rename(547): the plugin is grimoire — manifest, MCP key, hooks, env, skills

Step 3 of the Scribe -> Grimoire rename.

- Plugin `grimoire` in marketplace `grimoire-plugin`, MCP server key
  `grimoire`, so tools reach a session as mcp__plugin_grimoire_grimoire__*.
- hooks/scribe_* -> hooks/grimoire_*, their shell functions and the TMPDIR
  ledgers with them; SCRIBE_URL / SCRIBE_TOKEN / SCRIBE_HOOK_DIR /
  SCRIBE_LEDGER_DIRS -> GRIMOIRE_*; the project marker is `.grimoire`.
- skills/using-scribe -> using-grimoire, /grimoire:sync, stored processes
  arrive as grimoire-proc-<slug>; moment_actions names them the same way.
- Migration 0124 rewrites stored skill names (rule_moments,
  rule_moment_judgments, moment_mappings) from scribe:/scribe-proc- to
  grimoire:/grimoire-proc-, so a rule mounted on a skill keeps firing.
- Settings' install commands and MCP-only defaults, the docs and the
  tests follow.
- scripts/check_plugin.py drops the smoke event for a report-check hook
  that has no file in plugin/hooks.

Kept on purpose: the secret-sealing label, and the names that let backups
written as Scribe restore and be counted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugin/hooks/grimoire_reply_check.sh

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# Grimoire — Stop hook: the reply moment.
+#
+# A reply is the one act no tool call marks, and it is where "please check
+# this on your end" or "it's done" gets said — so every arm that fires on a
+# tool call misses it. This hook sends the finished reply to the server, which
+# checks it twice over: the rules MOUNTED on the reply moments, and the reply
+# text against every rule's trigger, as the backstop for whatever the earlier
+# arms missed. An unopened rule from either half holds the reply for one read.
+#
+# ONE END-OF-TURN REQUEST. When the turn closed a task, the same request
+# carries the task ids and the server also checks the reply for the completion
+# sections. The section check's outcome is recorded (`report_check`, the
+# adherence number), and when it
+# held the reply, the rewrite is sent back once with `rewrite: true` so the
+# server can record how it came out. A rewrite is never held.
+#
+# THE CONTRACT, and the reasons for it:
+#   - the server decides and supplies the words; this hook blocks only on a
+#     reason it was given, so an unconfigured or unreachable instance never
+#     stops a session;
+#   - the rewrite is never held (`stop_hook_active`), so a hold costs one turn
+#     at most;
+#   - a rule holds a session once. The ledger is the act checkpoint's own
+#     (`<sid>.checkpoint.ids`), so a rule that already stopped a command does
+#     not stop the reply about it, and the per-session cap counts both doors.
+#
+# Env:
+#   GRIMOIRE_URL / GRIMOIRE_TOKEN override for the settings.json dogfooding path.
+
+command -v curl >/dev/null 2>&1 || exit 0
+
+# shellcheck source=plugin/hooks/grimoire_defs.sh
+. "$(dirname "${BASH_SOURCE[0]}")/grimoire_defs.sh"
+
+event=$(cat 2>/dev/null || true)
+event_flat=$(printf '%s' "$event" | grimoire_json_flat)
+transcript=$(grimoire_json_pick "$event_flat" '.transcript_path')
+session_id=$(grimoire_json_pick "$event_flat" '.session_id')
+active=$(grimoire_json_pick "$event_flat" '.stop_hook_active')
+event_cwd=$(grimoire_json_pick "$event_flat" '.cwd')
+
+[ -n "$transcript" ] && [ -f "$transcript" ] && [ -n "$session_id" ] || exit 0
+
+state_dir="${TMPDIR:-/tmp}/grimoire-priorart"
+mkdir -p "$state_dir" 2>/dev/null || true
+safe_sid=$(printf '%s' "$session_id" | tr -c 'A-Za-z0-9._-' '_')
+rulefile="$state_dir/${safe_sid}.rules.ids"
+stopfile="$state_dir/${safe_sid}.checkpoint.ids"
+# Set when the section check held the reply: the next stop is its rewrite.
+# A ledger by name (`.ids`), so a compaction sweeps it with the rest.
+reportfile="$state_dir/${safe_sid}.reportcheck.ids"
+
+# The rewrite after a hold goes out as written. Only a rewrite of a SECTION
+# hold is sent at all — to record how it came out; one after a rule hold, or
+# another plugin's block, has nothing to report.
+if [ "$active" = "true" ]; then
+  [ -f "$reportfile" ] || exit 0
+  rm -f "$reportfile" 2>/dev/null || true
+  rewrite=true
+else
+  rm -f "$reportfile" 2>/dev/null || true
+  rewrite=false
+fi
+grimoire_config || exit 0
+
+facts=$(grimoire_turn_facts "$transcript")
+[ "$(grimoire_turn_fact "$facts" bounded)" = "1" ] || exit 0
+reply=$(grimoire_turn_fact "$facts" reply | grimoire_json_unescape)
+# The reply may not be in the transcript yet when the hook fires: an empty
+# reply is "cannot tell", never "missing everything".
+[ -n "$(printf '%s' "$reply" | tr -d '[:space:]')" ] || exit 0
+# How many tasks this turn closed, and which — successful closes only, this
+# session only (grimoire_turn.awk). A task created already done closes with no
+# id, so the count is what says a check is due. Digits and commas only, so
+# both drop straight into the JSON.
+closed=$(grimoire_turn_fact "$facts" closed | tr -cd '0-9')
+closed=${closed:-0}
+task_ids=$(grimoire_turn_fact "$facts" task_ids | tr -cd '0-9,' | sed 's/,,*/,/g; s/^,//; s/,$//')
+[ "$rewrite" = "true" ] && [ "$closed" = "0" ] && exit 0
+
+# Bounded before encoding. The server reads the head and the tail — the part
+# of a report that asks something of the reader is at its end — so a very
+# long reply keeps both.
+if [ "${#reply}" -gt 12000 ]; then
+  reply="${reply:0:4000} … ${reply: -8000}"
+fi
+reply_esc=$(printf '%s' "$reply" | grimoire_json_escape) || exit 0
+closing=""
+if [ "$closed" != "0" ]; then
+  closing=$(printf ',"closed":%d,"closed_task_ids":[%s],"rewrite":%s' "$closed" "$task_ids" "$rewrite")
+fi
+
+query=""
+scope=$(grimoire_scope_query "${event_cwd:-${CLAUDE_PROJECT_DIR:-$PWD}}")
+[ -n "$scope" ] && query="&${scope}"
+rule_seen=$(grimoire_rules_live "$rulefile")
+[ -n "$rule_seen" ] && query="${query}&exclude_rule_ids=${rule_seen}"
+query="${query}$(grimoire_held_query "$state_dir/${safe_sid}.opened.ids")"
+if [ -f "$stopfile" ]; then
+  stopped=$(grep -E '^[0-9]+$' "$stopfile" 2>/dev/null | paste -sd, -)
+  [ -n "$stopped" ] && query="${query}&stopped_rule_ids=${stopped}"
+fi
+query=${query#&}
+
+answer=$(printf '{"reply":"%s"%s}' "$reply_esc" "$closing" | curl -fsS --max-time 6 \
+  -H "Authorization: Bearer ${token}" \
+  -H "Content-Type: application/json" \
+  --data-binary @- \
+  "${url%/}/api/plugin/reply-rules${query:+?$query}" 2>/dev/null) || exit 0
+
+[ "$rewrite" = "true" ] && exit 0
+answer_flat=$(printf '%s' "$answer" | grimoire_json_flat)
+reason=$(grimoire_json_pick "$answer_flat" '.reason')
+[ -n "$reason" ] || exit 0
+[ "$(grimoire_json_pick "$answer_flat" '.report_check')" = "blocked" ] && : > "$reportfile" 2>/dev/null
+
+# Recorded BEFORE the block is emitted, for the act checkpoint's reason: a
+# hold that is shown and not recorded is one that can be shown again.
+for id in $(grimoire_json_list "$answer_flat" '.rule_ids'); do
+  grimoire_checkpoint_allowed "$stopfile" "$id" || true
+done
+grimoire_json_list "$answer_flat" '.rule_ids' | grimoire_rules_append "$rulefile"
+
+printf '{"decision":"block","reason":"%s"}\n' "$(printf '%s' "$reason" | grimoire_json_escape)"
+exit 0