semantic_search_rules searched every rule the user owned, and every hook arm
called it without a project, so each project's rules were injected into every
other project's sessions and a project rule meant nothing a session could feel.
The search now takes a scope: global rules by default (an unbound session, or a
caller that forgets to say), global plus project N when given project_id (N's
rules only if the caller can read that project, through access.can_read_project),
and every owned rule with everywhere=True. The four hook arms and the report
preference lookup pass the session's project; an explicit
search(content_type="rule") scopes to its project_id, or asks the whole rulebook
without one.
Milestone 414 step 1. Guarded by an AST walk that every hook call site passes
project_id, and an integration test on real Postgres that a rule is reached only
from its home.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01821k5B3Ysecp9fNYs92Kuy
The reporting-back skill ships default shapes; an operator's adjustments to
them are preference records. Prompt-time retrieval matches the operator's
message, and a shape preference is about the reply, so those preferences were
on file and never arrived. Operator's decision (logged on #4013): the server
delivers them for a completion report, and the skill asks for every other kind.
- Completion reports (option C): closing a task with update_task runs a
kind-filtered preference search for the moment "writing the completion
report after finishing a task" and returns matches as `reply_preferences`
({id, title, statement, kind}), with a sentence added to `report_back`
naming the key. A preference says it is about completion reports through
its own when_to_apply; no tag or column. Omitted when nothing matches, and
the lookup fails open.
- Telemetry: every call logs to retrieval_logs under `report_preference`
(empty calls included; a search that never ran writes no row) and hits are
recorded surfaced. The source is ranked, so it counts toward pull-through.
The bar is the prompt arm's setting until step 6 reads this source's near
misses.
- Every other reply (option A): reporting-back gains "The operator's own
shapes come first". Before a finding, decision, handoff or "where are we",
search(content_type="rule") in the words of that moment and follow what
comes back. Registered in the ownership guard with reporting-back as owner.
- Loading reply shapes at session start (option B) was rejected: it would be
a small copy of the preloading milestone 394 retired.
Domain-neutral query (pinned); works on an install with no preferences.
Plugin version minted.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>