Every mutating tool call (subagent or main session) is scope-checked
against the active construction contract through the installed hook:
in-scope edits allowed, out-of-scope blocked naming the contract; the
durable lock fails closed across fresh processes (ACTIVE/UNREADABLE
both stop, ABSENT allows ordinary work); shell escapes (clobber/tee/
--output/touch) caught; supervisory acts refused; violations recorded
and self-clear on remediation. 67/67 drills + authority tests green;
hook installed hash-verified; activation front door ported (the one
design decision per the map) with the introduce-verb fix for rune's
Rust-core delegation.
closes#2499
Reality-wins audit of the accepted Scaffolding V1 system against the live
repo/runtime found three genuine wiring defects (no architecture invented):
1. The MiMo edge was DEAD. `~/.mimocode/hooks/builder-bridge.ts` hardcoded
the ephemeral interpreter `/tmp/ci-venv/bin/python`, which no longer
exists, so every bridge call failed and the hook silently degraded —
MiMo received NO Rune Core preflight at all (zero fire-log lines). The
hook was also UNVERSIONED (no canonical copy), which is how it rotted.
Repair: canonical source `config/mimo-hooks/builder-bridge.ts` with
durable interpreter resolution (env override > repo venv > user venv >
/usr/bin/python3), installed + hash-verified + drift-checked by
`install_mimo_hook.py`, which now manages a hook SET rather than one file.
2. The native path skipped the canonical meaning layer. `construction_intent`
(the §17J/§17L/§17M intent resolver: interrogative structure, negation,
request modals, referent/proposal resolution) existed but was imported
ONLY by tests. `rune_operator._construction_activation` went straight to
`classify_mode`, so a pure question carrying a target reference
("explain how this module works") classified EXISTING_PROJECT_CHANGE and
recorded a construction activation for a discussion turn. Repair: the
intent layer now resolves MEANING before the ONE classifier decides mode
(the boundary the intent module documents). DISCUSSION maps to
NOT_CONSTRUCTION — the canonical vocabulary is unchanged, an explicit
user override (/scaffold-mode) outranks the gate, and an unavailable
intent layer preserves the previous behaviour exactly rather than
silently changing governance.
3. The shared Construction Context reported a TERMINAL contract as active.
`construction_context()` selected on `status == "open"` alone, so 8
contracts with phase `abandoned` (terminal) were reported as the active
construction. Repair: terminal phases are now DERIVED once from the
canonical transition table (`scaffold.TERMINAL_PHASES`), and a contract
is active only when its phase is non-terminal.
Also: the bridge capsule now surfaces the active Scaffolding construction
(contract/phase/scope/obligations/next-action) to the builder as a
read-only projection of the shared Construction Context — the MiMo edge of
state Scaffolding already owns. Inject-nothing is preserved when no
contract is active; the projection never mutates and degrades to [].
Spine projection refreshed (import graph legitimately gained importers).
Honest boundary: no byte-level enforcement point exists. `tool_executor.py`
never consults construction state, so the 19A invariant gates only the
/build-start route. Establishing MiMo-surface enforcement is NEW
architecture (a tool.execute.before governance hook) and was NOT built
here — it is recorded as the exact remaining blocker.
Verification: 511 passed across the construction/operator/bridge/hook/
structural/parity suites; native-default matrix 12/12; real operator-path
proof with fresh-process readback (EXISTING_PROJECT_CHANGE activated,
question -> NOT_CONSTRUCTION, PROJECT_BUILD bootstraps scaffold + registry);
installed hook invoked directly -> capsule injected + fire log written.
LOCAL_MODEL_COMPUTE_EXECUTED = NO.