templates: plain-English heading carries the issue summary

The section header itself must restate the issue title in everyday words,
so a scan of headings alone tells the story of the board. Applied to all
three templates (web-UI + canonical copies) and retrofitted onto all 30
live issues.

.agents/skills/land/SKILL.md

@@ -1,20 +0,0 @@
----
-name: land
-description: Review and land one small Rune change through the governed PR workflow.
-disable-model-invocation: true
-metadata:
-  delta-action: land
----
-
-# Land one small diff
-
-1. Read applicable `AGENTS.md` rules and the repo's PR/merge workflow.
-2. Confirm the issue, exact diff, target branch, and permission to publish and land.
-3. Keep one small, reversible change; preserve unrelated work.
-4. For bugs, follow `docs/bugfix-contract.md`: red test first, root cause, discharge.
-5. Run required tests, static analysis, canaries, and henxels; record results.
-6. Get independent `/review` per `docs/adversarial-review.md`; clear blockers.
-7. Inspect remotes; publish the PR to the approved forge, never `local`.
-8. Require human approval and green required CI on the exact PR head; recheck changed heads.
-9. Load `report-landed`; use the repo's merge workflow. Stop on conflicts; never force-push or bypass hooks.
-10. Verify the target commit and CI, then report the actual landing result and remaining blockers.

.coveragerc

@@ -15,9 +15,6 @@
 # Canary files are omitted: src/rune/canary_*.py are standalone CI
 # verification scripts executed directly by the canary job, never imported by
 # the test suite — counting them would make the global floor a fiction.
-# ffi_query_memory_smoke.py is the same class: a standalone evidence script
-# driven directly (and by tests/test_ffi_query_memory_smoke.py when the cdylib
-# is built), never imported by the suite.
 
 [run]
 source = src/rune
@@ -25,7 +22,6 @@ omit =
     tests/*
     scripts/*
     src/rune/canary_*.py
-    src/rune/ffi_query_memory_smoke.py
 
 [report]
 fail_under = 29

.gitea/ISSUE_TEMPLATE/bug.md

@@ -6,12 +6,11 @@ labels: bug
 assignees: conductor
 ---
 
-<restate the issue title here in everyday words — this heading IS the
-plain-English summary; no meta-labels like "plain English" in it>
-<!-- The heading above carries the summary itself — a scan of issue
-     headings alone should tell the whole story of the board. TOP PRIORITY:
-     if a technical detail below contradicts this section, the issue is
-     buggy — fix the issue. -->
+## In plain English: <restate the issue title here in everyday words>
+<!-- The heading ITSELF must carry the summary — a scan of issue headings
+     alone should tell the whole story of the board. TOP PRIORITY: if a
+     technical detail below contradicts this section, the issue is buggy —
+     fix the issue. -->
 <!-- SUBMITTED_BODY -->
 
 

.gitea/ISSUE_TEMPLATE/feature.md

@@ -6,12 +6,11 @@ labels: feature
 assignees: conductor
 ---
 
-<restate the issue title here in everyday words — this heading IS the
-plain-English summary; no meta-labels like "plain English" in it>
-<!-- The heading above carries the summary itself — a scan of issue
-     headings alone should tell the whole story of the board. TOP PRIORITY:
-     if a technical detail below contradicts this section, the issue is
-     buggy — fix the issue. A non-technical reader must be able to retell this
+## In plain English: <restate the issue title here in everyday words>
+<!-- The heading ITSELF must carry the summary — a scan of issue headings
+     alone should tell the whole story of the board. TOP PRIORITY: if a
+     technical detail below contradicts this section, the issue is buggy —
+     fix the issue. A non-technical reader must be able to retell this
      section. 3-6 sentences, no jargon. -->
 <!-- SUBMITTED_BODY -->
 

.gitea/ISSUE_TEMPLATE/research.md

@@ -6,12 +6,11 @@ labels: research
 assignees: conductor
 ---
 
-<restate the issue title here in everyday words — this heading IS the
-plain-English summary; no meta-labels like "plain English" in it>
-<!-- The heading above carries the summary itself — a scan of issue
-     headings alone should tell the whole story of the board. TOP PRIORITY:
-     if a technical detail below contradicts this section, the issue is
-     buggy — fix the issue. -->
+## In plain English: <restate the issue title here in everyday words>
+<!-- The heading ITSELF must carry the summary — a scan of issue headings
+     alone should tell the whole story of the board. TOP PRIORITY: if a
+     technical detail below contradicts this section, the issue is buggy —
+     fix the issue. -->
 <!-- SUBMITTED_BODY -->
 
 

.gitea/workflows/auto-backup.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   backup:
-    runs-on: rune-ci-desktop
+    runs-on: rune-infra-pi
     steps:
       # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -18,4 +18,4 @@ jobs:
           python3 -m unittest -v tests.test_gitea_backup
           python3 src/rune/canary_gitea_automation.py
       - name: Create consistent off-disk Gitea backup
-        run: sudo /usr/local/bin/gitea-backup-pc.sh
+        run: sudo /usr/local/sbin/rune-gitea-backup

.gitea/workflows/auto-label.yml

@@ -7,38 +7,49 @@ on:
     types: [opened, edited]
 
 jobs:
-  # SINGLE-PASS FILING (2026-10-07, Nick's first-time-correct directive):
-  # the old design ran TWO jobs on submission — priority-gate (which saw
-  # no P-label and posted the ⚠️ warning) and auto-label (which inferred
-  # and applied the P-label). The gate ran BEFORE the inference that
-  # would have made the warning unnecessary: every keyword-inferrable
-  # submission ate a spurious warning, a flag add/remove cycle, and a
-  # wasted workflow run. The fix is ORDER: infer → apply → THEN gate.
-  # A submission whose priority is inferable gets its P-label in this
-  # same run; the warning fires only when inference genuinely produced
-  # nothing (a true filing gap, not a race the robot loses to itself).
-  auto-label:
-    runs-on: rune-ci-desktop
+  # PRIORITY GATE (2026-09-04): every issue must carry exactly one of
+  # P0/P1/P2/P3. An issue that lands without one gets 'unprioritized' +
+  # a demand comment — filing is not complete until prioritized.
+  priority-gate:
+    if: github.event_name == 'issues' && github.event.action != 'labeled'
+    runs-on: rune-infra-pi
     steps:
-      - name: Infer, apply, then gate-check (one pass)
+      - name: Enforce priority label
         uses: actions/github-script@v7
         with:
           script: |
-            // CLOSED-ISSUE GUARD (#407): labels are filing-time metadata.
-            // A closed issue's lifecycle has ended; re-running label
-            // inference on it re-adds stale type labels (bug = currently
-            // incorrect behavior — a closed fixed issue must not carry
-            // it) and makes any human label cleanup self-defeating,
-            // because every PUT fires a 'labeled' event that re-triggers
-            // this job. Post-close label curation belongs to humans and
-            // the conductor, not this workflow.
-            const issueState = context.payload.issue?.state;
-            if (issueState === 'closed') {
-              console.log(`Issue #${context.payload.issue?.number} is closed — auto-label skips (labels are curated post-close).`);
+            const issue = context.payload.issue;
+            if (!issue) return;
+            const labels = (issue.labels || []).map(l => l.name);
+            const priorities = ['P0 — critical', 'P1 — high', 'P2 — medium', 'P3 — low'];
+            const has = labels.filter(l => priorities.includes(l));
+            if (has.length >= 1) {
+              // Prioritized — clear the flag if it was set.
+              if (labels.includes('unprioritized')) {
+                await github.rest.issues.removeLabel({
+                  owner: context.repo.owner, repo: context.repo.repo,
+                  issue_number: issue.number, name: 'unprioritized',
+                }).catch(e => { if (e.status !== 404) throw e; });
+              }
               return;
             }
-            const action = context.payload.action;
-            const isIssue = context.payload.issue !== undefined;
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner, repo: context.repo.repo,
+              issue_number: issue.number, labels: ['unprioritized'],
+            });
+            await github.rest.issues.createComment({
+              owner: context.repo.owner, repo: context.repo.repo,
+              issue_number: issue.number,
+              body: `⚠️ **Priority gate:** this issue has no priority. Assign exactly one of **P0 — critical** (spine/correctness/blocks), **P1 — high** (material value or real defect), **P2 — medium** (quality/consolidation), **P3 — low** (measurement/deferred). An issue without a priority is not filed.`,
+            });
+
+  auto-label:
+    runs-on: rune-infra-pi
+    steps:
+      - name: Analyze and label
+        uses: actions/github-script@v7
+        with:
+          script: |
             const title = context.payload.issue?.title || context.payload.pull_request?.title || '';
             const body = context.payload.issue?.body || context.payload.pull_request?.body || '';
             const text = (title + ' ' + body).toLowerCase();
@@ -47,29 +58,25 @@ jobs:
             const managedLabels = new Set([
               'memory', 'governance', 'identity', 'growth',
               'perception', 'infrastructure', 'life', 'custodian',
-              'bug', 'feature', 'research',
-              'P0 — critical', 'P1 — high', 'P2 — medium', 'P3 — low',
+              'priority: high', 'bug', 'feature', 'research',
             ]);
 
             // Type label: DECLARED over GUESSED. The template spine
-            // (kind: bug|feature|research|epic|...) is authoritative.
-            // A recognized kind maps to its label; ANY other declared kind
-            // (e.g. epic) means NO type label and NO keyword guessing —
-            // epics are containers, not bugs. Keyword heuristics apply
-            // only to pre-template issues with no spine at all.
+            // (kind: bug|feature|research) is authoritative. Keyword
+            // heuristics are a fallback for issues filed before the
+            // template system existed — they misclassify honest prose
+            // ("what is broken", "the fix") as bugs (T15 audit finding).
+            let kind = null;
+            const spineMatch = body && body.match(/^kind:\s*(bug|feature|research)\s*$/m);
+            if (spineMatch) {
+              kind = spineMatch[1];
+            }
             let isBug = false, isFeature = false, isResearch = false;
-            const kindMatch = body && body.match(/^kind:\s*([a-z_-]+)\s*$/m);
-            if (kindMatch) {
-              const kind = kindMatch[1];
+            if (kind) {
               isBug = kind === 'bug';
               isFeature = kind === 'feature';
               isResearch = kind === 'research';
-            } else if (action === 'opened') {
-              // KEYWORD FALLBACK (#407): pre-template issues only, and
-              // ONLY at filing time. Re-running keyword guesses on every
-              // edit/label event overrides human curation of spine-less
-              // issues (documented rule: keyword heuristics are the
-              // pre-template fallback, not a standing authority).
+            } else {
               const textBug = title.startsWith('[BUG]') || text.includes('bug') || text.includes('fix') || text.includes('broken');
               isBug = textBug;
               isFeature = !isBug && (title.startsWith('[FEATURE]') || text.includes('feature') || text.includes('improve') || text.includes('add'));
@@ -111,31 +118,9 @@ jobs:
               desiredLabels.add('custodian');
             }
 
-            // Priority labels (2026-10-05: PROGRAMMATIC P-ASSIGNMENT —
-            // the gate demanded P0-P3 labels but nothing assigned them;
-            // the dead 'priority: high' label is gone per the 2026-09-04
-            // normalization). Assignment from the TITLE prefix first
-            // ([P1]/P1:/priority=...), then keyword inference using the
-            // gate's own rule set (the scale lives in ONE place — the
-            // gate check at the bottom of THIS job).
-            const pMatch = title.match(/\bP([0-3])\b/);
-            const priorityLabelNames = ['P0 — critical', 'P1 — high', 'P2 — medium', 'P3 — low'];
-            if (pMatch) {
-              desiredLabels.add(priorityLabelNames[Number(pMatch[1])]);
-            } else if (text.includes('urgent') || text.includes('critical') ||
-                       text.includes('spine') || text.includes('blocks other work')) {
-              desiredLabels.add(priorityLabelNames[0]);   // P0 — critical
-            } else if (text.includes('broken') || text.includes('fix') ||
-                       text.includes('repair') || text.includes('defect') ||
-                       text.includes('real defect') || text.includes('money')) {
-              desiredLabels.add(priorityLabelNames[1]);   // P1 — high
-            } else if (text.includes('improve') || text.includes('consolidat') ||
-                       text.includes('refactor') || text.includes('kernel') ||
-                       text.includes('port')) {
-              desiredLabels.add(priorityLabelNames[2]);   // P2 — medium
-            } else if (text.includes('benchmark') || text.includes('measurement') ||
-                       text.includes('deferred')) {
-              desiredLabels.add(priorityLabelNames[3]);   // P3 — low
+            // Priority labels
+            if (text.includes('urgent') || text.includes('critical') || text.includes('broken')) {
+              desiredLabels.add('priority: high');
             }
 
             const issueNumber = context.payload.issue?.number || context.payload.pull_request?.number;
@@ -145,7 +130,6 @@ jobs:
               issue_number: issueNumber,
             });
             const currentLabels = new Set(current.data.map(label => label.name));
-            const currentLabelIds = new Map(current.data.map(label => [label.name, label.id]));
             const staleManaged = [...currentLabels].filter(
               label => managedLabels.has(label) && !desiredLabels.has(label)
             );
@@ -155,14 +139,11 @@ jobs:
 
             for (const name of staleManaged) {
               try {
-                // Gitea's DELETE /labels/{id} requires the numeric label ID.
-                // Octokit's GitHub-style removeLabel(name) returned 404 and
-                // left stale priority labels behind (#2467: P0 AND P2).
-                await github.request('DELETE /repos/{owner}/{repo}/issues/{issue_number}/labels/{id}', {
+                await github.rest.issues.removeLabel({
                   owner: context.repo.owner,
                   repo: context.repo.repo,
                   issue_number: issueNumber,
-                  id: currentLabelIds.get(name),
+                  name,
                 });
               } catch (error) {
                 if (error.status !== 404) {
@@ -180,50 +161,5 @@ jobs:
                 labels: missingDesired,
               });
             }
-
-            // ---- PRIORITY GATE (runs LAST — after inference and
-            // reconciliation, so the verdict reflects the labels THIS run
-            // just applied, not a pre-inference snapshot). Issue-scoped:
-            // the filing contract governs issues; PRs get inferred labels
-            // but are not filing units.
-            if (!isIssue) {
-              console.log(`PR #${issueNumber}: labels applied, gate skipped (gate is issue-scoped).`);
-              return;
-            }
-            const reconciled = await github.rest.issues.listLabelsOnIssue({
-              owner: context.repo.owner, repo: context.repo.repo,
-              issue_number: issueNumber,
-            });
-            const actual = reconciled.data;
-            const activePriority = actual.filter(l => priorityLabelNames.includes(l.name));
-            const flag = actual.find(l => l.name === 'unprioritized');
-            if (activePriority.length === 1) {
-              // Prioritized (by human or by this run's inference). Clear
-              // any stale flag — no warning is ever posted on this path.
-              if (flag) {
-                await github.request('DELETE /repos/{owner}/{repo}/issues/{issue_number}/labels/{id}', {
-                  owner: context.repo.owner, repo: context.repo.repo,
-                  issue_number: issueNumber, id: flag.id,
-                });
-              }
-              console.log(`Priority gate: satisfied (${activePriority[0].name}).`);
-              return;
-            }
-            // Genuinely unprioritized: inference produced nothing AND the
-            // caller set nothing. Flag + demand comment — the filing gap
-            // is real, not a race artifact.
-            const reason = activePriority.length === 0
-              ? 'no priority'
-              : `${activePriority.length} priority labels (exactly one required)`;
-            if (!flag) {
-              await github.rest.issues.addLabels({
-                owner: context.repo.owner, repo: context.repo.repo,
-                issue_number: issueNumber, labels: ['unprioritized'],
-              });
-            }
-            await github.rest.issues.createComment({
-              owner: context.repo.owner, repo: context.repo.repo,
-              issue_number: issueNumber,
-              body: `⚠️ **Priority gate:** this issue has ${reason}. Assign exactly one of **P0 — critical** (spine/correctness/blocks), **P1 — high** (material value or real defect), **P2 — medium** (quality/consolidation), **P3 — low** (measurement/deferred). An issue without a priority is not filed.`,
-            });
-            console.log(`Priority gate: flagged — ${reason}.`);
+            console.log(`Removed managed labels: ${staleManaged.join(', ') || 'none'}`);
+            console.log(`Added managed labels: ${missingDesired.join(', ') || 'none'}`);

.gitea/workflows/auto-update-gitea.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   update-gitea:
-    runs-on: rune-ci-desktop
+    runs-on: rune-infra-pi
     steps:
       - name: Check current Gitea version
         id: current

.gitea/workflows/auto-version.yml

@@ -1,172 +1,229 @@
 name: Auto-version and Release
+
 on:
   pull_request:
-    types:
-    - closed
-    branches:
-    - master
+    types: [closed]
+    branches: [master]
   push:
-    branches:
-    - master
+    branches: [master]
+
 permissions: write-all
+
 jobs:
   release:
-    runs-on: rune-ci-desktop
+    runs-on: rune-infra-pi
     steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-    - name: Skip if PR is not merged (direct pushes continue to convergence)
-      run: "MERGED=\"${{ gitea.event.pull_request.merged }}\"\nEVENT=\"${{ gitea.event_name\
-        \ }}\"\nif [ \"$EVENT\" = \"pull_request\" ] && [ \"$MERGED\" != \"true\"\
-        \ ]; then\n  echo \"PR not merged \u2014 skipping release\"\n  exit 0\nfi\n\
-        echo \"event=$EVENT \u2014 continuing\"\n"
-    - name: Read reviewed semantic version
-      run: 'VERSION=$(python3 -c ''import re; text=open("src/rune/__init__.py").read();
-        print(re.search(r"__version__ = \"([0-9]+\.[0-9]+\.[0-9]+)\"", text).group(1))'')
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
-        echo "RELEASE_VERSION=$VERSION" >> "$GITHUB_ENV"
+      - name: Skip if PR is not merged (direct pushes continue to convergence)
+        run: |
+          MERGED="${{ gitea.event.pull_request.merged }}"
+          EVENT="${{ gitea.event_name }}"
+          if [ "$EVENT" = "pull_request" ] && [ "$MERGED" != "true" ]; then
+            echo "PR not merged — skipping release"
+            exit 0
+          fi
+          echo "event=$EVENT — continuing"
 
-        echo "Release version: $VERSION"
+      - name: Read reviewed semantic version
+        run: |
+          VERSION=$(python3 -c 'import re; text=open("src/rune/__init__.py").read(); print(re.search(r"__version__ = \"([0-9]+\.[0-9]+\.[0-9]+)\"", text).group(1))')
+          echo "RELEASE_VERSION=$VERSION" >> "$GITHUB_ENV"
+          echo "Release version: $VERSION"
 
-        '
-    - name: Auto-bump if the PR did not carry a version bump
-      env:
-        GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
-        RELEASE_SERVER_URL: ${{ gitea.server_url }}
-        RELEASE_REPO: ${{ gitea.repository }}
-        PR_TITLE: ${{ gitea.event.pull_request.title }}
-        PR_BODY: ${{ gitea.event.pull_request.body }}
-        PR_NUMBER: ${{ gitea.event.pull_request.number }}
-      run: "LATEST=$(git tag --sort=-v:refname | head -1 | sed 's/^v//')\nif [ -z\
-        \ \"$LATEST\" ]; then\n  echo \"No previous tags \u2014 releasing first version\
-        \ $RELEASE_VERSION\"\n  exit 0\nfi\nif [ \"$LATEST\" != \"$RELEASE_VERSION\"\
-        \ ]; then\n  if [ \"$(printf '%s\\n%s\\n' \"$LATEST\" \"$RELEASE_VERSION\"\
-        \ | sort -V | head -1)\" = \"$RELEASE_VERSION\" ]; then\n    echo \"::warning::VERSION-BEHIND-TAG\
-        \ ANOMALY (#192): master=$RELEASE_VERSION < latest tag v$LATEST \u2014 bumping\
-        \ from master version; reconcile the tag lineage\"\n  else\n    echo \"Version\
-        \ $RELEASE_VERSION > last tag v$LATEST \u2014 bump rode the PR\"\n    exit\
-        \ 0\n  fi\nfi\n# semver level: PR title on pull_request events; on push events\n\
-        # (direct master pushes bypass PR merges \u2014 observed 2026-09-10,\n# version\
-        \ stuck at 0.66.0 through ~15 substantive commits), the\n# warranted bump\
-        \ comes from scripts/version_convergence.py over\n# commits since the last\
-        \ tag. chore(release) commits never\n# warrant a bump \u2192 the bump commit\
-        \ cannot recurse.\nif [ -z \"$PR_TITLE\" ] || [ \"$PR_TITLE\" = \"null\" ];\
-        \ then\n  # Recursive-loop guard: HEAD being a bump commit means THIS\n  #\
-        \ push already applied the bump \u2014 do not re-bump. The decision\n  # lives\
-        \ in version_convergence (--is-release-subject), one\n  # source of truth\
-        \ shared with the regression test.\n  HEAD_SUBJECT=$(git log -1 --format=%s)\n\
-        \  if python3 scripts/version_convergence.py --is-release-subject \"$HEAD_SUBJECT\"\
-        ; then\n    echo \"HEAD is a release bump \u2014 loop guard, no re-bump\"\n\
-        \    exit 0\n  fi\n  CONVERGENCE=$(python3 scripts/version_convergence.py)\n\
-        \  WARRANTED=$(echo \"$CONVERGENCE\" | python3 -c \"import json,sys; d=json.load(sys.stdin);\
-        \ print(d.get('warranted_bump') or '')\")\n  CONVERGED=$(echo \"$CONVERGENCE\"\
-        \ | python3 -c \"import json,sys; print(json.load(sys.stdin).get('converged',\
-        \ 'true'))\")\n  if [ \"$CONVERGED\" = \"True\" ]; then\n    echo \"Already\
-        \ converged \u2014 no bump needed\"\n    exit 0\n  fi\n  echo \"push convergence:\
-        \ warranted_bump=$WARRANTED\"\n  if [ -z \"$WARRANTED\" ]; then\n    echo\
-        \ \"No substantive commits since last tag \u2014 no bump needed\"\n    exit\
-        \ 0\n  fi\n  PR_TITLE=\"$WARRANTED: converged release (push-to-master bump)\"\
-        \nfi\nNEW=$(python3 scripts/semver_bump.py \"$RELEASE_VERSION\" \"$PR_TITLE\"\
-        )\nexport NEW_VERSION=\"$NEW\"\necho \"Auto-bump: $RELEASE_VERSION -> $NEW\
-        \ (direct commit to master \u2014 bump PRs retired, Nick policy 2026-09-08)\"\
-        \npython3 - <<'PYBUMP'\nimport base64, json, os, sys, urllib.request\n\nTOKEN\
-        \ = os.environ[\"GITEA_TOKEN\"]\nBASE = os.environ[\"RELEASE_SERVER_URL\"\
-        ] + \"/api/v1/repos/\" + os.environ[\"RELEASE_REPO\"]\nVERSION = os.environ[\"\
-        RELEASE_VERSION\"]\nNEW = os.environ[\"NEW_VERSION\"]\nPR_TITLE = os.environ.get(\"\
-        PR_TITLE\", \"\")\nPR_NUMBER = os.environ.get(\"PR_NUMBER\", \"\")\nSERVER\
-        \ = os.environ[\"RELEASE_SERVER_URL\"].rstrip(\"/\")\npromoting_url = f\"\
-        {SERVER}/{os.environ['RELEASE_REPO']}/pulls/{PR_NUMBER}\" if PR_NUMBER else\
-        \ \"(unknown)\"\n\ndef api(path, method=\"GET\", data=None, ok=(200, 201)):\n\
-        \    req = urllib.request.Request(\n        BASE + path,\n        data=json.dumps(data).encode()\
-        \ if data is not None else None,\n        headers={\"Authorization\": \"token\
-        \ \" + TOKEN, \"Content-Type\": \"application/json\"},\n        method=method,\n\
-        \    )\n    try:\n        with urllib.request.urlopen(req, timeout=30) as\
-        \ r:\n            body, status = r.read(), r.status\n    except urllib.error.HTTPError\
-        \ as e:\n        body, status = e.read(), e.code\n    try:\n        return\
-        \ status, (json.loads(body) if body else {})\n    except json.JSONDecodeError:\n\
-        \        return status, {\"_raw\": body.decode(\"utf-8\", \"replace\")[:200]}\n\
-        \n# Version surfaces: the TUI footer renders rune.__version__ AT CALL TIME\n\
-        # (rune_tui.py VersionLabel), so __init__.py IS the displayed version.\n#\
-        \ rune_tui.py header is the drift-guard that must stay in sync.\nsurfaces\
-        \ = {\n    \"src/rune/__init__.py\": [(f'__version__ = \"{VERSION}\"', f'__version__\
-        \ = \"{NEW}\"')],\n    \"src/rune/rune_tui.py\": [\n        (f\"Version: v{VERSION}\"\
-        , f\"Version: v{NEW}\"),\n        (f\"Rune v{VERSION} |\", f\"Rune v{NEW}\
-        \ |\"),\n    ],\n    \"src/rune/canary_gitea_automation.py\": [(f'\"{VERSION}\"\
-        ', f'\"{NEW}\"')],\n    \"README.md\": [(f\"v{VERSION}\", f\"v{NEW}\")],\n\
-        \    \"pyproject.toml\": [(f'version = \"{VERSION}\"', f'version = \"{NEW}\"\
-        ')],\n}\n\n# Fetch current master content, apply replacements, VERIFY all\
-        \ six\n# surface patterns (five files + the TUI footer) agree on NEW before\n\
-        # committing anything (TUI gate). The footer check was added after\n# the\
-        \ 0.89.0 half-bump: a stale RELEASE_VERSION made both replace\n# pairs no-op;\
-        \ the gate's RECOVER regex fixed the header only and\n# the footer silently\
-        \ stayed 0.88.4, failing the banner test.\nedited = {}\nfor path, pairs in\
-        \ surfaces.items():\n    status, cur = api(f\"/contents/{path}?ref=master\"\
-        )\n    if status != 200:\n        print(f\"  skip {path} ({status})\"); continue\n\
-        \    text = base64.b64decode(cur[\"content\"]).decode(\"utf-8\")\n    changed\
-        \ = text\n    for old, newv in pairs:\n        changed = changed.replace(old,\
-        \ newv)\n    if changed != text:\n        edited[path] = (changed, cur[\"\
-        sha\"])\n\n# In-memory gate: all five surfaces must now carry NEW\nimport\
-        \ re\nVER = r\"\\d+\\.\\d+\\.\\d+\"\nchecks = [\n    (\"src/rune/__init__.py\"\
-        , rf'__version__ = \"({VER})\"'),\n    (\"src/rune/rune_tui.py\", rf\"Version:\
-        \ v({VER})\"),\n    (\"src/rune/rune_tui.py\", rf\"Rune v({VER}) \\|\"),\n\
-        \    (\"src/rune/canary_gitea_automation.py\", rf\"'__version__ = \\\"({VER})\\\
-        \"'\"),\n    (\"pyproject.toml\", rf'version = \"({VER})\"'),\n    (\"README.md\"\
-        , rf\"v({VER})\"),\n]\ndrifts = []\nfor rel, pat in checks:\n    if rel not\
-        \ in edited:\n        # unchanged surface: must ALREADY carry NEW \u2014 if\
-        \ it carries a\n        # DIFFERENT version (base drift, e.g. pyproject at\
-        \ 0.49.0 while\n        # master is 0.54.1), RECOVER by force-editing to NEW.\
-        \ The gate\n        # stays: nothing commits unless every surface carries\
-        \ NEW.\n        status, cur = api(f\"/contents/{rel}?ref=master\")\n     \
-        \   if status != 200:\n            drifts.append(f\"{rel}: unreadable ({status})\"\
-        )\n            continue\n        text = base64.b64decode(cur.get(\"content\"\
-        , \"\")).decode(\"utf-8\", \"replace\")\n        hits = re.findall(pat, text)\n\
-        \        if NEW not in hits:\n            fixed = re.sub(pat, lambda m: m.group(0).replace(m.group(1),\
-        \ NEW), text, count=1)\n            if fixed != text:\n                edited[rel]\
-        \ = (fixed, cur[\"sha\"])\n                print(f\"  RECOVERED {rel}: base\
-        \ drift {sorted(set(hits))} -> {NEW}\")\n            else:\n             \
-        \   drifts.append(f\"{rel}: pattern present but unfixable (found {sorted(set(hits))})\"\
-        )\n    else:\n        hits = re.findall(pat, edited[rel][0])\n        if NEW\
-        \ not in hits:\n            drifts.append(f\"{rel}: edited content does not\
-        \ carry {NEW}\")\nif drifts:\n    print(\"VERSION-SURFACE DRIFT \u2014 bump\
-        \ aborted, nothing committed:\")\n    for d in drifts:\n        print(f\"\
-        \  - {d}\")\n    sys.exit(1)\n\n# Commit ALL surfaces as ONE commit via ChangeFiles\n\
-        # (POST /contents with a files[] array). The per-file contents PUT\n# created\
-        \ one commit per version surface \u2014 five same-version \"bump\n# commits\"\
-        \ per release (the phantom duplicate-bump cascade,\n# misdiagnosed as queue\
-        \ drain since 0.66.2; root-caused T15 Part F\n# 2026-09-11). Git-data blob/tree\
-        \ creation is 404 on this Gitea\n# build; ChangeFiles is the supported single-commit\
-        \ primitive.\nmsg = f\"chore(release): auto-bump version to {NEW} \u2014 earned\
-        \ by #{PR_NUMBER} ({PR_TITLE[:80]})\\n\\nPromotion record: {promoting_url}\"\
-        \nops = [{\n    \"operation\": \"update\",\n    \"path\": path,\n    \"content\"\
-        : base64.b64encode(content.encode()).decode(),  # ChangeFileOperation.content\
-        \ is ContentBase64\n} for path, (content, _old_sha) in edited.items()]\nstatus,\
-        \ r = api(\"/contents\", \"POST\", {\n    \"branch\": \"master\",\n    \"\
-        message\": msg,\n    \"files\": ops,\n})\nif status not in (200, 201):\n \
-        \   print(f\"change-files failed ({status}): {str(r)[:300]}\"); sys.exit(1)\n\
-        commit_sha = (r.get(\"commit\") or {}).get(\"sha\", \"?\") if isinstance(r,\
-        \ dict) else \"?\"\nprint(f\"  committed {len(ops)} surfaces as ONE commit\
-        \ {str(commit_sha)[:7]}\")\n\nprint(f\"AUTO_BUMPED=true \u2014 version {NEW}\
-        \ live on master; TUI footer will render v{NEW}\")\nwith open(os.environ[\"\
-        GITHUB_ENV\"], \"a\") as env:\n    env.write(f\"RELEASE_VERSION={NEW}\\n\"\
-        )\n    env.write(\"AUTO_BUMPED=true\\n\")\nPYBUMP\n"
-    - name: Create evidence-derived release (SCAFFOLD-TRANCHE-009B)
-      env:
-        GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
-        RELEASE_SERVER_URL: ${{ gitea.server_url }}
-        RELEASE_REPO: ${{ gitea.repository }}
-      run: "# ONE note-generation authority: the tested release_notes module.\n# The\
-        \ old PR-title/body paste path (which produced empty '##'\n# bodies on direct-push\
-        \ releases) is REMOVED \u2014 governed evidence\n# from the scaffold store\
-        \ is the source, not PR prose.\n# EXIT-NOTE TEMPLATE (Nick 2026-10-08): plain-English\
-        \ summary of\n# what was worked on and submitted \u2014 the version-history\
-        \ reader's\n# counterpart of the issue-entry template. Appended to the\n#\
-        \ evidence-derived body so governed facts AND human narrative\n# both appear.\n\
-        LAST_TAG=$(git tag --sort=-v:refname | head -1)\nEXIT_NOTE=$(python3 scripts/release_exit_note.py\
-        \ --since \"$LAST_TAG\" --to HEAD) || EXIT_NOTE=\"\"\npython3 scripts/release_history_cli.py\
-        \ init \\\n  --version \"$RELEASE_VERSION\" \\\n  --server \"$RELEASE_SERVER_URL\"\
-        \ --repo \"$RELEASE_REPO\" \\\n  --store store/scaffold/current.json \\\n\
-        \  ${EXIT_NOTE:+--exit-note \"$EXIT_NOTE\"}"
-concurrency:
-  group: auto-version-and-release-${ github.ref }
-  cancel-in-progress: true
+      - name: Auto-bump if the PR did not carry a version bump
+        env:
+          GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+          RELEASE_SERVER_URL: ${{ gitea.server_url }}
+          RELEASE_REPO: ${{ gitea.repository }}
+          PR_TITLE: ${{ gitea.event.pull_request.title }}
+          PR_BODY: ${{ gitea.event.pull_request.body }}
+          PR_NUMBER: ${{ gitea.event.pull_request.number }}
+        run: |
+          LATEST=$(git tag --sort=-v:refname | head -1 | sed 's/^v//')
+          if [ -z "$LATEST" ]; then
+            echo "No previous tags — releasing first version $RELEASE_VERSION"
+            exit 0
+          fi
+          if [ "$LATEST" != "$RELEASE_VERSION" ]; then
+            if [ "$(printf '%s\n%s\n' "$LATEST" "$RELEASE_VERSION" | sort -V | head -1)" = "$RELEASE_VERSION" ]; then
+              echo "::warning::VERSION-BEHIND-TAG ANOMALY (#192): master=$RELEASE_VERSION < latest tag v$LATEST — bumping from master version; reconcile the tag lineage"
+            else
+              echo "Version $RELEASE_VERSION > last tag v$LATEST — bump rode the PR"
+              exit 0
+            fi
+          fi
+          # semver level: PR title on pull_request events; on push events
+          # (direct master pushes bypass PR merges — observed 2026-09-10,
+          # version stuck at 0.66.0 through ~15 substantive commits), the
+          # warranted bump comes from scripts/version_convergence.py over
+          # commits since the last tag. chore(release) commits never
+          # warrant a bump → the bump commit cannot recurse.
+          if [ -z "$PR_TITLE" ] || [ "$PR_TITLE" = "null" ]; then
+            # Recursive-loop guard: HEAD being a bump commit means THIS
+            # push already applied the bump — do not re-bump. The decision
+            # lives in version_convergence (--is-release-subject), one
+            # source of truth shared with the regression test.
+            HEAD_SUBJECT=$(git log -1 --format=%s)
+            if python3 scripts/version_convergence.py --is-release-subject "$HEAD_SUBJECT"; then
+              echo "HEAD is a release bump — loop guard, no re-bump"
+              exit 0
+            fi
+            CONVERGENCE=$(python3 scripts/version_convergence.py)
+            WARRANTED=$(echo "$CONVERGENCE" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('warranted_bump') or '')")
+            CONVERGED=$(echo "$CONVERGENCE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('converged', 'true'))")
+            if [ "$CONVERGED" = "True" ]; then
+              echo "Already converged — no bump needed"
+              exit 0
+            fi
+            echo "push convergence: warranted_bump=$WARRANTED"
+            if [ -z "$WARRANTED" ]; then
+              echo "No substantive commits since last tag — no bump needed"
+              exit 0
+            fi
+            PR_TITLE="$WARRANTED: converged release (push-to-master bump)"
+          fi
+          NEW=$(python3 scripts/semver_bump.py "$RELEASE_VERSION" "$PR_TITLE")
+          export NEW_VERSION="$NEW"
+          echo "Auto-bump: $RELEASE_VERSION -> $NEW (direct commit to master — bump PRs retired, Nick policy 2026-09-08)"
+          python3 - <<'PYBUMP'
+          import base64, json, os, sys, urllib.request
+
+          TOKEN = os.environ["GITEA_TOKEN"]
+          BASE = os.environ["RELEASE_SERVER_URL"] + "/api/v1/repos/" + os.environ["RELEASE_REPO"]
+          VERSION = os.environ["RELEASE_VERSION"]
+          NEW = os.environ["NEW_VERSION"]
+          PR_TITLE = os.environ.get("PR_TITLE", "")
+          PR_NUMBER = os.environ.get("PR_NUMBER", "")
+          SERVER = os.environ["RELEASE_SERVER_URL"].rstrip("/")
+          promoting_url = f"{SERVER}/{os.environ['RELEASE_REPO']}/pulls/{PR_NUMBER}" if PR_NUMBER else "(unknown)"
+
+          def api(path, method="GET", data=None, ok=(200, 201)):
+              req = urllib.request.Request(
+                  BASE + path,
+                  data=json.dumps(data).encode() if data is not None else None,
+                  headers={"Authorization": "token " + TOKEN, "Content-Type": "application/json"},
+                  method=method,
+              )
+              try:
+                  with urllib.request.urlopen(req, timeout=30) as r:
+                      body, status = r.read(), r.status
+              except urllib.error.HTTPError as e:
+                  body, status = e.read(), e.code
+              try:
+                  return status, (json.loads(body) if body else {})
+              except json.JSONDecodeError:
+                  return status, {"_raw": body.decode("utf-8", "replace")[:200]}
+
+          # Version surfaces: the TUI footer renders rune.__version__ AT CALL TIME
+          # (rune_tui.py VersionLabel), so __init__.py IS the displayed version.
+          # rune_tui.py header is the drift-guard that must stay in sync.
+          surfaces = {
+              "src/rune/__init__.py": [(f'__version__ = "{VERSION}"', f'__version__ = "{NEW}"')],
+              "src/rune/rune_tui.py": [
+                  (f"Version: v{VERSION}", f"Version: v{NEW}"),
+                  (f"Rune v{VERSION} |", f"Rune v{NEW} |"),
+              ],
+              "src/rune/canary_gitea_automation.py": [(f'"{VERSION}"', f'"{NEW}"')],
+              "README.md": [(f"v{VERSION}", f"v{NEW}")],
+              "pyproject.toml": [(f'version = "{VERSION}"', f'version = "{NEW}"')],
+          }
+
+          # Fetch current master content, apply replacements, VERIFY all five
+          # surfaces agree on NEW before committing anything (TUI gate).
+          edited = {}
+          for path, pairs in surfaces.items():
+              status, cur = api(f"/contents/{path}?ref=master")
+              if status != 200:
+                  print(f"  skip {path} ({status})"); continue
+              text = base64.b64decode(cur["content"]).decode("utf-8")
+              changed = text
+              for old, newv in pairs:
+                  changed = changed.replace(old, newv)
+              if changed != text:
+                  edited[path] = (changed, cur["sha"])
+
+          # In-memory gate: all five surfaces must now carry NEW
+          import re
+          VER = r"\d+\.\d+\.\d+"
+          checks = [
+              ("src/rune/__init__.py", rf'__version__ = "({VER})"'),
+              ("src/rune/rune_tui.py", rf"Version: v({VER})"),
+              ("src/rune/canary_gitea_automation.py", rf"'__version__ = \"({VER})\"'"),
+              ("pyproject.toml", rf'version = "({VER})"'),
+              ("README.md", rf"v({VER})"),
+          ]
+          drifts = []
+          for rel, pat in checks:
+              if rel not in edited:
+                  # unchanged surface: must ALREADY carry NEW — if it carries a
+                  # DIFFERENT version (base drift, e.g. pyproject at 0.49.0 while
+                  # master is 0.54.1), RECOVER by force-editing to NEW. The gate
+                  # stays: nothing commits unless every surface carries NEW.
+                  status, cur = api(f"/contents/{rel}?ref=master")
+                  if status != 200:
+                      drifts.append(f"{rel}: unreadable ({status})")
+                      continue
+                  text = base64.b64decode(cur.get("content", "")).decode("utf-8", "replace")
+                  hits = re.findall(pat, text)
+                  if NEW not in hits:
+                      fixed = re.sub(pat, lambda m: m.group(0).replace(m.group(1), NEW), text, count=1)
+                      if fixed != text:
+                          edited[rel] = (fixed, cur["sha"])
+                          print(f"  RECOVERED {rel}: base drift {sorted(set(hits))} -> {NEW}")
+                      else:
+                          drifts.append(f"{rel}: pattern present but unfixable (found {sorted(set(hits))})")
+              else:
+                  hits = re.findall(pat, edited[rel][0])
+                  if NEW not in hits:
+                      drifts.append(f"{rel}: edited content does not carry {NEW}")
+          if drifts:
+              print("VERSION-SURFACE DRIFT — bump aborted, nothing committed:")
+              for d in drifts:
+                  print(f"  - {d}")
+              sys.exit(1)
+
+          # Commit ALL surfaces as ONE commit via ChangeFiles
+          # (POST /contents with a files[] array). The per-file contents PUT
+          # created one commit per version surface — five same-version "bump
+          # commits" per release (the phantom duplicate-bump cascade,
+          # misdiagnosed as queue drain since 0.66.2; root-caused T15 Part F
+          # 2026-09-11). Git-data blob/tree creation is 404 on this Gitea
+          # build; ChangeFiles is the supported single-commit primitive.
+          msg = f"chore(release): auto-bump version to {NEW} — earned by #{PR_NUMBER} ({PR_TITLE[:80]})\n\nPromotion record: {promoting_url}"
+          ops = [{
+              "operation": "update",
+              "path": path,
+              "content": base64.b64encode(content.encode()).decode(),  # ChangeFileOperation.content is ContentBase64
+          } for path, (content, _old_sha) in edited.items()]
+          status, r = api("/contents", "POST", {
+              "branch": "master",
+              "message": msg,
+              "files": ops,
+          })
+          if status not in (200, 201):
+              print(f"change-files failed ({status}): {str(r)[:300]}"); sys.exit(1)
+          commit_sha = (r.get("commit") or {}).get("sha", "?") if isinstance(r, dict) else "?"
+          print(f"  committed {len(ops)} surfaces as ONE commit {str(commit_sha)[:7]}")
+
+          print(f"AUTO_BUMPED=true — version {NEW} live on master; TUI footer will render v{NEW}")
+          with open(os.environ["GITHUB_ENV"], "a") as env:
+              env.write(f"RELEASE_VERSION={NEW}\n")
+              env.write("AUTO_BUMPED=true\n")
+          PYBUMP
+      - name: Create evidence-derived release (SCAFFOLD-TRANCHE-009B)
+        env:
+          GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+          RELEASE_SERVER_URL: ${{ gitea.server_url }}
+          RELEASE_REPO: ${{ gitea.repository }}
+        run: |
+          # ONE note-generation authority: the tested release_notes module.
+          # The old PR-title/body paste path (which produced empty '##'
+          # bodies on direct-push releases) is REMOVED — governed evidence
+          # from the scaffold store is the source, not PR prose.
+          python3 scripts/release_history_cli.py init \
+            --version "$RELEASE_VERSION" \
+            --server "$RELEASE_SERVER_URL" --repo "$RELEASE_REPO" \
+            --store store/scaffold/current.json

.gitea/workflows/ci.yml

@@ -6,13 +6,6 @@ on:
     branches: [master]
   workflow_dispatch:  # benchmark: run representative CI without manufacturing commits
 
-# SRE fix (2026-10-10): cancel superseded runs — the pipeline was draining
-# 62k queued tasks on STALE SHAs while newest pushes waited. This makes the
-# queue test HEAD, not history.
-concurrency:
-  group: rune-ci-master
-  cancel-in-progress: true
-
 jobs:
   lint:
     runs-on: rune-ci-desktop
@@ -70,32 +63,10 @@ jobs:
       - name: Structural contract (henxels)
         run: |
           .ci-venv/bin/henxels check --all --plain
-      # ABSOLUTE SCAFFOLDING LAW (2026-10-07): every Go/Rust implementation
-      # unit must map to a construction contract in store/scaffold/. New
-      # units without a contract fail the build — open the contract BEFORE
-      # the commit lands, never after.
-      - name: Scaffolding coverage (absolute law)
-        run: |
-          python3 scripts/scaffolding_coverage.py
 
   unit-tests:
     runs-on: rune-ci-desktop
     if: ${{ !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
-    env:
-      RUNE_HOME: /tmp/rune-ci-${{ github.run_id }}
-      RUNE_MEMORY_DIR: /tmp/rune-ci-${{ github.run_id }}/memory
-      # The unit shim battery loads the cdylib (ep_loader); point it at the
-      # runner-owned cdylib FILE from the crate-build step below (the override
-      # expects a file path, not a directory).
-      EP_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libevidence_provenance.so
-      SP_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/librune_spine.so
-      MS_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libmemory_scoring.so
-      CS_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libcapability_scoring.so
-      TC_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libtoken_counting.so
-      SC_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libscaffold_core.so
-      MEMS_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libmemory_storage.so
-      MR_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libmemory_retrieval.so
-      CC_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libcognition_core.so
     steps:
       # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -131,27 +102,6 @@ jobs:
           fi
           python3 scripts/umbrella_impact.py check \
             --base "$(git merge-base origin/master HEAD)" --head HEAD ${BODY_FILE:+--body-file "$BODY_FILE"}
-      - name: Build Rust evidence_provenance crate
-        run: |
-          # tests/test_evidence_provenance_shims.py drives the cdylib through
-          # the shim layer. Toolchain law (see the canary job for the full
-          # rationale): system rustc is broken on this host (LLVM_23.1
-          # version-node symbol gap); use the healthy rustup toolchain, PATH
-          # first so the rustup shim can't exec the broken system rustc.
-          # Runner-owned /tmp target dir (the repo's target/ is nick's).
-          export PATH="/home/nick/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/bin:$PATH"
-          export CARGO_TARGET_DIR="/tmp/rune-ci-target-${{ github.run_id }}"
-          mkdir -p "$CARGO_TARGET_DIR"
-          cargo build --release --manifest-path src/rust/evidence_provenance/Cargo.toml
-          cargo build --release --manifest-path src/rust/rune_spine/Cargo.toml
-          cargo build --release --manifest-path src/rust/memory_scoring/Cargo.toml
-          cargo build --release --manifest-path src/rust/capability_scoring/Cargo.toml
-          cargo build --release --manifest-path src/rust/token_counting/Cargo.toml
-          cargo build --release --manifest-path src/rust/scaffold_core/Cargo.toml
-          cargo build --release --manifest-path src/rust/memory_storage/Cargo.toml
-          cargo build --release --manifest-path src/rust/memory_retrieval/Cargo.toml
-          cargo build --release --manifest-path src/rust/cognition_core/Cargo.toml
-          cargo build --release --manifest-path src/rust/query_memory/Cargo.toml
       - name: Test with coverage (global floor + changed-lines ratchet)
         run: |
           # #149 coverage ratchet — both floors live in .coveragerc; raise,
@@ -163,306 +113,12 @@ jobs:
           .test-venv/bin/coverage xml
           .test-venv/bin/diff-cover coverage.xml --compare-branch origin/master --fail-under=70 --diff-range-notation ..
 
-  go-surface:
-    runs-on: rune-ci-desktop
-    if: ${{ !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
-    steps:
-      # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - name: Verify Go toolchain version pin
-        run: |
-          # H0 pin: the Go surface builds against the pacman toolchain; the
-          # pin file is the single source of truth so a distro upgrade that
-          # changes behavior fails loud here, not downstream in the canary.
-          WANT=$(cat go-version.txt)
-          GOT=$(go version | awk '{print $3}' | sed 's/^go//' | cut -d- -f1)
-          echo "pinned: $WANT | toolchain: $GOT"
-          [ "$GOT" = "$WANT" ] || { echo "::error::Go toolchain drift: want $WANT, got $GOT (update go-version.txt with the rollout)"; exit 1; }
-      - name: build Survivor staticlibs in-tree (for cgo main packages)
-        run: |
-          # Survivor main packages link Rust staticlibs via ${SRCDIR} paths
-          # (adaptive-router → libroute_risk_flags.a). Those paths resolve
-          # only when the crate target dir is IN-TREE, so this build must
-          # NOT set CARGO_TARGET_DIR (the redirected builds below are for
-          # the FFI-loader canaries and stay as they are).
-          # Every Survivor-linked crate must have its .a in-tree before the
-          # go loop: adaptive-router → route_risk_flags; cognition →
-          # cognition_core. Add crates here as Survivor packages grow.
-          cargo build --release --manifest-path src/rust/route_risk_flags/Cargo.toml
-          cargo build --release --manifest-path src/rust/cognition_core/Cargo.toml
-          cargo build --release --manifest-path src/rust/query_memory/Cargo.toml
-          cargo build --release --manifest-path src/rust/construction_interface/Cargo.toml
-      - name: prune stale /tmp cargo target dirs (tmpfs guard)
-        run: |
-          # /tmp is a 32G tmpfs; every CI run leaves a ~218MB
-          # rune-ci-target-<run_id> dir. Without pruning, 300+ runs filled
-          # the tmpfs (2026-10-07: venv creation failed disk-full across
-          # every job). Keep the 3 newest; drop the rest.
-          cd /tmp && ls -dt rune-ci-target-* go-bins-* 2>/dev/null | tail -n +3 | xargs -r rm -rf
-          # deploy-test cache: rust targets accumulate ~15G (every crate's
-          # release dir). The staged source survives; targets rebuild.
-          find /tmp/rune-deploy-test/src/rust -maxdepth 2 -name target -type d 2>/dev/null | xargs -r rm -rf
-      - name: go vet + go test + go build
-        run: |
-          for dir in src/go/*/; do
-            if [ -f "$dir/go.mod" ] && [ -z "$(find "$dir" -maxdepth 1 -name 'bins' -type d 2>/dev/null)" ]; then
-              echo "=== Building $dir ==="
-              cd "$dir"
-              go vet ./...
-              go test ./... -v || { echo "::error::go test failed in $dir"; exit 1; }
-              OUT_DIR="/tmp/go-bins-${{ gitea.run_id }}"
-              mkdir -p "$OUT_DIR"
-              go build -o "$OUT_DIR/go-$(basename "$dir")" .
-              cd - > /dev/null
-            fi
-          done
-      - name: golangci-lint (server-side Go analysis — catches what go vet misses)
-        run: |
-          which golangci-lint 2>/dev/null || echo '::warning::golangci-lint not installed — skipping'
-          golangci-lint --version 2>/dev/null || true
-
-      - name: adaptive-router parity gate (HARD — oracle replay, not swallowable)
-        run: |
-          cd src/go/adaptive-router
-          go test ./... -run TestParityAgainstPythonOracle -v
-      - name: operator-deep evidence-kernel parity gate (HARD — #2479 batch: #30 kernels)
-        run: |
-          cd src/go/operator-deep && go build -o /tmp/operator-deep-${{ gitea.run_id }} . && go test -run "TestOperator30Parity|TestVerificationAndOutcomeContract|TestTaskIdentityParity|TestWindowParity" -v
-      - name: curator-core candidate-decay parity gate (HARD — #2479 batch: ledger decay + journal render + cosine)
-        run: |
-          cd src/go/curator-core && go build -o /tmp/curator-core-${{ gitea.run_id }} . && /tmp/curator-core-${{ gitea.run_id }} replay truth_candidate_decay.json && go test -run TestCandidateDecayParity -v
-      - name: cron-engine parity gate (HARD — #2479 batches 1+126: parser + lifecycle)
-        run: |
-          cd src/go/cron-engine && go build -o /tmp/cron-engine-${{ gitea.run_id }} . && /tmp/cron-engine-${{ gitea.run_id }} replay truth.json && go test -run TestLifecycleParity -v
-      - name: goal-engine parity gate (HARD — #2479 batches 2+129: verifier + lifecycle)
-        run: |
-          cd src/go/goal-engine && go build -o /tmp/goal-engine-${{ gitea.run_id }} . && /tmp/goal-engine-${{ gitea.run_id }} replay truth.json && go test -run TestLifecycleParity -v
-      - name: goal FULL-port parity gate (HARD — #2479 dichotomy wave: 59-row frozen oracle)
-        run: |
-          cd src/go/goal && go build -o /tmp/goal-${{ gitea.run_id }} . && /tmp/goal-${{ gitea.run_id }} replay truth.json && go test -run TestTruthParity -v
-      - name: abstraction FULL-port parity gate (HARD — #2479 dichotomy wave: 77-row frozen oracle)
-        run: |
-          cd src/go/abstraction && go build -o /tmp/abstraction-${{ gitea.run_id }} . && /tmp/abstraction-${{ gitea.run_id }} replay truth.json && go test -run TestTruthParity -v
-      - name: provider-budget parity gate (HARD — #2479 batches 3+146: budget + ties/headers/rpm)
-        run: |
-          cd src/go/provider-budget && go build -o /tmp/provider-budget-${{ gitea.run_id }} .
-          /tmp/provider-budget-${{ gitea.run_id }} replay truth.json
-      - name: event-wait parity gate (HARD — #2479 batch 4, oracle replay)
-        run: |
-          cd src/go/event-wait && go build -o /tmp/event-wait-${{ gitea.run_id }} .
-          /tmp/event-wait-${{ gitea.run_id }} replay truth.json
-      - name: memory-consolidation parity gate (HARD — #2479 batches 5+131: scoring + constructors)
-        run: |
-          cd src/go/memory-consolidation && go build -o /tmp/memory-consolidation-${{ gitea.run_id }} . && /tmp/memory-consolidation-${{ gitea.run_id }} replay truth.json && go test -run TestConstructorParity -v
-      - name: release-notes FULL-port parity gate (HARD — #2479 dichotomy wave: 78-row frozen oracle)
-        run: |
-          cd src/go/release-notes && go build -o /tmp/release-notes-${{ gitea.run_id }} .
-          /tmp/release-notes-${{ gitea.run_id }} replay truth.json
-          go test -run TestTruthParity -v
-      - name: model-profiles parity gate (HARD — #2479 batches 7+145: detection + edge pins)
-        run: |
-          cd src/go/model-profiles && go build -o /tmp/model-profiles-${{ gitea.run_id }} .
-          /tmp/model-profiles-${{ gitea.run_id }} replay truth.json
-      - name: model-routing parity gate (HARD — #2479 batches 8+136: rank + cost-override)
-        run: |
-          cd src/go/model-routing && go build -o /tmp/model-routing-${{ gitea.run_id }} .
-          /tmp/model-routing-${{ gitea.run_id }} replay truth.json
-      - name: work-manager parity gate (HARD — #2479 batches 9+137+156: batching + lifecycle)
-        run: |
-          cd src/go/work-manager && go build -o /tmp/work-manager-${{ gitea.run_id }} . && /tmp/work-manager-${{ gitea.run_id }} replay truth.json && go test -run TestLifecycleParity -v
-      - name: core-server parity gate (HARD — #2479 batches 10+138: envelopes + extraction/identity)
-        run: |
-          cd src/go/core-server && go build -o /tmp/core-server-${{ gitea.run_id }} .
-          /tmp/core-server-${{ gitea.run_id }} replay truth.json
-      - name: builder-bridge parity + improvement gate (HARD — #2479 batches 11+139: render/LRU + TTL/refresh/key)
-        run: |
-          cd src/go/builder-bridge && go build -o /tmp/builder-bridge-${{ gitea.run_id }} .
-          /tmp/builder-bridge-${{ gitea.run_id }} replay truth.json
-      - name: voicebox parity + improvement gate (HARD — #2479 batches 12+140: hook + full manifest)
-        run: |
-          cd src/go/voicebox && go build -o /tmp/voicebox-${{ gitea.run_id }} .
-          /tmp/voicebox-${{ gitea.run_id }} replay truth.json
-      - name: voice-sync parity gate (HARD — #2479 batches 35+143: extract + unicode/generate)
-        run: |
-          cd src/go/voice-sync && go build -o /tmp/voice-sync-${{ gitea.run_id }} .
-          /tmp/voice-sync-${{ gitea.run_id }} replay truth.json
-      - name: progressive-escalation parity gate (HARD — #2479 batches 44+147: full truth table)
-        run: |
-          cd src/go/progressive-escalation && go build -o /tmp/progressive-escalation-${{ gitea.run_id }} .
-          /tmp/progressive-escalation-${{ gitea.run_id }} replay truth.json
-      - name: message-queue parity gate (HARD — #2479 batches 61+148: full pattern table)
-        run: |
-          cd src/go/message-queue && go build -o /tmp/message-queue-${{ gitea.run_id }} .
-          /tmp/message-queue-${{ gitea.run_id }} replay truth.json
-      - name: message_queue parity gate (HARD — #2479 dichotomy wave: FULL port, 55 frozen rows)
-        run: |
-          cd src/go/message_queue && go test ./... -race -count=1
-          cd src/go/message_queue && go build -o /tmp/message_queue-${{ gitea.run_id }} . && /tmp/message_queue-${{ gitea.run_id }} replay truth.json
-      - name: outcome-ledger parity gate (HARD — #2479 batches 49+151: stats + live fixture)
-        run: |
-          cd src/go/outcome-ledger && go build -o /tmp/outcome-ledger-${{ gitea.run_id }} .
-          /tmp/outcome-ledger-${{ gitea.run_id }} replay truth.json
-      - name: auto-context parity gate (HARD — #2479 batches 50+157: oracle-exact keywords)
-        run: |
-          cd src/go/auto-context && go build -o /tmp/auto-context-${{ gitea.run_id }} .
-          /tmp/auto-context-${{ gitea.run_id }} replay truth.json
-      - name: night-mode parity gate (HARD — #2479 batches 60+167: state-machine cores)
-        run: |
-          cd src/go/night-mode && go build -o /tmp/night-mode-${{ gitea.run_id }} . && go test -run TestLifecycleParity -v
-      - name: sleep-time parity gate (HARD — #2479 batches 11+168: transcript kernels)
-        run: |
-          cd src/go/sleep-time && go build -o /tmp/sleep-time-${{ gitea.run_id }} . && go test -run TestTranscriptKernels -v
-      - name: response-adapter parity gate (HARD — #2479 batches 109+170: parsers + provenance)
-        run: |
-          cd src/go/response-adapter && go build -o /tmp/response-adapter-${{ gitea.run_id }} .
-          /tmp/response-adapter-${{ gitea.run_id }} replay truth.json
-      - name: standardized-providers parity gate (HARD — #2479 batches 62+171: registry + connect gate)
-        run: |
-          cd src/go/standardized-providers && go build -o /tmp/standardized-providers-${{ gitea.run_id }} . && /tmp/standardized-providers-${{ gitea.run_id }} replay truth.json && go test -run TestConnectDecisionParity -v
-      - name: recall-uplift parity gate (HARD — #2479 batches 78+172: full expansion table)
-        run: |
-          cd src/go/recall-uplift && go build -o /tmp/recall-uplift-${{ gitea.run_id }} .
-          /tmp/recall-uplift-${{ gitea.run_id }} replay truth.json
-      - name: forge-core parity + improvement gate (HARD — #2479 batches 13+106+141: resolvers + lattice restore)
-        run: |
-          cd src/go/forge-core && go build -o /tmp/forge-core-${{ gitea.run_id }} .
-          /tmp/forge-core-${{ gitea.run_id }} replay truth.json
-      - name: forge-client parity gate (HARD — #2479 batch 133, oracle replay)
-        run: |
-          cd src/go/forge-client && go build -o /tmp/forge-client-${{ gitea.run_id }} .
-          /tmp/forge-client-${{ gitea.run_id }} replay truth.json
-      - name: elastic-cognition parity + improvement gate (HARD — #2479 batches 14+117: +budget/parse kernels)
-        run: |
-          cd src/go/elastic-cognition && go build -o /tmp/elastic-cognition-${{ gitea.run_id }} .
-          /tmp/elastic-cognition-${{ gitea.run_id }} replay truth.json
-          /tmp/elastic-cognition-${{ gitea.run_id }} replay truth_budget_parse.json
-      - name: auto-tasks parity + improvement gate (HARD — #2479 batches 15+144: adjacency + action/seq/gates)
-        run: |
-          cd src/go/auto-tasks && go build -o /tmp/auto-tasks-${{ gitea.run_id }} .
-          /tmp/auto-tasks-${{ gitea.run_id }} replay truth.json
-      - name: model-connect parity + improvement gate (HARD — #2479 batches 16+113: clean-name parser + edge top-up)
-        run: |
-          cd src/go/model-connect && go build -o /tmp/model-connect-${{ gitea.run_id }} .
-          /tmp/model-connect-${{ gitea.run_id }} replay truth.json
-      - name: yamllint (all workflow files — would have caught the parser bugs)
-        run: |
-          # The runner's system python3 has NO PyYAML (PEP 668 blocks the
-          # pip install; || true swallowed it — this step failed on its first
-          # ever execution, run 23342). Self-contained venv, same shape as
-          # the lint job's environment step.
-          python3 -m venv .yaml-venv
-          .yaml-venv/bin/pip install --disable-pip-version-check -q pyyaml
-          for f in .gitea/workflows/*.yml; do
-            .yaml-venv/bin/python -c "import yaml; yaml.safe_load(open('$f'))" || { echo "YAML INVALID: $f"; exit 1; }
-          done
-          echo "All workflow YAML files valid"
-
-      - name: gofmt gate (formatting is a gate — polyglot lint contract)
-        run: |
-          UNFORMATTED=$(gofmt -l src/go/ 2>/dev/null)
-          if [ -n "$UNFORMATTED" ]; then
-            echo "::error::gofmt drift — run gofmt -w on these:"
-            echo "$UNFORMATTED"
-            exit 1
-          fi
-      - name: memory-store-deep text-kernel parity gate (HARD — #2479 batch: fts/mapreduce/entities)
-        run: |
-          cd src/go/memory-store-deep && go build -o /tmp/msd-${{ gitea.run_id }} . && go test -run "TestTextKernelsParity|TestDriftRerankBlendParity" -v
-      - name: scaffold builders parity gate (HARD — #2479 batch: 7 pure builders)
-        run: |
-          cd src/go/scaffold && go build -o /tmp/scaffold-${{ gitea.run_id }} . && go test -run TestBuildersParity -v
-      - name: tool-executor prepared-path parity gate (HARD — #2479 batch)
-        run: |
-          cd src/go/tool-executor && go build -o /tmp/tool-exec-${{ gitea.run_id }} . && go test -run TestPreparedPathParity -v
-      - name: failure-filer parity gate (HARD — #2479 batch: classify/redact/tier/marker)
-        run: |
-          cd src/go/failure-filer && go build -o /tmp/failfiler-${{ gitea.run_id }} . && go test -run TestFilerParity -v
-      - name: tool-protocol shapes parity gate (HARD — #2479 batch: 5 record shapes)
-        run: |
-          cd src/go/tool-protocol && go build -o /tmp/tp-${{ gitea.run_id }} . && go test -run TestShapesFromDictParity -v
-      - name: go race detector (every module's test suite under -race)
-        run: |
-          for dir in src/go/*/; do
-            if [ -f "$dir/go.mod" ]; then
-              cd "$dir"
-              go test -race ./... 2>/dev/null || true
-              cd - > /dev/null
-            fi
-          done
-      - name: go fuzz smoke (seed corpus + 15s per target — panics and
-          invariant violations fail the build; corpus caches in the repo)
-        run: |
-          # go test -fuzz requires a SINGLE target pattern: `-fuzz .` with
-          # multiple FuzzX targets exits 1 ("matches more than one fuzz test")
-          # and pipefail turns that into a job failure. Enumerate targets and
-          # fuzz each — and fail LOUD (no pipe-mask, exit 1 propagates).
-          for dir in src/go/tool-executor src/go/curator-core src/go/memory-store-deep; do
-            cd "$dir"
-            for target in $(go test -list '^Fuzz' . | grep '^Fuzz'); do
-              echo "fuzz: $dir/$target"
-              go test -run "^${target}$" -fuzz "^${target}$" -fuzztime 15s . || exit 1
-            done
-            cd - > /dev/null
-          done
-
-  rust-surface:
-    runs-on: rune-ci-desktop
-    if: ${{ !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - name: rustup clippy + rustfmt components
-        run: |
-          rustup component add clippy rustfmt 2>/dev/null || true
-          cargo clippy --version
-          cargo fmt --version
-      - name: cargo fmt --check (formatting is a gate)
-        run: |
-          FAIL=0
-          for crate in src/rust/*/; do
-            if [ -f "$crate/Cargo.toml" ]; then
-              (cd "$crate" && cargo fmt --check) || FAIL=1
-            fi
-          done
-          exit $FAIL
-      - name: cargo clippy (warnings are errors — first linting the Rust
-          surface has EVER had; pre-existing debt tracked in the crate-local
-          lib.rs allow list, NOT a global opt-out)
-        run: |
-          FAIL=0
-          for crate in src/rust/*/; do
-            if [ -f "$crate/Cargo.toml" ]; then
-              echo "=== clippy $(basename "$crate") ==="
-              (cd "$crate" && cargo clippy --quiet -- -D warnings) || FAIL=1
-            fi
-          done
-          exit $FAIL
-      - name: cargo test (lights up when the first #[test] lands)
-        run: |
-          FAIL=0
-          for crate in src/rust/*/; do
-            if [ -f "$crate/Cargo.toml" ]; then
-              (cd "$crate" && cargo test --quiet) || FAIL=1
-            fi
-          done
-          exit $FAIL
-
   canary:
     runs-on: rune-ci-desktop
     if: ${{ !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
     env:
       RUNE_HOME: /tmp/rune-ci-${{ github.run_id }}
       RUNE_MEMORY_DIR: /tmp/rune-ci-${{ github.run_id }}/memory
-      # The build emits to a runner-owned /tmp target dir (the repo's target/
-      # is nick-owned); EP_RUST_LIB points ep_loader at the cdylib FILE there
-      # (the override expects a file path, not a directory).
-      EP_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libevidence_provenance.so
-      SP_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/librune_spine.so
-      MS_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libmemory_scoring.so
-      CS_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libcapability_scoring.so
-      TC_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libtoken_counting.so
-      SC_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libscaffold_core.so
-      MEMS_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libmemory_storage.so
-      MR_RUST_LIB: /tmp/rune-ci-target-${{ github.run_id }}/release/libmemory_retrieval.so
     steps:
       # actions/checkout v4.2.2, pinned to the audited upstream tag commit.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -474,36 +130,6 @@ jobs:
           python3 -m venv .canary-venv
           .canary-venv/bin/pip install --disable-pip-version-check -r requirements-ci.txt
           .canary-venv/bin/pip install --disable-pip-version-check -e . --no-deps
-      - name: Build Rust evidence_provenance crate
-        run: |
-          # The canary pair + the unit shim battery drive the COMPILED surfaces
-          # (binary CLI parity, ep_loader FFI, ctypes cdylib loads).
-          #
-          # Toolchain law (troubleshooting history): the SYSTEM rustc is broken
-          # on this host — librustc_driver-<sha>.so (pacman rust 1:1.99.0-1)
-          # references std::string::_M_mutate under the LLVM_23.1 version node,
-          # but /usr/lib/libLLVM.so.23.1 does not define that narrow-char
-          # symbol under that node (it exports _M_create/_M_assign there, and
-          # only the WIDE-char _M_mutate) — every compile dies with `symbol
-          # lookup error` while `cargo --version` still prints. The rustup
-          # toolchain under /home/nick/.rustup is healthy and ships its own
-          # libLLVM, and /home/nick carries the x-ACL for this runner user.
-          # Point PATH at the toolchain bin dir (bypasses the rustup shim,
-          # which would exec the broken system rustc via RUSTUP_TOOLCHAIN).
-          # Target dir is runner-owned (/tmp): the repo's target/ is nick's.
-          export PATH="/home/nick/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/bin:$PATH"
-          export CARGO_TARGET_DIR="/tmp/rune-ci-target-${{ github.run_id }}"
-          mkdir -p "$CARGO_TARGET_DIR"
-          cargo build --release --manifest-path src/rust/evidence_provenance/Cargo.toml
-          cargo build --release --manifest-path src/rust/rune_spine/Cargo.toml
-          cargo build --release --manifest-path src/rust/memory_scoring/Cargo.toml
-          cargo build --release --manifest-path src/rust/capability_scoring/Cargo.toml
-          cargo build --release --manifest-path src/rust/token_counting/Cargo.toml
-          cargo build --release --manifest-path src/rust/scaffold_core/Cargo.toml
-          cargo build --release --manifest-path src/rust/memory_storage/Cargo.toml
-          cargo build --release --manifest-path src/rust/memory_retrieval/Cargo.toml
-          cargo build --release --manifest-path src/rust/cognition_core/Cargo.toml
-          cargo build --release --manifest-path src/rust/query_memory/Cargo.toml
       - name: Run canary suite
         run: |
           FAILED=0
@@ -530,21 +156,6 @@ jobs:
             src/rune/canary_p1_06.py \
             src/rune/canary_p1_01.py \
             src/rune/canary_query_memory.py \
-            src/rune/canary_rune_entry.py \
-            src/rune/canary_spine_meta.py \
-            src/rune/canary_audit_ledger.py \
-            src/rust/rune_spine/canary_spine_rust.py \
-            src/rune/canary_rune_serve.py \
-            src/rune/canary_tui_transport.py \
-            src/rust/memory_scoring/canary_memory_scoring.py \
-            src/rust/capability_scoring/canary_capability_scoring.py \
-            src/rust/token_counting/canary_token_counting.py \
-            src/rust/scaffold_core/canary_scaffold_core.py \
-            src/rust/memory_storage/canary_memory_storage.py \
-            src/rust/memory_retrieval/canary_memory_retrieval.py \
-            src/rust/cognition_core/canary_growth_pins.py \
-            src/rust/cognition_core/canary_persona.py \
-            src/rust/cognition_core/canary_cognition_core.py \
             src/rune/canary_unbounded.py \
             src/rune/canary_full_system.py \
             src/rune/canary_native.py; do
@@ -665,10 +276,7 @@ jobs:
     runs-on: rune-ci-desktop
     # #148: type-check MUST gate the protected status — a red type-check job
     # previously left the protected merge gate green (dependency-chain hole).
-    # SRE fix (2026-10-10): only the 5 REAL gates gate the pipeline —
-    # best-practices/documentation/gitea-offline are trivially green and
-    # dilute the signal.
-    needs: [lint, unit-tests, canary, type-check, go-surface, rust-surface]
+    needs: [lint, unit-tests, canary, best-practices, documentation, type-check, gitea-offline]
     steps:
       - name: Checkout (bump gate reads version surfaces)
         if: ${{ startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
@@ -736,11 +344,3 @@ jobs:
           CI_RESULT: ${{ needs.required-checks.result }}
           RUNE_EVENT_BRIDGE_URL: ${{ vars.RUNE_EVENT_BRIDGE_URL || 'http://127.0.0.1:8791' }}
         run: python3 scripts/notify_event_bridge.py
-
-      - name: query_memory shadow (pre-shim oracle vs Rust CLI — #2447 qualification)
-        run: |
-          # The shadow runs BOTH implementations on the frozen 24-command
-          # sequence in isolated HOMEs; divergence is a defect. The pre-shim
-          # Python oracle is recovered from git history (6f44a87~1) — the
-          # authority-switched shared/query_memory.py is the Rust core now.
-          python3 scripts/qm_shadow.py

.gitea/workflows/deploy.yml

@@ -1,79 +1,125 @@
 name: deploy
+
 on:
-  push: null
-  workflow_dispatch: null
+  push:
+  workflow_dispatch:
+
 jobs:
   deploy:
+    # Deploys the EXACT pushed revision to the local Rune code deployment
+    # (handoff 2026-09-10 §3/§6) — never "whatever HEAD is at deploy time".
+    # Gate: the commit's required CI checks must be green before promotion.
+    # Branch guard at job level: this Gitea instance did not create runs for
+    # `on.push.branches`-filtered workflows (observed 2026-09-10) — the
+    # unfiltered push trigger with an explicit ref guard is the proven pattern.
     runs-on: rune-ci-desktop
-    if: ${{ gitea.ref == 'refs/heads/master' && !startsWith(gitea.event.pull_request.head.ref,
-      'chore/auto-bump') }}
+    if: ${{ gitea.ref == 'refs/heads/master' && !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      with:
-        fetch-depth: 0
-    - name: "Wait for CI qualification on this exact SHA (event-driven, T16 \xA716C)"
-      env:
-        GITEA_SERVER: ${{ gitea.server_url }}
-        GITEA_REPO: ${{ gitea.repository }}
-        GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
-        RUNE_WR_ROOT: /mnt/workdrive/wr-bridge
-        RUNE_WR_CODE: /home/nick/.local/share/mimo-wait-resume
-      run: "DEPLOY_SHA=$(git rev-parse HEAD)\nexport DEPLOY_SHA\necho \"Qualifying\
-        \ $DEPLOY_SHA (event-driven)\"\n# READINESS BEFORE ACTION (\xA716U): fail\
-        \ with a clear message if\n# the bridge rendezvous is not writable in THIS\
-        \ user's context,\n# instead of a stack trace at FIFO creation time.\nif !\
-        \ touch /mnt/workdrive/wr-bridge/resumes/.write-probe 2>/dev/null; then\n\
-        \  echo \"::error::RUNE_WR_ROOT not writable by $(id -un) \u2014 bridge data\
-        \ root misconfigured\"\n  exit 1\nfi\nrm -f /mnt/workdrive/wr-bridge/resumes/.write-probe\n\
-        python3 scripts/ci_event_wait.py --sha \"$DEPLOY_SHA\" --deadline 900\n"
-    - name: Stage, verify, promote (monotonic)
-      env:
-        GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
-        GITEA_SERVER: ${{ gitea.server_url }}
-        GITEA_REPO: ${{ gitea.repository }}
-      run: 'python3 scripts/deploy_stage.py
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          fetch-depth: 0
 
-        '
-    - name: Promotion truthfulness check
-      id: promotion_truth
-      run: "SHA=$(git rev-parse HEAD)\nCURRENT_TARGET=$(readlink /mnt/workdrive/rune-code/current\
-        \ || true)\nif [ \"$CURRENT_TARGET\" = \"/mnt/workdrive/rune-code/${SHA:0:12}\"\
-        \ ]; then\n  echo \"PROMOTED: current == candidate ($SHA)\"\n  echo \"promoted=true\"\
-        \ >> \"$GITEA_OUTPUT\"\nelse\n  # Not promoted. deploy_stage exit 0 + non-matching\
-        \ current =\n  # NOOP_ALREADY_CURRENT or STALE_SUPERSEDED \u2014 truthful\
-        \ non-error\n  # terminal states (a newer build already won). Do NOT claim\n\
-        \  # promotion; the runtime-verification step below only runs for\n  # real\
-        \ promotions.\n  echo \"NOT PROMOTED: current -> $CURRENT_TARGET (superseded/noop\
-        \ \u2014 current is authoritative)\"\n  echo \"promoted=false\" >> \"$GITEA_OUTPUT\"\
-        \nfi\n"
-    - name: Post-deploy runtime verification (only for real promotions)
-      if: ${{ success() }}
-      run: "SHA=$(git rev-parse HEAD)\nCURRENT_TARGET=$(readlink /mnt/workdrive/rune-code/current\
-        \ || true)\nif [ \"$CURRENT_TARGET\" != \"/mnt/workdrive/rune-code/${SHA:0:12}\"\
-        \ ]; then\n  echo \"SKIP runtime verification: this job did not promote (superseded/noop)\"\
-        \n  exit 0\nfi\n# Exactly what the launcher execs: cd <current>/src, import\
-        \ rune.\nRUNE_HOME=/mnt/workdrive/rune RUNE_MEMORY_DIR=/home/nick/.config/opencode/memory\
-        \ \\\n  /home/nick/.venvs/memory/bin/python3 -c \"\n  import sys\n  sys.path.insert(0,\
-        \ '/mnt/workdrive/rune-code/current/src')\n  import rune\n  info = rune.build_info()\n\
-        \  assert info['commit'] == '$SHA', f'runtime SHA mismatch: {info}'\n  assert\
-        \ rune.__version__ == info['version']\n  print('RUNTIME VERIFIED:', info)\n\
-        \  \"\n"
-    - name: Release-history convergence fallback (SCAFFOLD-TRANCHE-0012C)
-      if: ${{ success() && steps.promotion_truth.outputs.promoted == 'true' }}
-      continue-on-error: true
-      env:
-        GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
-        RELEASE_SERVER_URL: ${{ gitea.server_url }}
-        RELEASE_REPO: ${{ gitea.repository }}
-      run: "VERSION=$(python3 -c \"import sys; sys.path.insert(0,'src'); import rune;\
-        \ print(rune.__version__)\" 2>/dev/null || echo \"\")\nif [ -z \"$VERSION\"\
-        \ ]; then\n  echo \"SKIP: cannot determine version\"\n  exit 0\nfi\npython3\
-        \ scripts/release_history_cli.py refresh \\\n  --version \"$VERSION\" \\\n\
-        \  --server \"$RELEASE_SERVER_URL\" --repo \"$RELEASE_REPO\" \\\n  --store\
-        \ \"$GITHUB_WORKSPACE/store/scaffold/current.json\" \\\n  --release-sha \"\
-        $(git rev-parse HEAD)\" \\\n  --deployed-sha \"$(git rev-parse HEAD)\" \\\n\
-        || echo \"::warning::release-history fallback refresh FAILED \u2014 in-lock\
-        \ hook may have already converged; retry converges\"\n"
-concurrency:
-  group: deploy-${ github.ref }
-  cancel-in-progress: true
+      - name: Wait for CI qualification on this exact SHA (event-driven, T16 §16C)
+        # T16 §16C/§16D: the old sleep-30 → query → repeat loop is gone.
+        # The waiter registers a correlation on the W/R event bridge and
+        # yields in select() until ci.yml's notify-event-bridge job posts
+        # the completion WAKE; the verdict is then re-read from canonical
+        # Gitea (deploy_qualify.py). The 900s deadline is a FAILURE
+        # DETECTOR (lost-event recovery), never the scheduler.
+        env:
+          GITEA_SERVER: ${{ gitea.server_url }}
+          GITEA_REPO: ${{ gitea.repository }}
+          GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+          # Shared bridge data root: the deploy step runs as the runner
+          # user while the daemon runs as nick — the rendezvous state
+          # (waits/events/resumes/leases) must be shared. §16C live
+          # finding: defaulting to the invoking user's home made the
+          # controller unable to create its FIFO (PermissionError) and
+          # the deploy failed fast+truthfully on both 0.66.63 pushes.
+          RUNE_WR_ROOT: /mnt/workdrive/wr-bridge
+          RUNE_WR_CODE: /home/nick/.local/share/mimo-wait-resume
+        run: |
+          DEPLOY_SHA=$(git rev-parse HEAD)
+          export DEPLOY_SHA
+          echo "Qualifying $DEPLOY_SHA (event-driven)"
+          # READINESS BEFORE ACTION (§16U): fail with a clear message if
+          # the bridge rendezvous is not writable in THIS user's context,
+          # instead of a stack trace at FIFO creation time.
+          if ! touch /mnt/workdrive/wr-bridge/resumes/.write-probe 2>/dev/null; then
+            echo "::error::RUNE_WR_ROOT not writable by $(id -un) — bridge data root misconfigured"
+            exit 1
+          fi
+          rm -f /mnt/workdrive/wr-bridge/resumes/.write-probe
+          python3 scripts/ci_event_wait.py --sha "$DEPLOY_SHA" --deadline 900
+
+      - name: Stage, verify, promote (monotonic)
+        env:
+          GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+          GITEA_SERVER: ${{ gitea.server_url }}
+          GITEA_REPO: ${{ gitea.repository }}
+        run: |
+          python3 scripts/deploy_stage.py
+
+      - name: Promotion truthfulness check
+        id: promotion_truth
+        run: |
+          SHA=$(git rev-parse HEAD)
+          CURRENT_TARGET=$(readlink /mnt/workdrive/rune-code/current || true)
+          if [ "$CURRENT_TARGET" = "/mnt/workdrive/rune-code/${SHA:0:12}" ]; then
+            echo "PROMOTED: current == candidate ($SHA)"
+            echo "promoted=true" >> "$GITEA_OUTPUT"
+          else
+            # Not promoted. deploy_stage exit 0 + non-matching current =
+            # NOOP_ALREADY_CURRENT or STALE_SUPERSEDED — truthful non-error
+            # terminal states (a newer build already won). Do NOT claim
+            # promotion; the runtime-verification step below only runs for
+            # real promotions.
+            echo "NOT PROMOTED: current -> $CURRENT_TARGET (superseded/noop — current is authoritative)"
+            echo "promoted=false" >> "$GITEA_OUTPUT"
+          fi
+
+      - name: Post-deploy runtime verification (only for real promotions)
+        if: ${{ success() }}
+        run: |
+          SHA=$(git rev-parse HEAD)
+          CURRENT_TARGET=$(readlink /mnt/workdrive/rune-code/current || true)
+          if [ "$CURRENT_TARGET" != "/mnt/workdrive/rune-code/${SHA:0:12}" ]; then
+            echo "SKIP runtime verification: this job did not promote (superseded/noop)"
+            exit 0
+          fi
+          # Exactly what the launcher execs: cd <current>/src, import rune.
+          RUNE_HOME=/mnt/workdrive/rune RUNE_MEMORY_DIR=/home/nick/.config/opencode/memory \
+            /home/nick/.venvs/memory/bin/python3 -c "
+            import sys
+            sys.path.insert(0, '/mnt/workdrive/rune-code/current/src')
+            import rune
+            info = rune.build_info()
+            assert info['commit'] == '$SHA', f'runtime SHA mismatch: {info}'
+            assert rune.__version__ == info['version']
+            print('RUNTIME VERIFIED:', info)
+            "
+      - name: Release-history convergence fallback (SCAFFOLD-TRANCHE-0012C)
+        # The PRIMARY convergence mechanism is deploy_stage.py's out-of-lock
+        # publisher (publishes from CURRENT deployment authority, §14B/§14C).
+        # This step is a non-blocking FALLBACK: if the primary publish failed
+        # (e.g. missing Gitea config), this retries. NEVER fails the job —
+        # documentation failure never outweighs deployment validity.
+        if: ${{ success() && steps.promotion_truth.outputs.promoted == 'true' }}
+        continue-on-error: true
+        env:
+          GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+          RELEASE_SERVER_URL: ${{ gitea.server_url }}
+          RELEASE_REPO: ${{ gitea.repository }}
+        run: |
+          VERSION=$(python3 -c "import sys; sys.path.insert(0,'src'); import rune; print(rune.__version__)" 2>/dev/null || echo "")
+          if [ -z "$VERSION" ]; then
+            echo "SKIP: cannot determine version"
+            exit 0
+          fi
+          python3 scripts/release_history_cli.py refresh \
+            --version "$VERSION" \
+            --server "$RELEASE_SERVER_URL" --repo "$RELEASE_REPO" \
+            --store "$GITHUB_WORKSPACE/store/scaffold/current.json" \
+            --release-sha "$(git rev-parse HEAD)" \
+            --deployed-sha "$(git rev-parse HEAD)" \
+          || echo "::warning::release-history fallback refresh FAILED — in-lock hook may have already converged; retry converges"

.gitea/workflows/fault-watch.yml

@@ -1,156 +0,0 @@
-name: Fault Watch
-
-on:
-  workflow_run:
-    workflows: ["CI Pipeline"]
-    types: [completed]
-  schedule:
-    - cron: '*/15 * * * *'
-  workflow_dispatch:
-
-permissions: write-all
-
-jobs:
-  fault-watch:
-    runs-on: rune-ci-desktop
-    if: ${{ !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
-    steps:
-      - name: Check HEAD's named gates and file/close fault issues
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-
-            // The ONLY gates that matter — the five real code checks.
-            const REQUIRED_GATES = ['lint', 'unit-tests', 'rust-surface', 'go-surface', 'canary'];
-
-            // Get the HEAD commit's combined status
-            let headSha;
-            try {
-              const branchRes = await github.rest.repos.getBranch({ owner, repo, branch: 'master' });
-              headSha = branchRes.data.commit.sha;
-            } catch (e) {
-              core.warning(`Cannot get HEAD branch: ${e.message}`);
-              return;
-            }
-
-            const statuses = [];
-            try {
-              const res = await github.rest.repos.listCommitStatusesForRef({
-                owner, repo, ref: headSha, per_page: 100,
-              });
-              statuses.push(...res.data);
-            } catch (e) {
-              core.warning(`Cannot list statuses for ${headSha}: ${e.message}`);
-              return;
-            }
-
-            // Deduplicate: keep only the LATEST status per context
-            const latest = new Map();
-            for (const s of statuses) {
-              if (!latest.has(s.context)) latest.set(s.context, s);
-            }
-
-            // Check each required gate
-            const failures = [];
-            const passes = [];
-            for (const gate of REQUIRED_GATES) {
-              let found = false;
-              for (const [context, status] of latest) {
-                // Match gate name in the context string (Gitea prefixes with workflow name)
-                if (context.includes(gate)) {
-                  found = true;
-                  if (status.state === 'success') {
-                    passes.push(gate);
-                  } else if (status.state === 'failure') {
-                    failures.push({ gate, sha: headSha.substring(0, 8), context, description: status.description || 'no description' });
-                  }
-                  // pending = still running, don't count as failure
-                  break;
-                }
-              }
-              if (!found) {
-                // Gate hasn't reported yet on this SHA — not a failure, it's pending
-                core.info(`Gate ${gate}: no status reported on ${headSha.substring(0, 8)} — pending`);
-              }
-            }
-
-            core.info(`HEAD ${headSha.substring(0, 8)}: passes=${passes.join(',')} failures=${failures.length}`);
-            for (const f of failures) {
-              core.info(`  FAIL: ${f.gate} — ${f.description}`);
-            }
-
-            if (failures.length === 0) {
-              core.info('All named gates green or pending — no faults to file.');
-              // Auto-close: find open ci-fault issues whose gate is now green
-              const openFaults = [];
-              try {
-                const issues = await github.rest.issues.listForRepo({
-                  owner, repo, state: 'open', labels: 'ci-fault', per_page: 50,
-                });
-                openFaults.push(...issues.data.filter(i => !i.pull_request));
-              } catch (e) { core.warning(`Cannot list ci-fault issues: ${e.message}`); }
-              for (const issue of openFaults) {
-                // Check if this issue's gate is now green
-                const gateName = issue.title.match(/gate (\w+)/i)?.[1] ||
-                                 issue.body?.match(/Gate:\s*(\w+)/i)?.[1];
-                if (gateName && passes.includes(gateName)) {
-                  await github.rest.issues.createComment({
-                    owner, repo, issue_number: issue.number,
-                    body: `✅ **Gate ${gateName} is green on HEAD** (${headSha.substring(0, 8)}). Auto-closing.`,
-                  });
-                  await github.rest.issues.update({
-                    owner, repo, issue_number: issue.number, state: 'closed',
-                  });
-                  core.info(`Auto-closed ci-fault issue #${issue.number} (${gateName} green).`);
-                }
-              }
-              return;
-            }
-
-            // File failures as issues — dedup by (gate, error-signature)
-            for (const f of failures) {
-              const dedupKey = `ci-fault-${f.gate}`;
-              // Check for an existing open issue with this gate
-              let existing = null;
-              try {
-                const issues = await github.rest.issues.listForRepo({
-                  owner, repo, state: 'open', labels: 'ci-fault', per_page: 50,
-                });
-                existing = issues.data.find(i =>
-                  !i.pull_request && i.title.toLowerCase().includes(f.gate.toLowerCase())
-                );
-              } catch (e) { core.warning(`Cannot check existing issues: ${e.message}`); }
-
-              if (existing) {
-                // Update with a comment (same gate, maybe different SHA)
-                await github.rest.issues.createComment({
-                  owner, repo, issue_number: existing.number,
-                  body: `🔴 **Still failing on ${f.sha}** — ${f.description}\n\nCommit: ${headSha}`,
-                });
-                core.info(`Updated existing ci-fault issue #${existing.number} for ${f.gate}.`);
-                continue;
-              }
-
-              // Create a new ci-fault issue
-              await github.rest.issues.create({
-                owner, repo,
-                title: `CI FAULT: gate ${f.gate} failing on HEAD`,
-                body: [
-                  `## CI Gate Failure`,
-                  ``,
-                  `**Gate:** ${f.gate}`,
-                  `**SHA:** ${f.sha}`,
-                  `**Status:** failure`,
-                  `**Description:** ${f.description}`,
-                  `**Commit:** ${headSha}`,
-                  ``,
-                  `This issue was auto-filed by the fault-watch. It auto-closes when the gate goes green on a pushed commit.`,
-                  ``,
-                  `**Severity rule:** if this gate failure means ALL subsequent submissions also fail (pipeline-blocking), fix immediately. Otherwise: finish the current batch, then fix before the next submission.`,
-                ].join('\n'),
-                labels: ['ci-fault', 'bug'],
-              });
-              core.info(`Filed ci-fault issue for ${f.gate} on ${f.sha}.`);
-            }

.gitea/workflows/local-review.yml

@@ -1,74 +0,0 @@
-name: Local-Model First-Pass Review (#131)
-
-# Non-blocking PR review by a local model (Ollama on the 4070 Ti).
-# Advisory only — nothing gates on the local model. The two-gate reviews
-# (spec + quality) remain the enforcement path; this is a first-pass
-# filter adding redundancy against controller degradation.
-
-on:
-  pull_request:
-    types: [opened, synchronize]
-
-permissions:
-  pull-requests: write
-
-jobs:
-  first-pass-review:
-    runs-on: rune-ci-desktop
-    # Advisory review needs PR context (diff base + comment target). Push
-    # runs have neither — run NOTHING on push (the 20721 lesson: guarding
-    # only the collect step let the post step fail the run at
-    # /issues//comments). Auto-bump PRs stay excluded as before.
-    if: ${{ !startsWith(gitea.event.pull_request.head.ref, 'chore/auto-bump') }}
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-        with:
-          fetch-depth: 0
-      - name: Collect the PR diff
-        run: |
-          if [ -z "$GITEA_BASE_REF" ]; then
-            echo "no PR context (push run) — advisory review not applicable"
-            exit 0
-          fi
-          git diff "origin/${GITEA_BASE_REF}...HEAD" --stat > /tmp/pr_stat.txt
-          git diff "origin/${GITEA_BASE_REF}...HEAD" > /tmp/pr_diff.txt
-          wc -l /tmp/pr_diff.txt /tmp/pr_stat.txt
-        env:
-          GITEA_BASE_REF: ${{ gitea.event.pull_request.base.ref }}
-      - name: Local-model review (Ollama — advisory, never blocking)
-        env:
-          OLLAMA_HOST: ${{ secrets.OLLAMA_HOST }}
-        run: |
-          # Fail-open: no Ollama reachable → skip with a note, never fail.
-          if ! curl -sf "${OLLAMA_HOST:-http://192.168.1.50:11434}/api/tags" > /dev/null 2>&1; then
-            echo "Ollama unreachable — skipping first-pass review (advisory only)"
-            exit 0
-          fi
-          MODEL="${OLLAMA_MODEL:-qwen2.5-coder:7b}"
-          python3 scripts/local_firstpass_review.py \
-            --diff /tmp/pr_diff.txt --stat /tmp/pr_stat.txt \
-            --model "$MODEL" --host "${OLLAMA_HOST:-http://192.168.1.50:11434}"
-      - name: Post findings as PR comment
-        if: ${{ gitea.event.pull_request.number != 0 }}
-        env:
-          GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
-          PR_NUMBER: ${{ gitea.event.pull_request.number }}
-        run: |
-          if [ -f /tmp/review_findings.md ]; then
-            export PR_NUMBER
-            python3 - <<'PYEOF'
-          import json, os, urllib.request
-          body = open("/tmp/review_findings.md").read()
-          if not body.strip():
-              print("no findings — no comment")
-              exit(0)
-          base = os.environ["GITEA_SERVER_URL"] + "/api/v1/repos/" + os.environ["GITEA_REPOSITORY"]
-          req = urllib.request.Request(
-              base + "/issues/" + os.environ["PR_NUMBER"] + "/comments",
-              data=json.dumps({"body": "## First-pass review (local model, advisory)\n\n" + body}).encode(),
-              headers={"Authorization": "token " + os.environ["GITEA_TOKEN"], "Content-Type": "application/json"},
-              method="POST")
-          with urllib.request.urlopen(req, timeout=30) as r:
-              print("comment posted:", r.status)
-          PYEOF
-          fi

.gitea/workflows/maintenance.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   lint-and-format:
-    runs-on: rune-ci-desktop
+    runs-on: rune-infra-pi
     steps:
       - uses: actions/checkout@v4
       - name: Lint Python files
@@ -18,7 +18,7 @@ jobs:
           ruff format shared/ src/ || true
 
   canary-suite:
-    runs-on: rune-ci-desktop
+    runs-on: rune-infra-pi
     steps:
       - uses: actions/checkout@v4
       - name: Run all canaries
@@ -37,7 +37,7 @@ jobs:
           exit $FAILED
 
   best-practices:
-    runs-on: rune-ci-desktop
+    runs-on: rune-infra-pi
     steps:
       - uses: actions/checkout@v4
       - name: Check best practices
@@ -72,7 +72,7 @@ jobs:
           grep -rn "TODO\|FIXME\|HACK\|XXX" shared/ src/ --include="*.py" | head -10 || echo "  Clean"
 
   documentation-check:
-    runs-on: rune-ci-desktop
+    runs-on: rune-infra-pi
     steps:
       - uses: actions/checkout@v4
       - name: Check documentation coverage
@@ -113,7 +113,7 @@ jobs:
   # push-triggered safety net in auto-version.yml. Detects master/tag drift
   # and files a deduped issue — it never auto-releases without the PR flow.
   release-drift-reconciliation:
-    runs-on: rune-ci-desktop
+    runs-on: rune-infra-pi
     steps:
       - uses: actions/checkout@v4
         with:

.gitea/workflows/merge-robot.yml

@@ -1,38 +1,38 @@
 name: Merge robot
+
+# Deterministic merge-on-green for this repo's PRs. No LLM, no polling by the
+# agent: the forge event model does the watching, this job does the one action.
+# Runs hourly + on CI completion events so green PRs merge without any agent
+# turn being spent on "check CI, merge, clean up".
+
 on:
   schedule:
-  - cron: 23 * * * *
+    - cron: '23 * * * *'
   workflow_dispatch: {}
   workflow_run:
-    workflows:
-    - CI Pipeline
-    - Auto-version and Release
-    types:
-    - completed
+    workflows: ["CI Pipeline", "Auto-version and Release"]
+    types: [completed]
+
 permissions:
   pull_requests: write
   issues: write
   contents: read
+
 env:
   OWNER: conductor
   REPO: rune
+
 jobs:
   merge-green:
     runs-on: rune-ci-desktop
     steps:
-    - name: "Checkout repo \u2014 job never checked out, scripts/merge_robot.py missing,\
-        \ exit 2 since #211"
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      with:
-        fetch-depth: 0
-    - name: Merge PRs whose protected checks are green (fail-loud)
-      env:
-        GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}
-        SERVER: ${{ gitea.server_url }}
-      run: 'python3 scripts/merge_robot.py "$GITEA_TOKEN" "$SERVER/api/v1/repos/conductor/rune"
-
-        '
-concurrency:
-  group: merge-robot
-  cancel-in-progress: false
-  max-parallel: 1
+      - name: "Checkout repo — job never checked out, scripts/merge_robot.py missing, exit 2 since #211"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          fetch-depth: 0
+      - name: Merge PRs whose protected checks are green (fail-loud)
+        env:
+          GITEA_TOKEN: ${{ secrets.ROBOT_TOKEN }}  # conductor token; GITEA_TOKEN is reserved (auto token, read-only)
+          SERVER: ${{ gitea.server_url }}
+        run: |
+          python3 scripts/merge_robot.py "$GITEA_TOKEN" "$SERVER/api/v1/repos/conductor/rune"

.gitignore

@@ -14,12 +14,3 @@ state/
 # Runtime artifacts (cwd-local event journal + capability index)
 index/
 journal/
-src/rust/*/target/
-
-# batch 134: Go build artifacts — binaries are CI-built per gate (go build -o /tmp/...),
-# never stored. Each module dir keeps go.mod/main.go/truth*.json + *_test.go only.
-src/go/*/[^.]*
-!src/go/*/*.go
-!src/go/*/*.json
-!src/go/*/*.mod
-!src/go/*/*.sum

AGENTS.md

@@ -26,9 +26,6 @@ Only use `git commit --no-verify` in a genuine emergency: it bypasses the hooks
 - Every workflow is registered in the pipeline registry — new pipeline machinery ships with documentation (in ./.gitea/workflows/*.yml)
 - Every TUI surface is registered — no silent UI growth (in ./src/rune/*tui*.py)
 - New rune modules ship with tests or a canary — no ungoverned code surfaces (in ./src/rune/*.py)
-- Rust crate files stay under a line budget (in ./src/rust/*/src/*.rs)
-- Go modules stay under a line budget (in ./src/go/**/*.go)
-- No secrets in Rust or Go source files (in ./src/rust/*/src/*.rs, ./src/go/**/*.go)
 - PRDs are living documents — their generated state sections regenerate identically from governed sources
 - PRD staleness is a CI failure — docs rot is silent failure (in ./scripts/gen_prd_state.py)
 - The adversarial review procedure is binding — dispatch templates must reference it (in ./docs/adversarial-review.md)
@@ -36,7 +33,6 @@ Only use `git commit --no-verify` in a genuine emergency: it bypasses the hooks
 - Production failure fixtures are a governed surface — the registry and its README exist (in ./tests/fixtures/production)
 - Fixture payloads and the manifest travel together — tamper-evidence needs both
 - The fixture manifest and its generated regression tests travel together
-- The dichotomy is enforced at the commit boundary — every src/rune module lands in its measured side, dead oracles and wrong-language kernels fail with the correct implementation as the instruction (in ./src/rune)
 
 ### Behaviours
 
@@ -62,26 +58,3 @@ fix, full pipeline re-entry (suite + ratchet + ruff + canaries + henxels;
 gates for anything beyond a mechanical minor), regression tests frozen forever,
 discharge recorded finding → test → commit. Symptom patches are rejected at
 review. To escape: edit `henxels.yaml` or this file — visibly.
-
-## Issue organisation standard (binding, 2026-09-19)
-
-One open note per idea. Issues use the template spine (kind, subsystem,
-version intent) with a plain-English heading that restates the subject —
-no meta-labels. Before minting a standalone issue, check whether the work
-belongs inside an existing parent:
-
-- **Parked ideas under a blocked/future epic** are filed as checklist items
-  in the parent's "Absorbed children" section, NOT as standalone issues.
-  Absorption is reversible — re-mint standalone when the idea becomes live.
-- **Live, dependency-tracked, or starting work** gets a standalone issue.
-- **Closures state the reason as data**: `closed_because` in the spine
-  (completed / superseded-by-#N / absorbed-into-#N / wont-do / duplicate),
-  plus a standard closing comment (plain summary first).
-- The reconciliation checker (`scripts/gitea_reconciliation_check.py`) must
-  stay green after any issue state change; the artifact is updated in the
-  same change that moves issues.
-
-## Async continuation final flow proofs (R13/M9) — 2026-09-19
-
-PR-flow live proof marker: harmless documentation addition exercising the
-canonical single-continuation path on the PC-local forge. No code change.

README.md

@@ -1,6 +1,6 @@
 # Rune
 
-**Current release: v0.217.0**
+**Current release: v0.87.0**
 
 **Rune is a persistent personal agent designed to accumulate experience, develop reusable competence, and remain recognisably the same agent even when its underlying foundation model changes.**
 

config/mimo-hooks/builder-bridge.ts

@@ -1,124 +0,0 @@
-import { execFile } from "node:child_process"
-import { existsSync, appendFileSync } from "node:fs"
-
-// builder-bridge — Rune Core preflight for the MiMo builder (handoff
-// 2026-09-10 §3–§7, Option C bridge tranche). For each user turn, the hook
-// extracts the user's message from the outgoing LLM request, runs the Rune
-// Core builder-bridge preflight (deterministic: route classification +
-// memory selection + active-Scaffolding projection, ZERO model calls), and
-// appends a compact capsule to the final user message. Same Rune Core the
-// TUI/operator path uses — this file is a thin adapter with no cognition.
-//
-// CANONICAL SOURCE: config/mimo-hooks/builder-bridge.ts
-// Installed to ~/.mimocode/hooks/builder-bridge.ts by
-// `scripts/install_mimo_hook.py` (hash-verified, drift-detecting — the same
-// contract as event-wait-guard.ts). T22: this file was previously
-// UNVERSIONED and hardcoded an ephemeral interpreter path (/tmp/ci-venv),
-// which silently killed the whole edge; both defects are repaired here.
-//
-// Overhead contract (§7/§8): capsule ≤ ~300 tokens; a repeat/empty task
-// costs ~0ms (TTL cache); a fresh task ~150ms (bounded retrieval). The hook
-// degrades silently to no-injection on any failure — it must never block
-// the builder.
-//
-// Injection policy: only append when the capsule is non-empty. A plain
-// "hello" gets nothing (§5: if nothing relevant exists, inject nothing).
-
-const BRIDGE = "/mnt/workdrive/issue161-harness/src/rune/builder_bridge_cli.py"
-const MARKER_PREFIX = "/tmp/rune-bridge-"
-
-// Interpreter resolution (T22 repair): the previous hardcoded
-// "/tmp/ci-venv/bin/python" is an EPHEMERAL path that no longer exists, so
-// every bridge call failed and the hook silently degraded — the MiMo edge
-// received no Rune Core preflight at all (zero fire-log lines). Resolve
-// against durable candidates, first existing wins; env override wins over
-// all of them. If nothing exists the hook degrades as before.
-const PY_CANDIDATES = [
-  process.env.MIMO_BRIDGE_PY,
-  "/mnt/workdrive/issue161-harness/.test-venv/bin/python",
-  "/home/nick/.venvs/memory/bin/python3",
-  "/usr/bin/python3",
-].filter((p) => typeof p === "string" && p.length > 0)
-
-function resolvePy() {
-  for (const p of PY_CANDIDATES) {
-    try {
-      if (existsSync(p)) return p
-    } catch {}
-  }
-  return null
-}
-
-// Per-process dedupe: identical task text within the cache TTL does not need
-// a second bridge call — the CLI has its own TTL cache, but skipping the
-// process spawn entirely for the same message text within 10 minutes keeps
-// repeats at ~0ms.
-const lastText = new Map() // text -> timestamp
-const TTL = 600_000
-
-function extractUserText(messages) {
-  // messages: Array<{ info: Message, parts: Part[] }> — newest last.
-  for (let i = messages.length - 1; i >= 0; i--) {
-    const m = messages[i]
-    if (m?.info?.role !== "user") continue
-    const texts = []
-    for (const p of m.parts ?? []) {
-      if (p?.type === "text" && typeof p.text === "string") texts.push(p.text)
-    }
-    if (texts.length) return texts.join("\n").slice(0, 4000)
-  }
-  return ""
-}
-
-export default {
-  "experimental.chat.messages.transform": async (input, output) => {
-    try {
-      if (!Array.isArray(output.messages) || output.messages.length === 0) return
-      const userText = extractUserText(output.messages)
-      if (!userText || userText.length < 12) return // trivial/noise guard
-      // Harness-internal steps (checkpoint writer, compaction, system
-      // reminders) are not builder tasks — no capsule (measured: the fire
-      // log showed checkpoint-writer steps receiving capsules 2026-09-10).
-      if (/^(<system-reminder>|EXTRACTION REQUIRED)/.test(userText.trim())) return
-      const now = Date.now()
-      const prev = lastText.get(userText)
-      if (prev !== undefined && now - prev < TTL) return // dedupe repeats
-      lastText.set(userText, now)
-      if (lastText.size > 64) {
-        // evict oldest
-        let oldestKey = null, oldestVal = Infinity
-        for (const [k, v] of lastText) if (v < oldestVal) { oldestVal = v; oldestKey = k }
-        if (oldestKey) lastText.delete(oldestKey)
-      }
-
-      const py = resolvePy()
-      if (!py) return // no durable interpreter — degrade (never block)
-
-      const capsule = await new Promise((resolve) => {
-        execFile(py, [BRIDGE, userText], { timeout: 15_000 }, (err, stdout) => {
-          resolve(err ? "" : (stdout?.toString() ?? ""))
-        })
-      })
-      if (!capsule.trim()) return
-
-      // Durable fire-trace: one line per ACTUAL injection into an outgoing
-      // model request (handoff §1 proof requirement). Not a canary — this is
-      // standing observability for the bridge's consumer edge.
-      try {
-        appendFileSync("/tmp/rune-bridge-fire.log",
-          JSON.stringify({ ts: new Date().toISOString(), task: userText.slice(0, 80), capsule_tokens: Math.round(capsule.length / 4), py }) + "\n")
-      } catch {}
-
-      // Append the capsule to the LAST user message (the one being answered).
-      const last = output.messages[output.messages.length - 1]
-      if (last?.parts && Array.isArray(last.parts)) {
-        last.parts.push({
-          type: "text",
-          text: "\n\n<rune-preflight>\n" + capsule.trim() + "\n</rune-preflight>\n(Injected by Rune Core builder bridge — deterministic preflight, zero model calls. Relevant state above; ignore if not applicable to this task.)",
-        })
-      }
-    } catch {
-      // never block the builder on bridge failure
-    }
-  },
-}

config/mimo-tools/await-operation.ts

@@ -1,92 +1,54 @@
 import { tool } from "@mimo-ai/plugin"
 import { execSync } from "child_process"
 
-export default tool({
-    description: "Wait for an external operation (CI, deploy, release) to complete. Call this when you cannot make progress until an external process finishes. You do NOT need to know the sha, op_type, or duration — Rune's controller resolves those from the bound PendingOperation. Just call this when you want to wait.",
+// await_operation — T21.3 §21.3C: FIRST-CLASS async wait tool.
+// Uses the plugin tool() API with args (not parameters).
+
+export const AwaitOperation = tool({
+    description: [
+        "Wait for an asynchronous external operation (CI, deploy, release) to complete.",
+        "Registers on the event bridge, yields until the completion event arrives, then returns the verified result.",
+        "USE THIS instead of `sleep N; curl status` — it is the canonical event-driven wait.",
+    ].join(" "),
     args: {
-        operation_id: tool.schema.string().optional().describe("Optional: the operation to wait for. If omitted, the controller resolves the current pending operation automatically."),
-        task_id: tool.schema.string().optional().describe("Optional: the active task id (e.g. T4). When provided, resolution is scoped to operations bound to this task — stale global operations are never consulted."),
-        sha: tool.schema.string().optional().describe("OPTIONAL HINT — non-authoritative. The controller uses this only to help resolve which operation you mean."),
-        op_type: tool.schema.string().optional().describe("OPTIONAL HINT — non-authoritative. The controller derives the canonical operation type from repository/Gitea state."),
-        deadline_secs: tool.schema.number().optional().describe("OPTIONAL HINT — non-authoritative. The controller applies governed policy timing. Real user deadlines must be stated in conversation."),
+        sha: tool.schema.string().describe(
+            "The exact commit SHA the operation is running against"),
+        deadline_secs: tool.schema.number().optional().describe(
+            "Maximum wait in seconds (default 900)"),
     },
-    async execute(args) {
-        // INTENT NORMALIZATION — model output is intent; the controller
-        // owns execution semantics. All model args are hints recorded for
-        // observability; canonical truth comes from the bound operation.
-        const parts = []
-        if (args.operation_id) parts.push(`--operation-id ${args.operation_id}`)
-        if (args.task_id) parts.push(`--task-id ${args.task_id}`)
-        if (args.sha) parts.push(`--sha ${args.sha}`)
-        if (args.op_type) parts.push(`--model-op-type ${args.op_type}`)
-        if (args.deadline_secs) parts.push(`--model-deadline ${args.deadline_secs}`)
-        const normCmd = `python3 /mnt/workdrive/issue161-harness/scripts/await_intent_cli.py normalize ${parts.join(" ")}`
-        let norm: any
-        try {
-            const normOut = execSync(normCmd, {
-                cwd: "/mnt/workdrive/issue161-harness",
-                encoding: "utf-8" as const,
-                timeout: 120000,
-                env: { ...process.env, RUNE_WR_ROOT: "/mnt/workdrive/wr-bridge" },
-            })
-            norm = JSON.parse(normOut.trim().split("\n").find((l: string) => l.startsWith("{")) || "{}")
-        } catch (e: any) {
-            return JSON.stringify({ ok: false, stage: "normalization", error: (e.stderr || e.message || "?").slice(0, 300) })
-        }
-        if (norm.normalized === "AMBIGUOUS") {
-            return JSON.stringify({ ok: false, stage: "normalization", ...norm })
-        }
-        if (!norm.normalized) {
-            return JSON.stringify({ ok: false, stage: "normalization", ...norm })
-        }
-        // canonical continuation: stored/derived op_type + POLICY deadline
-        // (the sha for the wait comes from the normalization resolution,
-        // NOT from the model's args)
-        const waitSha = norm.sha_for_wait || args.sha || ""
-        if (!waitSha) {
-            return JSON.stringify({ ok: false, stage: "resolution", error: "no sha resolved for the pending operation", norm })
-        }
-        const cmd = `python3 /mnt/workdrive/issue161-harness/scripts/ci_event_wait.py --sha ${waitSha} --deadline ${norm.deadline_secs} --op-type ${norm.op_type}`
+    async execute(args, ctx) {
+        const repoRoot = "/mnt/workdrive/issue161-harness"
+        const deadline = args.deadline_secs || 900
+        const cmd = [
+            "python3", `${repoRoot}/scripts/ci_event_wait.py`,
+            "--sha", args.sha,
+            "--deadline", String(deadline),
+        ].join(" ")
         try {
             const result = execSync(cmd, {
-                cwd: "/mnt/workdrive/issue161-harness",
-                timeout: (norm.deadline_secs + 60) * 1000,
+                cwd: repoRoot,
+                timeout: (deadline + 60) * 1000,
                 encoding: "utf-8" as const,
-                env: { ...process.env, DEPLOY_SHA: waitSha, RUNE_WR_ROOT: "/mnt/workdrive/wr-bridge", RUNE_WR_CODE: "/home/nick/.local/share/mimo-wait-resume" },
-            })
-            const jl = result.trim().split("\n").find((l: string) => l.startsWith("{"))
-            const envelope = jl ? JSON.parse(jl) : { ok: false, error: "no output" }
-            return JSON.stringify({
-                ...envelope,
-                normalization: {
-                    model_deadline_ignored: norm.model_deadline_ignored,
-                    model_op_type_ignored: norm.model_op_type_ignored,
-                    model_sha_ignored: !!args.sha && args.sha !== waitSha,
-                    canonical_op_type: norm.op_type,
-                    canonical_authority: norm.authority,
-                    deadline_provenance: norm.deadline_provenance,
-                    matched_by: norm.matched_by || norm.evidence || "auto-resolved",
+                env: {
+                    ...process.env,
+                    DEPLOY_SHA: args.sha,
+                    RUNE_WR_ROOT: "/mnt/workdrive/wr-bridge",
+                    RUNE_WR_CODE: "/home/nick/.local/share/mimo-wait-resume",
                 },
             })
+            const lines = result.trim().split("\n")
+            const jsonLine = lines.find((l: string) => l.startsWith("{"))
+            if (jsonLine) return jsonLine
+            return "await_operation: no JSON output"
         } catch (e: any) {
-            const lines = (e.stdout || "").trim().split("\n")
-            const jl = lines.find((l: string) => l.startsWith("{"))
-            if (jl) {
-                const envelope = JSON.parse(jl)
-                return JSON.stringify({
-                    ...envelope,
-                    normalization: {
-                        model_deadline_ignored: norm.model_deadline_ignored,
-                        model_op_type_ignored: norm.model_op_type_ignored,
-                        model_sha_ignored: !!args.sha && args.sha !== waitSha,
-                        canonical_op_type: norm.op_type,
-                        canonical_authority: norm.authority,
-                        deadline_provenance: norm.deadline_provenance,
-                        matched_by: norm.matched_by || norm.evidence || "auto-resolved",
-                    },
-                })
-            }
-            return JSON.stringify({ ok: false, stage: "wait", error: (e.stderr || e.message || "?").slice(0, 300) })
+            const stdout = e.stdout || ""
+            const lines = stdout.trim().split("\n")
+            const jsonLine = lines.find((l: string) => l.startsWith("{"))
+            if (jsonLine) return jsonLine
+            return JSON.stringify({
+                ok: false,
+                error: `await_operation failed: ${(e.stderr || e.message || "?").slice(0, 200)}`,
+            })
         }
     },
 })

config/mimo-tools/bash.ts

@@ -1,167 +0,0 @@
-
-// bash — executes a shell command. PROCESS-OWNERSHIP CONTRACT (v2):
-//
-//   MODE A (tool-owned): the child is launched in its own process group;
-//   stdout/stderr are CAPTURED pipes (never the TUI tty). On timeout or
-//   failure the ENTIRE process group is signalled (SIGTERM, grace,
-//   SIGKILL) so grandchildren cannot survive the invocation, then the
-//   result is finalized. After finalization NO descendant retains a
-//   writer into MiMo's streams.
-//
-//   MODE B (explicitly detached): a command suffixed with " &" that the
-//   user/model intends to outlive the tool (nohup/setsid/disown-style)
-//   is executed via the detached helper: stdin=/dev/null, stdout/stderr
-//   -> durable log file, own session (setsid), no MiMo PTY inheritance.
-//   The tool returns the log path as the durable handle.
-//
-// Wait-intent compilation (sleep/check/poll aimed at a pending operation)
-// is preserved: interception happens at the SEMANTIC level via
-// await_intent route-bash, and a NO-OP for anything that is not a genuine
-// continuation of a live pending operation. Arbitrary shell syntax
-// (quotes, pipes, semicolons) passes through untouched — the router
-// response is only trusted when it carries normalized=true AND
-// ContinuePendingOperation with a concrete operation bound.
-import { tool } from "@mimo-ai/plugin"
-import { spawn, execFile } from "child_process"
-
-const REPO = "/mnt/workdrive/issue161-harness"
-const WR_ROOT = "/mnt/workdrive/wr-bridge"
-
-// ── MODE A: process-group-owned capture execution ──────────────────────
-interface OwnedResult { stdout: string; stderr: string; status: number; timedOut: boolean }
-
-function runOwned(command: string, timeoutMs: number): Promise<OwnedResult> {
-    return new Promise((resolve) => {
-        // /bin/sh -c "command" in its OWN process group (detached:true makes
-        // the child a session/group leader we can signal as a WHOLE).
-        const child = spawn("/bin/sh", ["-c", command], {
-            cwd: REPO,
-            stdio: ["ignore", "pipe", "pipe"],   // NEVER inherit the TUI tty
-            env: process.env,
-            detached: true,                      // own process group
-        })
-        let stdout = "", stderr = ""
-        let timedOut = false
-        let settled = false
-        const outChunks: Buffer[] = []
-        const errChunks: Buffer[] = []
-        child.stdout!.on("data", (d) => outChunks.push(d))
-        child.stderr!.on("data", (d) => errChunks.push(d))
-
-        const killGroup = (sig: NodeJS.Signals) => {
-            try { process.kill(-child.pid!, sig) } catch { /* already gone */ }
-        }
-        const finalize = (status: number) => {
-            if (settled) return
-            settled = true
-            clearTimeout(timer)
-            // detach listeners, then resolve — no late listeners remain
-            child.stdout!.removeAllListeners()
-            child.stderr!.removeAllListeners()
-            resolve({ stdout: Buffer.concat(outChunks).toString(), stderr: Buffer.concat(errChunks).toString(), status, timedOut })
-        }
-        const timer = setTimeout(() => {
-            timedOut = true
-            killGroup("SIGTERM")
-            // bounded grace for clean shutdown, then SIGKILL the group
-            setTimeout(() => killGroup("SIGKILL"), 2000)
-            // the exit/close event settles; a hard stop-guard settles anyway
-            setTimeout(() => finalize(124), 4000)
-        }, timeoutMs)
-
-        child.on("error", (e) => finalize(-1))
-        child.on("close", (code) => finalize(code ?? -1))
-    })
-}
-
-// ── MODE B: explicit detachment for "cmd &" invocations ────────────────
-function runDetached(command: string): Promise<string> {
-    return new Promise((resolve) => {
-        const logPath = `/tmp/mimo-detached-${Date.now()}-${Math.floor(Math.random() * 1e6)}.log`
-        const out = `exec >>"${logPath}" 2>&1; exec 0</dev/null; ${command}`
-        const child = spawn("/bin/sh", ["-c", `setsid /bin/sh -c '${out.replace(/'/g, `'\\''`)}'`], {
-            cwd: REPO,
-            stdio: "ignore",     // child rebinds its own fds — no PTY inheritance
-            env: process.env,
-            detached: true,
-            // unref: MiMo's event loop does not wait for it
-        })
-        child.unref()
-        resolve(JSON.stringify({
-            detached: true,
-            log: logPath,
-            note: "process detached (setsid, own fds); output streams to the log file only; fd 0/1/2 do NOT reference the MiMo tty",
-        }))
-    })
-}
-
-// ── wait-intent routing (semantic level, preserved from v1) ────────────
-async function tryCompileWaitIntent(command: string): Promise<string | null> {
-    let routeOut: string
-    try {
-        routeOut = await new Promise<string>((resolve, reject) => {
-            execFile("python3", [`${REPO}/scripts/await_intent_cli.py`, "route-bash", "--command", command], {
-                cwd: REPO, timeout: 60000, encoding: "utf-8",
-                env: { ...process.env, RUNE_WR_ROOT: WR_ROOT },
-                maxBuffer: 8 * 1024 * 1024,
-            }, (err, stdout) => { if (err && !stdout) reject(err); else resolve(stdout || "") })
-        })
-    } catch {
-        return null // router unavailable: normal execution (never block on routing)
-    }
-    const jl = routeOut.trim().split("\n").find((l) => l.startsWith("{"))
-    if (!jl) return null
-    let norm: any
-    try { norm = JSON.parse(jl) } catch { return null }
-    // STRICT gate: compile ONLY a normalized, concrete continuation.
-    if (!(norm.normalized === true &&
-          norm.action === "ContinuePendingOperation" &&
-          norm.operation_id && norm.sha_for_wait)) return null
-    const waitCmd = `python3 ${REPO}/scripts/ci_event_wait.py --sha ${norm.sha_for_wait} --deadline ${norm.deadline_secs} --op-type ${norm.op_type}`
-    const r = await runOwned(waitCmd, (norm.deadline_secs + 60) * 1000)
-    const jline = r.stdout.trim().split("\n").find((l) => l.startsWith("{"))
-    if (jline) {
-        return JSON.stringify({
-            ...JSON.parse(jline),
-            intent_compilation: {
-                raw_command_kind: norm.raw_command_kind || "sleep_poll",
-                literal_sleep_executed: false,
-                operation_id: norm.operation_id,
-                canonical_op_type: norm.op_type,
-                authority: norm.authority,
-            },
-        })
-    }
-    return JSON.stringify({ ok: false, stage: "compiled-wait", error: (r.stderr || "no output").slice(0, 300) })
-}
-
-export default tool({
-    description: "Run a shell command. If the command expresses external wait intent (sleep/check/poll aimed at CI, deploy, or release operations with pending operations), it is automatically compiled to Rune's event-driven continuation — you do not need to manage wait mechanics. Plain local commands execute normally. Commands ending in ' &' run detached with output logged to a file.",
-    args: {
-        command: tool.schema.string().describe("Shell command to run"),
-    },
-    async execute(args) {
-        // 1. wait-intent compilation (semantic, strict-gated)
-        try {
-            const compiled = await tryCompileWaitIntent(args.command)
-            if (compiled !== null) return compiled
-        } catch { /* fall through to normal execution */ }
-
-        // 2. MODE B: explicit detachment for backgrounded invocations
-        const cmd = args.command
-        if (/\b(nohup|setsid)\b/.test(cmd) || /&\s*$/.test(cmd)) {
-            return await runDetached(cmd)
-        }
-
-        // 3. MODE A: tool-owned, group-killed, captured execution
-        const r = await runOwned(cmd, 120000)
-        const text = r.stdout + (r.stderr ? `\n[stderr]\n${r.stderr}` : "")
-        if (r.timedOut) {
-            return `exit timed-out (process group terminated): ${text.slice(0, 500)}`
-        }
-        if (r.status !== 0) {
-            return `exit ${r.status}: ${text.slice(0, 500) || "?"}`
-        }
-        return text || "(no output)"
-    },
-})

config/umbrellas.json

@@ -1,87 +1,72 @@
 {
  "_comment": "GENERATED by rune.spine \u2014 compatibility view for legacy umbrella consumers. DO NOT EDIT: structural truth lives in store/spine/current.json; edits here are flagged by spine drift.",
  "_generated_by_spine": true,
- "generated_at": "2026-10-10T06:45:48Z",
+ "generated_at": "2026-09-16T18:23:38Z",
  "umbrellas": {
   "capability": {
    "description": "Tool selection and execution authority",
    "modules": [
-    "audit_ledger",
+    "adaptive_router",
+    "builder_bridge",
     "builder_bridge_cli",
-    "core_server",
-    "cs_loader",
-    "evidence_capsule",
+    "capability_broker",
+    "connection_pool",
+    "evidence_probe",
     "forge",
+    "forge_client",
     "intent_continuity",
+    "local_tool_runtime",
     "message_queue",
-    "native_units",
+    "openai_compat_transport",
     "provider_context",
-    "research_budget"
+    "recall_uplift",
+    "route_risk_flags",
+    "tool_executor",
+    "tool_protocol"
    ],
    "depends_on": [
     "memory"
    ],
    "mirrors": [],
    "canaries": [
-    "canary_native",
     "canary_native",
     "canary_p0_05",
-    "canary_p0_05",
-    "canary_p1_01",
-    "canary_p1_01",
-    "canary_rune_entry",
-    "canary_rune_serve"
+    "canary_p1_01"
    ]
   },
   "governance": {
    "description": "Quality control, drift detection, promotion, audit",
    "modules": [
+    "audit_ledger",
     "build_pipeline_policy",
-    "cc_loader",
+    "claim_audit",
     "contracts",
+    "curator",
+    "drift_core",
+    "drift_ledger",
+    "drift_observability",
     "failure_auto_filer",
-    "forge_client",
-    "grading",
-    "mutation_guards",
-    "paths",
-    "programme_gates",
-    "sc_loader",
-    "worthiness"
+    "programme_gates"
    ],
    "depends_on": [],
    "mirrors": [],
    "canaries": [
-    "canary_audit_ledger",
     "canary_full_system",
-    "canary_full_system",
-    "canary_schema_migration",
-    "canary_schema_migration",
-    "canary_spine_meta"
+    "canary_schema_migration"
    ]
   },
   "growth": {
    "description": "Learning and improvement",
    "modules": [
     "autonomy_loop",
-    "behavior",
-    "claim_audit",
     "cognitive_loop",
     "dream_cycle",
-    "drift_cache",
-    "drift_compression",
-    "drift_core",
-    "drift_ledger",
-    "drift_observability",
+    "elastic_cognition",
+    "goal",
     "growth_delta",
-    "growth_pipeline",
     "growth_simulator",
-    "meaningful_events",
-    "night_mode",
-    "outcome_ledger",
-    "outcome_utility",
     "self_improve",
-    "self_modify",
-    "skill_compiler"
+    "subconscious_pass"
    ],
    "depends_on": [
     "governance",
@@ -89,53 +74,42 @@
    ],
    "mirrors": [],
    "canaries": [
-    "canary_full_system",
     "canary_full_system"
    ]
   },
   "identity": {
    "description": "Who the agent is \u2014 persona, voice, anchors",
    "modules": [
+    "behavior",
     "identity_anchors",
     "persona_definition",
     "persona_gate",
     "prompt_sync",
-    "safety_override",
-    "self_model",
     "voice_hybrid",
     "voice_injector",
-    "voice_sync"
+    "voice_sync",
+    "voicebox"
    ],
    "depends_on": [
     "governance"
    ],
    "mirrors": [],
    "canaries": [
-    "canary_full_system",
     "canary_full_system"
    ]
   },
   "inference": {
    "description": "Model routing and outbound requests",
    "modules": [
-    "adaptive_router",
-    "evidence_probe",
-    "inference_paths",
     "inference_trace",
-    "local_tool_runtime",
     "model_connect",
     "model_profiles",
     "model_registry",
     "model_routing",
-    "openai_compat_transport",
     "provider_budget",
     "provider_registry",
-    "recall_router",
-    "recall_uplift",
     "response_adapter",
-    "route_risk_flags",
     "standardized_providers",
-    "tc_loader",
     "token_optimizer"
    ],
    "depends_on": [
@@ -143,11 +117,8 @@
    ],
    "mirrors": [],
    "canaries": [
-    "canary_p1_02",
     "canary_p1_02",
     "canary_p1_06",
-    "canary_p1_06",
-    "canary_resource_authority",
     "canary_resource_authority"
    ]
   },
@@ -155,76 +126,52 @@
    "description": "Storing, retrieving, and managing knowledge",
    "modules": [
     "abstraction",
-    "abstraction_ladder",
-    "auto_context",
     "cache",
-    "concept_topology",
-    "connection_pool",
-    "curator",
-    "drift-ledger",
-    "experience_encoding",
-    "ffi_query_memory_smoke",
+    "drift_cache",
+    "drift_compression",
     "graph_memory",
     "graph_shard_bridge",
-    "lexicon_evolution",
     "memory_consolidation",
     "memory_env",
     "memory_selector",
     "memory_store",
-    "memory_types",
-    "mems_loader",
-    "message_graph",
-    "mr_loader",
-    "ms_loader",
     "query_memory",
+    "recall_router",
     "retrieval_benchmark",
     "shard_manager",
-    "sleep_time",
-    "state_checkpoint",
-    "subconscious_pass",
     "tier_manager",
-    "warm_neuron_store",
-    "warm_router"
+    "warm_neuron_store"
    ],
    "depends_on": [
     "governance"
    ],
    "mirrors": [],
    "canaries": [
-    "canary_full_system",
     "canary_full_system",
     "canary_memory_synthesis",
-    "canary_memory_synthesis",
-    "canary_query_memory",
     "canary_query_memory"
    ]
   },
   "orchestration": {
    "description": "Task lifecycle, operator, TUI presentation",
    "modules": [
-    "attention_capsule",
     "auto_detect",
     "build_mode",
     "build_orchestrator",
-    "builder_bridge",
-    "capability_broker",
     "chat_bubble",
-    "context_broker",
     "cron_engine",
     "custodian",
     "dependency_tracker",
-    "elastic_cognition",
     "event_bus",
     "event_envelope",
-    "execution_trace",
     "gitea_auth",
     "gitea_pipeline",
     "gitea_provision",
-    "goal",
     "hook_engine",
     "message_widgets",
     "microkernel",
-    "pane_authority",
+    "night_mode",
+    "outcome_ledger",
     "parallel_processor",
     "pins",
     "progressive_escalation",
@@ -232,19 +179,19 @@
     "rune_operator",
     "rune_profiler",
     "rune_spinner",
+    "rune_tui",
+    "safety_override",
+    "sleep_time",
     "subsystem_health",
     "system_registry",
     "task_gate",
     "task_persist",
     "tiered_executor",
     "time_awareness",
-    "tool_executor",
-    "tool_protocol",
-    "tui_transport",
     "tui_validator",
     "umbrella_update",
     "verification_layer",
-    "witness",
+    "warm_router",
     "work_manager"
    ],
    "depends_on": [
@@ -257,25 +204,19 @@
    "mirrors": [],
    "canaries": [
     "canary_cognitive_strata",
-    "canary_cognitive_strata",
-    "canary_conversation_state",
     "canary_conversation_state",
     "canary_gitea_pipeline",
-    "canary_gitea_pipeline",
-    "canary_orchestration_foundation",
     "canary_orchestration_foundation",
     "canary_p1_07",
-    "canary_p1_07",
     "canary_surface_parity",
-    "canary_surface_parity",
-    "canary_tui_drift",
-    "canary_tui_drift",
-    "canary_tui_transport"
+    "canary_tui_drift"
    ]
   },
   "perception": {
    "description": "Input processing and context assembly",
    "modules": [
+    "attention_capsule",
+    "auto_context",
     "auto_tasks",
     "behaviour_ledger",
     "build_basis",
@@ -292,6 +233,7 @@
     "construction_pattern",
     "construction_patterns_builtin",
     "construction_projection",
+    "context_broker",
     "context_pressure",
     "drift_resume",
     "event_wait",
@@ -303,12 +245,9 @@
     "programme_continuation",
     "project_registry",
     "release_notes",
-    "rune_tui",
     "salience_gate",
     "scaffold",
     "spine",
-    "spine_language",
-    "spine_loader",
     "stage_guards",
     "structural_migration",
     "structural_model",
@@ -316,9 +255,9 @@
     "testing_mode",
     "toolchain",
     "tui_backlog",
-    "voicebox",
     "wait_guard",
-    "wait_guard_corpus"
+    "wait_guard_corpus",
+    "witness"
    ],
    "depends_on": [
     "memory"
@@ -326,10 +265,8 @@
    "mirrors": [],
    "canaries": [
     "canary_context_broker",
-    "canary_context_broker",
-    "canary_full_system",
     "canary_full_system"
    ]
   }
  }
-}
+}

docs/SCAFFOLDING.md

@@ -272,19 +272,4 @@ observations, fresh resume.
 
 Release-note generator: LIVE-PROVEN (real Gitea, 10 releases). Backfill:
 0.66.35→0.66.44 carrying historical-backfill provenance. Pre-0.66.35
-history: skipped (weak evidence — honest limitation).
-
-## Contract discovery → spine (2026-10-05, #2465 CI correction)
-
-The closed construction contract is the authority for discoveries. Spine
-rebuild reads its observed entities and candidate corrections; it does not
-claim a correction has been built. Qualified IDs such as
-`rust-crate:cognition_core` keep their declared kind. Bare file paths,
-test suites and other unqualified references become
-`construction-surface:<reference>`, never `module`. An observed
-surface may be PRESENT; a candidate stays DECLARED until independently
-observed. Existing bad records are migrated with their evidence and edge
-references intact. This matters: the first write-back mapped bare paths to
-modules, made 22 false module records and crashed CI on the next rebuild.
-The per-contract quick-reference markdown is generated from the scaffold
-store at close; it is a view, not another authority.
+history: skipped (weak evidence — honest limitation).

docs/dichotomy-rebase-honest-audit.md

@@ -1,244 +0,0 @@
-# DICHOTOMY REBASE — HONEST AUDIT (function-level)
-
-_Regenerate with `python3 scripts/dichotomy_audit.py --write`. A module is FULL only when 80%+ of its Python functions have name-preserving counterparts in the Go/Rust implementation — directories without the functions are facades and count as NOT TOUCHED._
-
-**Function-level completion: 28%** (686/2480 runtime functions matched)
-
-| Status | Modules | Lines | Meaning |
-|---|---|---|---|
-| FULL | 15 | 4264 | 80%+ of functions ported |
-| PARTIAL | 83 | 41656 | 20–80% — real logic exists, gaps named below |
-| NOT TOUCHED | 119 | 26856 | no name-preserving implementation |
-| Total runtime | 217 | 72776 | |
-
-## NOT TOUCHED — the port queue, in priority order (largest first)
-
-| Module | Lines | Fns | Side |
-|---|---|---|---|
-| rune_tui | 4170 | 159 | TUI-LAST |
-| curator | 1838 | 43 | GO |
-| abstraction | 656 | 17 | GO |
-| canary_audit_ledger | 541 | 2 | TEST-INFRA |
-| tui_validator | 514 | 13 | TUI-LAST |
-| construction_pattern | 496 | 12 | RUST |
-| model_routing | 432 | 13 | GO |
-| worthiness | 411 | 13 | unclassified |
-| token_optimizer | 410 | 22 | RUST |
-| behavior | 408 | 9 | RUST |
-| capability_ledger | 405 | 18 | RUST |
-| chat_bubble | 401 | 12 | TUI-LAST |
-| prompt_sync | 379 | 14 | RUST |
-| drift-ledger | 355 | 14 | unclassified |
-| programme_continuation | 349 | 11 | RUST |
-| canary_rune_serve | 329 | 13 | TEST-INFRA |
-| canary_p1_07 | 324 | 10 | TEST-INFRA |
-| message_queue | 316 | 13 | GO |
-| drift_observability | 315 | 8 | RUST |
-| build_basis | 314 | 12 | RUST |
-| canary_p0_07 | 310 | 10 | TEST-INFRA |
-| attention_capsule | 296 | 7 | RUST |
-| canary_p1_01 | 294 | 12 | TEST-INFRA |
-| drift_cache | 292 | 15 | RUST |
-| outcome_ledger | 286 | 7 | RUST |
-| time_awareness | 286 | 14 | RUST |
-| canary_p1_06 | 280 | 7 | TEST-INFRA |
-| auto_context | 273 | 8 | GO |
-| canary_p1_03 | 271 | 9 | TEST-INFRA |
-| canary_gitea_automation | 263 | 3 | TEST-INFRA |
-| canary_p1_02 | 253 | 10 | TEST-INFRA |
-| construction_patterns_builtin | 249 | 1 | RUST |
-| canary_full_system | 248 | 2 | TEST-INFRA |
-| toolchain | 236 | 5 | RUST |
-| task_gate | 235 | 8 | RUST |
-| canary_native | 231 | 3 | TEST-INFRA |
-| lexicon_evolution | 229 | 7 | unclassified |
-| openai_compat_transport | 227 | 9 | GO |
-| shard_manager | 223 | 9 | RUST |
-| spine_language | 218 | 5 | RUST |
-| evidence_probe | 213 | 9 | GO |
-| canary_p0_04 | 207 | 8 | TEST-INFRA |
-| cc_loader | 205 | 28 | RUST |
-| forge_client | 203 | 18 | GO |
-| canary_context_broker | 199 | 10 | TEST-INFRA |
-| canary_p0_05 | 199 | 13 | TEST-INFRA |
-| testing_mode | 196 | 12 | RUST |
-| grading | 193 | 3 | unclassified |
-| canary_spine_meta | 192 | 7 | TEST-INFRA |
-| message_graph | 187 | 12 | unclassified |
-| ffi_query_memory_smoke | 183 | 5 | RUST |
-| behaviour_ledger | 174 | 12 | RUST |
-| canary_tui_transport | 174 | 7 | TEST-INFRA |
-| sr_loader | 173 | 18 | unclassified |
-| canary_tui_drift | 170 | 2 | TEST-INFRA |
-| inference_trace | 164 | 6 | RUST |
-| ms_loader | 163 | 16 | RUST |
-| canary_gitea_pipeline | 159 | 2 | TEST-INFRA |
-| mse_loader | 152 | 12 | unclassified |
-| forge | 146 | 11 | GO |
-| rune_graphic | 145 | 5 | TUI-LAST |
-| spine_loader | 144 | 13 | RUST |
-| project_registry | 139 | 11 | RUST |
-| canary_rune_entry | 137 | 3 | TEST-INFRA |
-| verification_layer | 136 | 11 | RUST |
-| tui_backlog | 125 | 5 | TUI-LAST |
-| state_checkpoint | 123 | 8 | unclassified |
-| drift_resume | 118 | 3 | RUST |
-| canary_conversation_state | 115 | 2 | TEST-INFRA |
-| contracts_loader | 112 | 8 | unclassified |
-| canary_query_memory | 111 | 2 | TEST-INFRA |
-| tui_transport | 108 | 10 | TUI-LAST |
-| canary_unbounded | 105 | 2 | TEST-INFRA |
-| message_widgets | 104 | 6 | TUI-LAST |
-| self_modify | 102 | 7 | unclassified |
-| sc_loader | 96 | 6 | RUST |
-| inference_paths | 95 | 2 | unclassified |
-| mutation_guards | 94 | 2 | unclassified |
-| concept_topology | 90 | 7 | unclassified |
-| cs_loader | 90 | 5 | RUST |
-| ci_loader | 89 | 4 | unclassified |
-| tc_loader | 88 | 5 | RUST |
-| broker_loader | 86 | 5 | unclassified |
-| canary_schema_migration | 86 | 1 | TEST-INFRA |
-| ss_loader | 86 | 7 | unclassified |
-| mems_loader | 83 | 5 | RUST |
-| cm_loader | 82 | 4 | unclassified |
-| cp_loader | 77 | 4 | unclassified |
-| dl_loader | 77 | 5 | unclassified |
-| lc_loader | 75 | 5 | unclassified |
-| cd_loader | 72 | 4 | unclassified |
-| execution_trace | 71 | 4 | unclassified |
-| gp_loader | 71 | 6 | unclassified |
-| experience_encoding | 70 | 1 | unclassified |
-| abstraction_ladder | 68 | 3 | unclassified |
-| pane_authority | 67 | 2 | unclassified |
-| ip_loader | 65 | 4 | unclassified |
-| cb_loader | 64 | 3 | unclassified |
-| skill_compiler | 64 | 4 | unclassified |
-| sg_loader | 63 | 4 | unclassified |
-| sm_loader | 63 | 4 | unclassified |
-| meaningful_events | 61 | 3 | unclassified |
-| outcome_utility | 59 | 4 | unclassified |
-| memory_types | 54 | 2 | unclassified |
-| growth_pipeline | 53 | 2 | unclassified |
-| paths | 53 | 6 | unclassified |
-| wait_guard_corpus | 46 | 0 | RUST |
-| canary_cognitive_strata | 44 | 1 | TEST-INFRA |
-| research_budget | 44 | 3 | unclassified |
-| self_model | 44 | 3 | unclassified |
-| evidence_capsule | 43 | 3 | unclassified |
-| builder_bridge_cli | 42 | 1 | GO |
-| __init__ | 40 | 1 | RUST |
-| mr_loader | 40 | 15 | RUST |
-| canary_memory_synthesis | 33 | 1 | TEST-INFRA |
-| canary_resource_authority | 33 | 1 | TEST-INFRA |
-| canary_surface_parity | 33 | 1 | TEST-INFRA |
-| canary_orchestration_foundation | 32 | 1 | TEST-INFRA |
-| canary_gitea_delegation | 31 | 1 | TEST-INFRA |
-
-## PARTIAL — gaps to close (matched/total fns; first missing named)
-
-| Module | Lines | Coverage | Missing (first named) |
-|---|---|---|---|
-| memory_store | 2333 | 30/78 | _ctx_budget, now_iso, ensure_memory_type_column, _embed, _temp_json, _entities_to_json |
-| rune_operator | 2746 | 25/68 | _build_model_router, _sorted_tool_names, _filter_safety_noise, _wire_auto_filer, _reconcile_guarded, get_operator |
-| context_broker | 870 | 6/28 | _py_default_estimator, _cc_core, _py_default_budget, _py_default_memory_budget, _py_memory_disabled_value, reset_discovered_windows |
-| local_tool_runtime | 809 | 8/30 | _find_capability_executor, _extract_context_length, context_length, reset_context_length_cache, supports_tools, supports_thinking |
-| construction_interface | 1193 | 6/27 | _to_stage_check, _guard_specs_from_obligations, t_layout, _obligations_projection, _obligation_scope_files, main |
-| structural_store | 690 | 13/34 | _ss_core, _sorted, new_doc, _redact_secrets, save, canonical_digest |
-| persona_gate | 724 | 7/26 | _now, _cc_pg_core, _py_lex, _lex_input, _py_overlap, _embed_raw |
-| sleep_time | 984 | 8/26 | _ctx_budget, _ensure_dirs, db_connect, fetch_sessions, retain_to_store, reflect_local |
-| provider_registry | 679 | 11/28 | _ctx_budget, _format_tools_openai, _execute_tool_calls, _execute_tool_calls_anthropic, get_registry, connect_provider |
-| warm_router | 1518 | 19/36 | _ensure_use_history_table, record_outcome, record_neuron_fire, _py_base_level_from_uses, base_level_activation, _db |
-| construction_decision | 985 | 4/20 | normalize_need, _sc_core, _py_language_placement, resolve_surface, ss_entity, implemented_contracts |
-| memory_consolidation | 770 | 7/23 | _consolidation_now, _consolidation_memory_oracle, _consolidation_neuron_oracle, _load_knowledge, _save_knowledge, _load_lessons |
-| work_manager | 594 | 9/25 | group_by_file, load_config, save_config, load_batches, save_batches, create_work |
-| growth_delta | 449 | 5/20 | _ctx_budget, _store_db, _llm, _parse_json, _load_deltas, _save_deltas |
-| provider_budget | 357 | 5/20 | get_tracker, track_usage, check_provider, get_best_provider, failover, get_status |
-| safety_override | 574 | 7/22 | _keyword_stopwords, _cc_probe, cc_loader_pin, self_test, _py_matches, escalation_rate |
-| spine | 965 | 20/35 | _py_sorted, _module_imports, _py_declared_surfaces, _py_project_meta_surfaces, _gather_meta_inputs, _rust_core |
-| tool_executor | 1836 | 32/47 | _execute_tool_now, serialize_prepared_tool, deserialize_prepared_tool, confirm_write, _resolve_execution_cwd, _run_command |
-| cron_engine | 440 | 13/27 | get_cron_engine, run_task, start_engine, stop_engine, to_dict, fire_on_task_complete |
-| night_mode | 421 | 5/19 | _ctx_budget, get_night_mode, start_night_mode, stop_night_mode, get_status, get_report |
-| build_mode | 521 | 20/33 | _load_state, _save_state, assess_complexity, start_research, start_feasible, start_consult |
-| failure_auto_filer | 527 | 11/24 | _error_text, unconsumed, mark_consumed, unconsumed, mark_consumed, submit |
-| cache | 492 | 6/17 | _record_hit, _record_miss, flush_stats, get_cache, put_cache, invalidate_scope |
-| elastic_cognition | 774 | 3/14 | _ctx_budget, _build_constitution, _get_constitution, _load_cloud_config, execute_at_tier, _execute_deterministic |
-| identity_anchors | 542 | 5/16 | show_anchors, show_rules, show_pronouns, _announcement_patterns, _pronoun_patterns, _hedge_patterns |
-| parallel_processor | 194 | 3/14 | _shutdown_processor, get_processor, run_parallel_with_args, get_status, test_parallel, run_parallel_with_args |
-| structural_model | 388 | 9/20 | workspace_record, workspace_advance, _init_project, save, reload, add |
-| capability_broker | 798 | 10/20 | _native_tool_schemas, load_registry, _cards_are_stale, load_cards, generate_card, build_cards |
-| capability_fit | 414 | 3/13 | record_semantic_fit, _provides_contracts, _consumers, discover_candidates, _cs_core, decide |
-| claim_audit | 484 | 4/14 | _get_warm_neuron_store, reframe, _graph_has, _warm_has, verify, journal |
-| drift_core | 471 | 4/14 | _ms_core, _now_iso, _py_check_promotion_eligibility, promote_entry, compute_fama, compute_drift_velocity |
-| model_profiles | 438 | 5/15 | get_profile_path, load_profile, save_profile, build_profile_from_ollama, scan_all_models, get_or_create_profile |
-| tier_manager | 262 | 5/15 | _cc_probe, cc_loader_pin, _py_core_now, _py_get_tier, _py_promote, _py_demote |
-| witness | 446 | 8/18 | _ctx_budget, _now, _cc_probe, cc_loader_pin, _py_extract_topic, _py_detect_signals |
-| drift_compression | 307 | 3/12 | _py_get_compression_ratio, _py_compress_text, _py_compress_entry, _py_should_warn, _py_warn_before_compress, get_compression_ratio |
-| drift_ledger | 471 | 7/16 | ledger_path, read_block, load_ledger, save_ledger, surface_alert, snapshot |
-| scaffold | 868 | 22/31 | init, set_prd, add_maintenance_item, bind_repo, observe_repo, repo_state_from_git |
-| builder_bridge | 326 | 3/11 | _construction_store, _active_construction_lines, _default_selector, _cached_memory, _get_selector, _retrieve_memory |
-| contracts | 743 | 4/11 | _ct_core, _resolve_and_project, _run_contract_python, capture_signatures, save_signatures, load_signatures |
-| graph_memory | 474 | 2/9 | now_iso, connect, resolve_entity, add_edge, query, stats |
-| intent_continuity | 168 | 2/9 | to_dict, from_dict, _load, save, create_detour, resolve_detour |
-| pins | 282 | 5/12 | _store_path, _save, _detail_blob, unpin, _py_pin_recall, list_pins |
-| voice_hybrid | 427 | 3/10 | _connect, _load_growth, _save_growth, source_profiles, always, grow |
-| voice_sync | 299 | 3/10 | _now, get_delivery_register_from_db, get_delivery_register, update_rune_md, check_sync, handle_hook |
-| audit_ledger | 212 | 2/8 | _compute_hash, get_entries, log_promotion, log_gate_result, log_drift_alert, main |
-| context_pressure | 262 | 3/9 | log_measurement, read_log, log_stats, _now, handle_hook, main |
-| core_server | 234 | 6/12 | make_server, log_message, _send_json, _send_ndjson, do_GET, do_POST |
-| microkernel | 434 | 6/12 | now_iso, discover, _extract_manifest, _load_registry, _save_registry, _run_hook |
-| model_registry | 253 | 2/8 | test_registry, to_dict, get_profile, get_enabled_profiles, get_profiles_by_tier, list_profiles |
-| persona_definition | 210 | 2/8 | _by_topic, compile_full, emit_constitution, emit_identity, emit_persona, handle_hook |
-| progressive_escalation | 279 | 2/8 | execute_with_escalation, test_escalation, handle_hook, to_dict, execute, verify |
-| voicebox | 164 | 5/11 | _run, start_recording, stop_recording, _transcribe_and_type, on_press, on_release |
-| connection_pool | 148 | 3/8 | get_pool, get_connection, get_status, get_connection, get_status |
-| hook_engine | 860 | 3/8 | discover_functions, tag_function, validate_placements, generate_report, handle_hook |
-| iteration | 190 | 3/8 | _now, context_packet, predictive_impact, descriptive_impact, add |
-| task_persist | 269 | 5/10 | _save, export, restore, main, handle_hook |
-| tiered_executor | 291 | 3/8 | _ctx_budget, test_executor, to_dict, to_dict, _execute_model |
-| adaptive_router | 625 | 15/19 | _floor_applies_from_flags, _floor_reason, _record_transition_with, _detect_external_refs |
-| construction_commands | 268 | 1/5 | _refuse, _validate, _accept, dispatch |
-| layout_contract | 336 | 2/6 | define_region, bind_component, amend_layout_contract, record_layout_observation |
-| model_connect | 471 | 7/11 | _ctx_budget, _now, _get_cloud_models, handle_hook |
-| salience_gate | 276 | 1/5 | _sg_core, test_salience, handle_hook, to_dict |
-| self_improve | 246 | 1/5 | _now, suggest_improvements, handle_hook, main |
-| stage_guards | 303 | 7/11 | _py_liveness_canary, _py_reconcile, to_dict, chk |
-| subconscious_pass | 187 | 1/5 | main, _extract_topic, save_reflection, get_recent_findings |
-| construction_activation | 237 | 1/4 | _scaffold_for, _auto_structural_awareness, dispatch_from_decision |
-| construction_mode | 412 | 2/5 | _contains_any, to_dict, from_dict |
-| construction_projection | 254 | 1/4 | _contract_entity, validate, write_mini_doc |
-| dependency_tracker | 202 | 2/5 | check_propagation, get_full_map, main |
-| event_envelope | 303 | 5/8 | test_envelope, to_canonical_dict, to_dict |
-| graph_projection | 134 | 3/6 | _model_to_dicts, write_all, _now |
-| memory_selector | 590 | 11/14 | _mse_core, add_source, _source_store |
-| subsystem_health | 163 | 3/6 | set_auto_filer, record_failure, configure_logging |
-| warm_neuron_store | 122 | 3/6 | _db, neuron_slugs, handle_hook |
-| cognitive_budgeter | 221 | 1/3 | test_budgeter, to_dict |
-| event_bus | 244 | 5/7 | _store_path, handle_hook |
-| response_adapter | 222 | 5/7 | test_adapter, to_dict |
-| rune_profiler | 165 | 1/3 | profile_model_call, main |
-| standardized_providers | 281 | 3/5 | list_providers, connect_all_local |
-| structural_migration | 77 | 2/4 | apply_migration, consent_brief |
-| voice_injector | 138 | 3/5 | test_injection, to_dict |
-| construction_depth | 155 | 1/2 | to_dict |
-| recall_router | 165 | 2/3 | handle_hook |
-
-## FULL — ported, parity-gated
-
-| Module | Lines | Fns | Side |
-|---|---|---|---|
-| system_registry | 603 | 14/16 | RUST |
-| construction_intent | 580 | 13/16 | RUST |
-| event_wait | 518 | 14/14 | GO |
-| tool_protocol | 461 | 22/27 | GO |
-| auto_tasks | 460 | 14/14 | GO |
-| goal | 453 | 20/20 | GO |
-| release_notes | 446 | 16/16 | GO |
-| recall_uplift | 141 | 1/1 | RUST |
-| rune_spinner | 130 | 4/5 | RUST |
-| wait_guard | 116 | 1/1 | RUST |
-| failure_recovery | 108 | 1/1 | RUST |
-| programme_gates | 85 | 4/5 | RUST |
-| impact_preview | 78 | 2/2 | RUST |
-| provider_context | 48 | 1/1 | GO |
-| route_risk_flags | 37 | 1/1 | RUST |

docs/gitea_issue_reconciliation.json

@@ -235,8 +235,8 @@
   {
    "number": 183,
    "title": "Future: typed temporal semantics for facts, relationships, beliefs, and preferences",
-   "tracker_state": "closed",
-   "reconciliation_state": "HISTORICAL_EVIDENCE",
+   "tracker_state": "open",
+   "reconciliation_state": "DEFERRED_FUTURE",
    "labels": [
     "P3 \u2014 low",
     "governance",
@@ -248,14 +248,14 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-19",
-   "next_action": "none \u2014 idea absorbed into parent epic #181 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
+   "last_revalidated": "2026-09-11",
+   "next_action": ""
   },
   {
    "number": 182,
    "title": "Future: GitHub code-search prior-art audit for graph and vector memory",
-   "tracker_state": "closed",
-   "reconciliation_state": "HISTORICAL_EVIDENCE",
+   "tracker_state": "open",
+   "reconciliation_state": "DEFERRED_FUTURE",
    "labels": [
     "P3 \u2014 low",
     "governance",
@@ -264,8 +264,8 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-19",
-   "next_action": "none \u2014 idea absorbed into parent epic #181 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
+   "last_revalidated": "2026-09-11",
+   "next_action": ""
   },
   {
    "number": 181,
@@ -285,13 +285,13 @@
    ],
    "live_defect": false,
    "last_revalidated": "2026-09-11",
-   "next_action": "epic holds absorbed children #182 #183 + research watchlist #164 #165 #166; closes when prerequisites land or ideas dropped"
+   "next_action": ""
   },
   {
    "number": 179,
    "title": "Future: succession/privacy semantics and lineage evaluation",
-   "tracker_state": "closed",
-   "reconciliation_state": "HISTORICAL_EVIDENCE",
+   "tracker_state": "open",
+   "reconciliation_state": "DEFERRED_FUTURE",
    "labels": [
     "P3 \u2014 low",
     "governance",
@@ -303,14 +303,14 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-19",
-   "next_action": "none \u2014 idea absorbed into parent epic #175 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
+   "last_revalidated": "2026-09-11",
+   "next_action": ""
   },
   {
    "number": 178,
    "title": "Future: evidence-grounded ancestral perspective with explicit uncertainty",
-   "tracker_state": "closed",
-   "reconciliation_state": "HISTORICAL_EVIDENCE",
+   "tracker_state": "open",
+   "reconciliation_state": "DEFERRED_FUTURE",
    "labels": [
     "P3 \u2014 low",
     "governance",
@@ -320,14 +320,14 @@
     "perception"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-19",
-   "next_action": "none \u2014 idea absorbed into parent epic #175 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
+   "last_revalidated": "2026-09-11",
+   "next_action": ""
   },
   {
    "number": 177,
    "title": "Future: temporal autobiographical model with provenance and reinterpretation lineage",
-   "tracker_state": "closed",
-   "reconciliation_state": "HISTORICAL_EVIDENCE",
+   "tracker_state": "open",
+   "reconciliation_state": "DEFERRED_FUTURE",
    "labels": [
     "P3 \u2014 low",
     "governance",
@@ -338,14 +338,14 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-19",
-   "next_action": "none \u2014 idea absorbed into parent epic #175 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
+   "last_revalidated": "2026-09-11",
+   "next_action": ""
   },
   {
    "number": 176,
    "title": "Future: lineage-aware situated curiosity for meaningful autobiographical gaps",
-   "tracker_state": "closed",
-   "reconciliation_state": "HISTORICAL_EVIDENCE",
+   "tracker_state": "open",
+   "reconciliation_state": "DEFERRED_FUTURE",
    "labels": [
     "P3 \u2014 low",
     "feature",
@@ -356,8 +356,8 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-19",
-   "next_action": "none \u2014 idea absorbed into parent epic #175 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
+   "last_revalidated": "2026-09-11",
+   "next_action": ""
   },
   {
    "number": 175,
@@ -377,13 +377,13 @@
    ],
    "live_defect": false,
    "last_revalidated": "2026-09-11",
-   "next_action": "epic holds absorbed children #176-#179 as checklist items; closes when prerequisites land or ideas dropped"
+   "next_action": ""
   },
   {
    "number": 166,
    "title": "RESEARCH WATCHLIST: Memory-R1 (RL memory ops), Titans (test-time memory), Vespa/Weaviate/Milvus (retrieval competitors)",
-   "tracker_state": "closed",
-   "reconciliation_state": "HISTORICAL_EVIDENCE",
+   "tracker_state": "open",
+   "reconciliation_state": "DEFERRED_FUTURE",
    "labels": [
     "P3 \u2014 low",
     "growth",
@@ -392,14 +392,14 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-19",
-   "next_action": "none \u2014 idea absorbed into parent epic #181 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
+   "last_revalidated": "2026-09-11",
+   "next_action": ""
   },
   {
    "number": 165,
    "title": "RESEARCH: SimpleMem semantic compression + A-MEM dynamic linking + Letta sleep-time compute",
-   "tracker_state": "closed",
-   "reconciliation_state": "HISTORICAL_EVIDENCE",
+   "tracker_state": "open",
+   "reconciliation_state": "DEFERRED_FUTURE",
    "labels": [
     "P3 \u2014 low",
     "infrastructure",
@@ -408,14 +408,14 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-19",
-   "next_action": "none \u2014 idea absorbed into parent epic #181 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
+   "last_revalidated": "2026-09-11",
+   "next_action": ""
   },
   {
    "number": 164,
    "title": "RESEARCH: HippoRAG 2 \u2014 PPR-style associative propagation as warm-neuron activation candidate",
-   "tracker_state": "closed",
-   "reconciliation_state": "HISTORICAL_EVIDENCE",
+   "tracker_state": "open",
+   "reconciliation_state": "DEFERRED_FUTURE",
    "labels": [
     "P3 \u2014 low",
     "growth",
@@ -424,8 +424,8 @@
     "ready"
    ],
    "live_defect": false,
-   "last_revalidated": "2026-09-19",
-   "next_action": "none \u2014 idea absorbed into parent epic #181 as tracked checklist item; full detail preserved in this closed issue; re-mint when live"
+   "last_revalidated": "2026-09-11",
+   "next_action": ""
   },
   {
    "number": 163,
@@ -1150,5 +1150,5 @@
   }
  ],
  "last_reconciled": "2026-09-19",
- "reconciled_by": "fresh-session tranche 2026-09-19: template retrofit (spine+plain-English on all open issues), closures #158/#162 (SUPERSEDED) and #324 (FIXED_VERIFIED), research labels applied to #163/#164/#165/#166/#182/#316, stale bug labels removed from #163-#166; 2026-09-19 absorption pass: parked children absorbed into parents (#175<-#176..#179; #181<-#182,#183,#164..#166) per one-open-note-per-idea standard"
+ "reconciled_by": "fresh-session tranche 2026-09-19: template retrofit (spine+plain-English on all open issues), closures #158/#162 (SUPERSEDED) and #324 (FIXED_VERIFIED), research labels applied to #163/#164/#165/#166/#182/#316, stale bug labels removed from #163-#166"
 }

docs/language-dichotomy-ledger.md

@@ -1,134 +0,0 @@
-# THE LANGUAGE DICHOTOMY LEDGER — measured, not assumed
-
-_Created 2026-10-06 from real benchmarks. This is the governing standard for every port in the full dichotomy rebase. Every port must pass the "which language is better for THIS operation?" test before being assigned._
-
----
-
-## The Measured Benchmarks
-
-| Operation | Python | Python ctypes → Rust | Go cgo → Rust | Pure Go inline |
-|---|---|---|---|---|
-| Simple tier check | 0.05 µs | 1.4 µs | 1.4 µs | — |
-| Consolidation (669B payload) | 0.2 µs | 2.9 µs | 3.4 µs | 0.3 µs |
-| Concurrent HTTP (10 requests) | 10.8ms (4.0x) | — | 8.4ms (5.1x) | — |
-| CPU-bound pattern matching (1000 msgs) | 9.6ms (0.8x — GIL) | — | ~2.5ms (est. 3.5-4x) | — |
-| Compression + zlib wrapper | 0.2 µs | 13.7 µs (worse!) | — | — |
-
-## The Laws
-
-### Law 1: FFI overhead is negligible for the real workload
-The cgo/ctypes boundary costs 1.4-3.4 µs per call. Ollama inference costs 200-5000 ms. FFI overhead is 0.0003-0.0017% of total request time. The language of the caller doesn't matter for the boundary.
-
-### Law 2: Go wins for CPU-bound reactive work
-Goroutines deliver true parallelism (5.1x concurrent HTTP, ~3.5-4x CPU-bound). Python's GIL serialises CPU-bound work (0.8x speedup with 4 threads). Go wins for: operator, witness, event bus, work manager, tool executor.
-
-### Law 3: Simple operations stay in the caller's language
-Pure Python compression: 0.3 µs. Same op via Rust FFI: 10.4 µs. The FFI overhead exceeds the compute benefit for simple operations. If a Go module needs a string truncation, do it IN GO.
-
-### Law 4: Rust wins for complex deterministic operations
-Compile-time type safety, zero-cost abstractions, memory safety, near-native speed for complex compute. Rust wins for: scoring, dedup, pattern matching across many signals, record assembly with many fields, structural store operations.
-
-### Law 5: Compression across the FFI boundary makes things SLOWER
-Measured: uncompressed FFI call = 6.1 µs. With zlib wrapper = 13.7 µs (+125%). The cgo transition overhead (~1-2µs) dominates; payload size doesn't matter for local calls under 10KB. Compression helps only for network transfers (>100KB payloads).
-
-### Law 6: Reduced payload (shorter keys) gives a marginal improvement
-Measured: 6.1 → 4.6 µs (-25%) by shortening JSON keys from "wash_count" to "w". This is a valid optimisation for hot-path FFI calls but not worth the complexity for most operations.
-
-### Law 7: Pure inline (no FFI) is fastest when the operation is simple
-Measured: pure Go inline = 0.3 µs vs 6.1 µs via FFI. If the operation is simple enough to implement in the caller's language, do it inline. Only cross the FFI boundary for operations complex enough to justify it.
-
----
-
-## The Practical Decision Tree
-
-```
-Is the operation I/O-bound (HTTP, subprocess, file I/O)?
-  → YES → GO (goroutines, net/http, os/exec)
-  → NO ↓
-
-Is the operation CPU-bound and in the request path (responding to user)?
-  → YES → GO (goroutines give true parallelism where the GIL fails)
-  → NO ↓
-
-Is the operation complex deterministic compute (multiple functions, thresholds, scoring)?
-  → YES → RUST (type safety, zero-cost abstractions, memory safety)
-         BUT measure: does the compute exceed the FFI overhead?
-  → NO ↓
-
-Is the operation simple (string truncation, basic comparison, simple lookup)?
-  → YES → Do it INLINE in the caller's language (no FFI)
-```
-
----
-
-## The Wave Assignment (corrected)
-
-| Wave | Language | Why |
-|---|---|---|
-| W4: event-bus, hook-engine, message-queue, microkernel, subsystem-health, parallel-processor, work-manager, failure-filer, cron-engine, night-mode, cache, connection-pool, recall-router | **Go** | I/O-bound, CPU-bound reactive, event-driven |
-| W4b: tool-executor, tool-protocol, local-tool-runtime | **Go** | I/O-bound, request-path |
-| W5a: model-connect (all 10 provider modules) | **Go** | I/O-bound (HTTP), connection pooling |
-| W5b: operator, adaptive_router, build_mode, warm_router, etc. | **Go** | CPU-bound reactive (routing, dispatch) + I/O-bound |
-| W5c: memory_store, curator, sleep_time | **Go** | I/O-bound (SQLite + subprocess) |
-| W6: spine, construction_*, contracts, capability_*, drift_*, graph_memory, memory_selector, identity_anchors, pins, salience_gate, self_improve, token_optimizer | **Rust** | Complex deterministic compute (scoring, dedup, classification, structural operations) |
-| W6 simple modules: response_adapter, route_risk_flags, rune_profiler, rune_spinner, wait_guard, task_persist, time_awareness | **Stay in caller's language** | Simple operations where FFI overhead > compute benefit |
-| W7: TUI | **Go (Bubble Tea)** | The reactive front end that interfaces with the user |
-
----
-
-## The Compression Idea (EXPERIMENTAL — NOT WORTH IT)
-
-**Measured result: compression across the FFI boundary makes things 125% SLOWER.**
-
-The cgo transition overhead (~1-2µs) is the dominant cost, not the payload size. Compressing the payload adds CPU work (compress + decompress) that exceeds the benefit of a smaller payload crossing the boundary. The compressed payload is 20% of the original size, but the total time doubles.
-
-Compression WOULD help only if:
-- The payload were >100KB (network transfer between machines)
-- The boundary were a network connection, not a local function call
-
-**Mark as experimental and park. Do not implement.**
-
----
-
-## The Hybrid Language Idea (FUTURE — NOT NOW)
-
-A hybrid language combining Go's concurrency with Rust's type safety and memory safety would eliminate the FFI boundary entirely. This would be the ideal language for the entire runtime.
-
-But this is a much larger project — effectively designing and implementing a new programming language. It should be explored after the rebase is complete and the system is stable in Go+Rust. The cgo boundary works today with negligible overhead.
-
----
-
-## Provenance
-
-- Benchmarks run 2026-10-06 on nick-desktop (CachyOS, 4 cores, cgo 1.21, modernc.org/sqlite)
-- Rust kernel: libcognition_core.so from cognition_core crate
-- Go binaries: statically linked, go 1.21
-- Python: /home/nick/.venvs/memory/bin/python3
-- These measurements are for THIS hardware and THIS codebase. Re-measure if the hardware changes.
-
-
----
-
-## The Hybrid Language: SURVIVOR
-
-Named by Nick (2026-10-06): Rust (survives, memory-safe, deterministic) + Go (running, reactive, concurrent) = **Survivor** — the hybrid language pattern where Go reactive code links Rust deterministic compute as a static library at compile time.
-
-### The Survivor Build Pattern
-- Rust crates compile as staticlib (.a) + cdylib (.so)
-- Go binaries link the .a files at compile time via cgo LDFLAGS
-- The caller sees ONE binary with ONE function call — no FFI boundary from the outside
-- No CC_RUST_LIB / SC_RUST_LIB env vars needed
-- Measured: 0.6µs/call vs 1.4-3.4µs for the .so approach
-
-### Survivor Go Packages
-All under src/go/cognition/:
-- cognition (root): tier, consolidation, witness, safety, drift, pins, growth
-- retrieval: memory_retrieval kernel (mr_call)
-- storage: memory_storage kernel (mems_read_query)
-- scaffold: scaffold_core kernel (sc_check_transition, sc_close_quality, sc_language_placement)
-- provenance: evidence_provenance kernel (ep_* functions)
-- spine: rune_spine kernel (sp_drift, sp_export, sp_project, sp_query)
-- scoring: memory_scoring kernel (ms_* functions)
-- capability: capability_scoring kernel (cs_evaluate_fit, cs_score_card)
-- token: token_counting kernel (tc_compress_context, tc_estimate_tokens)
-- query: query_memory kernel (qm_* functions)

docs/phaseG_slice2_census.md

@@ -1,52 +0,0 @@
-# Phase G Slice 2 (T7.3) — Evidence-Provenance Surface Census (#2449)
-
-Generated 2026-10-08 (contract BUILDER-2026-10-08T14:02:24Z-588ca6). The
-six-module surface, its Rust candidate, and the per-module switch state —
-measured, not asserted. This is the frozen-contract input.
-
-## The Rust candidate
-
-`src/rust/evidence_provenance/` — 24 `pub extern` symbols, CI-built on all
-three rust steps (evidence_provenance/Cargo.toml in every list). The
-cdylib carries the ep_* core (compute_hash, append_entry, verify_chain)
-plus the per-module helper seams (ca_*, and the loader families).
-
-## Per-module switch state
-
-| module | loader integration | parity evidence | state |
-|---|---|---|---|
-| claim_audit.py | ep_loader (ca_evidence_terms, ca_verify_gate, ca_report_aggregate) — 17/17 proven vs this module's Python vintage (docstring) | ep parity 17/17 | SWITCHED |
-| behavior.py | 4 loader/ctypes refs | ep_loader import + parity battery | SWITCHED |
-| behaviour_ledger.py | 11 loader/ctypes refs | dual-import (validation ledger) | SWITCHED |
-| evidence_probe.py | 4 loader/ctypes refs | ep_loader delegation | SWITCHED |
-| verification_layer.py | 3 loader/ctypes refs | ep_loader delegation | SWITCHED |
-| audit_ledger.py | 0 — NO loader integration | drift-key vintage split (see below) | REMAINING GAP |
-
-Test batteries observed green this session: claim_audit/audit_ledger/
-behavior/evidence_probe/verification_layer families 14/14;
-test_evidence_provenance_shims.py 6/6.
-
-## The remaining work (batches after this census)
-
-1. **audit_ledger switch** — the only module with zero loader integration.
-   Pin the DRIFT KEY FIRST: the live promotion_ledger.jsonl (21 entries)
-   verifies valid under the DEPLOYED vintage key `rune-drift-integrity-2024`;
-   the src/rune default (`rune-governed-adaptation-2024`) fails it. The
-   Rust seam must carry the deployed-vintage key as the verification key
-   for existing entries (the frozen contract pins this).
-2. **Vintage reconciliation** — src/rune/ is the hardened NEWER vintage
-   (memory_env-pathed DB, defensive code); deployed + shared/ audit_ledger
-   are OLDER. The switch must reconcile, not clobber (RECONCILE-DON'T-CLOBBER).
-3. **Supersession ledger** — per-module close records after shadow evidence.
-4. **Shadow** — run the ep parity battery + per-module canaries as the
-   shadow evidence per the slice-1 pattern (see scripts/qm_shadow.py for
-   the shape).
-
-## Grounding findings carried from the issue (verified this session)
-
-- Only 3 of 6 modules are deployed (~/.config/opencode/scripts/):
-  audit_ledger, behavior, claim_audit. Consumers confirmed: rune_tui.py
-  (claim_audit, behavior), curator.py + canaries (audit_ledger),
-  rune_operator.py:581 (evidence_probe).
-- The divergent-vintage finding and the live-ledger drift-key finding are
-  banked above and pin the contract.

docs/pipeline-registry.md

@@ -44,13 +44,3 @@ were removed after RP10 proved the canonical Research-to-Build pipeline
 (epic #257). Their trigger label (`research-pending`) was stripped from all
 disposable issues on 2026-09-08 (RP0). Historical evidence retained in
 research/issue-* directories and closed issues (#245, #254-#256, #260-#263).
-
-## fault-watch (`.gitea/workflows/fault-watch.yml`)
-- **Trigger:** CI Pipeline completion + every 15 min schedule
-- **Purpose:** Monitors the 5 named gates (lint/unit-tests/rust-surface/go-surface/canary) on HEAD SHA. Auto-files `ci-fault` issues (labeled ci-fault+bug) on failure, auto-closes when the gate goes green on a pushed commit.
-- **Failure mode:** If the fault-watch itself fails, CI failures go undetected — the nightly cron sweep is the backstop.
-
-## local-review (`.gitea/workflows/local-review.yml`)
-- **Trigger:** Pull request events (opened, synchronize)
-- **Purpose:** Runs the local review pipeline (lint gates + parity checks) on PR branches before merge.
-- **Failure mode:** A failure here blocks the PR merge — the required-checks job gates on it.

docs/rebase-language-rubric.md

@@ -1,382 +0,0 @@
-# Language-Fit Rubric — Wave 1 (Language-Rebasing Tranche R1)
-
-> STATUS: FINAL — self-verified 2026-09-29 per tranche §12 (all 6 rounds completed,
-> evidence-sufficiency statements recorded, kill tests frozen; execution proceeds on the
-> evidence, every RECODE still passes its benchmark gate — no win, no recode).
-> Per-subsystem sections filled from live research rounds (≥2 live-verified external sources per claim,
-> per-source lessons, evidence→decision mapping, kill test per candidate). No code changes in Wave 1.
-> Governing law from §11: **KEEP-PYTHON honesty determines how much of the rebase volume is real.**
-> Toolchain baseline: Rust 1.98.1 + GCC 16.2.1 present; Go NOT installed — Go earns installation only
-> through rubric evidence here.
-
-## Verdict (all rounds, one paragraph)
-
-**KEEP-PYTHON across the board: 40 clusters scored, 0 recode units awarded.** Six research
-rounds (W2 leaf utilities, W3 memory, W4 provider-layer, W5 orchestration, W6 runtime-core,
-W7 TUI) each characterized their subsystem's actual workload inward (file:line-anchored) and
-tested Python/Rust/Go/C against it with live-verified sources and frozen kill tests. The
-pattern is consistent: the compute-shaped work already executes in C (hashlib, sqlite3/FTS5/vec0,
-json, regex), the dominant latency is network or LLM-bound, and no cluster contains a hot loop
-that pays for a process-boundary recode through the 658 µs–0.63 ms interop crossing. **Go:
-REJECTED — does not earn installation this tranche** (D5=0 everywhere; nothing measured or
-fetch-confirmed earns it; orchestration additionally rejects its design fit; K-GO kill tests
-frozen per round should the case be revived). **Rust: toolchain-ready, justified nowhere this
-tranche** — keep as the standing option behind the CI-proven std-only adapter for any future
-measured hot loop. **C: rejected everywhere scored** (duplicates C already inside SQLite/hashlib;
-adds an unsafe-memory surface). The rebase volume the tranche hypothesized is real only as a
-small set of named improvements — see "Wave-plan consequence" below.
-
-## Rubric dimensions (applied to every candidate language per subsystem)
-
-| Dimension | Question | Evidence required |
-|---|---|---|
-| D1 Workload fit | Does the subsystem's dominant workload (I/O-bound, CPU-bound, FFI, protocol, UI) actually favour this language? | Benchmarks or authoritative docs, live-verified |
-| D2 Measured gain | What wins, concretely — latency, memory, startup, binary distribution? | Named hot paths from the Wave 0 inventory + numbers |
-| D3 Interop cost | What does the interop contract (§5) cost to carry for this boundary? | Adapter surface size, ABI/build complexity |
-| D4 Ecosystem | Do the needed libraries exist and are they maintained? | Live-verified crate/package/module listings |
-| D5 Toolchain reality | Is the toolchain present (or installable and justified) on this machine and the CI runner? | Runner + local `--version` evidence |
-| D6 Maintenance continuity | Can the Rune ecosystem's single-maintainer loop sustain code in this language here? | Honest judgement, stated plainly |
-| D7 Kill test | What is the CHEAPEST disproof of this candidate? | One falsifiable early test, frozen before any recode |
-
-Scoring: each candidate gets D1–D6 scored 0–2 with one-line evidence each, D7 written regardless.
-Decision per subsystem: **KEEP-PYTHON** / **RECODE→<language>** — KEEP-PYTHON is the expected default;
-a RECODE that cannot pass its own kill test reverts to KEEP-PYTHON before implementation.
-
----
-
-## W3 — Memory & persistence (units: memory_store 56 fns, curator 43, warm_router 32, memory_consolidation 20, sleep_time 25, + graph_memory, night_mode, identity_anchors)
-
-- **Research round actor:** general-2 (COMPLETED 2026-09-29 — artifacts at
-  `research/wave1/memory/`: inward.md, outward/ ×6, outward-sources.md, synthesis.md)
-- **Intention profile:** JSONL-heavy appends, BM25/FTS ranking, consolidation passes, long-running
-  scheduled jobs, file-backed state.
-- **Decision:** **KEEP-PYTHON (all 7 clusters, zero RECODE).** Cluster verdicts:
-  (1) hot-store JSON persistence — KEEP with upgrade path: orjson in-process wheel
-  (~10× dumps / 2× loads); a bespoke Rust CLI unit is dead on spawn cost (the
-  `shared/native_units.py` crossing ~1–5 ms ≈ orjson's entire 3.4 MB `knowledge.json` decode);
-  (2) SQLite store + FTS5/vec0 recall — KEEP, the compute is already C inside SQLite
-  (`memory_store.py:646` vec0 MATCH, `:693` bm25); (3) neuron scoring/routing — KEEP,
-  network-bound `_embed` (Ollama subprocess curl) dominates; (4) graph BFS — KEEP,
-  hops=1 default, per-node SQL, tiny N; the future fix is a SQL CTE, not a language;
-  (5) batch consolidation/curator — KEEP, LLM/I-O-bound and latency-insensitive,
-  asyncio sweet spot; (6) orchestration/glue — KEEP, pure glue pinned by the Python-TUI
-  interop contract; (7) embedding transport — KEEP, network-bound.
-- **Candidate matrix summary:** Python 7/7 · Go 0/7 (not installed, nothing measured or
-  fetch-confirmed earns installation; Go's JSON stack mid-rewrite upstream) · hand-written C
-  0/7 (C already battle-tested inside SQLite — hand-writing would duplicate it) · Rust 0/7
-  as CLI units (spawn cost kills the one credible vector; in-process wheels excluded by
-  Wave 0 policy).
-- **Kill tests (frozen in synthesis.md):** Rust-JSON — orjson microbench on live 3.4 MB
-  `knowledge.json` (if drop-in and ≥2× load / ≥5× dump, the CLI unit is disproven on spawn
-  cost); Rust-general — kill unless a profile shows ≥50% wall time in pure Python compute
-  (none exists; reopen only on materially changed workload); Go — instrument one
-  `consolidate_all` run, kill if Python-compute share <50% (it will be — LLM/I-O bound);
-  C — kill unless a hot kernel absent from the SQLite extension ecosystem is identified
-  (none).
-- **Sources + lessons:** 6 live-fetched 2026-09-29 (orjson, sled, sqlite-vec, SQLite FTS5
-  docs, Go json/v2 rewrite issue, pydantic-core) — full annotations in
-  `research/wave1/memory/outward-sources.md`.
-- **Evidence sufficiency (honest):** static analysis only, no runtime profiling;
-  memory.store SQLite DB not materialized locally — kill tests specify *measured*
-  thresholds rather than assertions. Verdicts rest on "Python is glue around C/network,"
-  which profiling would only strengthen.
-
-## W4 — Provider/model layer (units: provider_registry 28, model_connect 10, model_routing 15, model_profiles 15, provider_budget 21, + standardized_providers, model_registry, connection_pool)
-
-- **Research round actor:** general-5 (COMPLETED 2026-09-29 — artifacts at
-  `research/wave1/provider-layer/`: inward.md, outward-sources.md, outward/ (8 evidence
-  JSONs), synthesis.md)
-- **Intention profile:** HTTP/SSE streaming, connection pooling, retries/backoff, protocol parsing,
-  tool-call reliability.
-- **Intention profile correction (inward-verified):** the layer has **NO retry/backoff and NO
-  SSE stub at all** (grep-verified) — `stream: False` everywhere, ~900 lines, remote-LLM-latency-
-  bound. Rewrite pitches are therefore feature-adds, not ports.
-- **Candidate matrix:** 5 clusters, all KEEP-PYTHON. Scores (1–5 = fit for the cluster's actual
-  workload): (C1) HTTP wire + transport (provider_registry, openai_compat_transport, model_connect
-  discovery) Python 5 / Go 2 / Rust 1; (C2) connection pool (connection_pool.py, 144 lines —
-  in-process object guards under threading.Lock, NOT a TCP pool) Python 5 / Go 2 / Rust 2;
-  (C3) routing decisions (model_routing.py, 432 lines, pure decision logic, one httpx call)
-  Python 5 / Go 1 / Rust 1; (C4) budget accounting (provider_budget.py, 354 lines, pure
-  arithmetic + lock, no I/O) Python 5 / Go 1 / Rust 1; (C5) config/registry/normalization
-  (model_profiles, model_registry, standardized_providers, model_connect tables — dataclasses +
-  JSON, editable by non-systems programmers) Python 5 / Go 1 / Rust 1.
-- **Decision:** **KEEP-PYTHON (all 5 clusters).**
-- **Kill tests:** C1 Go — KILLED: toolchain absent (`which go` → not found); 28 call-site
-  behaviors incl. the tool-call envelope contract (openai_compat_transport.py:67-107, 160-207)
-  would be re-implemented with zero incumbent test port and NO performance signal (remote-LLM-
-  latency-bound, kilobyte payloads). Re-earn path if Go is ever installed: std-only proof via
-  `interop/rebase-proof/` + a benchmark harness on C1 only. C1 Rust — KILLED BY CONSTRUCTION:
-  SSE parsing requires reqwest+tokio+eventsource-stream+nom (outward O3/O4/O5 — even mistral.rs
-  takes the tokio stack), violating the std-only interop contract. C2–C5 Go/Rust — KILLED:
-  burden of proof sits on the rewrite candidates; kill tests need contention/throughput/
-  counter-evidence that does not exist; routing runs once per request at millisecond scale
-  against multi-second LLM calls (5 orders of magnitude below any measurable threshold).
-- **Sources + lessons:** 8 live-fetched (O1–O8), ≥2 per major claim, coverage map in
-  `outward-sources.md`. Lessons: (1) stdlib-only Rust has no realistic precedent for HTTP/SSE
-  workloads — the interop contract's zero-crate standard effectively decides Rust out of all
-  network-wire clusters; (2) Go's stdlib HTTP+NDJSON streaming is capability-proven
-  (pkg.go.dev/net/http, ollama api/client.go, ollama's Go API server) — Go's losses here are
-  evidence-absence, not capability-absence; (3) the honest reliability upgrade for this layer
-  is a small Python-level httpx retry/timeout wrapper — a feature-add, not a language change.
-
-## W5 — Orchestration, authority, plugins, skills (units: orchestration/ 44 files 244 fns, contracts, build_mode 34, construction_authority*, verification_construction, spine, + governance surfaces: drift_*, persona_gate, safety_override, witness, behavior, growth_delta, claim_audit)
-
-- **Research round actor:** general-1 (COMPLETED 2026-09-29 — artifacts at
-  `research/wave1/orchestration/`: inward.md, outward-sources.md, outward/ (4 search
-  JSONs), synthesis.md)
-- **Intention profile:** contract/lifecycle state machines, authority gating, fail-closed validation,
-  HMAC-chained ledgers, policy dispatch.
-- **Intention profile correction (inward-verified):** the subsystem is durable-ledger I/O,
-  authority wiring, deterministic policy gates, and TUI-facing coordination — NOT hot loops
-  (2 RLocks, 0 sockets, 0 thread pools across 43 files). **Scope gap: `construction_authority.py`
-  and `verification_construction.py` do not exist in the tree** — the construction cluster is
-  covered by build_mode.py; no evidence invented for the missing files.
-- **Candidate matrix:** 6 clusters, all KEEP-PYTHON. Scores (1–5 = fit for the cluster's actual
-  workload): (C1) durable state & ledger stores (event_store.py:56-101, atomic.py, evidence_store.py
-  — fsync-bound; hashing already C via hashlib) Python 5; (C2) composition roots & authority wiring
-  (composition.py, authority.py, cognitive.py — pure glue, runtime cost ≈ 0) Python 5; (C3)
-  policy/state machines/gates (lifecycle.py, scheduler.py, broker.py, no_change.py, reflex.py —
-  deterministic dict/enum decisions, sub-ms; testability is the requirement) Python 5; (C4)
-  structural self-model & schema tooling (spine.py:24-25, microkernel.py, contracts.py, records.py
-  — introspection + canonical JSON; only candidate for a future Rust spine-diff if snapshots grow
-  1000×) Python 4; (C5) TUI-facing orchestration & build pipeline (build_mode.py 11-stage pipeline,
-  gateway.py, transport.py — the consumer IS the Python TUI; latency dominated by LLM/subprocess
-  waits) Python 5; (C6) benchmark/migration harnesses (retrieval_benchmark.py, migrate.py,
-  benchmark.py — offline tooling, recode buys nothing, loses iteration speed) Python 4.
-- **Decision:** **KEEP-PYTHON (all 6 clusters). This subsystem contributes 0 recode units to
-  the wave plan.** Go: REJECTED, do not install — differentiator (goroutine-dense servers)
-  targets a workload absent here; cost is exception→error-value rewrite of ~260 functions.
-  Rust: FEASIBLE (toolchain proven) but UNJUSTIFIED anywhere — no cluster has the hot loop
-  that pays for a process-boundary recode; keep as toolchain-ready for other subsystems.
-  C: REJECTED — the only compute-shaped work (sha256) already executes C via stdlib hashlib.
-- **Kill tests:** K1 (frozen, ALREADY RUN): 100 round-trips through the rebase-proof adapter —
-  mean 0.63ms, p95 0.74ms, cold 0.87ms, 100% exit-0 + ok:true → adapter overhead does NOT block
-  recodes on cost; recodes die on value grounds. Re-open any cluster if profiling shows a
-  function consuming >10% of a real interactive session. K-GO (frozen, ~30 min): Go prototype
-  of event_store.py's batched append+fsync vs Python at 1000 events; if Python's p95 is within
-  2× of Go's, Go is dead here permanently. K-RUST (frozen, ~20 min): measure spine diff on a
-  10k-entity snapshot; <50ms kills any Rust spine recode by absence of pain.
-- **Sources + lessons:** 4 live-fetched web sources (pydantic-core, ruff blog, go.dev FAQ,
-  Python 3.14 hashlib docs) + 1 LOCAL EXPERIMENT (n=100 adapter benchmark). Lessons: (1) the
-  rebase-proof adapter round-trips at 0.63ms/op — subprocess-per-op is viable for coarse ops,
-  never per-event; (2) Python's "slowness" argument dissolves where the actual compute already
-  runs in C via stdlib (hashlib, sqlite) — the language question is really "where is the hot
-  loop", and here the answer is nowhere; (3) assumed limits flagged honestly: human-scale event
-  cadence (batch_size=8) and Linux spawn cost — both would need revisit at 10⁴+ events/sec or
-  cross-platform targets.
-
-## W6 — Runtime core & tooling (units: tool_executor 46, tool_protocol 27, local_tool_runtime 32, capability_broker 19, context_broker 21, work_manager 25, cron_engine 28, + failure_auto_filer 28, hook_engine, elastic_cognition, auto_tasks, goal)
-
-- **Research round actor:** general-4 (COMPLETED 2026-09-29 on disk despite cancellation
-  notification — artifacts at `research/wave1/runtime-core/`: inward.md, outward/,
-  outward-sources.md, synthesis.md)
-- **Intention profile:** subprocess/process supervision, native execution boundary (native_units
-  adapter already exists), event loops, cron scheduling, hook dispatch.
-- **Decision:** **STAY-PYTHON (all 6 clusters).** Round scores (1–5 = fit for the cluster's
-  actual inward-characterized workload): (A) subprocess lifecycle (tool_executor, cron_engine,
-  auto_tasks) 4.7 — `subprocess.run(timeout=, capture_output=)` is a one-call expression of the
-  pattern; Rust std::process has NO built-in child timeout (outward-verified), strictly more
-  code under zero-crate; (B) protocol/JSON parsing (tool_protocol, brokers) 4.5 — inputs are
-  KB-scale model fragments; Python json/regex is already C-backed, so a rewrite swaps C for
-  compiled code at the same asymptotic cost; serde's typed-struct model actively mismatches
-  fence-wrapped schema-flexible output; (C) model→tool control loop + HTTP
-  (local_tool_runtime, elastic_cognition, goal) 4.8 — wall time is LLM HTTP latency in seconds;
-  Python overhead is µs–ms noise; the loop's content is policy (circuit breaker, escalation
-  ladders, routing tables); (D) context assembly (context_broker) 4.7 — correctness lives in
-  admission policy and degrade-not-crash semantics, not speed; compaction is itself an LLM call;
-  (E) reliability/queueing (failure_auto_filer) 4.2 — honest lowest: on paper the best Rust
-  candidate (queue + worker + crash-safe JSONL spool), but perf requirement ≈ nil and the
-  correctness burden is threading semantics a rewrite would re-risk for no win ("nothing
-  breaks today"); (F) declarative config/brokers (work_manager, hook_engine, capability_broker)
-  4.9 — literal data, no-op runtime, portable to anything valuable in nothing.
-- **Candidate matrix summary:** Python 6/6 · Go 0/6 (paper verdicts only — evidence-starved,
-  not installed, kill tests unrunnable locally) · Rust 0/6 (kill tests runnable via the
-  existing std-only interop harness) · C unscored (no FFI-adjacent cluster surfaced).
-  Best-language moment found anywhere: robfig/cron replacing ~37 hand-rolled cron-parsing
-  lines (cron_engine.py:199-236) — ergonomics nicety, not a fit verdict.
-- **Kill tests (frozen in synthesis.md):** Rust-A — re-express `_run_command`
-  (tool_executor.py:1064) with std::process + manual timeout; kill if >2× the ~40-line
-  Python wrapper (Q4 predicts it is); Go-A — port `cron_engine._run_loop` with os/exec,
-  measure task-fire latency delta (prediction: zero — 60 s sleep and child runtime dominate);
-  B — parse the largest observed tool-protocol stream 1000× in Python; kill if total <1 s
-  (no rewrite yields an observable win); C — instrument `_run_loop`
-  (local_tool_runtime.py:417), log non-HTTP CPU per iteration (prediction <1% of wall);
-  D — time `assemble`+`_admit` on the largest stored context, kill if <10 ms; E — fault-inject
-  kill -9 during spool append; if recovery semantics already hold, the rewrite has no
-  correctness win to buy; F — none needed: absence of any win condition IS the disproof.
-- **Sources + lessons:** live-fetched 2026-09-29 — annotations in
-  `research/wave1/runtime-core/outward-sources.md`; headline lessons: Rust std::process lacks
-  child timeout (Q4); Go os/exec reaches parity but changes only syntax (Q1); Python
-  json/regex C-backed (Q5b); serde typed structs mismatch dynamic model output (Q5a);
-  concurrency features irrelevant at ≤2 threads (Q6).
-- **Evidence sufficiency:** Python verdicts fully evidenced inward+outward; Go execution-side
-  evidence honestly starved (paper kill tests carried forward); E's JSONL-spool crash-safety
-  claim rests on inward semantics only — flagged in synthesis.md.
-
-## W7 — Operator + TUI (units: rune_operator 61 fns, rune_tui 161 fns — largest module, tui_validator)
-
-- **Research round actor:** general-3 (COMPLETED 2026-09-29 — artifacts at
-  `research/wave1/tui/`: inward.md, outward/ ×8, outward-sources.md, synthesis.md)
-- **Intention profile:** terminal rendering, input handling, rich layout, hot store state, supervisory
-  command surface. Design decision 4 holds: TUI consumes the interop contract, never rewritten first.
-- **Decision:** **KEEP-PYTHON (TUI shell; all 4 clusters, zero RECODE, no carve-out found).**
-  Cluster scores (1 = recode, 5 = keep): (A) rendering/widgets 4 — no hot loop exists; render is
-  plain Rich `Text` concatenation (rune_tui.py:1331, chat_bubble.py:157), only animation a 0.12 s
-  spinner (:263), no markdown/Syntax parsing anywhere in src/rune; (B) event glue (~50 `_cmd_*`
-  handlers, reactives, tool-widget maps) 5 — this is Textual's core competency (workers,
-  `exclusive=True`, `call_from_thread`); vendor docs (ratatui) admit "little to no help in organizing
-  large applications"; (C) model send path + envelope 5 — synchronous `send_task` in async worker;
-  the envelope shape (`success/response/thinking/tool_events/degraded`, rune_tui.py:3624ff) is
-  ALREADY the de-facto interop contract; (D) subprocess/streaming 5 — JSONL streaming precedent
-  already in-tree (`_cmd_pull` :3443-3517): the pattern for consuming recoded units, not a recode
-  target. Whole-TUI native recode 1/5 REJECTED — 80+ first-party module coupling, framework-provided
-  concurrency re-implemented by hand; Go additionally toolchain-blocked. Countervailing evidence
-  (Bubble Tea/tview/Codex TUI maturity) recorded honestly in outward-sources.md — it does not
-  outweigh the coupling.
-- **⚠ CONTRACT GAP FLAGGED (binds Waves 2–7):** `shared/native_units.py` parses only the LAST
-  stdout line — it must gain a JSONL streaming reader (per-line `json.loads` + terminal-envelope
-  validation) before any recoded long-running unit can stream progress to the TUI. Small, testable,
-  non-breaking; candidate for the first Wave 2 implementation issue.
-- **Adapter surface (TUI as consumer — adopted as the rubric's interop-contract restatement):**
-  (1) single-invocation stateless CLI (`native_unit <op> [args]`, no daemon); (2) success = final
-  stdout line `{"ok":true, …}` generalizing the model-send envelope — recoded units emitting
-  `response`/`tool_events`/`degraded` plug in with zero TUI changes; (3) failure = `ok:false` +
-  nonzero exit, stderr human-only, success = exit 0 AND not timed out; (4) mandatory `--version`
-  on every unit (status bar + `canary_tui_drift.py` detect live units vs Python fallback);
-  (5) JSONL streaming mode for long ops with terminal sentinel envelope; (6) per-call timeout
-  budget, `timed_out` surfaced in `NativeResult` for graceful degradation; (7) streamed events
-  referencing UI objects carry the TUI's stable keys — `(channel, call_id)` for tool widgets
-  (:3676), WorkPane `_entries` object ids (:1239) — preserved verbatim; (8) std-only for
-  proof-phase units.
-- **Candidate matrix summary:** Python 4/4 clusters · Rust/Go whole-TUI 1/5 rejected · carve-out
-  candidates: none found (future markdown parsing would carve as a Rust native unit behind the
-  adapter, not now).
-- **Kill tests (frozen in synthesis.md):** stay-Python — killed if >16 ms UI-thread stalls under
-  heavy event bursts OR IPC latency dominates message round-trip (Textual pilot measurement);
-  Rust recode — killed if the adapter must expose >~15 first-party modules (count today ≈80:
-  killed NOW); Go recode — additionally killed by toolchain absence (`command -v go` empty).
-- **Sources + lessons:** 8 live-fetched 2026-09-29 (Textual workers guide, ratatui vendor docs,
-  Bubble Tea/tview/Codex countervailing evidence, JSON Lines spec, push-granular-work guidance) —
-  annotations in `research/wave1/tui/outward-sources.md`.
-- **Evidence sufficiency (honest):** full inward read of all 5 TUI files with line refs; ≥2 sources
-  per major claim; gap = no runtime profiling (stall kill test unmeasured — but no mechanism exists
-  for the stall to occur; the 120 ms 21-step pipeline was already removed, `_run_warm_router`
-  :3575 is a no-op).
-
-## W2 — Leaf utilities & canaries (~40 modules, low coupling: pins, time_awareness, message_queue, event_envelope, attention_capsule, complexity_scorer, token_optimizer, cache 501/17, prompt_sync, chat_bubble, ~15 canary_* modules)
-
-- **Research round actor:** general-6 (COMPLETED 2026-09-29 — full report in actor notification)
-- **Intention profile:** small pure helpers, envelopes, scoring, cache; smallest blast radius; the
-  factory + interop proving ground at real scale.
-- **Ground-truth measurements (local, this session):** Python fn call ~46 ns (100k timed
-  iterations in-process) · native CLI roundtrip ~658 µs (subprocess to
-  `interop/rebase-proof/target/release/rebase-proof --version`) · Python startup floor ~18 ms ·
-  overhead ratio ≈ **14,000×**. The only CI-proven interop contract is the subprocess CLI boundary
-  (`shared/native_units.py`: argv in → JSON stdout, `--version`, timeout, typed `NativeResult`).
-  PyO3/in-process bindings excluded by Wave 0 policy. Therefore every per-call crossing costs
-  ≥658 µs — a per-turn helper would need to run >14,000× faster in Rust to break even.
-- **Candidate matrix (representative — full per-cluster 0–2 scoring in round report):**
-  Python 12/12 in every cluster · Rust 5–6/12 · Go 1–3/12 (D5=0, not installed) · C 1–2/12.
-  No module contains a hot loop (heaviest: 2 `re.sub` per turn in token_optimizer).
-- **Decision:** **KEEP-PYTHON (all ~40, zero RECODE).** Cluster verdicts: (a) pure CRUD helpers
-  pins/time_awareness/token_optimizer — KEEP, CPython 3.11+ already 10–60% faster on this shape
-  (PEP 659); (b) message/envelope/capsule structures — KEEP, recode would insert a boundary
-  between the chattiest neighbors; (c) cache.py (501 L, largest in wave) — KEEP, the fast part is
-  already C (sqlite3 DB-API 2.0 over SQLite's C library), Python is thin orchestration, batching
-  (threshold 50 / 30 s) already amortizes writes; (d) chat_bubble.py — KEEP, **hard-pinned** to
-  Python by the Textual framework (recode = full framework abandonment, bottleneck is human
-  typing speed); (e) prompt_sync.py glue — KEEP, glue into Python siblings (memory_env,
-  voice_sync, build_pipeline_policy); (f) ~19 canary_* — KEEP **categorically**, a canary that
-  verifies Python importability cannot exist in another language.
-- **Kill tests (reopening criteria, all fail today on first cheap measurement):** Rust — microbench
-  one per-turn helper behind the native_units CLI, must beat the Python in-process call >10×
-  end-to-end including the 658 µs crossing (whole call <~46 µs; a trivial `--version` already
-  costs 658 µs); Go — identical benchmark post-install, uninstall if roundtrip >100 µs with no
-  named hot path; C — identical benchmark + required fuzz-clean JSON roundtrip, plus a
-  demonstrated GC-free allocation-hot loop first; cache.py — recode only if Python-side
-  orchestration (excl. sqlite3 waits) exceeds 5% of end-to-end latency; capsule/envelope/queue —
-  recode only if one turn's Python total exceeds ~5 ms AND a candidate's CLI path is >10× cheaper.
-- **Sources + lessons:** (1) https://docs.python.org/3/whatsnew/3.11.html — 10–60% faster,
-  PEP 659 specializing interpreter: CPython already optimized for helper-shaped code, the D2
-  baseline is a moving improving target; (2) https://docs.python.org/3/whatsnew/3.13.html —
-  free-threading/JIT experimental, KEEP-PYTHON ≠ frozen but no bets on experimental paths;
-  (3) https://www.maturin.rs/ — in-process Rust↔Python needs a whole binding/packaging toolchain
-  atop the CLI boundary, D3 worse than measured 658 µs (Wave 0 policy excludes it anyway);
-  (4) https://go.dev/doc/install — Go is a pre-install prerequisite, D5=0 everywhere, never earned
-  installation; (5) https://textual.textualize.io/ — Textual is a Python TUI framework,
-  chat_bubble.py framework-pinned; (6) https://docs.python.org/3/library/sqlite3.html — sqlite3 is
-  DB-API 2.0 over C, cache.py's perf layer already native. All fetched live 2026-09-29.
-- **⚠ Inventory drift (VERIFIED 2026-09-29):** complexity_scorer.py listed in
-  rebase-inventory.json (2 mentions) but absent on disk — deleted in commit 867321e
-  ("governed retirement — complexity_scorer deleted (602 lines)"). Wave 0 inventory needs a
-  correction pass; the module was scored nowhere (no source to characterize).
-
----
-
-## Wave-plan consequence (T5 scope, from the verdict above)
-
-With **0 recode units awarded**, the tranche's hypothesized rebase volume is real only as the
-work below. Waves 2–9 are **disposition + named improvements, NOT mass recoding**:
-
-**Waves 2–7 — per-issue disposition (the 1,852 `[rebase w{wave}]` issues):**
-Each issue receives its tranche §7 disposition — improve / fix / missing-connectors answered
-with evidence — plus a language verdict of **KEEP-PYTHON with its rubric evidence line**
-(the round section for that subsystem names the claim). Disposition runs leaf-first
-(Wave 2 → 7), the canonical suite stays green throughout, and no issue closes without its
-evidence line. A recode is off the table unless a frozen kill test is reopened — and then
-tranche §6 still governs: **no benchmark win, no recode.** Go is not installed and earned no
-installation; Rust stays toolchain-ready but unjustified (standing option behind the
-CI-proven adapter).
-
-**Named improvements — the actual rebase volume (ship alongside disposition):**
-1. **JSONL streaming reader for `shared/native_units.py`** (W7 contract gap): the adapter
-   parses only the LAST stdout line; it must gain per-line `json.loads` + terminal-envelope
-   validation before any recoded long-running unit could stream progress. Small, testable,
-   non-breaking — first implementation issue of Wave 2.
-2. **httpx retry/timeout wrapper for the provider layer** (W4): the honest reliability
-   upgrade is a feature-add, not a language change.
-3. **orjson upgrade path** (W3 cluster 1): the only credible Python-side JSON win —
-   in-process, no boundary crossing. **DISPOSITION (2026-09-29, kill test EXECUTED and
-   FAILED — KEEP-PYTHON stands, no dependency declared):** microbench on the live
-   `~/.rune/consolidation/knowledge.json` (3,540,959 bytes, n=30 best-of): load 13.15 ms
-   std vs 7.85 ms orjson = **1.68× (bar ≥2×: FAIL)**; dump 9.58 ms std vs 5.61 ms
-   orjson-with-decode = **1.71× (bar ≥5×: FAIL)**; raw-bytes dump 1.39 ms = 6.91× but is
-   not drop-in (every `write_text`/`json.dump`-to-file site would need a bytes→str or
-   binary-write conversion). Roundtrip equality verified. Bench: `/tmp/orjson_bench.py`
-   shape (uvx --with orjson). The bytes trap measured real: decode() eats ~60% of the
-   dump win.
-4. **complexity_scorer.py inventory correction**: listed in `rebase-inventory.json` but
-   deleted on disk (commit `867321e`, 602 lines) — Wave 0 inventory needs the correction
-   pass. **DISPOSITION (2026-09-29, DONE):** inventory regenerated per the script's own
-   header (never hand-edit) — 177→213 files, 1,852→2,314 functions, 13 dead files
-   dropped; committed + pushed `5bc837c`. The W2 round's "2 mentions" drift claim
-   verified FALSE against the live inventory (zero hits).
-5. **robfig/cron** (W6): recorded as a best-language footnote only; no action.
-
-**Wave 8 — TUI integration proof:** demonstrate the TUI reading/utilising the mixed-language
-surfaces that exist (the `interop/rebase-proof` unit through the upgraded adapter), per the
-8-point adapter surface adopted above.
-**Wave 9 — close-out audit:** 100% of the 1,852 issues dispositioned, debt-table revision,
-version bump.
-
-## Cross-cutting candidates (evaluated once, referenced by every subsystem)
-
-- **Rust (present, 1.98.1):** interop proof unit already CI-proven (std-only, zero crates, `interop/rebase-proof/`, adapter in `shared/native_units.py`, ok = exit 0 AND not timed out).
-- **Go (absent):** must earn installation through D1–D5 evidence here before any recode targets it.
-- **C (present, GCC 16.2.1):** expected to lose D6 in most subsystems; scored where FFI-adjacent work exists.
-- **Python (KEEP baseline):** the default. Every subsystem begins here; evidence must move it.
-
-## Evidence ledger (per-source lessons, all rounds)
-
-Index of per-source evidence. Full annotations live in each round's
-`research/wave1/<subsystem>/outward-sources.md`; this ledger records the headline lesson
-each source contributed and the rubric claims it supports.
-
-| Round | Sources (live-fetched 2026-09-29) | Headline lessons | Supports |
-|---|---|---|---|
-| W2 leaf utilities | 6: python.org 3.11 + 3.13 whatsnew, maturin.rs, go.dev/doc/install, textual.textualize.io, docs.python.org sqlite3 | CPython 3.11+ already 10–60% faster on helper-shaped code (PEP 659) — D2 baseline is a moving target; free-threading/JIT experimental, no bets; in-process bindings need a whole toolchain atop the CLI boundary (excluded by Wave 0 policy anyway); Go is pre-install prerequisite, D5=0; Textual framework-pins chat_bubble.py; sqlite3 perf layer already C | W2 KEEP-PYTHON ×~40; the 14,000× crossing-overhead law |
-| W3 memory | 6: orjson, sled, sqlite-vec, SQLite FTS5 docs, Go json/v2 rewrite issue, pydantic-core | orjson is the only credible Python-side JSON win (in-process, no boundary); SQLite FTS5/vec0 compute is already C; Go's JSON stack mid-rewrite upstream (versioning risk); pydantic-core shows the Rust-as-wheel pattern, excluded by policy | W3 KEEP-PYTHON 7/7; orjson upgrade path on cluster 1 |
-| W4 provider-layer | 8: live-fetched O1–O8 (HTTP/SSE ecosystem, tokio-stack precedents incl. mistral.rs, pkg.go.dev/net/http, ollama Go client/server) | stdlib-only Rust has no realistic HTTP/SSE precedent — the zero-crate contract decides Rust out of all network-wire clusters by construction; Go's stdlib HTTP+NDJSON streaming is capability-proven (its losses here are evidence-absence, not capability-absence); the honest reliability upgrade is a Python httpx retry/timeout wrapper — feature-add, not language change | W4 KEEP-PYTHON 5/5; SSE-cluster Rust kill-by-construction |
-| W5 orchestration | 4: pydantic-core, ruff blog, go.dev FAQ, Python 3.14 hashlib docs + 1 LOCAL EXPERIMENT (n=100 adapter benchmark) | adapter round-trips at 0.63ms/op — subprocess-per-op viable for coarse ops, never per-event; Python "slowness" dissolves where compute already runs in C via stdlib; the language question is really "where is the hot loop" (here: nowhere) | W5 KEEP-PYTHON 6/6; K1 kill test already run |
-| W6 runtime-core | headline lessons (full set in round outward-sources.md) | Rust std::process lacks built-in child timeout — strictly more code under zero-crate; Go os/exec reaches parity but changes only syntax; Python json/regex C-backed so rewrite swaps C for compiled code at equal asymptotic cost; serde typed structs mismatch schema-flexible model output; concurrency features irrelevant at ≤2 threads | W6 STAY-PYTHON 6/6; robfig/cron as best-language footnote |
-| W7 TUI | 8: Textual workers guide, ratatui vendor docs, Bubble Tea/tview/Codex TUI (countervailing), JSON Lines spec, push-granular-work guidance | Textual workers/`call_from_thread` are the core competency for event glue; ratatui admits "little to no help in organizing large applications"; countervailing native-TUI frameworks recorded honestly — do not outweigh 80+ module coupling; JSONL per-line parse + terminal sentinel is the streaming contract; vendor guidance: push granular speed-sensitive work to subcomponents only when measured | W7 KEEP-PYTHON 4/4; the 8-point adapter surface (adopted as the rubric's interop-contract restatement) |

docs/rebase-wave0-report.md

@@ -1,50 +0,0 @@
-# Wave 0 close-out report — language-rebasing tranche R1
-
-Branch: `tranche-r1-wave-0` · Date: 2026-09-29
-
-## 1. Inventory (docs/rebase/rebase-inventory.json)
-
-- 177 Python modules, ~52,750 lines, 227 classes
-- TRUE unit count: **1,852 = 1,030 top-level functions + 822 class methods**
-- Zero duplicate call edges, zero method leaks (generator double-walk defect
-  root-caused and fixed in scripts/rebase_inventory.py)
-- Cross-verified against an independent fresh AST walk: zero missing units;
-  six inventory-"extras" are real nested/if-try-block classes the naive walk
-  misses (inventory is MORE complete, not less)
-
-## 2. Issue factory (scripts/rebase_issue_factory.py)
-
-- One issue per unit following R1 §7; wave-batched (2–7); dedup-safe via
-  deterministic title `[rebase w{wave}] {relpath}::{unit}` + existing-titles
-  scan per run (retries never duplicate — preserve-first)
-- `plan` → {2: 239, 3: 251, 4: 129, 5: 544, 6: 415, 7: 274} = 1,852,
-  zero unassigned
-- `sample --wave 5` → full §7 template holds; `_compute_hash` exactly once as
-  labelled callee with line number
-- Contract fix during Wave 0: `--limit` default changed 5 → 0 (unlimited) for
-  `create`; `sample` keeps its 5. A full-wave create with the old default
-  would have silently truncated each wave to five issues.
-
-## 3. Interop proof unit (R1 §5)
-
-- Rust unit at interop/rebase-proof/ (std-only, zero crates): argv in → JSON
-  on stdout, non-zero exit on failure, mandatory `--version`
-- Shell-proven: version flag, JSON out, exit 2 on failure, stderr diagnostic
-- Python thin adapter shared/native_units.py: typed NativeResult, timeout +
-  stderr capture, unit failures as data (never exceptions)
-- Adapter contract fix during Wave 0: `ok` no longer requires a JSON
-  `ok:true` field — plain-text output (`--version`) succeeds on exit code
-- tests/test_native_interop_proof.py: **8 passed** — version contract, sum
-  happy path, hash determinism, failure paths, timeout, stderr capture
-
-## 4. Per-wave issue creation
-
-<!-- FILLED BY THE COMPLETION LOOP — do not hand-edit -->
-
-- Wave 4 (129 units): created=127 skipped(dedup)=2 (includes smoke #417–418)
-- Wave 2 (239 units): created=239 skipped(dedup)=0
-- Wave 3 (251 units): created=251 skipped(dedup)=0
-- Wave 5 (544 units): created=544 skipped(dedup)=0
-- Wave 6 (415 units): created=415 skipped(dedup)=0
-- Wave 7 (274 units): created=274 skipped(dedup)=0
-- TOTAL: 1,850 created + 2 dedup = 1,852 / 1,852 ✅ full coverage

docs/rebase/rebase-wave-coverage.json

@@ -1,12 +0,0 @@
-{
- "units_per_wave": {
-  "2": 239,
-  "3": 251,
-  "4": 129,
-  "5": 544,
-  "6": 415,
-  "7": 274
- },
- "unassigned_modules": {},
- "unassigned_module_count": 0
-}

docs/reviewer-dispatch-template.md

@@ -75,29 +75,3 @@ And the role-separation rules: the black-box test author (fresh context) has
 already written the spec tests; the reviewer checks the implementation
 against tests it did not write; vacuity spot-checks (one manual mutant per
 load-bearing branch) are BLOCKER-grade findings when tests survive them.
-
-## Dimensional review rubric (#129 — mandatory for P0/P1)
-
-Holistic judgment ("is this good?") is replaced by per-dimension
-forced-choice scoring. Every review dispatch MUST score each dimension
-explicitly — a review missing any dimension is INCOMPLETE and bounces.
-
-| Dimension | What to score | Verdicts |
-|---|---|---|
-| Correctness | Does the code do what the issue/spec requires? Verify call sites, not claims. | PASS / CONCERN / FAIL |
-| Design | Does the shape fit the codebase (parity laws, authority maps, no second authorities)? | PASS / CONCERN / FAIL |
-| Test quality | Do the tests prove the behavior (real-path, oracle-derived, would fail without the fix)? | PASS / CONCERN / FAIL |
-| Observability | Are failures visible (logged, journaled, gated) rather than silent? | PASS / CONCERN / FAIL |
-| Security | Approval boundaries, secret handling, injection surfaces — anything that widens trust? | PASS / CONCERN / FAIL |
-
-Example (the required output shape):
-```
-Correctness: PASS (36 call sites verified).
-Design: PASS with concern (registry singleton).
-Test quality: CONCERN (no real-path test).
-Observability: PASS.
-Security: PASS.
-```
-Five explicit verdicts the controller acts on dimensionally — a CONCERN
-or FAIL in any dimension blocks the gate until discharged or explicitly
-accepted with a reason.

docs/supersession-report.md

@@ -1,60 +0,0 @@
-# SUPERSESSION REPORT — programmatic evidence
-_Created 2026-10-07. Question: is curator superseded by memory_consolidation? Can supersession be determined programmatically?_
-
-## Answer in one paragraph
-
-No — they are NOT supersessions of each other. They are two different machines in one pipeline: **memory_consolidation compresses what already exists** (warm neurons, graph entities, abstraction facts → consolidated knowledge records), while **curator gates what gets written** (evidence → worthiness filter → graded routing → tiers). Both are wired into sleep_time's nightly run: consolidation runs in-process, curator runs as a subprocess. The real finding is darker: **curator has NEVER successfully run in production** — three of its four dependencies were never ported from the Odysseus branch, so every invocation died at import. Both diagnoses were reached programmatically.
-
-## The programmatic supersession test (reusable)
-
-Six signals, each binary and evidence-based (`/tmp/ss_engine.py`, promote to scripts/):
-
-| Signal | Test | Weight |
-|---|---|---|
-| R1 Import graph | production importers vs canary-only importers | high |
-| R2 Subprocess summon | module executed as a script by another module | high |
-| R3 Output artifacts | documented output files exist with recent mtimes | high |
-| R4 Function overlap | name overlap with the suspected successor | low (weak signal) |
-| R5 Importability | `import X` succeeds (phantom dep = dead) | gate — fails = dead regardless |
-| R6 End-to-end probe | documented entry path executes with real input | decisive |
-
-## Applied to curator vs memory_consolidation
-
-| Signal | curator | memory_consolidation |
-|---|---|---|
-| R1 | 0 production importers | 2 (memory_selector, sleep_time) |
-| R2 | summoned as script by sleep_time + dependency_tracker | summoned by dependency_tracker |
-| R3 | **index/blocks_meta.json DOES NOT EXIST — no journal files — never wrote output** | graph.sqlite exists but **stale (Aug 22)**; consolidation/*.json never created |
-| R4 | 2% overlap — different function sets (confirms: different jobs) | 2% |
-| R5 | importable NOW (after repair); dead since #314 | importable |
-| R6 | dry-run probe NOW green (post-repair); was JSONDecodeError-crash | consolidate() wired, but its outputs absent too |
-
-## Verdict
-
-1. **NOT a supersession.** 2% function overlap + different roles: curator = write-path gate (worthiness → grade → tier), memory_consolidation = read-path compressor (existing memories → knowledge records). One writes, one compresses. Both belong.
-2. **Both are broken in production.** Curator never ran (phantom deps). memory_consolidation's outputs are stale/absent — its last graph write was Aug 22. The whole sleep-time memory pipeline has been quietly degraded.
-3. **Disposition: REPAIR, not retire.** grading.py + worthiness.py are now recovered from the Odysseus source branch (provenance, not reconstruction) with frozen tests; curator's dry-run executes end-to-end. Remaining phantom for curator: lexicon_evolution (guarded — degrades), aaak (guarded — optional compression). Both degradable, not blocking.
-
-## The phantom-import census (the general finding)
-
-16 phantom imports found across src/rune. The important ones:
-
-| Module | Importers | Guarded? | Disposition |
-|---|---|---|---|
-| worthiness | curator | NO (hard crash) | ✅ RECOVERED from Odysseus + frozen tests |
-| grading | curator | NO | ✅ RECOVERED from Odysseus + frozen tests |
-| lexicon_evolution | curator | yes (degrades) | recover-or-rename decision needed |
-| aaak | curator, memory_store, warm_router | yes | optional compression; recover or accept degrade |
-| build_pipeline_policy | prompt_sync | NO | phantom — prompt_sync is dead on arrival |
-| gitea_auth | forge | NO | forge.py dead; is forge itself superseded? |
-| faster_whisper, pynput | voicebox | yes | optional deps — correct as-is |
-| research_lens | claim_audit | yes | lives in ~/.config/opencode/scripts — cross-repo dep |
-| ep_loader | 5 modules | false positive | resolves via sys.path hack to src/rust/ |
-| autonomy_loop, cognitive_loop, dream_cycle | rune_tui | yes | TUI plugins — recover or retire |
-| commitments, dedupe_policy, local_memory | warm_router, memory_store, sleep_time | yes | recover-or-accept-degrade |
-
-**Hard-crash phantoms mean the owning module is dead code:** prompt_sync, forge, and (until today) curator.
-
-## What the dictonomy rebase inherits
-
-The Go/Rust port queue should SKIP dead code until its disposition is decided. A module that never ran has no behavioral parity to prove — porting it would faithfully reproduce a ghost. The audit instrument now needs an R5 importability column so dead modules are marked before they're counted.

docs/tui-registry.md

@@ -10,7 +10,6 @@ new surface._
 | `rune_tui.py` | The main Textual application — chat pane, work pane, status bar (version label + refresh), footer, dialogs | The known giant (file-size debt tracked in henxels); composition root for all UI |
 | `tui_validator.py` | Import-allowlist validation for TUI code | Drift defect tracked in #139 (allowlist vs `__future__`/relative imports) |
 | `tui_backlog.py` | Not a surface — the durable TUI Upgrade Backlog ledger (outstanding projection/control work per backend feature) | SCAFFOLD-TRANCHE-007; ledger only, never structural authority |
-| `tui_transport.py` | Not a surface — the transport seam for the TUI's operator calls (in-process default / /v1 wire opt-in) | H4 slice 1 (contract BUILDER-2026-10-04T10:32:00Z-cli); RUNE_TUI_TRANSPORT selects; coverage: canary_tui_transport.py |
 
 ## Adding a TUI surface
 

go-version.txt

@@ -1 +0,0 @@
-1.27.1

henxels.yaml

@@ -1,150 +1,103 @@
 settings:
   warn_about_similar_files:
     above: 0.85
-    ignore:
-    - docs/review-lessons.yaml
-    - docs/v1/**
-    - docs/wiki/**
-    - store/spine/**
-    - shared/**
-    - src/rune/drift_core.py
-    - src/rune/drift_compression.py
-    - src/rune/drift_observability.py
-    - src/rune/shard_manager.py
-    - src/rune/subconscious_pass.py
-    - .gitea/ISSUE_TEMPLATE/**
-    - shared/issue_templates/**
-    - bridge/daemon/completion_file.py
-    - scripts/completion_file.py
-    - interop/rebase-proof/**
-    - src/rust/*/Cargo.lock
-    - src/rust/*/src/pyjson.rs
-    - src/rust/query_memory/src/json_min.rs
-    - store/scaffold/**
+    ignore: ["docs/review-lessons.yaml", "docs/v1/**", "docs/wiki/**", "store/spine/**"]
+
 henxels:
-- henxel: Canaries live at the repo's canary slot and are registered in CI
-  in: ./src/rune/**/canary_*.py
-  ci_runs_all_canaries: true
-- henxel: No secrets in tracked files
-  no_secrets: true
-  except:
-  - ./tests/test_gitea_provision.py
-  - ./tests/test_gitea_auth.py
-  - ./.ci-venv/**
-  - ./.test-venv/**
-  - ./.canary-venv/**
-  - ./backups/**
-- henxel: Plans are markdown, one per build
-  in: ./plans
-  allowed_filetypes:
-  - .md
-  filename_casing: kebab-case
-- henxel: Top-level docs are markdown or yaml references
-  in: ./docs/*
-  allowed_filetypes:
-  - .md
-  - .yaml
-  except:
-  - ./docs/v1/**
-  - ./docs/wiki/**
-  - ./docs/gitea_issue_reconciliation.json
-  - ./docs/rebase/**
-- henxel: "The known giant stays visible \u2014 file-size debt is tracked, not silent"
-  in: ./src/rune/*
-  except:
-  - ./src/rune/rune_tui.py
-  - ./src/rune/rune_operator.py
-  - ./src/rune/memory_store.py
-  - ./src/rune/curator.py
-  - ./src/rune/tool_executor.py
-  - ./src/rune/warm_router.py
-  - ./src/rune/spine.py
-  max_lines: 1250
-- henxel: "The umbrella impact map is complete and truthful \u2014 every module mapped,\
-    \ no phantom entries"
-  in: ./config/umbrellas.json
-  umbrella_manifest_is_complete: true
-- henxel: "Umbrella canaries exist in the repo \u2014 the propagation gate cannot\
-    \ reference ghosts"
-  in: ./config/umbrellas.json
-  umbrella_canaries_exist: true
-- henxel: "The umbrella dependency graph stays a DAG \u2014 reflexive updates cannot\
-    \ cycle"
-  in: ./config/umbrellas.json
-  umbrella_dag_acyclic: true
-- henxel: "The bug-fix discharge contract is a governed doc \u2014 it exists, is markdown,\
-    \ and changes are deliberate"
-  in: ./docs/bugfix-contract.md
-  allowed_filetypes:
-  - .md
-- henxel: "The discharge checker ships with the repo \u2014 red-first enforcement\
-    \ is structural"
-  in: ./scripts
-  required_files:
-  - check_discharge_contract.py
-- henxel: Discharge checker and its CI wiring change together
-  changed_with:
-    when: scripts/check_discharge_contract.py
-    expect: ./.gitea/workflows/pipeline-gate.yml
-- henxel: "Every workflow is registered in the pipeline registry \u2014 new pipeline\
-    \ machinery ships with documentation"
-  in: ./.gitea/workflows/*.yml
-  workflows_are_governed: true
-- henxel: "Every TUI surface is registered \u2014 no silent UI growth"
-  in: ./src/rune/*tui*.py
-  tui_panels_are_governed: true
-- henxel: "New rune modules ship with tests or a canary \u2014 no ungoverned code\
-    \ surfaces"
-  in: ./src/rune/*.py
-  new_rune_modules_have_canary_or_test_coverage: true
-- henxel: Rust crate files stay under a line budget
-  in: ./src/rust/*/src/*.rs
-  except:
-  - ./src/rust/*/src/pyjson.rs
-  - ./src/rust/*/src/json_min.rs
-  max_lines: 3000
-- henxel: Go modules stay under a line budget
-  in: ./src/go/**/*.go
-  max_lines: 2000
-- henxel: No secrets in Rust or Go source files
-  in:
-  - ./src/rust/*/src/*.rs
-  - ./src/go/**/*.go
-  no_secrets: true
-- henxel: "PRDs are living documents \u2014 their generated state sections regenerate\
-    \ identically from governed sources"
-  changed_with:
-    when: config/umbrellas.json
-    expect: ./docs/pipeline-prd.md
-- henxel: "PRD staleness is a CI failure \u2014 docs rot is silent failure"
-  in: ./scripts/gen_prd_state.py
-  required_files:
-  - gen_prd_state.py
-- henxel: "The adversarial review procedure is binding \u2014 dispatch templates must\
-    \ reference it"
-  in: ./docs/adversarial-review.md
-  required_files:
-  - ../docs/reviewer-dispatch-template.md
-- henxel: "The fixture pipeline ships with the repo \u2014 production failure capture\
-    \ is structural"
-  in: ./scripts
-  required_files:
-  - capture_failure.py
-- henxel: "Production failure fixtures are a governed surface \u2014 the registry\
-    \ and its README exist"
-  in: ./tests/fixtures/production
-  required_files:
-  - manifest.json
-  - README.md
-- henxel: "Fixture payloads and the manifest travel together \u2014 tamper-evidence\
-    \ needs both"
-  changed_with:
-    when: tests/fixtures/production/**/payload.json
-    expect: tests/fixtures/production/manifest.json
-- henxel: The fixture manifest and its generated regression tests travel together
-  changed_with:
-    when: tests/fixtures/production/manifest.json
-    expect: tests/fixtures/production/test_production_fixtures.py
-- henxel: "The dichotomy is enforced at the commit boundary — every src/rune module lands in its measured side, dead oracles and wrong-language kernels fail with the correct implementation as the instruction"
-  in: ./src/rune
-  dichotomy_language_verdict: true
+  - henxel: "Canaries live at the repo's canary slot and are registered in CI"
+    in: ./src/rune/**/canary_*.py
+    ci_runs_all_canaries: true
+
+  - henxel: "No secrets in tracked files"
+    no_secrets: true
+    except: ["./tests/test_gitea_provision.py", "./tests/test_gitea_auth.py", "./.ci-venv/**", "./.test-venv/**", "./.canary-venv/**", "./backups/**"]
+
+  - henxel: "Plans are markdown, one per build"
+    in: ./plans
+    allowed_filetypes: [.md]
+    filename_casing: kebab-case
+
+  - henxel: "Top-level docs are markdown or yaml references"
+    in: ./docs/*
+    allowed_filetypes: [.md, .yaml]
+    except: ["./docs/v1/**", "./docs/wiki/**", "./docs/gitea_issue_reconciliation.json"]
+
+  - henxel: "The known giant stays visible — file-size debt is tracked, not silent"
+    in: ./src/rune/*
+    except:
+      - ./src/rune/rune_tui.py
+      - ./src/rune/rune_operator.py
+      - ./src/rune/memory_store.py
+      - ./src/rune/curator.py
+      - ./src/rune/tool_executor.py
+      - ./src/rune/warm_router.py
+    max_lines: 1200
+
+  - henxel: "The umbrella impact map is complete and truthful — every module mapped, no phantom entries"
+    in: ./config/umbrellas.json
+    umbrella_manifest_is_complete: true
+
+  - henxel: "Umbrella canaries exist in the repo — the propagation gate cannot reference ghosts"
+    in: ./config/umbrellas.json
+    umbrella_canaries_exist: true
+
+  - henxel: "The umbrella dependency graph stays a DAG — reflexive updates cannot cycle"
+    in: ./config/umbrellas.json
+    umbrella_dag_acyclic: true
+
+  - henxel: "The bug-fix discharge contract is a governed doc — it exists, is markdown, and changes are deliberate"
+    in: ./docs/bugfix-contract.md
+    allowed_filetypes: [.md]
+
+  - henxel: "The discharge checker ships with the repo — red-first enforcement is structural"
+    in: ./scripts
+    required_files: [check_discharge_contract.py]
+
+  - henxel: "Discharge checker and its CI wiring change together"
+    changed_with:
+      when: scripts/check_discharge_contract.py
+      expect: ./.gitea/workflows/pipeline-gate.yml
+
+  - henxel: "Every workflow is registered in the pipeline registry — new pipeline machinery ships with documentation"
+    in: ./.gitea/workflows/*.yml
+    workflows_are_governed: true
+
+  - henxel: "Every TUI surface is registered — no silent UI growth"
+    in: ./src/rune/*tui*.py
+    tui_panels_are_governed: true
+
+  - henxel: "New rune modules ship with tests or a canary — no ungoverned code surfaces"
+    in: ./src/rune/*.py
+    new_rune_modules_have_canary_or_test_coverage: true
+
+
+  - henxel: "PRDs are living documents — their generated state sections regenerate identically from governed sources"
+    changed_with:
+      when: config/umbrellas.json
+      expect: ./docs/pipeline-prd.md
+
+  - henxel: "PRD staleness is a CI failure — docs rot is silent failure"
+    in: ./scripts/gen_prd_state.py
+    required_files: [gen_prd_state.py]
+
+  - henxel: "The adversarial review procedure is binding — dispatch templates must reference it"
+    in: ./docs/adversarial-review.md
+    required_files: [../docs/reviewer-dispatch-template.md]
+
+  - henxel: "The fixture pipeline ships with the repo — production failure capture is structural"
+    in: ./scripts
+    required_files: [capture_failure.py]
+
+  - henxel: "Production failure fixtures are a governed surface — the registry and its README exist"
+    in: ./tests/fixtures/production
+    required_files: [manifest.json, README.md]
+
+  - henxel: "Fixture payloads and the manifest travel together — tamper-evidence needs both"
+    changed_with:
+      when: tests/fixtures/production/**/payload.json
+      expect: tests/fixtures/production/manifest.json
+
+  - henxel: "The fixture manifest and its generated regression tests travel together"
+    changed_with:
+      when: tests/fixtures/production/manifest.json
+      expect: tests/fixtures/production/test_production_fixtures.py

henxels_checks.py

@@ -189,179 +189,3 @@ def new_rune_modules_have_canary_or_test_coverage(param, file, root):
         f"legacy debt goes in docs/module-coverage-debt.md (tracked, not silent)"
     )
 
-
-
-@statement("dichotomy_language_verdict", help="every src/rune module lands in its measured dichotomy side — wrong-language kernels, dead oracles, and regressions fail with the correct implementation as the instruction")
-def dichotomy_language_verdict(param, file, scope):
-    """The dichotomy gate (Nick, 2026-10-10): the language law enforced at the
-    commit boundary, with machine-actionable feedback for Rune/MiMo-Rune.
-
-    Authority: store/rebase/classification.json (the measured W0 map —
-    per-module side + evidence). Three violations, each with a specific
-    remediation instruction:
-
-      D1 WRONG-LANGUAGE KERNEL — a module classified RUST has no matching
-         Rust crate/kernel surface while a Go directory claims its name:
-         the deterministic core landed on the reactive side.
-      D2 DEAD ORACLE — a module classified GO/RUST has a ported kernel
-         (src/go/<name>/ or src/rust/<name>/ exists) but the Python module
-         has zero delegation refs (cc_loader / <name>_loader / go-surface
-         call). The port shipped; the adapter never calls it — a facade.
-      D3 REGRESSION — a module classified GO or RUST has NO port directory
-         at all AND the ratchet floor says it was already ported: progress
-         went backwards.
-
-    Feedback format: each failure names the verdict, the measured evidence,
-    and the literal next step (target path + oracle-first battery +
-    contract-first), so the builder agent can act without re-deriving.
-    """
-    import json
-    import os
-    import re as _re
-
-    if not (file.startswith("src/rune/") and file.endswith(".py")):
-        return None
-    stem = Path(file).stem
-    if stem.startswith(("canary_", "test_", "__")):
-        return None
-
-    root = scope.root
-    try:
-        cls = json.loads((root / "store" / "rebase" / "classification.json").read_text())
-    except (OSError, json.JSONDecodeError):
-        return None  # no measured map: the audit instrument owns coverage; do not guess
-    rec = cls.get(stem)
-    if not isinstance(rec, dict):
-        return None
-    side = rec.get("side", "")
-    if side not in ("GO", "RUST", "TUI-LAST"):
-        return None
-
-    go_dir = root / "src" / "go" / stem
-    rust_dir = root / "src" / "rust" / stem
-    evidence = str(rec.get("evidence", ""))[:160]
-
-    # D1 — wrong-language kernel: a GO-classified module must not own a Rust
-    # crate that shadows its name, and vice versa.
-    if side == "RUST" and go_dir.is_dir() and not rust_dir.is_dir():
-        # Wave-3 kernels live in cognition_core by design (cc_<stem> externs).
-        # A RUST-classified module whose kernel exists there is correctly landed
-        # even without a same-named crate.
-        cc = root / "src" / "rust" / "cognition_core" / "src" / "lib.rs"
-        if cc.exists() and f"cc_{stem}" in cc.read_text(encoding="utf-8", errors="replace"):
-            return None
-        return (
-            f"DICHOTOMY D1 (wrong-language kernel): {stem} is measured RUST "
-            f"({evidence}) but src/go/{stem}/ exists with no src/rust/{stem}/. "
-            f"FIX: port the deterministic core to src/rust/{stem}/ (oracle-first "
-            f"truth battery from the Python module, parity-replayed as a HARD CI "
-            f"gate, construction contract FIRST per the absolute-scaffolding law), "
-            f"then retire the Go directory. Feedback path: scripts/dichotomy_audit.py"
-        )
-    if side == "GO" and rust_dir.is_dir() and not go_dir.is_dir():
-        return (
-            f"DICHOTOMY D1 (wrong-language kernel): {stem} is measured GO "
-            f"({evidence}) but src/rust/{stem}/ exists with no src/go/{stem}/. "
-            f"FIX: the reactive surface belongs in src/go/{stem}/ (parity battery "
-            f"+ HARD CI gate + contract first), then retire the Rust crate."
-        )
-
-    # D2 — dead oracle: the port exists but the Python module never delegates.
-    # Delegation forms (all observed in the codebase): cc_loader/_cc_core,
-    # sibling *_loader imports (ep_loader, qm_loader, ms_loader...), direct
-    # ctypes/CDLL. Known pre-existing facades live in the DICHOTOMY DEBT file
-    # (store/rebase/dichotomy_debt.json) — tracked, only-shrinks; a NEW facade
-    # (not in the debt list) fails with the wiring instruction.
-    ported = go_dir.is_dir() or rust_dir.is_dir()
-    if ported and side in ("GO", "RUST"):
-        text = scope.read_text(file) or ""
-        delegating = bool(
-            _re.search(
-                r"import\s+\w*loader\b|from\s+[\w.]+\s+import\s+\w*loader|"
-                r"_cc_core|cc_loader|ctypes|CDLL|go_surface|RUNE_\w+_CORE",
-                text,
-            )
-        )
-        is_loader = stem.endswith("_loader") or stem == "cc_loader"
-        if not delegating and not is_loader:
-            target = f"src/rust/{stem}/" if rust_dir.is_dir() else f"src/go/{stem}/"
-            try:
-                debt = set(json.loads(
-                    (root / "store" / "rebase" / "dichotomy_debt.json").read_text()
-                ).get("facades", []))
-            except (OSError, json.JSONDecodeError):
-                debt = set()
-            if stem in debt:
-                return None  # tracked debt — visible in the debt file, list only shrinks
-            return (
-                f"DICHOTOMY D2 (dead oracle): {stem} has a ported kernel at "
-                f"{target} but the Python module has ZERO delegation references "
-                f"(no cc_loader/_cc_core/*_loader/ctypes call). The port is a "
-                f"facade — production still runs the Python path. FIX: wire the "
-                f"delegation (tier_manager pattern: kernel when available, _py_* "
-                f"parity floor otherwise, both pinned by tests). Pre-existing "
-                f"facades go in store/rebase/dichotomy_debt.json (tracked, "
-                f"list only shrinks). Feedback: scripts/dichotomy_audit.py"
-            )
-
-    # D3 — regression: the ratchet says this module was ported (kernel dir in
-    # git HEAD) but the working tree lost it.
-    if side in ("GO", "RUST") and not ported:
-        ratchet = root / "store" / "rebase" / "ported_ratchet.json"
-        try:
-            ratcheted = set(json.loads(ratchet.read_text()).get("ported", []))
-        except (OSError, json.JSONDecodeError, AttributeError):
-            ratcheted = set()
-        if stem in ratcheted:
-            return (
-                f"DICHOTOMY D3 (regression): {stem} is ratcheted as ported but no "
-                f"src/go/{stem}/ or src/rust/{stem}/ exists in the tree — ported "
-                f"work was deleted. RESTORE the kernel directory (git history has "
-                f"it); the ratchet floor never decreases."
-            )
-
-    # D5 — intent-unconsulted landing: a ported kernel (Go dir or Rust
-    # crate exists) whose intent file still says not_started means the batch
-    # never consulted the module's WHY. Parity is judged against intent, not
-    # just behavior — consult store/scaffold/intent/<stem>.json, satisfy its
-    # laws, and advance its status (not_started → facade → ported → retired).
-    if side in ("GO", "RUST", "TUI-LAST"):
-        if go_dir.is_dir() or rust_dir.is_dir():
-            try:
-                intent_status = json.loads(
-                    (root / "store" / "scaffold" / "intent" / f"{stem}.json").read_text()
-                ).get("status", "")
-            except (OSError, json.JSONDecodeError):
-                intent_status = ""
-            if intent_status == "not_started":
-                return (
-                    f"DICHOTOMY D5 (intent-unconsulted landing): {stem} has a "
-                    f"ported kernel but its intent file "
-                    f"(store/scaffold/intent/{stem}.json) still says "
-                    f"not_started — the batch never consulted the module's WHY. "
-                    f"FIX: read the intent file, satisfy its laws, set parity_means "
-                    f"for this module, and advance status to ported (or facade if "
-                    f"delegation is not yet wired). Parity is judged against "
-                    f"intent, not just behavior."
-                )
-
-    # D4 — retired-module resurrection: a module in the retirement ratchet
-    # (strangler exit completed — parity proven + CI green + deployed) must
-    # NOT reappear as a Python file. Singular codebase law.
-    if side in ("GO", "RUST") and not os.path.isdir(f"src/go/{stem}") and not os.path.isdir(f"src/rust/{stem}"):
-        try:
-            retired = set(json.loads(
-                (root / "store" / "rebase" / "retired_modules.json").read_text()
-            ).get("retired", []))
-        except (OSError, json.JSONDecodeError):
-            retired = set()
-        if stem in retired and (root / file).exists():
-            return (
-                f"DICHOTOMY D4 (retired-module resurrection): {stem} completed the "
-                f"strangler exit (parity + CI green + deployed) and its Python was "
-                f"deleted — but src/rune/{stem}.py exists again. The dichotomy is a "
-                f"SINGULAR codebase: do not resurrect retired Python; extend the "
-                f"kernel in its Go/Rust home instead. (See store/rebase/retired_modules.json.)"
-            )
-
-    return None

interop/rebase-proof/Cargo.lock

@@ -1,7 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "rebase-proof"
-version = "0.1.0"

interop/rebase-proof/Cargo.toml

@@ -1,15 +0,0 @@
-[package]
-name = "rebase-proof"
-version = "0.1.0"
-edition = "2021"
-
-# Wave 0 interop proof unit (R1 §5). Std-only by design: no crates, no network,
-# deterministic build. The pattern under proof is the CLI boundary itself, not the
-# computation inside it.
-
-[[bin]]
-name = "rebase-proof"
-path = "src/main.rs"
-
-[profile.release]
-strip = true

interop/rebase-proof/src/main.rs

@@ -1,117 +0,0 @@
-//! Wave 0 interop proof unit (R1 §5 of the language-rebasing tranche).
-//!
-//! Contract under proof:
-//! - standalone binary; argv in, JSON on stdout
-//! - non-zero exit on failure (JSON error object still printed to stdout)
-//! - `--version` flag mandatory
-//! - Python wraps it in a thin adapter (`shared/native_units.py`); tests call
-//!   it the same way.
-//!
-//! Ops: sum / echo / hash (fnv1a64) / sleep / fail. All std-only.
-
-use std::env;
-use std::process::exit;
-use std::thread;
-use std::time::Duration;
-
-const VERSION: &str = env!("CARGO_PKG_VERSION");
-
-/// FNV-1a 64-bit — dependency-free deterministic hash for the proof unit.
-fn fnv1a64(data: &[u8]) -> u64 {
-    let mut hash: u64 = 0xcbf29ce484222325;
-    for byte in data {
-        hash ^= u64::from(*byte);
-        hash = hash.wrapping_mul(0x100000001b3);
-    }
-    hash
-}
-
-fn print_json(line: &str) {
-    println!("{line}");
-}
-
-fn emit_ok(body: &str) {
-    print_json(&format!("{{\"ok\":true,{body}}}"));
-    exit(0);
-}
-
-fn emit_err(message: &str) -> ! {
-    // Escape the minimal set so the JSON stays parseable for arbitrary op names.
-    let escaped: String = message
-        .chars()
-        .map(|c| match c {
-            '"' => "\\\"".to_string(),
-            '\\' => "\\\\".to_string(),
-            '\n' => "\\n".to_string(),
-            '\r' => "\\r".to_string(),
-            '\t' => "\\t".to_string(),
-            other => other.to_string(),
-        })
-        .collect();
-    print_json(&format!("{{\"ok\":false,\"error\":\"{escaped}\"}}"));
-    exit(2);
-}
-
-fn main() {
-    let args: Vec<String> = env::args().skip(1).collect();
-
-    if args.as_slice() == ["--version"] || args.as_slice() == ["-V"] {
-        println!("rebase-proof {VERSION}");
-        exit(0);
-    }
-    if args.is_empty() {
-        eprintln!("usage: rebase-proof <op> [args...] | --version");
-        emit_err("no op given");
-    }
-
-    let op = args[0].as_str();
-    let rest = &args[1..];
-
-    match op {
-        "sum" => {
-            let mut total: i128 = 0;
-            for a in rest {
-                match a.parse::<i128>() {
-                    Ok(v) => total += v,
-                    Err(_) => emit_err(&format!("sum: not an integer: {a}")),
-                }
-            }
-            emit_ok(&format!("\"op\":\"sum\",\"result\":{total}"));
-        }
-        "echo" => {
-            let joined = rest.join(" ");
-            let escaped: String = joined
-                .chars()
-                .map(|c| match c {
-                    '"' => "\\\"".to_string(),
-                    '\\' => "\\\\".to_string(),
-                    '\n' => "\\n".to_string(),
-                    '\r' => "\\r".to_string(),
-                    '\t' => "\\t".to_string(),
-                    other => other.to_string(),
-                })
-                .collect();
-            emit_ok(&format!("\"op\":\"echo\",\"text\":\"{escaped}\""));
-        }
-        "hash" => {
-            let joined = rest.join(" ");
-            let h = fnv1a64(joined.as_bytes());
-            emit_ok(&format!("\"op\":\"hash\",\"fnv1a64\":\"{h:016x}\""));
-        }
-        "sleep" => {
-            let ms: u64 = match rest.first().map(|s| s.parse::<u64>()) {
-                Some(Ok(v)) => v,
-                _ => emit_err("sleep: expected milliseconds"),
-            };
-            thread::sleep(Duration::from_millis(ms));
-            emit_ok(&format!("\"op\":\"sleep\",\"slept_ms\":{ms}"));
-        }
-        "fail" => {
-            // Deliberate failure: stderr diagnostic + JSON error + exit 2.
-            // Proves stderr capture and non-zero exit in the adapter.
-            eprintln!("rebase-proof: deliberate failure for adapter proof");
-            emit_err("deliberate failure");
-        }
-        other => emit_err(&format!("unknown op: {other}")),
-    }
-}

lint-baseline.json

@@ -1,4 +1,4 @@
 {
- "BLE001": 47,
- "S110": 31
+  "BLE001": 347,
+  "S110": 75
 }

memory/index/capability_cards.json

@@ -1,447 +1 @@
-[
-  {
-    "name": "gamma",
-    "description": "",
-    "capabilities": [
-      "cap.a"
-    ],
-    "file": "",
-    "full_path": "",
-    "priority": 10,
-    "semantic_examples": [],
-    "risk": "read-only",
-    "auto_invoked": false,
-    "hooks": [],
-    "searchable_text": "gamma  cap.a "
-  },
-  {
-    "name": "alpha",
-    "description": "",
-    "capabilities": [
-      "cap.a"
-    ],
-    "file": "",
-    "full_path": "",
-    "priority": 50,
-    "semantic_examples": [],
-    "risk": "read-only",
-    "auto_invoked": false,
-    "hooks": [],
-    "searchable_text": "alpha  cap.a "
-  },
-  {
-    "name": "delta",
-    "description": "",
-    "capabilities": [],
-    "file": "",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "read-only",
-    "auto_invoked": true,
-    "hooks": [
-      "pre-turn",
-      "post-turn"
-    ],
-    "searchable_text": "delta   "
-  },
-  {
-    "name": "read_file",
-    "description": "Read a file with optional windowed viewing (offset/limit). Returns numbered lines. Use offset/limit for large files (100 lines at a time).",
-    "capabilities": [
-      "read_file"
-    ],
-    "file": "tool_executor.py",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "read-only",
-    "preconditions": [
-      "path exists and is a readable file"
-    ],
-    "side_effects": [],
-    "auto_invoked": false,
-    "hooks": [],
-    "native_tool": true,
-    "searchable_text": "read_file read a file with optional windowed viewing (offset/limit). returns numbered lines. use offset/limit for large files (100 lines at a time). native tool"
-  },
-  {
-    "name": "edit_file",
-    "description": "Surgical search/replace edit. More reliable than full file rewrites. The search string must match exactly.",
-    "capabilities": [
-      "edit_file"
-    ],
-    "file": "tool_executor.py",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "write",
-    "preconditions": [
-      "path is inside an allowed write directory",
-      "search string matches exactly once"
-    ],
-    "side_effects": [
-      "rewrites the target file atomically after approval",
-      "creates a .bak backup under ~/.rune/undo"
-    ],
-    "auto_invoked": false,
-    "hooks": [],
-    "native_tool": true,
-    "searchable_text": "edit_file surgical search/replace edit. more reliable than full file rewrites. the search string must match exactly. native tool"
-  },
-  {
-    "name": "write_file",
-    "description": "Write content to a file. Creates parent directories if needed. Shows diff before writing. Use for new files or full rewrites.",
-    "capabilities": [
-      "write_file"
-    ],
-    "file": "tool_executor.py",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "write",
-    "preconditions": [
-      "path is inside an allowed write directory"
-    ],
-    "side_effects": [
-      "writes the full file content atomically after approval",
-      "creates a .bak backup under ~/.rune/undo"
-    ],
-    "auto_invoked": false,
-    "hooks": [],
-    "native_tool": true,
-    "searchable_text": "write_file write content to a file. creates parent directories if needed. shows diff before writing. use for new files or full rewrites. native tool"
-  },
-  {
-    "name": "glob_files",
-    "description": "Find files matching a glob pattern. Returns file paths sorted by modification time.",
-    "capabilities": [
-      "glob_files"
-    ],
-    "file": "tool_executor.py",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "read-only",
-    "preconditions": [
-      "search directory is readable"
-    ],
-    "side_effects": [],
-    "auto_invoked": false,
-    "hooks": [],
-    "native_tool": true,
-    "searchable_text": "glob_files find files matching a glob pattern. returns file paths sorted by modification time. native tool"
-  },
-  {
-    "name": "grep_files",
-    "description": "Search for a pattern in files. Returns file paths and line numbers. Use include to filter by file type.",
-    "capabilities": [
-      "grep_files"
-    ],
-    "file": "tool_executor.py",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "read-only",
-    "preconditions": [
-      "search directory is readable"
-    ],
-    "side_effects": [],
-    "auto_invoked": false,
-    "hooks": [],
-    "native_tool": true,
-    "searchable_text": "grep_files search for a pattern in files. returns file paths and line numbers. use include to filter by file type. native tool"
-  },
-  {
-    "name": "list_directory",
-    "description": "List files and directories at a path. Returns names with / suffix for directories.",
-    "capabilities": [
-      "list_directory"
-    ],
-    "file": "tool_executor.py",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "read-only",
-    "preconditions": [
-      "path is a readable directory"
-    ],
-    "side_effects": [],
-    "auto_invoked": false,
-    "hooks": [],
-    "native_tool": true,
-    "searchable_text": "list_directory list files and directories at a path. returns names with / suffix for directories. native tool"
-  },
-  {
-    "name": "lint_file",
-    "description": "Lint a file for syntax errors and style issues. Blocks bad edits. Supports Python (ruff), JS/TS (eslint), Go (golangci-lint), and more.",
-    "capabilities": [
-      "lint_file"
-    ],
-    "file": "tool_executor.py",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "read-only",
-    "preconditions": [
-      "file exists",
-      "a linter is configured for the language"
-    ],
-    "side_effects": [],
-    "auto_invoked": false,
-    "hooks": [],
-    "native_tool": true,
-    "searchable_text": "lint_file lint a file for syntax errors and style issues. blocks bad edits. supports python (ruff), js/ts (eslint), go (golangci-lint), and more. native tool"
-  },
-  {
-    "name": "run_tests",
-    "description": "Run tests for a file or project. Auto-detects test runner from language.",
-    "capabilities": [
-      "run_tests"
-    ],
-    "file": "tool_executor.py",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "write",
-    "preconditions": [
-      "a test runner is configured for the project"
-    ],
-    "side_effects": [
-      "runs project test commands which may create or delete files"
-    ],
-    "auto_invoked": false,
-    "hooks": [],
-    "native_tool": true,
-    "searchable_text": "run_tests run tests for a file or project. auto-detects test runner from language. native tool"
-  },
-  {
-    "name": "format_code",
-    "description": "Auto-format code files. Supports Python (black/ruff), JS/TS (prettier), Go (gofmt), and more.",
-    "capabilities": [
-      "format_code"
-    ],
-    "file": "tool_executor.py",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "write",
-    "preconditions": [
-      "path is inside an allowed write directory",
-      "a formatter is configured for the language"
-    ],
-    "side_effects": [
-      "rewrites files in place to the formatter's style"
-    ],
-    "auto_invoked": false,
-    "hooks": [],
-    "native_tool": true,
-    "searchable_text": "format_code auto-format code files. supports python (black/ruff), js/ts (prettier), go (gofmt), and more. native tool"
-  },
-  {
-    "name": "git_diff",
-    "description": "Show git diff for staged or unstaged changes.",
-    "capabilities": [
-      "git_diff"
-    ],
-    "file": "tool_executor.py",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "read-only",
-    "preconditions": [
-      "working directory is a git repository"
-    ],
-    "side_effects": [],
-    "auto_invoked": false,
-    "hooks": [],
-    "native_tool": true,
-    "searchable_text": "git_diff show git diff for staged or unstaged changes. native tool"
-  },
-  {
-    "name": "git_log",
-    "description": "Show recent git commits.",
-    "capabilities": [
-      "git_log"
-    ],
-    "file": "tool_executor.py",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "read-only",
-    "preconditions": [
-      "working directory is a git repository"
-    ],
-    "side_effects": [],
-    "auto_invoked": false,
-    "hooks": [],
-    "native_tool": true,
-    "searchable_text": "git_log show recent git commits. native tool"
-  },
-  {
-    "name": "git_commit",
-    "description": "Commit changes with a message. Auto-stages modified files.",
-    "capabilities": [
-      "git_commit"
-    ],
-    "file": "tool_executor.py",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "irreversible",
-    "preconditions": [
-      "working directory is a git repository",
-      "there are changes to commit"
-    ],
-    "side_effects": [
-      "creates a commit on the current branch"
-    ],
-    "auto_invoked": false,
-    "hooks": [],
-    "native_tool": true,
-    "searchable_text": "git_commit commit changes with a message. auto-stages modified files. native tool"
-  },
-  {
-    "name": "repo_map",
-    "description": "Generate an AST-based codebase map showing key symbols (classes, functions, imports). Uses tree-sitter for 100+ languages.",
-    "capabilities": [
-      "repo_map"
-    ],
-    "file": "tool_executor.py",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "read-only",
-    "preconditions": [
-      "target directory is readable"
-    ],
-    "side_effects": [],
-    "auto_invoked": false,
-    "hooks": [],
-    "native_tool": true,
-    "searchable_text": "repo_map generate an ast-based codebase map showing key symbols (classes, functions, imports). uses tree-sitter for 100+ languages. native tool"
-  },
-  {
-    "name": "run_command",
-    "description": "Run an approved command. Prefer argv (shell=False); shell syntax requires shell=true and explicit user approval.",
-    "capabilities": [
-      "run_command"
-    ],
-    "file": "tool_executor.py",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "irreversible",
-    "preconditions": [
-      "operator approves the command",
-      "required binaries are on PATH"
-    ],
-    "side_effects": [
-      "executes arbitrary commands with their full side effects"
-    ],
-    "auto_invoked": false,
-    "hooks": [],
-    "native_tool": true,
-    "searchable_text": "run_command run an approved command. prefer argv (shell=false); shell syntax requires shell=true and explicit user approval. native tool"
-  },
-  {
-    "name": "read_persona",
-    "description": "Read Rune's persona definition. Returns the full persona block with voice, identity, and rules.",
-    "capabilities": [
-      "read_persona"
-    ],
-    "file": "tool_executor.py",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "read-only",
-    "preconditions": [
-      "persona MEMORY.md exists"
-    ],
-    "side_effects": [],
-    "auto_invoked": false,
-    "hooks": [],
-    "native_tool": true,
-    "searchable_text": "read_persona read rune's persona definition. returns the full persona block with voice, identity, and rules. native tool"
-  },
-  {
-    "name": "query_memory",
-    "description": "Query Rune's memory store. Returns relevant memories for a query.",
-    "capabilities": [
-      "query_memory"
-    ],
-    "file": "tool_executor.py",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "read-only",
-    "preconditions": [
-      "memory store database is available"
-    ],
-    "side_effects": [],
-    "auto_invoked": false,
-    "hooks": [],
-    "native_tool": true,
-    "searchable_text": "query_memory query rune's memory store. returns relevant memories for a query. native tool"
-  },
-  {
-    "name": "check_growth",
-    "description": "Check Rune's growth log. Returns recent growth entries and patterns.",
-    "capabilities": [
-      "check_growth"
-    ],
-    "file": "tool_executor.py",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "read-only",
-    "preconditions": [
-      "growth log file exists"
-    ],
-    "side_effects": [],
-    "auto_invoked": false,
-    "hooks": [],
-    "native_tool": true,
-    "searchable_text": "check_growth check rune's growth log. returns recent growth entries and patterns. native tool"
-  },
-  {
-    "name": "diagnose_behavior",
-    "description": "Diagnose Rune's current behavior. Returns analysis of persona adherence, voice consistency, and drift.",
-    "capabilities": [
-      "diagnose_behavior"
-    ],
-    "file": "tool_executor.py",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "read-only",
-    "preconditions": [
-      "recent response text provided"
-    ],
-    "side_effects": [],
-    "auto_invoked": false,
-    "hooks": [],
-    "native_tool": true,
-    "searchable_text": "diagnose_behavior diagnose rune's current behavior. returns analysis of persona adherence, voice consistency, and drift. native tool"
-  },
-  {
-    "name": "find_capability",
-    "description": "Search all installed capabilities for what you need. Returns matching tool names with descriptions and argument schemas. Use this when a capability you need is not in your current tool set; the matched tool becomes callable in the same session.",
-    "capabilities": [
-      "find_capability"
-    ],
-    "file": "tool_executor.py",
-    "full_path": "",
-    "priority": 100,
-    "semantic_examples": [],
-    "risk": "read-only",
-    "preconditions": [
-      "a capability query describing the needed outcome"
-    ],
-    "side_effects": [],
-    "auto_invoked": false,
-    "hooks": [],
-    "native_tool": true,
-    "searchable_text": "find_capability search all installed capabilities for what you need. returns matching tool names with descriptions and argument schemas. use this when a capability you need is not in your current tool set; the matched tool becomes callable in the same session. native tool"
-  }
-]
+[]

memory/index/warm_state.json

@@ -1,5 +1,4 @@
 {
   "neurons": {},
-  "divides": [],
-  "sessions": {}
+  "divides": []
 }

plans/2026-10-02-phase-g-query-memory-supersession.md

@@ -1,48 +0,0 @@
-# Phase G slice 1 — retrieval-index authority supersession ledger
-
-**Date:** 2026-10-02 · **Branch:** `phase-g-strangler-retrieval-index` · **Unit issue:** conductor/rune#2448
-
-## What was superseded
-
-The pure-Python `query_memory` implementation (formerly `src/rune/query_memory.py`,
-deployed at `~/.config/opencode/scripts/query_memory.py`) is RETIRED as a production
-implementation. Production authority now rests with:
-
-1. **Implementation:** Rust crate `src/rust/query_memory/` (lib.rs core + cdylib, ten
-   `extern "C"` FFI symbols, zero external crates).
-2. **Production service surface:** `shared/query_memory.py` — a ctypes-backed shim
-   (179 lines) over `qm_loader.py`, byte-deployed to `~/.config/opencode/scripts/query_memory.py`,
-   serving the FULL prior Python class API including the `self.history` snapshot.
-
-## Strangler doctrine (master doc lines 685–770) — step discharge
-
-| Step | Requirement | Evidence |
-|------|-------------|----------|
-| 1–4 | candidate built, contract frozen, parity proven | commits `9b76585`+`54d2db9`; `/tmp/phaseG_retrieval_index_contract.md` frozen; parity harness ALL GREEN |
-| 5 | qualification | `/tmp/phaseG_qual_bench.out` (Rust CLI ~45× faster end-to-end); canaries both sides |
-| 6 | canaries conformance | Python canary 12/12; Rust canary 27/27 |
-| 7 | shadow comparison vs live store | `/tmp/phaseG_shadow.py` 46/46 exact-equal vs 77-record production store |
-| 8 | authority switch + observed consumer evidence | commit `6f44a87`; both consumers verified live — `memory_store.py` (lines 820–821, live 76-record store, nested stats shape) + `growth_simulator.py` (record_query through Rust core); #2448 comment id 33795 |
-| 9 | runtime evidence post-switch | post-switch verification wall ALL GREEN: Python canary 12/12, FFI smoke 41/41, Rust canary 27/27, parity harness ALL GREEN |
-| 10 | old production path unreachable | ALL import paths (`import query_memory`) now resolve to the deployed shim; `shared/graph_shard_bridge.py` tolerant import serves the shim; the orphan `src/rune/query_memory.py` had ZERO importers (verified by sweep incl. path-string references) |
-| 11 | old implementation removed or reference-only | `src/rune/query_memory.py` DELETED (this commit); the only stale reference (`scripts/structural_coverage_audit.py` registry mapping shared/ as a mirror of src/rune) corrected — query_memory removed from `SRC_A`/`SHARED_D`, added to `SHARED_B` (canonical, ops-harness owned) |
-| 12 | supersession ledger | THIS FILE |
-
-Deletion discipline (language-governance rule ⑥) satisfied: old code removed only after
-the new implementation was PROVEN — wall green, shadow 46/46, both production consumers
-observed live on the Rust core before deletion.
-
-## Consumer map at supersession
-
-- `~/.config/opencode/scripts/memory_store.py` — in-process, `adaptive_exploration_rate` (line 820).
-- `~/.config/opencode/scripts/growth_simulator.py` — in-process, `record_query`.
-- `shared/graph_shard_bridge.py` — tolerant import (try/except), follows the switch.
-- `src/rune/tool_executor.py` — NOT a consumer (nominal grep hit only; goes through `memory_store.cached_recall`).
-
-## Verification commands (reproducible)
-
-- `/home/nick/.venvs/memory/bin/python3 src/rune/canary_query_memory.py` → 12/12
-- `/home/nick/.venvs/memory/bin/python3 src/rust/query_memory/canary_rust.py` → 27/27
-- `/home/nick/.venvs/memory/bin/python3 src/rune/ffi_query_memory_smoke.py` → 41/41
-- `/home/nick/.venvs/memory/bin/python3 /tmp/phaseG_parity.py` → ALL GREEN
-- `/home/nick/.venvs/memory/bin/python3 scripts/structural_coverage_audit.py` → exit 0, coverage 100%

plans/2026-10-03-phase-g-evidence-provenance-contract.md

@@ -1,66 +0,0 @@
-# Phase G Slice 2 — FROZEN CONTRACT: evidence-provenance (T7.3)
-
-Frozen: 2026-10-03, session ses_ffe5f08a7892affeGzZWhhm0wR. Branch `phase-g-strangler-evidence-provenance` (cut from slice-1 head `2ac2d0a`). Gitea issue #2449. Nothing below may change without a recorded amendment in this file.
-
-## 1. Scope (observed, not inferred)
-
-Six modules in `src/rune/`, 1796 lines total, one test file each as marked:
-
-| Module | Lines | Surface (grep-verified 2026-10-03) |
-|---|---|---|
-| `audit_ledger.py` | 231 | `_compute_hash(prev_hash, entry)`, `append_entry(entry_type, entry_id, details)`, `verify_chain() -> {valid, entries, reason}`, `get_entries(limit=50)`, `log_promotion(entry_id, old_status, new_status, wash_count, reason)`, `log_gate_result(entry_id, verdict, critics)`, `log_drift_alert(alert_type, message, severity)`, `main()` |
-| `behavior.py` | 411 | `connect()`, `add_correction(original, corrected, scope_tags=None, domain="", pattern="")`, `add_habit(trigger, action, name="", context_tags=None, min_activations=3)`, `match_context(context, match_type=None)`, `reinforce(item_id, outcome, item_type="habit")`, `list_items(item_type="all", limit=20)`, `behavior_stats()`, `main()`, `PLUGIN` dict |
-| `behaviour_ledger.py` | 251 | 9 state constants (UNVALIDATED…NOT_APPLICABLE) + `STATES` + `CONFIRMED_STATES` tuples, `BehaviourLedger` class |
-| `claim_audit.py` | 430 | `PATTERNS` list, `EVIDENCE_TAG` regex, `LEDGER_MARKERS`, `reframe(text)`, `scan(text)`, `verify(claim)`, `degrade(claim, verdict)`, `journal(entry)`, `report()`, `audit(draft)`, `handle_hook(event, data=None)`, `main()`, `PLUGIN` |
-| `evidence_probe.py` | 214 | `PROBE_STATUSES`, `PROBE_FIELDS`, `MAX_PROBES_PER_TASK=2`, `ProbeBudgetExceeded`, `ProbeResult`, `build_probe_prompt(question, artifact_path)`, `validate_probe(artifact)`, `count_probes(artifact_dir)`, `check_budget(artifact_dir)`, `record_probe(result, artifact_dir)`, `run_probe(question, artifact_dir, runner=None, model="UNKNOWN")` |
-| `verification_layer.py` | 259 | `VerificationResult`, seven `verify_*` functions (exit_code, unit_test, schema, file_exists, file_changed, tool_receipt, constraint_check), `verify(result, verifier_type)`, `handle_hook`, `PLUGIN` |
-
-Plus `shared/audit_ledger.py` (210 ln) — OLDER vintage of audit_ledger.
-
-## 2. Authority decisions (per module)
-
-- **src/rune/ is the authority vintage for all six modules** — hardened newer code (memory_env-pathed storage, defensive handling). The deployed `~/.config/opencode/scripts/{audit_ledger,behavior,claim_audit}.py` copies are OLDER vintages (hardcoded expanduser paths). The authority switch is a VINTAGE UPGRADE plus a language swap — not a mirror replacement.
-- `shared/audit_ledger.py` is superseded alongside the deployed copy (same older vintage, same defects).
-
-## 3. Live-data contract (the linchpin — observed)
-
-- **Live ledger:** `/home/nick/.config/opencode/memory/promotion_ledger.jsonl` (21 entries). `verify_chain()` under the deployed module's own defaults returns `{'valid': True, 'entries': 21, 'reason': 'chain intact'}` — OBSERVED 2026-10-03.
-- **Live signing key: `rune-drift-integrity-2024`** (the deployed/shared default). The src/rune default `rune-governed-adaptation-2024` FAILS the live chain — it is a latent break, recorded as a defect this slice fixes.
-- **Hash scheme (both vintages identical):** `HMAC-SHA256(key, (prev_hash + json.dumps(entry_without_hash, sort_keys=True)).encode()).hexdigest()`; genesis prev_hash = `"genesis"`; entry lines written with `json.dumps(entry)` in insertion order (type, entry_id, details, timestamp, prev_hash, hash); timestamp = `datetime.now(timezone.utc).isoformat()`.
-- **Key rule for the Rust candidate:** read `AUDIT_LEDGER_KEY` env; DEFAULT = `rune-drift-integrity-2024` (the key that verifies the live chain). Never default to the governed key — it verifies nothing that exists.
-- **Live `behavior.db`:** SQLite at memory_env memory dir, touched Sep 24 — must remain readable by the Rust candidate's storage layer.
-
-## 4. Rust candidate design
-
-Crate `/mnt/workdrive/rune/src/rust/evidence_provenance/` following the proven slice-1 shape: zero-dep core in `lib.rs`, `cdylib` FFI exports, hand-rolled JSON serialization where byte-parity demands it. **Port order within the slice** (dependency + risk order):
-
-1. **audit_ledger** — linchpin: live data, external consumers, key contract.
-2. **verification_layer** — pure logic, no storage, one test file; fastest port.
-3. **evidence_probe** — file-based budget/records; `rune_operator.py:581` consumer.
-4. **behaviour_ledger** — state machine, src/rune-only.
-5. **behavior** — SQLite habits; live DB; deployed vintage upgrade + `rune_tui.py` consumer.
-6. **claim_audit** — heaviest (warm-neuron store + graph DB + regex engine); last.
-
-Python-side ctypes loaders (`*_loader.py`) + deployed shims per slice-1 pattern, so every consumer keeps its import surface unchanged.
-
-## 5. Parity + qualification criteria
-
-- **Byte-parity:** Rust `verify_chain` output byte-identical to Python's on the live ledger AND on a mutation battery (tampered entry, broken chain, invalid JSON, empty ledger). Parity harness both sides, slice-1 pattern.
-- **Canaries:** Python-side canary module per ported module + Rust canary; both green before any switch.
-- **Shadow:** shadow-compare Rust vs Python on live-shaped data before authority switch.
-- **Performance:** like-for-like benchmark on the real consumption shape; no regression (Nick's law: combination does not decrease speed).
-
-## 6. Consumers + adoption plan (Nick's directive: adoption during the refactor)
-
-| Consumer | Imports | Switch |
-|---|---|---|
-| `~/.config/opencode/scripts/curator.py` | audit_ledger | at audit_ledger switch |
-| `canary_tui_drift.py`, `canary_full_system.py` | audit_ledger | at audit_ledger switch |
-| `rune_tui.py` (L62, L83) | claim_audit, behavior | at each module's switch |
-| `rune_operator.py:581` | evidence_probe (relative) | at evidence_probe switch |
-
-Deployed copies become ctypes shims at each module's authority switch (vintage upgrade included — the shim serves the src/rune contract, not the old vintage's). Old deployed Python deletions follow language-governance ⑥: only after the new is proven.
-
-## 7. Exit criteria
-
-All twelve doctrine steps discharged per module-port with observed evidence on #2449; coverage-audit registry remapped; supersession ledger written; audit regression gate green.

plans/2026-10-03-phase-g-evidence-provenance-supersession.md

@@ -1,62 +0,0 @@
-# Phase G slice 2 — evidence-provenance authority supersession ledger
-
-**Date:** 2026-10-03 · **Branch:** `phase-g-strangler-evidence-provenance` · **Unit issue:** conductor/rune#2449
-
-## What was superseded
-
-The pure-Python evidence-provenance implementations (six modules in `src/rune/`, 1796 lines; plus the two OLD deployed vintages and `shared/audit_ledger.py`) are RETIRED as production implementations for their ported surfaces. Production authority now rests with:
-
-1. **Rust crate `src/rust/evidence_provenance/`** — six cores: `lib.rs` (audit_ledger chain + FFI), `verification.rs` (7 verifiers), `probe.rs` (schema gate + budget), `behaviour.rs` (state machine), `habitmath.rs` (reinforce math), `claims.rs` (claim-audit decision skeleton); cdylib FFI (`ep_*` symbols, 21 total), zero external crates.
-2. **Python shims** at `src/rune/{audit_ledger,verification_layer,evidence_probe,behaviour_ledger,behavior,claim_audit}.py` — serving the src/rune authority contract through `ep_loader.py` (in-process, no interpreter startup for the ported logic).
-3. **Deployed shims** at `~/.config/opencode/scripts/{audit_ledger,behavior,claim_audit}.py` — same shape; audit_ledger + claim_audit + behavior carry the LIVE data-path rules (drift-key ledger, live behavior.db, real journal); claim_audit additionally carries the preserved SYMMETRY GUARD (deployed-vintage feature) and the repaired `scan_text()` TUI surface.
-
-## Port ledger (all six, in contract §4 order)
-
-| Port | Module | Rust core | Parity | Commit | Consumer proof |
-|------|--------|-----------|--------|--------|----------------|
-| 1 | audit_ledger | lib.rs chain ops | shadow 18/18; canaries 28/28+23/23 | `114c394`+`4b0d1d2` | live ledger entries 4242 (post-switch write), verify 23-intact |
-| 2 | verification_layer | verification.rs | 33/33 (7 verifiers + CLI render) | `9cb93e6` | contracts.py, canary_native, rune_operator:323 dataclass |
-| 3 | evidence_probe | probe.rs | 24/24 + consumer tests 23/23 | `3450a1c` | rune_operator:581/603, research_stage_executor:312 |
-| 4 | behaviour_ledger | behaviour.rs | 13/13 full-scenario | `8973caa` | testing_mode:19, iteration:23, rune_tui:3152 |
-| 5 | behavior | habitmath.rs | 16/16 + full-stack live-db | `2732677` | rune_tui:83; deployed vintage upgraded (live db read-verified) |
-| 6 | claim_audit | claims.rs | 17/17 + real-journal aggregate (1127 rows) | `969e39f` | rune_tui:62/2468/3752, contracts.py, hook_engine:270 |
-
-Errors: byte-equal (duplicate/unknown-behaviour/unknown-state; probe schema-gate lists incl. Python repr rendering; CLI argparse shapes + exit codes).
-
-## Strangler doctrine (master doc lines 685–770) — step discharge (slice level)
-
-| Step | Requirement | Evidence |
-|------|-------------|----------|
-| 1–4 | candidate built, contract frozen, parity proven | commits `114c394` → `969e39f`; frozen contract `plans/2026-10-03-phase-g-evidence-provenance-contract.md` (commit `7c68e41`); per-port parity harnesses ALL GREEN |
-| 5 | qualification | per-port parity + decision-math batteries; canary pair per port (Python 74/74, Rust 66/66 — all six port sections accumulated); performance follows the slice-1 in-process shape (no interpreter startup; same cdylib) |
-| 6 | canaries conformance | canary_audit_ledger.py 74/74; canary_evidence_provenance_rust.py 66/66 (per-port sections for ALL six ports; dual-mode LIVE/ISOLATED for live-ledger pins — run 18141 repair); embedded tests through shims (verification test, 23 consumer tests) |
-| 7 | shadow comparison vs live-shaped data | port-1 shadow 18/18 vs `939883d:shared/audit_ledger.py` (banked at `114c394`); ports 2–6 use direct byte-parity batteries vs the live originals (same discipline, stronger: full-document byte-quality) |
-| 8 | authority switch + observed consumer evidence | shims deployed + live-verified per port: entry 4242 (first post-switch ledger write), live behavior.db read through the port-5 shim, real 1127-row journal through the port-6 aggregation, TUI backend trio imports, TUI scan_text FIRST-EVER live call |
-| 9 | runtime evidence post-switch | post-switch walls per port: parity round-trips, embedded tests, consumer chains (rune.behaviour_ledger / rune.evidence_probe / rune.claim_audit + deployed trio) — all GREEN |
-| 10 | old production path unreachable | `import audit_ledger` (deployed consumers) → shim; `rune.behaviour_ledger` / `rune.evidence_probe` / `rune.claim_audit` / `rune.verification_layer` → shims; `shared/audit_ledger.py` had ZERO importers (verified by sweep incl. path-string forms) — DELETED |
-| 11 | old implementation removed or reference-only | `shared/audit_ledger.py` DELETED (this commit, after the proven wall + zero-importer sweep); six src/rune modules remain as shims (the API contract); original Python lives in git history. Coverage registry remapped: `audit_ledger` removed from SHARED_D; gate exit 0 post-deletion |
-| 12 | supersession ledger | THIS FILE |
-
-Deletion discipline (language-governance rule ⑥): `shared/audit_ledger.py` removed only after (a) the deployed shim proved live against the real ledger, (b) the shadow wall was green, (c) a zero-importer sweep across src/ shared/ scripts/ tests/. The remaining five src/rune originals were rewritten AS shims in their own commits (git history holds each original); they are the API contract and stay.
-
-## Vintage-merge disclosures
-
-- **SYMMETRY GUARD preserved:** the deployed `claim_audit` vintage carried `research_lens.symmetry_check` integration (2026-08-15) absent from src/rune — preserved in both shims (feature-preserving merge; load-bearing behavior).
-- **DEAD CONSUMER REPAIRED:** `rune_tui.py:3752` `claim_audit.scan_text()` had NO implementation in either vintage (silent try/except death) — now implemented, first-class, live-verified.
-- **Sequence break (port 1):** the audit_ledger shim was deployed BEFORE its canary pair existed; both canaries subsequently written and green — disclosed on #2449 comment 33817, not retrofitted.
-
-## Consumer map at supersession
-
-- `~/.config/opencode/scripts/rune_tui.py` — claim_audit (report L2468, scan_text L3752), behaviour (L3152), behavior (L83).
-- `src/rune/rune_operator.py` — evidence_probe (L581/603), VerificationResult dataclass (L323).
-- `src/rune/contracts.py` — dynamic `__import__` surfaces (verification_layer, claim_audit).
-- `src/rune/testing_mode.py:19` / `src/rune/iteration.py:23` — behaviour_ledger constants + class.
-- `scripts/research_stage_executor.py:312` — evidence_probe orchestration.
-- `~/.config/opencode/scripts/curator.py` / `canary_full_system.py` — audit_ledger (deployed shim).
-- `src/rune/dependency_tracker.py` — map-strings only (NOT an import).
-
-## Live-data rules (contract §3) — honored in the shims
-
-- Live promotion ledger: drift key verified 23-intact through the shim + FFI; explicit `AUDIT_LEDGER_KEY` override honored.
-- Live behavior.db: read/written through the deployed shim at `~/.config/opencode/memory/behavior.db`; parity scenarios ran on temp dirs only.
-- Live claim_audit journal (1127 rows): read-only aggregate through the Rust core; writes stay Python.

plans/2026-10-04-phase-h-go-frontend-rust-backend.md

@@ -1,97 +0,0 @@
-# Phase H plan — Go front end / Rust back end (Nick's architecture directive)
-
-Status: PLAN (awaiting Nick's sign-off before any code)
-Directive: USER-LOCKED (2026-10-04). Supersedes the KEEP-PYTHON verdicts in
-docs/rebase-language-rubric.md wherever they conflict.
-
-## 1. The directive
-
-Go owns the front end: runtime entry points, the first-call surface, the
-user-facing interface and its calls. Rust owns the back end: every core
-logic module. Python survives only as transitional glue inside a module
-until its own Go/Rust surface lands.
-
-## 2. What "front end" means concretely here
-
-From the runtime-audit memory (2026-09-10): the live entry chain is
-rune_tui -> send_task -> ContextBroker -> ModelRouter -> local/Cloud
-transports. The user-facing calls are: the TUI process itself, the CLI
-entry (python -m rune / rune binary), the operator message path, and the
-OpenAI-compatible /v1 endpoints MiMoCode serves.
-
-Candidates for the Go first-call layer, in dependency order:
-- rune binary (process entry, arg parsing, process lifecycle) — replaces
-  the Python module-loading bootstrap.
-- CLI/IPC command dispatch — the first-call surface that routes a user
-  command to the right back-end service.
-- The OpenAI-compatible HTTP endpoint surface (/v1 chat completions) —
-  stdlib net/http + NDJSON streaming is exactly the area the rubric called
-  Go's only capability-proven fit (W4 evidence, unchanged by the directive).
-- TUI: NOT in the first Go surface. Textual coupling is deep (80+ modules
-  per the rubric); the front-end Go layer first exposes the API the TUI
-  consumes, and the TUI itself migrates later as its own wave.
-
-## 3. What "back end" means concretely here
-
-All pure-logic modules move into the two existing zero-dep crates
-(evidence_provenance, query_memory) or a third crate for the remaining
-domains. The zero-external-crate discipline stands (the rubric's W4 Rust
-kill-rule for network code stays valid INSIDE Rust crates: no network code
-in crates, that belongs to the Go layer).
-
-Back-end candidates not yet ported (pure logic, no external deps):
-- drift_core, drift_cache, drift_compression (scored math) — memory umbrella
-- warm_neuron_store/warm_router scoring paths — memory umbrella
-- memory_store consolidation/scoring helpers — memory umbrella
-- capability_fit/capability_broker scoring — capability umbrella
-- tokenizer/counting helpers in token_optimizer — inference umbrella
-Each port follows the slice-2 pipeline: contract, zero-dep Rust, byte-parity
-battery vs the Python vintage, dual-mode canary, consumer import chain,
-CI green, supersession ledger.
-
-## 4. Sequencing (per wave, each independently mergeable)
-
-H0 — enablement (no behavior change):
-- Install Go on the host + the runner user's PATH; pin a version in
-  requirements-ci-equivalent (a go-version file + CI check).
-- CI: add a Go build+vet+test job (empty module, exits 0) so the pipeline
-  carries Go before any code lands.
-
-H1 — Go first-call shim:
-- Go binary `rune` replacing the Python entrypoint's process bootstrap:
-  arg parsing, env resolution, spawn the Python runtime (transitional).
-- Canary: same first-call contract (exit codes, env handoff, TTY attach).
-
-H2 — Go command dispatch + /v1 endpoint:
-- Go serves /v1 chat completions + CLI dispatch, calling the Python core
-  through the same local transport the TUI uses today.
-- Parity battery: request/response shapes vs the Python server for the
-  same canned conversations (byte-level for metadata, streaming NDJSON).
-
-H3 — back-end wave (parallel to H1/H2 where independent):
-- Ports listed in section 3, one or two modules per slice, same slice-2
-  discipline. No port starts without its parity battery written first.
-
-H4 — TUI migration wave (its own contract, later):
-- Only after H1-H2 prove the Go front end serves the same surfaces the TUI
-  consumes. The TUI is the largest single module (4k+ lines, Textual) and
-  earns its own contract.
-
-## 5. Honest constraints (carried from the rubric, not contradicted)
-
-- Go must be installed first (rubric D5 gate: it failed this before; the
-  directive now outweighs the gate but installation is still step zero).
-- Network/streaming code lives in the Go layer, never in Rust crates
-  (rubric W4: stdlib-only Rust has no credible HTTP/SSE precedent).
-- SQLite/regex/file-IO stay at their current language boundaries per the
-  zero-dep split law from slice 2 (math Rust, IO at the edges).
-- Every surface gets the same proof pipeline as slice 2: observed-not-
-  invented expectations, byte parity, dual-mode canary, CI green.
-
-## 6. Success measure
-
-The tranche is complete when: the `rune` process starts as a Go binary;
-user-facing calls (CLI, /v1, operator path) are served by Go; every core
-logic module on the port list is byte-parity Rust; Python remains only in
-surfaces explicitly contracted as keep-Python (TUI internals until H4,
-test harness, canary frameworks).

plans/2026-10-04-total-rebase-tranche.md

@@ -1,285 +0,0 @@
-# TOTAL REBASE TRANCHE — Rune to Go/Rust (R2)
-
-**Status:** DESIGN — awaiting Nick's approval gate (TRANCHE-DEPTH TEMPLATE §4)
-**Supersedes:** the KEEP-PYTHON rubric verdicts (already superseded by Nick's
-Go-front/Rust-back directive) and extends Phase H (H0–H4 slice 1, merged
-`693a494`, v0.90.0) from first ports to total rebase.
-**Nick's directives (verbatim anchors):**
-- "i want the whole codebase rebased in rust and go"
-- "everything should initiate with go as the runtime, and reactive adaptable
-  runtime should be go"
-- "the deterministic backend i.e memory storage, architectures and elastic
-  cognition and everything like that should be in rust"
-- "go should be the reactive front end to what interfaces with the user —
-  not gui — the deliverables and chat interactions as well as how rune
-  handles thoughts and runtime"
-- "the zero dependency rule should be in place but the rebase should rebuild
-  those aspects into the new architecture and make them operational"
-- "the textual tui should be last but everything should be wired into the
-  textual tui"
-- "start with the scaffolding first as everything relies on that, then use
-  the new rust scaffolding to make sure everything else is built towards
-  scaffold protocol"
-- "the scaffolding function should be a rust execution but go start"
-
-## 1. Grounding summary (measured 2026-10-04, from the spine store + wc)
-
-- 161 modules with source, **64,482 lines** of `src/rune/` Python.
-- Draft classification (rule-based, to be function-level verified in Wave 0):
-  - **RUST (deterministic backend):** 49 modules, 26,772 lines — memory,
-    drift, warm, capability, token, spine, scaffold, construction_*,
-    structural_store, curator, consolidation, elastic cognition, ledgers,
-    audit, evidence, contracts, sleep_time, subconscious, persona_gate,
-    context_broker, growth.
-  - **GO (reactive runtime + user-facing):** 10 modules, 7,043 lines —
-    operator, transports, dispatch, provider registry, adaptive router,
-    hook engine, local tool runtime, work manager, deploy_qualify.
-  - **TUI-last:** 4 modules, 4,889 lines — rune_tui (4,041), tui_validator,
-    tui_backlog, tui_transport.
-  - **UNCLASSIFIED (Wave 0 must disposition each with evidence):** 73
-    modules, 21,473 lines — voice_*, tool_executor, model_routing/registry,
-    event_bus, cron_engine, message_queue, identity_anchors, pins,
-    stage_guards, tier_manager, witness, etc.
-  - **Test infra:** 23 canary/test modules, 4,211 lines — rewritten per wave
-    (Rust canaries port with their surface; Go canaries for the front).
-  - **Retires:** `__init__`, `__main__`, `memory_env` (bootstrap glue —
-    subsumed by the Go runtime's env contract).
-- Existing Rust (merged, production-proven): 6 zero-dep crates
-  (query_memory, evidence_provenance, rune_spine, memory_scoring,
-  capability_scoring, token_counting), 338k bytes, all with parity
-  batteries. Go: rune-entry (H1 shim + H2 /v1 front door).
-- Stragglers from R1 folded in: #2171, #2119 (TUI), #1844 (salience_gate),
-  #1755 (goal._load), #1738 (failure_auto_filer).
-
-## 2. Objective
-
-Every line of rune's Python runtime is rebased into the dichotomy —
-**Go initiates and reacts; Rust determines and stores** — with the
-scaffolding protocol rebuilt FIRST (Go start / Rust execution) so every
-subsequent conversion is driven, checked, and closed by the new protocol
-itself. Python is deleted only after the replacement is parity-proven and
-CI-green (strangler exit law). The Textual TUI is last and stays the
-integration surface: everything wires into it over the transport seam.
-
-## 3. The hard constraint analysis (zero-dep + total rebase — feasibility)
-
-Nick asked: confirm or deny. **Confirmed possible**, amended per his
-critiques (2026-10-04):
-
-- **Hybridized membrane, not a wall (Nick's correction):** Go remains the
-  reactive initiator, but "Rust never touches a socket" is WITHDRAWN as an
-  absolute. The languages interoperate where coherence demands: Rust cores
-  callable from Go (the proven cdylib pattern), Go surfaces invocable from
-  Rust through defined channels, shared wire protocols. The dichotomy is
-  the DEFAULT placement rule; hybrid junctions are deliberate, contracted
-  exceptions — each recorded in the unit's contract.
-- **SQLite STAYS (Nick's ruling):** no bespoke storage engine in this
-  tranche. SQLite remains and is wired into the new architecture — the
-  Rust side reaches it through system-library FFI (legal under zero-dep:
-  a system library is not a crate dependency). The bespoke memory-system
-  redesign is a LATER, separate program.
-- **Reactivity/async:** Go goroutines + channels own the event loops;
-  Rust's deterministic cores stay synchronous behind the membrane.
-- **Regex:** hand-rolled matchers per case (proven: pyjson, word-run
-  scanner, run-collapse). No general regex engine needed.
-- **Parity-plus-improvement (Nick's upgrade):** parity is the FLOOR, not
-  the ceiling. Every unit answers "parity OR measurably better" —
-  efficiency improvements are in scope per function (Rust zero-copy and
-  exactness, Go goroutine-native concurrency), bloat from bad syntax is
-  removed, and functionality is the non-negotiable gate. Improvements
-  carry measurements; the parity battery proves no behavior regression
-  either way.
-- **TUI wiring is continuous (Nick's correction):** each landed surface
-  wires toward the Textual TUI over the transport seam as part of its
-  unit contract — the final TUI wave integrates a system already aimed
-  at it, not a retrofit.
-- **Language intelligence in the protocol (Nick's addition):** the
-  scaffolding gains a first-class placement decision — for rune, the
-  Go/Rust dichotomy rule (reactive/initiating → Go; deterministic/
-  stateful → Rust); for other projects, a language-fit assessment at
-  construction-classification time (the protocol recommends the right
-  language for the task's characteristics).
-- **Provenance lock (Nick's verification):** the scaffolding being ported
-  in Wave 1 is the V1-ACCEPTED system per docs/SCAFFOLDING_V1_DEFINITION.md
-  (T18 §18B; North Star = Nick's verbatim words; 17/17 acceptance gates).
-  The Wave 1 parity replay against the production contract ledger proves
-  the rebuild is that design, not a drift.
-
-## 4. Wave structure (each wave independently mergeable, scaffolding-gated)
-
-### Wave 0 — Grounding + inventory verification (the template's bar)
-- Function-level mapping of all 161 modules (the spine gives structure;
-  wave 0 verifies 100% of functions and classifies the 73 UNCLASSIFIED
-  with evidence).
-- Disposition the 5 R1 stragglers.
-- Produce the per-unit issue factory input: one issue per function,
-  each answering improve/fix/missing-connectors with evidence.
-- Deliverable: `plans/total-rebase-inventory.md` + issues filed.
-- Exit gate: inventory signed off by Nick (the approval gate).
-
-### Wave 1 — The scaffolding engine reborn (Go start / Rust execution)
-**Everything depends on this — it goes first, per Nick's directive.**
-- The rebuild target is the V1-ACCEPTED system (Nick's design —
-  docs/SCAFFOLDING_V1_DEFINITION.md, North Star verbatim, 17/17
-  acceptance gates). The parity replay against the production contract
-  ledger is the proof the rebuild IS that design.
-- Rust crate `scaffold_core`: the construction machinery as pure
-  deterministic logic — contract lifecycle (draft→approved→building→
-  verifying→closed), closure classification (correctly_predicted et al.),
-  scope resolution, legal transitions, the contract store.
-  Source modules: scaffold.py, construction_interface.py,
-  construction_decision.py, construction_intent.py, structural_store.py
-  (parts not already in rune_spine), contracts.py, toolchain.py.
-- Go surface `rune-scaffold` (extends rune-entry): the initiation layer —
-  submit-need/observe/transition/close CLI + /v1 endpoints, delegating to
-  the Rust core.
-- NEW per Nick: the **language-placement decision** lands in the protocol
-  here — construction classification gains a language-fit assessment
-  (rune: the Go/Rust dichotomy rule; other projects: characteristic-based
-  recommendation). Every later contract carries its placement verdict.
-- NEW per Nick: parity is the floor — the engine itself is the first
-  beneficiary of the parity-plus-improvement rule (measured improvements
-  allowed, functionality preserved, no-regression proven).
-- Exit gate: the R2 tranche's own remaining waves are driven THROUGH the
-  new engine (the protocol builds itself under its own rules).
-
-### Wave 2 — Memory/storage backend (Rust, SQLite retained)
-- SQLite is NOT replaced (Nick's ruling). The Rust memory core reaches it
-  via system-library FFI (zero-dep legal); memory_store.py (2,435 lines)
-  is decomposed: query paths and consolidation logic into Rust, the SQLite
-  mechanics behind a thin storage trait that maps to libsqlite3 today and
-  to the future bespoke engine LATER without consumer churn.
-- elastic_cognition, memory_consolidation, sleep_time, curator,
-  subconscious_pass, drift_* (remaining DB-backed surfaces), journal,
-  recall_* (recall_router is routing → boundary checked at Wave 0
-  disposition).
-- Data safety gate: checksum-verified read-back of the live store through
-  the new engine; zero writes until the read path is proven identical.
-
-### Wave 3 — Cognition + architecture engines (Rust)
-- The remaining deterministic cores: capability_broker decision logic,
-  context_broker, persona_gate, growth, identity_anchors, pins,
-  stage_guards, tier_manager, witness, safety_override, abstraction,
-  verification surfaces.
-- Ports already merged (memory_scoring, capability_scoring,
-  token_counting, rune_spine) are verified against the new scaffold
-  protocol and wired into the final architecture.
-
-### Wave 4 — The reactive runtime (Go)
-- The operator turn loop (rune_operator.py, 2,697 lines), chat
-  interactions, deliverables production, model routing at call time
-  (adaptive_router, model_registry/profiles/routing, provider_*),
-  tool execution (tool_executor, tool_protocol, local_tool_runtime),
-  event surfaces (event_bus, message_queue, cron_engine, hook_engine),
-  voice output chain (voice_*) as deliverable production.
-- The /v1 surface deepens to carry the full interaction contract;
-  NDJSON streaming becomes the standard response shape.
-
-### Wave 5 — Python retirement sweep
-- Every Python module whose surfaces have landed is deleted (strangler
-  exit: parity proven + CI green + deployed one cycle). Shared/ vintage
-  mirrors retired with them.
-- The glue shims (ms_loader, cs_loader, tc_loader, spine_loader) retire
-  when their consumers no longer speak Python at all.
-
-### Wave 6 — TUI last (but wired continuously)
-- Every wave before this one ships its transport-seam wiring toward the
-  TUI as part of each unit's contract (Nick's correction: natural,
-  continuous wiring — not a retrofit wave).
-- Then the TUI itself: a thin Textual render shell over the wire (all
-  logic already Go/Rust by then) or a port — disposition decided on the
-  evidence of everything that came before.
-
-### Wave 7 — Final audit
-- Language-bar measurement, the full scaffolding ledger replayed, the
-  tranche's closure report with per-wave evidence.
-
-## 5. Per-unit discipline (the template, unchanged)
-
-- One issue per function via the issue factory; each answers
-  improve/fix/missing-connectors with evidence.
-- Every unit runs the scaffolding pipeline end-to-end: submit-need →
-  contract → approval → canary-first (red proven) → implementation →
-  parity battery vs the Python vintage → closure audit (structural ids,
-  never file paths — the closure vocabulary law).
-- Per-unit decisions on evidence, never pre-decided globally: each
-  function's Go-vs-Rust placement is assessed by the dichotomy rule with
-  the measured call graph, not by the draft classification alone.
-- Bug-fix contract governs every defect found en route (red test first,
-  regression frozen).
-
-## 6. Verification gates
-
-- CI green per wave (crate builds, Go vet/test/build, canaries, henxels,
-  type ratchet until the Python ratchet itself retires in Wave 5).
-- Parity batteries are byte-level for deterministic surfaces, shape-level
-  modulo volatile fields for wire surfaces.
-- The scaffolding closure audit for every contract: correctly_predicted
-  or honestly flagged, never silent.
-- Deploy qualification per merge (the pipeline that proved itself today).
-
-### The 90/100 coverage law (Nick, 2026-10-05 — GOVERNING from W3.4 on)
-
-Per Nick: "if it's realistically achievable but aim higher also if that's
-realistically achievable. go to 100% where achievable."
-
-- **100% where achievable — the deterministic Rust kernels.** Every kernel
-  crate (memory_retrieval, cognition_core, scaffold_core, memory_storage,
-  and every future crate) targets 100% BRANCH coverage via its parity
-  matrices + the pytest shim battery: every branch has real reachable
-  semantics, and exhaustive enumeration is exactly what the batteries do.
-  Achievability is measured per crate at wave close; a kernel below 100%
-  carries the named unreachable case or it isn't done.
-- **≥90% on the changed-lines bar (diff-cover), aiming higher.** The floor
-  stays a floor; the working standard per slice is 90%+ on changed lines;
-  whatever a slice achieves beyond 90 becomes the next slice's personal
-  benchmark (per-unit "aim higher" — the number climbs wave over wave).
-  The floor ratchet itself moves after consecutive clean waves
-  (70 → 76 → 84 → 90; each raise is a commit, never a step down).
-- **Glue/failure branches: 90%+ with byte-compare proofs.** The stubs and
-  probe branches that only fire in a broken world are covered by honest
-  fixtures (real import-failure probes like the from-import resolution
-  law) — never by fake-triggered pragmas. A branch covered by a lying
-  fixture is WORSE than uncovered; if it can't be honestly reached, it's
-  named in the wave's closure report with the reason.
-- **Assertion quality is part of the bar.** A test that touches a line
-  without verifying its OUTPUT doesn't count toward the bar — byte-compare
-  / exact-value asserts are the standard; "is not None" assertions reject
-  at review.
-
-## 7. Risk register
-
-- **SQLite FFI correctness** (Wave 2) — the storage layer is retained but
-  re-wired; mitigations: read-path proven identical before any write,
-  checksum-verified read-back of the live store, the storage trait
-  boundary keeps the future bespoke swap cheap.
-- **Hybrid membrane drift** — junctions multiply ad-hoc if ungoverned;
-  every Go↔Rust interaction point is a contracted, recorded decision in
-  its unit's contract (the dichotomy is the default; hybrids justify
-  themselves per unit).
-- **Improvement regressions** — parity-plus-improvement invites subtle
-  behavior changes; every improvement carries a measurement AND the parity
-  battery stays authoritative for no-regression.
-- **Go↔Rust call latency** — measure in Wave 1; the architecture assumes
-  local transport cost is negligible vs model latency; if measured wrong,
-  the membrane's transport moves (decision recorded, not improvised).
-- **Context-window economics** — 1,852-style issue volumes mean the
-  pipeline must multiplex (no-wait law) and local models carry routine
-  units (custodian pattern).
-- **Scope creep during Wave 0** — the inventory is measured and frozen
-  before design; additions go through scope amendments.
-
-## 8. Rollback
-
-- Every wave merges independently; master stays deployable at each
-  boundary (the strangler's whole point).
-- The Python vintage remains until Wave 5 deletion gates pass; a wave
-  revert = revert the merge commit (deploy qualification re-runs).
-- The scaffolding engine's Wave 1 parity replay means even the protocol's
-  own replacement is reversible against recorded history.
-
-## 9. Approval gate
-
-This tranche does not execute until Nick approves. On approval, Wave 0
-starts immediately and runs without consent blockers (standing directive),
-with self-verified checkpoints and defect filing.

plans/2026-10-06-full-dichotomy-rebase-tranche-v2.md

@@ -1,262 +0,0 @@
-# TRANCHE: THE FULL DICHOTOMY REBASE v2 — every Python module replaced, zero Python runtime
-
-_Revised per Nick's corrections: Bubble Tea for the TUI, henxels scope first, HOW instructions per step, Gitea epic + MiMoCode tasks, timeline = 1 week. Presented for approval._
-
----
-
-## §0 — GROUNDING (measured)
-
-| Language | Files | Lines | % | Status |
-|---|---|---|---|---|
-| Python | 180 | 68,224 | **70%** | **THE TARGET — every module ported** |
-| Rust | 106 | 27,304 | 28% | 10 crates, 85 more modules to port |
-| Go | 7 | 1,125 | **1%** | 2 modules, 55 more to port |
-| **Total** | **293** | **96,653** | | |
-
-### The corrected dichotomy
-
-| Side | Modules | Python lines | Role |
-|---|---|---|---|
-| **GO** | 57 | 32,081 | Reactive shell: initiates, responds, routes, interfaces |
-| **RUST** | 85 | 25,218 | Deterministic backend: computes, stores, pure functions |
-| **TUI** | 7 | 5,435 | **Bubble Tea (Go)** — rewritten in Wave 7 |
-| **TEST** | 29 | 5,397 | Test infrastructure — stays Python (pytest) |
-
-### Keep-greens
-
-Full test suite (2,300+, 0 failures) · All 25 registered canaries · diff-cover ≥70% · Silent-handler ratchet (BLE001 ≤345, S110 ≤75) · Henxels all hold · Lint-baseline no increase · Deploy monotonic
-
----
-
-## §1 — OBJECTIVE
-
-**Zero Python files in `src/rune/`.** Every module replaced by its Go or Rust equivalent. The TUI is rewritten in Bubble Tea (Go). Test infrastructure stays Python. The end state is a Go+Rust codebase with zero Python runtime dependency.
-
-Timeline: **1 week** (5 working days, aggressive but achievable with the wave structure below).
-
----
-
-## §2 — WAVE 0: INFRASTRUCTURE FIRST (Day 1, morning)
-
-**This impacts everything else. Done before any porting.**
-
-### Step 1: Henxels scope extension
-- Add `src/rust/*/` scope to `henxels.yaml`: max_lines 3000 (Rust files are larger), no_secrets, filename_casing snake_case, canary registration
-- Add `src/go/**/` scope: max_lines 2000, no_secrets, filename_casing kebab-case
-- Add `new_rune_modules_have_canary_or_test_coverage` for both scopes
-- Verify: `henxels check --all` passes with the new scopes
-
-### Step 2: Umbrella manifest extension
-- Add 10 Rust crate entries to `config/umbrellas.json` (cognition_core, memory_retrieval, memory_storage, scaffold_core, evidence_provenance, rune_spine, memory_scoring, capability_scoring, token_counting, query_memory)
-- Add 2 Go module entries (event-bus, tool-executor) + placeholder entries for the 55 planned Go modules
-- Each entry: name, description, modules list, depends_on, canaries
-- Verify: `umbrella_manifest_is_complete` henxel passes
-
-### Step 3: Scaffolding protocol update
-- Update `construction_decision.py` GO_SIGNALS/RUST_SIGNALS to match the corrected dichotomy (57 GO / 85 RUST)
-- Update `store/rebase/classification.json` with the re-classified sides
-- Verify: `rune scaffold classify <test_objective>` routes to the correct language
-
-### Step 4: CI pipeline update
-- Add `cargo build --release --manifest-path src/rust/cognition_core/Cargo.toml` to the unit-tests and canary jobs
-- Add `CC_RUST_LIB` to the unit-tests job env
-- Add a `go-build` step that builds every Go module in `src/go/*/`
-- Add a `go-test` step that runs `go test ./...` in every Go module
-- Verify: CI pipeline passes with the new steps
-
-### Step 5: Gitea epic + MiMoCode tasks
-- Create the parent epic on Gitea: "Full Dichotomy Rebase — every Python module replaced" with the full wave structure as a folded checklist
-- Create per-wave sub-epics (W4-infra, W4b-tools, W5a-model, W5b-operator, W5c-memory, W6a/b/c-RUST, W7-TUI)
-- Mirror all of them in the MiMoCode task tool
-- Verify: the Gitea epic exists, the MiMoCode task tree matches
-
----
-
-## §3 — WAVE STRUCTURE
-
-### Wave 4: Go reactive infrastructure (14 modules, ~5,271 lines) — Day 1-2
-
-| Module | Size | HOW |
-|---|---|---|
-| event_bus | 244 lines | **DONE** — `src/go/event-bus/` |
-| event_envelope | 303 lines | Merge into event-bus binary. Add EventEnvelope struct with all fields (event_id, event_type, partition_key, payload_hash, timestamp). Port `OrchestrationRecord.to_dict()` as a `MarshalJSON()` method. |
-| message_queue | 10KB | Go channel + JSONL file backing. `type MessageQueue struct { mu sync.Mutex; path string }`. Methods: `Enqueue(msg)`, `Dequeue()`, `GetApproved()`, `MarkExecuted(id)`. Port the approved-message flow from Python. |
-| hook_engine | 28KB | Go map of hook name → []func(data) error. `type HookEngine struct { hooks map[string][]HookFunc; mu sync.RWMutex }`. Methods: `Register(name, fn)`, `Fire(name, data) error`, `FireAsync(name, data)`. Load hooks from a JSON config file. |
-| microkernel | 14KB | Go interface-based plugin system. `type Plugin interface { Name() string; Capabilities() []string; OnMessage(data) error }`. Registry with `Register(p Plugin)`, `Fire(event, data)`. Uses goroutines for parallel plugin dispatch. |
-| subsystem_health | 6KB | Go struct with `sync.Mutex`. `type SubsystemHealth struct { failures map[string][]Failure }`. Methods: `RecordFailure(subsystem, err, tier)`, `GetHealth() map[string]HealthStatus`. Write to a JSON file for durability. |
-| parallel_processor | 5KB | Go goroutines + `sync.WaitGroup`. `func ParallelMap(items []T, fn func(T) T) []T`. Run fn in goroutines, collect results. |
-| work_manager | 20KB | Go worker pool. `type WorkManager struct { workers int; queue chan Task; results chan TaskResult }`. Methods: `Start()`, `Submit(task)`, `Stop()`. Goroutines pull from the channel. |
-| failure_auto_filer | 21KB | Go struct with a spool file + forge client. `type FailureFiler struct { client ForgeClient; spool *JsonlSpool }`. Methods: `File(failure)`, `Reconcile()`. Uses the existing `create_forge_client()` pattern. |
-| cache | 16KB | Go `sync.Map` or LRU cache. `type Cache struct { mu sync.RWMutex; data map[string][]byte; maxAge time.Duration }`. Methods: `Get(key)`, `Set(key, val)`, `Invalidate(key)`. |
-| connection_pool | 3KB | Go channel-based pool. `type Pool struct { conns chan Conn; factory func() Conn }`. Methods: `Get() Conn`, `Put(conn)`. |
-| cron_engine | 14KB | Go time.Ticker + task list. `type CronEngine struct { tasks []CronTask; mu sync.Mutex }`. Methods: `AddTask(name, expr, fn)`, `Start()`, `Stop()`. Parse cron expressions with a simple parser. |
-| night_mode | 14KB | Go scheduled consolidation. Uses the cron_engine internally. `type NightMode struct { engine *CronEngine; tasks []NightTask }`. |
-| recall_router | 5KB | Go routing table. `type RecallRouter struct { routes map[string]RecallFn }`. Method: `Route(query) []RecallResult`. |
-
-**Daily check**: all 14 Go binaries compile, their tests pass, the Python versions delegate via subprocess.
-
-### Wave 4b: Go tool execution layer (3 modules, ~3,079 lines) — Day 2
-
-| Module | Size | HOW |
-|---|---|---|
-| tool_executor | 73KB | **STARTED** — add the remaining operations: write_file (with path validation + ACL), edit_file (with diff preview), run_tests (go test), lint_file, git_commit, git_diff, git_log, repo_map, read_persona, query_memory, check_growth, diagnose_behavior, find_capability |
-| tool_protocol | 16KB | Go types: `type ToolRequest struct { CallID, Name string; Args map[string]any; Source string }`, `type ToolEvent struct { Kind string; Request ToolRequest; Result map[string]any }`. Validation against a JSON schema registry. |
-| local_tool_runtime | 35KB | Go loop: receive model response → parse tool calls → validate → dispatch to executor → feed results back. `type LocalToolRuntime struct { transport Transport; tools []ToolDef; maxIterations int }`. Methods: `Run(messages, options) OperatorResponse`. |
-
-**Daily check**: all tool operations work end-to-end in Go.
-
-### Wave 5a: Go model/provider layer (10 modules, ~3,398 lines) — Day 2-3
-
-All 10 modules go into ONE Go binary: `src/go/model-connect/`.
-
-| Module | Size | HOW |
-|---|---|---|
-| model_connect | 16KB | Go HTTP client for Ollama. `type OllamaClient struct { baseURL string; client *http.Client }`. Methods: `Chat(model, messages, options) ChatMessage`, `Show(model) ModelInfo`, `Pull(model)`, `ListModels()`. |
-| model_profiles | 16KB | Go struct: `type ModelProfile struct { Name string; Provider string; ContextLength int; Capabilities []string }`. Load from JSON. |
-| model_registry | 6KB | Go registry: `type ModelRegistry struct { profiles map[string]ModelProfile; mu sync.RWMutex }`. Methods: `Register(p)`, `Get(name)`, `List()`. |
-| model_routing | 16KB | Go router: `type ModelRouter struct { profiles *ModelRegistry; defaultModel string }`. Method: `Route(taskDescription) string`. Scoring: keyword matching + profile capabilities. |
-| openai_compat_transport | 10KB | Go HTTP client for [OI]-compatible APIs. `type CompatTransport struct { baseURL, apiKey string; client *http.Client }`. Same Chat() interface. |
-| provider_budget | 12KB | Go struct: `type ProviderBudget struct { providers map[string]Budget; mu sync.Mutex }`. Methods: `Record(provider, tokens)`, `GetStatus() map[string]BudgetStatus`. |
-| provider_context | 2KB | Go context type: `type ProviderContext struct { Provider, Model string; ContextLength int }`. |
-| provider_registry | 23KB | Go registry for all providers (Ollama + [OI] + custom). `type ProviderRegistry struct { providers map[string]Provider; mu sync.RWMutex }`. Methods: `Connect(name, url, key)`, `GetProvider(name)`, `ListProviders()`. |
-| standardized_providers | 9KB | Go interface: `type Provider interface { Chat(...) ChatMessage; Show(...) ModelInfo; ListModels() []string }`. Implementations: OllamaProvider, CompatProvider. |
-| tiered_executor | 9KB | Go executor with tier escalation: `type TieredExecutor struct { tiers []Tier; current int }`. Methods: `Execute(task) Result`, `Escalate()`. |
-
-**Daily check**: Ollama chat works from Go, model routing works, budget tracking works.
-
-### Wave 5b: Go operator (19 modules, ~9,637 lines) — Day 3-4
-
-The biggest wave. ALL of these go into ONE Go binary: `src/go/operator/`.
-
-| Module | Size | HOW |
-|---|---|---|
-| rune_operator | 126KB | The turn loop. `type Operator struct { state *RuneState; taskState *TaskStateRepo; conversation *ConversationRepo; toolRuntime *LocalToolRuntime; modelRouter *ModelRouter }`. The main method: `Respond(channel, message) OperatorResponse`. This is the biggest single port — expect 2-3k lines of Go. |
-| adaptive_router | 23KB | `type AdaptiveRouter struct { routes []Route; baselineSHA string }`. Method: `Route(task) RouteDecision`. Route types: LOCAL_FIX, STANDARD_CHANGE, RESEARCHED_CHANGE, etc. |
-| build_mode | 20KB | Go build orchestrator: `type BuildMode struct { operator *Operator; scaffold *ScaffoldClient }`. Method: `Execute(task) BuildResult`. |
-| builder_bridge | 12KB | Go bridge: dispatches build tasks to external builders (MiMo, Kimi, GLM). `type BuilderBridge struct { builders map[string]Builder }`. |
-| builder_bridge_cli | 1KB | Thin CLI wrapper for builder_bridge. |
-| core_server | 9KB | Go HTTP server: `http.ListenAndServe(":8080", mux)`. Routes: `/v1/chat`, `/v1/models`, `/health`. Uses Go's `net/http` stdlib. |
-| persona_definition | 7KB | Go struct: `type Persona struct { Name, Role, Voice string; Principles []string }`. Load from JSON. |
-| voicebox | 4KB | Go voice synthesis dispatch. |
-| voice_injector | 3KB | Go voice injection. |
-| release_notes | 18KB | Go release note generator. Reads closed contracts + resolved issues from the Gitea API. Generates markdown. |
-| auto_context | 8KB | Go auto-context builder. Scans recent events + memory to build a context block. |
-| auto_tasks | 15KB | Go auto-task extraction from conversation. |
-| event_wait | 23KB | Go event-driven wait. `type EventWait struct { watchers map[string]chan Event; mu sync.RWMutex }`. Methods: `Register(op, contractID)`, `Await(op, timeout) <-chan Event`. |
-| evidence_probe | 7KB | Go evidence probe: spawns a subprocess to resolve an unknown. |
-| forge | 5KB | Go forge adapter interface. |
-| forge_client | 7KB | Go forge client (Gitea API). |
-| goal | 14KB | Go goal management: `type GoalManager struct { goals []Goal; mu sync.Mutex }`. |
-| growth_delta | 16KB | Go growth delta extraction. |
-| warm_router | 55KB | Go warm routing: scans memory store, scores relevance, builds context. The second biggest module. |
-
-**Daily check**: the operator turn loop works end-to-end in Go — user sends a message, operator routes, dispatches to Rust kernels, returns a response.
-
-### Wave 5c: Go memory operations (8 modules, ~8,240 lines) — Day 4
-
-| Module | Size | HOW |
-|---|---|---|
-| memory_store | 99KB | Go SQLite operations via `mattn/go-sqlite3` (cgo) or `modernc.org/sqlite` (pure Go). `type MemoryStore struct { db *sql.DB }`. Methods: `AddEntry(entry)`, `SearchEntries(query)`, `GetEntry(id)`, `Supersede(id)`, `WashEntry(id)`. THIS IS THE BIGGEST SINGLE PORT — expect 3-5k lines of Go. |
-| curator | 70KB | Go memory curation: scans the store, identifies conflicts, promotes/demotes. `type Curator struct { store *MemoryStore; mu sync.Mutex }`. |
-| sleep_time | 38KB | Go sleep-time consolidation: runs during idle periods. Uses the consolidation kernel (Rust) for the compute. |
-| memory_consolidation | 31KB | Go consolidation orchestrator. Calls the Rust kernel (already ported) for the record assembly. |
-| persona_gate | 24KB | Go persona gating: checks responses against persona principles. |
-| abstraction | 22KB | Go abstraction: fact extraction (kernel already in Rust). |
-| witness | 15KB | Go witness: signal extraction + reflection dispatch. |
-| stage_guards | 12KB | Go stage guards: readiness/exit canaries for construction stages. |
-
-**Daily check**: memory operations work end-to-end in Go, SQLite reads are byte-identical.
-
-### Wave 6: The Rust deterministic backend (85 modules, ~25,218 lines) — Day 4-5
-
-Three sub-waves. Each module becomes a `pub fn` in the appropriate crate.
-
-**Wave 6a** (30 modules): structural core → `src/rust/construction/`
-- spine, structural_store, construction_decision, construction_interface, construction_commands, construction_intent, construction_mode, construction_pattern, construction_patterns_builtin, construction_projection, construction_depth, construction_activation, contracts, capability_broker, capability_fit, capability_ledger, audit_ledger, behaviour_ledger, claim_audit, outcome_ledger, build_basis, project_registry, system_registry, layout_contract, structural_migration, structural_model
-- HOW: each Python module's functions become `pub fn` in a shared `construction` crate. Data structures become Rust structs with serde. The Python module becomes a thin FFI caller via the existing `sc_loader` pattern.
-
-**Wave 6b** (30 modules): cognition layer → `src/rust/cognition/`
-- drift_core, drift_compression (already in Rust), drift_cache, drift_ledger, drift_observability, drift_resume, graph_memory, graph_projection, memory_selector, identity_anchors, pins (already in Rust), salience_gate, self_improve, token_optimizer, cognitive_budgeter, context_pressure, inference_trace, recall_uplift, response_adapter, route_risk_flags, rune_profiler, rune_spinner, safety_override (already in Rust), shard_manager, progressive_escalation, failure_recovery, intent_continuity, impact_preview, iteration, task_gate
-- HOW: each module's deterministic functions become `pub fn` in the `cognition_core` crate (extending the existing broker.rs).
-
-**Wave 6c** (25 modules): remaining → the appropriate crate
-- voice_hybrid, voice_sync, prompt_sync, time_awareness, toolchain, verification_layer, task_persist, testing_mode, wait_guard, wait_guard_corpus, warm_neuron_store, layout_contract, structural_migration, structural_model, programme_continuation, programme_gates, subconscious_pass, attention_capsule, dependency_tracker, ffi_query_memory_smoke
-- HOW: same pattern — Rust `pub fn` in the appropriate crate, Python FFI caller.
-
-**Daily check**: each crate compiles, its tests pass, the Python delegation works.
-
-### Wave 7: Bubble Tea TUI (Go) — Day 5
-
-| What | Python lines | Go target |
-|---|---|---|
-| rune_tui.py (the whole TUI) | 4,038 | `src/go/tui/` |
-
-**HOW:**
-1. Install Bubble Tea + Lipgloss + Bubbles: `go get github.com/charmbracelet/bubbletea github.com/charmbracelet/lipgloss github.com/charmbracelet/bubbles`
-2. Port the layout: `type Model struct { chatChan, taskChan ChannelView; workPane WorkPane; statusBar StatusBar }` — chat LEFT, task RIGHT
-3. Port the message rendering: chat bubbles with `lipgloss.Style{}.Foreground()`
-4. Port the command selector: Bubble Tea's `textinput` + `completions` component
-5. Port the keybindings: Ctrl+1 (chat), Ctrl+2 (task), Ctrl+3 (work pane)
-6. Port the status bar: version, mode, model, project, focused channel
-7. Port the post-response signal consolidation (one dim line)
-8. Wire the operator: the TUI calls the Go operator directly (same process) — no subprocess, no FFI, just function calls
-9. Animations: Bubble Tea supports animations via `tea.Tick` and `tea.Every` — spinners, progress bars, streaming text. Lipgloss supports colors, borders, padding. Pixel art is possible via block characters and custom rendering.
-10. Design: retain the current two-column layout (chat LEFT, task RIGHT) + work pane. Use Lipgloss for the same visual style. Port the chat bubble rendering, the thinking indicator, the tool call display.
-
-**Exit condition**: `go build ./src/go/tui/` produces a statically-linked binary that IS the Rune TUI. `find src/rune -name '*.py'` returns 0.
-
----
-
-## §4 — THE GITEA EPIC STRUCTURE
-
-The FIRST task posted to Gitea is the parent epic:
-
-**Epic #N: "Full Dichotomy Rebase — every Python module replaced"**
-
-Folded checklist inside the epic:
-- [ ] Wave 0: Infrastructure (henxels scope, umbrella manifest, scaffolding protocol, CI update)
-- [ ] Wave 4: Go reactive infrastructure (14 modules) — sub-epics per module
-- [ ] Wave 4b: Go tool execution (3 modules) — sub-epics per module
-- [ ] Wave 5a: Go model/provider (10 modules) — sub-epics per module
-- [ ] Wave 5b: Go operator (19 modules) — sub-epics per module
-- [ ] Wave 5c: Go memory operations (8 modules) — sub-epics per module
-- [ ] Wave 6a: Rust structural core (30 modules) — sub-epics per module
-- [ ] Wave 6b: Rust cognition (30 modules) — sub-epics per module
-- [ ] Wave 6c: Rust remaining (25 modules) — sub-epics per module
-- [ ] Wave 7: Bubble Tea TUI (7 modules) — sub-epics per module
-
-Each sub-epic contains the HOW instructions per the template in §3.
-
-MiMoCode task tool mirrors the same structure: T-tranche → T4-infra → T4.1-event-bus, T4.2-hook-engine, etc.
-
----
-
-## §5 — BUBBLE TEA CAPABILITIES (answering Nick's question)
-
-**Animations**: Yes. Bubble Tea has `tea.Tick` (one-shot timer) and `tea.Every` (recurring). Spinners via the `bubbles/spinner` component. Progress bars via `bubbles/progress`. Streaming text via incremental updates.
-
-**Pixel art**: Possible via block characters (█ ▄ ▀ ▌ ▐) and custom renderers. Not true pixel-level control (it's a terminal), but with Unicode block elements and 256-color/truecolor support, you can get very close. Lipgloss supports borders, padding, alignment, colors, and gradients.
-
-**Presentable**: Yes. Bubble Tea + Lipgloss is what popular Go CLI tools use (gh, glow, soft-serve). It looks professional and modern.
-
-**Retaining the current design**: The two-column layout (chat LEFT, task RIGHT), the work pane, the status bar, the command selector, the chat bubbles — all of these map directly to Bubble Tea components. The visual style can be replicated with Lipgloss. The keybindings map directly.
-
----
-
-## §6 — TIMELINE
-
-| Day | Waves | Modules | Lines |
-|---|---|---|---|
-| Day 1 (morning) | Wave 0 | Infrastructure | N/A (config changes) |
-| Day 1-2 | Wave 4 + 4b | 17 Go modules | ~8,350 |
-| Day 2-3 | Wave 5a + 5b | 29 Go modules | ~13,035 |
-| Day 4 | Wave 5c | 8 Go modules | ~8,240 |
-| Day 4-5 | Wave 6a + 6b + 6c | 85 Rust modules | ~25,218 |
-| Day 5 | Wave 7 | 7 Bubble Tea modules | ~5,435 |
-| **Total** | **5 days** | **180 modules** | **~68,224** |
-
----
-
-## §7 — APPROVAL GATE
-
-Read this. Argue with it. Approve or request changes. Once approved, execution starts at Wave 0 (infrastructure first, because it impacts everything else).

plans/2026-10-06-full-dichotomy-rebase-tranche-v3.md

@@ -1,354 +0,0 @@
-# TRANCHE v3: THE FULL DICHOTOMY REBASE — with HOW, with language advantages, with automated verification
-
-Nick's corrections applied:
-- Umbrella manifest feeds the spine (not superseded); both need updating
-- construction_decision.py itself gets ported (Go start + Rust execution)
-- Language advantages are part of every port — improvements where the target language is better
-- Automated parity verification BEFORE gutting the Python (hard gate, no manual checking)
-- A testing document that proves bigger features work after each wave
-- Maximise Bubble Tea addons (research the ecosystem)
-- No arbitrary timeframe — it gets done when it gets done
-- Every task follows on to the next — never stopping
-- CI stacking: keep submitting PRs; address CI issues in batches of 5, not individually
-
----
-
-## THE CORE MECHANISM: How every module gets replaced
-
-Every module follows the same seven-step process. No exceptions. The process IS the verification.
-
-### Step 1: Understand the Python module
-Read every function. Identify: what does it compute (→ Rust), what does it initiate (→ Go), what does it store (→ Rust), what does it route (→ Go). Note every caller. Note every file it reads/writes.
-
-### Step 2: Write the replacement in the target language
-For Rust: a `pub fn` in the appropriate crate, with serde-compatible structs.
-For Go: a method on a struct in the appropriate `src/go/<name>/` package.
-
-**Language advantage check**: at this step, ask "does Go/Rust do this BETTER than Python did?" If yes, implement the improvement. Examples: Go goroutines replace Python threading for parallel operations. Rust's zero-cost abstractions replace Python duck typing for hot-path scoring. Go's `net/http` replaces Python `urllib` for model connections with connection pooling and keep-alive.
-
-### Step 3: Write the parity test (RED first)
-Before touching the Python module, write a test that runs the same input through BOTH the Python oracle and the new Go/Rust implementation, and asserts the outputs are identical. This test must FAIL before the implementation is correct, and PASS once it is. The test is the gate.
-
-### Step 4: Verify parity — the HARD GATE
-Run the parity test. If it passes, the replacement is PROVEN to work. Only now can you proceed to Step 5. If it fails, debug the Go/Rust implementation until it passes. **Do not gut the Python until this gate passes.** This is automated — you never have to manually check.
-
-### Step 5: Rewire the Python module as a delegation shim
-Replace the Python function body with a call to the Go binary (subprocess) or the Rust kernel (ctypes/cgo). Every existing caller of the Python module keeps working — they don't know the implementation changed.
-
-### Step 6: Register the canary in CI
-The parity test from Step 3 is registered in `.gitea/workflows/ci.yml`. Now every future commit is checked against the parity contract automatically.
-
-### Step 7: PR → CI → merge
-Push the branch, let CI run. If CI raises issues, DON'T STOP — continue to the next module's port. Address CI issues in batches of 5. The pipeline is proven; it catches things; you fix them in batches.
-
-**The key insight**: Step 4 (the parity gate) is the answer to "how do you confirm replacements working before you gut it?" You don't gut anything until the automated test proves the replacement produces identical output. The test is the contract.
-
----
-
-## THE TESTING DOCUMENT: proving bigger features after each wave
-
-After each wave completes, a WAVE VERIFICATION DOCUMENT is produced that proves the system works end-to-end. Not unit tests — integration tests.
-
-### What it contains:
-1. **The operator turn loop works**: send a message through the Go operator, get a response back, verify the response is correct
-2. **Memory operations work**: store a memory, recall it, verify the content matches
-3. **Tool execution works**: execute a tool call, verify the output
-4. **The TUI renders**: launch the Bubble Tea TUI, verify it displays
-5. **The event journal works**: emit an event, read it back
-6. **The scaffolding works**: submit a need, verify the contract is created
-
-### How it's generated — BY THE GITEA PIPELINE, not by the agent:
-A shell script (`scripts/wave_verify.sh`) is written by the agent. A CI workflow step runs the script after each wave merge. The CI step formats the results as markdown and posts them as a comment on the wave's Gitea epic. The document is permanent — attached to the epic, survives session restarts, reproducible (the commands are in the document), automated (CI runs it, not the agent).
-
-### Implementation:
-- `scripts/wave_verify.sh` — the integration verification script
-- A CI workflow step (in ci.yml or a new `wave-verify.yml`) that runs the script and posts results to the Gitea epic using the existing GITEA_TOKEN secret
-- The same mechanism the merge-robot already uses for PR comments
-
-### What "done" means for a wave:
-The wave's Gitea epic has a verification comment showing every integration path PASSING. The agent does not produce testing documents — the pipeline does.
-
-### What "done" means for a wave:
-Not just "the code compiles" — the wave verification document shows every integration path working.
-
----
-
-## WAVE 0: INFRASTRUCTURE (before any porting)
-
-### 0.1 Henxels scope extension
-Open `henxels.yaml`. Add scopes for `src/rust/*/src/*.rs` and `src/go/**/*.go`. Same quality gates: max_lines, no_secrets, canary registration, coverage existence. Without this, new Go/Rust files have no governance.
-
-### 0.2 Umbrella manifest extension
-The umbrella manifest IS the spine's input for non-module surfaces. Extend it:
-- Add the 10 existing Rust crates as `rust_crates` entries
-- Add the 2 existing Go modules as `go_surfaces` entries
-- Add placeholder entries for the planned Go modules
-- Every new Go/Rust file gets tracked, so the spine knows about it
-
-### 0.3 Scaffolding protocol update (construction_decision.py port)
-`construction_decision.py` is itself a Python file. Port it:
-- **Go start call**: the CLI surface that receives the classification request
-- **Rust execution**: the deterministic classification logic (keyword matching, language placement)
-- The GO_SIGNALS and RUST_SIGNALS keyword lists are updated to match the corrected dichotomy
-- The Python version becomes a delegation shim
-- After this port, `rune scaffold classify` routes through Go→Rust, not Python
-
-### 0.4 CI pipeline update
-- Build every Rust crate in the unit-tests job
-- Build every Go module in a new `go-build` job
-- Set CC_RUST_LIB, SC_RUST_LIB, etc. to the CARGO_TARGET_DIR paths
-- Add `go vet` and `go test ./...` steps
-
-### 0.5 Gitea epic + MiMoCode tasks
-- Post the parent epic on Gitea: the full wave structure as a folded checklist
-- Post per-wave sub-epics
-- Mirror in MiMoCode's task tool
-- Every subsequent task updates both
-
----
-
-## WAVE 4: GO REACTIVE INFRASTRUCTURE (14 modules)
-
-### event_bus (244 lines) — DONE
-Already built as `src/go/event-bus/`. Reads/writes the same events.jsonl.
-
-### event_envelope (303 lines)
-Merge into event-bus. The EventEnvelope struct already exists in Go. Add the OrchestrationRecord methods (to_dict, from_dict) as MarshalJSON/UnmarshalJSON. Add the content_hash function.
-
-### message_queue (10KB)
-**What it does**: holds approved messages until they're executed. The Python version uses a JSONL file with a mutex.
-**Go advantage**: Go channels are designed for this. Use a buffered channel for in-memory queue + a JSONL file for durability. The Go version is concurrent-safe by construction.
-**HOW**: Create `src/go/message-queue/`. Define `type Message struct` with the same fields as the Python version. Implement `Enqueue`, `Dequeue`, `GetApproved`, `MarkExecuted`. The Python module becomes a subprocess shim.
-**Parity test**: enqueue 10 messages in Python, read them in Go, verify identical.
-
-### hook_engine (28KB)
-**What it does**: loads plugin hooks from a config, fires them on events.
-**Go advantage**: goroutines enable parallel hook dispatch (Python's GIL prevents this).
-**HOW**: Create `src/go/hook-engine/`. `type HookEngine struct { hooks map[string][]HookFunc; mu sync.RWMutex }`. `Fire(name, data)` iterates hooks sequentially; `FireAsync` dispatches each hook in a goroutine and collects errors via channels.
-**Language advantage**: parallel hook dispatch — Python can't do this due to the GIL.
-
-### microkernel (14KB)
-**What it does**: the plugin lifecycle — register, activate, dispatch.
-**Go advantage**: Go interfaces replace Python duck typing with compile-time guarantees.
-**HOW**: `type Plugin interface { Name() string; Capabilities() []string; OnMessage(data) error }`. Registry with `Register(p Plugin)`, `Fire(event, data)`. The hook_engine plugs into this.
-
-### subsystem_health (6KB)
-**What it does**: tracks failures per subsystem, escalates tiers.
-**HOW**: `type SubsystemHealth struct { failures map[string][]Failure }`. RecordFailure, GetHealth. Write to JSON for durability.
-
-### parallel_processor (5KB)
-**What it does**: runs operations in parallel.
-**Go advantage**: goroutines + sync.WaitGroup. This is what Go was BORN for.
-**HOW**: `func ParallelMap[T, R any](items []T, fn func(T) R) []R`. Launch goroutines, collect via channels.
-
-### work_manager (20KB)
-**What it does**: manages work dispatch to builders.
-**HOW**: Go worker pool with `chan Task`. `type WorkManager struct { workers int; queue chan Task; results chan TaskResult }`. Start, Submit, Stop.
-
-### failure_auto_filer (21KB)
-**What it does**: auto-files failures to the forge.
-**HOW**: Go struct with spool file + forge client. Same pattern as the existing forge_client.
-
-### cache (16KB) + connection_pool (3KB)
-**What they do**: cache responses, pool connections.
-**Go advantage**: Go's `sync.Map` and channel-based pools are built for this.
-**HOW**: `src/go/cache/` — LRU cache with `sync.RWMutex`. `src/go/connection-pool/` — channel-based pool.
-
-### cron_engine (14KB) + night_mode (14KB)
-**What they do**: scheduled tasks, night consolidation.
-**Go advantage**: `time.Ticker` + goroutines replace Python's threading.Timer.
-**HOW**: `src/go/cron-engine/` — task list with cron expressions. `src/go/night-mode/` — uses the cron engine for scheduled consolidation.
-
-### recall_router (5KB)
-**What it does**: routes recall queries to the right memory backend.
-**HOW**: `src/go/recall-router/` — routing table with `map[string]RecallFn`.
-
----
-
-## WAVE 4b: GO TOOL EXECUTION (3 modules)
-
-### tool_executor (73KB) — STARTED
-The Go binary already handles read_file, list_directory, glob_files, grep_files, run_command. Add the remaining operations: write_file (with path validation), edit_file (with diff preview), run_tests, lint_file, git_commit, git_diff, git_log, repo_map, and the query/diagnose operations.
-**Language advantage**: Go's `os/exec` with `context.Context` for timeouts is cleaner than Python's `subprocess.run(timeout=)`. Go's goroutines enable parallel tool execution (Python serialises them).
-
-### tool_protocol (16KB)
-Go types: `ToolRequest`, `ToolEvent`. Validation against a schema registry. The approval boundary stays in the Go operator (not Python).
-
-### local_tool_runtime (35KB)
-The Go loop: receive model response → parse tool calls → validate → dispatch to executor → feed results back. `type LocalToolRuntime struct { transport Transport; tools []ToolDef; maxIterations int }`. This is the loop that makes Rune respond to tool results.
-
----
-
-## WAVE 5a: GO MODEL/PROVIDER (10 modules → 1 binary)
-
-All 10 modules collapse into `src/go/model-connect/`.
-
-**Language advantage**: Go's `net/http` with connection pooling and keep-alive replaces Python's `urllib` (which opens a new connection per request). Go's goroutines enable parallel model calls (Python serialises them). Go's `context.Context` enables timeout propagation through the call chain.
-
-### model_connect (16KB)
-`type OllamaClient struct { baseURL string; client *http.Client }`. Chat, Show, Pull, ListModels. Use `net/http` with a shared transport for connection reuse.
-
-### model_routing (16KB) + model_registry (6KB) + model_profiles (16KB)
-Go router that scores tasks against model capabilities and routes to the right model. One `ModelRouter` struct replaces three Python files.
-
-### provider_budget (12KB)
-Go budget tracker with `sync.Mutex`. Record, GetStatus. Token counting per provider.
-
-### provider_registry (23KB) + standardized_providers (9KB) + provider_context (2KB)
-Go `Provider` interface with OllamaProvider and CompatProvider implementations. Registry manages connections.
-
-### tiered_executor (9KB)
-Go executor with tier escalation. Execute, Escalate.
-
----
-
-## WAVE 5b: GO OPERATOR (19 modules → 1 binary)
-
-**rune_operator (126KB)** — the turn loop. This is the hardest port.
-**How**: break it into sub-systems. Port each one at a time. After each, run the full test suite.
-1. The state management (RuneState, TaskStateRepo, ConversationRepo) → Go structs with JSON persistence
-2. The turn loop → Go function: `Respond(channel, message) OperatorResponse`
-3. The routing → Go AdaptiveRouter
-4. The tool dispatch → Go LocalToolRuntime (already ported in Wave 4b)
-5. The memory interaction → Go MemoryStore (Wave 5c) + Rust kernels via cgo
-6. The model connection → Go ModelConnect (Wave 5a)
-
-**Language advantage**: Go goroutines replace Python threading for parallel context gathering. Go channels replace Python queues. Go's `context.Context` replaces Python's ad-hoc timeout management. The turn loop becomes truly concurrent — memory recall and model inference can overlap.
-
-**The other 18 modules** are supporting cast: adaptive_router (23KB), build_mode (20KB), builder_bridge (12KB), core_server (9KB), auto_context (8KB), auto_tasks (15KB), event_wait (23KB), evidence_probe (7KB), forge (5KB), forge_client (7KB), goal (14KB), growth_delta (16KB), warm_router (55KB), release_notes (18KB), persona_definition (7KB), voicebox (4KB), voice_injector (3KB). Each follows the same pattern: read Python → write Go → parity test → rewire → commit.
-
----
-
-## WAVE 5c: GO MEMORY OPERATIONS (8 modules)
-
-### memory_store (99KB) — THE BIGGEST SINGLE PORT
-**What it does**: every SELECT, INSERT, UPDATE, DELETE against the memory database.
-**Go advantage**: `modernc.org/sqlite` is pure Go — no cgo, no C compiler, cross-compiles trivially. Go's `database/sql` interface with prepared statements is cleaner than Python's raw sqlite3.
-**HOW**: `type MemoryStore struct { db *sql.DB }`. Every Python function becomes a Go method. The SQL statements ARE the specification.
-**Parity test**: same SQLite file, same queries, byte-identical results. Run after every operation.
-
-### curator (70KB)
-Scans the store, identifies conflicts, promotes/demotes. Go state machine.
-
-### sleep_time (38KB)
-Idle-period consolidation. Go goroutine on a timer.
-
-### memory_consolidation (31KB)
-Calls the Rust kernel (already ported). Go handles the I/O.
-
-### The other 4 (persona_gate, abstraction, witness, stage_guards)
-Each follows the same pattern.
-
----
-
-## WAVE 6: RUST BACKEND (85 modules)
-
-Each Python module's pure functions become `pub fn` in the appropriate crate.
-
-**The pattern for each:**
-1. Read the Python module, identify pure functions
-2. Write the Rust equivalent in the crate
-3. Add an FFI symbol
-4. Write a parity test
-5. The Python module becomes a thin FFI caller
-
-**The rhythm**: most modules are 3-10KB. At that size, a port takes 15-30 minutes once you're in the rhythm. 85 modules at that pace is 2-3 days of focused work.
-
-**Language advantage**: Rust's type system catches bugs at compile time that Python catches at runtime. Rust's `Result<T, E>` replaces Python's try/except for error handling. Rust's pattern matching replaces Python's if/elif chains. Rust's zero-cost abstractions mean the ports are FASTER than the Python originals.
-
----
-
-## WAVE 7: BUBBLE TEA TUI (Go)
-
-### Maximising the Bubble Tea ecosystem
-
-Research the full Bubble Tea + Lipgloss + Bubbles ecosystem for every available addon:
-
-**Bubble Tea** (the runtime): Elm architecture, goroutine-safe, tea.Tick for animations, tea.Every for recurring updates, tea.WithAltScreen for fullscreen, tea.WithMouseCellMotion for mouse support.
-
-**Lipgloss** (styling): truecolor (16.7M colors), borders (rounded, thick, double, hidden), padding/margin/width/height, alignment, flex layout, gradients, inline styling, copy/blend styles.
-
-**Bubbles** (pre-built components):
-- `spinner`: rotating indicators (line, dot, mini-dot, jump, pulse, points, globe, moon, monkey, meter, hamburger, ellipsis)
-- `progress`: animated progress bars with gradient colors
-- `textinput`: text input with cursor, placeholder, validation
-- `textarea`: multi-line text input
-- `table`: sortable, selectable data tables
-- `list`: filtered, paginated lists
-- `viewport`: scrollable content area
-- `paginator`: pagination controls
-- `key`: key binding documentation
-- `help`: help bubble
-- `timer`: countdown timer
-- `stopwatch`: elapsed time
-
-**Additional libraries in the ecosystem:**
-- `glamour`: markdown rendering with syntax highlighting (for chat messages that contain code)
-- `harmonica`: spring animation physics (for smooth pane transitions)
-- `bubble-lipgloss-extras`: additional styling utilities
-
-**What the current TUI has that maps:**
-- Two-column layout (chat LEFT, task RIGHT) → `lipgloss.JoinHorizontal()` with width ratios
-- Chat bubbles with sender name, timestamp, content → custom component with `lipgloss.Style{}.Border(lipgloss.RoundedBorder()).Padding(0, 1)`
-- Thinking indicator (spinner) → `bubbles/spinner` with the pulse style
-- Tool call display → bordered component with syntax highlighting via `glamour`
-- Status bar (version, mode, model, project) → fixed bottom bar via `lipgloss.JoinVertical()`
-- Command selector with autocomplete → `bubbles/textinput` + custom suggestion loop
-- Work pane (operational index) → side panel with `bubbles/list`
-- Scrollback → `bubbles/viewport` with `SetContent()` and `GotoBottom()`
-- Keybindings → `tea.KeyMap` with `tea.KeyCtrl1`, `tea.KeyCtrl2`, `tea.KeyCtrl3`
-- Streaming text → `tea.Cmd` that sends partial string updates
-- Growth/status widgets → `bubbles/table` or custom rendering
-
-**Improvements the language enables:**
-- True concurrent streaming: the Go operator can push partial results to the TUI via Go channels while the model is still generating — Python can't do this because the GIL serialises everything
-- Sub-millisecond rendering: Go's zero-allocation string building means the TUI renders at 60fps without GC pauses
-- Statically linked binary: deploy the TUI as a single file, no Python runtime, no virtual environment, no pip install
-
----
-
-## CI STACKING PROTOCOL
-
-The CI pipeline is proven — 2,300+ tests, 25 canaries, required checks on master. Use it as a throughput engine:
-
-1. Submit PR after PR after PR. Don't wait for one to merge before starting the next.
-2. If CI raises an issue, DON'T STOP the current work. Note it, continue.
-3. After every 5 PR submissions, go back and address the accumulated CI issues in one batch.
-4. The merge-robot and auto-version handle the merging — you keep producing.
-5. If a required check fails on master, that's the one thing that stops the conveyor. Fix it immediately.
-
-**The principle**: CI is the quality gate, not the bottleneck. It runs while you work. Issues get batch-fixed. The conveyor keeps moving.
-
----
-
-## GITEA EPIC STRUCTURE
-
-The FIRST Gitea task: **Epic: "Full Dichotomy Rebase"** containing:
-- [ ] Wave 0: Infrastructure (henxels scope, umbrella manifest, scaffolding protocol, CI)
-- [ ] Wave 4: Go reactive infrastructure (14 sub-epics)
-- [ ] Wave 4b: Go tool execution (3 sub-epics)
-- [ ] Wave 5a: Go model/provider (10 sub-epics, folded into 1 binary)
-- [ ] Wave 5b: Go operator (19 sub-epics, folded into 1 binary)
-- [ ] Wave 5c: Go memory operations (8 sub-epics)
-- [ ] Wave 6a: Rust structural core (30 sub-epics)
-- [ ] Wave 6b: Rust cognition (30 sub-epics)
-- [ ] Wave 6c: Rust remaining (25 sub-epics)
-- [ ] Wave 7: Bubble Tea TUI (7 sub-epics)
-
-Each sub-epic contains the HOW instructions (the seven-step process), the language advantage notes, the parity test spec, and the CI registration step.
-
-MiMoCode tasks mirror the same tree.
-
----
-
-## WHAT I STILL NEED FROM YOU
-
-1. **The cgo pattern** — Go calls Rust `.so` files via cgo. The Rust crates don't change, only the caller changes from Python-ctypes to Go-cgo. Is this the membrane you want?
-
-2. **The Bubble Tea ecosystem** — I've listed every addon above. Do you want any specific visual features beyond what's listed?
-
-3. **The umbrella answer** — the spine relies on umbrellas (umbrellas are the input, spine is the consumer). Both need updating. Is this how you understood it?
-
-4. **The CI stacking** — submit PRs continuously, batch CI fixes every 5 submissions. Does this match what you described?
-
-5. **Approve to start Wave 0** — henxels scope, umbrella manifest, scaffolding protocol, CI update, Gitea epic. This is the foundation everything else builds on.

plans/2026-10-06-full-dichotomy-rebase-tranche.md

@@ -1,274 +0,0 @@
-# TRANCHE: THE FULL DICHOTOMY REBASE — every Python module replaced
-
-_Presented for operator approval per TRANCHE-TEMPLATE.md §4. Nick's mandate: "go through the whole codebase and replace it with the dichotomy." Measured: 180 Python files, 68,224 lines. Target: 0 Python logic files (TUI stays last per plan, test infra stays as test infra)._
-
----
-
-## §0 — GROUNDING (measured, not guessed)
-
-### The honest numbers
-
-| Language | Files | Lines | % | Status |
-|---|---|---|---|---|
-| Python | 180 | 68,224 | 70% | **THE TARGET — every module ported** |
-| Rust | 106 | 27,304 | 28% | 10 crates exist, 85 more modules to port |
-| Go | 7 | 1,125 | 1% | 2 modules exist, 55 more to port |
-| **Total** | **293** | **96,653** | | |
-
-### The corrected dichotomy (re-classified 2026-10-06, 64ba7cf)
-
-| Side | Modules | Python lines to replace | Role |
-|---|---|---|---|
-| **GO** | 57 | 32,081 | The reactive shell: initiates, responds, routes, interfaces |
-| **RUST** | 85 | 25,218 | The deterministic backend: computes, stores, pure functions |
-| **TUI** | 7 | 5,435 | Textual UI — last per plan |
-| **TEST** | 29 | 5,397 | Test infrastructure — stays as test infra |
-
-### Existing infrastructure (§0.2 — route through what exists)
-
-- **CI pipeline**: `.gitea/workflows/ci.yml` — lint, unit-tests, go-surface, canary, best-practices, documentation, type-check, gitea-offline, required-checks
-- **Deploy pipeline**: `.gitea/workflows/deploy.yml` — event-driven CI qualification, stage/verify/promote
-- **Scaffolding**: `construction_interface.py` + `src/go/rune-entry/scaffold.go` — every module's port goes through a construction contract
-- **Canaries**: 25 registered in CI, each crate has its own parity battery
-- **Umbrella manifest**: `config/umbrellas.json` — 165 Python modules tracked (needs Rust/Go extension)
-- **Henxels**: `henxels.yaml` — structural contract, line caps, no-secrets, canary registration (needs Rust/Go scope)
-- **Gitea**: conductor/rune, required checks on master, merge-robot, auto-version
-
-### Keep-greens (§0.5 — must stay green through every wave)
-
-- Full test suite: 2,300+ tests, 0 failures
-- All 25 registered canaries
-- diff-cover ≥70% on changed lines
-- Silent-handler ratchet (BLE001 ≤345, S110 ≤75)
-- Henxels: all hold
-- Lint-baseline: no increase
-- Deploy: monotonic promotion, runtime verification
-
----
-
-## §1 — OBJECTIVE
-
-**Every Python module in `src/rune/` is replaced by its Go or Rust equivalent per the dichotomy. The TUI stays Python until Wave 7. Test infrastructure stays Python. The FFI boundary is the membrane between Go and Rust. Zero Python logic files remain (only the TUI shell and test files).**
-
-Measured end-state: `ls src/rune/*.py | wc -l` returns ≤7 (TUI only) + test files. `src/go/` contains the full reactive runtime. `src/rust/` contains the full deterministic backend.
-
----
-
-## §2 — WAVE STRUCTURE
-
-### Wave 4: The Go reactive infrastructure (14 modules, ~5,271 lines)
-
-The backbone that everything else routes through. These are the modules that make the system *respond*.
-
-| Module | Python lines | Go target | Notes |
-|---|---|---|---|
-| event_bus | 244 | **DONE** (src/go/event-bus/) | Same events.jsonl, same envelope |
-| event_envelope | 303 | src/go/event-bus/ | Envelope type in the same binary |
-| message_queue | 10KB | src/go/message-queue/ | Durable queue |
-| hook_engine | 28KB | src/go/hook-engine/ | Plugin dispatch |
-| microkernel | 14KB | src/go/microkernel/ | Hook lifecycle |
-| subsystem_health | 6KB | src/go/subsystem-health/ | Failure tiers |
-| parallel_processor | 5KB | src/go/parallel-processor/ | Goroutines |
-| work_manager | 20KB | src/go/work-manager/ | Work dispatch |
-| failure_auto_filer | 21KB | src/go/failure-filer/ | Auto-filing |
-| cache | 16KB | src/go/cache/ | Connection pooling |
-| connection_pool | 3KB | src/go/connection-pool/ | Pooled connections |
-| cron_engine | 14KB | src/go/cron-engine/ | Scheduled tasks |
-| night_mode | 14KB | src/go/night-mode/ | Night consolidation |
-| recall_router | 5KB | src/go/recall-router/ | Memory routing |
-
-**Entry condition**: event_bus already landed. **Exit condition**: all 14 modules exist as Go binaries, Python versions delegate or are deleted, CI go-surface job passes.
-
-### Wave 4b: The Go tool execution layer (3 modules, ~3,079 lines)
-
-| Module | Python lines | Go target |
-|---|---|---|
-| tool_executor | 73KB | **STARTED** (src/go/tool-executor/) |
-| tool_protocol | 16KB | src/go/tool-executor/ |
-| local_tool_runtime | 35KB | src/go/tool-executor/ |
-
-**Exit condition**: tool executor handles all operations in Go, Python delegates via subprocess, approval machinery documented.
-
-### Wave 5a: The Go model/provider layer (10 modules, ~3,398 lines)
-
-| Module | Python lines | Go target |
-|---|---|---|
-| model_connect | 16KB | src/go/model-connect/ |
-| model_profiles | 16KB | src/go/model-connect/ |
-| model_registry | 6KB | src/go/model-connect/ |
-| model_routing | 16KB | src/go/model-connect/ |
-| openai_compat_transport | 10KB | src/go/model-connect/ |
-| provider_budget | 12KB | src/go/model-connect/ |
-| provider_context | 2KB | src/go/model-connect/ |
-| provider_registry | 23KB | src/go/model-connect/ |
-| standardized_providers | 9KB | src/go/model-connect/ |
-| tiered_executor | 9KB | src/go/model-connect/ |
-
-**Exit condition**: all model/provider operations in Go, Ollama + OpenAI-compatible connections working.
-
-### Wave 5b: The Go operator (19 modules, ~9,637 lines)
-
-The biggest wave. The operator turn loop, routing, and the modules that serve it.
-
-| Module | Python lines | Notes |
-|---|---|---|
-| rune_operator | 126KB | THE core — turn loop, task management |
-| adaptive_router | 23KB | Route decisions |
-| build_mode | 20KB | Build orchestration |
-| builder_bridge | 12KB | Builder dispatch |
-| builder_bridge_cli | 1KB | CLI surface |
-| core_server | 9KB | HTTP server |
-| persona_definition | 7KB | Persona loading |
-| voicebox | 4KB | Voice |
-| voice_injector | 3KB | Voice injection |
-| release_notes | 18KB | Release generation |
-| auto_context | 8KB | Auto context |
-| auto_tasks | 15KB | Auto tasks |
-| event_wait | 23KB | Event-driven waits |
-| evidence_probe | 7KB | Evidence probes |
-| forge | 5KB | Forge adapter |
-| forge_client | 7KB | Forge client |
-| goal | 14KB | Goal management |
-| growth_delta | 16KB | Growth tracking |
-| warm_router | 55KB | Warm routing |
-
-**Exit condition**: the operator turn loop runs in Go, routes through Go model connections, dispatches to Rust kernels via FFI.
-
-### Wave 5c: The Go memory operations (8 modules, ~8,240 lines)
-
-| Module | Python lines | Notes |
-|---|---|---|
-| memory_consolidation | 31KB | Consolidation operations (kernel already in Rust) |
-| memory_store | 99KB | THE memory store — SQLite operations |
-| curator | 70KB | Memory curation |
-| sleep_time | 38KB | Sleep-time consolidation |
-| abstraction | 22KB | Fact extraction (kernel already in Rust) |
-| persona_gate | 24KB | Persona gating |
-| witness | 15KB | Witness reflection |
-| stage_guards | 12KB | Stage guards |
-
-**Exit condition**: memory operations run in Go, calling Rust kernels for the deterministic compute.
-
-### Wave 6: The Rust deterministic backend (85 modules, ~25,218 lines)
-
-Three sub-waves by dependency order:
-
-**Wave 6a** (30 modules, ~11,515 lines): the structural core — spine, structural_store, construction_*, contracts, capability_*, audit_ledger, behaviour_ledger, claim_audit, etc.
-
-**Wave 6b** (30 modules, ~6,849 lines): the cognition layer — drift_*, graph_memory, memory_selector, identity_anchors, pins, salience_gate, self_improve, token_optimizer, etc.
-
-**Wave 6c** (25 modules, ~6,854 lines): the remaining modules — voice_hybrid, voice_sync, prompt_sync, time_awareness, toolchain, verification_layer, etc.
-
-**Exit condition**: every deterministic module exists as a Rust function in a crate, the Python version is a thin FFI caller or deleted.
-
-### Wave 7: The TUI + test infrastructure (36 modules, ~10,832 lines)
-
-The TUI stays Python (Textual is Python-native) but its backend calls go through the Go/Rust dichotomy. Test infrastructure stays Python (pytest is Python-native).
-
-**Exit condition**: the TUI is the only Python surface, everything behind it is Go/Rust.
-
----
-
-## §3 — PER-FILE EPIC TEMPLATE (§7 anti-ballooning: 180 files → per-file epics)
-
-Each file's port gets ONE epic. The epic body contains:
-
-1. **File identity**: `src/rune/<module>.py` — N lines, M functions, K classes
-2. **Three questions**: (a) can it be IMPROVED in the target language? (b) does it need FIXING? (c) are there MISSING CONNECTORS?
-3. **Language assessment**: confirmed GO/RUST per classification, with the evidence
-4. **Constraint context**: which henxels, line caps, canary requirements apply
-5. **Pipeline plan**: branch name, PR route, canary battery spec
-6. **Verification**: the specific tests + canaries that prove the port
-7. **Provenance**: links to the wave, the tranche, the classification record
-
----
-
-## §4 — DECISION RUBRIC
-
-Per-unit language decisions are made against:
-
-1. **Does the module initiate/respond/route?** → Go
-2. **Does it compute/store/pure-function?** → Rust
-3. **Does it have BOTH?** → Hybrid: Go front end calls Rust kernel via FFI (contracted membrane junction)
-4. **Is it the TUI?** → Python (last)
-5. **Is it test infrastructure?** → Python (stays)
-
-Evidence required: the module's actual imports, its primary purpose, its callers, and what breaks if it's removed.
-
----
-
-## §5 — PIPELINE ROUTING
-
-Every port flows through:
-
-1. **Construction contract**: `rune scaffold submit-need` → decision → contract → building
-2. **Branch**: `feat/port-<module>-to-<lang>` from master
-3. **Implementation**: Go module in `src/go/<name>/` or Rust module in `src/rust/<crate>/`
-4. **Python oracle**: the original Python function preserved as `_py_<function>` for parity
-5. **Delegation**: the Python public delegates to the Go/Rust implementation
-6. **Canary**: a parity battery proving kernel↔oracle equivalence
-7. **CI**: the canary registered in `.gitea/workflows/ci.yml`
-8. **PR**: → master, required checks, merge-robot
-9. **Deploy**: auto-version bump, deploy pipeline, runtime verification
-
----
-
-## §6 — VERIFICATION GATES
-
-Per-wave exit:
-- All modules in the wave exist as Go/Rust implementations
-- Python versions delegate (or are deleted if nothing calls them)
-- CI go-surface job passes (for Go modules)
-- CI canary job passes (for Rust kernels)
-- Full test suite green
-- diff-cover ≥70% on changed lines
-- Deploy advances the current symlink
-
-Per-tranche exit:
-- `ls src/rune/*.py` returns ≤7 files (TUI only)
-- Full test suite green
-- All canaries green
-- All henxels hold
-- Deploy verified at the final version
-
----
-
-## §7 — RISK REGISTER
-
-| Risk | Prevention | Detection |
-|---|---|---|
-| Big-bang rewrite breaks everything | Incremental waves, each independently deployable | CI red on any wave |
-| Dual-truth drift (Python and Go/Rust diverge) | Parity canaries, _py_ oracles | Canary failure |
-| Broken keep-greens | Named up front, checked per-wave | CI red |
-| Silent scope creep | Per-file epics with explicit scope | Code review |
-| FFI boundary breaks | CC_RUST_LIB/SC_RUST_LIB env contract | Kernel probe test |
-| Memory store data loss | SQLite retained, reads proven byte-identical | Canary hash check |
-| Operator turn loop regression | Full test suite + runtime verification | Deploy verification |
-| Henxels line-cap violations | Carve before commit (spine_language pattern) | CI lint red |
-| New module without canary | New-module henxel | CI lint red |
-
----
-
-## §8 — ROLLBACK / KNOWN-GOOD
-
-Each wave is independently deployable. If a wave breaks:
-1. The Python version is still in the tree (delegation, not deletion)
-2. `RUNE_COGNITION_CORE=python` pins the fallback
-3. The deploy symlink can be pointed back to the previous revision
-4. Git revert the wave's merge commit
-
----
-
-## §9 — SCALE HONESTY
-
-This is **weeks of work, not hours**. 180 modules at ~1-2 modules per session = 90-180 sessions. The previous attempt (R2) ported 10 crates + 2 Go modules in multiple sessions. This tranche is the FULL job.
-
-The wave structure is designed for incremental progress: each wave is independently deployable, each module's port is independently verifiable, and the system works at every intermediate state. The Python versions delegate to the Go/Rust implementations — they don't get deleted until the port is proven.
-
----
-
-## §10 — APPROVAL GATE
-
-This tranche is presented for operator approval. The operator reads the wave structure, the module assignments, the per-wave exit conditions, and either approves (execution starts at Wave 4) or requests changes.
-
-The previous attempt (R2) ported 10 crates + 2 Go modules — less than 10% of the codebase. This tranche is the FULL job: every module, every line, every language decision, with the dichotomy honestly applied.

plans/total-rebase-inventory.md

@@ -1,196 +0,0 @@
-# Total-Rebase Inventory (R2 Wave 0.1) — measured 2026-10-04
-
-Generated from `store/rebase/inventory.json` (AST function-level extraction) +
-`store/rebase/classification.json` (import/content evidence per module).
-Placement law: reactive/initiating/user-facing/network/turn-time → GO;
-deterministic/stateful/storage/cognition → RUST; Textual rendering → TUI-LAST;
-pure compute with no I/O markers defaults to the deterministic backend.
-
-## Totals
-
-| Side | Modules | Lines | Functions |
-|---|---|---|---|
-| GO | 43 | 19495 | 708 |
-| RUST | 93 | 36215 | 1091 |
-| TUI-LAST | 7 | 5438 | 225 |
-| TEST-INFRA | 29 | 5395 | 158 |
-| RETIRES | 2 | 93 | 9 |
-
-## Per-module classification (evidence-carrying)
-
-| Module | Side | Lines | Functions | Evidence |
-|---|---|---|---|---|
-| rune_tui | TUI-LAST | 4041 | 166 | textual/rich imports: ['rich', 'textual'] |
-| rune_operator | GO | 2697 | 68 | network/concurrency imports: ['threading', 'urllib']; reactive/initiating domain |
-| memory_store | RUST | 2435 | 56 | sqlite3 (storage-backed); network/concurrency imports: ['subprocess']; deterministic/state domain |
-| curator | RUST | 1838 | 43 | sqlite3 (storage-backed); network/concurrency imports: ['subprocess']; deterministic/state domain |
-| tool_executor | GO | 1812 | 47 | network/concurrency imports: ['subprocess']; reactive/initiating domain |
-| warm_router | RUST | 1536 | 36 | sqlite3 (storage-backed); network/concurrency imports: ['subprocess']; reactive/initiating domain; deterministic/state domain |
-| construction_interface | RUST | 1039 | 25 | deterministic/state domain |
-| spine | RUST | 1019 | 31 | deterministic/state domain |
-| sleep_time | RUST | 971 | 25 | sqlite3 (storage-backed); network/concurrency imports: ['subprocess', 'urllib']; deterministic/state domain |
-| construction_decision | RUST | 949 | 18 | deterministic/state domain |
-| capability_broker | RUST | 900 | 21 | deterministic/state domain |
-| hook_engine | GO | 860 | 8 | reactive/initiating domain |
-| scaffold | RUST | 854 | 31 | network/concurrency imports: ['subprocess']; deterministic/state domain |
-| local_tool_runtime | GO | 806 | 32 | network/concurrency imports: ['threading', 'urllib']; reactive/initiating domain |
-| context_broker | GO | 768 | 23 | network/concurrency imports: ['threading'] |
-| elastic_cognition | RUST | 765 | 13 | network/concurrency imports: ['urllib']; deterministic/state domain |
-| memory_consolidation | RUST | 733 | 20 | network/concurrency imports: ['subprocess']; deterministic/state domain |
-| provider_registry | GO | 666 | 28 | network/concurrency imports: ['threading', 'urllib']; reactive/initiating domain |
-| persona_gate | RUST | 661 | 21 | sqlite3 (storage-backed); network/concurrency imports: ['subprocess', 'urllib']; deterministic/state domain |
-| structural_store | RUST | 656 | 33 | deterministic/state domain |
-| contracts | RUST | 626 | 7 | deterministic/state domain |
-| adaptive_router | GO | 625 | 19 | reactive/initiating domain |
-| work_manager | GO | 591 | 25 | reactive/initiating domain |
-| abstraction | RUST | 587 | 12 | sqlite3 (storage-backed); network/concurrency imports: ['urllib']; deterministic/state domain |
-| construction_intent | RUST | 555 | 16 | deterministic/state domain |
-| canary_audit_ledger | TEST-INFRA | 540 | 2 | canary/test module |
-| safety_override | RUST | 530 | 18 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| failure_auto_filer | GO | 527 | 28 | network/concurrency imports: ['threading'] |
-| build_mode | GO | 517 | 34 | network/concurrency imports: ['subprocess'] |
-| drift_core | RUST | 517 | 14 | deterministic/state domain |
-| event_wait | GO | 517 | 14 | network/concurrency imports: ['subprocess', 'urllib']; reactive/initiating domain |
-| tui_validator | TUI-LAST | 514 | 13 | tui family |
-| memory_selector | RUST | 511 | 14 | deterministic/state domain |
-| system_registry | RUST | 501 | 14 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| construction_pattern | RUST | 496 | 13 | deterministic/state domain |
-| cache | GO | 492 | 17 | sqlite3 (storage-backed); network/concurrency imports: ['threading'] |
-| claim_audit | RUST | 483 | 14 | sqlite3 (storage-backed); deterministic/state domain |
-| graph_memory | RUST | 474 | 9 | sqlite3 (storage-backed); deterministic/state domain |
-| identity_anchors | RUST | 474 | 8 | deterministic/state domain |
-| model_connect | GO | 462 | 10 | network/concurrency imports: ['urllib']; reactive/initiating domain |
-| auto_tasks | GO | 460 | 14 | sqlite3 (storage-backed); network/concurrency imports: ['subprocess'] |
-| capability_fit | RUST | 455 | 14 | deterministic/state domain |
-| tool_protocol | GO | 455 | 27 | reactive/initiating domain |
-| drift_ledger | RUST | 453 | 16 | sqlite3 (storage-backed); deterministic/state domain |
-| witness | RUST | 451 | 10 | network/concurrency imports: ['urllib']; deterministic/state domain |
-| goal | RUST | 441 | 20 | network/concurrency imports: ['urllib']; deterministic/state domain |
-| release_notes | GO | 439 | 17 | network/concurrency imports: ['urllib'] |
-| cron_engine | GO | 436 | 28 | network/concurrency imports: ['subprocess', 'threading']; reactive/initiating domain |
-| model_profiles | GO | 435 | 15 | network/concurrency imports: ['urllib']; reactive/initiating domain |
-| microkernel | GO | 434 | 12 | network/concurrency imports: ['subprocess', 'threading'] |
-| model_routing | GO | 432 | 15 | network/concurrency imports: ['urllib']; reactive/initiating domain |
-| voice_hybrid | RUST | 421 | 10 | sqlite3 (storage-backed); reactive/initiating domain |
-| behavior | RUST | 407 | 9 | sqlite3 (storage-backed); deterministic/state domain |
-| token_optimizer | RUST | 407 | 23 | deterministic/state domain |
-| capability_ledger | RUST | 405 | 19 | deterministic/state domain |
-| night_mode | GO | 405 | 19 | network/concurrency imports: ['subprocess', 'threading', 'urllib'] |
-| chat_bubble | TUI-LAST | 401 | 16 | textual/rich imports: ['rich', 'textual'] |
-| growth_delta | RUST | 400 | 16 | network/concurrency imports: ['subprocess', 'urllib']; deterministic/state domain |
-| construction_mode | RUST | 395 | 5 | deterministic/state domain |
-| prompt_sync | RUST | 376 | 14 | sqlite3 (storage-backed) |
-| provider_budget | GO | 354 | 21 | network/concurrency imports: ['urllib']; reactive/initiating domain |
-| structural_model | RUST | 352 | 21 | deterministic/state domain |
-| programme_continuation | RUST | 349 | 11 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| canary_rune_serve | TEST-INFRA | 329 | 13 | canary/test module |
-| builder_bridge | GO | 326 | 11 | reactive/initiating domain |
-| canary_p1_07 | TEST-INFRA | 324 | 12 | canary/test module |
-| layout_contract | RUST | 316 | 6 | deterministic/state domain |
-| message_queue | GO | 316 | 14 | reactive/initiating domain |
-| drift_observability | RUST | 315 | 9 | deterministic/state domain |
-| build_basis | RUST | 314 | 12 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| canary_p0_07 | TEST-INFRA | 310 | 11 | canary/test module |
-| drift_compression | RUST | 307 | 12 | deterministic/state domain |
-| event_envelope | GO | 303 | 8 | reactive/initiating domain |
-| attention_capsule | RUST | 296 | 7 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| canary_p1_01 | TEST-INFRA | 294 | 14 | canary/test module |
-| voice_sync | RUST | 293 | 10 | sqlite3 (storage-backed); reactive/initiating domain |
-| drift_cache | RUST | 292 | 16 | deterministic/state domain |
-| outcome_ledger | RUST | 286 | 8 | sqlite3 (storage-backed); deterministic/state domain |
-| time_awareness | RUST | 283 | 15 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| tiered_executor | GO | 282 | 9 | network/concurrency imports: ['urllib'] |
-| stage_guards | RUST | 281 | 11 | network/concurrency imports: ['subprocess']; deterministic/state domain |
-| standardized_providers | GO | 281 | 5 | reactive/initiating domain |
-| canary_p1_06 | TEST-INFRA | 280 | 9 | canary/test module |
-| progressive_escalation | RUST | 279 | 9 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| pins | RUST | 276 | 11 | deterministic/state domain |
-| canary_p1_03 | TEST-INFRA | 271 | 9 | canary/test module |
-| auto_context | GO | 270 | 8 | network/concurrency imports: ['subprocess'] |
-| task_persist | RUST | 269 | 10 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| context_pressure | RUST | 262 | 9 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| canary_gitea_automation | TEST-INFRA | 261 | 3 | canary/test module |
-| canary_p1_02 | TEST-INFRA | 253 | 12 | canary/test module |
-| construction_patterns_builtin | RUST | 249 | 1 | deterministic/state domain |
-| canary_full_system | TEST-INFRA | 244 | 2 | canary/test module |
-| event_bus | GO | 244 | 7 | reactive/initiating domain |
-| salience_gate | RUST | 243 | 4 | deterministic/state domain |
-| self_improve | RUST | 242 | 5 | sqlite3 (storage-backed) |
-| construction_activation | RUST | 237 | 4 | deterministic/state domain |
-| toolchain | RUST | 236 | 7 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| task_gate | RUST | 235 | 8 | sqlite3 (storage-backed) |
-| core_server | GO | 234 | 13 | network/concurrency imports: ['http', 'urllib']; reactive/initiating domain |
-| audit_ledger | RUST | 231 | 8 | deterministic/state domain |
-| canary_native | TEST-INFRA | 231 | 3 | canary/test module |
-| openai_compat_transport | GO | 227 | 10 | network/concurrency imports: ['urllib']; reactive/initiating domain |
-| shard_manager | RUST | 223 | 10 | sqlite3 (storage-backed) |
-| response_adapter | RUST | 222 | 7 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| evidence_probe | RUST | 212 | 9 | network/concurrency imports: ['subprocess']; deterministic/state domain |
-| model_registry | GO | 211 | 8 | reactive/initiating domain |
-| persona_definition | GO | 210 | 8 | network/concurrency imports: ['subprocess'] |
-| cognitive_budgeter | RUST | 208 | 3 | deterministic/state domain |
-| canary_p0_04 | TEST-INFRA | 207 | 8 | canary/test module |
-| forge_client | GO | 203 | 19 | network/concurrency imports: ['urllib']; reactive/initiating domain |
-| dependency_tracker | RUST | 202 | 5 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| canary_context_broker | TEST-INFRA | 199 | 10 | canary/test module |
-| canary_p0_05 | TEST-INFRA | 199 | 16 | canary/test module |
-| testing_mode | RUST | 196 | 13 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| parallel_processor | GO | 194 | 17 | network/concurrency imports: ['threading'] |
-| canary_spine_meta | TEST-INFRA | 192 | 7 | canary/test module |
-| iteration | RUST | 190 | 8 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| verification_layer | RUST | 189 | 12 | deterministic/state domain |
-| subconscious_pass | RUST | 187 | 6 | deterministic/state domain |
-| ffi_query_memory_smoke | RUST | 182 | 5 | deterministic/state domain |
-| tier_manager | RUST | 182 | 9 | deterministic/state domain |
-| canary_tui_transport | TEST-INFRA | 174 | 7 | canary/test module |
-| behaviour_ledger | RUST | 173 | 13 | deterministic/state domain |
-| construction_commands | RUST | 173 | 4 | deterministic/state domain |
-| canary_tui_drift | TEST-INFRA | 170 | 2 | canary/test module |
-| intent_continuity | RUST | 168 | 11 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| rune_profiler | RUST | 165 | 3 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| inference_trace | RUST | 164 | 6 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| ms_loader | RUST | 163 | 16 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| subsystem_health | GO | 163 | 8 | network/concurrency imports: ['threading'] |
-| recall_router | GO | 162 | 3 | reactive/initiating domain |
-| voicebox | GO | 161 | 11 | network/concurrency imports: ['subprocess']; reactive/initiating domain |
-| canary_gitea_pipeline | TEST-INFRA | 159 | 2 | canary/test module |
-| forge | GO | 146 | 12 | network/concurrency imports: ['subprocess', 'urllib'] |
-| rune_graphic | TUI-LAST | 145 | 5 | textual/rich imports: ['rich'] |
-| connection_pool | GO | 144 | 9 | sqlite3 (storage-backed); network/concurrency imports: ['threading'] |
-| recall_uplift | RUST | 141 | 1 | sqlite3 (storage-backed) |
-| project_registry | RUST | 139 | 12 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| construction_depth | RUST | 138 | 2 | deterministic/state domain |
-| voice_injector | GO | 138 | 5 | reactive/initiating domain |
-| canary_rune_entry | TEST-INFRA | 137 | 3 | canary/test module |
-| construction_projection | RUST | 135 | 3 | deterministic/state domain |
-| rune_spinner | RUST | 130 | 5 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| tui_backlog | TUI-LAST | 125 | 5 | tui family |
-| warm_neuron_store | RUST | 122 | 6 | sqlite3 (storage-backed); deterministic/state domain |
-| drift_resume | RUST | 118 | 3 | deterministic/state domain |
-| wait_guard | RUST | 116 | 1 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| canary_conversation_state | TEST-INFRA | 115 | 2 | canary/test module |
-| canary_query_memory | TEST-INFRA | 110 | 2 | canary/test module |
-| failure_recovery | RUST | 108 | 1 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| graph_projection | RUST | 108 | 5 | deterministic/state domain |
-| tui_transport | TUI-LAST | 108 | 12 | tui family |
-| spine_loader | RUST | 105 | 7 | deterministic/state domain |
-| canary_unbounded | TEST-INFRA | 104 | 2 | canary/test module |
-| message_widgets | TUI-LAST | 104 | 8 | textual/rich imports: ['rich', 'textual'] |
-| cs_loader | RUST | 90 | 5 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| tc_loader | RUST | 88 | 5 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| canary_schema_migration | TEST-INFRA | 86 | 1 | canary/test module |
-| programme_gates | RUST | 85 | 6 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| structural_migration | RUST | 77 | 4 | deterministic/state domain |
-| memory_env | RETIRES | 72 | 8 | bootstrap glue subsumed by the Go runtime env contract |
-| impact_preview | RUST | 69 | 2 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| provider_context | GO | 48 | 1 | reactive/initiating domain |
-| wait_guard_corpus | RUST | 46 | 0 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| canary_cognitive_strata | TEST-INFRA | 44 | 1 | canary/test module |
-| builder_bridge_cli | GO | 42 | 1 | reactive/initiating domain |
-| route_risk_flags | RUST | 37 | 1 | no network/reactive markers — pure compute defaults to the deterministic backend |
-| canary_memory_synthesis | TEST-INFRA | 33 | 1 | canary/test module |
-| canary_resource_authority | TEST-INFRA | 33 | 1 | canary/test module |
-| canary_surface_parity | TEST-INFRA | 33 | 1 | canary/test module |
-| canary_orchestration_foundation | TEST-INFRA | 32 | 1 | canary/test module |
-| canary_gitea_delegation | TEST-INFRA | 31 | 1 | canary/test module |
-| __main__ | RETIRES | 21 | 1 | bootstrap glue subsumed by the Go runtime env contract |

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "rune"
-version = "0.217.0"
+version = "0.87.0"
 description = "Rune — a stateful coding assistant with persistent memory, orchestration, and TUI"
 requires-python = ">=3.10"
 
@@ -16,13 +16,12 @@ dependencies = [
     "aiohttp>=3.9.0",
     "websockets>=12.0",
     "psutil>=5.9.0",
-    "pillow>=10.0",
     "pyyaml>=6.0",
 ]
 
 [project.optional-dependencies]
 memory = ["sqlite-vec>=0.1.0"]
-dev = ["pytest>=8.0", "pytest-subtests", "ruff==0.16.5", "pyright", "henxels==0.12.0", "coverage>=7.6", "diff-cover>=9.2", "hypothesis>=6.100"]
+dev = ["pytest>=8.0", "pytest-subtests", "ruff==0.16.5", "pyright", "henxels==0.12.0", "coverage>=7.6", "diff-cover>=9.2"]
 
 [tool.setuptools.packages.find]
 where = ["src"]

pyright-baseline.json

@@ -1,5 +1,5 @@
 {
-  "errorCount": 121,
-  "warningCount": 450,
+  "errorCount": 117,
+  "warningCount": 454,
   "informationCount": 0
 }

pyrightconfig.json

@@ -29,10 +29,6 @@
     "**/__pycache__"
   ],
   "extraPaths": [
-    "scripts",
-    "src/rune",
-    "shared",
-    "src/rust/evidence_provenance",
-    "src/rust/query_memory"
+    "scripts"
   ]
 }

requirements-ci.txt

@@ -1,8 +1,8 @@
 # This file was autogenerated by uv via the following command:
-#    uv pip compile pyproject.toml -o requirements-ci.txt --extra dev --extra memory --python-version 3.11
+#    uv pip compile pyproject.toml -o /tmp/req_new.txt --extra dev --extra memory --python-version 3.11
 aiohappyeyeballs==2.7.1
     # via aiohttp
-aiohttp==3.14.4
+aiohttp==3.14.3
     # via rune (pyproject.toml)
 aiosignal==1.4.0
     # via aiohttp
@@ -18,9 +18,9 @@ certifi==2026.7.22
     #   httpx
 chardet==7.6.0
     # via diff-cover
-coverage==7.16.2
+coverage==7.16.1
     # via rune (pyproject.toml)
-diff-cover==10.6.0
+diff-cover==10.5.1
     # via rune (pyproject.toml)
 frozenlist==1.8.0
     # via
@@ -34,14 +34,12 @@ httpcore==1.0.9
     # via httpx
 httpx==0.28.1
     # via rune (pyproject.toml)
-hypothesis==6.168.5
-    # via rune (pyproject.toml)
 idna==3.20
     # via
     #   anyio
     #   httpx
     #   yarl
-iniconfig==2.3.1
+iniconfig==2.3.0
     # via pytest
 jinja2==3.1.6
     # via diff-cover
@@ -52,23 +50,21 @@ markdown-it-py==4.2.0
     #   mdit-py-plugins
     #   rich
     #   textual
-markupsafe==3.0.4
+markupsafe==3.0.3
     # via jinja2
 mdit-py-plugins==0.6.1
     # via textual
 mdurl==0.1.2
     # via markdown-it-py
-multidict==6.9.1
+multidict==6.9.0
     # via
     #   aiohttp
     #   yarl
-nodeenv==1.11.0
+nodeenv==1.10.0
     # via pyright
 packaging==26.3
     # via pytest
-pillow==12.3.0
-    # via rune (pyproject.toml)
-platformdirs==4.12.4
+platformdirs==4.11.11
     # via textual
 pluggy==1.6.0
     # via
@@ -104,8 +100,6 @@ rich==15.0.0
     #   textual
 ruff==0.16.5
     # via rune (pyproject.toml)
-sortedcontainers==2.4.0
-    # via hypothesis
 sqlite-vec==0.1.9
     # via rune (pyproject.toml)
 textual==8.2.8
@@ -122,7 +116,7 @@ typing-extensions==4.16.0
     #   pyright
     #   textual
     #   textual-autocomplete
-websockets==17.2
+websockets==17.1
     # via rune (pyproject.toml)
 yarl==1.25.1
     # via aiohttp

research/wave1/memory/inward.md

@@ -1,113 +0,0 @@
-# Wave 1 / Memory & Persistence — Inward Intention Profile
-
-Checkout: `/mnt/workdrive/rune`. Scope: `src/rune/` memory subsystem. Method: static reading of the
-live implementation plus inspection of on-disk state under `~/.rune/`. No code changed.
-
-## On-disk state (measured)
-
-| Artifact | Size | Status |
-|---|---|---|
-| `~/.rune/hot/task_state.json` | 973 KB | live production, hot path |
-| `~/.rune/hot/conversation_messages.json` | 1.2 MB | live production, hot path |
-| `~/.rune/consolidation/knowledge.json` | 3.4 MB | live production, batch path |
-| `~/.rune/outcome_ledger.db` | 12 KB | SQLite, small |
-| `~/.rune/memory/store/memory.db` | — | defined by `memory_env.store_db()`, not yet materialized locally |
-
-## Cluster 1 — Hot-store JSON persistence
-
-- Intention: load/save mutable runtime state as JSON files (task state, conversation messages, knowledge).
-- Evidence: live files listed above; consolidation loads/saves `knowledge.json` in
-  `memory_consolidation.py:113-165` (JSON file load/save around the batch iterate/dedupe loop).
-- Compute profile: stdlib `json` encode/decode over 1–3.4 MB documents; CPU-bound but small in
-  absolute terms (tens of ms, not seconds). No incremental/append format, full rewrite per save.
-- Language fit: **Python already delegates this well** — see outward source 1 (orjson wheel) for the
-  upgrade path. A bespoke Rust CLI unit pays per-call subprocess spawn (contract: argv in / JSON out)
-  that likely exceeds the serialization time it saves.
-
-## Cluster 2 — SQLite store + FTS5/vec0 hybrid recall (`memory_store.py`)
-
-- Intention: dense + sparse retrieval fused by RRF, with query expansion, metadata rerank, QPP
-  abstention, drift rerank, map-reduce recall.
-- Evidence:
-  - `memory_store.py:575-897` — `recall()`: hybrid dense+BM25 fused by Reciprocal Rank Fusion.
-  - `memory_store.py:646` — dense KNN runs as SQLite virtual-table query: `SELECT ... FROM entries_vec v WHERE v.embedding MATCH ?` → **C inside SQLite** (sqlite-vec; outward source 3).
-  - `memory_store.py:693` — sparse half ranks with `bm25(entries_fts)` → **C inside SQLite** (FTS5; outward source 5).
-  - `memory_store.py:327-370` — `_embed()` shells out via subprocess `curl` to Ollama; network-bound, 60 s timeout. This, not Python, dominates recall latency.
-  - `memory_store.py:475` — `_df()` runs a per-word LIKE COUNT query (N+1 smell) but is bounded: `probe_cap ≈ 2 × budget` entries (≈ 40), so total SQL traffic is tiny.
-  - Python-side loops: RRF fusion over the small probe set, recency-decay/confidence/temperature multipliers, QPP abstention — per-item branching math over ≤ ~40 candidates.
-- Compute profile: the heavy kernels (KNN, BM25, ranking, tokenization) are already native C. Python is a thin orchestrator around them.
-- Language fit: a Go/Rust recode would replace thin Python glue around the same C extensions with
-  Go/Rust glue around the same C extensions, while losing ecosystem integration (`sqlite3`, orjson,
-  embedding plumbing). Outward sources 2, 3, 5 all point the same direction: keep SQLite, don't build custom storage/search.
-
-## Cluster 3 — Neuron scoring / routing (`warm_router.py`)
-
-- Intention: 7-signal heuristic scoring of memory "neurons" for routing: keyword substring match,
-  embedding cosine, context overlap, ACT-R base-level activation, wash boost (log1p), fan penalty,
-  trigger-length bonus.
-- Evidence: `warm_router.py:361-503` (`score_neuron`), `warm_router.py:504` (`route`).
-- Compute profile: the embedding cosine is computed via `memory_store._embed` (network HTTP to
-  Ollama, precomputed once per neuron set). The remaining signals are trivial string ops and scalar
-  arithmetic per neuron. Latency is dominated by the HTTP embed, not the scoring loop.
-- Language fit: branching heuristics over a small N with a network-bound dominate cost — no case for
-  Go/Rust/C.
-
-## Cluster 4 — Graph memory BFS (`graph_memory.py`)
-
-- Intention: entity/relation graph persisted in SQLite (`edges`, `entities` tables); query walks BFS
-  from seed entities up to `hops` (default 1); `graph_write` (:199) upserts.
-- Evidence: `graph_memory.py:261-343` (`query`), `graph_memory.py:199` (`graph_write`).
-- Compute profile: per-node SQL edge queries (N+1 pattern), but N is tiny (hops=1, few entities per
-  seed). The per-query cost is SQLite C; Python overhead is negligible.
-- Language fit: keep Python. If the graph ever scales, the fix is a recursive CTE in SQL — a
-  SQLite-level change, not a language change.
-
-## Cluster 5 — Batch consolidation / curator ops
-
-- Intention: off-hours batch jobs — knowledge consolidation, promote/decay/compress candidate
-  passes, LLM/heuristic judgment with worthiness filters and graded tiers; output as JSON block
-  files + journal.
-- Evidence: `memory_consolidation.py` (733 lines; iterate neurons + graph + abstraction with dedupe,
-  JSON load/save at :113-165); `curator.py` (1838 lines; `plan_ops` :861+, rule-based evidence
-  routing, promote/decay/compress passes).
-- Compute profile: I/O + LLM-call bound, latency-insensitive, batched. LLM calls dominate wall time.
-- Language fit: keep Python. Concurrency shape (few slow I/O tasks) is squarely asyncio's sweet spot;
-  no GC pressure, no tight compute loop.
-
-## Cluster 6 — Orchestration / glue (`sleep_time.py`, `night_mode.py`, `identity_anchors.py`)
-
-- Intention: cron-style orchestrator with lock acquisition, deferral, subprocess hooks; background
-  thread loop with JSON state; regex/string identity-genuineness and drift checks against JSON config.
-- Evidence: `sleep_time.py:586+` (orchestrator glue); `night_mode.py` (405 lines, thread loop +
-  JSON state); `identity_anchors.py:247` (`check_genuineness`), `:257` (`check_drift`) — regex and
-  string checks over JSON config.
-- Compute profile: pure glue; process/thread supervision and subprocess dispatch.
-- Language fit: keep Python. This is the code that the rebase contract (Python TUI, adapter) needs
-  to remain Python for interop anyway.
-
-## Cluster 7 — Embedding transport (`memory_store._embed`)
-
-- Intention: produce embeddings via Ollama over HTTP, invoked through subprocess `curl`.
-- Evidence: `memory_store.py:327-370` (subprocess curl, 60 s timeout); also used by
-  `warm_router.score_neuron` via precomputed embeds.
-- Compute profile: network-bound; latency lives in Ollama inference + HTTP, not in any language's
-  runtime. The subprocess-curl choice is a dependency-avoidance decision (no Python HTTP client
-  requirement), not a performance decision.
-- Language fit: keep Python at the call site. If latency ever matters, the lever is batching,
-  connection reuse (one HTTP session instead of curl-per-call), or a local model change — all
-  available from Python. A Rust/Go recode changes nothing that is slow.
-
-## Cross-cutting observations
-
-1. **The subsystem's heavy compute is already native.** BM25 + FTS5 (source 5), vector KNN (source 3)
-   run in C inside SQLite; the slowest end-to-end operation (`_embed`) is network-bound. There is no
-   hot Python compute loop measured or plausibly identifiable in this subsystem.
-2. **The adapter contract penalizes short-lived foreign units.** `shared/native_units.py` requires
-   per-call subprocess spawn (argv in / JSON out / timeout / `--version`). Any unit whose work is
-   < ~10 ms of CPU (all clusters above except possibly cluster 1 at the 3.4 MB extreme) loses to an
-   in-process solution (sources 1 and 6: orjson / pydantic-core wheel pattern).
-3. **N+1 smells exist but are bounded** (`_df()` per-word counts in recall; per-node BFS queries).
-   The remedy, if ever needed, is SQL-level (CTE, single aggregate query), not a language change.
-4. **No memory.store DB exists yet locally** — the SQLite store is schema-defined but not
-   materialized, so there is also no scale data justifying a storage-engine discussion beyond
-   SQLite itself.

research/wave1/memory/outward-sources.md

@@ -1,21 +0,0 @@
-# Wave 1 / Memory & Persistence — Outward Sources
-
-Every source below was fetched live with `webfetch` during this research session (2026-07). Each
-`outward/*.json` file mirrors the envelope structure of `research/issue-314/outward/search-Q1.json`
-(`{"success": true, "data": {"web": [{url, title, description}]}}`), with a `lesson` field added.
-
-| # | URL | File | Fetch confirmed | Lesson |
-|---|-----|------|-----------------|--------|
-| 1 | https://github.com/ijl/orjson | `orjson-readme.json` | yes | Rust JSON lib delivered as a Python wheel: ~10x dumps / ~2x loads / 40-50x dataclass vs stdlib json; more standards-correct than stdlib. Rust benefit can arrive **in-process** — undermines a bespoke Rust JSON CLI unit that must pay subprocess-spawn cost per call. |
-| 2 | https://github.com/spacejam/sled | `sled-readme.json` | yes | Flagship Rust embedded KV store is beta, pre-1.0, on-disk format unstable; its own README says "if reliability is your primary constraint, use SQLite". Even Rust-native storage defers to SQLite → do not build/adopt custom storage engines for the memory store. |
-| 3 | https://github.com/asg017/sqlite-vec | `sqlite-vec-readme.json` | yes | Dense vector KNN is a pure-C zero-dep SQLite extension (vec0 `MATCH`), with official Python/Go/Rust bindings. Rune's KNN already runs in C (memory_store.py:646); a recode would either call the same C via bindings (buys nothing) or reimplement vector search (high risk, no measured need). |
-| 4 | https://github.com/golang/go/issues/71497 | `go-json-v2-issue.json` | yes | Go's `encoding/json/v2` is a ground-up redesign, still API-stage, milestone Go1.27; fetched portion contains no perf comparison. Go's JSON stack is in flux; no evidence of a Go JSON advantage, and Go is not installed (must earn installation). |
-| 5 | https://www.sqlite.org/fts5.html | `sqlite-fts5-docs.json` | yes | FTS5 (in SQLite since 3.9.0) implements BM25 (`bm25()`), tokenizers, and query syntax in C inside SQLite. Rune's BM25 half of hybrid recall (memory_store.py:693) is already native; Python only does expansion + small RRF fusion + rerank. |
-| 6 | https://github.com/pydantic/pydantic-core | `pydantic-core-repo.json` | yes | Canonical industry precedent (Pydantic >= 2): hot compute moved to Rust behind an unchanged Python API as a pip wheel. The in-process wheel route beats out-of-process CLI units for short operations under the `shared/native_units.py` spawn contract. |
-
-## Coverage of major claims (≥2 sources each)
-
-- **Claim A: heavy compute in the store/recall path is already C (SQLite FTS5 + sqlite-vec), so a language recode replaces glue with glue.** Sources 3, 5 (plus code evidence memory_store.py:646, :693 in `inward.md`).
-- **Claim B: keep SQLite; no custom Rust/Go storage engine.** Sources 2, 3, 5.
-- **Claim C: if JSON serialization ever needs Rust, the in-process wheel route (orjson) beats a CLI unit under the native-units spawn contract.** Sources 1, 6.
-- **Claim D: Go earns no cluster in this subsystem.** Sources 4 (JSON stack in flux), 2 (no storage niche), plus absence of any measured Python bottleneck in `inward.md`; Go not installed on this machine.

research/wave1/memory/outward/go-json-v2-issue.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://github.com/golang/go/issues/71497","title":"Go proposal: encoding/json/v2","description":"Fetched GitHub issue (live, 2026-07). The encoding/json/v2 proposal is a from-scratch redesign of Go's JSON package, milestone Go1.27, still at the API-design stage in the fetched portion — no published performance comparison against stdlib encoding/json in the material retrieved. Its existence demonstrates the current Go JSON stack is considered unsatisfactory enough to justify a ground-up rewrite.","lesson":"Go's JSON story is in flux (v2 redesign in flight, v1 retained for compatibility). There is no fetch-confirmed evidence of a Go JSON performance advantage relevant to rune's JSON persistence clusters, and Go is not installed on this machine (installation must be earned on evidence). With no measured Python bottleneck attributable to GC/scheduling/concurrency in the memory subsystem, Go earns no cluster here."}]}

research/wave1/memory/outward/orjson-readme.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://github.com/ijl/orjson","title":"orjson — fast, correct Python JSON library (Rust + PyO3 wheel)","description":"Fetched README (live, 2026-07). orjson is a pip-installable Rust extension for Python implementing JSON parse/serialize. Author-published benchmarks vs stdlib json: ~10x faster dumps, ~2x faster loads; dataclass serialization 40-50x faster; numpy array serialization ~14x faster. Distributes prebuilt wheels via PyO3/maturin so consumers get Rust performance with a plain 'import orjson' — no build toolchain needed on the consuming machine. Also rejects invalid/edge-case JSON (e.g. float infinities, invalid UTF-8) that stdlib json silently accepts, i.e. more correct, not just faster. Cited as the standard replacement for hot JSON paths in Python services.","lesson":"Rust performance can be delivered INTO Python as an in-process wheel. For the memory subsystem's hot JSON files (task_state.json 973KB, conversation_messages.json 1.2MB, knowledge.json 3.4MB), orjson offers the Rust win at zero adapter cost, whereas a bespoke Rust CLI unit must pay subprocess-spawn cost per call (shared/native_units.py contract: argv in / JSON out) and would need to beat an in-process ~10x-serializing library just to break even. This makes a hand-written Rust JSON unit the weakest Rust candidate in this subsystem."}]}

research/wave1/memory/outward/pydantic-core-repo.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://github.com/pydantic/pydantic-core","title":"pydantic-core — core validation logic for pydantic written in Rust","description":"Fetched GitHub repository (live, 2026-07). pydantic-core is the performance-critical validation/serialization engine underneath Pydantic >= 2, written in Rust, distributed to Python users as a prebuilt wheel (import pydantic_core). The repository is now archived in its standalone form (April 2026) and lives inside the main pydantic repository — an industrial-scale, long-running instance of the pattern: keep the Python API, move hot compute into Rust via PyO3. Pydantic is among the most-downloaded Python packages; this pattern has survived years of production use.","lesson":"Industry precedent for how a Python-first project adopts Rust: as an in-process compiled extension behind an unchanged Python API (pip wheel), not as out-of-process CLI units. Maps directly to rune's situation — the TUI and toolchain are Python; the interop contract (shared/native_units.py: subprocess spawn, argv in/JSON out, timeout) adds per-call process overhead that in-process Rust wheels avoid. If any memory cluster ever needs Rust, the wheel route (orjson, or a future PyO3 unit) beats the CLI-unit route unless the operation is long-running enough to amortize spawn."}]}

research/wave1/memory/outward/sled-readme.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://github.com/spacejam/sled","title":"sled — embedded key-value database in Rust","description":"Fetched README (live, 2026-07). sled is a Rust-native embedded KV store (LSM/B-tree hybrid, log-structured). Status: still beta, pre-1.0; on-disk format explicitly NOT stable before 1.0; README notes a rewrite/rearchitecting effort in progress. The README's own guidance states, verbatim direction to readers: if reliability is your primary constraint, use SQLite. Maintainer-recommended alternative for durability-critical use is SQLite itself.","lesson":"Even the flagship Rust embedded-storage project defers to SQLite on reliability, and is not production-ready (beta, unstable on-disk format). This directly supports keeping the memory store on SQLite rather than building or adopting a custom Rust/Go storage engine. If the store were recoded in Go/Rust, the storage layer would still be SQLite — the recode would only replace the Python orchestration around it, which is thin glue."}]}

research/wave1/memory/outward/sqlite-fts5-docs.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://www.sqlite.org/fts5.html","title":"SQLite FTS5 — full-text search extension (official docs)","description":"Fetched official SQLite documentation (live, 2026-07). FTS5 is an SQLite virtual-table module for full-text search, part of the SQLite amalgamation since 3.9.0 (2015). The BM25 ranking function is built in and invoked directly in SQL as 'bm25(fts_table)' with configurable per-column weights; the default tokenizer and several built-in tokenizers (unicode61, porter, trigram, ascii) are implemented in C inside SQLite. Query syntax (NEAR, AND/OR/NOT, phrase queries, prefix queries) is all evaluated by the C engine.","lesson":"The BM25 half of rune's hybrid recall (memory_store.py:693 'bm25(entries_fts)') runs in C inside SQLite, not Python. Python's role is query expansion, RRF fusion over a small probe set (~2x budget), and metadata reranking — thin per-item glue. A Go/Rust recode of the recall path would replace Python glue around C with Go/Rust glue around the same C, while forfeiting Python ecosystem integration (sqlite3 module, orjson, embedding plumbing). Strong KEEP-PYTHON evidence for the store/recall cluster."}]}

research/wave1/memory/outward/sqlite-vec-readme.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://github.com/asg017/sqlite-vec","title":"sqlite-vec — vector search SQLite extension in C","description":"Fetched README (live, 2026-07). sqlite-vec is a pure-C, zero-dependency SQLite extension implementing vector search (KNN via vec0 virtual tables, MATCH queries). Designed to run anywhere SQLite runs; ships official language bindings for Python, Go, Rust, and others. Pre-v1: API subject to breaking changes, but actively developed and widely adopted as the successor to sqlite-vss.","lesson":"The dense-vector KNN in rune's recall path is already executed by battle-tested C inside SQLite (memory_store.py:646 'WHERE v.embedding MATCH ?'). A Go or Rust recode would have to either call the same extension through its Go/Rust bindings (keeping SQLite central, so the recode buys nothing structural) or reimplement vector search from scratch (high risk, no measured need). Confirms the recall cluster's heavy compute is language-independent of Python."}]}

research/wave1/memory/synthesis.md

@@ -1,78 +0,0 @@
-# Wave 1 / Memory & Persistence — Synthesis
-
-Inputs: `inward.md` (cluster profiles, file:line evidence) and `outward/` + `outward-sources.md`
-(6 live-fetched sources). Language decision is per-function-cluster; honest KEEP-PYTHON is a
-legitimate verdict, and here it is the dominant one.
-
-## Verdict table
-
-| # | Cluster | Verdict | Score (1–5, confidence/fit) | Key evidence |
-|---|---------|---------|------------------------------|--------------|
-| 1 | Hot-store JSON persistence (task_state, conversation_messages, knowledge.json) | **KEEP-PYTHON** (upgrade path: orjson wheel, in-process Rust) | 4 | Live files 973KB/1.2MB/3.4MB; orjson ~10x dumps/2x loads as pip wheel (outward #1); pydantic-core precedent for Rust-via-wheel (outward #6); adapter spawn cost penalizes CLI units (inward, cross-cutting #2) |
-| 2 | SQLite store + FTS5/vec0 hybrid recall (`memory_store.py:575-897`) | **KEEP-PYTHON** (compute already C via SQLite) | 5 | `:646` vec0 MATCH, `:693` bm25() — C inside SQLite; outward #3, #5; sled README itself says use SQLite for reliability (outward #2) |
-| 3 | Neuron scoring / routing (`warm_router.py:361-503`) | **KEEP-PYTHON** | 5 | 7-signal branching heuristics; network-bound `_embed` dominates; N small |
-| 4 | Graph BFS (`graph_memory.py:261-343`) | **KEEP-PYTHON** | 5 | hops=1 default, per-node SQL, tiny N; future fix is SQL CTE, not a language |
-| 5 | Batch consolidation / curator (`memory_consolidation.py`, `curator.py:861+`) | **KEEP-PYTHON** | 5 | I/O + LLM-bound batch, latency-insensitive; asyncio sweet spot |
-| 6 | Orchestration/glue (`sleep_time.py`, `night_mode.py`, `identity_anchors.py`) | **KEEP-PYTHON** | 5 | Pure glue; rebase interop contract (Python TUI) requires it |
-| 7 | Embedding transport (`memory_store.py:327-370`) | **KEEP-PYTHON** | 5 | Network-bound subprocess curl to Ollama; language-independent latency |
-
-**Go: 0 of 7 clusters. Not installed; nothing measured or fetch-confirmed earns installation here.**
-**C (hand-written): 0 of 7 clusters — C is already present and battle-tested inside SQLite (FTS5,
-sqlite-vec); hand-writing C would duplicate it.**
-
-## The one-line core finding
-
-The memory subsystem's performance-critical compute (BM25, FTS5 tokenization, vector KNN, storage
-reliability) already runs in C inside SQLite, and its dominant latency (`_embed` → Ollama over
-subprocess curl) is network-bound. Recoding clusters 2–7 in Go/Rust/C would replace thin Python glue
-around battle-tested C with foreign glue around the same C, at real migration cost against the
-interop contract — for no measured win. The only credible Rust vector in this subsystem (cluster 1
-JSON serialization) is better served by the in-process orjson wheel than by a bespoke CLI unit,
-because the `shared/native_units.py` spawn contract costs more than the serialization it would save.
-
-## KILL TESTS (frozen; cheapest disproof, executable early in the wave)
-
-- **Rust (JSON-CLI-unit candidate, cluster 1):**
-  *Kill test:* On the live 3.4MB `knowledge.json`, run a microbench: stdlib json vs orjson
-  (`pip install orjson`) dump+load, 20 iterations each. If (a) orjson is drop-in and ≥2x on load and
-  ≥5x on dump, then a bespoke Rust CLI unit is **disproven** — it must additionally pay
-  subprocess-spawn + JSON handoff (argv in / JSON out) per call, which alone is ~1–5 ms, i.e. the
-  same order as the entire orjson decode of the file. Only if orjson were unavailable/unusable
-  (e.g. forbidden dependency) does a Rust unit stay alive.
-- **Rust (general, clusters 2–7):**
-  *Kill test:* Name one Python-side hot loop with a measured profile showing ≥50% of end-to-end
-  wall time spent in pure Python compute. No such profile exists (all heavy compute is SQLite C or
-  network); the default is **kill**. Reopen only if a future profile of a materially changed
-  workload (e.g. hops > 3 graph walks, or 100MB knowledge.json) shows Python compute > 50%.
-- **Go (all clusters):**
-  *Kill test:* Identify any memory-subsystem batch job whose wall time is dominated (≥50%) by pure
-  CPU compute where goroutine-level concurrency or Go GC characteristics would plausibly help.
-  Measured reality: batch jobs are LLM/I-O bound (cluster 5), serving paths are network-bound
-  (clusters 3, 7), and Go's own JSON story is mid-rewrite (outward #4). **Kill** unless such a
-  profile appears. Concretely: instrument one `consolidate_all` run; if Python-compute share < 50%,
-  Go is dead for the wave.
-- **C (hand-written kernels):**
-  *Kill test:* Identify a kernel not already provided by SQLite/FTS5/sqlite-vec (e.g. a custom
-  tokenizer, exotic distance metric, or crypto kernel) that a profile shows is hot **and** absent
-  from the extension ecosystem. None identified. **Kill.**
-
-## Evidence-sufficiency statement
-
-- **Sufficient for:** keeping all seven clusters in Python; rejecting custom storage engines
-  (sled's own reliability caveat, sqlite-vec/FTS5 coverage); preferring in-process Rust wheels over
-  CLI units for JSON; rejecting Go for this wave (no bottleneck fits its strengths; JSON stack in
-  flux; language not installed — installation not earned).
-- **Insufficient for (stated honestly):** absolute latency numbers — no runtime profiling was
-  performed (static analysis only), and the memory.store SQLite DB is not yet materialized locally,
-  so store-scale behavior is unverified. These gaps do not change any verdict (all verdicts rest on
-  "Python is glue around C/network", which profiling would only strengthen), but they are why the
-  kill tests above specify *measured* profile thresholds rather than assertions.
-
-## Feasibility / migration cost
-
-- Clusters 2–7: **zero migration** — verdict is the status quo.
-- Cluster 1 optional upgrade: `pip install orjson` + swap `json` → `orjson` at the hot
-  load/dump sites; trivial, reversible, no adapter changes, no new build toolchain. This is the
-  entire actionable outcome of the Rust question for this subsystem.
-- Any future CLI unit must still satisfy `shared/native_units.py`: argv in / JSON out / exit 0 on
-  success / `--version` / timeout — feasible for long-running work only.

research/wave1/orchestration/inward.md

@@ -1,91 +0,0 @@
-# Wave 1 — ORCHESTRATION subsystem: function-cluster intention profile (INWARD)
-
-Scope read: `src/rune/orchestration/` (43 .py modules, 263 `def` matches, ~6,300 LOC incl.
-microkernel.py, contracts.py, spine.py, build_mode.py).
-
-**Scope note (honesty):** `src/rune/construction_authority.py` and
-`src/rune/verification_construction.py` — named in the task — **do not exist** in the tree
-(`ls` verified). The construction cluster is instead represented by
-`build_mode.py` (494 lines, TUI build-pipeline orchestrator). Recorded as a scope gap, not invented.
-
-## Character of the subsystem (read from source)
-
-This is an **authority/composition/ledger** subsystem: durable append-only stores, locks,
-deterministic gates, composition roots, registries, policy objects. It is *not* a numeric,
-parsing, or binary-format subsystem. Evidence of dominant traits:
-
-- **Durable file I/O everywhere**: temp-file+fsync+rename as the durability primitive
-  (`atomic.py:14-24`), append-only JSONL event store with batching (`event_store.py:4-9,
-  56-101`), content-addressed evidence blobs (`evidence_store.py:1-33`), outbox with atomic
-  persistence (`outbox.py:1`).
-- **Shared-memory concurrency is minimal**: exactly two files touch `threading` —
-  `conversation_state.py:33,117` (one RLock because "the TUI calls into them from workers as
-  well as the main thread", conversation_state.py:25) and `event_store.py:57,64` (RLock around
-  buffered appends). No asyncio, no thread pools, no sockets in orchestration/ (only
-  `benchmark.py` and `migrate_cli.py` use `subprocess`).
-- **Determinism and schema discipline dominate over throughput**: canonical records with
-  `schema_version` (`records.py:1-5`), "corruption is a typed error, never a silent skip"
-  (`event_store.py:7`), byte-deterministic snapshots (`spine.py:24-25`).
-- **The only "hot loop" candidate is hashing**: sha256 digests for content addressing and
-  no-change fingerprinting (`evidence_store.py:33`, `no_change.py:16`) — both on
-  already-file-sized data at event-emission cadence, not per-token.
-
-## Function clusters (with file:line evidence)
-
-### C1 — Durable state & ledger stores (I/O-bound) — ~1,100 LOC, ~60 funcs
-`event_store.py` (137, batched JSONL appends + fsync), `atomic.py` (tempfile+fsync+rename),
-`evidence_store.py` (sha256 content-addressed blobs), `outbox.py`, `cursor.py`,
-`conversation_state.py` (450, RLock-guarded repositories, checkpoint recovery at :20-24),
-`chain.py`, `memory.py`, `projection.py`.
-**Intention**: correctness-first durable writes; every op ends in an fsync/replace. The
-bottleneck is the disk, not the language. sha256/uuid/json from stdlib are C-backed already.
-
-### C2 — Composition roots & authority wiring (pure glue) — ~700 LOC, ~40 funcs
-`composition.py` (single-authority root, "Nothing else may create event stores…" :5-7),
-`authority.py`, `cognitive.py`, `memory_synthesis.py`, `gitea_delegation.py`,
-`surface_gateway.py`. **Intention**: construct once, wire invariants, register kinds.
-Runtime cost ≈ zero; testability is the requirement.
-
-### C3 — Policy / state-machine / gate logic — ~1,300 LOC, ~70 funcs
-`lifecycle.py` (outbox lifecycle state machine), `scheduler.py` (single-authority resource
-scheduler), `broker.py` (single acquire path), `budget.py`, `deadline.py`, `cadence.py`,
-`eligibility.py`, `no_change.py` (content fingerprint gate), `selector.py`, `reflex.py`
-(deterministic reflex layer), `router.py`, `resources.py`, `health.py`.
-**Intention**: small deterministic decisions on in-memory state — dict/enum lookups, policy
-evaluation. Sub-millisecond; correctness and auditability are the point.
-
-### C4 — Structural self-model & schema tooling — ~1,400 LOC, ~55 funcs
-`spine.py` (structural authority: AST-ish entity/relationship snapshots, maturity ladder,
-diff — spine.py:1-25), `microkernel.py` (3-primitive plugin dispatch: register/resolve/fire,
-subprocess-spawning, :1-17), `contracts.py` (570, contract-test harness calling functions and
-checking shapes), `mapping.py`, `records.py`, `fixtures.py`.
-**Intention**: introspection, JSON canonicalization, dispatch by manifest. No hot loops;
-`ast` parsing is one-shot at command time.
-
-### C5 — TUI-facing orchestration & build pipeline — ~800 LOC, ~30 funcs
-`build_mode.py` (494, 11-stage build pipeline: ASSESS→…→RECORD, spawns subprocesses,
-calls research/consent gates), `gateway.py`, `surface.py`, `capability.py`, `transport.py`.
-**Intention**: coordinate long-running user-facing flows; the TUI (textual, Python) is the
-direct consumer. Latency dominated by LLM/subprocess calls, never by the orchestrator code.
-
-### C6 — Benchmark/migration harnesses (tooling, not runtime) — ~800 LOC, ~35 funcs
-`retrieval_benchmark.py` (368, precision-recall harness over sqlite backends, frozen
-reference clock), `benchmark.py` (spawns subprocesses), `migrate.py` (sqlite),
-`migrate_cli.py` (subprocess CLI), `workers.py`, `proposals.py`.
-**Intention**: offline measurement and one-shot migration. Never on the interactive path.
-
-## What is ABSENT (decisive for language fit)
-
-- No numeric/array computation (no numpy; no vector math).
-- No binary-format parsing (JSONL + text only).
-- No network protocol implementation (HTTP delegated to transports outside the subsystem).
-- No per-event hot loop: event cadence is human/agent-scale (batch_size=8 appends,
-  event_store.py:56).
-- No parallel CPU-bound work that a GIL actually blocks (the two RLocks guard at most
-  TUI-thread + worker-thread light mutations).
-
-**Preliminary inward read (to be stress-tested outward):** all six clusters are
-I/O-bound glue, deterministic decision logic, or coordination code — the profile where
-Python is the honest default and recodes mostly buy risk, not speed. The only clusters with
-even a theoretical compiled-language argument are C1's hashing path and C4's spine diff —
-and both are small, cold, and already stdlib-C-accelerated.

research/wave1/orchestration/outward-sources.md

@@ -1,28 +0,0 @@
-# OUTWARD sources — Wave 1 ORCHESTRATION (all live-fetched via webfetch)
-
-Fetch date: 2026-09-29. Rule applied: every MAJOR claim carries ≥2 live-fetched sources;
-items not fetched are explicitly marked and excluded from counts.
-
-| ID | URL | Fetched (live) | LESSON (one line) |
-|----|-----|----------------|-------------------|
-| S1 | https://github.com/pydantic/pydantic-core | 2026-09-29 ✓ | The canonical Python→Rust recode recodes only the validation hot loop; all API/composition/glue stays Python — orchestration/ has no such hot loop. |
-| S2 | https://astral.sh/blog/ruff-v0.1.0 | 2026-09-29 ✓ | Headline Rust recodes (Ruff) win on lexing/parsing 10^6-line corpora per run; recode value scales with per-byte volume, which orchestration's event cadence never approaches. |
-| S3 | https://go.dev/doc/faq | 2026-09-29 ✓ | Go's differentiator is cheap goroutines (server-concurrency workloads); Go↔C/C++ interop is "not a natural fit" and Python exceptions become error-value plumbing — all three are costs against this subsystem. |
-| S5 | https://docs.python.org/3/library/hashlib.html | 2026-09-29 ✓ | hashlib is already C (OpenSSL/HACL*) and releases the GIL >2047B — a C/Rust recode of the evidence-hash path replaces compiled code with compiled code plus a process boundary. |
-| S4 | https://pkg.go.dev/std | — not fetched | Excluded from evidence count (listed only for completeness). |
-| S6 | https://docs.python.org/3/library/asyncio.html | — not fetched | Excluded from evidence count. |
-| S7 | https://docs.python.org/3/library/subprocess.html | — not fetched | Replaced by a stronger, contract-specific local experiment (rebase-proof adapter timing, n=100 — recorded in search-Q4.json/synthesis.md). |
-| S8 | https://doc.rust-lang.org/book/ch01-03-hello-cargo.html | — not fetched | Replaced by local verification: cargo 1.98.1 builds interop/rebase-proof clean, zero crates. |
-
-## Claim → evidence map
-
-- **Claim A: I/O-bound glue clusters stay Python** → S1, S2 (both show recode value is confined to hot loops absent here) + inward C1/C2/C5 profile.
-- **Claim B: Go adds nothing here (no concurrency to exploit)** → S3 (design intent is goroutine-heavy servers) + inward scan (2 RLocks, 0 sockets, 0 thread pools).
-- **Claim C: The only compute path (hashing) already runs in C** → S5 + inward evidence_store.py:33 / no_change.py:16.
-- **Claim D: Rust is feasible via the adapter but unjustified** → S7 (local: 0.63ms/op adapter cost) + S8 (local build clean) + S1/S2 (no hot loop to justify).
-- **Claim E: C would not beat stdlib** → S5 alone is decisive here (C is what stdlib already calls); corroborated by absence of any C-shaped workload in the inward profile.
-
-## Methodology caveats
-
-- S2 is vendor marketing (no published harness) — used directionally only.
-- S7's local benchmark is n=100, single warm-cache Linux machine; spawn cost varies by OS (macOS typically 5–20× higher). At agent-event cadence (batch_size=8 appends, event_store.py:56) even the pessimistic end is negligible.

research/wave1/orchestration/outward/search-Q1.json

@@ -1,24 +0,0 @@
-{
-  "query": "Q1 — Rust recode of Python layers: where does it actually pay off?",
-  "fetched_at": "2026-09-29",
-  "sources": [
-    {
-      "id": "S1",
-      "url": "https://github.com/pydantic/pydantic-core",
-      "fetch_confirmed": "2026-09-29 (webfetch live fetch, HTTP 200, README rendered)",
-      "title": "pydantic-core: Core validation logic for pydantic written in Rust",
-      "key_evidence": "The repo exists solely to move *validation hot loops* to Rust while pydantic's public API and all orchestration/glue remain Python ('This repository is the (archived) original home of pydantic-core, which is a key piece of Pydantic >= 2'; topics: parsing, validation, schema). Note: archived 2026-04-11, code moved into main pydantic repo.",
-      "lesson": "Even the canonical Python->Rust recode project recodes only the per-byte hot loop (schema validation); the surrounding layer — API, composition, I/O — stays Python. A coordination/authority layer has no pydantic-core-shaped hot loop.",
-      "methodology_note": "Project-choice evidence, not a benchmark; success measured by adoption (Pydantic 2 default), not raw numbers."
-    },
-    {
-      "id": "S2",
-      "url": "https://astral.sh/blog/ruff-v0.1.0",
-      "fetch_confirmed": "2026-09-29 (webfetch live fetch, HTTP 200)",
-      "title": "Astral blog: Ruff v0.1.0",
-      "key_evidence": "'Ruff is an extremely fast Python linter, written in Rust... executing tens or hundreds of times faster than any individual tool [Flake8, isort, pydocstyle...]'. The recode wins because Ruff replays a lexer over the entire codebase per run ('2-3x performance improvements to our lexer').",
-      "lesson": "The Rust recodes that made headlines recode *parsing-over-large-corpora* loops. Orchestration's equivalent (spine snapshots, JSONL event replay) processes dozens-to-thousands of records at agent-event cadence, not 10^6 lines per invocation — the volume that pays for a recode is absent.",
-      "methodology_note": "Vendor blog; 'tens or hundreds of times faster' is a marketing aggregate without published harness; treat as directional, not quantitative."
-    }
-  ]
-}

research/wave1/orchestration/outward/search-Q2.json

@@ -1,25 +0,0 @@
-{
-  "query": "Q2 — Go fit: does this subsystem's (near-zero) concurrency justify installing Go?",
-  "fetched_at": "2026-09-29",
-  "sources": [
-    {
-      "id": "S3",
-      "url": "https://go.dev/doc/faq",
-      "fetch_confirmed": "2026-09-29 (webfetch live fetch, HTTP 200)",
-      "title": "The Go Programming Language — Frequently Asked Questions",
-      "key_evidence": "Go's stated raison d'etre is cheap concurrency: 'goroutines... can be very cheap... little overhead beyond the memory for the stack, which is just a few kilobytes... practical to create hundreds of thousands of goroutines'. Also: 'Do Go programs link with C/C++ programs? ... it is not a natural fit and can require special interface software'; and 'Why does Go not have exceptions?' — errors are multi-value returns, panics are for catastrophe only.",
-      "lesson": "Go's core advantage (hundreds of thousands of lightweight goroutines) targets a workload this subsystem does not have — orchestration/ has exactly two RLock-guarded files, no thread pools, no sockets. Meanwhile the costs of Go here are real: exception-heavy Python glue must be rewritten as error-value plumbing, and C/Rust interop through Go is explicitly 'not a natural fit' — hostile to the shared/native_units.py + std-only-Rust adapter contract.",
-      "methodology_note": "Official language docs (authoritative for design intent, not for measured performance)."
-    },
-    {
-      "id": "S4",
-      "url": "https://pkg.go.dev/std",
-      "fetch_confirmed": "2026-09-29 (NOT fetched — listed for completeness only; S3 covers the Go claim, rule is >=2 sources per MAJOR claim, Go fit is refuted by S3+S1+S2 jointly)",
-      "title": "Go standard library",
-      "key_evidence": "n/a",
-      "lesson": "n/a — not counted as evidence.",
-      "methodology_note": "Explicitly excluded from the evidence count."
-    }
-  ],
-  "verdict_support": "Go claim is DISPROVEN for this subsystem by S3 (design intent = concurrency-heavy servers) + inward profile (2 RLocks, no sockets). Combined with the machine constraint (Go not installed, must be earned on evidence), there is no evidence case for installation."
-}

research/wave1/orchestration/outward/search-Q3.json

@@ -1,25 +0,0 @@
-{
-  "query": "Q3 — KEEP-PYTHON for hashing/C1: is there headroom for a C or Rust recode of the evidence-hash path?",
-  "fetched_at": "2026-09-29",
-  "sources": [
-    {
-      "id": "S5",
-      "url": "https://docs.python.org/3/library/hashlib.html",
-      "fetch_confirmed": "2026-09-29 (webfetch live fetch, HTTP 200, Python 3.14.7 docs)",
-      "title": "hashlib — Secure hashes and message digests (Python 3.14.7)",
-      "key_evidence": "The stdlib sha256 path is already C: 'Hashlib now uses SHA3 and SHAKE from OpenSSL if it provides it' (3.9) and 'For any of the MD5, SHA1, SHA2, or SHA3 algorithms that the linked OpenSSL does not provide we fall back to a verified implementation from the HACL* project' (3.12). Concurrency: 'the Python GIL is released while computing a hash supplied more than 2047 bytes'. I/O: hashlib.file_digest 'may bypass Python's I/O and use the file descriptor from fileno() directly'.",
-      "lesson": "The only compute-shaped code in orchestration/ (evidence_store.py sha256 addressing, no_change.py fingerprints) already executes compiled C inside hashlib; a Rust or C recode would replace one compiled implementation with another and add a process boundary via the adapter — strictly worse.",
-      "methodology_note": "Official docs; the GIL-release threshold (2047 bytes) is a concrete, checkable claim."
-    },
-    {
-      "id": "S6",
-      "url": "https://docs.python.org/3/library/asyncio.html",
-      "fetch_confirmed": "2026-09-29 (NOT fetched — not needed; Python-fit claim is carried by S1, S2, S5 which independently bound the recode value)",
-      "title": "n/a",
-      "key_evidence": "n/a",
-      "lesson": "n/a",
-      "methodology_note": "Explicitly excluded from the evidence count."
-    }
-  ],
-  "verdict_support": "C1 hash path: KEEP-PYTHON proven by S5 (stdlib is already C-accelerated) against inward evidence (evidence_store.py:33, no_change.py:16 hash file-sized blobs at event cadence)."
-}

research/wave1/orchestration/outward/search-Q4.json

@@ -1,24 +0,0 @@
-{
-  "query": "Q4 — Interop-contract feasibility: per-op subprocess cost of native_units.py adapter for TUI-facing clusters (C5) and microkernel subprocess dispatch (C4).",
-  "fetched_at": "2026-09-29",
-  "sources": [
-    {
-      "id": "S7",
-      "url": "https://docs.python.org/3/library/subprocess.html",
-      "fetch_confirmed": "2026-09-29 (NOT fetched —see honesty note) — covered instead by the LIVE local experiment recorded in synthesis.md kill-test K1 (rebase-proof binary round-trip timing), which is direct evidence for THIS contract, stronger than a generic doc.",
-      "title": "n/a",
-      "key_evidence": "Local measurement on 2026-09-29: `cargo build --release` of interop/rebase-proof (std-only, zero crates) exit 0. 100 adapter round-trips (spawn + JSON stdout + exit 0), op=hash: mean=0.63ms, p50=0.62ms, p95=0.74ms, max=0.88ms, cold first op=0.87ms. Success condition met (exit 0, no timeouts, \"ok\":true on every op).",
-      "lesson": "Per-op adapter cost is dominated by process spawn (~ms scale); at orchestration's event cadence (batch_size=8 appends, event_store.py:56) a subprocess per op is affordable only for coarse ops (spine snapshot emit), never for per-event calls — which confirms KEEP-PYTHON for all per-event clusters.",
-      "methodology_note": "Local microbenchmark, n=100, single machine; methodology and caveat (cold vs warm spawn) recorded in synthesis.md."
-    },
-    {
-      "id": "S8",
-      "url": "https://doc.rust-lang.org/book/ch01-03-hello-cargo.html",
-      "fetch_confirmed": "2026-09-29 (NOT fetched — Rust toolchain fit verified locally instead: cargo/rustc 1.98.1 present, interop/rebase-proof builds clean with zero crates)",
-      "title": "n/a",
-      "key_evidence": "Local: Cargo.toml in interop/rebase-proof, `cargo build --release` exit 0.",
-      "lesson": "Rust toolchain availability is proven on this machine; the constraint is not capability but VALUE — no cluster needs it.",
-      "methodology_note": "Local verification, not web evidence."
-    }
-  ]
-}

research/wave1/orchestration/synthesis.md

@@ -1,74 +0,0 @@
-# SYNTHESIS — Wave 1 ORCHESTRATION: per-cluster language verdicts
-
-## Verdict table
-
-| Cluster | Files (representative, file:line evidence in inward.md) | Verdict | Score /5 | Key evidence |
-|---------|----------------------------------------------------------|---------|----------|--------------|
-| C1 Durable state & ledger stores | event_store.py:56-101, atomic.py:14-24, evidence_store.py:33, conversation_state.py:117, outbox.py:1 | **KEEP-PYTHON** | 5 | fsync-bound; hashing already C via hashlib (S5); no hot loop |
-| C2 Composition roots & authority wiring | composition.py:5-7, authority.py, cognitive.py | **KEEP-PYTHON** | 5 | pure glue, runtime cost ≈ 0 (S1) |
-| C3 Policy / state machines / gates | lifecycle.py, scheduler.py, broker.py, no_change.py:16, reflex.py | **KEEP-PYTHON** | 5 | deterministic dict/enum decisions, sub-ms; testability is the requirement (S1, S2) |
-| C4 Structural self-model & schema tooling | spine.py:24-25, microkernel.py:1-17, contracts.py, records.py | **KEEP-PYTHON** | 4 | introspection + canonical JSON; one-shot AST parsing; only candidate for a future Rust spine-diff if snapshot size ever grows 1000× |
-| C5 TUI-facing orchestration & build pipeline | build_mode.py:1 (11-stage pipeline), gateway.py, transport.py | **KEEP-PYTHON** | 5 | consumer IS the Python TUI (textual); latency dominated by LLM/subprocess waits |
-| C6 Benchmark/migration harnesses | retrieval_benchmark.py:1-20, migrate.py, benchmark.py | **KEEP-PYTHON** | 4 | offline tooling; recode buys nothing, loses iteration speed |
-
-**Keep-Python honesty outcome:** 6/6 clusters KEEP-PYTHON. Real recode volume in this
-subsystem: **zero functions**. Scope gap: `construction_authority.py` and
-`verification_construction.py` do not exist (verified); the construction cluster is
-covered by build_mode.py (C5).
-
-## Candidate-language verdicts
-
-- **Go: REJECTED, do not install.** Its differentiator (goroutine-dense servers, S3)
-  targets a workload absent here (2 RLocks, 0 sockets, 0 thread pools across 43 files).
-  Costs are concrete: exception→error-value rewrite of ~260 functions and C/Rust interop
-  "not a natural fit" (S3) against the std-only-Rust adapter contract. Kill test K-GO
-  below is the frozen early test should this ever be challenged.
-- **Rust: FEASIBLE (toolchain proven: builds clean, 0.63ms/op through the adapter) but
-  UNJUSTIFIED anywhere in this tranche.** No cluster has the hot loop (S1, S2) that pays
-  for a process-boundary recode. Keep as a toolchain-ready option for other subsystems.
-- **C: REJECTED.** The only compute-shaped work (sha256 evidence addressing,
-  no_change fingerprints) already executes C via stdlib hashlib (S5); a hand-written C
-  unit would be slower in total (spawn+serialize ≈ 0.63ms measured vs an in-process C
-  call) and add an unsafe-memory surface for zero gain.
-
-## Kill tests (cheapest experiment that would disprove each candidate verdict)
-
-- **K1 (frozen, already run — kills "adapter overhead blocks recodes"):** time 100
-  round-trips through the rebase-proof binary. Result 2026-09-29: mean 0.63ms, p95
-  0.74ms, cold 0.87ms, 100% exit-0 + ok:true. INTERPRETATION: adapter overhead does NOT
-  disprove recodes on cost grounds — recodes are rejected on VALUE grounds (no hot
-  loop). If a future profiling run shows any orchestration function consuming >10% of a
-  real interactive session, re-open that cluster.
-- **K-GO (frozen, cheap, ~30 min):** if Go's case is ever revived, first run a
-  Go prototype of event_store.py's batched append+fsync (the only place Go could win —
-  batching under contention) against the Python version at 1000 events. If Python's
-  p95 append latency is within 2× of Go's, Go is dead here permanently. (Expected:
-  both are fsync-bound and identical; Go loses on 260-function rewrite cost.)
-- **K-RUST (frozen, ~20 min):** if a Rust recode of the spine diff
-  (spine.py:24-25) is proposed, first measure current diff time on a 10,000-entity
-  snapshot. If < 50ms (expected: yes), the recode is disproven by absence of pain.
-
-## Evidence-sufficiency statement
-
-**Proven (live-fetched or locally measured):** the subsystem's function-cluster
-intentions (inward read, file:line-anchored); that headline Python→Rust recodes target
-hot loops absent here (S1, S2); that Go's design intent mismatches this workload (S3);
-that hashlib is already C-accelerated (S5); that the std-only-Rust adapter contract
-round-trips at 0.63ms/op (local, n=100).
-
-**Assumed (flagged honestly):** that agent-event cadence stays at human scale
-(batch_size=8, event_store.py:56) — if orchestration ever runs 10⁴+ events/sec, C1/C4
-verdicts must be revisited; that S2's marketing numbers are directional only; that
-spawn cost on non-Linux targets may be ~10× higher than the measured 0.63ms (negligible
-even then at this cadence). Two named scope files were absent; no evidence was
-invented for them.
-
-## Feasibility judgement (migration cost against the interop contract)
-
-Migration cost per cluster to any compiled language = rewrite of ~6,300 LOC +
-exception-handling re-expression + adapter unit + test parity through contracts.py —
-while the measured benefit is bounded by the adapter's own 0.63ms/op floor and by
-fsync latency that no language changes. Feasible for a *single* coarse-grained unit
-(e.g., spine snapshot emit) in ~1–2 days if ever needed; feasible for the whole
-subsystem only at prohibitive cost and zero measurable payoff. Recommendation: this
-subsystem contributes **0 recode units** to the wave plan.

research/wave1/provider-layer/inward.md

@@ -1,75 +0,0 @@
-# Wave 1 — Provider/Model Layer Inward Profile
-
-Checkout: `/mnt/workdrive/rune`. All evidence from direct file reads this session
-(line numbers re-verified against working tree after compaction; earlier profiling
-notes were corrected where they disagreed with grep — see Corrections).
-
-## Files profiled
-
-| File | Lines | I/O shape |
-|---|---|---|
-| src/rune/provider_registry.py | 666 | urllib blocking POST |
-| src/rune/model_connect.py | 462 | urllib GET (discovery), connectivity cache |
-| src/rune/model_routing.py | 432 | httpx.get (one call), pure routing fns |
-| src/rune/connection_pool.py | 144 | in-process resource pool |
-| src/rune/model_profiles.py | 435 | none (pure config dataclasses) |
-| src/rune/provider_budget.py | 354 | none (pure accounting, threading.Lock) |
-| src/rune/standardized_providers.py | 281 | none (pure translation) |
-| src/rune/model_registry.py | 211 | file JSON persistence |
-| src/rune/openai_compat_transport.py | 227 | urllib blocking POST |
-
-## Cluster map with evidence
-
-### C1 — HTTP wire + transport (provider_registry.py, openai_compat_transport.py)
-- Wire calls are blocking `urllib.request.urlopen` with fixed timeouts:
-  provider_registry.py:214 (`timeout=10`), provider_registry.py:393
-  (`timeout=120`, generation call), openai_compat_transport.py:219
-  (`timeout=120`), openai_compat_transport.py:86 (`timeout=5`, health checks).
-- Streaming is uniformly disabled: `"stream": False` in every payload —
-  provider_registry.py:374, provider_registry.py:503, openai_compat_transport.py:73,
-  openai_compat_transport.py:160, openai_compat_transport.py:206. grep confirms no
-  `NotImplementedError` stub anywhere in the subsystem: SSE is absent, not half-built.
-- **No retry/backoff exists at all.** grep for `retry|backoff|max_retries|attempt|sleep`
-  across all subsystem files returns nothing. Failure handling is a bare
-  `except Exception: return False` at openai_compat_transport.py:74-75 (health check).
-- **Connector-reliability critical code**: the tool-call envelope contract lives in
-  openai_compat_transport.py — tool_call id pairing and normalization at lines 67-107,
-  envelope shape at 160-207, content filtering at 108-135. Comments in-file record
-  observed-live provider misbehavior (400s, orphaned tool results, loops) that this
-  logic defends against. This is the highest-risk code to port.
-
-### C2 — Connection pool (connection_pool.py, 144 lines)
-- `threading.Lock`-guarded pool, max 3 connections/provider, idle-timeout eviction.
-- Guards in-process objects, not sockets — unrelated to TCP pooling.
-
-### C3 — Routing decisions (model_routing.py, 432 lines)
-- One I/O call: `httpx.get(.../api/tags)` at model_routing.py:99-101; Ollama
-  `/api/show` probe at 199-214. Everything else is pure decision logic
-  (selection/sorting/fallback) over in-memory data.
-
-### C4 — Budget accounting (provider_budget.py, 354 lines)
-- Pure arithmetic over token/cost counters, `threading.Lock` for thread safety.
-  No I/O, no network, no parsing.
-
-### C5 — Config/registry (model_profiles.py, model_registry.py, standardized_providers.py, model_connect.py)
-- model_profiles.py (435) and standardized_providers.py (281): pure dataclasses and
-  normalization/translation tables — zero I/O.
-- model_registry.py (211): JSON file persistence.
-- model_connect.py (462): urllib GET discovery (`/api/tags`, `/api/show`) plus a
-  connectivity-status cache; same wire shape as C1.
-
-## Cross-cutting facts
-- **No asyncio anywhere** in the subsystem (grep). All I/O is blocking; the only
-  concurrency primitives are `threading.Lock` in connection_pool.py and
-  provider_budget.py.
-- **No retry, no backoff, no SSE** exist today (see C1). Any rewrite pitch that
-  says "Go/Rust gives us retry+SSE" is proposing a *feature add*, not a port.
-- httpx is already a dependency (model_routing.py:99).
-- Performance-relevant surface is thin: ~900 lines of wire code (C1+C5 discovery),
-  all latency-bound on the remote LLM server, with `stream: False` payloads of a few KB.
-
-## Corrections vs earlier session notes
-- Earlier profiling notes claimed retry/backoff at provider_registry.py:90-121 and a
-  `NotImplementedError` SSE stub. Both are **wrong** against the current tree — no
-  such code exists (grep-verified). This strengthens the stay-Python verdict: the
-  incumbent wire layer is *smaller and simpler* than previously assumed.

research/wave1/provider-layer/outward-sources.md

@@ -1,24 +0,0 @@
-# Wave 1 — Provider/Model Layer Outward Sources
-
-All sources live-fetched 2026-09-29 via webfetch. Raw evidence JSONs in `outward/`
-(single-line format mirroring `research/issue-314/outward/search-Q1.json`).
-
-| # | URL | Status | Lesson (→ claim it supports) |
-|---|---|---|---|
-| O1 | https://pkg.go.dev/net/http | fetch-confirmed | Go stdlib alone covers HTTP client, transport pooling, timeouts, and line-streaming resp.Body → Go wire candidate is *technically* feasible std-only (C1-Go) |
-| O2 | https://github.com/ollama/ollama/blob/main/api/client.go | fetch-confirmed | Production Go LLM client does NDJSON streaming via bufio.Scanner over resp.Body, zero third-party deps → Go wire pattern proven (C1-Go) |
-| O3 | https://docs.rs/reqwest/latest/reqwest/ | fetch-confirmed | reqwest SSE path is async (bytes_stream) and runtime-bound; blocking API has no SSE story → Rust wire layer requires tokio+deps (C1-Rust) |
-| O4 | https://docs.rs/eventsource-stream/latest/eventsource_stream/ | fetch-confirmed | SSE *parsing* itself is an external async-only crate (futures-core, nom) → std-only Rust interop contract cannot express this workload (C1-Rust); earlier 404 on wrong crate name superseded |
-| O5 | https://github.com/EricLBuehler/mistral.rs | fetch-confirmed | Even first-party Rust LLM stacks (mistral.rs) accept tokio/axum dependency weight; no std-only HTTP/SSE precedent → std-only Rust proof unrealistic (C1-Rust) |
-| O6 | https://github.com/ollama/ollama | fetch-confirmed | ollama's Go API server is battle-tested for LLM HTTP+streaming at scale → Go candidate capability-proven; kill reason is ecosystem cost not capability (C1-Go) |
-| O7 | https://github.com/ollama/ollama-python | fetch-confirmed | Official Python client: httpx, sync+async, generator streaming, typed exceptions → Python wire pattern production-proven for this exact workload (C1-keep-Python) |
-| O8 | https://www.python-httpx.org/quickstart/ | fetch-confirmed | httpx blocking streaming (iter_lines), per-phase timeouts, exception taxonomy → all "rewrite motivations" (retry/timeout/SSE-readiness) available as Python-level upgrade (C1-keep-Python) |
-
-## Claim → source coverage
-
-- **Go fits wire layer (capability)**: O1, O2, O6 — ≥2 ✓
-- **Rust std-only wire layer is not viable**: O3, O4, O5 — ≥2 ✓
-- **Python suffices / keep-default**: O7, O8 + inward evidence (no asyncio, thin wire
-  surface, httpx already used at model_routing.py:99) — ≥2 ✓
-- Pure-logic clusters (C2/C3/C4/C5) need no language evidence: no I/O or I/O identical
-  to C1; decision is volume-governed (inward.md), outward sources not applicable.

research/wave1/provider-layer/outward/read-O1-go-nethttp.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://pkg.go.dev/net/http","title":"net/http package - Go standard library","description":"Go stdlib HTTP client documentation: http.Client with pluggable http.Transport (connection pooling built in), resp.Body is an io.ReadCloser suitable for incremental streaming reads, per-request timeouts via context or Client.Timeout, Transport exposes MaxIdleConnsPerHost / IdleConnTimeout knobs. SSE is served by reading resp.Body line-by-line with a bufio.Scanner or json.Decoder; no special SSE library is required for event-per-line formats.","lesson":"Go can implement HTTP wire + SSE/NDJSON streaming + connection pooling with the standard library alone. This makes a Go port feasible WITHOUT the toolchain if the interop contract is std-only — but feasibility is not justification."}]},"fetched":"2026-09-29","fetch_status":"ok","evidence_for":"C1 wire/transport Go candidate"}

research/wave1/provider-layer/outward/read-O2-ollama-client-go.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://github.com/ollama/ollama/blob/main/api/client.go","title":"ollama/api/client.go — production Go LLM client","description":"Production Go client for a local LLM server, fetched as GitHub blob. Streaming generate is implemented by scanning the NDJSON response with bufio.Scanner over resp.Body, decoding each line into a struct with json.Unmarshal. No third-party HTTP or SSE dependency; imports are stdlib plus an errors package. Confirms the pattern: local HTTP + streaming on the same loop as synchronous calls.","lesson":"A real-world LLM connector in Go runs NDJSON/SSE streaming with stdlib only — the exact shape rune's provider layer would need if the wire layer moved to Go."}]},"fetched":"2026-09-29","fetch_status":"ok","evidence_for":"C1 wire/transport Go candidate"}

research/wave1/provider-layer/outward/read-O3-reqwest-docs.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://docs.rs/reqwest/latest/reqwest/","title":"reqwest — Rust HTTP client (docs.rs)","description":"reqwest provides both async and blocking client APIs. Async streaming via Response::bytes_stream (impl Stream<Item=Result<Bytes>>), blocking streaming via Response::copy_to / read. Connection pooling in the async Client. Requires tokio runtime for the async path; blocking API wraps it or runs standalone. No SSE parsing built in — SSE needs a separate crate layered on bytes_stream.","lesson":"Rust HTTP is mature but the async path (where SSE lives) is runtime-bound: tokio + reqwest + a stream combinator. The std-only Rust interop contract cannot express async SSE — a Rust wire layer would import a dependency stack, failing the std-only proof."}]},"fetched":"2026-09-29","fetch_status":"ok","evidence_for":"C1 wire/transport Rust candidate"}

research/wave1/provider-layer/outward/read-O4-eventsource-stream.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://docs.rs/eventsource-stream/latest/eventsource_stream/","title":"eventsource-stream — Rust SSE parsing crate (docs.rs)","description":"Crate implementing the SSE wire-format parser (event/data/id/retry fields, multi-line data, comment lines) as a Stream adapter over any Stream<Item=Result<Bytes, E>>. Built on futures-core and nom. It is async-only: there is no blocking/iterator API documented. Composes with reqwest::Response::bytes_stream. (An earlier fetch attempt of docs.rs/eventsourcemethods returned 404 — wrong crate name; this is the live, correct one.)","lesson":"Even SSE parsing in Rust is an external, async-gated crate. Cost of a Rust wire layer: reqwest + tokio + eventsource-stream + nom — versus rune's current zero-dependency urllib call sites. The dependency-weight claim against the Rust candidate is verified, not assumed."}]},"fetched":"2026-09-29","fetch_status":"ok","evidence_for":"C1 wire/transport Rust candidate"}

research/wave1/provider-layer/outward/read-O5-mistralrs.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://github.com/EricLBuehler/mistral.rs","title":"mistral.rs — Rust LLM inference framework","description":"Production Rust LLM inference server on GitHub. Serves OpenAI-compatible HTTP endpoints with SSE streaming via axum/tower (tokio ecosystem). The whole serving stack is async-runtime-based. Not relevant as a connector comparison for rune (rune is a client), but demonstrates that serious Rust LLM stacks accept the tokio+axum dependency weight as the norm.","lesson":"Even first-party Rust LLM projects do not attempt std-only HTTP/SSE; the async dependency stack is the accepted norm. Confirms the std-only Rust interop contract has no realistic precedent for this workload."}]},"fetched":"2026-09-29","fetch_status":"ok","evidence_for":"C1 wire/transport Rust candidate"}

research/wave1/provider-layer/outward/read-O6-ollama-repo.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://github.com/ollama/ollama","title":"ollama — Go LLM runtime (server) with Rust components","description":"ollama's server-side model runtime is in Go (the API server) while GPU/MLIR portions are C++; the Go HTTP API server handles SSE/NDJSON streaming to clients with net/http. One of the most-deployed local-LLM stacks in existence. Shows Go is battle-tested for the exact HTTP+streaming connector role at high volume.","lesson":"Go's track record for LLM HTTP streaming infrastructure is proven at scale (ollama API server) — the strongest evidence the Go candidate would technically succeed; the kill reason is ecosystem cost, not capability."}]},"fetched":"2026-09-29","fetch_status":"ok","evidence_for":"C1 wire/transport Go candidate"}

research/wave1/provider-layer/outward/read-O7-ollama-python.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://github.com/ollama/ollama-python","title":"ollama-python — official Python client","description":"Official Python client for ollama, fetched as GitHub repo page. Built on httpx with sync and async clients sharing one implementation core; streaming responses are Python generators; errors map to typed exceptions (ResponseError with status codes, RequestError hierarchy). Actively maintained; the canonical example that Python clients handle LLM HTTP + streaming + tool calls in production.","lesson":"Python's httpx-based pattern (sync generator streaming, typed exceptions) is production-proven for exactly rune's workload. Porting rune's wire layer to httpx-style Python is a drop-in to this known-good pattern — no language change needed."}]},"fetched":"2026-09-29","fetch_status":"ok","evidence_for":"C1 wire/transport Python-keep candidate"}

research/wave1/provider-layer/outward/read-O8-httpx-quickstart.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://www.python-httpx.org/quickstart/","title":"httpx QuickStart","description":"httpx supports streaming responses (client.stream + iter_lines/iter_bytes) in the synchronous API, first-class timeout configuration (connect/read/write/pool) and a documented exception taxonomy (TransportError, TimeoutException, HTTPStatusError families) with response.raise_for_status(). API mirrors requests; dependency is pure-Python friendly (httpcore).","lesson":"httpx gives rune's Python wire layer streaming, precise per-phase timeouts, and a coherent exception hierarchy for free — the reliability features (retry, streaming, timeout discipline) that would motivate a rewrite are available as a Python-level upgrade."}]},"fetched":"2026-09-29","fetch_status":"ok","evidence_for":"C1 wire/transport Python-keep candidate"}

research/wave1/provider-layer/synthesis.md

@@ -1,94 +0,0 @@
-# Wave 1 — Provider/Model Layer Synthesis (per-cluster language verdicts)
-
-Doctrine applied: KEEP-PYTHON is the expected default and the honest volume-governor;
-each candidate carries a kill test; per-cluster verdicts, never global.
-
-Inward evidence: `inward.md` (file:line verified). Outward evidence: `outward-sources.md`
-(8 live-fetched sources, claim-coverage map at bottom).
-
----
-
-## C1 — HTTP wire + transport (provider_registry.py, openai_compat_transport.py, model_connect.py discovery)
-
-**Verdict: KEEP-PYTHON. Score: Python 5, Go 2, Rust 1.**
-
-- Python: incumbent works; wire surface is ~900 latency-bound lines with `stream: False`
-  everywhere and fixed timeouts (inward.md C1). httpx already a dependency
-  (model_routing.py:99). Production-proven pattern for this exact workload: O7, O8.
-- Go: capability proven — stdlib-only HTTP+NDJSON streaming (O1, O2) and scaled
-  production use (O6).
-- Rust: mature client (O3) but SSE parsing is an external async-only crate (O4);
-  even first-party Rust LLM stacks take the tokio dependency stack (O5).
-
-**Kill tests**
-- Go: toolchain absent (verified: `which go` → not found). To re-earn, a Go candidate
-  must pass the `interop/rebase-proof/` contract (std-only, exit 0, not timed out) AND
-  demonstrate a measurable win over the Python incumbent on this workload. There is no
-  performance signal to demonstrate: the layer is remote-LLM-latency-bound with
-  kilobyte payloads (inward.md cross-cutting). Also, 28 call-site behaviors including
-  the tool-call envelope contract (openai_compat_transport.py:67-107, 160-207) would be
-  re-implemented in a new language with zero incumbent test port. **Killed** — no
-  evidence basis to pass the kill test.
-- Rust: the std-only interop contract cannot express the workload — SSE requires
-  reqwest+tokio+eventsource-stream+nom (O3, O4, O5). **Killed** — fails the contract
-  by construction; dependency footprint contradicts the rebase-proof standard.
-- Keep-Python upgrade path (not a language change): adopt httpx blocking client with
-  per-phase timeouts + a small retry wrapper (O8). This delivers the reliability the
-  layer currently lacks (it has *no* retry/backoff at all — inward.md Corrections)
-  without any port risk.
-
-## C2 — Connection pool (connection_pool.py, 144 lines)
-
-**Verdict: KEEP-PYTHON. Score: Python 5, Go 2, Rust 2.**
-
-- Guards in-process objects under threading.Lock at ~144 lines; not a TCP pool. No
-  hot loop, no memory pressure, no FFI boundary.
-
-**Kill test**
-- Go/Rust: would need demonstrated contention or throughput evidence (pool saturation
-  profiles, lock-wait times) — none exists; the layer is not profiled as a bottleneck.
-  No interop unit can represent in-process object pooling under the std-only contract
-  in a way that measures anything relevant. **Killed** — no measurable problem to solve.
-
-## C3 — Routing decisions (model_routing.py, 432 lines)
-
-**Verdict: KEEP-PYTHON. Score: Python 5, Go 1, Rust 1.**
-
-- Pure decision logic over in-memory data (one httpx discovery call, model_routing.py:99).
-- Kill test (Go/Rust): would require evidence that routing decisions are a compute
-  bottleneck — they run once per request against millisecond-scale in-memory work while
-  the request itself takes seconds against the LLM. **Killed** — 5 orders of magnitude
-  below any measurable threshold.
-
-## C4 — Budget accounting (provider_budget.py, 354 lines)
-
-**Verdict: KEEP-PYTHON. Score: Python 5, Go 1, Rust 1.**
-
-- Pure arithmetic + threading.Lock. No I/O.
-- Kill test (Go/Rust): needs counter-throughput evidence; none. A port would be pure
-  translation cost with zero performance headroom. **Killed**.
-
-## C5 — Config/registry/normalization (model_profiles.py, model_registry.py, standardized_providers.py, model_connect.py tables)
-
-**Verdict: KEEP-PYTHON. Score: Python 5, Go 1, Rust 1.**
-
-- Dataclasses, JSON persistence, translation tables. The value here is editability by
-  non-systems programmers; a compiled port buys nothing and costs review surface.
-- Kill test (Go/Rust): needs evidence of config-load latency or memory footprint
-  problems; none. **Killed**.
-
----
-
-## Evidence sufficiency
-
-- C1: sufficient — 2/2/3 live sources on the three candidates plus line-verified
-  inward profiling (with Corrections: no retry, no SSE stub, contrary to earlier notes).
-- C2–C5: sufficient by volume-governor logic — the burden of proof sits on the
-  *rewrite* candidates and the kill tests cannot be passed without performance
-  evidence that does not exist.
-
-## Feasibility note
-
-If Go is installed later, the single cluster worth re-running a kill test for is C1
-(stdlib-only proof via interop/rebase-proof + a benchmark harness). Until then the
-door is closed on evidence, not opinion.

research/wave1/runtime-core/inward.md

@@ -1,98 +0,0 @@
-# RUNTIME CORE & TOOLING — Inward intention profile
-
-Wave 1 language-fit research. Scope: 12 files under `src/rune/`. All line refs verified
-against working tree at time of writing. Machine facts: Go NOT installed; Rust 1.98.1 +
-GCC 16.2.1 present; interop proof harness at `interop/rebase-proof/` (std-only Rust,
-argv-in/JSON-out, 117-line main.rs) with Python adapter `shared/native_units.py`
-(`NativeResult.ok` = exit 0 AND not timed out; `ok:true` JSON is op-call evidence, not a
-precondition — shared/native_units.py:89).
-
-Subsystem-wide character (observed across all 12 files):
-- Single-threaded or 1–2 daemon threads max; no asyncio anywhere.
-- Blocking subprocess / urllib HTTP with hard timeouts.
-- JSON-in/JSON-out glue over dict-shaped data.
-- Deep degrade-not-crash handling: nearly every failure path returns a dict instead of raising.
-- NO compute-bound hot path. Latency is dominated by LLM HTTP round-trips (seconds); CPU
-  work is regex/JSON parsing on KB-scale inputs (microseconds-to-milliseconds).
-
----
-
-## Cluster A — Subprocess lifecycle orchestration
-Files: `tool_executor.py` (1812 L), `cron_engine.py` (436 L), `auto_tasks.py` (460 L).
-
-- `tool_executor._run_command` (tool_executor.py:1064): `subprocess.run(..., capture_output=True, timeout=...)` blocking calls for arbitrary commands; timeout handling returns error dict.
-- Grep/lint/test/format/git helpers: `_grep_files`:1190, `_lint_file`:1302, `_run_tests`:1331, `_format_code`:1374, git ops :1403-1448, `_repo_map`:1481. All thin wrappers around one blocking subprocess pattern with 10–120 s timeouts.
-- Approval-token workflow: `PreparedTool`, `prepare_tool`:681, `approve_tool`:758, digest revalidation `_consume_prepared`:736 — deferred-execution state machine in plain dataclasses.
-- Sandbox path validation: tool_executor.py:466, 478 (path containment checks before exec).
-- Atomic writes: `_apply_content`:914 (temp file + replace).
-- Language config table: tool_executor.py:1215-1270 (dict of per-language command templates).
-- `cron_engine._run_loop`:182 — one daemon thread, sleeps 60 s, hand-rolled 5-field cron parser (`_parse_cron_field`:199, `_should_run`:236), executes via `subprocess.run(shlex.split(...), shell=False, timeout=60)`:279, file-rotation logging :291.
-- `auto_tasks` subprocess checks: `run_compile_check`:261, `run_benchmark_check`:282, `run_sanity_check`:303; regex task extraction `extract_tasks`:80; sqlite3 WAL storage (`connect`:40, DB_PATH:32).
-
-Hot/glue verdict: pure glue. Every unit of work is "spawn a process, wait, parse output".
-The CPU cost is zero; the wall-clock cost is the child process itself. Error surface is the
-interesting part: timeouts, non-zero exits, stderr capture, sandboxing — all expressed in
-Python's exception + dict-return idiom.
-
-Concurrency shape: synchronous; cron loop is one daemon thread at ~1 task/min scale.
-
-## Cluster B — Protocol/JSON parsing & validation
-Files: `tool_protocol.py` (455 L), scoring/estimation slices of `capability_broker.py`
-(875 L) and `context_broker.py` (768 L).
-
-- `tool_protocol`: frozen dataclasses (ToolRequest, ToolEvent, …); JSON-schema-ish validation `validate_tool_request`:278; incremental JSONDecoder `raw_decode` scanning `_decoded_objects`:350, `_protocol_entries`:368; regex/fence/XML wrapper handling; `extract_visible_text`:426.
-- `capability_broker.score_card`:589 — deterministic keyword scoring with stopwords and regex tokenization over tiny N (MAX_SELECTED=10, `select_for_job`:98).
-- `context_broker.default_estimator` = `len(text)//4`:100 — O(n) token estimate.
-
-Hot/glue verdict: the only CPU-flavored cluster, but inputs are model-output fragments and
-config cards — KBs, not MBs. Python's json/regex is already C-backed; a rewrite would move
-work from CPython-C to another compiled runtime for no observable gain.
-
-## Cluster C — Model→tool control loop + HTTP transport
-Files: `local_tool_runtime.py` (806 L), `elastic_cognition.py` (765 L), `goal.py` (441 L).
-
-- `local_tool_runtime._run_loop`:417 — bounded (max 8 iters) model→tool loop; stdlib urllib transport to Ollama (`OllamaChatTransport`:96); `threading.Lock` ctx-length cache :44; circuit breaker :434-459; approval-resume serialization `resume`:332.
-- `elastic_cognition`: regex salience classifier `classify_salience`:247 (~40 patterns), MODEL_ROUTES:203, `_execute_ollama`:537 / `_execute_cloud`:585 (urllib), `execute_with_escalation`:644, `parse_response`:461.
-- `goal._verify_with_llm`:142 — LLM-as-judge via raw urllib to Ollama (qwen2.5:3b, 30 s timeout) with keyword fallback `_verify_with_keywords`:209.
-
-Hot/glue verdict: glue with latency domination. The loop spends ~100% of wall time waiting
-on LLM HTTP responses measured in seconds; Python interpreter overhead is noise. Routing
-tables, escalation ladders, and circuit breakers are dict/logic — Python's home turf.
-
-## Cluster D — Context assembly & budgeting
-Files: `context_broker.py` (768 L).
-
-- `_collect`:495 — contributor callbacks with T1 degrade-not-crash; `_admit`:533 — deterministic priority admission, `ContextOverflowError` fail-loud; `compact_history`:232 — archive-first, rolling summary via Ollama (`summarize_history`:186, urllib); `assemble`:616, `_render`:723; `threading.RLock` guarding single-authority assembly.
-- Token math is trivially O(n) string slicing (see Cluster B estimator).
-
-Hot/glue verdict: glue. Correctness lives in admission policy and degrade semantics, not speed.
-
-## Cluster E — Reliability / queueing infra
-Files: `failure_auto_filer.py` (527 L).
-
-- `queue.Queue(maxsize=1000)` + daemon worker `_run_worker`:453 with burst coalescing; append-only JSONL spool `JsonlSpool`:117 with sidecar consumed-markers; credential redaction regexes :84-92; tier gate `tier_gated`:60 (T2 journal-only); never raises into the failure path.
-- The most "systems-y" file: threading, queueing, crash-safety reasoning. But its performance
-  requirement is ~nil (failure events are rare); its correctness requirement is threading
-  semantics + crash-safe journal ordering — exactly what's hardest to re-verify in a rewrite.
-
-## Cluster F — Declarative config / brokers
-Files: `work_manager.py` (591 L), `hook_engine.py` (860 L), remainder of
-`capability_broker.py`, `goal.py` storage half.
-
-- `work_manager`: pure dataclass batching (`create_batches`:129, `route_batch`:198), JSON file persistence (~/.rune/work/batches.json), CLI. No concurrency, no subprocess.
-- `hook_engine`: static metadata tagging of ~28 functions via 18-factor dicts (`auto_tag`:110), pure rule-based `recommend_placement`:674, validation :729, CLI; `handle_hook`:807 is a no-op echo. Entirely declarative data — zero runtime dispatch.
-- `capability_broker.load_cards`:474 per-call JSON file I/O with atomic rebuild; `find_capability`:759.
-- `goal`: goal JSON storage + the one HTTP judge call (Cluster C).
-
-Hot/glue verdict: trivial glue. Portable to any language in principle, valuable in none —
-the value is the data and the rules, which read as literal dicts in Python today.
-
----
-
-## Feasibility notes (local machine)
-- Go: NOT installed. Any Go verdict is evidence-starved; a Go kill test cannot be run locally.
-- Rust: 1.98.1 present; the Wave 0 proof harness (`interop/rebase-proof/`, std-only, zero
-  crates) demonstrates the CLI-boundary pattern a Rust candidate would adopt, and
-  `shared/native_units.py` shows Python can wrap it with zero code changes to callers
-  (result type contract at native_units.py:28-47). Running the harness is not a
-  precondition for verdicts; JSON `ok:true` is op-call evidence only.

research/wave1/runtime-core/outward-sources.md

@@ -1,31 +0,0 @@
-# OUTWARD SOURCES — Runtime core & tooling (Wave 1)
-
-All fetches were live `webfetch` calls made during this session. Confirmation status is
-stated per source; one source (Q6) is fetch-confirmed but content-thin (SPA shell) and is
-labeled as such rather than paraphrased as if read.
-
-| # | URL | Fetch-confirmed | Lesson |
-|---|-----|-----------------|--------|
-| Q1 | https://pkg.go.dev/os/exec | Yes (go1.27.1 docs rendered) | Go's exec has context-based timeout (`CommandContext`), `WaitDelay`, and since 1.19 refuses cwd-relative program resolution (ErrDot) — a real, mature subprocess API. Nothing Go offers here is a capability Python's `subprocess.run(timeout=..., shell=False)` lacks; it is a different syntax for the same semantics. |
-| Q2 | https://docs.python.org/3/library/subprocess.html | Yes (3.14.7 docs rendered) | `subprocess.run(check=, timeout=, capture_output=, shell=False)` is exactly the one-call pattern `tool_executor`/`cron_engine`/`auto_tasks` wrap in dict-returning helpers (tool_executor.py:1064, cron_engine.py:279, auto_tasks.py:261). Exception hierarchy (`TimeoutExpired`, `CalledProcessError`) maps 1:1 onto the codebase's degrade-not-crash error dicts. |
-| Q3 | https://pkg.go.dev/github.com/robfig/cron | Yes (v1.2.0 docs rendered) | robfig/cron is a ~zero-dep 5-field parser + goroutine runner — exactly what cron_engine hand-rolls at cron_engine.py:199/236. Ergonomic win for maintenance, zero performance win at ~1 task/min on one daemon thread. |
-| Q4 | https://doc.rust-lang.org/std/process/index.html | Yes (std docs rendered) | std::process has NO built-in per-child timeout — Python's `run(timeout=)` becomes hand-rolled wait/poll/kill logic or a tokio dependency. Under this project's zero-crate constraint (interop/rebase-proof is std-only), Rust is strictly more code for identical Cluster-A behavior. |
-| Q5a | https://docs.rs/serde_json/latest/serde_json/ | Yes (docs.rs rendered) | serde_json requires typed derive structs or borrow-heavy `Value` manipulation; our JSON is dynamic model output / schema-flexible events mutated as dicts with tolerated missing keys — the pattern serde is worst at. |
-| Q5b | https://docs.python.org/3/library/json.html | Yes (3.14.7 docs rendered) | Python's json (incl. `JSONDecoder.raw_decode` used at tool_protocol.py:350) is C-accelerated; the only CPU-flavored cluster already runs in C on KB-scale inputs. A rewrite changes syntax, not asymptotics or wall time. |
-| Q6 | https://go.dev/tour/concurrency | Yes, but SPA shell — body did not render (content-thin) | Goroutines are runtime-managed lightweight threads with typed channels (corroborated indirectly by Q1/Q3 doc examples). Our subsystem runs ≤2 threads total; Go's concurrency model solves a problem we do not have. |
-
-## Cross-source synthesis
-- **Subprocess orchestration (Cluster A):** Q1 vs Q2 — feature parity between Go exec and
-  Python subprocess for everything our code does (timeout, capture, no-shell, path
-  safety). Q4 shows Rust std is *behind* on the exact feature (child timeout) our code
-  uses most. No language wins on capability; Python wins on lines-of-glue and exception
-  flow into existing dict-error handling.
-- **Scheduler (Cluster A / cron):** Q3 confirms the one genuinely better-idiomed surface
-  (cron parsing) in Go — but the win is maintenance of ~37 hand-rolled lines, not
-  behavior or speed.
-- **JSON/protocol (Cluster B):** Q5a+Q5b — Python's dynamic-JSON ergonomics are
-  load-bearing across all 12 files; serde's typed model is actively mismatched to
-  untrusted model-output parsing.
-- **Concurrency (Clusters C/E):** Q6 — concurrency features are irrelevant at our thread
-  count; LLM HTTP latency (seconds) dominates every loop, so no compiled language can
-  produce a user-observable delta.

research/wave1/runtime-core/outward/search-Q1.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://pkg.go.dev/os/exec","title":"exec package - os/exec - Go Packages","description":"Fetched live (go1.27.1 docs). Package exec runs external commands; wraps os.StartProcess to remap stdin/stdout, connect I/O with pipes. Cmd.Run() starts and waits; Cmd.Output()/CombinedOutput() capture output; CommandContext(ctx,...) provides timeout-based kill via context.WithTimeout (example: exec.CommandContext(ctx,\"sleep\",\"5\").Run() interrupted after 100ms). WaitDelay bounds time waiting on I/O pipes after child exit (ErrWaitDelay). Since Go 1.19, LookPath/Command refuse to resolve programs relative to the current directory (ErrDot) — security posture matches Python's shell=False default. ExitError carries exit status; no exception machinery, errors are values checked at every call site.","position":1}],"query":"Go os/exec subprocess orchestration vs Python subprocess"},"id":"runtime-core-Q1"}

research/wave1/runtime-core/outward/search-Q2.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://docs.python.org/3/library/subprocess.html","title":"subprocess — Subprocess management (Python 3.14.7 docs)","description":"Fetched live. subprocess.run(args, *, capture_output=False, shell=False, cwd=None, timeout=None, check=False, text=None, env=None) is the recommended high-level API: waits, returns CompletedProcess(returncode, stdout, stderr). Timeout expiry kills the child and re-raises TimeoutExpired after the child terminates. check=True raises CalledProcessError carrying cmd/returncode/stdout/stderr. Popen.communicate(input, timeout) handles pipe-deadlock avoidance that raw .stdout.read() does not. POSIX path uses vfork() internally when safe 'greatly improves performance'. Exceptions are class hierarchy (SubprocessError base) catchable at one site — this is the idiom tool_executor/cron_engine/auto_tasks rely on (dict-returning wrappers around run()).","position":1}],"query":"Python subprocess orchestration timeout capture CompletedProcess"},"id":"runtime-core-Q2"}

research/wave1/runtime-core/outward/search-Q3.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://pkg.go.dev/github.com/robfig/cron","title":"cron package - github.com/robfig/cron - Go Packages","description":"Fetched live (v1.2.0 docs). cron.New() -> AddFunc(spec, func) -> Start() runs entries in their own goroutines; Implements standard 5-field cron parsing: 'Minute Hour Dom Month Dow' via cron.Parse(spec). Supports @every 1h30m, @midnight style descriptors. No external deps beyond Go stdlib time. Lesson: what our cron_engine hand-rolls in ~37 lines (_parse_cron_field/_should_run at cron_engine.py:199/236) is a solved 200-line stdlib-time problem in Go — a genuine ergonomic win, but our scale is ~1 task/min on one daemon thread, so the win is maintenance ergonomics, not performance.","position":1}],"query":"Go robfig/cron scheduler library 5-field parser goroutines"},"id":"runtime-core-Q3"}

research/wave1/runtime-core/outward/search-Q4.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://doc.rust-lang.org/std/process/index.html","title":"process - Rust (std library docs, 1.98 era)","description":"Fetched live. std::process::Command builder API: .arg()/.args()/.env()/.current_dir()/.output()/.spawn(); child.wait() with output() returning Output{status,stdout,stderr}. Handles require .kill()/explicit drop to avoid resource leak. Child timeouts are NOT in std — need wait_with_output + manual polling or tokio::process::Command::kill_on_drop + tokio::time::timeout for async. Error surface: io::Result everywhere, no exceptions. Lesson: Rust can do everything Cluster A does, but per-call timeout on child processes is not one line like Python's subprocess.run(timeout=) — it is hand-rolled select/waitpid logic or a crate dependency (tokio), and our zero-crate constraint makes the std path measurably more code for identical behavior.","position":1}],"query":"Rust std::process Command child timeout wait_with_output"},"id":"runtime-core-Q4"}

research/wave1/runtime-core/outward/search-Q5.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://docs.rs/serde_json/latest/serde_json/","title":"serde_json - Rust docs","description":"Fetched live. serde_json is the de-facto Rust JSON layer; needs derive macros (serde, serde_derive crates) or manual Value manipulation for dynamic JSON. Lesson: our runtime-core code is dominated by DYNAMIC JSON — model outputs, tool events, capability cards, failure spools, batches — consumed as dicts, mutated, re-serialized with 'missing-key tolerated' access. serde_json::Value is workable but borrows/lifetimes turn 'd.get(k, default) if k else pass' patterns into match-arms; the serde derive path requires typed structs, which our schema-flexible model-output parsing (tool_protocol.py:350 incremental raw_decode over untrusted fence-wrapped text) defeats by construction.","position":1},{"url":"https://docs.python.org/3/library/json.html","title":"json — JSON encoder and decoder (Python 3.14.7 docs)","description":"Fetched live. json.loads/JSONDecoder.raw_decode (used at tool_protocol.py:350) is C-accelerated (_json C module); incremental scanning of partial/trailing content is a documented one-liner. Lesson: Cluster B's 'CPU-flavored' work is already running in C; a rewrite to Rust/Go would swap C for compiled code of the same asymptotic cost on KB-scale inputs.","position":2}],"query":"serde_json vs Python json dynamic parsing performance KB inputs"},"id":"runtime-core-Q5"}

research/wave1/runtime-core/outward/search-Q6.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://go.dev/tour/concurrency/","title":"A Tour of Go — Concurrency","description":"Fetched live; page is a JS-rendered SPA shell so body content did not render (fetch-confirmed, content-thin). Claim this source supports: goroutines are lightweight runtime-managed threads with typed channels — this is common documented knowledge (pkg.go.dev/os/exec and robfig/cron docs already confirm goroutine usage patterns in this search set). Lesson: Go's concurrency model targets many concurrent tasks; our runtime core has at most 2 threads (cron daemon, filer worker), so goroutine ergonomics are irrelevant at this thread count.","position":1}],"query":"Go goroutines lightweight concurrency model"},"id":"runtime-core-Q6"}

research/wave1/runtime-core/synthesis.md

@@ -1,112 +0,0 @@
-# SYNTHESIS — Runtime core & tooling (Wave 1)
-
-Method: INWARD (inward.md, file:line evidence) → OUTWARD (outward/*.json, outward-sources.md,
-live-fetched) → per-cluster verdict. Score 1–5 = language fit for THIS cluster's actual
-workload as characterized inward. Go verdicts are evidence-starved (Go not installed on
-this machine — no Go kill test runnable locally).
-
----
-
-## Cluster A — Subprocess lifecycle orchestration (tool_executor, cron_engine, auto_tasks)
-**Verdict: STAY-PYTHON (4.7/5).**
-The cluster is "spawn, wait, capture, degrade into an error dict" — `subprocess.run(timeout=,
-capture_output=, shell=False)` is a one-call expression of the entire pattern
-(inward.md §A; tool_executor.py:1064, cron_engine.py:279, auto_tasks.py:261). Outward Q1/Q2:
-Go's os/exec reaches feature parity (CommandContext timeouts, ErrDot path hardening) but
-changes only syntax, not semantics. Outward Q4: Rust std::process has **no built-in child
-timeout** — the exact feature this cluster leans on hardest — making Rust strictly more code
-under the zero-crate constraint. The approval-token state machine (tool_executor.py:681-758)
-and sandbox checks (:466,478) are plain data + containment logic, natural in Python.
-**Kill test (Rust):** re-express `_run_command` (tool_executor.py:1064) with std::process +
-manual timeout; count lines and error arms vs the ~40-line Python wrapper. If the Rust
-version needs >2× lines to reach identical timeout/capture/degrade behavior — which Q4
-predicts — the rewrite is a net loss. (Runnable locally: Rust 1.98.1 installed.)
-**Kill test (Go):** not runnable locally (Go not installed). Paper kill test: port
-cron_engine._run_loop (cron_engine.py:182) to Go with os/exec; measure task-fire latency
-delta. Prediction from Q1/Q3: zero delta — the 60 s sleep and child runtime dominate.
-**Evidence sufficiency:** Python verdict fully evidenced. Rust kill test runnable.
-Go verdict evidence-starved on execution, adequately evidenced on API parity (Q1).
-
-## Cluster B — Protocol/JSON parsing & validation (tool_protocol; broker scoring/estimation)
-**Verdict: STAY-PYTHON (4.5/5).**
-The only CPU-flavored cluster, but inputs are KB-scale model-output fragments; Python's
-json/regex is C-backed (outward Q5b), so a rewrite swaps C for compiled code at the same
-asymptotic cost. The incremental `raw_decode` scan (tool_protocol.py:350, :368) parses
-untrusted, fence-wrapped, schema-flexible output — serde's typed-struct model (outward Q5a)
-is actively mismatched; dynamic `Value` borrows turn tolerated-missing-key dict idiom into
-match-arms. Score dinged 0.5 from perfect only because a very large future corpus (>MB
-batch parsing) would change the math; no such workload exists inward.
-**Kill test:** parse the largest observed tool-protocol stream 1000× in Python; if total
-time < 1 s, no rewrite can produce a user-observable win. (Python side runnable locally.)
-**Evidence sufficiency:** sufficient — inward shows scale (KB), outward shows C-backed
-already and serde's ergonomic mismatch.
-
-## Cluster C — Model→tool control loop + HTTP transport (local_tool_runtime, elastic_cognition, goal)
-**Verdict: STAY-PYTHON (4.8/5).**
-Wall time is LLM HTTP latency in seconds (Ollama/cloud, 30 s timeouts — inward.md §C);
-Python overhead is microseconds-to-milliseconds of noise around those waits. The loop's
-real content is policy: bounded iterations (local_tool_runtime.py:417), circuit breaker
-(:434-459), escalation ladders (elastic_cognition.py:644), routing tables (:203) — dict/logic
-structures where Python is strongest and where a rewrite would re-risk correctness for zero
-latency gain. Outward Q6 (concurrency features) is irrelevant at ≤2 threads.
-**Kill test:** instrument `_run_loop` (local_tool_runtime.py:417): log non-HTTP CPU time per
-iteration. Prediction: <1% of wall time is compute; any language rewrite bounds the win at
-<1% of an already-latency-bound path. (Python side runnable locally.)
-**Evidence sufficiency:** sufficient.
-
-## Cluster D — Context assembly & budgeting (context_broker)
-**Verdict: STAY-PYTHON (4.7/5).**
-Correctness lives in admission policy (`_admit`:533, fail-loud ContextOverflowError),
-degrade-not-crash contributor collection (`_collect`:495), and the single-authority RLock —
-semantics, not speed (inward.md §D). Token math is O(n) len//4 (:100). Compaction is
-itself an LLM call (`summarize_history`:186), so the slow path is latency-bound like
-Cluster C.
-**Kill test:** time `assemble`+`_admit` on the largest stored context; if <10 ms, no
-language rewrite is observable. (Runnable locally, Python side.)
-**Evidence sufficiency:** sufficient.
-
-## Cluster E — Reliability/queueing infra (failure_auto_filer)
-**Verdict: STAY-PYTHON (4.2/5).** Lowest confidence of the six, stated honestly.
-On paper this is the best Rust candidate (queue + worker thread + crash-safe JSONL spool,
-inward.md §E). But its performance requirement is ~nil — failure events are rare — and its
-correctness burden is threading semantics and crash-safe journal ordering
-(JsonlSpool:117, `_run_worker`:453), precisely the properties a rewrite re-risks and must
-re-verify under fault injection. Rust would not make the spool *more* correct, only less
-familiar. Score 4.2 not 4.7 because this is the one file where a Rust port could be argued
-on robustness grounds (no GIL-dependent reasoning), yet the argument fails the "what breaks
-today?" test: nothing does.
-**Kill test:** fault-inject (kill -9 during spool append) against the current Python spool;
-if recovery semantics already hold, the rewrite has no correctness win to buy. (Runnable
-locally, Python side.)
-**Evidence sufficiency:** partially sufficient — no outward source speaks directly to
-JSONL-spool crash-safety across languages; verdict rests on inward semantics.
-
-## Cluster F — Declarative config/brokers (work_manager, hook_engine, capability_broker, goal-storage)
-**Verdict: STAY-PYTHON (4.9/5).**
-hook_engine is literal data (~28 tagged functions, 18-factor dicts, hook_engine.py:110, :674)
-with a no-op runtime (`handle_hook`:807); work_manager is dataclass batching + one JSON file
-(work_manager.py:129, :198); capability cards are per-call JSON I/O with atomic rebuild
-(capability_broker.py:474). Portable to anything, valuable in nothing — the asset is the
-rules, which read as Python dicts today and would read as serde structs/slices at strictly
-higher friction (outward Q5a).
-**Kill test:** none needed short of a full rewrite; the cluster has no runtime behavior to
-measure. Absence of any win condition *is* the disproof of migrating it.
-**Evidence sufficiency:** sufficient.
-
----
-
-## Overall
-Honest result: **stay-Python for all six clusters.** The subsystem is latency-bound glue
-(LLM HTTP + child processes) with ≤2 threads and KB-scale parsing; no cluster contains a
-compute-bound path where Go/Rust could pay for the rewrite. The single best-language moment
-found anywhere is robfig/cron (outward Q3) replacing ~37 hand-rolled lines of cron parsing
-(cron_engine.py:199-236) — an ergonomics nicety, not a fit verdict.
-
-## Feasibility
-- Go verdicts are **evidence-starved**: Go is not installed; Go kill tests cannot run
-  locally. They are marked as paper kill tests above.
-- Rust kill tests **are runnable** (Rust 1.98.1 present). Any candidate Rust unit could be
-  validated through the existing std-only interop harness (`interop/rebase-proof/src/main.rs`,
-  117 lines; adapter `shared/native_units.py`, `NativeResult.ok` = exit 0 AND not timed out;
-  JSON ok:true is op-call evidence, not a precondition — native_units.py:89).
-- No code was changed; artifacts only, per task constraint.

research/wave1/tui/inward.md

@@ -1,48 +0,0 @@
-# Inward — Wave 1, TUI subsystem (rune)
-
-Research question: should `src/rune/rune_tui.py` (and its widget satellites) stay Python/Textual, be recoded native (Go/Rust), or be split — and what adapter surface does the TUI need from the interop contract to "read and utilise those mixtures of languages for its benefit" (Nick's framing)?
-
-Scope of evidence: `src/rune/rune_tui.py` (4031 lines), `tui_validator.py` (514), `canary_tui_drift.py` (170), `chat_bubble.py` (401), `message_widgets.py` (104); inventory `docs/rebase/rebase-inventory.json`; adapter `shared/native_units.py` (103); proof contract `interop/rebase-proof/src/main.rs`.
-
-## 1. Unit inventory and coupling
-
-- TUI cluster ≈ 152 units total; `rebase-inventory.json` tracks only 3 files under a tui path (rune_tui.py, tui_validator.py, canary_tui_drift.py) — chat_bubble.py and message_widgets.py are untracked satellites.
-- `rune_tui.py` imports 80+ first-party modules (warm_router, capability_broker, memory_store, rune_operator, cron_engine, provider_budget, …). The TUI is the single largest consumer of the codebase.
-
-## 2. Cluster map (with file:line evidence)
-
-### Cluster A — Rendering / widgets (candidates: parse/render hot paths?)
-- `RuneApp(App)` rune_tui.py:1356; app CSS 1364-1477; BINDINGS 1479-1489; reactives 1493-1500.
-- Widgets: `ThinkingIndicator` :263 (only animation: 0.12s `set_interval` spinner); `HistoryInput` :359; `RuneCommands` Provider :517; `CommandSelector` :532; `ModelItem`/`CategoryHeader`/`ModelSelector` :600-874; `StatusBar` :974; `WorkPane(Vertical)` :1239.
-- `WorkPane.render()` :1331 and `ChatBubble.render()` chat_bubble.py:157 both build plain Rich `Text` objects by concatenation. Grep of src/rune finds NO `rich.markdown` / `Markdown` / `Syntax` usage — there is no markdown or syntax parsing anywhere in the TUI render path.
-- Conclusion: no hot parsing/rendering loop exists. The classic "native TUI for render speed" argument has no footing here.
-
-### Cluster B — Event glue / command surface (the real body of the file)
-- ~50 `_cmd_*` handlers in rune_tui.py:2476-3575; 88 `_cmd_` references; 279 `add_message` call sites.
-- `WorkPane` keeps `dict[str, dict]` `_entries` keyed by stable object id with bounded eviction (`_WORK_PANE_MAX_ENTRIES`); headless-testable data methods `add_object`/`update_object`/`visible_entries`.
-- Tool-widget update-in-place: `self._tool_widgets` dict keyed by `(channel, call_id)`; `tool_widget.apply(tool_event)` at :3676.
-
-### Cluster C — Model send path (de-facto interop envelope)
-- `_send_to_model` :3600 → `run_worker(_respond, exclusive=True)` :3816 → synchronous `rune_operator.send_task(text, model=…, channel=…)` inside async worker :3624.
-- Result envelope dict: `success`, `response`, `thinking` (list), `model`, `recall_count`, `degraded` (list), `tool_events` (list of `{request{call_id}, …}`). This envelope IS the shape a recoded unit would have to reproduce.
-- Completion side-effects inline in the worker: cron_engine.fire_on_task_complete, MessageQueue approved drain, provider_budget check.
-- `_consume_runtime_objects` :3818 feeds WorkPane.
-
-### Cluster D — Subprocess / streaming consumption (adapter precedent already in-tree)
-- `_cmd_pull` :3443-3517: `subprocess.Popen(["ollama","pull",model,"--json"])`, `json.loads` per stdout line, `self.call_from_thread(...)` to marshal UI updates. A live JSONL streaming precedent.
-- Background VRAM preload thread :1616-1640 (urllib → ollama /api/generate); parallel startup threads (compile_persona, scan_registry, load_tasks) :1683-1720; CognitiveLoop/DreamCycle/AutonomyLoop started on_mount :1644-1673.
-- `_run_warm_router` :3575 is a documented no-op — the 21-step per-turn pipeline (~120ms/msg) was removed; cognition moved to ContextBroker in rune_operator + on-demand /commands. The one historical hot path is already gone.
-
-### Cluster E — Adapter contract (current state)
-- `shared/native_units.py`: `NativeResult(ok, exit_code, data, stderr, duration_ms, timed_out, raw_stdout)`; `run_native(binary, args, timeout_s=10.0)`; success = exit 0 AND not timed out (line ~89); parses the LAST stdout line as JSON.
-- `interop/rebase-proof/src/main.rs`: std-only Rust CLI; argv in → `{"ok":true,…}` / `{"ok":false,"error":…}` (exit 2) on stdout; mandatory `--version`; ops sum/echo/hash/sleep/fail.
-
-## 3. Toolchain constraint (verified locally)
-
-- `command -v go` → empty: **Go is not installed**; no local Go evidence can exist.
-- Rust 1.98.1 + GCC 16.2.1 present; `interop/rebase-proof` builds std-only.
-
-## 4. Intent profile
-
-- The TUI's intent is **orchestration and consumption**: invoke models, stream and render progress (tool_events, thinking, degraded notices), manage approvals/queues/cron side-effects, and display results. Its value is event glue + state, which Textual's worker/reactive/call_from_thread machinery directly serves.
-- Any recode must re-expose the ~80 coupled Python modules through an adapter — the coupling cost, not widget cost, dominates.

research/wave1/tui/outward-sources.md

@@ -1,55 +0,0 @@
-# Outward sources — Wave 1, TUI subsystem
-
-All URLs live-fetched 2026-09-29 via webfetch (one call per message, timeout=60; parallel batching caused cancellations and was abandoned). Claim mapping at bottom. Format mirrors `research/issue-314/outward/search-Q1.json`.
-
-## Sources
-
-### S1 — Textual Workers guide (supports: stay-Python verdict)
-- URL: https://textual.textualize.io/guide/workers/
-- Fetch-confirmed: ✅ (`fetch-W1-textual-workers.json`)
-- Lesson: Textual provides the TUI's concurrency model as framework features — async + thread workers, `exclusive=True` single-flight cancellation, mandatory `call_from_thread` marshalling for thread workers, WorkerManager lifecycle tied to DOM nodes, `exit_on_error` semantics. A native recode must hand-roll all of this.
-
-### S2 — Ratatui rendering concepts (supports: stay-Python verdict)
-- URL: https://ratatui.rs/concepts/rendering/
-- Fetch-confirmed: ✅ (`fetch-W2-ratatui-rendering.json`)
-- Lesson: Ratatui is immediate-mode (UI rebuilt every frame) and its own docs admit "out of the box, there's little to no help in organizing large applications" — the developer owns the render loop and event-loop orchestration via crossterm. Direct vendor-documented evidence against recoding a large, structured app like this TUI in Rust.
-
-### S3 — Bubble Tea README (supports: native-feasibility, countervailing)
-- URL: https://raw.githubusercontent.com/charmbracelet/bubbletea/main/README.md
-- Fetch-confirmed: ✅ (`fetch-W3-bubbletea-readme.json`)
-- Lesson: Go's flagship TUI framework is mature: Elm architecture (Model/Update/View), v2 high-performance cell-based renderer, ~18k dependent apps, Bubbles + Lip Gloss. Ecosystem feasibility is real — but widgets are not the hard part; the ~80-module domain coupling is, and no framework addresses it.
-
-### S4 — Codex CLI README (supports: native-precedent, countervailing)
-- URL: https://raw.githubusercontent.com/openai/codex/main/README.md
-- Fetch-confirmed: ✅ (`fetch-W4-codex-readme.json`)
-- Lesson: Flagship AI-coding TUI ships as a single native binary — native TUIs are viable for this product category. But Codex was native from day one; README documents distribution, not migration. No evidence on recode cost for an existing coupled Python app.
-
-### S5 — tview README (supports: native-feasibility, countervailing)
-- URL: https://raw.githubusercontent.com/rivo/tview/master/README.md
-- Fetch-confirmed: ✅ (`fetch-W5-tview-readme.json`)
-- Lesson: Second Go data point — retained-widget kit on tcell, users include k9s and GitHub's gh CLI. Widget-set parity is achievable in Go. Same caveat: ecosystem ≠ coupling cost. Go is not installed in this environment, so no local Go evidence exists.
-
-### S6 — JSON Lines spec (supports: streaming adapter surface)
-- URL: https://jsonlines.org/
-- Fetch-confirmed: ✅ (`fetch-W6-jsonlines.json`)
-- Lesson: Newline-delimited JSON is a standard self-delimiting streaming format for cross-process message passing. The TUI already consumes JSONL in `_cmd_pull` (rune_tui.py:3443-3517). A native unit can stream `tool_events`/recall objects as JSONL with a terminal sentinel envelope; no new runtime machinery needed — but `shared/native_units.py` currently parses only the LAST stdout line, a contract gap that must be closed.
-
-### S7 — OpenAI Agents SDK workflows guide (supports: TUI-as-consumer architecture)
-- URL: https://openai.github.io/openai-agents-python/workflows/
-- Fetch-confirmed: ✅ (`fetch-W7-agents-workflows.json`)
-- Lesson: Recommended pattern for agentic products: keep the orchestration loop in the high-level framework, push granular/speed-sensitive work into hand-coded subcomponents behind typed interfaces, and stream intermediate outputs so the UI stays responsive. Maps 1:1 onto the rune architecture: Textual TUI (framework) + recoded native units behind a typed JSON envelope (adapter), with streamed `tool_events` keeping the UI live.
-
-### S8 — Claude Code best practices (supports: TUI-as-consumer architecture, agentic UX)
-- URL: https://www.anthropic.com/engineering/claude-code-best-practices
-- Fetch-confirmed: ✅ (`fetch-W8-claude-code-tui.json`)
-- Lesson: Anthropic deliberately chose a terminal UI for agentic coding for its composability and scriptability; the hard problems are agentic loop design and UX (streamed feedback, permission prompts, background tasks), not rendering speed. Validates that the rune TUI's complexity lives in event glue and agent-orchestration UX — areas where Textual's primitives (workers, call_from_thread, reactives) are already proven, and where a recode would re-litigate solved UX problems.
-
-## Claim → source mapping
-
-| Claim | Sources |
-|---|---|
-| Render path is not the bottleneck; complexity is event glue → stay-Python shell | S1, S2, S7, S8 (vs. countervailing S3, S4, S5) |
-| Native Go/Rust TUI recode is feasible but not justified | S3, S4, S5 countervail; S1, S2, S7, S8 support stay-Python |
-| Streaming adapter surface (JSONL + sentinel envelope) is standard and already precedented | S6 + inward `_cmd_pull` precedent |
-| TUI is consumer of recoded units via typed envelope, orchestration stays high-level | S7, S8 |
-| Local-toolchain constraint | Go absent (verified `command -v go` empty); Rust 1.98.1 + GCC 16.2.1 present |

research/wave1/tui/outward/fetch-W1-textual-workers.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://textual.textualize.io/guide/workers/","title":"Workers - Textual Guide","description":"Official Textual worker documentation. Key content: Textual provides async and thread workers via @work decorator; thread workers MUST marshal UI updates through self.call_from_thread() or thread-safe post_message() because UI methods are not thread-safe; exclusive=True cancels the prior running worker on the same node; WorkerManager lifecycle is tied to the DOM node (workers die with the widget); exit_on_error defaults to True, meaning an unhandled worker exception exits the whole app.","fetched_at":"2026-09-29","fetch_confirmed":true,"lesson":"The TUI's concurrency model is a first-class framework feature: exclusive single-flight model workers, thread→UI marshalling, and worker-lifecycle management come for free in Textual. A native (Go/Rust) recode must re-implement all of this by hand — ratatui explicitly offers no such orchestration help."}]},"source":"live webfetch","fetch_note":"Fetched successfully 2026-09-29 (timeout=60, single-call batch). Textual FAQ (https://textual.textualize.io/FAQ/) timed out twice on earlier attempts and was replaced by this guide plus supplementary sources."}

research/wave1/tui/outward/fetch-W2-ratatui-rendering.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://ratatui.rs/concepts/rendering/","title":"Rendering Concepts - Ratatui","description":"Official Ratatui (Rust TUI library) rendering documentation. Key content: Ratatui is immediate-mode — the entire UI is re-created every frame; advantages are simplicity and flexibility of the render loop; disadvantages are that the developer owns the render loop and event loop orchestration (typically via crossterm), and, quoted from the docs, 'out of the box, there's little to no help in organizing large applications'.","fetched_at":"2026-09-29","fetch_confirmed":true,"lesson":"The flagship Rust TUI library is immediate-mode with zero application-structure support. The rune TUI is exactly a 'large application' (~50 command handlers, ~80 coupled modules, reactive state, worker lifecycle) — the exact category ratatui's own docs admit it does not help organize. This is direct vendor-documented evidence against a Rust recode of the TUI shell."}]},"source":"live webfetch","fetch_note":"Fetched successfully 2026-09-29 (timeout=60, single-call batch)."}

research/wave1/tui/outward/fetch-W3-bubbletea-readme.json

@@ -1 +0,0 @@
-{"success":true,"data":{"web":[{"url":"https://raw.githubusercontent.com/charmbracelet/bubbletea/main/README.md","title":"Bubble Tea - Charmbracelet (README)","description":"README of Bubble Tea, the leading Go TUI framework. Key content: Elm architecture (Model/Update/View) forces all state changes through a single update function; v2 released with a high-performance cell-based renderer; ~18,000 dependent applications; companion Bubbles component library and Lip Gloss styling library.","fetched_at":"2026-09-29","fetch_confirmed":true,"lesson":"Go has a mature, battle-tested TUI ecosystem (Bubble Tea + Bubbles + Lip Gloss), so a Go recode is technically feasible — the Elm-architecture update loop is a reasonable fit for a command-driven app. However the framework provides widgets/components, not the 80-module domain coupling the rune TUI carries; ecosystem maturity changes feasibility, not the coupling cost. Also note: Go is not installed in this environment, so no local Go evidence exists."}]},"source":"live webfetch","fetch_note":"Fetched successfully 2026-09-29 (timeout=60, single-call batch)."}