBroker()
+    broker.register_contributor(subsystem, broken, 2)
+    broker.register_contributor(
+        "user",
+        lambda task, session: _block("user", 100, "task", evictable=False),
+        4,
+    )
+
+    capsule, trace = broker.assemble(object(), None, budget_tokens=10_000)
+
+    entry = registry().snapshot()[subsystem]
+    assert entry["tier"] == 1
+    assert entry["failures"] >= 1
+    assert "selector exploded" in entry["last_error"]
+    assert subsystem not in [block["name"] for block in trace["blocks"]]
+    assert [block.name for block in capsule.blocks] == ["user"]
+
+
+def test_thread_safety_concurrent_assemble():
+    """2 threads x 10 assemblies each — no corruption."""
+    broker = ContextBroker()
+    broker.register_contributor("memory", lambda task, session: _block("memory", 70, "## Context\n- fact"), 2)
+    broker.register_contributor(
+        "user",
+        lambda task, session: _block("user", 100, "task text", evictable=False),
+        4,
+    )
+
+    results = []
+    errors = []
+
+    def worker():
+        try:
+            for _ in range(10):
+                capsule, trace = broker.assemble(object(), None, budget_tokens=10_000)
+                results.append((len(capsule.blocks), trace["admitted_total"], trace["budget"]))
+        except Exception as exc:  # pragma: no cover - surfaced via assertion
+            errors.append(exc)
+
+    threads = [threading.Thread(target=worker) for _ in range(2)]
+    for thread in threads:
+        thread.start()
+    for thread in threads:
+        thread.join()
+
+    assert errors == []
+    assert len(results) == 20
+    assert all(blocks == 2 and total > 0 and budget == 10_000 for blocks, total, budget in results)
+    assert len(broker.trace_log) == 20
+
+
+def test_operator_characterization_parity():
+    """Existing role-message assertions still hold via the broker path."""
+    operator = rune_operator.RuneOperator("/tmp/context-broker-parity-operator.json")
+    runtime = Mock()
+    runtime.run.return_value = OperatorResponse(success=True, user_text="Final answer", model="qwen3:8b")
+    profile = SimpleNamespace(safety_tier=2)
+    memory_db = Mock()
+
+    with (
+        patch("rune.local_tool_runtime.context_length", return_value=8192),
+        patch.object(rune_operator, "LocalToolRuntime", return_value=runtime, create=True),
+        patch.object(rune_operator, "OllamaChatTransport", return_value=Mock(), create=True),
+        patch.object(rune_operator.model_profiles, "get_or_create_profile", return_value=profile),
+        patch.object(rune_operator.model_profiles, "get_prompt_context", return_value="model context"),
+        patch.object(rune_operator.model_profiles, "record_interaction") as record,
+        patch("rune.memory_store.connect", return_value=memory_db),
+        patch(
+            "rune.memory_store.cached_recall",
+            return_value=[{"text": "remembered fact"}],
+        ),
+        patch.object(operator, "_log_token_usage"),
+    ):
+        response = operator._execute_on_model(
+            rune_operator.RuneTask("task-1", "inspect this", assigned_model="qwen3:8b"),
+            "qwen3:8b",
+        )
+
+    assert response.success
+    assert response.recall_count == 1
+    messages = runtime.run.call_args.args[0]
+    assert [message["role"] for message in messages] == ["system", "user"]
+    assert "I am Rune" in messages[0]["content"]
+    assert "remembered fact" in messages[0]["content"]
+    assert "model context" in messages[0]["content"]
+    assert 'To use a tool, respond with: {"tool":' not in messages[0]["content"]
+    assert "inspect this" in messages[1]["content"]
+    record.assert_called_once_with("qwen3:8b", True, "inspect this")
+
+
+# --- Quality-gate discharges (general-172) — each pins the fixed defect ---
+
+
+def test_c3_fallback_window_never_cached():
+    """C3: a transient discovery failure (8192 fallback) must NOT enter the
+    discovered-window registry — otherwise it poisons the process lifetime."""
+    from rune import context_broker as cb
+
+    cb._DISCOVERED.clear()
+    try:
+        with patch("rune.local_tool_runtime.context_length", return_value=8192):
+            window = cb.default_window("poisoned-model")
+        assert window == 8192, "fallback still returned"
+        assert "poisoned-model" not in cb._DISCOVERED, "fallback poisoned the registry"
+        # and a genuine discovery DOES register
+        with patch("rune.local_tool_runtime.context_length", return_value=32768):
+            assert cb.default_window("poisoned-model") == 32768
+        assert cb._DISCOVERED["poisoned-model"] == 32768
+    finally:
+        cb._DISCOVERED.clear()
+
+
+def test_c1_rolling_summary_persists_and_archives_once():
+    """C1: consecutive compactions reuse the rolled summary — one archive
+    write per NEW message batch, no duplicate re-archiving per turn."""
+    import tempfile
+
+    from rune import context_broker as cb
+
+    cb._ROLLING.clear()
+    messages = []
+    for i in range(20):
+        messages.append({"role": "user", "content": f"turn {i} question " + "x" * 200})
+        messages.append({"role": "assistant", "content": f"turn {i} answer " + "y" * 200})
+    calls = {"n": 0}
+
+    def fake_summarizer(msgs):
+        calls["n"] += 1
+        return f"summary v{calls['n']}: " + " ".join(m["content"][:20] for m in msgs[:2])
+
+    with tempfile.TemporaryDirectory() as tmp:
+        archive = Path(tmp) / "history_archive.jsonl"
+        first, event1 = cb.compact_history(
+            messages,
+            8192,
+            archive_path=archive,
+            summarizer=fake_summarizer,
+            source="operator",
+            session_id="s1",
+        )
+        assert event1["triggered"] and event1["persisted"]
+        archived_first = archive.read_text().count("\n")
+        # second compaction over the SAME history (next turn re-derives it):
+        second, event2 = cb.compact_history(
+            messages,
+            8192,
+            archive_path=archive,
+            summarizer=fake_summarizer,
+            source="operator",
+            session_id="s1",
+        )
+        # Nothing new: summary reused, NO new archive line, NO new summarizer call.
+        assert event2["persisted"] and event2["turns_summarized"] == 0
+        assert archive.read_text().count("\n") == archived_first, "duplicate archive lines (C1 regression)"
+        assert calls["n"] == 1, "re-summarized the same window (C1 regression)"
+        # history GROWS by two turns -> only the new pair is archived+summarized
+        messages2 = messages + [
+            {"role": "user", "content": "new turn question " + "z" * 200},
+            {"role": "assistant", "content": "new turn answer " + "z" * 200},
+        ]
+        third, event3 = cb.compact_history(
+            messages2,
+            8192,
+            archive_path=archive,
+            summarizer=fake_summarizer,
+            source="operator",
+            session_id="s1",
+        )
+        assert event3["turns_summarized"] == 2, "should summarize only the NEW turns"
+        assert calls["n"] == 2
+        assert archive.read_text().count("\n") == archived_first + 1
+    cb._ROLLING.clear()
+
+
+def test_c2_no_dead_zone_history_compacts_at_budget():
+    """C2: history between budget and 0.8*window must compact inside
+    assemble (the old window-based trigger left that band silently dropped
+    whole — no compaction, no archive, no history in the prompt)."""
+    import tempfile
+
+    from rune import context_broker as cb
+
+    cb._ROLLING.clear()
+    window = 32768
+    budget = cb.default_budget(window)  # ~22938
+    messages = []
+    for i in range(30):
+        messages.append({"role": "user", "content": f"q{i} " + "a" * 1600})
+        messages.append({"role": "assistant", "content": f"a{i} " + "b" * 1600})
+    tokens = sum(cb.default_estimator(m["content"]) for m in messages)
+    assert budget < tokens < 0.8 * window, f"probe mis-sized: {tokens}"
+
+    broker = ContextBroker()
+    broker.register_contributor(
+        "history",
+        lambda t, s: ContributionBlock("history", 30, [dict(m) for m in messages], 0, "t"),
+        3,
+    )
+    with tempfile.TemporaryDirectory() as tmp:
+        broker._archive_path = Path(tmp) / "a.jsonl"
+        broker._summarizer = lambda msgs: "summary"
+        capsule, trace = broker.assemble(SimpleNamespace(description="t"), {}, budget_tokens=budget, session_id="dz")
+    assert trace["compaction"], "dead zone: over-budget history never compacted (C2)"
+    assert any(b["name"] == "history" for b in trace["blocks"] if b.get("admitted")), (
+        "history dropped whole despite compaction (C2)"
+    )
+    cb._ROLLING.clear()
+
+
+def test_c2_summarizer_failure_keeps_fitting_tail():
+    """C2: on summarizer failure the degrade returns a tail that FITS the
+    budget — not the whole over-budget history (which admission would drop)."""
+    from rune import context_broker as cb
+
+    window = 8192
+    budget = cb.default_budget(window)
+    messages = [{"role": "user", "content": "x" * 4000} for _ in range(10)]  # ~10k tokens
+    compacted, event = cb.compact_history(
+        messages,
+        window,
+        summarizer=lambda m: (_ for _ in ()).throw(RuntimeError("no model")),
+        source="operator",
+        session_id="deg",
+    )
+    assert event["failed"]
+    tail_tokens = sum(cb.default_estimator(m["content"]) for m in compacted)
+    assert tail_tokens <= budget, f"degraded tail {tail_tokens} still over budget {budget}"
+    assert len(compacted) < len(messages)
+
+
+def test_i1_collective_mandatory_overflow_raises():
+    """I1: several mandatory blocks that individually fit but collectively
+    exceed the budget must raise ContextOverflowError."""
+    from rune.context_broker import ContextBroker, ContributionBlock, ContextOverflowError
+
+    broker = ContextBroker()
+    broker.register_contributor(
+        "big_user", lambda t, s: ContributionBlock("user", 100, "u" * 400, 0, "t", evictable=False), 4
+    )
+    broker.register_contributor(
+        "big_persona", lambda t, s: ContributionBlock("persona", 100, "p" * 400, 0, "t", evictable=False), 0
+    )
+    try:
+        broker.assemble(SimpleNamespace(description="task"), {}, budget_tokens=150)
+        raise AssertionError("collective overflow was silent (I1 regression)")
+    except ContextOverflowError:
+        pass
+
+
+def test_i5_malformed_contributor_content_is_t1_failure():
+    """I5: a contributor returning malformed content (None content / int) is
+    a recorded T1 failure + degrade, not a raw TypeError crash."""
+    from rune.context_broker import ContextBroker, ContributionBlock
+
+    broker = ContextBroker()
+    broker.register_contributor("broken", lambda t, s: ContributionBlock("broken", 50, None, 0, "t"), 1)
+    broker.register_contributor("ok", lambda t, s: ContributionBlock("ok", 50, "fine", 0, "t"), 1)
+    capsule, trace = broker.assemble(SimpleNamespace(description="t"), {}, budget_tokens=1000)
+    assert "broken" in trace["degraded"], "malformed content not recorded as T1 degrade"
+    assert "ok" in trace["admitted"], "healthy contributor lost"
+    from rune.subsystem_health import registry as get_registry
+
+    assert get_registry().snapshot()["broken"]["failures"] >= 1, "no registry entry for malformed content"

tests/test_forge_client.py

@@ -0,0 +1,67 @@
+"""Forge client: config-driven, protocol-shaped, adapters for Gitea/Forgejo/none."""
+
+import json
+from unittest.mock import patch
+
+import pytest
+
+from rune.forge_client import (
+    ForgeClient,
+    GiteaForgejoAdapter,
+    NullAdapter,
+    create_forge_client,
+)
+
+
+def test_protocol_is_structural():
+    assert issubclass(GiteaForgejoAdapter, ForgeClient)
+    assert issubclass(NullAdapter, ForgeClient)
+
+
+def test_null_adapter_is_noop():
+    adapter = NullAdapter()
+    r = adapter.create_issue("title", "body")
+    assert r["created"] is False
+    r = adapter.add_comment(1, "comment")
+    assert r["created"] is False
+    assert adapter.get_issue_state(1) == {"state": "unknown"}
+    assert adapter.list_open_issues() == []
+
+
+def test_create_forge_client_unconfigured_returns_null():
+    client = create_forge_client(None)
+    assert isinstance(client, NullAdapter)
+
+
+def test_create_forge_client_configured_returns_adapter(monkeypatch):
+    monkeypatch.setenv("FORGE_URL", "https://forge.example.com")
+    monkeypatch.setenv("FORGE_TOKEN", "test_token")
+    client = create_forge_client({})
+    assert isinstance(client, GiteaForgejoAdapter)
+    assert client._base_url == "https://forge.example.com/api/v1/repos/owner/repo"
+
+
+def test_gitea_adapter_create_issue_sends_post(monkeypatch):
+    adapter = GiteaForgejoAdapter("https://forge.example.com", "tok", owner="o", repo="r")
+    captured = {}
+
+    class FakeResponse:
+        def json(self):
+            return {"number": 42, "state": "open"}
+
+        def raise_for_status(self):
+            pass
+
+    def fake_post(url, **kwargs):
+        captured["url"] = url
+        captured["headers"] = kwargs.get("headers", {})
+        captured["json_data"] = kwargs.get("json", {})
+        return FakeResponse()
+
+    with patch("rune.forge_client.httpx.post", side_effect=fake_post):
+        result = adapter.create_issue("Test", "Body")
+
+    assert result["number"] == 42
+    assert "issues" in captured["url"]
+    assert captured["json_data"]["title"] == "Test"
+    assert captured["headers"]["Authorization"] == "token tok"

tests/test_henxels_contract.py

@@ -0,0 +1,122 @@
+"""Frozen tests for the structural contract (#138).
+
+Proves the custom statement bites (red-green) and the contract is
+well-formed (non-empty, every statement real, nothing inert).
+"""
+
+import subprocess
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+
+
+def _check_all() -> subprocess.CompletedProcess:
+    return subprocess.run(
+        ["henxels", "check", "--all", "--plain"],
+        capture_output=True,
+        text=True,
+        cwd=REPO,
+    )
+
+
+def test_ci_runs_all_canaries_statement_bites(tmp_path):
+    """Unregistered canary name -> statement returns an instruction."""
+    from henxels_checks import ci_runs_all_canaries
+
+    verdict = ci_runs_all_canaries(
+        "src/rune/canary_unregistered_example.py", "src/rune/canary_unregistered_example.py", REPO
+    )
+    assert verdict is not None
+    assert "ci.yml" in verdict
+
+
+def test_ci_runs_all_canaries_accepts_registered():
+    from henxels_checks import ci_runs_all_canaries
+
+    assert (
+        ci_runs_all_canaries("src/rune/canary_schema_migration.py", "src/rune/canary_schema_migration.py", REPO) is None
+    )
+
+
+def test_ci_runs_all_canaries_ignores_non_canaries():
+    from henxels_checks import ci_runs_all_canaries
+
+    assert ci_runs_all_canaries("src/rune/rune_tui.py", "src/rune/rune_tui.py", REPO) is None
+
+
+def test_ci_runs_all_canaries_bites_in_subdirectories():
+    """Quality-gate I1: a canary one directory deeper must still be governed."""
+    from henxels_checks import ci_runs_all_canaries
+
+    nested = "src/rune/orchestration/canary_nested_example.py"
+    verdict = ci_runs_all_canaries(nested, nested, REPO)
+    assert verdict is not None, "subdir canary slipped through the guard (I1 blindspot)"
+    assert "ci.yml" in verdict
+
+
+def test_contract_scope_matches_nested_canaries():
+    """The henxels.yaml canary scope must cross directories (henxels glob: * never crosses /; ** does)."""
+    from henxels.util.glob import glob_match
+
+    assert glob_match("src/rune/**/canary_*.py", "src/rune/canary_top.py")
+    assert glob_match("src/rune/**/canary_*.py", "src/rune/orchestration/canary_deep.py")
+    assert not glob_match("src/rune/**/canary_*.py", "src/rune/rune_tui.py")
+
+
+def test_agents_md_digest_is_in_sync():
+    """Quality-gate I4 — the umbrella rule made mechanical: if henxels.yaml
+    changes, AGENTS.md must be re-synced (henxels sync), or this fails."""
+    from henxels.contract import load_contract
+    from henxels.digest import render_digest
+
+    rendered = render_digest(load_contract(REPO / "henxels.yaml"))
+    agents = (REPO / "AGENTS.md").read_text()
+    assert rendered.strip() in agents, "AGENTS.md digest is stale — run `henxels sync` and commit both together"
+
+
+def test_contract_is_nonempty_and_loads():
+    """The empty-contract trap: contract must hold real rules that actually enforce."""
+    cfg = (REPO / "henxels.yaml").read_text()
+    assert "henxels:" in cfg
+    assert cfg.count("henxel:") >= 5
+
+
+def test_every_canary_on_disk_is_registered_in_ci():
+    """Live-tree check: no canary left behind (the gap #138 closes)."""
+    canaries = sorted(str(p.relative_to(REPO)) for p in (REPO / "src" / "rune").rglob("canary_*.py"))
+    assert canaries, "no canaries found — rglob broken?"
+    ci_text = (REPO / ".gitea" / "workflows" / "ci.yml").read_text()
+    missing = [c for c in canaries if Path(c).name not in ci_text]
+    assert missing == [], f"canaries missing from CI: {missing}"
+
+
+def test_canary_native_tolerance_is_content_matched():
+    """Quality-gate I2: the #139 tolerance matches ONLY the two known
+    false-failure messages. Any other error must count as failed."""
+    import importlib.util
+
+    spec = importlib.util.spec_from_file_location("_cn", REPO / "src" / "rune" / "canary_native.py")
+    # canary_native runs its main() at import under __main__ guard — read the
+    # tuple directly instead of importing the module.
+    source = (REPO / "src" / "rune" / "canary_native.py").read_text()
+    import re as _re
+
+    match = _re.search(r"known_false_failures = \(([^)]*)\)", source)
+    assert match, "tolerance tuple not found in canary_native.py"
+    namespace = {}
+    exec(f"known_false_failures = ({match.group(1)})", namespace)
+    tolerance = namespace["known_false_failures"]
+
+    tolerated = [
+        "rune_tui.py:2: Import '__future__' — module not found in rune/ or scripts/",
+        "rune_tui.py:92: Import 'rune' — module not found in rune/ or scripts/",
+    ]
+    must_fail = [
+        "rune_tui.py:99: Import 'rune_tui_helper' — module not found in rune/ or scripts/",
+        "rune_tui.py:100: Import 'os' — module not found in rune/ or scripts/",
+        "Widget missing: StatusBar",
+    ]
+    for err in tolerated:
+        assert any(k in err for k in tolerance), f"known false-failure not tolerated: {err}"
+    for err in must_fail:
+        assert not any(k in err for k in tolerance), f"over-tolerant: {err!r} matched"

tests/test_orchestration_conversation_state.py

@@ -0,0 +1,471 @@
+"""Canonical ConversationState and TaskState (#18 / P0-02).
+
+Covers the records (CS1), TaskStateRepository (CS2),
+ConversationStateRepository (CS3), composition + send_task integration
+(CS4), and the legacy operator.json migration + canary/docs/CI wiring
+(CS5).
+"""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "src"))
+
+from rune import rune_operator  # noqa: E402
+from rune.orchestration.atomic import AtomicStore  # noqa: E402
+from rune.orchestration.composition import (  # noqa: E402
+    AUTHORITY_KINDS,
+    build_conversation_state,
+    build_root,
+    compose_conversation_state,
+)
+from rune.orchestration.conversation_state import (  # noqa: E402
+    OPEN_TASK_STATUSES,
+    ConversationStateRepository,
+    IllegalTaskTransitionError,
+    TaskStateRepository,
+    migrate_operator_tasks,
+)
+from rune.orchestration.event_store import DurableEventStore  # noqa: E402
+from rune.orchestration.records import (  # noqa: E402
+    SCHEMA_VERSION,
+    ConversationMessageRecord,
+    TaskStateRecord,
+    TASK_STATUSES,
+)
+from rune.tool_protocol import OperatorResponse, ToolEvent, ToolRequest  # noqa: E402
+
+
+@pytest.fixture()
+def repos(tmp_path: Path):
+    """One event log + hot store with both repositories bound to them."""
+    events = DurableEventStore(tmp_path / "events.jsonl")
+    hot = AtomicStore(tmp_path / "hot")
+    tasks = TaskStateRepository(events, hot)
+    conv = ConversationStateRepository(events, hot, tasks=tasks)
+    return SimpleNamespaceFixture(tasks=tasks, conv=conv, events=events, tmp_path=tmp_path)
+
+
+class SimpleNamespaceFixture:
+    def __init__(self, tasks, conv, events, tmp_path):
+        self.tasks = tasks
+        self.conv = conv
+        self.events = events
+        self.tmp_path = tmp_path
+
+    def restart(self):
+        """Simulate a process restart: fresh instances over the same disk."""
+        hot = AtomicStore(self.tmp_path / "hot")
+        tasks = TaskStateRepository(self.events, hot)
+        conv = ConversationStateRepository(self.events, hot, tasks=tasks)
+        return SimpleNamespaceFixture(tasks=tasks, conv=conv, events=self.events, tmp_path=self.tmp_path)
+
+
+# ---------------------------------------------------------------- CS1
+
+
+def test_task_state_record_round_trip_and_defaults():
+    rec = TaskStateRecord(title="Fix the login bug", channel_id="task", assigned_model="qwen3:14b")
+    assert rec.task_id.startswith("task_")
+    assert rec.status == "created"
+    assert rec.created_at and rec.updated_at  # non-empty ISO timestamps
+    assert rec.parent_task_id is None
+    assert rec.outcome_ref == ""
+    assert rec.schema_version == SCHEMA_VERSION
+    restored = TaskStateRecord.from_dict(rec.to_dict())
+    assert restored == rec
+    # dict boundary: JSON round trip preserves every field
+    assert TaskStateRecord.from_dict(json.loads(json.dumps(rec.to_dict()))) == rec
+
+
+def test_conversation_message_record_round_trip_and_defaults():
+    msg = ConversationMessageRecord(
+        role="user",
+        content="hello rune",
+        channel_id="task",
+        task_id="task_abc123",
+        token_estimate=2,
+    )
+    assert msg.msg_id.startswith("msg_")
+    assert msg.ts  # non-empty ISO timestamp
+    restored = ConversationMessageRecord.from_dict(msg.to_dict())
+    assert restored == msg
+    assert ConversationMessageRecord.from_dict(json.loads(json.dumps(msg.to_dict()))) == msg
+
+
+def test_task_state_status_vocabulary():
+    assert set(TASK_STATUSES) == {
+        "created",
+        "running",
+        "awaiting_approval",
+        "completed",
+        "failed",
+        "cancelled",
+        "superseded",
+    }
+    assert OPEN_TASK_STATUSES == {"created", "running", "awaiting_approval"}
+    assert TaskStateRecord().status in TASK_STATUSES
+
+
+# ---------------------------------------------------------------- CS2
+
+
+def test_task_state_create_mints_canonical_record(repos):
+    rec = repos.tasks.create("Fix login", "task", model="qwen3:14b")
+    assert rec.task_id.startswith("task_")
+    assert rec.status == "created"
+    assert rec.channel_id == "task"
+    assert rec.assigned_model == "qwen3:14b"
+    # the transition is durably logged
+    assert "task_state.created" in [e["event_type"] for e in repos.events.replay()]
+    # the hot checkpoint survives a restart
+    reborn = repos.restart()
+    assert reborn.tasks.get(rec.task_id).title == "Fix login"
+    assert reborn.tasks.get_active("task").task_id == rec.task_id
+
+
+def test_task_state_amend_keeps_identity_and_updates_title(repos):
+    rec = repos.tasks.create("Fix login", "task")
+    amended = repos.tasks.amend(rec.task_id, "Fix login and add tests")
+    assert amended.task_id == rec.task_id  # same identity — follow-up, not a new task
+    assert amended.title == "Fix login and add tests"
+    assert repos.tasks.get(rec.task_id).title == "Fix login and add tests"
+    assert "task_state.amended" in [e["event_type"] for e in repos.events.replay()]
+    with pytest.raises(KeyError):
+        repos.tasks.amend("task_missing", "nope")
+
+
+def test_task_state_transition_follows_status_spine(repos):
+    rec = repos.tasks.create("Ship it", "task")
+    repos.tasks.transition(rec.task_id, "running")
+    repos.tasks.transition(rec.task_id, "awaiting_approval")
+    repos.tasks.transition(rec.task_id, "completed")
+    assert repos.tasks.get(rec.task_id).status == "completed"
+    assert repos.tasks.get_active("task") is None  # terminal status clears active
+    with pytest.raises(IllegalTaskTransitionError):
+        repos.tasks.transition(rec.task_id, "running")  # completed is terminal
+    with pytest.raises(IllegalTaskTransitionError):
+        repos.tasks.transition(rec.task_id, "bogus")  # unknown status
+    with pytest.raises(KeyError):
+        repos.tasks.transition("task_missing", "running")
+
+
+def test_task_state_get_active_returns_open_task_and_clears_on_terminal(repos):
+    assert repos.tasks.get_active("task") is None
+    rec = repos.tasks.create("Work", "task")
+    assert repos.tasks.get_active("task").task_id == rec.task_id
+    repos.tasks.transition(rec.task_id, "failed")
+    assert repos.tasks.get_active("task") is None
+    # per-channel isolation
+    other = repos.tasks.create("Other", "chat")
+    assert repos.tasks.get_active("chat").task_id == other.task_id
+    assert repos.tasks.get_active("task") is None
+
+
+def test_task_state_get_returns_record_or_none(repos):
+    assert repos.tasks.get("task_nope") is None
+    rec = repos.tasks.create("Work", "task")
+    assert repos.tasks.get(rec.task_id).task_id == rec.task_id
+
+
+def test_task_state_list_open_filters_by_channel_and_status(repos):
+    a = repos.tasks.create("A", "task")
+    b = repos.tasks.create("B", "task")
+    c = repos.tasks.create("C", "chat")
+    repos.tasks.transition(b.task_id, "completed")
+    assert [t.task_id for t in repos.tasks.list_open("task")] == [a.task_id]
+    assert [t.task_id for t in repos.tasks.list_open("chat")] == [c.task_id]
+    assert all(t.status in OPEN_TASK_STATUSES for t in repos.tasks.list_open("chat"))
+
+
+# ---------------------------------------------------------------- CS3
+
+
+def test_conversation_append_persists_message(repos):
+    msg = ConversationMessageRecord(role="user", content="hi", channel_id="task", task_id="t1")
+    stored = repos.conv.append(msg)
+    assert stored.msg_id == msg.msg_id
+    assert "conversation.message" in [e["event_type"] for e in repos.events.replay()]
+    reborn = repos.restart()
+    assert [m.msg_id for m in reborn.conv.window("task", n=10)] == [msg.msg_id]
+
+
+def test_conversation_window_returns_last_n_chronological(repos):
+    for i in range(12):
+        repos.conv.append(ConversationMessageRecord(role="user", content=f"m{i}", channel_id="task"))
+    win = repos.conv.window("task", n=8)
+    assert [m.content for m in win] == [f"m{i}" for i in range(4, 12)]
+    assert repos.conv.window("task") == win  # default n=8
+    repos.conv.append(ConversationMessageRecord(role="user", content="chat-only", channel_id="chat"))
+    assert all(m.channel_id == "task" for m in repos.conv.window("task", n=100))
+    assert repos.conv.window("task", n=0) == []
+
+
+def test_conversation_messages_for_task_filters(repos):
+    repos.conv.append(ConversationMessageRecord(role="user", content="a", channel_id="task", task_id="t1"))
+    repos.conv.append(ConversationMessageRecord(role="assistant", content="b", channel_id="task", task_id="t1"))
+    repos.conv.append(ConversationMessageRecord(role="user", content="c", channel_id="task", task_id="t2"))
+    assert [m.content for m in repos.conv.messages_for_task("t1")] == ["a", "b"]
+    assert repos.conv.messages_for_task("missing") == []
+
+
+def test_conversation_latest_task_returns_most_recent(repos):
+    first = repos.tasks.create("First", "task")
+    assert repos.conv.latest_task("task").task_id == first.task_id
+    second = repos.tasks.create("Second", "task")
+    assert repos.conv.latest_task("task").task_id == second.task_id
+    assert repos.conv.latest_task("chat") is None
+
+
+# ---------------------------------------------------------------- CS4
+
+
+def test_authority_kinds_declare_conversation_and_task_state():
+    assert "conversation_state" in AUTHORITY_KINDS
+    assert "task_state" in AUTHORITY_KINDS
+
+
+def test_build_conversation_state_wires_single_authorities(tmp_path: Path):
+    paths = {
+        "events": tmp_path / "e.jsonl",
+        "evidence": tmp_path / "ev",
+        "state": tmp_path / "state",
+    }
+    root = build_conversation_state(paths)
+    root.assert_single_authority()
+    tasks = root.get("task_state")
+    conv = root.get("conversation_state")
+    assert isinstance(tasks, TaskStateRepository)
+    assert isinstance(conv, ConversationStateRepository)
+    # one shared durable log carries both ledgers
+    rec = tasks.create("Work", "task")
+    conv.append(ConversationMessageRecord(role="user", content="go", channel_id="task", task_id=rec.task_id))
+    assert len(root.get("event_store").replay()) == 2
+    # compose_conversation_state also wires into an existing root
+    root2 = build_root({"events": tmp_path / "e2.jsonl", "evidence": tmp_path / "ev2"})
+    auth = compose_conversation_state(root2, tmp_path / "state2")
+    root2.assert_single_authority()
+    assert auth.task_state is root2.get("task_state")
+    assert auth.conversation is root2.get("conversation_state")
+    assert auth.conversation.latest_task("task") is None
+
+
+class SendTaskIntegrationTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.tempdir = tempfile.TemporaryDirectory()
+        self.tmp = Path(self.tempdir.name)
+        self.operator = rune_operator.RuneOperator(str(self.tmp / "operator.json"))
+
+    def tearDown(self) -> None:
+        self.tempdir.cleanup()
+
+    @staticmethod
+    def pending_response() -> OperatorResponse:
+        request = ToolRequest(
+            call_id="call-1",
+            name="write_file",
+            arguments={"path": "/tmp/a", "content": "new"},
+            source="ollama-native",
+        )
+        return OperatorResponse(
+            success=True,
+            tool_events=[ToolEvent("pending_approval", request)],
+            pending_approval=request,
+            pending_state={"messages": []},
+            model="qwen3:8b",
+        )
+
+    def test_send_task_amends_active_task_on_follow_up(self):
+        with patch.object(self.operator, "_execute_on_model", return_value=self.pending_response()):
+            first = self.operator.send_task("change the login flow", "qwen3:8b")
+
+        active = self.operator._task_state.get_active("task")
+        assert active is not None
+        assert active.task_id == first["task"]["task_id"]
+        assert active.status == "awaiting_approval"
+
+        done = OperatorResponse(success=True, user_text="Done.", model="qwen3:8b")
+        with patch.object(self.operator, "_execute_on_model", return_value=done):
+            second = self.operator.send_task("yes continue with that", "qwen3:8b")
+
+        # follow-up AMENDED the active task instead of minting a new one
+        assert second["task"]["task_id"] == first["task"]["task_id"]
+        assert self.operator._task_state.get(second["task"]["task_id"]).status == "completed"
+        assert self.operator._task_state.get_active("task") is None
+        messages = self.operator._conversation.messages_for_task(first["task"]["task_id"])
+        assert [(m.role, m.content) for m in messages] == [
+            ("user", "change the login flow"),
+            ("user", "yes continue with that"),
+            ("assistant", "Done."),
+        ]
+
+    def test_send_task_creates_new_task_with_parent_lineage_and_messages(self):
+        done = OperatorResponse(success=True, user_text="All done.", model="qwen3:8b")
+        with patch.object(self.operator, "_execute_on_model", return_value=done):
+            first = self.operator.send_task("write the parser", "qwen3:8b")
+            second = self.operator.send_task("now write its tests", "qwen3:8b")
+
+        assert second["task"]["task_id"] != first["task"]["task_id"]
+        second_rec = self.operator._task_state.get(second["task"]["task_id"])
+        assert second_rec.parent_task_id == first["task"]["task_id"]
+        assert second_rec.status == "completed"
+        assert self.operator._task_state.get_active("task") is None
+        window = self.operator._conversation.window("task", n=10)
+        assert [(m.role, m.content) for m in window] == [
+            ("user", "write the parser"),
+            ("assistant", "All done."),
+            ("user", "now write its tests"),
+            ("assistant", "All done."),
+        ]
+        assert window[2].task_id == second["task"]["task_id"]
+
+
+# ---------------------------------------------------------------- CS5
+
+
+def test_migrate_operator_tasks_imports_legacy_ledger(repos):
+    legacy = {
+        "identity": "Rune",
+        "current_task": "cc33dd44",
+        "tasks": [
+            {
+                "task_id": "aa11bb22",
+                "description": "hello",
+                "status": "completed",
+                "assigned_model": "qwen2.5:7b",
+                "result": "hi there",
+                "created_at": "2026-08-22T00:25:02+00:00",
+                "completed_at": "2026-08-22T00:25:03+00:00",
+            },
+            {
+                "task_id": "cc33dd44",
+                "description": "running thing",
+                "status": "running",
+                "assigned_model": "m",
+                "result": None,
+                "created_at": "2026-08-22T01:00:00+00:00",
+                "completed_at": None,
+            },
+            {
+                "task_id": "ee55ff66",
+                "description": "broken thing",
+                "status": "failed",
+                "assigned_model": "m",
+                "result": "boom",
+                "created_at": "2026-08-22T02:00:00+00:00",
+                "completed_at": None,
+            },
+        ],
+    }
+    path = repos.tmp_path / "operator.json"
+    path.write_text(json.dumps(legacy))
+
+    report = migrate_operator_tasks(path, repos.tasks, repos.conv)
+    assert report.imported == 3
+    assert report.skipped == 0
+    assert report.messages == 4  # 3 user + 1 assistant (completed result only)
+    assert repos.tasks.get("aa11bb22").status == "completed"
+    assert repos.tasks.get("cc33dd44").status == "running"
+    assert repos.tasks.get("ee55ff66").status == "failed"
+    assert repos.tasks.get("aa11bb22").channel_id == "task"
+    # legacy current_task pointer is honored
+    assert repos.tasks.get_active("task").task_id == "cc33dd44"
+    # conversation history is reconstructed, nothing lost
+    assert [(m.role, m.content) for m in repos.conv.messages_for_task("aa11bb22")] == [
+        ("user", "hello"),
+        ("assistant", "hi there"),
+    ]
+    assert [m.content for m in repos.conv.messages_for_task("ee55ff66")] == ["broken thing"]
+
+    # idempotent: a second pass imports nothing
+    report2 = migrate_operator_tasks(path, repos.tasks, repos.conv)
+    assert report2.imported == 0
+    assert report2.skipped == 3
+
+
+def test_operator_auto_migrates_legacy_state_on_init(tmp_path: Path):
+    legacy = {
+        "identity": "Rune",
+        "tasks": [
+            {
+                "task_id": "zz99",
+                "description": "old task",
+                "status": "completed",
+                "assigned_model": "m",
+                "result": "done",
+                "created_at": "2026-08-22T00:00:00+00:00",
+                "completed_at": "2026-08-22T00:01:00+00:00",
+            }
+        ],
+    }
+    (tmp_path / "operator.json").write_text(json.dumps(legacy))
+    operator = rune_operator.RuneOperator(str(tmp_path / "operator.json"))
+    assert operator._task_state.get("zz99") is not None
+    assert operator._task_state.get("zz99").status == "completed"
+    assert operator._conversation.messages_for_task("zz99")[0].content == "old task"
+    # module-level history reader works against the installed singleton
+    with patch.object(rune_operator, "_operator", operator):
+        assert rune_operator.get_conversation_window("task", n=8)[0]["content"] == "old task"
+
+
+def test_canary_script_runs_clean():
+    result = subprocess.run(
+        [sys.executable, str(ROOT / "src/rune/canary_conversation_state.py")],
+        capture_output=True,
+        text=True,
+        timeout=60,
+    )
+    assert result.returncode == 0, result.stderr
+    assert "CONVERSATION STATE CANARY PASSED" in result.stdout
+
+
+def test_docs_exist_and_ci_wiring():
+    docs = (ROOT / "docs/conversation-state.md").read_text()
+    assert "src/rune/orchestration/conversation_state.py" in docs
+    assert "pytest" in docs
+    ci = (ROOT / ".gitea/workflows/ci.yml").read_text()
+    assert "canary_conversation_state.py" in ci
+
+
+def test_self_edges_allow_idempotent_reassertion(repos):
+    # P0-02 quality B1+B2 discharge: chained approvals re-enter
+    # awaiting_approval; amend-while-running re-enters running. Self-edges
+    # make both idempotent instead of crashing with IllegalTaskTransition.
+    repo = repos.tasks
+    task = repo.create("test task", channel_id="task", model="m")
+    repo.transition(task.task_id, "running")
+    # Re-assert running (B2: amend-while-running)
+    repo.transition(task.task_id, "running")
+    assert repo.get(task.task_id).status == "running"
+    # Re-enter awaiting_approval (B1: chained approval)
+    repo.transition(task.task_id, "awaiting_approval")
+    repo.transition(task.task_id, "awaiting_approval")
+    assert repo.get(task.task_id).status == "awaiting_approval"
+    # Back to running then awaiting again (normal multi-tool loop)
+    repo.transition(task.task_id, "running")
+    repo.transition(task.task_id, "awaiting_approval")
+    assert repo.get(task.task_id).status == "awaiting_approval"
+
+
+def test_terminal_states_still_reject_all(repos):
+    # Self-edges only apply to non-terminal states.
+    import pytest
+    from rune.orchestration.conversation_state import IllegalTaskTransitionError
+
+    repo = repos.tasks
+    task = repo.create("done task", channel_id="task", model="m")
+    repo.transition(task.task_id, "completed")
+    with pytest.raises(IllegalTaskTransitionError):
+        repo.transition(task.task_id, "running")
+    with pytest.raises(IllegalTaskTransitionError):
+        repo.transition(task.task_id, "completed")

tests/test_p0_04_pipeline_removal.py

@@ -0,0 +1,145 @@
+"""P0-04: the per-turn cognitive pipeline must not run on ordinary messages.
+
+Frozen contract: (1) sending a message does NOT invoke any of the 21 pipeline
+subsystems; (2) every subsystem remains reachable on demand (/commands and
+direct module calls); (3) the model-facing path (broker) is untouched.
+"""
+
+import sys
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import Mock, patch
+
+REPO = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(REPO / "src"))
+
+from rune import rune_operator, rune_tui  # noqa: E402
+
+
+def _make_app():
+    """Build a RuneApp with backend stubs (no live Ollama, no TUI runtime)."""
+    # RuneApp() is safe to construct without a running event loop: __init__
+    # only wires attributes and loads model state (channels/status_bar stay
+    # None until on_mount, which we never run). The post-P0-04 pipeline
+    # no-op never touches them.
+    return rune_tui.RuneApp()
+
+
+def test_sending_message_runs_no_pipeline_subsystems():
+    """Ordinary chat must not invoke warm_router.route, witness.detect_signals,
+    drift_ledger.check, sleep_time.consolidate, or any of the 21 steps."""
+    app = _make_app()
+    with (
+        patch.object(rune_tui.warm_router, "route") as wr,
+        patch.object(rune_tui.witness, "detect_signals") as ws,
+        patch.object(rune_tui.drift_ledger, "check") as dl,
+        patch.object(rune_tui.sleep_time, "consolidate") as st,
+        patch.object(rune_tui.capability_broker, "match_capabilities") as cb,
+        patch.object(rune_tui.memory_store, "cached_recall") as mr,
+    ):
+        app._run_warm_router("hi", channel="task")  # method must be a no-op now
+        wr.assert_not_called()
+        ws.assert_not_called()
+        dl.assert_not_called()
+        st.assert_not_called()
+        cb.assert_not_called()
+        mr.assert_not_called()
+
+
+def test_warm_router_method_is_noop():
+    """_run_warm_router exists (compat) but does nothing."""
+    app = _make_app()
+    assert app._run_warm_router("anything", channel="task") is None
+
+
+def test_subsystems_remain_available_on_demand():
+    """/commands still dispatch: _cmd_drift, _cmd_pressure, _cmd_events exist."""
+    app = _make_app()
+    for cmd in ("_cmd_drift", "_cmd_pressure", "_cmd_events", "_cmd_health"):
+        assert hasattr(app, cmd), f"{cmd} removed — functionality must be immutable"
+
+
+def test_pre_dispatch_parallel_block_removed():
+    """The pre-message dispatch (auto_context/auto_tasks/behavior) no longer
+    runs per message — _send_to_model goes straight to the operator."""
+    import inspect
+
+    src = inspect.getsource(rune_tui.RuneApp._send_to_model)
+    assert "build_auto_context" not in src
+    assert "extract_tasks" not in src
+    assert "match_context" not in src
+
+
+def test_broker_path_untouched():
+    """The model-facing context path still flows through the ContextBroker."""
+    import inspect
+
+    src = inspect.getsource(rune_tui.RuneApp._send_to_model)
+    assert "send_task" in src  # operator call intact
+
+
+# ── Task 3 addendum (P0-04 plan): the meaningful-event seed ──────────────
+# Not part of the 5 frozen tests; additive lock for the new task.failed emit.
+
+
+def test_operator_failure_emits_task_failed_event():
+    """The operator's failed transition emits the typed task.failed event.
+
+    Verified during research that NO emit existed (record_failure in the
+    operator only covers subsystem degradations → capability.failed), so
+    P0-04 Task 3 adds the emit rather than documenting an existing one.
+    """
+    import tempfile
+
+    from rune import rune_operator
+    from rune.tool_protocol import OperatorResponse
+
+    with tempfile.TemporaryDirectory() as td:
+        # I-1 (general-176): EVENT_LOG resolves at import time, so env patches
+        # are useless here — patch the store path function (call-time seam)
+        # so BOTH the emit and log() hit the tempdir journal.
+        with patch.object(rune_operator.event_bus, "_store_path", return_value=Path(td) / "journal" / "events.jsonl"):
+            op = rune_operator.RuneOperator(str(Path(td) / "operator.json"))
+            runtime = Mock()
+            runtime.run.side_effect = RuntimeError("canary failure")
+            profile = SimpleNamespace(safety_tier=2)
+            with (
+                patch.object(rune_operator, "LocalToolRuntime", return_value=runtime),
+                patch.object(rune_operator, "OllamaChatTransport", return_value=Mock()),
+                patch.object(
+                    rune_operator.model_profiles,
+                    "get_or_create_profile",
+                    return_value=profile,
+                ),
+                patch.object(rune_operator.model_profiles, "get_prompt_context", return_value=""),
+                patch.object(rune_operator.model_profiles, "record_interaction"),
+                patch("rune.attention_capsule.create_capsule", return_value=SimpleNamespace(token_count=1)),
+                patch("rune.memory_store.connect", return_value=Mock()),
+                patch("rune.memory_store.cached_recall", return_value=[]),
+                patch.object(op, "_log_token_usage"),
+            ):
+                result = op.send_task("fail on purpose", "qwen3:8b")
+
+            assert result.get("success") is False
+            events = rune_operator.event_bus.log()
+            failed = [e for e in events if e.get("event_type") == "task.failed"]
+            assert failed, "operator failure did not emit task.failed"
+            assert failed[0]["partition_key"] == "rune_operator"
+            # I-1: bind to THIS run — the failed task must exist in the operator
+            # state for this exact run (stale journal events cannot satisfy it).
+            failed_tasks = [t for t in op.state.tasks if t.status == "failed"]
+            assert failed_tasks, "no failed task recorded for this run"
+            assert any(t.description == "fail on purpose" for t in failed_tasks), (
+                "this run's failed task not in operator state"
+            )
+
+
+def test_response_failure_still_carries_error_without_emitting_twice():
+    """A failed send_task emits exactly ONE task.failed (no double emit via
+    the approval-resolution path)."""
+    import inspect
+
+    src = inspect.getsource(rune_operator.RuneOperator._apply_runtime_result)
+    assert src.count("_emit_task_failed") == 1
+    direct = inspect.getsource(rune_operator.RuneOperator.send_task)
+    assert direct.count("_emit_task_failed") == 1

tests/test_p0_05_acceptance.py

@@ -0,0 +1,92 @@
+"""P0-05 acceptance: qwen3:14b completes a multi-step disposable coding task
+using REAL native tool calls. Skips cleanly when Ollama is unreachable (CI)."""
+
+import os
+import shutil
+import urllib.request
+from pathlib import Path
+
+import pytest
+
+from rune.local_tool_runtime import LocalToolRuntime, OllamaChatTransport
+from rune.tool_executor import execute_tool
+
+
+def _ollama_up() -> bool:
+    try:
+        urllib.request.urlopen("http://127.0.0.1:11434/api/tags", timeout=2)
+        return True
+    except Exception:
+        return False
+
+
+pytestmark = pytest.mark.skipif(
+    not _ollama_up() or os.environ.get("GITHUB_ACTIONS") == "true",
+    reason=("Ollama not reachable, or CI: the live-model E2E is nondeterministic "
+            "when a runner host has Ollama (shell-syntax approval gate); CI skips it "
+            "exactly as the Pi runner did when Ollama was unreachable"),
+)
+
+
+def test_qwen3_14b_fixes_broken_add_end_to_end(tmp_path):
+    """The issue's acceptance scenario, in-suite: read → edit → run → verified,
+    with approval pauses resolved programmatically (the TUI's own flow)."""
+    sandbox = Path(os.path.expanduser("~")) / ".rune-e2e-probe" / "p0-05"
+    shutil.rmtree(sandbox, ignore_errors=True)
+    sandbox.mkdir(parents=True)
+    calc = sandbox / "calc.py"
+    calc.write_text("def add(a, b):\n    return a - b\n")
+
+    runtime = LocalToolRuntime(
+        transport=OllamaChatTransport(timeout=90),
+        executor=execute_tool,
+        model="qwen3:14b",
+    )
+    resp = runtime.run(
+        [
+            {
+                "role": "system",
+                "content": "You are a coding agent. Fix bugs using your tools: "
+                "read_file, edit_file, run_command. Work step by step until verified.",
+            },
+            {
+                "role": "user",
+                "content": f"The function add() in {calc} is broken — it should add, "
+                "not subtract. Fix it and PROVE the fix by running: "
+                f"python3 -c \"import sys; sys.path.insert(0,'{sandbox}'); "
+                "from calc import add; assert add(2,3)==5; print('OK')\"",
+            },
+        ],
+        options={"num_ctx": 16384, "num_predict": 1024},
+        think=False,
+    )
+    rounds = 0
+    while resp.pending_approval and rounds < 6:
+        resp = runtime.approve(resp.pending_state)
+        rounds += 1
+
+    assert resp.success, f"loop failed: {resp.error}"
+    names = [ev.request.name for ev in resp.tool_events]
+    assert "read_file" in names and "edit_file" in names, names
+    assert "run_command" in names, names
+    # NO faux-JSON acceptance: every executed call came through the typed path
+    assert all(ev.request.source in ("ollama-native", "text-fallback") for ev in resp.tool_events)
+    # THE acceptance: the fix actually landed
+    import importlib.util
+
+    spec = importlib.util.spec_from_file_location("calc", calc)
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    assert mod.add(2, 3) == 5
+    shutil.rmtree(sandbox.parent, ignore_errors=True)
+    # Minor-5 (general-179): unload the 14B model — a ~10 GB VRAM resident for
+    # Ollama's default 5-minute keep_alive can OOM unrelated local work.
+    try:
+        req = urllib.request.Request(
+            "http://127.0.0.1:11434/api/generate",
+            data=b'{"model": "qwen3:14b", "keep_alive": 0}',
+            headers={"Content-Type": "application/json"},
+        )
+        urllib.request.urlopen(req, timeout=10)
+    except Exception:
+        pass  # unload is best-effort; test outcome already recorded

tests/test_p0_05_native_tools.py

@@ -0,0 +1,238 @@
+"""P0-05 (#21) frozen tests: budget visibility, failure circuit breaker,
+sandbox error self-correction, tool-capable system guidance.
+
+FROZEN TESTS ARE THE SPEC (plans/2026-09-05-p0-05-native-tools.md Tasks 1-3).
+"""
+
+from __future__ import annotations
+
+import copy
+import inspect
+import sys
+import unittest
+from pathlib import Path
+from typing import Sequence, cast
+
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "src"))
+
+from rune.local_tool_runtime import (  # noqa: E402
+    ChatMessage,
+    LocalToolRuntime,
+)
+from rune.rune_operator import RuneOperator  # noqa: E402
+from rune.tool_executor import ALLOWED_WRITE_DIRS, execute_tool  # noqa: E402
+
+
+def native_call(call_id: str, name: str, arguments: object) -> dict:
+    return {
+        "id": call_id,
+        "function": {"name": name, "arguments": arguments},
+    }
+
+
+class FakeTransport:
+    def __init__(self, responses: Sequence[object]):
+        self.responses = list(responses)
+        self.calls: list[dict] = []
+
+    def supports_tools(self, model: str) -> bool:
+        return True
+
+    def supports_thinking(self, model: str) -> bool:
+        return True
+
+    def chat(
+        self,
+        *,
+        model: str,
+        messages: list[ChatMessage],
+        tools: list[dict] | None,
+        options: dict | None = None,
+        think: bool | str | None = None,
+    ) -> ChatMessage:
+        self.calls.append(copy.deepcopy(messages))
+        response = self.responses.pop(0)
+        if not isinstance(response, dict):
+            raise TypeError("fake response must be a message object")
+        return cast(ChatMessage, copy.deepcopy(response))
+
+
+class RecordingExecutor:
+    def __init__(self, results: list[dict] | None = None):
+        self.results = list(results or [])
+        self.calls: list[tuple[str, dict]] = []
+
+    def __call__(self, name: str, arguments: dict) -> dict:
+        self.calls.append((name, copy.deepcopy(arguments)))
+        if self.results:
+            return self.results.pop(0)
+        return {"success": True, "result": name}
+
+
+class P0_05NativeToolsTests(unittest.TestCase):
+    def make_runtime(
+        self,
+        responses: Sequence[object],
+        *,
+        executor: RecordingExecutor | None = None,
+        max_iterations: int = 8,
+    ) -> tuple[LocalToolRuntime, FakeTransport, RecordingExecutor]:
+        transport = FakeTransport(responses)
+        executor = executor or RecordingExecutor()
+        runtime = LocalToolRuntime(
+            transport=transport,
+            executor=executor,
+            model="qwen3:8b",
+            max_iterations=max_iterations,
+        )
+        return runtime, transport, executor
+
+    def test_response_carries_iteration_budget_fields(self):
+        """P3: every OperatorResponse from the loop reports iterations used/budget."""
+        runtime, _, _ = self.make_runtime(
+            [
+                {
+                    "role": "assistant",
+                    "content": "",
+                    "tool_calls": [native_call("1", "list_directory", {"path": "/tmp"})],
+                },
+                {"role": "assistant", "content": "done"},
+            ]
+        )
+
+        response = runtime.run([{"role": "user", "content": "inspect"}])
+
+        self.assertTrue(response.success)
+        self.assertEqual(response.iterations_used, 2)
+        self.assertEqual(response.iteration_budget, runtime.max_iterations)
+
+    def test_identical_failure_twice_stops_before_budget_burn(self):
+        """P4: the same tool failing twice with identical arguments stops the loop
+        with a typed reason — the model cannot burn all 8 iterations on it."""
+        executor = RecordingExecutor([{"success": False, "error": "boom"} for _ in range(8)])
+        responses = [
+            {
+                "role": "assistant",
+                "content": "",
+                "tool_calls": [native_call(str(i), "read_file", {"path": "/tmp/a"})],
+            }
+            for i in range(8)
+        ]
+        runtime, _, _ = self.make_runtime(responses, executor=executor)
+
+        response = runtime.run([{"role": "user", "content": "inspect"}])
+
+        self.assertFalse(response.success)
+        self.assertIn("consecutive", response.error)
+        self.assertIn("read_file", response.error)
+        self.assertLess(response.iterations_used, runtime.max_iterations)
+        self.assertEqual(response.iteration_budget, runtime.max_iterations)
+        # the breaker stopped the burn: exactly two identical executions, no more
+        self.assertEqual(len(executor.calls), 2)
+
+    def test_different_arguments_reset_the_failure_streak(self):
+        """A failing call followed by the same tool with DIFFERENT args is not a
+        streak — the loop continues."""
+        executor = RecordingExecutor([{"success": False, "error": "boom"} for _ in range(8)])
+        runtime, _, _ = self.make_runtime(
+            [
+                {
+                    "role": "assistant",
+                    "content": "",
+                    "tool_calls": [native_call("1", "read_file", {"path": "/tmp/a"})],
+                },
+                {
+                    "role": "assistant",
+                    "content": "",
+                    "tool_calls": [native_call("2", "read_file", {"path": "/tmp/b"})],
+                },
+                {"role": "assistant", "content": "recovered"},
+            ],
+            executor=executor,
+        )
+
+        response = runtime.run([{"role": "user", "content": "inspect"}])
+
+        self.assertTrue(response.success)
+        self.assertEqual(response.user_text, "recovered")
+        self.assertEqual(
+            [arguments for _, arguments in executor.calls],
+            [{"path": "/tmp/a"}, {"path": "/tmp/b"}],
+        )
+
+    def test_path_denial_names_the_allowed_directories(self):
+        """A denied write tells the model WHERE it can write — one-step recovery."""
+        result = execute_tool(
+            "write_file", {"path": "/opt/nope.txt", "content": "x"}
+        )  # /opt: outside allowed dirs, NOT in BLOCKED_DIRS (general-179 minor-3)
+        assert result["success"] is False
+        assert "allowed" in str(result["error"]).lower()
+        assert any(d.split("/")[-1] in str(result["error"]) or d in str(result["error"]) for d in ALLOWED_WRITE_DIRS)
+
+    def test_tools_block_carries_usage_guidance(self):
+        """P2: the native path's system prompt tells the model HOW to use tools
+        (a bare name list left qwen3:14b claiming it could not read files)."""
+        src = inspect.getsource(RuneOperator._contributor_tools)
+        assert "never fabricate" in src
+        assert "Read before editing" in src
+
+
+if __name__ == "__main__":
+    unittest.main()
+
+
+def test_mid_loop_failure_reports_consumed_iterations():
+    """F1 (general-179): a failure INSIDE the loop reports the turns already
+    consumed — not 0. The documented budget contract holds on every path."""
+
+    class BoomTransport:
+        def __init__(self):
+            self.calls = 0
+
+        def supports_tools(self, model):
+            return False  # text-fallback path: the script speaks the text protocol
+
+        def supports_thinking(self, model):
+            return False
+
+        def chat(self, **kwargs):
+            self.calls += 1
+            if self.calls == 3:
+                raise ConnectionError("ollama died mid-loop")
+            return {"role": "assistant", "content": self._script(self.calls)}
+
+        @staticmethod
+        def _script(turn):
+            if turn < 3:
+                # different args each turn — keeps the failure-streak breaker
+                # quiet so the test exercises the TRANSPORT error path (F1)
+                return '{"tool": "read_file", "args": {"path": "/tmp/a' + str(turn) + '"}}'
+            raise ConnectionError("ollama died mid-loop")
+
+    from rune.local_tool_runtime import LocalToolRuntime
+
+    transport = BoomTransport()
+    runtime = LocalToolRuntime(
+        transport=transport,
+        executor=lambda name, args: {"success": True, "result": "ok"},
+        model="probe",
+    )
+
+    def _failing_executor(name, args):
+        return {"success": False, "error": "boom"}
+
+    runtime.executor = _failing_executor
+    runtime.max_iterations = 8
+    resp = runtime.run(
+        [
+            {"role": "user", "content": "read /tmp/a then answer"},
+        ],
+        options={"num_ctx": 4096},
+        think=None,
+    )
+    assert resp.success is False
+    assert "transport error" in resp.error and "ollama died mid-loop" in resp.error
+    assert resp.iterations_used == 2, f"mid-loop failure reported {resp.iterations_used} — F1 regression"
+    assert resp.iteration_budget == 8

tests/test_p0_07_inference_trace.py

@@ -0,0 +1,516 @@
+"""P0-07 (#23): durable inference traces — frozen tests are the spec.
+
+Layers covered:
+1. transport usage accumulators (raw material),
+2. InferenceTrace record + JSONL store (durable shape),
+3. operator wiring (one trace per run, degrade-not-crash).
+
+The canary (src/rune/canary_p0_07.py) re-proves the same contract CI-side.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "src"))
+
+from rune import rune_operator  # noqa: E402
+from rune.context_broker import MEMORY_BLOCK_NAMES  # noqa: E402
+from rune.local_tool_runtime import OllamaChatTransport  # noqa: E402
+from rune.tool_protocol import OperatorResponse  # noqa: E402
+
+# ---------------------------------------------------------------------------
+# helpers
+# ---------------------------------------------------------------------------
+
+
+class _ScriptedTransport(OllamaChatTransport):
+    """OllamaChatTransport with _post scripted — real accumulation code runs."""
+
+    def __init__(self, responses):
+        super().__init__()
+        self._responses = list(responses)
+
+    def _post(self, path, payload):
+        if not self._responses:
+            raise AssertionError("scripted transport exhausted")
+        return self._responses.pop(0)
+
+
+def _chat_response(prompt_eval_count, eval_count, total_duration_ns):
+    """Ollama /api/chat response envelope: usage lives on the envelope."""
+    return {
+        "model": "qwen3:8b",
+        "created_at": "2026-09-05T00:00:00Z",
+        "message": {"role": "assistant", "content": "ok"},
+        "done": True,
+        "prompt_eval_count": prompt_eval_count,
+        "eval_count": eval_count,
+        "total_duration": total_duration_ns,
+    }
+
+
+def _broker_trace(**overrides):
+    """A representative broker trace (#19 assemble output)."""
+    trace = {
+        "model_id": "qwen3:8b",
+        "window": 40960,
+        "budget": 32768,
+        "blocks": [
+            {"name": "persona", "tokens": 980, "admitted": True, "reason": ""},
+            {"name": "tools", "tokens": 90, "admitted": True, "reason": ""},
+            {"name": "memory", "tokens": 75, "admitted": True, "reason": ""},
+            {"name": "history", "tokens": 400, "admitted": True, "reason": ""},
+            {"name": "user", "tokens": 20, "admitted": True, "reason": ""},
+            {
+                "name": "consolidated",
+                "tokens": 5000,
+                "admitted": False,
+                "reason": "budget: 1565+5000>32768 (lowest-priority evictable dropped)",
+            },
+        ],
+        "admitted": ["persona", "tools", "memory", "history", "user"],
+        "admitted_total": 1565,
+        "dropped": [
+            {
+                "name": "consolidated",
+                "tokens": 5000,
+                "reason": "budget: 1565+5000>32768 (lowest-priority evictable dropped)",
+            }
+        ],
+        "memory_tokens": 75,
+        "degraded": ["memory_selector"],
+        "compaction": [],
+        "elapsed_ms": 1.5,
+    }
+    trace.update(overrides)
+    return trace
+
+
+def _make_trace(**overrides):
+    """Build an InferenceTrace from broker trace + transport counters.
+
+    Mirrors the operator's wiring in _execute_on_model field for field.
+    """
+    from rune.inference_trace import InferenceTrace, price_for
+
+    trace = overrides.pop("broker_trace", None) or _broker_trace()
+    transport = overrides.pop("transport", None)
+    model = trace.get("model_id", "qwen3:8b")
+    price = price_for(model)
+    defaults = dict(
+        schema_version=1,
+        provider=getattr(transport, "provider", "unknown"),
+        model=model,
+        task_id="task-123",
+        channel="task",
+        resolved_context_window=trace["window"] or 0,
+        input_budget=trace["budget"],
+        model_calls=getattr(transport, "usage_calls", 0),
+        prompt_tokens_estimated=trace["admitted_total"],
+        prompt_tokens_served=getattr(transport, "usage_prompt_tokens", 0),
+        output_tokens=getattr(transport, "usage_output_tokens", 0),
+        latency_ms=1234.5,
+        model_time_ms=round(getattr(transport, "usage_total_duration_ns", 0) / 1e6, 3),
+        per_block_tokens={b["name"]: b["tokens"] for b in trace["blocks"] if b.get("admitted")},
+        dropped_blocks=[{"name": b["name"], "tokens": b["tokens"]} for b in trace["blocks"] if not b.get("admitted")],
+        tools_exposed=["read_file", "write_file", "list_directory"],
+        memories_exposed=[
+            b["name"]
+            for b in trace["blocks"]
+            if b.get("admitted") and b["name"] in MEMORY_BLOCK_NAMES and b["tokens"] > 0
+        ],
+        memory_tokens=trace["memory_tokens"],
+        degraded=sorted(trace.get("degraded", [])),
+        cache=None,
+        cost_usd=price,
+        cost_basis="price-map" if price is not None else "local-unpriced",
+        success=True,
+        error="",
+    )
+    defaults.update(overrides)
+    return InferenceTrace(**defaults)
+
+
+def _record(trace, tmp_path):
+    from rune.inference_trace import record_trace
+
+    return record_trace(trace, trace_dir=tmp_path)
+
+
+def _records(tmp_path):
+    path = tmp_path / "inference_traces.jsonl"
+    return [json.loads(line) for line in path.read_text().splitlines() if line.strip()]
+
+
+# ---------------------------------------------------------------------------
+# Task 1 — transport accumulators
+# ---------------------------------------------------------------------------
+
+
+def test_transport_accumulates_usage_across_calls():
+    """P0-07: the transport sums served prompt/output tokens and call count
+    across every chat — the raw material for the durable trace."""
+    transport = _ScriptedTransport(
+        [
+            _chat_response(1000, 50, 1_500_000_000),
+            _chat_response(1200, 80, 2_000_000_000),
+            _chat_response(1400, 70, 500_000_000),
+        ]
+    )
+    for _ in range(3):
+        transport.chat(model="qwen3:8b", messages=[], tools=None)
+
+    assert transport.usage_calls == 3
+    assert transport.usage_prompt_tokens == 1000 + 1200 + 1400
+    assert transport.usage_output_tokens == 50 + 80 + 70
+    assert transport.usage_total_duration_ns == 1_500_000_000 + 2_000_000_000 + 500_000_000
+    # last_prompt_eval_count behavior is unchanged (calibration depends on it)
+    assert transport.last_prompt_eval_count == 1400
+    # missing usage fields must not crash or corrupt the sums
+    sparse = _ScriptedTransport([{"message": {"role": "assistant", "content": "x"}}])
+    sparse.chat(model="m", messages=[], tools=None)
+    assert sparse.usage_calls == 1
+    assert sparse.usage_prompt_tokens == 0
+    assert sparse.usage_output_tokens == 0
+    assert sparse.usage_total_duration_ns == 0
+    assert sparse.last_prompt_eval_count is None
+
+
+def test_transport_provider_attribute():
+    """The transport carries its provider identity for the trace record."""
+    assert OllamaChatTransport.provider == "ollama"
+
+
+# ---------------------------------------------------------------------------
+# Task 2 — InferenceTrace record + durable store
+# ---------------------------------------------------------------------------
+
+REQUIRED_FIELDS = (
+    "schema_version",
+    "provider",
+    "model",
+    "task_id",
+    "channel",
+    "resolved_context_window",
+    "input_budget",
+    "model_calls",
+    "prompt_tokens_estimated",
+    "prompt_tokens_served",
+    "output_tokens",
+    "latency_ms",
+    "model_time_ms",
+    "per_block_tokens",
+    "dropped_blocks",
+    "tools_exposed",
+    "memories_exposed",
+    "memory_tokens",
+    "degraded",
+    "cache",
+    "cost_usd",
+    "cost_basis",
+    "success",
+    "error",
+)
+
+
+def test_trace_record_persists_all_required_fields(tmp_path):
+    """One record carries every field the issue lists (provider/model, window,
+    prompt est+served, output, latency, per-block, tools, memories, task_id)."""
+    transport = _ScriptedTransport([_chat_response(2100, 333, 4_000_000_000), _chat_response(2100, 111, 3_000_000_000)])
+    # two chats on the SAME transport → accumulators sum across them
+    transport.chat(model="qwen3:8b", messages=[], tools=None)
+    transport.chat(model="qwen3:8b", messages=[], tools=None)
+    trace = _make_trace(transport=transport)
+    _record(trace, tmp_path)
+    record = _records(tmp_path)[0]
+
+    for field in REQUIRED_FIELDS:
+        assert field in record, f"missing trace field: {field}"
+    assert record["schema_version"] == 1
+    assert record["provider"] == "ollama"
+    assert record["model"] == "qwen3:8b"
+    assert record["task_id"] == "task-123"
+    assert record["channel"] == "task"
+    assert record["resolved_context_window"] == 40960
+    assert record["input_budget"] == 32768
+    assert record["model_calls"] == 2
+    assert record["prompt_tokens_estimated"] == 1565
+    assert record["prompt_tokens_served"] == 4200
+    assert record["output_tokens"] == 444
+    assert record["latency_ms"] == 1234.5
+    assert record["model_time_ms"] == 7000.0
+    assert record["memory_tokens"] == 75
+    assert record["degraded"] == ["memory_selector"]
+    assert record["cache"] is None
+    assert record["cost_usd"] is None
+    assert record["cost_basis"] == "local-unpriced"
+    assert record["success"] is True
+    assert record["error"] == ""
+
+
+def test_trace_answers_what_did_the_model_see(tmp_path):
+    """Per-block contributions + tools + memories exposed reconstruct exactly
+    what the prompt contained (admitted blocks with token counts)."""
+    trace = _make_trace(transport=_ScriptedTransport([]))
+    _record(trace, tmp_path)
+    record = _records(tmp_path)[0]
+
+    assert record["per_block_tokens"] == {
+        "persona": 980,
+        "tools": 90,
+        "memory": 75,
+        "history": 400,
+        "user": 20,
+    }
+    assert record["memories_exposed"] == ["memory"]
+    assert record["tools_exposed"] == ["read_file", "write_file", "list_directory"]
+    assert record["dropped_blocks"] == [{"name": "consolidated", "tokens": 5000}]
+    # admitted blocks reconstruct the broker's estimate
+    assert sum(record["per_block_tokens"].values()) == trace.prompt_tokens_estimated
+
+
+def test_trace_answers_cost_local(tmp_path):
+    """Local model: served + estimated tokens present, cost None with basis
+    'local-unpriced' (cloud comparison = same record shape, priced basis)."""
+    transport = _ScriptedTransport([_chat_response(1565, 99, 1_000_000_000)])
+    transport.chat(model="qwen3:8b", messages=[], tools=None)
+    trace = _make_trace(transport=transport)
+    assert trace.prompt_tokens_served == 1565
+    assert trace.prompt_tokens_estimated == 1565
+    assert trace.cost_usd is None
+    assert trace.cost_basis == "local-unpriced"
+
+    _record(trace, tmp_path)
+    record = _records(tmp_path)[0]
+    assert record["cost_usd"] is None
+    assert record["cost_basis"] == "local-unpriced"
+
+    # the same shape supports a priced basis for cloud comparison
+    priced = _make_trace(cost_usd=0.0031, cost_basis="price-map")
+    assert priced.cost_usd == 0.0031
+    assert priced.cost_basis == "price-map"
+
+
+def test_trace_latency_and_output_tokens_from_transport(tmp_path):
+    """latency_ms (wall) and model_time_ms (Ollama total_duration sum) +
+    output_tokens (eval_count sum) flow from the transport accumulators."""
+    transport = _ScriptedTransport(
+        [
+            _chat_response(100, 40, 2_500_000_000),
+            _chat_response(100, 60, 1_500_000_000),
+        ]
+    )
+    for _ in range(2):
+        transport.chat(model="qwen3:8b", messages=[], tools=None)
+    trace = _make_trace(transport=transport, latency_ms=9876.543)
+    _record(trace, tmp_path)
+    record = _records(tmp_path)[0]
+    assert record["output_tokens"] == 100
+    assert record["model_time_ms"] == 4000.0
+    assert record["latency_ms"] == 9876.543
+
+
+def test_trace_task_id_linkage(tmp_path):
+    """task_id + channel land on the record — traces join to TaskState."""
+    trace = _make_trace(task_id="task-abc-999", channel="ops")
+    _record(trace, tmp_path)
+    record = _records(tmp_path)[0]
+    assert record["task_id"] == "task-abc-999"
+    assert record["channel"] == "ops"
+
+
+def test_trace_file_rotates_at_capacity(tmp_path, monkeypatch):
+    """Rotation: >10MB → .1 backup, fresh file; no unbounded growth."""
+    from rune import inference_trace
+
+    monkeypatch.setattr(inference_trace, "TRACE_ROTATE_BYTES", 2048)
+    for i in range(40):
+        trace = _make_trace(task_id=f"task-{i}")
+        inference_trace.record_trace(trace, trace_dir=tmp_path)
+
+    live = tmp_path / "inference_traces.jsonl"
+    backup = tmp_path / "inference_traces.jsonl.1"
+    assert live.exists()
+    assert backup.exists(), "rotation did not produce a .1 backup"
+    assert live.stat().st_size <= 4096, "live file grew past the rotation limit"
+    live_lines = [line for line in live.read_text().splitlines() if line.strip()]
+    assert len(live_lines) >= 1
+    # every rotated record is still a valid schema_version 1 record
+    for line in backup.read_text().splitlines():
+        if line.strip():
+            assert json.loads(line)["schema_version"] == 1
+
+
+def test_price_map_unknown_model_is_none():
+    """price_for('unknown') is None → cost_usd None, basis 'local-unpriced'."""
+    from rune.inference_trace import price_for
+
+    assert price_for("unknown-model") is None
+    assert price_for("qwen3:8b") is None  # local models are unpriced
+    trace = _make_trace(model="unknown-model")
+    assert trace.cost_usd is None
+    assert trace.cost_basis == "local-unpriced"
+
+
+# ---------------------------------------------------------------------------
+# Task 3 — operator wiring
+# ---------------------------------------------------------------------------
+
+
+class _ScriptedRuntime:
+    """Minimal runtime stand-in: one chat (like a 1-iteration loop), then
+    the final response — the transport accumulators get exercised."""
+
+    def __init__(self, transport, response):
+        self.transport = transport
+        self.tool_names = ("read_file", "write_file")
+        self._response = response
+
+    def run(self, messages, **kwargs):
+        self.transport.chat(model="qwen3:8b", messages=list(messages), tools=None)
+        return self._response
+
+
+def _wire_operator(tmp_path, monkeypatch, runtime):
+    """A real RuneOperator on a temp home; collaborators scripted; RUNE_HOME
+    pointed at tmp_path so record_trace lands inside the test sandbox."""
+    monkeypatch.setenv("RUNE_HOME", str(tmp_path))
+    op = rune_operator.RuneOperator(str(tmp_path / "operator.json"))
+    trace = _broker_trace()
+    capsule = SimpleNamespace(
+        token_count=trace["admitted_total"],
+        active_objective="",
+        blocks=[],
+        to_messages=lambda: [
+            {"role": "system", "content": "sys"},
+            {"role": "user", "content": "do it"},
+        ],
+    )
+    broker = SimpleNamespace(assemble=lambda task, session, model_id: (capsule, trace))
+    profile = SimpleNamespace(safety_tier=0)
+
+    patches = [
+        patch.object(op, "_context_broker", return_value=broker),
+        patch.object(rune_operator.model_profiles, "get_or_create_profile", return_value=profile),
+        patch.object(rune_operator.model_profiles, "record_interaction"),
+        patch.object(rune_operator, "LocalToolRuntime", return_value=runtime),
+        patch.object(rune_operator, "OllamaChatTransport", return_value=runtime.transport),
+        patch("rune.local_tool_runtime.context_length", lambda model: 40960),
+        patch.object(
+            rune_operator.safety_override.SafetyOverride,
+            "get_params",
+            lambda self, text: {"tier": 0, "temperature": 0.7, "prefix": "", "suffix": ""},
+        ),
+        patch.object(rune_operator.safety_override.SafetyOverride, "is_refusal", lambda self, text: False),
+        patch.object(op, "_log_token_usage"),
+    ]
+    return op, patches
+
+
+def _run_wired(op, patches):
+    with patches[0], patches[1], patches[2], patches[3], patches[4], patches[5], patches[6], patches[7], patches[8]:
+        return op.send_task("inspect this", "qwen3:8b")
+
+
+def test_operator_writes_trace_per_run(tmp_path, monkeypatch):
+    """The operator persists one trace per send_task with task linkage."""
+    transport = _ScriptedTransport([_chat_response(1600, 42, 1_000_000_000)])
+    runtime = _ScriptedRuntime(transport, OperatorResponse(success=True, user_text="All done.", model="qwen3:8b"))
+    op, patches = _wire_operator(tmp_path, monkeypatch, runtime)
+    result = _run_wired(op, patches)
+
+    assert result["success"]
+    path = tmp_path / "state" / "inference_traces.jsonl"
+    assert path.exists(), "operator did not persist a trace"
+    records = [json.loads(line) for line in path.read_text().splitlines() if line.strip()]
+    assert len(records) == 1, "expected exactly one trace per run"
+    record = records[0]
+    assert record["task_id"] == result["task"]["task_id"]
+    assert record["channel"] == "task"
+    assert record["model"] == "qwen3:8b"
+    assert record["provider"] == "ollama"
+    assert record["model_calls"] == 1
+    assert record["prompt_tokens_served"] == 1600
+    assert record["output_tokens"] == 42
+    assert record["tools_exposed"] == ["read_file", "write_file"]
+    assert record["success"] is True
+
+
+def test_operator_trace_failure_degrades_not_crashes(tmp_path, monkeypatch):
+    """A broken trace store never fails the turn (P0-06 degrade-not-crash)."""
+    transport = _ScriptedTransport([_chat_response(1600, 42, 1_000_000_000)])
+    runtime = _ScriptedRuntime(transport, OperatorResponse(success=True, user_text="All done.", model="qwen3:8b"))
+    op, patches = _wire_operator(tmp_path, monkeypatch, runtime)
+    with (
+        patch("rune.inference_trace.record_trace", side_effect=OSError("disk full")),
+        patch("rune.subsystem_health.record_failure") as record_failure,
+    ):
+        result = _run_wired(op, patches)
+
+    assert result["success"], "trace failure must not fail the turn"
+    record_failure.assert_called()
+    assert record_failure.call_args.args[0] == "inference_trace"
+
+
+def test_escalated_run_sums_usage_across_tiers(tmp_path, monkeypatch):
+    """I2 (general-182): a tier escalation recreates the transport — the trace
+    must report the RUN total (both attempts), not the final attempt only."""
+    # cycle order: t1 (tier 0), t2 (tier 1), t1 (tier 2), t2 (tier 3) — each
+    # transport gets 2 turns of its own; per-call counts are uniform per
+    # transport so the run sums stay deterministic.
+    t1 = _ScriptedTransport([_chat_response(1000, 10, 500_000_000) for _ in range(8)])
+    # t2 serves every attempt (tiers 2 and 3 reuse it): same counts per call
+    t2 = _ScriptedTransport([_chat_response(2000, 20, 800_000_000) for _ in range(8)])
+    # attempt 1: a refusal (success + refusal text) forces tier escalation;
+    # attempt 2: success. Both attempts consume distinct transports.
+    responses = [
+        OperatorResponse(success=True, user_text="I cannot help with that request.", model="qwen3:8b"),
+        OperatorResponse(success=True, user_text="Recovered on tier 2.", model="qwen3:8b"),
+    ]
+    runtimes = [_ScriptedRuntime(t1, responses[0]), _ScriptedRuntime(t2, responses[1])]
+
+    op, patches = _wire_operator(tmp_path, monkeypatch, runtimes[0])
+    # _run_wired hard-codes the wire's 9 patchers; this test needs 2 more
+    # (is_refusal True to force escalation + sequential runtimes), so manage
+    # the extra patchers explicitly.
+    import itertools
+
+    runtime_cycle = itertools.cycle(runtimes)  # tiers 0-3: extra attempts reuse t2
+    with patches[0], patches[1], patches[2], patches[3], patches[4], patches[5], patches[6], patches[7], patches[8]:
+        with (
+            patch.object(
+                rune_operator.safety_override.SafetyOverride,
+                "is_refusal",
+                lambda self, text: True,
+            ),
+            patch.object(
+                rune_operator,
+                "LocalToolRuntime",
+                side_effect=lambda **kw: next(runtime_cycle),
+            ),
+        ):
+            result = op.send_task("inspect this", "qwen3:8b")
+
+    assert result["success"], result.get("error")
+    path = tmp_path / "state" / "inference_traces.jsonl"
+    records = [json.loads(line) for line in path.read_text().splitlines() if line.strip()]
+    assert len(records) == 1
+    record = records[0]
+    # RUN total: all 4 attempts summed (t1 once + t2 thrice) — the escalation
+    # loop runs tiers 0-3; every tier's transport usage must land in the trace.
+    # The invariant that matters (I2): the trace reports the RUN total —
+    # equal to the sum of the per-transport reality, not the final attempt.
+    total_calls = t1.usage_calls + t2.usage_calls
+    assert total_calls >= 2, "escalation did not happen"
+    assert record["model_calls"] == total_calls, (
+        f"I2 regression: trace {record['model_calls']} != run total {total_calls}"
+    )
+    assert record["prompt_tokens_served"] == t1.usage_prompt_tokens + t2.usage_prompt_tokens
+    assert record["output_tokens"] == t1.usage_output_tokens + t2.usage_output_tokens
+    assert record["model_calls"] > 1, "escalation produced no multi-attempt run"

tests/test_subsystem_health.py

@@ -0,0 +1,81 @@
+"""Subsystem health: observable failures with tiers, anti-spam, snapshot."""
+
+import json  # noqa: F401  — part of the frozen P0-06 test block
+
+from rune import event_bus  # noqa: F401  — frozen import-existence pin
+from rune.subsystem_health import (
+    SubsystemHealthRegistry,
+    configure_logging,
+    record_failure,
+)
+
+
+def test_record_failure_emits_event_and_registry_entry(tmp_path, monkeypatch):
+    monkeypatch.setattr("rune.event_bus._store_path", lambda: tmp_path / "events.jsonl")
+    registry = SubsystemHealthRegistry()
+    record_failure("memory_selector", RuntimeError("boom"), tier=1, registry=registry)
+    entry = registry.snapshot()["memory_selector"]
+    assert entry["failures"] == 1
+    assert "boom" in entry["last_error"]
+    assert entry["tier"] == 1
+
+
+def test_t1_user_message_fires_once_per_subsystem(tmp_path, monkeypatch):
+    monkeypatch.setattr("rune.event_bus._store_path", lambda: tmp_path / "events.jsonl")
+    registry = SubsystemHealthRegistry()
+    m1 = record_failure("memory_selector", RuntimeError("a"), tier=1, registry=registry)
+    m2 = record_failure("memory_selector", RuntimeError("b"), tier=1, registry=registry)
+    assert m1 and not m2  # anti-spam: first call surfaces, repeats silent
+    m3 = record_failure("warm_router", RuntimeError("c"), tier=1, registry=registry)
+    assert m3  # different subsystem surfaces independently
+
+
+def test_t2_never_surfaces_user_message(tmp_path, monkeypatch):
+    monkeypatch.setattr("rune.event_bus._store_path", lambda: tmp_path / "events.jsonl")
+    registry = SubsystemHealthRegistry()
+    assert not record_failure("cron", RuntimeError("x"), tier=2, registry=registry)
+
+
+def test_events_are_canonical_and_typed(tmp_path, monkeypatch):
+    monkeypatch.setattr("rune.event_bus._store_path", lambda: tmp_path / "events.jsonl")
+    registry = SubsystemHealthRegistry()
+    record_failure("memory_selector", RuntimeError("boom"), tier=1, registry=registry)
+    from rune.orchestration.event_store import DurableEventStore
+
+    store = DurableEventStore(tmp_path / "events.jsonl")
+    recs = store.replay()
+    assert any(r["event_type"] == "capability.failed" for r in recs)
+
+
+def test_configure_logging_writes_file(tmp_path):
+    handler = configure_logging(log_dir=tmp_path)
+    import logging
+
+    logging.getLogger("rune.subsystem_health").error("visible")
+    for h in logging.getLogger("rune.subsystem_health").handlers:
+        h.flush()
+    assert (tmp_path / "rune.log").exists()
+    handler.close()
+    logging.getLogger("rune.subsystem_health").removeHandler(handler)
+
+
+def test_acceptance_broken_memory_selector_is_visible(tmp_path, monkeypatch):
+    # Issue #22 acceptance: break the memory selector -> explicit failure.
+    monkeypatch.setattr("rune.event_bus._store_path", lambda: tmp_path / "events.jsonl")
+    from rune.orchestration.event_store import DurableEventStore
+
+    registry = SubsystemHealthRegistry()
+
+    class Broken:
+        def cached_recall(self, *a, **k):
+            raise RuntimeError("memory selector is broken")
+
+    broken = Broken()
+    try:
+        broken.cached_recall()
+    except RuntimeError as exc:
+        surfaced = record_failure("memory_selector", exc, tier=1, registry=registry)
+    assert surfaced
+    store = DurableEventStore(tmp_path / "events.jsonl")
+    assert any(r["event_type"] == "capability.failed" for r in store.replay())
+    assert registry.snapshot()["memory_selector"]["failures"] == 1

tests/test_v1_authority_map.py

@@ -113,6 +113,7 @@ def test_pr_template_enforces_v1_feature_admission_questions():
 
 def test_gitea_required_gate_runs_authority_map_contracts():
     text = CI_WORKFLOW.read_text(encoding="utf-8")
-    assert "tests/test_v1_authority_map.py" in text
+    # Full-suite auto-discovery: all tests run, including this file.
+    assert "pytest tests/" in text
     assert "unit-tests:" in text
     assert "needs: [lint, unit-tests, canary" in text

tests/test_version_footer.py

@@ -0,0 +1,25 @@
+"""TUI footer version label: derived from the single source of truth."""
+
+from rune import __version__
+from rune.rune_tui import VersionLabel
+
+
+def test_version_label_renders_reviewed_version():
+    label = VersionLabel()
+    rendered = str(label.render())
+    assert f"v{__version__}" in rendered
+
+
+def test_version_label_tracks_version_change(monkeypatch):
+    # Reactive by construction: the label reads the import at render time.
+    import rune
+
+    monkeypatch.setattr(rune, "__version__", "9.9.9")
+    label = VersionLabel()
+    assert "v9.9.9" in str(label.render())
+
+
+def test_version_label_importable_and_static_subclass():
+    from textual.widgets import Static
+
+    assert issubclass(VersionLabel, Static)