Sutra

sutra

v2.39.13 (2026-06-14, HEAD) Flow now fires every turn like the H-Sutra header: the per-turn Flow block's emission_mode changed from skill_invocation (the only block needing a Skill tool call, which got skipped on light turns) to a literal-text fast-path emitted every turn; the core:flow Skill is invoked only on substantive/multi-step/mutation turns. v2.39.12 flow-gate HARD fleet-wide; v2.39.10-11 Flow on every input + 1-step fast-path. ··· v2.35.3 (2026-05-09) BUG FIX (layer 2): reset-turn-markers.sh stdin handling. v2.35.2 fixed event registration (Stop -> UserPromptSubmit) but jq still read empty .prompt on real founder turns under Claude Code's actual UserPromptSubmit payload format, so every real turn still hit the synthetic-skip branch and never reached rm -f. Same symptom as v2.35.2 fix target: per-turn markers carrying across whole sessions. v2.35.3 fix: capture stdin ONCE into STDIN_RAW, parse PROMPT via printf '%s' STDIN_RAW | jq, log stdin_bytes + first-200-char head on every skip-empty event so root cause is observable in routing-misses.log. D55 dedupe semantics restored fleet-wide. Discovery: founder diagnostic 2026-05-09 — structure-first-active marker TURN_TS persisted 3+ min across turns, root-caused to jq + stdin double-read. ··· v2.35.2 (2026-05-09) BUG FIX: reset-turn-markers.sh event registration corrected (Stop -> UserPromptSubmit). Pre-existing fleet-wide bug: hooks.json registered reset-turn-markers.sh on Stop event, but the script reads .prompt from stdin (which only exists on UserPromptSubmit events, not Stop). Result: on every Stop fire, jq returned empty for .prompt, script fell into the "empty-prompt = synthetic turn = skip" path, NEVER wiped markers. Routing-misses.log confirmed: zero "markers-cleared" rows for entire sessions, only "reset-skipped-empty-prompt" rows. Per-turn marker discipline silently broken for ALL markers (depth-registered, input-routed, build-layer-registered, sutra-deploy-depth5, and the new structure-first-active) — they persisted for entire sessions instead of resetting per turn. D55 reminder DEDUPED across whole sessions instead of re-firing per turn. v2.35.2 moves registration to UserPromptSubmit (matches script header comment + CLAUDE.md Marker Lifecycle docs + script synthetic-turn-check logic which is designed for UserPromptSubmit stdin shape). Reset hook is now FIRST in UserPromptSubmit chain so subsequent hooks (codex-directive-detect, feedback-routing-rule, per-turn-discipline-prompt) see fresh marker state. Discovered via founder relaunch test: D55 structure-first reminder did not visibly fire in new session despite hook being installed; diagnostic traced to marker persistence across turns. ··· v2.35.1 (2026-05-09) chmod +x fix for hooks/session-token-snapshot.sh. Pre-existing bug surfaced in v2.35.0 install logs ("SessionStart:startup hook error / Permission denied"). File was tracked at git mode 100644 since at least v2.34.0 -- every cache install propagated the non-exec bit, so the SessionStart hook silently failed (non-blocking) on every session start fleet-wide for weeks. Source-side fix: git update-index --chmod=+x marketplace/plugin/hooks/session-token-snapshot.sh -> mode 100755. Now ships executable. No other hooks affected (verified: 0 of 73 .sh files in source plugin hooks/ remain non-exec). ··· v2.35.0 (2026-05-09) D55 Structure-First Default + Restructure-on-Add — hard enforcement hook fires on every tool call. New PreToolUse no-matcher hook structure-first-reminder.sh emits two-clause reminder once per founder turn (dedupe via .claude/structure-first-active marker; wiped by reset-turn-markers.sh on UserPromptSubmit; fail-open). Clause 1: tables>prose for >=3 rows, numbers>adjectives, ASCII-boxed decisions, Impact+Effort columns on every task list — action-time default, not output-time polish. Clause 2 (Restructure-on-Add): adding ANY new thing (file/section/direction/protocol/hook/skill/dep) fires four mandatory steps — Survey existing -> Reorg new+existing into one shape -> Simplify (dedupe, merge, delete) -> Surface in turn output what changed. Audit log holding/hooks/hook-log.jsonl. Kill: touch ~/.structure-first-disabled | STRUCTURE_FIRST_ACK=1 STRUCTURE_FIRST_ACK_REASON='<why>' <cmd>. Founder direction D55 (2026-05-09): "Make sure by default there is structuring applied everywhere... when we add new things, you structure the existing things with the new things and see if there are simplifications required. Make this as a hard. This code which has to run on every command." Verification gap from prior 888b790 ship (source-only, no version bump) closed by v2.35.0 cache refresh. Asawa-side landed in asawa-holding 104b037 (FOUNDER-DIRECTIONS.md sec D55 + CLAUDE.md). + v2.34.0 (2026-05-06) D53 Context7 fleet recommend banner — /core:start + /sutra-go print Context7 status line; 'enabled' when context7@claude-plugins-official installed at user scope, 'recommended' with install command otherwise. Read-only probe via ~/.claude/plugins/installed_plugins.json. NO silent install (D50 P1-1 precedent). Codex consult ADVISORY 2026-05-06 — folded go.sh coverage + wording. Asawa-side governance landed in asawa-holding 9eac452. ··· v2.33.0 (2026-05-06) D50 Identity-on-wire (opt-in, re-consent gated, 4-field allowlist). Reverses v2.2.0 PROTO-024 H2 strip on the OPT-IN telemetry rail. Strict 4-field allowlist on manifest.json: git_user_name + github_login + github_id + git_user_email_hash. Re-consent gate: existing pre-v2.33 opt-ins must re-acknowledge via /core:start --telemetry on (writes consent_version='2.33' to .claude/sutra-project.json) before identity crosses. PRIVACY.md v2.33.0 amendment supersedes v2.18.0 'identity NOT pushed' line; adds explicit collaborator-identity disclosure. Codex consult 2026-05-06 verdict CHANGES-REQUIRED → all 2 P1 + 3 P2 folded. test-identity-transport.sh covers 7 transport-boundary cases (all green). Founder direction D50. Verdict at .enforcement/codex-reviews/2026-05-06-v2.33.0-identity-on-wire.md. ··· v2.32.0 (2026-05-04) Permission posture realigned to catastrophic-only across Bash/MCP/Web/Task. WebFetch/WebSearch/Task/NotebookEdit added to PermissionRequest dispatch. MCP rule flipped from read-allowlist+mutator-prompt to catastrophic-only deny (delete/destroy/drop/purge/wipe + bulk_*/batch_modify + per-vendor catastrophes). New lib/web_trust_mode.py URL classifier — public http(s) auto-approves; localhost/127.*/169.254.*/RFC1918 prompt (SSRF defense). Aligns MCP+Web posture with Bash Trust Mode v2.6.1. v2.30.0 (2026-05-04, HEAD) D43 charter resume series complete: 10-release stream v2.21.0→v2.30.0 (CSM banner + L1→L0 CSM tools promotion + cap-114 split + cap-118 lint + Delivery OS waves). All 5 CSM TODOs closed; 8 disciplines on plugin canonical surface; Phase 1 strict gate PASSES. See CURRENT-VERSION.md + CHANGELOG.md for full per-version detail. Prior description (v2.25.0 narrative) preserved below for archaeology. ··· v2.25.0 (2026-05-04) D38 L1->L0 promotion wave closes acceptance criterion ahead of 2026-05-12 deadline. Six-wave execution (A-F) with codex consult 1777875522 PASS-with-CHANGES converged: (A) D38 PLUGIN-RUNTIME expanded to include sutra/marketplace/plugin/lib/** so sourced shared libraries promote into a formally-recognized path; build-layer-check.sh + FOUNDER-DIRECTIONS.md amended in lockstep. (B) Removed dangling Stop hook ref to assistant-kill-switch.sh from .claude/settings.json (file deleted 2026-04-27 D37 pause; settings ref orphaned until now). (C) 24 holding/ files stamped with normalized D38 multi-line marker schema (LAYER=L2/SCOPE=single-instance:asawa-holding/WHY_NOT_L0_KIND=instance-only/<file-specific WHY_NOT_L0_REASON>/PROMOTE_*=NONE/OWNER=NONE/ACCEPTANCE=NONE/TS=2026-05-04) — 6 weak-marker upgrades (architecture-awareness, principle-regression, research-cadence-check, rtk-health-check, dispatcher-pretool, dispatcher-stop) + 4 unclassified hooks classified L2 (session-end-satisfaction, verify-connections, verify-policy-coverage, verify-recursive-flow) + 12 Bucket-D classics (god-mode, upgrade-clients, desktop-healthcheck, install-git-hooks, bootstrap-project, bootstrap-testlify, new-project, close-marketplace-feedback, sync-feedback-from-gh, external-client-firewall, version-governance, verify-os-deploy) + 2 unaccounted (observability-synthesis, pre-push-test-gate). Each got a file-specific reason per codex 'don't reuse the same generic sentence' requirement. (D) L1->L0 promotion sequence rescoped 3->2+1 mid-wave: D-1 reclassified migration-dryrun.sh L1->L2 (hardcoded billu|paisa|ppr|maze portfolio inventory + Asawa-specific git remote URLs would hard-fail on T4 fleet — refactor-then-promote needed before fleet-safe; L2 is the honest classification today); D-2 promoted session-token-snapshot.sh L1->L0 to plugin/hooks/ as SessionStart hook (registered alongside existing 8 entries; LOG_FILE auto-picks holding/ vs .sutra/ for fleet-safety; COMPANY fall-through uses repo basename not 'asawa' default); D-3 promoted telemetry-shared-path.sh L1->L0 to plugin/lib/ as sourced library (no hooks.json registration per codex — activation contract is call-site sourcing + source-compatible shim). All 3 promotions have 4-line shims at holding/hooks/ with 7-day TTL retire-by 2026-05-11. (E) THIS RELEASE — v2.25.0 plugin bump shipping all D38 Wave A-D commits as one release window per codex atomicity requirement (no intermediate trunk states without release). (F) plugin-promotion-ledger.md refresh + verify (Wave F lands in next commit). Closes D38 §Acceptance: 'Existing Asawa-side artifacts have a documented disposition within 14 days (target: 2026-05-12)' — ahead of deadline by 8 days. Vinit gh#6/#7/#8 phantom-feature class structurally impossible (plugin IS where we build). Codex consult verdict + brief archived at .enforcement/codex-reviews/2026-05-04-l1-l0-promotion-wave-1777875522.{md,consult.md}. + Sutra Core — governance primitives + first-party Delivery OS skills (test-strategy, architect, with W3-W4 coming). v2.22.0 (2026-05-04) Sutra Delivery OS Wave 2 ships: second first-party Generative skill core:architect. Designs and writes a structured ARCHITECTURE.md (9 sections incl. C4 + ADRs + STRIDE + Sutra D38 Build-Layer table + Open questions). The D38 Build-Layer integration is the distinctive value-add: maps every component to L0/L1/L2 + (in existing-codebase mode) to D38 enforcement categories the runtime hook checks at edit time. Distinct from gstack plan-eng-review (reviews) and core:incremental-architect (W4 migration). Codex REVIEW CHANGES-REQUIRED -> all P0 (Open-questions section/eval contract drift, D38 enforcement-mapping gap) + P1 (telemetry made optional+non-side-effecting, all-L0 reframed to require justification, E2 file-level grounding strengthened) folded inline. + v2.20.0 (2026-05-04) Sutra Delivery OS Wave 1 ships: first first-party Generative+Decisional skill core:test-strategy. Designs a TEST-STRATEGY.md document for any subject (function / module / system / AI prompt) before tests are written: pyramid breakdown by domain heuristic + risk profile, fixture decision matrix, mock-vs-real boundary, coverage targets matched to safety-critical / user-facing / internal-tooling, AI eval-pack design when AI is in the loop, CI gate placement. Distinct from gstack gsd-add-tests (generates tests) and superpowers test-driven-development (workflow). Ships SKILL.md + 3 evals with structural assertions only. Codex CONSULT on the 5-skill spec rescoped to 4 (cut idea-to-delivery, rename io-contract-test -> deterministic-testing, promote test-strategy to W1). Build REVIEW CHANGES-REQUIRED -> all P0/P1 folded inline. First wave of 4-wave Sutra Delivery OS expansion. + v2.18.2 (2026-05-03) JSON validity hotfix: v2.18.1 description string contained unescaped double-quotes around the example pattern phrase, causing JSON parse error on every T4 fleet client running /reload-plugins. v2.18.2 escapes the quotes, bumps the version so version-keyed plugin caches refresh fleet-wide, syncs this marketplace.json catalog (was drifted at 2.18.0 while source was 2.18.1) to 2.18.2, and adds a jq-validate contract test over the 4 release-critical manifests so the bug class never recurs. Codex consult 2026-05-03 CHANGES-REQUIRED -> all 4 fold-ins applied. + v2.18.1 (2026-05-03) Optional input_text capture in H-Sutra log via SUTRA_HSUTRA_CAPTURE_INPUT=on env flag (default OFF preserves T4 privacy). Unlocks Native v1.2 organic-emergence detector for opt-in cohorts. Truncated to 500 chars. Honors C3 (Native consumes H-Sutra read-only) and D44 v1.0 (frequency-only detection, no LLM). + v2.18.0 (2026-05-03) Opt-in telemetry push restored; default OFF posture preserved. Founder direction "make it on if the user said yes". The --telemetry on flag added in v2.9.1 persisted telemetry_optin=true but scripts/push.sh:19-24 had a hard gate from the v2.0 privacy reset that blocked all pushes regardless of consent (opt-in theater). v2.18.0 lifts the gate. SUTRA_TELEMETRY=0 short-circuits BEFORE the telemetry_optin check (uniform with capture path) — kill-switch now stops both capture AND push. python3 JSON probes in push.sh / go.sh / status.sh / flush-telemetry.sh OPTIN-probe replaced with jq (matches v2.13.0 EDR-killed-python3 fix). SUTRA_TELEMETRY=0 early exits added to hooks/posttool-counter.sh and hooks/emit-metric.sh so kill-switch covers capture rail too. PRIVACY.md amendment explicitly supersedes v2.0 "no outbound transmission" sentence + tier-default T1/T2 paragraph; discloses opt-in WHAT/CADENCE/DESTINATION/KILL-SWITCH. New SUTRA_DATA_REMOTE env on push.sh for testability. Codex chain R1-R5 PASS — verdict at .enforcement/codex-reviews/2026-05-03-v2.18.0-opt-in-push.md (DIRECTIVE-ID 1777800873). + v2.17.0 (2026-05-01) Connector tools and routine project edits no longer prompt every time. MCP connector tools (Slack/Apollo/Atlassian/Gmail/Drive/Calendar/HubSpot/Read.ai/Playwright) auto-approve on read-class verbs; per-vendor mutator/send denylist always prompts (sends, deletes, external writes, Playwright stateful actions). First-time Edit/Write inside cwd auto-approves except secrets/CI/deploy/IaC paths. Founder direction D44. Sister to D43 (Sutra self-execute terminal commands) — same friction class, different actor (harness vs model). New lib/mcp_trust_mode.py + extended permission-gate.sh dispatch + widened hooks.json matcher to mcp__.* + Tier 1.7 (MCP) + Tier 1.8 (first-time-edit) added to PERMISSIONS.md. Telemetry: tool_class + decision_basis added. PERMISSIONS.md is a sibling discipline to HUMAN-SUTRA-LAYER.md (codex caught the architectural framing). Codex R1 CHANGES-REQUIRED (2 P1 / 2 P2 / 2 P3) → R2 ADVISORY, DIRECTIVE-ID 1777641500. + v2.16.0 (2026-05-01) Sutra now self-executes terminal commands by default. Before this release, Sutra often asked you to run terminal commands yourself; now Sutra runs them itself unless (1) the command needs a real terminal (interactive auth, GUI, headless-incompatible), (2) the command is on the danger list (force-pushes, recursive deletes, npm/Play Store/App Store publishes, emails, money, legal/compliance), or (3) you've marked the command class as always-ask-me. Founder direction D43. Closes the over-handoff pathology — parallel guardrail to ADR-001's OUT-QUERY 3-check. Tech detail: new OUT-DIRECT sub-form REQUEST·HUMAN-EXEC + Stage-3 3-check (cant-self-exec / denylist-hit / opt-out, denylist reused from ADR-001 §4 Rule 4 verbatim). Demotion telemetry on existing turn row (one-row-per-turn invariant preserved). 94/94 tests green. Codex R1 CHANGES-REQUIRED → R2 PASS, DIRECTIVE-ID 1777640243. + v2.15.1 (2026-05-01) systemic fix for the recurring nudge-skip pattern (founder direction "systemically fix it"): three preceding releases v2.14.1/v2.15.0/H-Sutra-not-showing all had the same root cause — hook reminder phrased as "(skill: X)" parenthetical, which the model misread as "invoke skill X" rather than "emit text directly," so blocks got silently skipped when skill auto-discovery didn't fire. v2.15.1 changes phrasing to imperative form ("MUST emit literal text" / "MUST invoke skill") so the emission contract is unambiguous. Promotes H-Sutra header from hardcoded hook-only to canonical schema entry: new `.per_turn_blocks.human_sutra_header` key in sutra-defaults.json (closes v2.14.1 deferred TODO). Hook reads `.format` and `.format_stage_1_fail` instead of hardcoding. Stderr nudge restructured: 7 numbered "MUST emit" lines + 4 "Conditionals" lines. Asawa CLAUDE.md gets new H-Sutra Header section above Input Routing + canonical-schema pointer to sutra-defaults.json so future blocks update one place. + v2.15.0 (2026-05-01) governance-parity bump — 3 Asawa-side disciplines reach T4 fleet via expanded per-turn-discipline-prompt.sh emission: Skill-explain card (4-line SKILL/WHAT/WHY/EXPECT/ASKS), Readability gate (tables>prose, ASCII boxes, no unicode boxes), and Karpathy right-effort discipline (think first / simpler-alt / surgical scope / verify-loop). Adds new `right_effort` key to sutra-defaults.json. Subagent dispatch briefing was already shipping in v2.14.1 via subagent-dispatch-brief.sh — now verified emitting 5-block briefing + 4-line footer reminder. Closes 4 of the v2.14.1 audit gaps. Founder direction 2026-05-01: "ship everything to clients". + v2.14.1 (2026-05-01) per-turn-discipline reminder expanded — v2.14.0 only nudged Input Routing + Depth+Estimation in stderr; BLUEPRINT, H-Sutra header tag, OUTPUT TRACE were silently model-side-only with no hook reminder, so T4 fleet (vinit feedback) saw H-Sutra log-write but no visible block-stack discipline. v2.14.1 reads all 5 per_turn_blocks keys from sutra-defaults.json + emits the full block stack in output order (H-Sutra header → IR → Depth → BLUEPRINT → BUILD-LAYER → tool calls → OUTPUT TRACE) plus the existing Codex-consult-at-Depth-≥3 line. Single hook edit, surgical scope per Karpathy. + v2.14.0 (2026-05-01) H-Sutra Layer v1.0 ships to fleet (D42 visibility-before-influence): every UserPromptSubmit is classified into a 9-cell CQRS-extended grid (3 verbs DIRECT/QUERY/ASSERT × 3 directions INBOUND/INTERNAL/OUTBOUND) + 3 orthogonal tags (TENSE/TIMING/CHANNEL) + REVERSIBILITY, appended to holding/state/interaction/log.jsonl (Asawa override) or .sutra/h-sutra.jsonl (default). Closes the merged≠shipping gap D43 ratified hours earlier today — dev tree had the H-Sutra fold for hours but the marketplace pointer was stuck at 2.11.1, so cached runtimes never got it. + v2.13.0 (2026-05-01) python3 removal from /core:start bootstrap (vinit#38 escalation): _sutra_project_lib.py retired to archive/2026-05-01-py3-removed-from-bootstrap/, replaced by _sutra_project_lib.sh (bash/jq) with identical 4-subcommand surface and identical atomic-write contract; start.sh adds upfront jq health gate, onboard.sh 4 inline `python3 -c` reads → jq; sandbox-tested with PATH stripped of all python3* (rc=0, all 7 fields, identity preserved). + v2.12.0 (2026-05-01) dispatcher portability charter: 6 Asawa-coupled hooks (dispatcher-pretool/dispatcher-stop/architecture-awareness/+3) extracted from plugin to holding/, ~890 lines of dead weight removed from T4 fleet on-disk footprint; codex-converged ADVISORY. + v2.10.1 (2026-05-01) silences cascade-check.sh's 'No stderr output' wrapper banner — block diagnostics route to stderr (Claude Code's hook protocol relays stderr only); tracking-artifact whitelist (research/state/checkpoints/.enforcement/.analytics/.claude/sutra/archive) added to cascade-check exempt list, aligned with CLAUDE.md whitelist; 17/17 cascade-check unit tests + 14/14 full unit suite green. + v2.10.0 (2026-05-01) ships the previously untracked hooks/inbox-display.sh (closes vinit#43 SessionStart STDERR banner on every resume) + scripts/validate-hook-paths.sh + tests/unit/test-validate-hook-paths.sh CI guard so manifest-vs-source-tree drift never reaches a release tarball again (49/49 hook paths now confirmed tracked at release time). + v2.9.1 telemetry: explicit opt-in during install (founder direction 2026-04-30) + v2.9.0 D40 governance parity — client per-turn discipline reminder + skill-explain card + subagent-dispatch contract + sutra-defaults.json policy surface + 5-turn acceptance harness + v2.8.0 codex-sutra v1.0.0 — Sutra-owned codex CLI wrapper (15-min hard cap, fail-closed semantics, 4 modes: review/challenge/consult/design-review). Replaces gstack /codex as the canonical PROTO-019 codex-by-codex review primitive. Also fixes codex-directive-detect.sh false-positive bug (system XML echoes self-triggering directives) and rewires PROTO-019 user-facing messages from /codex to /codex-sutra. Codex-reviewed across multiple rounds; verdict files at .enforcement/codex-reviews/2026-04-28-*. + v2.7.3 honesty pass II: RTK rewrite is opt-in external dep (banner + README disclose status; not bundled) per vinit#7; telemetry banner shows true v2.0 state (local-only when push disabled) per vinit#9 + v2.7.2 honesty pass I: removes session-retrieve from advertised plugin skills per vinit#6 + v2.7.1 actually applies the assistant-observer.sh B7+B9 code change (v2.7.0 narrative claimed shipped but commit didn't include the edit) + v2.7.0 permission-system streamline (codex-converged: -50% LoC, single source of truth, drift bugs eliminated) + v2.6.2 D36 Feedback Channel three-layer defense + v2.6.2 D37 Assistant default-OFF + v2.6.1 Trust Mode catastrophic-only + v2.6 PROTO-024 V1 client→team feedback fanout + Tier 1.6 Trust Mode permissions + strengthened scrub. Hooks warn when depth marker is missing before Edit/Write; estimation metrics on session end; reset-turn-markers fires on Stop event (spoof-safe). Privacy: see ~/.sutra/PRIVACY.md; opt out with SUTRA_TELEMETRY=0; feedback fanout opt-out via SUTRA_FEEDBACK_FANOUT=0 or ~/.sutra-feedback-fanout-disabled.

Sutra Native v1.5.0 — the production-grade founder workflow engine for Claude Code. v1.5.0 (2026-05-08) ships Verifier Engine v1: profile-driven utterance generator + 4-tier verifier (schema / artifact / behavior / rubric) + multi-axis assertion report (Outcome-Fidelity, Constraint-Honor, Cross-Stage-Drift, Acceptance-Coverage). SPEC §6 capture-lifecycle invariant enforced at extractor (auto-corrects clarification_required when ambiguity_flags non-empty OR confidence < 0.6) AND tier-1 verifier (new tier-1/ambiguity-coherence assertion). First scenario: pets-site (happy + broken-fixture variants). 1503 tests passing. + v1.4.0 (2026-05-06, D49) made Native fully standalone — no core@sutra dependency at runtime. Native ships its own H-Sutra producer hook + vendored classifier + shared lib. + v1.3.0 (2026-05-04) shipped 6-wave Native v1.x final ship: W1 per-step timeout_ms + CLI invoke_host_llm/--host-N + create-trigger CLI; W2 step-level approval gate; W3 cron daemon scheduler tick + workflow status/cancel CLI; W4 on_failure machinery; W5 PNC predicate adapter + commitment_broken; W6 cutover-validator + telemetry-sink. Backward-compatible with v1.2.2 user-kits.