feat: message digests, unverified ceiling removal (0.0.49)

.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
     "email": "hi@okis.dev"
   },
   "description": "Multi-model orchestration marketplace for Claude Code.",
-  "version": "0.0.48",
+  "version": "0.0.49",
   "plugins": [
     {
       "name": "grok",
       "source": "./plugins/grok",
       "displayName": "Grok Companion",
       "description": "Local Grok CLI delegation: task, review, resumable history, best-of-n tournaments, background jobs, stats, and setup health checks.",
-      "version": "0.0.48",
+      "version": "0.0.49",
       "author": {
         "name": "Harry Yep"
       },
@@ -34,7 +34,7 @@
       "source": "./plugins/codex",
       "displayName": "Codex Companion",
       "description": "First party local Codex CLI delegation for tasks, reviews, resumable threads, and durable background jobs.",
-      "version": "0.0.48",
+      "version": "0.0.49",
       "author": {
         "name": "Harry Yep"
       },
@@ -55,7 +55,7 @@
       "source": "./plugins/fusion",
       "displayName": "Fusion Orchestrator",
       "description": "Multi-model orchestration: tier agents, routing rules, blind panel, ultra fleet, model config, and drift doctor.",
-      "version": "0.0.48",
+      "version": "0.0.49",
       "author": {
         "name": "Harry Yep"
       },

CHANGELOG.md

@@ -1,5 +1,11 @@
 # changelog
 
+## 0.0.49
+
+- the judgment posture unverified ceiling is removed entirely, by user directive, after its first week fired almost solely on false positives: the ceiling denied writes in sessions that were verifying constantly, because the 0.0.48 sensor's output evidence regex (`fail 0`) is node:test reporter grammar while the sessions that hit the stop live in vitest repositories (`Tests 1635 passed`), and the exit status channel requires the runner as the final unpiped segment, a shape the standing discipline of piping every run through `tail` or `grep` guarantees never occurs. three days of audit ground truth: 1126 counted writes, 18 verification resets, 25 ceiling denies across six sessions, every denied session demonstrably green on its own suite. the deny branch, `FUSION_INLINE_UNVERIFIED_CEILING`, the approaching ceiling advisory note, the `unverified-ceiling` audit reason and the stats `unverifiedCeilingStops` counter all leave; judgment posture counts and advises and never denies a main loop write, `strict` keeps every floor verbatim, and the two posture independent denials (no-op heartbeat Bash, reaped worker probe) stay. the vitest blind sensor itself is deliberately not repaired here, removal rather than recalibration was the directive, and it remains the open candidate since advisory counts still overstate in vitest repositories
+- every user visible message now ends with a stable numeric digest, `[fusion:NNNN]`: a 43 entry registry in `lib/user-messages.mjs` maps each message kind to a 4 digit code derived from the sha256 of its slug, so the code survives rewording and can be quoted, searched and counted. guard denies and advisories, all worker lifecycle stop gate and dispatch messages, the fleet posture reminders, breaker advisories, rules sync notices, the compact echo, codex monitor lines and the stats raw args error all carry one. guard audit events stamp their `messageCode`, `/fusion:stats --messages` lists the registry and `/fusion:stats --message <n>` explains one code and shows its recorded occurrences, both admitted as strict direct arguments; message kinds without an audit backed ledger say so instead of pretending
+- the tagging sweep re-proved the verification list lesson at larger scale: three suites outside every package's named verification list pinned exact message text (`codex-wrapper-contract`, `codex-jobs-monitor` with twenty pinned monitor lines, and the `raw-transport-surface` ritual regex over the stats skill), and all three surfaced only on the merged tree full run, which stays the acceptance gate for exactly this reason
+
 ## 0.0.48
 
 - the inline guard's verification sensor stops being blind to real traffic: the recognizer only ever looked at a compound command's final segment, so `npm test 2>&1 | rg` shapes never registered and a seven day audit showed exactly 1 recognized verification event against 1325 counted writes, which is how the forty write ceiling fired on a session that had run the full suite green eight times that day. recognition is now any-segment with a quote-aware splitter, and the pass decision splits by observability: a runner that is the final segment keeps the exit status check, while a runner followed by a pipe tail or sequenced segment requires positive evidence in the tool output, a `fail 0` summary with no `✖` or `not ok` line, because a grep tail exits 0 even when it merely matched failure lines. each reset stamps `evidence: exit-status|output-summary` on its audit event and `/fusion:stats --audit` aggregates recognizer health by evidence kind. ten transcript vectors from the incident session ride as tests, five that must reset and five that must not

plugins/codex/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "codex",
   "displayName": "Codex Companion",
-  "version": "0.0.48",
+  "version": "0.0.49",
   "description": "First party local Codex CLI delegation for tasks, reviews, resumable threads, and durable background jobs.",
   "author": {
     "name": "Harry Yep"

plugins/fusion/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "fusion",
   "displayName": "Fusion Orchestrator",
-  "version": "0.0.48",
+  "version": "0.0.49",
   "description": "Multi-model orchestration: tier agents, routing rules, blind panel, ultra fleet, model config, and drift doctor.",
   "author": {
     "name": "Harry Yep"

plugins/fusion/hooks/hooks.json

@@ -26,7 +26,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "echo 'Context was compacted. Restate the session execution posture (coordinate, implement, or triage) in your next message. Confirm that every dispatched package is still tracked to collection and verification, and that any main loop work since the last verification still has a verification command to run. Reassess routing for the remaining work: does anything now belong to fusion:deep-reasoner, a peer engine, or the panel?'",
+            "command": "echo 'Context was compacted. Restate the session execution posture (coordinate, implement, or triage) in your next message. Confirm that every dispatched package is still tracked to collection and verification, and that any main loop work since the last verification still has a verification command to run. Reassess routing for the remaining work: does anything now belong to fusion:deep-reasoner, a peer engine, or the panel? [fusion:9902]'",
             "timeout": 5
           }
         ]

plugins/fusion/rules-manifest.json

@@ -23,6 +23,7 @@
     "93e7b5692737fcd82946ab75ee173783c2fbdefd5f3da954d4d676c97101c4f3",
     "955aea2e9890bf79c5ebabb499e9ae170c4bfe372d7e35f44e6f3c4096225a83",
     "9581481f2f57e522fbfa6c120056289ddcc36c29bd7aade8575308a3045e64c1",
+    "99164fddc893385c69c4a493bead0aa650bc2f3f71240c3f316d0dc36abd5aa1",
     "9b6d1f1e857020604219a1095928748dcad5d25070a2b33a2e9747273370038b",
     "9e3213d69a08713ffa97f22042ecee8493fb4aa4a2d91150da4f1b6e4573b42a",
     "a04a6b16fdf5ff42e8ab8da398331da505bdffa0a002e3073c4e73d3298bd3fc",

plugins/fusion/rules/orchestration.md

@@ -45,7 +45,7 @@ Inline work gate: the unit is one coherent change, not a file count. A change qu
 
 Accumulation triggers, each forcing a transition to implement before the next product code edit: unverified accumulation, meaning main loop edits piling up without their verification command passing; a failed verification of inline work; the same file or the same named symptom (error string, test name, component) being fixed for the second time in the session. Edit counts and turn counts are not triggers by themselves. Verified work never accumulates, and the inline write guard measures exactly this distinction.
 
-Posture dial: `judgment`, the default, lets the main session choose width and locus per package while the guards enforce that work is collected and verified, bounded by the unverified write ceiling and the two posture independent denials. `strict` restores mandatory floors for long unattended runs, where only a dispatch reopens the main loop write window and the fleet reminder fires on every prompt. `/fusion:config set-posture <judgment|strict>` is the write path and `FUSION_POSTURE` overrides it for one session. `FUSION_FLEET_MODE=off` silences the fleet reminder in both postures without changing any gate.
+Posture dial: `judgment`, the default, lets the main session choose width and locus per package while the guards enforce that work is collected and verified, bounded only by the two posture independent denials. `strict` restores mandatory floors for long unattended runs, where only a dispatch reopens the main loop write window and the fleet reminder fires on every prompt. `/fusion:config set-posture <judgment|strict>` is the write path and `FUSION_POSTURE` overrides it for one session. `FUSION_FLEET_MODE=off` silences the fleet reminder in both postures without changing any gate.
 
 Crossing into implement is declared in one short user visible status line before the next tool call.
 
@@ -175,7 +175,7 @@ Every brief is self contained: goal, constraints, relevant paths, and what done
 - Grok review requires the installed headless `--json-schema` contract and consumes `structuredOutput` from the same turn. A schema error or explicit null structured result is a failed review, not permission to trust text or spend a second call. Compatibility parsing of `text` is allowed only when the structured output field is completely absent. Preserve request id, session id, turn count, token usage, per-model usage, cost, partial-cost, and incomplete-usage indicators in job records whenever the CLI reports them. A `model_usage` row reports only input, output, cache-read, and model-call counts plus optional cost, so never synthesize aggregate reasoning or total token channels. `usage_is_incomplete` means the usage ledger may have missed open subagents, usage application, or a drain timeout; present values are observed lower bounds, and both job-total token and cost coverage fail closed to incomplete. Accept only positive complete top-level cost pairs and use ticks as authoritative at 10000000000 ticks per USD. These fields improve observability but never replace independent semantic acceptance.
 - A future Grok ACP adapter must use one process pool per canonical cwd and sandbox profile. Each daemon starts directly with `grok --cwd <canonical> --sandbox <profile> agent --no-leader stdio`; a global bridge or leader reuse is forbidden because sandbox installation happens once at process start and an existing leader can retain a different cwd or sandbox. ACP permission requests and live tool events improve visibility, but do not weaken the companion's tool, worktree, background, collection, or semantic acceptance boundaries.
 - Never delegate to codex or grok anything touching secrets, credentials, or context that cannot be compressed into a brief.
-- Runtime guard: in `judgment` posture the hook counts the writes in the current window and attaches one advisory at each multiple of the five write budget, naming the lanes the remaining work could go to; a dispatch or a passing verification command closes the window and clears the advisory, because verified work is finished work. Verification is recognized by passing evidence in the command's output as well as its exit status, so piped and redirected runner invocations count, and absolute paths outside the session workspace (memory files, transport payloads, scratchpad paths) never enter the unverified count while relative paths always count. Advice is not a floor, so ordinary work is never blocked by it, but the window carries a ceiling of eight budgets, forty unverified writes by default, and a write that reaches the ceiling is denied until one of those two moves reopens the window. The last two advisories before the ceiling name it, so the stop is never a surprise, and the denial names both reopening moves rather than only the dispatch. Locus stays judgment below the ceiling, so inline sprawl is measured rather than blocked, and it surfaces in the coercion ledger as the deepest unverified window a session reached and the number of ceiling stops. In `strict` posture the floors are hard again: only a dispatch opens a window, and past the budget the hook permits up to three small Edit calls with replacement content at most 1024 bytes for files already written in the window, plus a zero dispatch relief of ten writes and 16384 bytes that applies to any write tool and any path, while outside those two reliefs every write stays denied. Unreadable guard state fails closed in `strict` and fails open in `judgment`. Two denials hold in both postures, because neither rests on semantics a counter cannot see: a no-op Bash command while Fusion tasks are in flight, which is a silent turn, and a `TaskOutput` or `TaskStop` probe of a worker that already completed and was reaped, which has a result file to read instead. `FUSION_INLINE_WRITE_BUDGET`, `FUSION_INLINE_TAIL_MAX_BYTES`, `FUSION_INLINE_TAIL_ALLOWANCE`, `FUSION_INLINE_ZERO_DISPATCH_MAX_BYTES`, and `FUSION_INLINE_ZERO_DISPATCH_WRITES` configure the strict limits, `FUSION_INLINE_UNVERIFIED_CEILING` sets the judgment posture ceiling and zero removes it, and `FUSION_VERIFICATION_PATTERN` adds a project specific runner to the verification recognizer. The posture dial remains the only control over gate strength; the ceiling is a limit like the others, not a second mode switch.
+- Runtime guard: in `judgment` posture the hook counts the writes in the current window and attaches one advisory at each multiple of the five write budget, naming the lanes the remaining work could go to; a dispatch or a passing verification command closes the window and clears the advisory, because verified work is finished work. Verification is recognized by passing evidence in the command's output as well as its exit status, so piped and redirected runner invocations count, and absolute paths outside the session workspace (memory files, transport payloads, scratchpad paths) never enter the unverified count while relative paths always count. Advice is never a floor and judgment posture never denies a main loop write: inline sprawl is measured rather than blocked, and it surfaces in the coercion ledger as the deepest unverified window a session reached. In `strict` posture the floors are hard: only a dispatch opens a window, and past the budget the hook permits up to three small Edit calls with replacement content at most 1024 bytes for files already written in the window, plus a zero dispatch relief of ten writes and 16384 bytes that applies to any write tool and any path, while outside those two reliefs every write stays denied. Unreadable guard state fails closed in `strict` and fails open in `judgment`. Two denials hold in both postures, because neither rests on semantics a counter cannot see: a no-op Bash command while Fusion tasks are in flight, which is a silent turn, and a `TaskOutput` or `TaskStop` probe of a worker that already completed and was reaped, which has a result file to read instead. Every user visible guard, lifecycle, and session message ends with a bracketed numeric digest such as `[fusion:1234]`; `/fusion:stats --messages` lists every digest with its meaning and `/fusion:stats --message <n>` explains one digest and shows its recorded occurrences. `FUSION_INLINE_WRITE_BUDGET`, `FUSION_INLINE_TAIL_MAX_BYTES`, `FUSION_INLINE_TAIL_ALLOWANCE`, `FUSION_INLINE_ZERO_DISPATCH_MAX_BYTES`, and `FUSION_INLINE_ZERO_DISPATCH_WRITES` configure the strict limits, and `FUSION_VERIFICATION_PATTERN` adds a project specific runner to the verification recognizer. The posture dial remains the only control over gate strength.
 - A review job whose findings are consumed by a follow-up dispatch is settled like any other package; consuming the findings without recording the review's verdict is a settlement gap.
 - When any package in a wave terminates by timeout with partial output, rerun that package's verification plus one broad typecheck or test pass over the merged tree before accepting sibling packages that share the subsystem.
 - Before dispatching Codex into a workspace, confirm its single-flight slot is free or route down the admission ladder; a dispatch bounced with an already-running error is a routing error, not a retry candidate.

plugins/fusion/scripts/breaker-check.mjs

@@ -7,6 +7,7 @@ import { fileURLToPath } from "node:url";
 
 import { resolveCodexStateDir, resolveCodexStateRoots } from "./lib/codex-state-roots.mjs";
 import { canonicalWorkerAgentType, readWorkerRecords } from "./lib/worker-state.mjs";
+import { tagMessage } from "./lib/user-messages.mjs";
 
 const GROK_DATA_ENV = "GROK_COMPANION_DATA";
 const LOOKBACK_ENV = "FUSION_BREAKER_LOOKBACK_HOURS";
@@ -304,7 +305,7 @@ function run(env = process.env, now = Date.now()) {
     }
   }
   if (lines.length > 0) {
-    process.stdout.write(`${lines.join("\n")}\n`);
+    process.stdout.write(`${tagMessage("breaker-check.breaker-advisory", lines.join("\n"))}\n`);
   }
 }
 

plugins/fusion/scripts/codex-jobs-monitor.mjs

@@ -20,6 +20,7 @@ import {
   workspaceRootsShareRepository
 } from "./fusion-stats.mjs";
 import { observeGrokJobsSafely } from "./grok-jobs-observer.mjs";
+import { tagMessage } from "./lib/user-messages.mjs";
 
 const TERMINAL_STATUSES = new Set(["done", "error", "cancelled"]);
 const DEFAULT_POLL_INTERVAL_MS = 15000;
@@ -713,7 +714,7 @@ function pruneOldStateFiles(stateRoot, currentFile) {
 
 function safeWriteLine(line) {
   try {
-    process.stdout.write(`${line}\n`);
+    process.stdout.write(`${tagMessage("codex-monitor.job-notification", line)}\n`);
   } catch (error) {
     if (error?.code === "EPIPE") {
       process.exit(0);

plugins/fusion/scripts/fleet-posture.mjs

@@ -5,12 +5,13 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { isStrictPosture, resolveFusionDataDir } from "./lib/posture.mjs";
 import { normalizeSessionId, resolveStateDir, stateFile } from "./inline-delegation-guard.mjs";
+import { tagMessage } from "./lib/user-messages.mjs";
 
 const FLEET_MODE_ENV = "FUSION_FLEET_MODE";
 const NARROW_WAVE_THRESHOLD_ENV = "FUSION_NARROW_WAVE_THRESHOLD";
 const FLEET_MODE_FILE = "fleet-mode";
 const DEFAULT_NARROW_WAVE_THRESHOLD = 2;
-const ADDITIONAL_CONTEXT = "fleet-default active: a goal that decomposes into three or more independent work packages convenes /fusion:ultra once bootstrap dependencies are resolved; narrower execution states `fleet-decline: <reason>` visibly in the reply.";
+const ADDITIONAL_CONTEXT = tagMessage("fleet-posture.strict-fleet-reminder", "fleet-default active: a goal that decomposes into three or more independent work packages convenes /fusion:ultra once bootstrap dependencies are resolved; narrower execution states `fleet-decline: <reason>` visibly in the reply.");
 
 function readHookInput() {
   try {
@@ -73,7 +74,7 @@ function main() {
   if (streak === null || streak < resolveNarrowWaveThreshold()) {
     return;
   }
-  const additionalContext = `${streak} consecutive width one dispatch waves in this session. If the remaining packages are independent, dispatch them together in one message; /fusion:ultra is available when the goal is genuinely wide.`;
+  const additionalContext = tagMessage("fleet-posture.narrow-wave-reminder", `${streak} consecutive width one dispatch waves in this session. If the remaining packages are independent, dispatch them together in one message; /fusion:ultra is available when the goal is genuinely wide.`);
   process.stdout.write(`${JSON.stringify({ hookSpecificOutput: { hookEventName: "UserPromptSubmit", additionalContext } })}\n`);
 }