walm00
diff --git a/‎.claude/hooks/auto_save_session.sh‎
Lines changed: 12 additions & 7 deletions b/‎.claude/hooks/auto_save_session.sh‎
Lines changed: 12 additions & 7 deletions
diff --git a/‎.claude/quality/ecosystem/state.json‎
Lines changed: 0 additions & 65 deletions b/‎.claude/quality/ecosystem/state.json‎
Lines changed: 0 additions & 65 deletions
diff --git a/‎.claude/quality/lifecycle-routing.yml‎
Lines changed: 6 additions & 3 deletions b/‎.claude/quality/lifecycle-routing.yml‎
Lines changed: 6 additions & 3 deletions
diff --git a/‎.claude/quality/schedule-config.template.json‎
Lines changed: 31 additions & 24 deletions b/‎.claude/quality/schedule-config.template.json‎
Lines changed: 31 additions & 24 deletions
diff --git a/‎.claude/scripts/_jsonl_safe.py‎
Lines changed: 96 additions & 0 deletions b/‎.claude/scripts/_jsonl_safe.py‎
Lines changed: 96 additions & 0 deletions
@@ -27,10 +27,14 @@ mkdir -p "$STATE_DIR" "$SESSIONS_DIR"
 # ---------------------------------------------------------------------------
 INPUT=$(cat)
 
-# Extract fields using python (available everywhere, no jq dependency)
-read -r STOP_HOOK_ACTIVE SESSION_ID TRANSCRIPT_PATH <<< "$(python3 -c "
+# Extract fields using python (available everywhere, no jq dependency).
+# Pipe $INPUT to stdin — never interpolate untrusted hook input into a -c string.
+read -r STOP_HOOK_ACTIVE SESSION_ID TRANSCRIPT_PATH <<< "$(printf '%s' "$INPUT" | python3 -c "
 import json, sys
-data = json.loads('''$INPUT''')
+try:
+    data = json.loads(sys.stdin.read())
+except Exception:
+    data = {}
 active = str(data.get('stop_hook_active', False)).lower()
 sid = data.get('session_id', 'unknown')
 tp = data.get('transcript_path', '')
@@ -53,11 +57,13 @@ if [ -z "$TRANSCRIPT_PATH" ] || [ ! -f "$TRANSCRIPT_PATH" ]; then
     exit 0
 fi
 
-EXCHANGE_COUNT=$(python3 -c "
-import json, sys
+# Pass transcript path via env var — never interpolate into source.
+EXCHANGE_COUNT=$(BCOS_TRANSCRIPT_PATH="$TRANSCRIPT_PATH" python3 -c "
+import json, os
 count = 0
+path = os.environ.get('BCOS_TRANSCRIPT_PATH', '')
 try:
-    with open('$TRANSCRIPT_PATH', 'r') as f:
+    with open(path, 'r') as f:
         for line in f:
             line = line.strip()
             if not line:
@@ -66,7 +72,6 @@ try:
                 entry = json.loads(line)
                 if entry.get('role') == 'user':
                     content = str(entry.get('content', ''))
-                    # Skip slash commands and system messages
                     if '<command-message>' not in content:
                         count += 1
             except json.JSONDecodeError:
 
@@ -233,16 +233,19 @@ rules:
     description: >
       Research documents with external URLs that have aged past the declared
       route_to_wiki_after_days threshold. Sweep confirms an external URL exists
-      in the body (otherwise it's not source-summary material), then calls
-      /wiki promote to produce a source-summary page.
+      in the body and then delegates to /wiki promote — the bcos-wiki skill
+      chooses the destination bucket (pages/ vs source-summary/) based on the
+      document's shape, so the sweep MUST NOT encode the bucket itself. The
+      `destination.bucket: auto` value documents this delegation; lifecycle_sweep
+      surfaces a "delegate to /wiki promote" finding rather than moving files.
     match:
       zones: [active]
       lifecycle-triggers:
         - route_to_wiki_after_days: any
       cluster-hints: [market-intelligence, research, competitive, reference]
     destination:
       zone: wiki
-      bucket: source-summary
+      bucket: auto  # bcos-wiki picks pages/ vs source-summary/ on promote
     body-markers:
       - pattern: "https?://"
         role: require
 
@@ -9,62 +9,67 @@
     "index-health": {
       "enabled": true,
       "schedule": "daily",
-      "_about": "Rebuild document index + scan for frontmatter, metadata, and cross-reference issues. Cheap — always run daily."
+      "_about": "Run cadence: starts daily, tune down once stable. Rebuild document index + scan for frontmatter, metadata, and cross-reference issues. Cheap — fine to leave daily long-term."
     },
     "daydream-lessons": {
       "enabled": true,
-      "schedule": "mon",
-      "_about": "Strategic reflection + lessons capture. Once a week is usually enough."
+      "schedule": "daily",
+      "_about": "Run cadence: starts daily, tune down once stable. Steady state ~weekly (e.g. 'mon') — strategic reflection + lessons capture rarely needs more than that once context settles."
     },
     "daydream-deep": {
       "enabled": true,
-      "schedule": "wed",
-      "_about": "Deeper mid-week daydream — gaps, structural change. Skip in new projects where context is still forming."
+      "schedule": "daily",
+      "_about": "Run cadence: starts daily, tune down once stable. Steady state ~weekly mid-week (e.g. 'wed') — gaps and structural change. In mature projects, biweekly is also reasonable."
     },
     "audit-inbox": {
       "enabled": true,
-      "schedule": "fri",
-      "_about": "Deep CLEAR audit + inbox processing. Weekly by default; bump to twice-weekly if the inbox grows faster than you can triage."
+      "schedule": "daily",
+      "_about": "Run cadence: starts daily, tune down once stable. Steady state ~weekly (e.g. 'fri') — deep CLEAR audit + inbox processing. Bump back up to twice-weekly if the inbox grows faster than you can triage."
     },
     "architecture-review": {
       "enabled": true,
-      "schedule": "1st",
-      "_about": "Monthly full architecture + ecosystem pass. Quarterly is fine once context is mature — just change 'schedule' to a cron like '0 0 1 */3 *' or ask Claude to do it."
+      "schedule": "daily",
+      "_about": "Run cadence: starts daily, tune down once stable. Steady state monthly (e.g. '1st') or quarterly ('0 0 1 */3 *') once context is mature — full architecture + ecosystem pass."
     },
     "wiki-stale-propagation": {
       "enabled": true,
       "schedule": "daily",
-      "_about": "Scan wiki pages whose builds-on sources changed after last-reviewed. Cheap metadata-only check; emits action items for human review."
+      "_about": "Run cadence: starts daily, tune down once stable. Cheap metadata-only check — fine to leave daily long-term. Scans wiki pages whose builds-on sources changed after last-reviewed and emits action items."
     },
     "wiki-source-refresh": {
       "enabled": true,
-      "schedule": "mon",
-      "_about": "Two-tier source-summary refresh: HEAD-only quick checks at stale_threshold_days/4, full refresh-must-rediscover at stale_threshold_days."
+      "schedule": "daily",
+      "_about": "Run cadence: starts daily, tune down once stable. Steady state ~weekly (e.g. 'mon') — two-tier source-summary refresh: HEAD-only quick checks at stale_threshold_days/4, full refresh-must-rediscover at stale_threshold_days."
     },
     "wiki-graveyard": {
       "enabled": true,
-      "schedule": "1st",
-      "_about": "Monthly archive-candidate scan for stale/orphaned/expired wiki pages. Suggests archive actions; only whitelisted post-mortem expiry is auto-fixable."
+      "schedule": "daily",
+      "_about": "Run cadence: starts daily, tune down once stable. Steady state monthly (e.g. '1st') — archive-candidate scan for stale/orphaned/expired wiki pages. Only whitelisted post-mortem expiry is auto-fixable."
     },
     "wiki-coverage-audit": {
       "enabled": true,
-      "schedule": "0 0 1 */3 *",
-      "_about": "Quarterly cross-zone coverage scan. Surfaces active data points without wiki explainers and wiki clusters not present in document-index as INFO."
+      "schedule": "daily",
+      "_about": "Run cadence: starts daily, tune down once stable. Steady state quarterly ('0 0 1 */3 *') — cross-zone coverage scan. Surfaces active data points without wiki explainers and wiki clusters missing from document-index as INFO."
     },
     "auto-fix-audit": {
       "enabled": true,
-      "schedule": "fri",
-      "_about": "Friday weekly safety brake on the self-learning ladder. Surfaces amber cards when a learned rule reversal rate crosses 5% in 7 days. Recommend-only at v0.1."
+      "schedule": "daily",
+      "_about": "Run cadence: starts daily, tune down once stable. Steady state ~weekly (e.g. 'fri') — safety brake on the self-learning ladder. Surfaces amber cards when a learned rule reversal rate crosses 5% in 7 days. Recommend-only at v0.1."
     },
     "lifecycle-sweep": {
       "enabled": true,
-      "schedule": "fri",
-      "_about": "Friday weekly classifier of active-zone docs against lifecycle-routing.yml. Surface-only for the first 2 weeks (default); flip lifecycle-routing.yml > global.surface_only=false after 0 false-positives confirmed to enable auto-routing."
+      "schedule": "daily",
+      "_about": "Run cadence: starts daily, tune down once stable. Steady state ~weekly (e.g. 'fri') — classifier of active-zone docs against lifecycle-routing.yml. Surface-only for the first 2 weeks (default); flip lifecycle-routing.yml > global.surface_only=false after 0 false-positives confirmed to enable auto-routing."
     },
     "wiki-canonical-drift": {
       "enabled": true,
       "schedule": "daily",
-      "_about": "Daily mechanical scan: wiki captures whose numeric facts diverge from canonical docs whose last-updated is > 180 days. Emits wiki-canonical-drift-suggestion findings; never edits canonical docs. Schema 1.2 Class D — see job-wiki-canonical-drift.md."
+      "_about": "Run cadence: starts daily, tune down once stable. Mechanical scan — fine to leave daily long-term. Wiki captures whose numeric facts diverge from canonical docs whose last-updated is > 180 days. Emits wiki-canonical-drift-suggestion findings; never edits canonical docs. Schema 1.2 Class D — see job-wiki-canonical-drift.md."
+    },
+    "wiki-failed-ingest": {
+      "enabled": true,
+      "schedule": "daily",
+      "_about": "Run cadence: starts daily, tune down once stable. Cheap dead-letter scan — fine to leave daily long-term. Surfaces stuck queue.md URLs (default >14 days), source-summary files missing provenance.source, and wiki drafts with malformed/missing YAML frontmatter. Mechanical-only; never auto-fixes. See job-wiki-failed-ingest.md."
     }
   },
   "auto_fix": {
@@ -89,12 +94,14 @@
     "write_file": true,
     "path": "docs/_inbox/daily-digest.md",
     "auto_commit": false,
-    "_about": "Overwrites each run. Full history lives in .claude/hook_state/schedule-diary.jsonl. Set auto_commit: true to commit generated artifacts (digest, index, diary, wake-up context) at the end of each run — but ONLY if the working tree has no other changes. Never pushes, never branches. Safe default is false; flip to true once you trust a week of clean runs.",
+    "_about": "Overwrites each run. Full history lives in .claude/hook_state/schedule-diary.jsonl. Set auto_commit: true to commit generated artifacts (digest, index, diary, wake-up context) at the end of each run — but ONLY if the working tree has no other changes AND the current branch is in auto_commit_branches. Never pushes, never branches. Safe default is false; flip to true once you trust a week of clean runs.",
     "auto_commit_block_on_red": true,
-    "_about_block_on_red": "When true (default), auto_commit is skipped on red verdict runs even if the tree is otherwise clean. Surfaces an Auto-commit paused chip in the cockpit. Set to false to opt back into committing on red days."
+    "_about_block_on_red": "When true (default), auto_commit is skipped on red verdict runs even if the tree is otherwise clean. Surfaces an Auto-commit paused chip in the cockpit. Set to false to opt back into committing on red days.",
+    "auto_commit_branches": ["main", "master", "dev", "develop"],
+    "_about_branches": "Allowlist of long-lived branches where auto-commit may land. On any other branch (short-lived feature branches like 'feat/foo'), the dispatcher writes the digest locally but skips the commit so unrelated daily-maintenance commits don't pollute feature PRs. Add 'trunk', 'production', 'staging', or your team's gitflow names if needed."
   },
   "tuning": {
-    "suggest_reduce_after_green_runs": 3,
+    "suggest_reduce_after_green_runs": 5,
     "suggest_increase_if_findings_trending_up": true,
     "_about": "Adaptive tuning is suggestion-only. The dispatcher never changes this config on its own."
   }
 
@@ -0,0 +1,96 @@
+"""Safe JSONL loader with corruption tracking.
+
+Most BCOS loaders read JSONL with `try: json.loads(line) except: continue`,
+which silently drops malformed lines. On Windows, concurrent appends to a
+JSONL file are NOT atomic — a race can produce one mangled line, which then
+silently disappears from the auditor's denominator and skews the
+self-learning ladder's reversal-rate computation.
+
+This module replaces the pattern with one that counts drops, so the
+dispatcher can surface a `data-corruption-detected` finding when a loader
+quietly threw away rows. No behaviour change on clean data.
+
+Migration: replace
+
+    out = []
+    with p.open(encoding="utf-8") as fh:
+        for line in fh:
+            line = line.strip()
+            if not line:
+                continue
+            try:
+                out.append(json.loads(line))
+            except Exception:
+                continue
+    return out
+
+with
+
+    rows, report = safe_load_jsonl(p)
+    if report.dropped:
+        log_corruption(report)   # or: include in dispatcher findings
+    return rows
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from dataclasses import dataclass
+from pathlib import Path
+
+
+@dataclass
+class CorruptionReport:
+    path: str
+    dropped: int
+    sample_offsets: list[int]  # byte offsets of the first few bad lines
+
+    def as_finding(self) -> dict:
+        """Shape compatible with the dispatcher's `actions_needed` finding format."""
+        return {
+            "type": "data-corruption-detected",
+            "severity": "amber" if self.dropped < 5 else "red",
+            "path": self.path,
+            "dropped_lines": self.dropped,
+            "sample_offsets": self.sample_offsets[:3],
+            "note": (
+                f"{self.dropped} malformed JSONL line(s) dropped from {self.path}. "
+                "Likely cause: concurrent append on Windows (no atomic O_APPEND) "
+                "or an interrupted write. Inspect the file at the listed byte offsets."
+            ),
+        }
+
+
+def safe_load_jsonl(path: Path) -> tuple[list[dict], CorruptionReport]:
+    """Load a JSONL file, returning rows and a corruption report.
+
+    Empty/missing files return empty results with `dropped=0` (not an error).
+    """
+    rows: list[dict] = []
+    bad_offsets: list[int] = []
+    if not path.is_file():
+        return rows, CorruptionReport(str(path), 0, [])
+    offset = 0
+    with path.open("rb") as fh:
+        for raw in fh:
+            line = raw.decode("utf-8", errors="replace").strip()
+            if not line:
+                offset += len(raw)
+                continue
+            try:
+                rows.append(json.loads(line))
+            except Exception:
+                bad_offsets.append(offset)
+            offset += len(raw)
+    return rows, CorruptionReport(str(path), len(bad_offsets), bad_offsets)
+
+
+def safe_load_jsonl_rows(path: Path) -> list[dict]:
+    """Backwards-compatible drop-in: same signature as the old `_load_rows`.
+
+    Drops the corruption report; loaders that don't yet surface findings can
+    use this and migrate later.
+    """
+    rows, _ = safe_load_jsonl(path)
+    return rows