docs(runbook): correct flywheel (nil→local) + instrumentation-fixed note

Two corrections after the #73 investigation: (1) the router routes cold (nil pass-rate) calls to the LOCAL fast tier, not cloud — the earlier "pay in on cloud" description was wrong (per policy.go). (2) Note that pass-rate logging was broken until v0.11.1 (#73) and is now verified; reset the window to 2026-06-30→07-14. Refs #73, #35. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix(ingestion): migrate mcp-chassis import to git.d-ma.be path (#74 )
2026-06-30 22:16:03 +02:00 · 2026-06-30 21:39:41 +02:00 · 2026-06-30 08:36:18 +02:00 · 2026-06-29 23:41:07 +02:00 · 2026-06-26 14:49:27 +00:00 · 2026-06-26 16:34:15 +02:00
23 changed files with 1268 additions and 127 deletions
@@ -53,7 +53,7 @@ func main() {
 	router := &routing.Router{
 		Fetcher:       routing.NewFetcher(cfg.BrainURL, "7d", time.Duration(cfg.PassRateTTLSeconds)*time.Second),
-		Logger:        routing.NewLogger(cfg.BrainURL),
+		Logger:        routing.NewLogger(cfg.BrainURL, cfg.BrainMCPToken),
 		Policy:        routing.Policy{Floor: cfg.RouteLocalFloor, Ceil: cfg.RouteLocalCeil},
 		FastModel:     cfg.FastModel,
 		ThinkingModel: cfg.ThinkingModel,
@@ -0,0 +1,104 @@
 # Runbook: exercising review/debug traffic to fill the pass-rate dataset
 **Why this exists:** the routing pod's local-vs-cloud decision is gated on a
 pass-rate history that only accrues from real `review`/`debug` invocations
 **through the pod**. Until the dataset has data, the fast (local) path never
 activates and the core hypothesis (hyperguild #35) can't be validated. This
 runbook is how you spin that flywheel.
 ## The one trap
 Pass-rate accrues **only** when a skill tool is called via the routing pod's MCP
 endpoint. These look like they should count but **do not**:
 - **Crush** — talks to LiteLLM directly, bypasses the pod. No log.
 - **claude.ai web / Claude Desktop without the connector** — no log.
 - **Running the local `code-review` / `debug` skills** (`~/dev/.skills`) inline in
  a Claude Code session — those are local skills, not the pod's MCP tools. No log.
 Only a `tools/call` to the routing pod records a pass/fail.
 ## Endpoints
 | Purpose | URL | Auth |
 |---------|-----|------|
 | Routing MCP (local, Tailscale) | `http://koala:30310/mcp` | Bearer `ROUTING_MCP_TOKEN` |
 | Routing MCP (remote) | `https://routing-mcp.d-ma.be/mcp` | OAuth via `auth.d-ma.be` (audience `claude-ai`) |
 | Pass-rate readout | `http://koala:30330/pass-rate?skill=<name>` | none (read-only) |
 Tools advertised: **`review`**, **`debug`** (the two the #35 gate measures),
 plus `session_log`, `retrospective`, `trainer`.
 ## Step 1 — connect the routing pod as an MCP server
 **Local** (needs the bearer token; keep it out of argv via 1Password):
 ```bash
 op run --env-file ~/.op-env -- \
  claude mcp add routing --transport http http://koala:30310/mcp \
    --header "Authorization: Bearer $ROUTING_MCP_TOKEN"
 ```
 **Remote** (claude.ai / Claude Desktop): add a custom connector pointing at
 `https://routing-mcp.d-ma.be/mcp`; it completes OAuth against `auth.d-ma.be`,
 no static token.
 Verify: a `tools/list` should return `review`, `debug`, `session_log`,
 `retrospective`, `trainer`.
 ## Step 2 — route real work through it
 In normal sessions, invoke the pod's tools instead of reviewing/debugging inline:
 - *"Use the **routing** `review` tool on this diff."*
 - *"**debug** this failure through the routing pod."*
 Each call logs an outcome to ingestion → `/pass-rate` ticks up.
 ## Step 3 — how routing actually picks the model
 Per `internal/routing/policy.go`:
 1. pass-rate `nil` (cold) → **local** fast tier. The router defaults to local
   from invocation #1, not to cloud — so the fast tier is exercised immediately.
 2. pass-rate `>= 0.90` (floor) → **local**; `< 0.70` (ceil) → **cloud/thinking**;
   in the `[0.70, 0.90)` band a request-hash bit samples 50/50.
 3. On a local execution error the router falls open to the thinking model for
   that one call (logged `thinking_fallback`).
 So you are not "paying in on cloud" — cold calls already run on the (validated)
 local fast tier **`koala/qwen36-35b-a3b`** (Qwen3.6-35B-A3B MTP, promoted
 2026-06-29, infra `c66a195`, `HYPERGUILD_FAST_MODEL`). Accumulating passes just
 keeps it there once real pass-rate is computed.
 > **Instrumentation note (#73, fixed 2026-06-30):** until v0.11.1 the pod logged
 > successes as `"skip"` (not `"pass"`), under `skill:"_routing"`, via an
 > unauthenticated POST that silently 401'd — so `/pass-rate` stayed at zero no
 > matter how much you used it. That's fixed and verified (a real review call now
 > moves `/pass-rate?skill=review` 0→1). If you see traffic not registering,
 > re-check #73's three failure modes first.
 ## Target & verification
 - **50 logged invocations** across `review` + `debug` within the 14-day window.
  The clock restarts **2026-06-30** (the day instrumentation was verified working;
  the original 2026-06-26→07-10 window measured broken plumbing) → **kill-date
  2026-07-14**, ~4 calls/day (1 already logged from the #73 smoke test).
 - Check progress anytime:
  ```bash
  curl -s "http://koala:30330/pass-rate?skill=review"
  curl -s "http://koala:30330/pass-rate?skill=debug"
  ```
 - If ~4–5/day isn't realistic alongside Crush, that is **not** a failure — per
  #35 deliverable #1 it's the signal hyperguild isn't on the work critical path,
  and the pre-decided **Berget fallback** (`gpt-oss-120b` / `qwen3-32b`) carries
  the fast tier instead.
 ## Refs
 - hyperguild #35 — the validation issue (data gate = deliverable #1)
 - `docs/multi-model-routing.md` — routing policy
 - brain: `wiki/homelab/hypotheses/qwen36-35b-a3b-fast-model-experiment-2026-05-28.md`
 - infra `c66a195` — qwen36 promotion; `models.yml` / `llama-swap-configmap.yaml`
@@ -13,7 +13,7 @@ import (
 	"strings"
 	"time"
-	chassisauth "gitea.d-ma.be/mathias/mcp-chassis/auth"
+	chassisauth "git.d-ma.be/mathias/mcp-chassis/auth"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/audit"
@@ -369,6 +369,8 @@ func main() {
 	mux.HandleFunc("POST /ingest-path", h.IngestPath)
 	mux.HandleFunc("POST /ingest-raw", h.IngestRaw)
 	mux.HandleFunc("POST /backfill-refs", h.BackfillRefs)
 	mux.HandleFunc("GET /pending", h.Pending)
 	mux.HandleFunc("POST /promote", h.Promote)
 	mux.HandleFunc("POST /backfill-embeddings", h.BackfillEmbeddings)
 	mux.HandleFunc("GET /pass-rate", h.PassRate)
 	jwtValidator, err := chassisauth.NewJWTValidator(ctx, os.Getenv("DEX_ISSUER_URL"), os.Getenv("MCP_AUDIENCE"))
@@ -410,13 +412,22 @@ func main() {
 			os.Exit(1)
 		}
 		auditSink := buildAuditSink(ctx, brainDir, logger)
 		// The Gitea client also satisfies SummaryWriter (#66): session
 		// summaries are written to mathias/ai-sessions over the same API
 		// token. nil only if a future tracker impl lacks file writes.
 		summaryWriter, _ := tracker.(capture.SummaryWriter)
 		captureSvc := capture.NewService(
-			mcpSrv.BrainStore(), tracker, nil, classCfg, auditSink)
+			mcpSrv.BrainStore(), tracker, summaryWriter, classCfg, auditSink)
 		sovereign := splitList(os.Getenv("BRAIN_CAPTURE_SOVEREIGN_PRINCIPALS"))
-		captureH := capturehttp.New(captureSvc, jwtValidator, mcpToken, "local-cli",
+		resolver := capturehttp.NewOriginResolver(sovereign)
-			capturehttp.NewOriginResolver(sovereign))
+		captureH := capturehttp.New(captureSvc, jwtValidator, mcpToken, "local-cli", resolver)
 		mux.Handle("POST /capture", captureH)
-		logger.Info("capture endpoint enabled", "sovereign_principals", len(sovereign))
+		// Same use-case behind the MCP `capture` tool (#55 relay) so MCP-native
 		// harnesses (claude.ai, Crush, Pi, LLM Council) reach capture through
 		// the existing /mcp OAuth connector. mcpSrv is already wrapped above;
 		// WithCapture mutates the same instance, so the tool appears live.
 		mcpSrv.WithCapture(captureSvc, jwtValidator, mcpToken, "local-cli", resolver)
 		logger.Info("capture enabled (REST + MCP tool)", "sovereign_principals", len(sovereign))
 	} else {
 		logger.Info("capture endpoint disabled (BRAIN_GITEA_TOKEN unset)")
 	}
@@ -2,19 +2,22 @@ module github.com/mathiasbq/hyperguild/ingestion
 go 1.26.1
 require github.com/stretchr/testify v1.11.1
 require (
-	github.com/lestrrat-go/jwx/v2 v2.1.6
+	github.com/kr/text v0.2.0 // indirect
-	github.com/stretchr/testify v1.11.1
+	github.com/lestrrat-go/jwx/v2 v2.1.6 // indirect
 	github.com/rogpeppe/go-internal v1.15.0 // indirect
 )
 require (
-	gitea.d-ma.be/mathias/mcp-chassis v0.1.0 // indirect
+	git.d-ma.be/mathias/mcp-chassis v0.2.0
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
 	github.com/goccy/go-json v0.10.3 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgx/v5 v5.9.2 // indirect
+	github.com/jackc/pgx/v5 v5.9.2
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.3 // indirect
 	github.com/lestrrat-go/httpcc v1.0.1 // indirect
@@ -27,5 +30,5 @@ require (
 	golang.org/x/sync v0.17.0 // indirect
 	golang.org/x/sys v0.31.0 // indirect
 	golang.org/x/text v0.29.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
+	gopkg.in/yaml.v3 v3.0.1
 )
@@ -1,5 +1,6 @@
-gitea.d-ma.be/mathias/mcp-chassis v0.1.0 h1:8RXO34+n7Vu8HnUMagars6fc4oemqRpMu7MVtjaj4qY=
+git.d-ma.be/mathias/mcp-chassis v0.2.0 h1:6fLmb7xqRa2nNVWsHaUbbfbArgDXJw/gDhb09clBIjo=
-gitea.d-ma.be/mathias/mcp-chassis v0.1.0/go.mod h1:ajbLlwr2L7FAN3TBU39KucZkKJM02wTbKbDKDEW2YvE=
+git.d-ma.be/mathias/mcp-chassis v0.2.0/go.mod h1:Ks7EK2UnGAN0H3rJjKUxUagX8/ZBdtLrOlcUbv0RwH8=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -15,6 +16,10 @@ github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw=
 github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
 github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/lestrrat-go/blackmagic v1.0.3 h1:94HXkVLxkZO9vJI/w2u1T0DAoprShFd13xtnSINtDWs=
 github.com/lestrrat-go/blackmagic v1.0.3/go.mod h1:6AWFyKNNj0zEXQYfTMPfZrAXUWUfTIZ5ECEUEJaijtw=
 github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=
@@ -29,6 +34,8 @@ github.com/lestrrat-go/option v1.0.1 h1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNB
 github.com/lestrrat-go/option v1.0.1/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
 github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys=
 github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -46,9 +53,9 @@ golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
 golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
 golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -483,6 +483,40 @@ func (h *Handler) BackfillRefs(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, map[string]int{"updated": n})
 }
 // Pending handles GET /pending — list raw/ notes awaiting promotion.
 func (h *Handler) Pending(w http.ResponseWriter, _ *http.Request) {
 	pending, err := ListPending(h.brainDir)
 	if err != nil {
 		h.logger.Error("pending failed", "err", err)
 		writeError(w, http.StatusInternalServerError, "pending error")
 		return
 	}
 	writeJSON(w, map[string]any{"pending": pending})
 }
 type promoteRequest struct {
 	Filename string `json:"filename"`
 	Wing     string `json:"wing"`
 	Hall     string `json:"hall"`
 	Slug     string `json:"slug,omitempty"`
 }
 // Promote handles POST /promote — move a raw/ note into the wiki. A bad
 // hall / collision / missing source is a 400 (caller error), not a 500.
 func (h *Handler) Promote(w http.ResponseWriter, r *http.Request) {
 	var req promoteRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		writeError(w, http.StatusBadRequest, "invalid JSON")
 		return
 	}
 	rel, err := PromoteNote(h.brainDir, PromoteOptions(req))
 	if err != nil {
 		writeError(w, http.StatusBadRequest, err.Error())
 		return
 	}
 	writeJSON(w, map[string]string{"path": rel})
 }
 func writeJSON(w http.ResponseWriter, v any) {
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode(v) //nolint:errcheck
@@ -0,0 +1,156 @@
 package api
 import (
 	"fmt"
 	"os"
 	"path/filepath"
 	"regexp"
 	"sort"
 	"strings"
 	"time"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
 )
 // PendingNote describes a raw/ note awaiting human promotion to the wiki.
 type PendingNote struct {
 	Filename  string `json:"filename"`
 	CreatedAt string `json:"created_at"`
 	SizeBytes int64  `json:"size_bytes"`
 	Excerpt   string `json:"excerpt"`
 }
 // datePrefix matches a leading YYYY-MM-DD- on a raw filename, stripped when
 // deriving the default promoted slug.
 var datePrefix = regexp.MustCompile(`^\d{4}-\d{2}-\d{2}-`)
 // ListPending returns the notes in brain/raw/ awaiting review, oldest-first
 // (natural review order). An absent raw/ dir yields an empty slice, not an
 // error. Only .md files are listed; tunnel-candidate files are skipped.
 func ListPending(brainDir string) ([]PendingNote, error) {
 	dir := filepath.Join(brainDir, "raw")
 	entries, err := os.ReadDir(dir)
 	if err != nil {
 		if os.IsNotExist(err) {
 			return []PendingNote{}, nil
 		}
 		return nil, fmt.Errorf("read raw dir: %w", err)
 	}
 	out := make([]PendingNote, 0, len(entries))
 	for _, e := range entries {
 		if e.IsDir() || !strings.HasSuffix(e.Name(), ".md") || strings.HasPrefix(e.Name(), "tunnel-candidates-") {
 			continue
 		}
 		info, statErr := e.Info()
 		if statErr != nil {
 			continue
 		}
 		raw, readErr := os.ReadFile(filepath.Join(dir, e.Name()))
 		if readErr != nil {
 			continue
 		}
 		fm, body := parseFrontmatter(string(raw))
 		created := fm.get("created_at")
 		if created == "" {
 			created = info.ModTime().UTC().Format(time.RFC3339)
 		}
 		out = append(out, PendingNote{
 			Filename:  e.Name(),
 			CreatedAt: created,
 			SizeBytes: info.Size(),
 			Excerpt:   excerpt(body, 200),
 		})
 	}
 	sort.SliceStable(out, func(i, j int) bool { return out[i].CreatedAt < out[j].CreatedAt })
 	return out, nil
 }
 // PromoteOptions identifies a raw note to promote and its wiki destination.
 type PromoteOptions struct {
 	Filename string // basename in brain/raw/
 	Wing     string
 	Hall     string
 	Slug     string // optional; defaults to Filename minus date prefix + .md
 }
 // PromoteNote moves a note from brain/raw/ into the structured wiki: it
 // rewrites frontmatter (sets wing/hall/promoted_at, preserves created_at and
 // any custom fields), writes to brain/wiki/<wing>/<hall>/<slug>.md, deletes
 // the source, then rebuilds the wing index and runs auto-tunnel detection.
 //
 // It is atomic from the caller's view: validation (hall, wing, slug,
 // collision) happens before any filesystem change, and the source is deleted
 // only after the destination write succeeds (write-then-delete, never move).
 // Returns the promoted note's path relative to brainDir.
 func PromoteNote(brainDir string, opts PromoteOptions) (string, error) {
 	// Validate filename (basename only — no traversal) before touching fs.
 	base := filepath.Base(opts.Filename)
 	if base != opts.Filename || base == "." || base == ".." || strings.ContainsAny(opts.Filename, `/\`) {
 		return "", fmt.Errorf("invalid filename %q", opts.Filename)
 	}
 	slug := opts.Slug
 	if slug == "" {
 		slug = datePrefix.ReplaceAllString(strings.TrimSuffix(base, ".md"), "")
 	}
 	// NotePath validates hall + wing + slug; do this before reading anything.
 	dest, err := brain.NotePath(brainDir, opts.Wing, opts.Hall, slug)
 	if err != nil {
 		return "", err
 	}
 	src := filepath.Join(brainDir, "raw", base)
 	raw, err := os.ReadFile(src)
 	if err != nil {
 		if os.IsNotExist(err) {
 			return "", fmt.Errorf("pending note %q does not exist in raw/", base)
 		}
 		return "", fmt.Errorf("read source: %w", err)
 	}
 	// Collision: never silently overwrite an existing promoted note.
 	if _, statErr := os.Stat(dest); statErr == nil {
 		rel, _ := filepath.Rel(brainDir, dest)
 		return "", fmt.Errorf("target %s already exists; choose a different slug", filepath.ToSlash(rel))
 	}
 	fm, body := parseFrontmatter(string(raw))
 	now := time.Now().UTC().Format(time.RFC3339)
 	fm.set("wing", brain.Sanitise(opts.Wing))
 	fm.set("hall", opts.Hall)
 	if fm.get("created_at") == "" {
 		fm.set("created_at", now)
 	}
 	fm.set("promoted_at", now)
 	if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
 		return "", fmt.Errorf("create wing dir: %w", err)
 	}
 	// Write-then-delete: the source survives any write failure.
 	if err := os.WriteFile(dest, []byte(fm.render()+body), 0o644); err != nil {
 		return "", fmt.Errorf("write promoted note: %w", err)
 	}
 	if err := os.Remove(src); err != nil {
 		return "", fmt.Errorf("promoted note written but source removal failed: %w", err)
 	}
 	rel, _ := filepath.Rel(brainDir, dest)
 	relSlash := filepath.ToSlash(rel)
 	// Best-effort wiki upkeep — the note is already promoted.
 	_ = brain.BuildWingIndex(brainDir, opts.Wing)
 	_ = brain.AutoTunnel(brainDir, relSlash, body)
 	return relSlash, nil
 }
 // excerpt returns the first n runes of s, trimmed, single-spaced.
 func excerpt(s string, n int) string {
 	s = strings.TrimSpace(s)
 	r := []rune(s)
 	if len(r) > n {
 		r = r[:n]
 	}
 	return strings.TrimSpace(string(r))
 }
@@ -0,0 +1,121 @@
 package api
 import (
 	"os"
 	"path/filepath"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 func writeRaw(t *testing.T, brainDir, name, content string) {
 	t.Helper()
 	dir := filepath.Join(brainDir, "raw")
 	require.NoError(t, os.MkdirAll(dir, 0o755))
 	require.NoError(t, os.WriteFile(filepath.Join(dir, name), []byte(content), 0o644))
 }
 func TestListPendingEmptyWhenAbsent(t *testing.T) {
 	got, err := ListPending(t.TempDir())
 	require.NoError(t, err, "absent raw/ is not an error")
 	assert.Empty(t, got)
 }
 func TestListPendingReturnsOldestFirstWithExcerpt(t *testing.T) {
 	dir := t.TempDir()
 	writeRaw(t, dir, "2026-06-02-newer.md", "---\ncreated_at: 2026-06-02T00:00:00Z\n---\nNewer body here.\n")
 	writeRaw(t, dir, "2026-06-01-older.md", "---\ncreated_at: 2026-06-01T00:00:00Z\n---\nOlder body content.\n")
 	// non-md ignored
 	writeRaw(t, dir, "notes.txt", "ignore me")
 	got, err := ListPending(dir)
 	require.NoError(t, err)
 	require.Len(t, got, 2)
 	assert.Equal(t, "2026-06-01-older.md", got[0].Filename, "oldest first")
 	assert.Equal(t, "2026-06-02-newer.md", got[1].Filename)
 	assert.Contains(t, got[0].Excerpt, "Older body content")
 	assert.NotContains(t, got[0].Excerpt, "---", "excerpt is body, not frontmatter")
 	assert.Positive(t, got[0].SizeBytes)
 }
 func TestPromoteHappyPath(t *testing.T) {
 	dir := t.TempDir()
 	writeRaw(t, dir, "2026-06-01-lejpa-decision.md",
 		"---\ncreated_at: 2026-06-01T09:00:00Z\ncustom_field: keep-me\n---\n# LeJEPA\n\nbody.\n")
 	rel, err := PromoteNote(dir, PromoteOptions{
 		Filename: "2026-06-01-lejpa-decision.md", Wing: "jepa-fx", Hall: "decisions",
 	})
 	require.NoError(t, err)
 	assert.Equal(t, "wiki/jepa-fx/decisions/lejpa-decision.md", rel, "slug defaults to filename minus date prefix")
 	// Source deleted.
 	_, statErr := os.Stat(filepath.Join(dir, "raw", "2026-06-01-lejpa-decision.md"))
 	assert.True(t, os.IsNotExist(statErr), "source removed after promote")
 	got, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel)))
 	require.NoError(t, err)
 	s := string(got)
 	assert.Contains(t, s, "wing: jepa-fx")
 	assert.Contains(t, s, "hall: decisions")
 	assert.Contains(t, s, "created_at: 2026-06-01T09:00:00Z", "original created_at preserved")
 	assert.Contains(t, s, "promoted_at:")
 	assert.Contains(t, s, "custom_field: keep-me", "custom frontmatter preserved")
 	assert.Contains(t, s, "# LeJEPA")
 }
 func TestPromoteExplicitSlug(t *testing.T) {
 	dir := t.TempDir()
 	writeRaw(t, dir, "2026-06-01-x.md", "body\n")
 	rel, err := PromoteNote(dir, PromoteOptions{Filename: "2026-06-01-x.md", Wing: "a", Hall: "facts", Slug: "custom-slug"})
 	require.NoError(t, err)
 	assert.Equal(t, "wiki/a/facts/custom-slug.md", rel)
 }
 func TestPromoteInvalidHallErrorsBeforeTouchingFS(t *testing.T) {
 	dir := t.TempDir()
 	writeRaw(t, dir, "2026-06-01-x.md", "body\n")
 	_, err := PromoteNote(dir, PromoteOptions{Filename: "2026-06-01-x.md", Wing: "a", Hall: "garbage"})
 	require.Error(t, err)
 	// Source untouched.
 	_, statErr := os.Stat(filepath.Join(dir, "raw", "2026-06-01-x.md"))
 	assert.NoError(t, statErr, "invalid hall must not delete or move the source")
 }
 func TestPromoteMissingSourceErrors(t *testing.T) {
 	_, err := PromoteNote(t.TempDir(), PromoteOptions{Filename: "ghost.md", Wing: "a", Hall: "facts"})
 	require.Error(t, err)
 }
 func TestPromoteSlugCollisionNoOverwrite(t *testing.T) {
 	dir := t.TempDir()
 	// Pre-existing target.
 	dest := filepath.Join(dir, "wiki", "a", "facts", "x.md")
 	require.NoError(t, os.MkdirAll(filepath.Dir(dest), 0o755))
 	require.NoError(t, os.WriteFile(dest, []byte("EXISTING\n"), 0o644))
 	writeRaw(t, dir, "2026-06-01-x.md", "NEW\n")
 	_, err := PromoteNote(dir, PromoteOptions{Filename: "2026-06-01-x.md", Wing: "a", Hall: "facts"})
 	require.Error(t, err, "collision must error, not overwrite")
 	got, _ := os.ReadFile(dest)
 	assert.Equal(t, "EXISTING\n", string(got), "target not overwritten")
 	_, statErr := os.Stat(filepath.Join(dir, "raw", "2026-06-01-x.md"))
 	assert.NoError(t, statErr, "source preserved on collision (atomic: no delete without write)")
 }
 func TestPromoteRejectsTraversalFilename(t *testing.T) {
 	_, err := PromoteNote(t.TempDir(), PromoteOptions{Filename: "../escape.md", Wing: "a", Hall: "facts"})
 	require.Error(t, err)
 }
 func TestPromoteRebuildsWingIndex(t *testing.T) {
 	dir := t.TempDir()
 	writeRaw(t, dir, "2026-06-01-x.md", "---\ntitle: X Note\n---\nbody\n")
 	_, err := PromoteNote(dir, PromoteOptions{Filename: "2026-06-01-x.md", Wing: "a", Hall: "facts"})
 	require.NoError(t, err)
 	idx, err := os.ReadFile(filepath.Join(dir, "wiki", "a", "_index.md"))
 	require.NoError(t, err, "wing _index regenerated")
 	assert.Contains(t, string(idx), "x", "promoted note appears in the index")
 }
@@ -11,6 +11,7 @@ import (
 	"crypto/subtle"
 	"encoding/json"
 	"errors"
 	"io"
 	"net/http"
 	"strings"
@@ -90,19 +91,22 @@ type summaryBody struct {
 // ServeHTTP authenticates, derives origin, runs the use-case, and maps the
 // result to an HTTP status.
 func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	principal, viaStatic, ok := h.authenticate(r)
+	principal, viaStatic, ok := Authenticate(r, h.staticToken, h.staticPrincipal, h.validator)
 	if !ok {
 		http.Error(w, "unauthorized", http.StatusUnauthorized)
 		return
 	}
-	var req request
+	body, err := io.ReadAll(r.Body)
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+	if err != nil {
 		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "read body"})
 		return
 	}
 	in, err := DecodeRequest(body)
 	if err != nil {
 		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid JSON"})
 		return
 	}
 	in := req.toInput()
 	// Principal and origin are server-derived — overwrite anything the
 	// caller may have tried to put in the body.
 	in.Context.Principal = principal
@@ -125,26 +129,39 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, statusFor(rec), rec)
 }
-// authenticate mirrors the chassis Bearer precedence (static wins, then
+// Authenticate mirrors the chassis Bearer precedence (static token wins,
-// JWT) but returns the resolved principal and whether the static path was
+// then Dex JWT) and returns the resolved principal plus whether the static
-// taken — the chassis middleware hides both, and capture needs them to
+// path was taken — the chassis middleware hides both, and capture (REST or
-// derive the origin.
+// MCP) needs them to derive the trust-zone origin. ok is false when no
-func (h *Handler) authenticate(r *http.Request) (principal string, viaStatic, ok bool) {
+// credential matched.
 func Authenticate(r *http.Request, staticToken, staticPrincipal string, validator Validator) (principal string, viaStatic, ok bool) {
 	raw, found := strings.CutPrefix(r.Header.Get("Authorization"), "Bearer ")
 	if !found || raw == "" {
 		return "", false, false
 	}
-	if h.staticToken != "" && subtle.ConstantTimeCompare([]byte(raw), []byte(h.staticToken)) == 1 {
+	if staticToken != "" && subtle.ConstantTimeCompare([]byte(raw), []byte(staticToken)) == 1 {
-		return h.staticPrincipal, true, true
+		return staticPrincipal, true, true
 	}
-	if h.validator != nil {
+	if validator != nil {
-		if sub, err := h.validator.Validate(r.Context(), raw); err == nil && sub != "" {
+		if sub, err := validator.Validate(r.Context(), raw); err == nil && sub != "" {
 			return sub, false, true
 		}
 	}
 	return "", false, false
 }
 // DecodeRequest parses a capture request body into a CaptureInput. Shared
 // by the REST adapter and the MCP capture tool so the wire shape has one
 // definition. Principal and Origin are NOT set here — the caller sets them
 // from the authenticated identity.
 func DecodeRequest(data []byte) (capture.CaptureInput, error) {
 	var b request
 	if err := json.Unmarshal(data, &b); err != nil {
 		return capture.CaptureInput{}, err
 	}
 	return b.toInput(), nil
 }
 func (b request) toInput() capture.CaptureInput {
 	in := capture.CaptureInput{
 		Context: capture.CaptureContext{
@@ -12,6 +12,7 @@ package gitea
 import (
 	"bytes"
 	"context"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -93,37 +94,105 @@ func (c *Client) CloseIssue(ctx context.Context, repo string, number int, commen
 	return capture.IssueRef{Repo: repo, Number: number, URL: out.HTMLURL}, nil
 }
-// do performs a JSON request against the Gitea API and decodes the
+// WriteFile creates or updates a file in repo at path via the Gitea
-// response into out. Errors carry the status and a truncated body for
+// contents API — the SummaryWriter port (#66). It upserts: a GET resolves
-// diagnosis but never the token.
+// the current blob sha (if any) so an existing file is updated rather than
-func (c *Client) do(ctx context.Context, method, path string, payload any, out *issueResponse) error {
+// rejected (the richer-fidelity-supersedes rule for re-captured sessions).
-	reqBody, err := json.Marshal(payload)
+// Owner is the fixed const, like every other call.
-	if err != nil {
+func (c *Client) WriteFile(ctx context.Context, repo, path, content string) error {
-		return fmt.Errorf("marshal request: %w", err)
+	cpath := fmt.Sprintf("/api/v1/repos/%s/%s/contents/%s", owner, repo, path)
-	}
+	sha, err := c.fileSHA(ctx, cpath)
 	req, err := http.NewRequestWithContext(ctx, method, c.baseURL+path, bytes.NewReader(reqBody))
 	if err != nil {
 		return err
 	}
-	req.Header.Set("Content-Type", "application/json")
+	payload := map[string]any{
-	req.Header.Set("Accept", "application/json")
+		"message": "capture: " + path,
-	// Gitea's token scheme. Held here only; never logged.
+		"content": base64.StdEncoding.EncodeToString([]byte(content)),
-	req.Header.Set("Authorization", "token "+c.token)
+	}
-
+	// Gitea contents API: POST creates a new file, PUT updates an existing
-	resp, err := c.http.Do(req)
+	// one (PUT requires the current sha). Pick by whether the file exists.
 	method := http.MethodPost
 	if sha != "" {
 		method = http.MethodPut
 		payload["sha"] = sha
 	}
 	status, body, err := c.request(ctx, method, cpath, payload)
 	if err != nil {
-		return fmt.Errorf("gitea %s %s: %w", method, path, err)
+		return err
 	}
-	defer func() { _ = resp.Body.Close() }()
+	if status < 200 || status >= 300 {
 		return fmt.Errorf("gitea %s %s: status %d: %s", method, cpath, status, strings.TrimSpace(string(body)))
 	}
 	return nil
 }
-	respBody, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
+// fileSHA returns the current blob sha for a contents path, or "" when the
-	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+// file does not exist (404). Any other non-2xx is an error.
-		return fmt.Errorf("gitea %s %s: status %d: %s", method, path, resp.StatusCode, strings.TrimSpace(string(respBody)))
+func (c *Client) fileSHA(ctx context.Context, cpath string) (string, error) {
 	status, body, err := c.request(ctx, http.MethodGet, cpath, nil)
 	if err != nil {
 		return "", err
 	}
-	if out != nil && len(respBody) > 0 {
+	if status == http.StatusNotFound {
-		if err := json.Unmarshal(respBody, out); err != nil {
+		return "", nil
 	}
 	if status < 200 || status >= 300 {
 		return "", fmt.Errorf("gitea GET %s: status %d: %s", cpath, status, strings.TrimSpace(string(body)))
 	}
 	var meta struct {
 		SHA string `json:"sha"`
 	}
 	if err := json.Unmarshal(body, &meta); err != nil {
 		return "", fmt.Errorf("gitea GET %s: decode: %w", cpath, err)
 	}
 	return meta.SHA, nil
 }
 // do performs a JSON request against the Gitea API and decodes a 2xx
 // response into out. Errors carry the status and a truncated body for
 // diagnosis but never the token.
 func (c *Client) do(ctx context.Context, method, path string, payload any, out *issueResponse) error {
 	status, body, err := c.request(ctx, method, path, payload)
 	if err != nil {
 		return err
 	}
 	if status < 200 || status >= 300 {
 		return fmt.Errorf("gitea %s %s: status %d: %s", method, path, status, strings.TrimSpace(string(body)))
 	}
 	if out != nil && len(body) > 0 {
 		if err := json.Unmarshal(body, out); err != nil {
 			return fmt.Errorf("gitea %s %s: decode response: %w", method, path, err)
 		}
 	}
 	return nil
 }
 // request is the shared HTTP path: marshals an optional JSON payload,
 // attaches auth (token only ever in the header), and returns the status +
 // body so callers can branch on status (e.g. 404) without it being an
 // error. Never logs the token.
 func (c *Client) request(ctx context.Context, method, path string, payload any) (int, []byte, error) {
 	var reader io.Reader
 	if payload != nil {
 		reqBody, err := json.Marshal(payload)
 		if err != nil {
 			return 0, nil, fmt.Errorf("marshal request: %w", err)
 		}
 		reader = bytes.NewReader(reqBody)
 	}
 	req, err := http.NewRequestWithContext(ctx, method, c.baseURL+path, reader)
 	if err != nil {
 		return 0, nil, err
 	}
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set("Accept", "application/json")
 	req.Header.Set("Authorization", "token "+c.token)
 	resp, err := c.http.Do(req)
 	if err != nil {
 		return 0, nil, fmt.Errorf("gitea %s %s: %w", method, path, err)
 	}
 	defer func() { _ = resp.Body.Close() }()
 	body, _ := io.ReadAll(io.LimitReader(resp.Body, 8192))
 	return resp.StatusCode, body, nil
 }
@@ -115,3 +115,69 @@ func TestErrorPathDoesNotLeakToken(t *testing.T) {
 	assert.NotContains(t, err.Error(), testToken, "token must never appear in an error message")
 	assert.Contains(t, err.Error(), "500")
 }
 func TestWriteFileCreatesNewFile(t *testing.T) {
 	var getPath, postPath, postBody string
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.Method {
 		case http.MethodGet:
 			getPath = r.URL.Path
 			w.WriteHeader(http.StatusNotFound) // file does not exist yet
 		case http.MethodPost: // gitea contents API: POST = create
 			postPath = r.URL.Path
 			b, _ := io.ReadAll(r.Body)
 			postBody = string(b)
 			w.WriteHeader(http.StatusCreated)
 			_ = json.NewEncoder(w).Encode(map[string]any{"content": map[string]any{"html_url": "https://git/x"}})
 		default:
 			t.Errorf("create must POST, got %s", r.Method)
 		}
 	}))
 	defer srv.Close()
 	err := gitea.New(srv.URL, testToken).WriteFile(context.Background(),
 		"ai-sessions", "summaries/claude-code/2026-06/2026-06-23-x-abcd1234.md", "# Summary\n\nbody\n")
 	require.NoError(t, err)
 	assert.Equal(t, "/api/v1/repos/mathias/ai-sessions/contents/summaries/claude-code/2026-06/2026-06-23-x-abcd1234.md", getPath)
 	assert.Equal(t, getPath, postPath)
 	// base64 of the content, no sha on create.
 	assert.Contains(t, postBody, "IyBTdW1tYXJ5") // base64("# Summary")
 	assert.NotContains(t, postBody, `"sha"`)
 }
 func TestWriteFileUpdatesExisting(t *testing.T) {
 	var putBody string
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.Method {
 		case http.MethodGet:
 			w.WriteHeader(http.StatusOK)
 			_ = json.NewEncoder(w).Encode(map[string]any{"sha": "deadbeef"})
 		case http.MethodPut:
 			b, _ := io.ReadAll(r.Body)
 			putBody = string(b)
 			w.WriteHeader(http.StatusOK)
 			_ = json.NewEncoder(w).Encode(map[string]any{"content": map[string]any{"html_url": "https://git/x"}})
 		}
 	}))
 	defer srv.Close()
 	err := gitea.New(srv.URL, testToken).WriteFile(context.Background(), "ai-sessions", "p/x.md", "new")
 	require.NoError(t, err)
 	assert.Contains(t, putBody, `"sha":"deadbeef"`, "existing file → update with sha")
 }
 func TestWriteFileErrorNoTokenLeak(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method == http.MethodGet {
 			w.WriteHeader(http.StatusNotFound)
 			return
 		}
 		w.WriteHeader(http.StatusUnprocessableEntity)
 		_, _ = w.Write([]byte("bad"))
 	}))
 	defer srv.Close()
 	err := gitea.New(srv.URL, testToken).WriteFile(context.Background(), "ai-sessions", "p/x.md", "x")
 	require.Error(t, err)
 	assert.NotContains(t, err.Error(), testToken)
 	assert.Contains(t, err.Error(), "422")
 }
@@ -9,6 +9,7 @@ import (
 	"strings"
 	"time"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/extract"
@@ -38,7 +39,7 @@ func (s *Server) tools() []map[string]any {
 		return b
 	}
-	return []map[string]any{
+	tools := []map[string]any{
 		{
 			"name":        "brain_query",
 			"description": "BM25 full-text search across brain/knowledge/ and brain/wiki/ markdown files. Optionally scope by wing (topic domain) and hall (memory type).",
@@ -81,6 +82,21 @@ func (s *Server) tools() []map[string]any {
 				"path": str("brain-relative path to the note; equivalent to id"),
 			}),
 		},
 		{
 			"name":        "brain_pending",
 			"description": "List notes in brain/raw/ awaiting human promotion to the wiki, oldest-first. Returns filename, created_at, size_bytes, excerpt. The human-review queue complement to brain_promote.",
 			"inputSchema": schema([]string{}, map[string]any{}),
 		},
 		{
 			"name":        "brain_promote",
 			"description": "Promote a brain/raw/ note into brain/wiki/<wing>/<hall>/: rewrites frontmatter (sets wing/hall/promoted_at, preserves created_at + custom fields), deletes the source, rebuilds the wing index, runs auto-tunnel. Errors (without touching the fs) on invalid hall or a slug collision. Returns {path}.",
 			"inputSchema": schema([]string{"filename", "wing", "hall"}, map[string]any{
 				"filename": str("basename in brain/raw/, e.g. 2026-06-01-lejpa-decision.md"),
 				"wing":     str("target wing, e.g. jepa-fx"),
 				"hall":     enum("target hall", halls...),
 				"slug":     str("optional target slug; defaults to filename minus date prefix"),
 			}),
 		},
 		{
 			"name":        "brain_tunnel",
 			"description": "Create an explicit bidirectional [[wikilink]] between two notes in different wings. Idempotent.",
@@ -171,6 +187,13 @@ func (s *Server) tools() []map[string]any {
 			}),
 		},
 	}
 	// The capture relay tool (#55) is advertised only when wired via
 	// WithCapture — MCP-native harnesses (claude.ai, Crush, Pi, LLM Council)
 	// reach capture through it.
 	if s.capture != nil {
 		tools = append(tools, captureToolDescriptor())
 	}
 	return tools
 }
 type brainQueryArgs struct {
@@ -314,6 +337,40 @@ func (s *Server) brainGet(ctx context.Context, args json.RawMessage) (json.RawMe
 	})
 }
 // brainPending lists the raw/ review queue (oldest-first).
 func (s *Server) brainPending(_ context.Context, _ json.RawMessage) (json.RawMessage, error) {
 	pending, err := api.ListPending(s.brainDir)
 	if err != nil {
 		return nil, err
 	}
 	return json.Marshal(map[string]any{"pending": pending})
 }
 type brainPromoteArgs struct {
 	Filename string `json:"filename"`
 	Wing     string `json:"wing"`
 	Hall     string `json:"hall"`
 	Slug     string `json:"slug,omitempty"`
 }
 // brainPromote moves a raw/ note into the structured wiki (frontmatter
 // rewrite + index + auto-tunnel, all owned by api.PromoteNote) and then
 // re-indexes it into the graph. The human-facing complement to brain_write.
 func (s *Server) brainPromote(ctx context.Context, args json.RawMessage) (json.RawMessage, error) {
 	var a brainPromoteArgs
 	if err := json.Unmarshal(args, &a); err != nil {
 		return nil, fmt.Errorf("parse args: %w", err)
 	}
 	relPath, err := api.PromoteNote(s.brainDir, api.PromoteOptions{
 		Filename: a.Filename, Wing: a.Wing, Hall: a.Hall, Slug: a.Slug,
 	})
 	if err != nil {
 		return nil, err
 	}
 	s.indexInGraph(ctx, "brain_promote", relPath)
 	return json.Marshal(map[string]string{"path": relPath})
 }
 // indexInGraph is a best-effort wrapper around graphsync.IndexDoc that
 // logs failures but never propagates them — the underlying write/ingest
 // has already succeeded and the graph is an augmentation, not a
@@ -332,3 +332,61 @@ func TestSessionLogRequiresSessionID(t *testing.T) {
 	resp := toolCall(t, srv, "session_log", map[string]any{"skill": "tdd"})
 	require.NotNil(t, resp["error"])
 }
 func TestBrainPendingListsRaw(t *testing.T) {
 	brainDir := t.TempDir()
 	raw := filepath.Join(brainDir, "raw")
 	require.NoError(t, os.MkdirAll(raw, 0o755))
 	require.NoError(t, os.WriteFile(filepath.Join(raw, "2026-06-01-x.md"),
 		[]byte("---\ncreated_at: 2026-06-01T00:00:00Z\n---\npending body\n"), 0o644))
 	srv := mcp.NewServer(brainDir, nil, nil, nil)
 	resp := toolCall(t, srv, "brain_pending", map[string]any{})
 	require.Nil(t, resp["error"])
 	text := resp["result"].(map[string]any)["content"].([]any)[0].(map[string]any)["text"].(string)
 	assert.Contains(t, text, "2026-06-01-x.md")
 	assert.Contains(t, text, "pending body")
 }
 func TestBrainPendingEmpty(t *testing.T) {
 	srv := mcp.NewServer(t.TempDir(), nil, nil, nil)
 	resp := toolCall(t, srv, "brain_pending", map[string]any{})
 	require.Nil(t, resp["error"])
 	text := resp["result"].(map[string]any)["content"].([]any)[0].(map[string]any)["text"].(string)
 	assert.Contains(t, text, `"pending":[]`)
 }
 func TestBrainPromoteMovesToWiki(t *testing.T) {
 	brainDir := t.TempDir()
 	raw := filepath.Join(brainDir, "raw")
 	require.NoError(t, os.MkdirAll(raw, 0o755))
 	require.NoError(t, os.WriteFile(filepath.Join(raw, "2026-06-01-decision.md"),
 		[]byte("---\ncreated_at: 2026-06-01T00:00:00Z\n---\n# D\n\nbody\n"), 0o644))
 	srv := mcp.NewServer(brainDir, nil, nil, nil)
 	resp := toolCall(t, srv, "brain_promote", map[string]any{
 		"filename": "2026-06-01-decision.md", "wing": "jepa-fx", "hall": "decisions",
 	})
 	require.Nil(t, resp["error"], "got: %v", resp["error"])
 	text := resp["result"].(map[string]any)["content"].([]any)[0].(map[string]any)["text"].(string)
 	assert.Contains(t, text, "wiki/jepa-fx/decisions/decision.md")
 	_, err := os.Stat(filepath.Join(brainDir, "wiki/jepa-fx/decisions/decision.md"))
 	require.NoError(t, err)
 	_, srcErr := os.Stat(filepath.Join(raw, "2026-06-01-decision.md"))
 	assert.True(t, os.IsNotExist(srcErr), "source removed")
 }
 func TestBrainPromoteInvalidHallErrors(t *testing.T) {
 	brainDir := t.TempDir()
 	raw := filepath.Join(brainDir, "raw")
 	require.NoError(t, os.MkdirAll(raw, 0o755))
 	require.NoError(t, os.WriteFile(filepath.Join(raw, "x.md"), []byte("body\n"), 0o644))
 	srv := mcp.NewServer(brainDir, nil, nil, nil)
 	resp := toolCall(t, srv, "brain_promote", map[string]any{
 		"filename": "x.md", "wing": "a", "hall": "garbage",
 	})
 	require.NotNil(t, resp["error"])
 	_, srcErr := os.Stat(filepath.Join(raw, "x.md"))
 	assert.NoError(t, srcErr, "source untouched on validation error")
 }
@@ -1,7 +1,9 @@
 // Package mcp implements an MCP HTTP handler for the ingestion service.
 // Exposed tools: brain_query, brain_write, brain_update, brain_get,
-// brain_index, brain_tunnel, brain_ingest, brain_ingest_raw,
+// brain_pending, brain_promote, brain_index, brain_tunnel, brain_ingest,
-// brain_answer, brain_classify, brain_graph, brain_context, session_log.
+// brain_ingest_raw, brain_answer, brain_classify, brain_graph,
 // brain_context, session_log, and capture (the #55 relay tool, registered
 // only when WithCapture is set).
 package mcp
 import (
@@ -12,6 +14,7 @@ import (
 	"github.com/mathiasbq/hyperguild/ingestion/internal/brainstore"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capturehttp"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/graphstore"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/graphsync"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
@@ -50,6 +53,19 @@ type Server struct {
 	graph     graphsync.Store       // nil = brain_graph and GraphRAG augmentation disabled
 	store     *brainstore.Store     // shared brain write/update/get impl (also used by capture)
 	tracker   capture.IssueTracker  // nil = no Gitea ticket integration; wired for capture (#53)
 	capture   *captureDeps          // nil = capture MCP tool disabled (#55 relay)
 }
 // captureDeps holds what the MCP `capture` tool (the #55 relay door for
 // MCP-native harnesses like claude.ai) needs: the use-case, the auth bits
 // to re-derive the caller's principal from the Bearer header (the chassis
 // middleware gates but discards the principal), and the origin resolver.
 type captureDeps struct {
 	svc             *capture.Service
 	validator       capturehttp.Validator
 	staticToken     string
 	staticPrincipal string
 	resolver        capturehttp.OriginResolver
 }
 // NewServer constructs a Server bound to brainDir. pipelineCfg supplies the
@@ -123,6 +139,29 @@ func (s *Server) BrainStore() *brainstore.Store {
 	return s.store
 }
 // WithCapture enables the MCP `capture` tool (#55) — the relay door for
 // MCP-native harnesses (claude.ai, Crush, Pi, LLM Council) that cannot run
 // the use-case in-process. It forwards to the same CaptureService as
 // POST /capture, deriving the caller's principal + origin from the same
 // auth credentials that gate /mcp. nil svc leaves the tool unregistered.
 func (s *Server) WithCapture(svc *capture.Service, validator capturehttp.Validator, staticToken, staticPrincipal string, resolver capturehttp.OriginResolver) *Server {
 	if svc == nil {
 		s.capture = nil
 		return s
 	}
 	if staticPrincipal == "" {
 		staticPrincipal = "local-cli"
 	}
 	s.capture = &captureDeps{
 		svc:             svc,
 		validator:       validator,
 		staticToken:     staticToken,
 		staticPrincipal: staticPrincipal,
 		resolver:        resolver,
 	}
 	return s
 }
 func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	// MCP streamable HTTP: GET establishes the SSE stream for server-to-client events.
 	if r.Method == http.MethodGet {
@@ -172,7 +211,18 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			rpcErr = &rpcError{Code: -32602, Message: "invalid params"}
 			break
 		}
-		out, err := s.handleCall(r.Context(), p.Name, p.Arguments)
+		// Re-derive the authenticated principal from the Bearer header so
 		// the capture tool can compute the trust-zone origin. The request
 		// is already gated by BearerMiddleware; this only recovers the
 		// identity that middleware discards.
 		ctx := r.Context()
 		if s.capture != nil {
 			if principal, viaStatic, ok := capturehttp.Authenticate(
 				r, s.capture.staticToken, s.capture.staticPrincipal, s.capture.validator); ok {
 				ctx = withPrincipal(ctx, principal, viaStatic)
 			}
 		}
 		out, err := s.handleCall(ctx, p.Name, p.Arguments)
 		if err != nil {
 			rpcErr = &rpcError{Code: -32000, Message: err.Error()}
 			break
@@ -214,6 +264,12 @@ func (s *Server) handleCall(ctx context.Context, name string, args json.RawMessa
 		return s.brainUpdate(ctx, args)
 	case "brain_get":
 		return s.brainGet(ctx, args)
 	case "brain_pending":
 		return s.brainPending(ctx, args)
 	case "brain_promote":
 		return s.brainPromote(ctx, args)
 	case "capture":
 		return s.brainCapture(ctx, args)
 	case "brain_index":
 		return s.brainIndex(ctx, args)
 	case "brain_tunnel":
@@ -58,6 +58,7 @@ func TestServerToolsList(t *testing.T) {
 	}
 	assert.ElementsMatch(t, []string{
 		"brain_query", "brain_write", "brain_update", "brain_get",
 		"brain_pending", "brain_promote",
 		"brain_index", "brain_tunnel",
 		"brain_ingest_raw", "brain_ingest",
 		"brain_answer", "brain_classify", "brain_graph", "brain_context",
@@ -0,0 +1,105 @@
 package mcp
 import (
 	"context"
 	"encoding/json"
 	"fmt"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capturehttp"
 )
 // principalKey is the context key under which the authenticated principal
 // (re-derived in ServeHTTP) is stashed for the capture tool.
 type principalKeyT struct{}
 var principalKey principalKeyT
 type principalInfo struct {
 	principal string
 	viaStatic bool
 }
 func withPrincipal(ctx context.Context, principal string, viaStatic bool) context.Context {
 	return context.WithValue(ctx, principalKey, principalInfo{principal: principal, viaStatic: viaStatic})
 }
 // captureToolDescriptor is the tools/list entry for the capture relay.
 // Appended only when WithCapture has wired the tool.
 func captureToolDescriptor() map[string]any {
 	str := func(d string) map[string]any { return map[string]any{"type": "string", "description": d} }
 	insightItem := map[string]any{
 		"type": "object",
 		"properties": map[string]any{
 			"text": str("the insight body"), "wing": str("brain wing"),
 			"hall": str("brain hall (facts/decisions/failures/hypotheses/sources)"),
 			"supersede_slug": str("optional: slug of a prior note to revise in place instead of creating"),
 		},
 		"required": []string{"text", "wing", "hall"},
 	}
 	ticketItem := map[string]any{
 		"type": "object",
 		"properties": map[string]any{
 			"repo": str("gitea repo (owner is always mathias)"), "action": str("create|close|comment"),
 			"number": map[string]any{"type": "integer", "description": "issue number (close/comment)"},
 			"title": str("issue title (create)"), "body": str("issue/comment body"),
 		},
 		"required": []string{"repo", "action"},
 	}
 	schema := map[string]any{
 		"type": "object",
 		"properties": map[string]any{
 			"context": map[string]any{
 				"type": "object",
 				"properties": map[string]any{
 					"harness": str("descriptive harness label (telemetry only, never a gate input)"),
 					"session_ref": str("optional session reference"), "fidelity": str("live-capture|transcript-parse|agent-runlog"),
 					"actor": str("acting user/agent"), "classification": str("caller-declared sensitivity: public|internal|confidential"),
 				},
 			},
 			"insights": map[string]any{"type": "array", "items": insightItem},
 			"tickets":  map[string]any{"type": "array", "items": ticketItem},
 			"summary": map[string]any{"type": "object", "properties": map[string]any{
 				"title": str("summary title"), "body": str("summary body"),
 				"repos_touched": map[string]any{"type": "array", "items": map[string]any{"type": "string"}},
 			}},
 			"dry_run": map[string]any{"type": "boolean", "description": "validate + return the would-be receipt, write nothing"},
 		},
 	}
 	b, _ := json.Marshal(schema)
 	return map[string]any{
 		"name":        "capture",
 		"description": "Persist a session's value uniformly: insights → brain (write or supersede), action items → Gitea tickets, optional summary → ai-sessions. The relay door for MCP-native harnesses. Origin is server-derived from your authenticated identity; confidential captures through a us-nexus surface are refused (I1). Returns a partial-aware receipt.",
 		"inputSchema": json.RawMessage(b),
 	}
 }
 // brainCapture is the MCP capture tool: the #55 relay for MCP-native
 // harnesses. It re-uses the same CaptureService, principal-derivation, and
 // origin resolver as POST /capture — only the transport differs. It holds
 // no state and retains nothing beyond the I5 audit record.
 func (s *Server) brainCapture(ctx context.Context, args json.RawMessage) (json.RawMessage, error) {
 	if s.capture == nil {
 		return nil, fmt.Errorf("capture tool not configured")
 	}
 	info, ok := ctx.Value(principalKey).(principalInfo)
 	if !ok || info.principal == "" {
 		// No authenticated principal ⇒ cannot derive origin ⇒ cannot gate.
 		return nil, fmt.Errorf("capture requires an authenticated principal")
 	}
 	in, err := capturehttp.DecodeRequest(args)
 	if err != nil {
 		return nil, fmt.Errorf("invalid capture request: %w", err)
 	}
 	// Principal and origin are server-derived — never taken from the body.
 	in.Context.Principal = info.principal
 	in.Context.Origin = s.capture.resolver.Resolve(info.principal, info.viaStatic)
 	rec, err := s.capture.svc.Capture(ctx, in)
 	if err != nil {
 		// Surface I1/I5 refusals and validation failures verbatim; errors.Is
 		// markers (ErrSovereigntyRefused / ErrAuditUnavailable) ride in the message.
 		return nil, err
 	}
 	return json.Marshal(rec)
 }
@@ -0,0 +1,150 @@
 package mcp_test
 import (
 	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"testing"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/audit"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/brainstore"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capturehttp"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/classification"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/mcp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 const capStaticTok = "cap-static-tok"
 type capFakeTracker struct{}
 func (capFakeTracker) CreateIssue(context.Context, string, string, string) (capture.IssueRef, error) {
 	return capture.IssueRef{Repo: "hyperguild", Number: 1, URL: "https://git/1"}, nil
 }
 func (capFakeTracker) CloseIssue(context.Context, string, int, string) (capture.IssueRef, error) {
 	return capture.IssueRef{}, nil
 }
 func (capFakeTracker) CommentIssue(context.Context, string, int, string) (capture.IssueRef, error) {
 	return capture.IssueRef{}, nil
 }
 type capFakeValidator struct {
 	subject string
 	err     error
 }
 func (v capFakeValidator) Validate(context.Context, string) (string, error) {
 	return v.subject, v.err
 }
 func captureServer(t *testing.T, validator capturehttp.Validator, sovereign []string) (*mcp.Server, string) {
 	t.Helper()
 	brainDir := t.TempDir()
 	cfg, err := classification.Load(brainDir)
 	require.NoError(t, err)
 	svc := capture.NewService(brainstore.New(brainDir), capFakeTracker{}, nil, cfg, audit.NewSlogSink(nil))
 	srv := mcp.NewServer(brainDir, nil, nil, nil)
 	srv.WithCapture(svc, validator, capStaticTok, "local-cli", capturehttp.NewOriginResolver(sovereign))
 	return srv, brainDir
 }
 func captureCall(t *testing.T, srv http.Handler, authz string, args map[string]any) map[string]any {
 	t.Helper()
 	body, _ := json.Marshal(map[string]any{
 		"jsonrpc": "2.0", "id": 1, "method": "tools/call",
 		"params": map[string]any{"name": "capture", "arguments": args},
 	})
 	req := httptest.NewRequest(http.MethodPost, "/mcp", bytes.NewReader(body))
 	if authz != "" {
 		req.Header.Set("Authorization", authz)
 	}
 	rr := httptest.NewRecorder()
 	srv.ServeHTTP(rr, req)
 	var resp map[string]any
 	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &resp))
 	return resp
 }
 func TestCaptureToolListedWhenWired(t *testing.T) {
 	srv, _ := captureServer(t, nil, nil)
 	body, _ := json.Marshal(map[string]any{"jsonrpc": "2.0", "id": 1, "method": "tools/list"})
 	req := httptest.NewRequest(http.MethodPost, "/mcp", bytes.NewReader(body))
 	rr := httptest.NewRecorder()
 	srv.ServeHTTP(rr, req)
 	assert.Contains(t, rr.Body.String(), `"capture"`)
 }
 func TestCaptureToolNotListedByDefault(t *testing.T) {
 	srv := mcp.NewServer(t.TempDir(), nil, nil, nil) // no WithCapture
 	body, _ := json.Marshal(map[string]any{"jsonrpc": "2.0", "id": 1, "method": "tools/list"})
 	req := httptest.NewRequest(http.MethodPost, "/mcp", bytes.NewReader(body))
 	rr := httptest.NewRecorder()
 	srv.ServeHTTP(rr, req)
 	assert.NotContains(t, rr.Body.String(), `"capture"`)
 }
 func TestCaptureToolForwardsViaStaticPrincipal(t *testing.T) {
 	srv, brainDir := captureServer(t, nil, nil)
 	resp := captureCall(t, srv, "Bearer "+capStaticTok, map[string]any{
 		"context":  map[string]any{"harness": "claude-code", "actor": "mathias", "classification": "internal"},
 		"insights": []map[string]any{{"text": "a fact", "wing": "hyperguild", "hall": "facts"}},
 		"tickets":  []map[string]any{{"repo": "hyperguild", "action": "create", "title": "t"}},
 	})
 	require.Nil(t, resp["error"], "got error: %v", resp["error"])
 	text := resp["result"].(map[string]any)["content"].([]any)[0].(map[string]any)["text"].(string)
 	var rec capture.CaptureReceipt
 	require.NoError(t, json.Unmarshal([]byte(text), &rec))
 	assert.True(t, rec.Insights[0].OK)
 	assert.True(t, rec.Tickets[0].OK)
 	// Forwarded to the real brain store.
 	_, statErr := os.Stat(filepath.Join(brainDir, "wiki/hyperguild/facts"))
 	require.NoError(t, statErr)
 }
 func TestCaptureToolRefusesConfidentialViaUSNexus(t *testing.T) {
 	// JWT principal not in the sovereign allowlist ⇒ us-nexus origin.
 	srv, _ := captureServer(t, capFakeValidator{subject: "claudeai-oauth"}, nil)
 	resp := captureCall(t, srv, "Bearer jwt-token", map[string]any{
 		"context":  map[string]any{"harness": "claudeai-chat", "actor": "mathias", "classification": "confidential"},
 		"insights": []map[string]any{{"text": "secret", "wing": "client-seb", "hall": "facts"}},
 	})
 	require.NotNil(t, resp["error"])
 	assert.Contains(t, resp["error"].(map[string]any)["message"].(string), "sovereignty")
 }
 func TestCaptureToolAllowsConfidentialViaSovereignJWT(t *testing.T) {
 	srv, _ := captureServer(t, capFakeValidator{subject: "koala-cli"}, []string{"koala-cli"})
 	resp := captureCall(t, srv, "Bearer jwt-token", map[string]any{
 		"context":  map[string]any{"harness": "claude-code", "actor": "mathias", "classification": "confidential"},
 		"insights": []map[string]any{{"text": "secret", "wing": "client-seb", "hall": "facts"}},
 	})
 	assert.Nil(t, resp["error"], "sovereign JWT principal should be allowed: %v", resp["error"])
 }
 func TestCaptureToolRejectsUnauthenticated(t *testing.T) {
 	srv, _ := captureServer(t, capFakeValidator{err: errors.New("no jwt")}, nil)
 	resp := captureCall(t, srv, "", map[string]any{ // no Authorization
 		"context":  map[string]any{"harness": "x", "classification": "internal"},
 		"insights": []map[string]any{{"text": "a", "wing": "hyperguild", "hall": "facts"}},
 	})
 	require.NotNil(t, resp["error"])
 	assert.Contains(t, resp["error"].(map[string]any)["message"].(string), "authenticated principal")
 }
 func TestCaptureToolCallerCannotForgeOrigin(t *testing.T) {
 	// Body asserts sovereign harness, but the us-nexus JWT principal governs.
 	srv, _ := captureServer(t, capFakeValidator{subject: "claudeai-oauth"}, nil)
 	resp := captureCall(t, srv, "Bearer jwt", map[string]any{
 		"context":  map[string]any{"harness": "sovereign-soil", "classification": "confidential"},
 		"insights": []map[string]any{{"text": "secret", "wing": "client-seb", "hall": "facts"}},
 	})
 	require.NotNil(t, resp["error"])
 	assert.Contains(t, resp["error"].(map[string]any)["message"].(string), "sovereignty")
 }
@@ -14,6 +14,7 @@ type RoutingConfig struct {
 	LiteLLMBaseURL     string  // LITELLM_BASE_URL, default https://llm-api.d-ma.be
 	LiteLLMAPIKey      string  // LITELLM_API_KEY
 	BrainURL           string  // BRAIN_URL, default http://ingestion.supervisor:3300
 	BrainMCPToken      string  // BRAIN_MCP_TOKEN, bearer for the auth-gated ingestion /mcp (session_log)
 	FastModel          string  // HYPERGUILD_FAST_MODEL, default koala/qwen35-9b-fast
 	ThinkingModel      string  // HYPERGUILD_THINKING_MODEL, default iguana/gemma4-26b
 	// RouteLocalFloor and RouteLocalCeil intentionally invert the usual
@@ -44,6 +45,7 @@ func LoadRouting() (RoutingConfig, error) {
 		LiteLLMBaseURL: envOr("LITELLM_BASE_URL", "https://llm-api.d-ma.be"),
 		LiteLLMAPIKey:  os.Getenv("LITELLM_API_KEY"),
 		BrainURL:       envOr("BRAIN_URL", "http://ingestion.supervisor:3300"),
 		BrainMCPToken:  os.Getenv("BRAIN_MCP_TOKEN"),
 		FastModel:      envOr("HYPERGUILD_FAST_MODEL", "koala/qwen35-9b-fast"),
 		ThinkingModel:  envOr("HYPERGUILD_THINKING_MODEL", "iguana/gemma4-26b"),
 	}
@@ -17,19 +17,24 @@ type LogEntry struct {
 	Message     string // free-form, e.g. "model=qwen35, pass_rate=0.94"
 	ProjectRoot string
 	DurationMs  int64
-	Failed      bool // true → final_status: "fail"; false → "skip"
+	Failed      bool // true → final_status: "fail"; false → "pass"
 }
 // Logger posts session_log entries to a brain MCP at BrainURL + /mcp.
 type Logger struct {
 	BrainURL string
 	Token    string // bearer for the (auth-gated) ingestion /mcp; empty = no header
 	HTTP     *http.Client
 }
-// NewLogger creates a Logger with a 2-second HTTP timeout.
+// NewLogger creates a Logger with a 2-second HTTP timeout. token authenticates
-func NewLogger(brainURL string) *Logger {
+// to the bearer-gated ingestion /mcp; an empty token sends no Authorization
 // header (and silently 401s against a gated server — see brain
 // mcpclient-empty-token-silent-401-envfrom-missing-key).
 func NewLogger(brainURL, token string) *Logger {
 	return &Logger{
 		BrainURL: brainURL,
 		Token:    token,
 		HTTP:     &http.Client{Timeout: 2 * time.Second},
 	}
 }
@@ -37,7 +42,10 @@ func NewLogger(brainURL string) *Logger {
 // LogDecision posts a session_log MCP call. Errors are returned but the caller
 // MUST NOT block real work on them — logging is best-effort.
 func (l *Logger) LogDecision(ctx context.Context, e LogEntry) error {
-	status := "skip"
+	// A completed routed call is a pass (liveness); only an execution error is a
 	// fail. There is no "skip" for routing — the prior default-to-"skip" meant a
 	// successful call never counted toward pass_rate, so the gate was unreachable.
 	status := "pass"
 	if e.Failed {
 		status = "fail"
 	}
@@ -49,7 +57,9 @@ func (l *Logger) LogDecision(ctx context.Context, e LogEntry) error {
 			"name": "session_log",
 			"arguments": map[string]any{
 				"session_id": e.SessionID,
-				"skill":        "_routing",
+				// The real skill, so /pass-rate?skill=review|debug sees these
 				// records; routing decisions stay groupable via session_id "_routing".
 				"skill":        e.Skill,
 				"phase":        "decide",
 				"final_status": status,
 				"message":      fmt.Sprintf("%s: %s — %s", e.Skill, e.Decision, e.Message),
@@ -67,6 +77,9 @@ func (l *Logger) LogDecision(ctx context.Context, e LogEntry) error {
 		return fmt.Errorf("log: build request: %w", err)
 	}
 	req.Header.Set("Content-Type", "application/json")
 	if l.Token != "" {
 		req.Header.Set("Authorization", "Bearer "+l.Token)
 	}
 	resp, err := l.HTTP.Do(req)
 	if err != nil {
 		return fmt.Errorf("log: request: %w", err)
@@ -15,36 +15,44 @@ import (
 func TestLoggerLogDecision(t *testing.T) {
 	var captured map[string]any
 	var authHeader string
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		assert.Equal(t, http.MethodPost, r.Method)
 		assert.Equal(t, "/mcp", r.URL.Path)
 		authHeader = r.Header.Get("Authorization")
 		body, _ := io.ReadAll(r.Body)
 		require.NoError(t, json.Unmarshal(body, &captured))
 		_ = json.NewEncoder(w).Encode(map[string]any{"jsonrpc": "2.0", "id": 1, "result": map[string]any{"content": []map[string]any{{"type": "text", "text": "ok"}}}})
 	}))
 	defer srv.Close()
-	l := routing.NewLogger(srv.URL)
+	l := routing.NewLogger(srv.URL, "test-token")
 	err := l.LogDecision(context.Background(), routing.LogEntry{
 		SessionID:   "sess-1",
 		Skill:       "review",
 		Decision:    "local",
-		Message:     "model=qwen35, pass_rate=0.94",
+		Message:     "model=qwen36, pass_rate=0.94",
 		ProjectRoot: "/home/x/proj",
 		DurationMs:  1234,
 		Failed:      false,
 	})
 	require.NoError(t, err)
 	// Bug C fix: the POST authenticates to the bearer-gated ingestion /mcp.
 	assert.Equal(t, "Bearer test-token", authHeader)
 	params := captured["params"].(map[string]any)
 	assert.Equal(t, "tools/call", captured["method"])
 	assert.Equal(t, "session_log", params["name"])
 	args := params["arguments"].(map[string]any)
-	assert.Equal(t, "_routing", args["skill"])
+	// Bug B fix: the record carries the real skill so /pass-rate?skill=review sees it.
 	assert.Equal(t, "review", args["skill"])
 	assert.Equal(t, "decide", args["phase"])
-	assert.Equal(t, "skip", args["final_status"])
+	// Bug A fix: a successful routed call logs "pass", not "skip".
 	assert.Equal(t, "pass", args["final_status"])
 	assert.Contains(t, args["message"].(string), "review: local")
 	// session grouping is preserved via session_id.
 	assert.Equal(t, "sess-1", args["session_id"])
 	assert.Equal(t, "/home/x/proj", args["project_root"])
 	assert.Equal(t, float64(1234), args["duration_ms"])
@@ -59,23 +67,40 @@ func TestLoggerLogFailure(t *testing.T) {
 	}))
 	defer srv.Close()
-	l := routing.NewLogger(srv.URL)
+	l := routing.NewLogger(srv.URL, "test-token")
 	err := l.LogDecision(context.Background(), routing.LogEntry{
 		SessionID: "s", Skill: "debug", Decision: "local", Message: "litellm down", Failed: true,
 	})
 	require.NoError(t, err)
 	args := captured["params"].(map[string]any)["arguments"].(map[string]any)
 	assert.Equal(t, "debug", args["skill"])
 	assert.Equal(t, "fail", args["final_status"])
 }
 func TestLoggerOmitsAuthWhenTokenEmpty(t *testing.T) {
 	var authHeader string
 	hasAuth := false
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		authHeader = r.Header.Get("Authorization")
 		_, hasAuth = r.Header["Authorization"]
 		_ = json.NewEncoder(w).Encode(map[string]any{"jsonrpc": "2.0", "id": 1, "result": map[string]any{}})
 	}))
 	defer srv.Close()
 	l := routing.NewLogger(srv.URL, "")
 	require.NoError(t, l.LogDecision(context.Background(), routing.LogEntry{Skill: "review", SessionID: "_routing", Decision: "local"}))
 	assert.False(t, hasAuth, "no Authorization header should be set when token is empty")
 	assert.Equal(t, "", authHeader)
 }
 func TestLoggerSurfacesUpstreamError(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		http.Error(w, "down", http.StatusBadGateway)
 	}))
 	defer srv.Close()
-	l := routing.NewLogger(srv.URL)
+	l := routing.NewLogger(srv.URL, "test-token")
 	err := l.LogDecision(context.Background(), routing.LogEntry{Skill: "x", SessionID: "y", Decision: "local"})
 	require.Error(t, err)
 }
@@ -50,7 +50,7 @@ func newRouter(t *testing.T, llm *fakeLLM, passRate float64) (*routing.Router, *
 	r := &routing.Router{
 		Fetcher:       routing.NewFetcher(brain.URL, "7d", time.Minute),
-		Logger:        routing.NewLogger(brain.URL),
+		Logger:        routing.NewLogger(brain.URL, ""),
 		Policy:        routing.Policy{Floor: 0.9, Ceil: 0.7},
 		FastModel:     "koala/qwen35-9b-fast",
 		ThinkingModel: "iguana/gemma4-26b",
@@ -117,7 +117,7 @@ func TestRouterDefaultsToFastWhenBrainUnreachable(t *testing.T) {
 	llm := &fakeLLM{resp: "ok"}
 	r := &routing.Router{
 		Fetcher:       routing.NewFetcher(brain.URL, "7d", time.Minute),
-		Logger:        routing.NewLogger(brain.URL),
+		Logger:        routing.NewLogger(brain.URL, ""),
 		Policy:        routing.Policy{Floor: 0.9, Ceil: 0.7},
 		FastModel:     "koala/qwen35-9b-fast",
 		ThinkingModel: "iguana/gemma4-26b",
@@ -7,14 +7,14 @@ description: Disciplined end-of-session closeout for a Claude.ai chat before arc
 Capture a finishing Claude.ai work session into durable storage before the chat is archived and its context is lost. The goal is simple and load-bearing: **after this runs, a fresh session (or another agent) can reconstruct what was decided, what was shipped, and what is still open — without the original chat.**
-This skill is **batch**: one session in, findings out, done. It does not loop or re-read its own fresh output semantically (see Phase 5). Run the phases in order. Stop at any confirmation gate that says STOP.
+This skill is **batch**: one session in, findings out, done. Run the phases in order. Stop at any confirmation gate that says STOP.
 ## Operating constraints (read first)
 - **Gitea owner is always `mathias`.** Never guess another owner.
 - **Ground-truth at HEAD before acting.** Issue bodies and doc references rot — stale hostnames, retired services, moved endpoints. Before closing/commenting on any issue, `gitea:issue_get` it fresh. Before asserting an infra fact, verify it; do not copy it from memory or from a stale issue body.
 - **Current infra truths** (verify rather than trust, but these are the known-good baseline): Gitea is `git.d-ma.be` (not `gitea.d-ma.be`). LiteLLM is `http://koala:30401/v1/` (public `https://llm-api.d-ma.be`); piguard runs NGINX Proxy Manager only — never reference `piguard:4000` or `koala:4000`. Identity provider is Authentik (Dex migration complete).
- **Side-effects need a confirmation gate.** Closing issues, committing files, and writing to the brain are all real writes. Surface exactly what will happen and get a clear yes before doing it. Reads are free; writes are gated.
+- **Side-effects need a confirmation gate.** Closing issues and capturing to brain/Gitea/ai-sessions are real writes. Surface exactly what will happen and get a clear yes before doing it. Reads are free; writes are gated.
 - **Never fabricate.** If the session didn't produce a decision worth persisting, say so and skip that write. An empty-but-honest closeout beats an invented one.
 ## Phase 1 — Harvest
@@ -34,76 +34,46 @@ For every repo touched this session, get its true current state before proposing
 Do not write anything in this phase. This is the read pass.
-## Phase 3 — Confirm and act on issue changes
+## Phase 3 — Plan the issue changes
-Present a single consolidated plan of issue actions: which to close (with closing comment), which to file (discovered-but-deferred work — token-budget gaps, recorded limitations, v2 follow-ups), which to comment on. Include the exact title/body for any new issue and the closing rationale for any close.
+Decide the issue actions: which to close (with closing comment), which to file (discovered-but-deferred work — token-budget gaps, recorded limitations, v2 follow-ups), which to comment on. Include the exact title/body for any new issue and the closing rationale for any close.
-**GATE — STOP and get explicit confirmation before any issue write.** Issue closes and new issues are side-effects. Once confirmed, execute them (`gitea:issue_close`, `gitea:issue_create`, `gitea:issue_comment`, all owner `mathias`), correcting any rotted references you found in Phase 2 as you go.
+These actions are **carried into the Phase 4 capture call** as `tickets[]` rather than executed here with direct `gitea:issue_*` calls — routing them through capture puts each one into the I5 audit record. (Closing an issue that needs a separate explanatory comment first is the one case to do directly; otherwise prefer the capture path.)
-## Phase 4 — Commit the canonical session summary
+## Phase 4 — Capture (one uniform call)
-Write one summary file to `mathias/ai-sessions`, committed directly to `main` via `gitea:file_write_branch` (no PR — this repo is solo and unprotected; if branch protection is ever added, fall back to a branch + PR).
+Persist the session via a **single `capture` call** (the `brain:capture` MCP tool, live on the Claude.ai connector). Capture owns the writes server-side — insights → brain, action items → Gitea tickets, summary → ai-sessions — plus the I1 sovereignty gate, the I5 audit record, and the supersession/read-after-write discipline. The skill's job is to *assemble the payload*, not to write each store itself. Do NOT fall back to separate `gitea:file_write_branch` + `brain_write` steps unless `capture` is unreachable (see fallback below).
-**Path:** `summaries/claudeai/<YYYY-MM>/<YYYY-MM-DD>-<topic-slug>-<chatid8>.md`
+**Assemble one payload:**
 where `<chatid8>` is the first 8 chars of the chat's UUID if known, else a short stable slug. `claudeai` has no host segment — Claude.ai is Anthropic-side, not a homelab host.
-**Frontmatter — the REDUCED live-capture schema.** A live close-session capture cannot populate the batch-export telemetry (token counts, message counts, duration_ms, permission_mode) — those only exist in the account export pipeline. Write only what's truthfully known, and mark fidelity so a reader (or the batch pipeline) can tell a live capture from an export:
+- **`insights[]`** — the generalizable learnings from Phase 1 (decisions/failures worth re-reading). Each: `{text, wing, hall}`; add `supersede_slug` to revise a prior note in place instead of creating a duplicate. `hall` ∈ facts/decisions/failures/hypotheses/sources.
 - **`tickets[]`** — the issue actions from Phase 3: `{repo, action, ...}` where action ∈ create/close/comment. Owner is always `mathias` (server-forced).
 - **`summary`** — `{title, body, repos_touched}`. Capture writes it to `ai-sessions` and stamps `fidelity` in frontmatter. Body stays reconstructable: one-paragraph summary, decisions, key artifacts, open threads.
 - **`context`** — `{harness: "claudeai-chat", session_ref: <chatid8-or-slug>, fidelity: "live-capture", actor: "mathias", classification: <see gate below>}`.
-```yaml
+**THE CLASSIFICATION GATE (read before calling — this is where capture refuses).**
---
+Capture computes an **effective classification = the strictest across EVERY target it touches** (each insight's `wing`, each ticket's `repo`, and every entry in `summary.repos_touched`), then refuses if that effective level is `confidential` and the origin is us-nexus (claude.ai is us-nexus). Levels come from `classification.yaml` at the brain root (source of truth, #67), with the code defaults as the floor: `hyperguild`/`homelab` → internal; `client-*` → confidential; **anything untagged → confidential (fail-safe)**.
-title: "<concise session title>"
+- **Tagged `internal` today** (safe through claude.ai): wings `hyperguild`, `homelab`; repos `brain`, `ai-sessions`, `infra`, `hyperguild`, `homelab`, `tapir`, `agentsquad`, `jepa-fx-risk`, `swedsl`. Treat `classification.yaml` as authoritative — this list is a hint, not gospel.
-client: "claudeai"
+- Declare `context.classification: "internal"` for normal homelab work.
-interface: "claudeai-chat"
+- `summary.repos_touched`, insight `wing`s, and ticket `repo`s are classification INPUTS, not free-form metadata — every target must resolve `internal` or the whole capture escalates to `confidential` and the gate refuses via claude.ai. Listing the central homelab repos (incl. `brain`/`ai-sessions`) is now fine; they're tagged. The summary always lands in `ai-sessions` (internal), so the summary path itself never escalates.
-date: "<YYYY-MM-DD>"
+- If a session genuinely touched **`client-*` or otherwise-untagged** material, it cannot be captured through claude.ai — note that in the verdict rather than trying to force it.
 repos_touched: [<repo slugs>]
 topic_tags: [<tags>]
 outcome: "<shipped|in-progress|abandoned>"
 fidelity: "live-capture"   # NOT an export; reconstructed live from chat
 captured_by: "close-session-skill"
 ---
 ```
-Do not invent the export-only fields. `fidelity: live-capture` is the honest signal; if the batch export later produces a richer summary for the same session, the export is source of truth and supersedes this.
+**GATE — dry-run first, then execute.**
 1. Call `capture` with `dry_run: true`. It validates the whole payload and returns the would-be receipt + `effective_classification`, writing nothing.
 2. **STOP. Show the dry-run receipt** (effective classification, the insights/tickets/summary that would land) and get explicit confirmation.
 3. On confirmation, call `capture` again with `dry_run: false`. Read the returned receipt: it is partial-aware (`errors[]`, per-item `ok`). Report exactly what landed.
-**Body** (keep it reconstructable, not exhaustive):
+If `capture` is **unreachable** (tool not on the connector — e.g. a session that started before a deploy; a tool-list refresh usually fixes it): say so. Only then fall back to the legacy inline path (`gitea:file_write_branch` summary + `brain_write`/`brain_update` + `brain_get` confirm), and note in the verdict that the I5 audit record was NOT produced.
 ```markdown
 ## One-paragraph summary
 ## Decisions
 ## Key artifacts
 ## Open threads
 ```
-**GATE — STOP, show the full file (path + frontmatter + body), get explicit confirmation before committing.**
+## Phase 5 — Verdict
 ## Phase 5 — Brain orientation note (the durable "where we are" record)
 Write one brain note so a fresh session can orient without the chat. This uses the `brain_update`/`brain_get` verbs (live since 2026-06).
 **Target:** `wing: <domain>` (the project/topic domain, e.g. `hyperguild`, `jepa-fx`), `hall: decisions`. The note is a knowledge-type record (a decision/orientation), grouped by knowledge-type, not by interface surface.
 **Batch read-after-write discipline (important — do these in order, do not interleave):**
 1. **Read first, before any write.** Check whether an orientation note already exists for this wing/topic. Do your "does this already exist / what should I supersede" reads NOW, up front. BM25/keyword search and `brain_get` are immediate; semantic/vector search may lag up to ~5 min after a write, so never rely on a semantic query to find something you wrote earlier in this same run.
 2. **Write or supersede:**
   - **New note** → `brain_write` (wing, hall: decisions). Returns `{id, path, content_hash}`.
   - **Superseding a prior orientation note** → `brain_update` (slug or path, wing, hall, content, reason). Whole-note replace; stamps `supersedes`/`updated_at`; returns `{id, path, content_hash, superseded}`. Use this instead of a second `brain_write` to the same slug — blind re-write creates duplicates/contradictions, which is the exact failure brain_update exists to prevent.
 3. **Confirm it landed** via `brain_get(id)` and check the returned `content_hash` matches what the write returned. This is the read-after-write confirmation — do it with `brain_get`, never a semantic query.
 **RULE: no semantic/vector brain query after the first `brain_update` in this run.** The batch shape makes this natural — read up front, write, confirm by id. If you ever find the skill wanting to semantic-search a just-superseded note, stop and flag it (that's the signal the staleness window matters and needs the synchronous-reembed follow-up).
 **GATE — STOP, show the note (target wing/hall, new-vs-supersede, full content), get explicit confirmation before the brain write.**
 After the note lands, if it relates to a note in another wing, create the cross-link inline with `brain_tunnel(source, target)` (idempotent; both paths brain-relative, must be in different wings). Optionally append a `session_log` entry (`session_id`, `skill: close-session`, `phase`, `final_status`) for telemetry. Both are now callable directly from Claude.ai — no Claude Code/Crush handoff needed.
 ## Phase 6 — Verdict
 Deliver a final "safe to archive" verdict in the chat. Either:
- **SAFE TO ARCHIVE** — list what landed (issues closed/filed with numbers, summary path, brain note id, any tunnels) so the trail is auditable. Then list anything still in the user's queue (e.g. a PR awaiting their merge, a decision owed next session).
+- **SAFE TO ARCHIVE** — list what landed from the capture receipt (issues closed/filed with numbers, summary path, brain note ids/paths) so the trail is auditable. Then list anything still in the user's queue (e.g. a PR awaiting their merge, a decision owed next session).
- **NOT YET** — name the specific gate that wasn't passed or the write that failed, and what to do about it.
+- **NOT YET** — name the specific gate that wasn't passed, the capture refusal reason, or the per-item error from the receipt, and what to do about it.
-Never claim safe-to-archive if any gated write was declined or errored. The verdict is the skill's contract: if it says safe, the session can be lost without losing the work.
+Never claim safe-to-archive if the capture refused, any receipt item errored, or a gated confirmation was declined. The verdict is the skill's contract: if it says safe, the session can be lost without losing the work.
-## Why the gates and the batch discipline matter
+## Why the gate and the single-call shape matter
-The whole point is durability across a context reset. Every gate is a place where a wrong write would silently corrupt the record (close the wrong issue, overwrite a good brain note, commit a half-truth). The batch read-discipline in Phase 5 exists because the brain's vector index refreshes out-of-band: write-then-semantically-reread in the same run can read stale, so the skill front-loads reads and confirms writes by id. Get those right and the skill does what it promises — nothing important is lost when the chat goes away.
+The whole point is durability across a context reset. The capture call is the one place a wrong payload would silently corrupt the record (close the wrong issue, escalate to a refusal, commit a half-truth), which is why it is dry-run-then-confirm. Routing everything through one `capture` keeps the supersession discipline, the read-after-write confirmation, and the I5 audit trail server-side — the skill never has to carry those rules itself, and every closeout is uniformly audited. Get the payload and the classification right and the skill does what it promises — nothing important is lost when the chat goes away.
@@ -0,0 +1,116 @@
 # Capture capability — implementation report (as-built)
 **Status:** Shipped 2026-06-23, tagged `v0.11.0`. Epic hyperguild #49 (sub-issues #50–#55) closed.
 **Spec:** `specs/capture-bdd-spec.md` (the design contract this implements).
 **Governed by:** `infra/docs/architecture/01-invariants.md` (I1–I5) + the I2 acceptance ledger entry in `infra/docs/security-baseline.md`.
 This document records what was actually built, where it lives, how it maps to the spec, and what was deferred — for onboarding and future audit. It does not restate the design rationale (see the spec and the linked brain entries).
 ---
 ## 1. Outcome
 One uniform capture capability — insights → brain, action items → Gitea tickets, optional summary → ai-sessions — reachable identically from every harness:
 - **In-process / direct-REST harnesses** (Claude Code CLI, Agentsquad, claude.ai Code, headless): `POST /capture` on the brain server.
 - **MCP-native harnesses** (claude.ai Chat/Cowork/Design, Crush, Pi, LLM Council): the `capture` MCP tool, reached over the existing `/mcp` OAuth connector.
 Both doors call the **same** `CaptureService`; only the transport and credential assembly differ. The persistence behaviour (validation, classification, I1 gate, orchestration, I5 audit, partial receipt) is written once.
 ---
 ## 2. Architecture (as-built)
 ```
                 POST /capture (REST)          capture MCP tool
                 capturehttp.Handler           mcp.Server.brainCapture
                          \                          /
                           \   (auth → principal →  /
                            \   origin; decode)    /
                             v                    v
                        capture.CaptureService (use-case, pure)
            ┌───────────────┬───────────────┬──────────────┬───────────────┐
        BrainStore     IssueTracker    SummaryWriter   ClassificationPolicy  AuditSink
        brainstore.    gitea.Client    (nil today)     classification.Config  audit.Degrading
        Store          (REST)                                                 Sink / SlogSink
        │                                                                     │
        api.WriteNote/UpdateNote/ReadNote (#45)                       LokiCentral + FileBuffer
        + wing index + auto-tunnel + graph re-index                  + NtfyNotifier + Reconcile
 ```
 - **`internal/capture/`** — the use-case + ports + entities. Pure; no I/O. Owns validation (fail-closed), effective-classification resolution (stricter wins), the **I1 sovereignty gate**, best-effort orchestration, the **two-phase I5 audit** (Reserve before writes / Record after), and the partial-aware receipt.
 - **`internal/brainstore/`** — concrete `BrainStore` wrapping the #45 `api` primitives + wiki upkeep (wing `_index`, auto-tunnel, graph re-index). The MCP `brain_write`/`brain_update`/`brain_get` handlers were re-pointed at it: one implementation, not two.
 - **`internal/classification/`** — `public < internal < confidential` taxonomy + per-wing/repo tags from an optional `classification.yaml`; fail-safe to confidential.
 - **`internal/gitea/`** — `IssueTracker` over the Gitea REST API; owner forced to `mathias`; token only in the Authorization header.
 - **`internal/capturehttp/`** — the REST adapter + the shared `Authenticate` / `DecodeRequest` / `OriginResolver` (also used by the MCP tool).
 - **`internal/audit/`** — `SlogSink` (default) and the `DegradingSink` (loki + durable `FileBuffer` + `NtfyNotifier` + `Reconcile`).
 - **`internal/mcp/`** — the `capture` relay tool + principal threading (re-derives the caller's principal from the Bearer header the chassis middleware discards).
 ---
 ## 3. Sub-issue → PR map
 | Sub | Issue | PR(s) | Delivered |
 |-----|-------|-------|-----------|
 | 49a | #50 | #56 | classification taxonomy + per-wing/repo tags (fail-safe to confidential) |
 | 49b | #51 | #57 | `CaptureService` use-case + ports + entities; `BrainStore` extraction (MCP re-pointed) |
 | 49c | #52 | #58 | Gitea `IssueTracker` (owner forced mathias; token never logged) |
 | 49d | #53 | #59 | `POST /capture` REST + OAuth2 + I1 sovereignty gate (server-derived origin) |
 | 49e | #54 | #60 | I5 audit path + classification-aware degradation (loki + buffer + reconcile) |
 | 49f | #55 | #61, infra #151 (ledger), #152 (deploy) | MCP `capture` relay tool + I2 ledger + I3 deploy |
 Predecessor: #45 (`brain_update`/`brain_get` verbs, PR #46) — the read-after-write contract capture reuses.
 ---
 ## 4. Invariant compliance
 | Inv | How satisfied |
 |-----|---------------|
 | **I1** sovereign containment | Effective classification = stricter(caller-declared, target-derived #50). Origin is **server-derived from the authenticated principal**, never `context.harness`. Confidential + us-nexus origin → refused before any write; refusal audited. Asserted-vs-derived mismatch → security event. |
 | **I2** deliberate acceptance | The relay's cross-harness reach is recorded in `infra/docs/security-baseline.md` with six containment properties + Revisit-if, **merged before relay code shipped** (infra #151). |
 | **I3** GitOps reconcilability | Env + `gitea-api-token` ExternalSecret under `infra/k3s/apps/supervisor/`, Flux-reconciled; image bumped by CD. No untracked runtime. |
 | **I5** auditability | Every capture emits a request-level audit record. Classification-aware degradation: confidential + sink-down → hard-refuse; internal/public + sink-down → durable local buffer + ntfy + reconcile-on-recovery; floor → refuse if nothing can record. |
 ---
 ## 5. Operational reference (env)
 Set on the `ingestion` deployment (`infra/k3s/apps/supervisor/ingestion-deployment.yaml`):
 | Env | Purpose | Notes |
 |-----|---------|-------|
 | `BRAIN_GITEA_URL` / `BRAIN_GITEA_TOKEN` | enables the `IssueTracker` → gates `/capture` + the MCP tool | token from 1P `DMABE_GITEA_API_TOKEN` via ESO; unset ⇒ capture disabled |
 | `BRAIN_LOKI_URL` | activates the `DegradingSink` | unset ⇒ `SlogSink` (audit to stdout → alloy → loki; no refuse/buffer semantics) |
 | `BRAIN_NTFY_URL` / `BRAIN_NTFY_TOKEN` | degraded-state alerts | optional |
 | `BRAIN_CAPTURE_SOVEREIGN_PRINCIPALS` | JWT subjects treated as sovereign-soil | comma-separated; static-token caller is always sovereign; unknown JWT ⇒ us-nexus (fail safe) |
 | `BRAIN_AUDIT_RECONCILE_INTERVAL` | buffer→loki replay tick | default 60s |
 The audit buffer lives at `<brain>/.audit-buffer/capture.jsonl` on the brain hostPath (nodeSelector-pinned to koala) — durable across restart without a separate PV.
 ---
 ## 6. Tests
 67 test functions across the six packages. Coverage maps to the spec's Gherkin: happy path, supersede-not-duplicate, fail-closed validation, partial-failure receipt, dry-run, stricter-classification-wins, I1 confidential-via-us-nexus-refused / via-sovereign-allowed / asserted-label-ignored / caller-cannot-forge-origin, I5 confidential-refuse / internal-buffer / floor-refuse / reconcile / buffer-survives-restart, and the MCP relay tool (forwards, preserves principal, unauth rejected). `task check` green.
 ---
 ## 7. Deferred (not in this epic)
 Tracked here so they aren't lost; file as issues when picked up:
 - **SKILL veneer** — the `close-session` SKILL becomes the claude.ai trigger/harvest layer that calls capture.
 - **Per-harness token provisioning** for Crush / Pi / LLM Council (claude.ai is done via the existing `/mcp` connector).
 - **Harvest adapters** — transcript-parse vs chat-memory-reconstruct vs agent-runlog, each assembling capture args at its own fidelity.
 - **`SummaryWriter` impl** — ai-sessions summary persistence (the port + path logic exist; the concrete writer is nil today, so a request with a summary fails that one item).
 ---
 ## 8. Brain learnings
 - `wiki/hyperguild/decisions/capture-classification-taxonomy`
 - `wiki/hyperguild/decisions/gate-on-server-derived-signals-fail-safe`
 - `wiki/hyperguild/decisions/two-phase-reserve-record-audit-gate`
 - `wiki/hyperguild/failures/mcp-bearer-middleware-discards-principal`
 - `wiki/hyperguild/facts/brain-mcp-embeddings-out-of-band-sync` (from #45, the predecessor)
Author	SHA1	Message	Date
mathiasandClaude Opus 4.8	00e5f62c8e	docs(runbook): correct flywheel (nil→local) + instrumentation-fixed note CI / Lint / Test / Vet (push) Successful in 12s Details CI / Mirror to GitHub (push) Successful in 4s Details Two corrections after the #73 investigation: (1) the router routes cold (nil pass-rate) calls to the LOCAL fast tier, not cloud — the earlier "pay in on cloud" description was wrong (per policy.go). (2) Note that pass-rate logging was broken until v0.11.1 (#73) and is now verified; reset the window to 2026-06-30→07-14. Refs #73, #35. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-30 22:16:03 +02:00
mathiasandClaude Opus 4.8	b9d03316fd	fix(ingestion): migrate mcp-chassis import to git.d-ma.be path (#74 ) CI / Lint / Test / Vet (push) Successful in 13s Details CI / Mirror to GitHub (push) Has been skipped Details Unblocks CD: the build's go mod download failed because mcp-chassis was imported via the old gitea.d-ma.be module path, which the renamed server no longer serves a matching go-import meta tag for. Point at the renamed module git.d-ma.be/mathias/mcp-chassis v0.2.0 (mcp-chassis 69d389d) + go mod tidy. Fresh download now resolves; ingestion builds + tests green. This restores the normal CI path so the routing pass-rate fix (`da9bdc4`, #73) builds and deploys through gitea Actions. Refs #74, #73, #35. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-30 21:39:41 +02:00
mathiasandClaude Opus 4.8	da9bdc4cbb	fix(routing): repair pass-rate instrumentation (3 bugs) — #73 , #35 CI / Lint / Test / Vet (push) Successful in 13s Details CI / Mirror to GitHub (push) Successful in 4s Details The #35 data gate could never fill: a real review call routed cleanly to qwen36 but /pass-rate stayed total:0 under every key. Root cause was three independent defects in the session_log path, each alone fatal: - A: a successful routed call logged final_status "skip", never "pass". /pass-rate computes pass/(pass+fail) and skips count as neither, so the >=0.90 gate was mathematically unreachable. Success now logs "pass". - B: every record was written under skill "_routing", so /pass-rate?skill= review\|debug (what #35 measures) always read zero. Now uses the real e.Skill; routing decisions stay groupable via session_id "_routing". - C: the session_log POST to the bearer-gated ingestion /mcp carried no Authorization header → silent 401, swallowed by best-effort logging (the documented mcpclient-empty-token-silent-401 footgun). Logger now takes a token (BRAIN_MCP_TOKEN) and sets the bearer when non-empty. Tests rewritten to assert correct behavior (they had encoded the bugs: "skip" on success, "_routing" skill). New test covers the auth header and the empty-token path. Infra (BRAIN_MCP_TOKEN ExternalSecret + env on the routing deployment) and redeploy follow separately. Refs #73, #35. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-30 08:36:18 +02:00
mathiasandClaude Opus 4.8	dcb9ff4a56	docs(runbook): how to exercise review/debug traffic for the pass-rate gate CI / Lint / Test / Vet (push) Successful in 20s Details CI / Mirror to GitHub (push) Successful in 3s Details The #35 data gate stays at zero because pass-rate only accrues from review/ debug calls through the routing pod — Crush, cloud chat, and the local .skills all bypass it. Document the connect → route → flywheel steps, the endpoints (koala:30310/mcp + routing-mcp.d-ma.be), the cold-start behavior (nil pass-rate routes cloud until passes accrue past the 0.90 floor, then local qwen36 activates), the 50-invocation / 2026-07-10 target, and the Berget fallback. Refs #35. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-29 23:41:07 +02:00
mathias	0454527b83	Merge pull request 'feat: brain_pending + brain_promote — close the raw→wiki curation loop (#38 )' (#70 ) from feat/brain-pending-promote into main CI / Lint / Test / Vet (push) Successful in 13s Details CI / Mirror to GitHub (push) Successful in 3s Details	2026-06-26 14:49:27 +00:00
mathiasandClaude Opus 4.8	ef11864121	feat(mcp): brain_pending + brain_promote tools + REST routes (#38 ) CI / Lint / Test / Vet (pull_request) Successful in 13s Details CI / Mirror to GitHub (pull_request) Has been skipped Details Wires the curation primitives into the MCP surface (all three sites: tools() descriptors, handleCall dispatch, package doc) and registers the GET /pending + POST /promote REST routes. brain_promote additionally re-indexes the promoted note into the graph (best-effort), matching the other write paths. brain_pending is the human-review-queue complement to the agent-facing brain_write. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-26 16:34:15 +02:00
mathiasandClaude Opus 4.8	14b04a25cb	feat(brain): ListPending + PromoteNote — raw→wiki curation primitives (#38 ) Closes the human curation loop: list brain/raw/ notes awaiting review (oldest-first, with excerpt) and promote one into brain/wiki/<wing>/<hall>/. PromoteNote rewrites frontmatter (sets wing/hall/promoted_at, preserves created_at + custom fields via the existing frontmatter editor), rebuilds the wing _index, and runs auto-tunnel. Atomic from the caller's view: hall/wing/slug/collision validation happens before any fs change, and the source is deleted only after the destination write succeeds (write-then- delete, never move) — a collision or write failure leaves raw/ intact. Default slug = filename minus the YYYY-MM-DD- prefix. Also exposes GET /pending + POST /promote for shell scripts (bad hall/collision/missing-source → 400, not 500). Scope note: operates on raw/ (the retrospective-skill review queue) per this issue's spec. The knowledge/ legacy pile is #22's bulk-migration concern, not this ongoing queue. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-26 16:34:15 +02:00
mathias	66a9b8e725	Merge pull request 'docs(close-session): refresh classification gate post-#67 (#62 )' (#69 ) from fix/close-session-classification-refresh into main CI / Lint / Test / Vet (push) Successful in 12s Details CI / Mirror to GitHub (push) Successful in 3s Details	2026-06-26 14:28:48 +00:00
mathiasandClaude Opus 4.8	9f8fb9c138	docs(close-session): refresh classification gate post-#67 (#62 ) CI / Lint / Test / Vet (pull_request) Successful in 13s Details CI / Mirror to GitHub (pull_request) Has been skipped Details The capture-routing in `723dab5` (#62 minimal) carried pre-#67 prose: it warned "no populated classification.yaml yet" and steered repos_touched away from brain/ai-sessions as if they'd escalate to confidential. #67 tagged the homelab repos internal, so that guidance is now wrong and over-restrictive — listing the central repos is fine, and the summary's fixed ai-sessions target no longer escalates the call. Point at classification.yaml as the source of truth; reserve the refusal warning for client-*/untagged material. Completes #62's veneer. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-26 16:25:57 +02:00
mathias	d39a18dd69	Merge pull request 'fix: wire ai-sessions SummaryWriter into the capture relay (#66 )' (#68 ) from fix/capture-summarywriter into main CI / Lint / Test / Vet (push) Successful in 12s Details CI / Mirror to GitHub (push) Successful in 4s Details	2026-06-23 15:22:42 +00:00
mathiasandClaude Opus 4.8	5288554338	fix(gitea): WriteFile creates via POST, updates via PUT (real contents API) CI / Lint / Test / Vet (pull_request) Successful in 13s Details CI / Mirror to GitHub (pull_request) Has been skipped Details A live token-scope probe against mathias/ai-sessions revealed gitea's contents API uses POST to create and PUT (sha required) to update — the first impl always PUT'd, so creating a new summary 422'd "[SHA]: Required". The httptest mock had the same wrong assumption. Pick the method by whether the file exists (GET sha). Token confirmed contents:write (push:true) by the probe. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-23 17:22:37 +02:00
mathiasandClaude Opus 4.8	2368564523	fix(capture): wire ai-sessions SummaryWriter into the relay (#66 ) CI / Lint / Test / Vet (pull_request) Successful in 13s Details CI / Mirror to GitHub (pull_request) Has been skipped Details The deployed CaptureService was constructed with a nil SummaryWriter, so a capture carrying a summary block returned the partial-failure "no summary writer configured" (surfaced in the 2026-06-23 claude.ai dogfood). The Gitea client already reaches mathias/* over BRAIN_GITEA_TOKEN and now implements SummaryWriter, so inject it (type-asserted from the tracker) — no new credential, no manifest change. Session summaries now write to mathias/ai-sessions at summaries/<harness>/<YYYY-MM>/... Reuses the existing token deliberately; assumes it carries contents:write scope on ai-sessions (it already does issue writes for the tracker). If the token is issue-scoped only, the live write 422s — a token-scope widen, not a code fix. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-23 10:47:00 +02:00
mathiasandClaude Opus 4.8	0e28b2125b	feat(gitea): WriteFile contents-API upsert — satisfies SummaryWriter (#66 ) Adds Client.WriteFile (Gitea contents API) so the Gitea client also implements capture.SummaryWriter. Upserts: a GET resolves the current blob sha so an existing file is updated (the richer-fidelity-supersedes rule for re-captured sessions) rather than 422'd. Owner stays the fixed const; token only in the Authorization header (no leak — regression tested). Refactors the HTTP path into a shared request() helper so the contents flow can branch on 404 without it being an error. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-23 10:47:00 +02:00
mathias	723dab51ae	feat(close-session): route closeout through the capture tool (#62 minimal) CI / Lint / Test / Vet (push) Successful in 13s Details CI / Mirror to GitHub (push) Successful in 3s Details Collapse Phases 4 (summary commit) + 5 (brain note) into a single capture-driven Phase 4. The skill now assembles one brain:capture payload (insights + tickets + summary + context) and dry-runs-then-executes; capture owns the brain/gitea/ai-sessions writes, the I1 gate, the I5 audit record, and the supersession/read-after-write discipline server-side. Adds the classification-gate lesson learned dogfooding capture this session: effective classification = strictest across ALL targets (wings, ticket repos, repos_touched); untagged repos (brain, ai-sessions) fail-safe to confidential and get refused via claude.ai, so repos_touched must stay to internal-default repos. Legacy inline path kept only as the capture-unreachable fallback. Staleness prose removed (server owns it now). Partial of #62; harness-token + harvest-adapter + fidelity-supersession work remain.	2026-06-23 06:27:57 +00:00
mathiasandClaude Opus 4.8	06e21c019e	docs(capture): as-built implementation report for the #49 epic CI / Lint / Test / Vet (push) Successful in 12s Details CI / Mirror to GitHub (push) Successful in 4s Details Records what shipped (v0.11.0): architecture, sub-issue→PR map, I1–I5 compliance, the operational env reference, test coverage, and the deferred follow-ups. Companion to specs/capture-bdd-spec.md (the design contract) for onboarding + future audit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-23 07:41:24 +02:00
mathias	76514215f4	Merge pull request 'feat: capture relay — MCP capture tool for non-library harnesses (#55 , capture 49f)' (#61 ) from feat/capture-mcp-relay into main CI / Lint / Test / Vet (push) Successful in 12s Details CI / Mirror to GitHub (push) Has been skipped Details	2026-06-23 05:26:55 +00:00
mathiasandClaude Opus 4.8	7cf5bc221d	feat(mcp): capture relay tool — MCP door for non-library harnesses (#55 ) CI / Lint / Test / Vet (pull_request) Successful in 13s Details CI / Mirror to GitHub (pull_request) Has been skipped Details Adds the `capture` MCP tool: the #55 relay for harnesses that cannot run the use-case in-process (claude.ai Chat/Cowork/Design, Crush, Pi, LLM Council). They reach it through the existing /mcp OAuth connector. - Thin: forwards to the SAME CaptureService as POST /capture; holds no state and retains nothing beyond the I5 audit record. The containment properties accepted in infra security-baseline (I2 ledger) hold by construction. - Per-principal: ServeHTTP re-derives the caller's principal from the Bearer header (the chassis middleware gates but discards it) and stashes it in context; the tool resolves the trust-zone origin from it. A caller-asserted harness/origin in the body is ignored — origin is server-derived, so the I1 confidential refusal still fires for us-nexus callers (claude.ai), and sovereign-allowlisted JWT principals pass. - Registered only when WithCapture is wired (all three sites: tools(), handleCall, package doc); main wires REST + MCP from the same service, resolver, and credentials. Tests: listed-only-when-wired, forwards-via-static-principal, confidential-via-us-nexus-refused, confidential-via-sovereign-allowed, unauthenticated-rejected, caller-cannot-forge-origin. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-23 00:21:11 +02:00
mathiasandClaude Opus 4.8	f78a5474a5	refactor(capturehttp): export Authenticate + DecodeRequest for reuse (#55 ) Lifts the Bearer principal-derivation and the request→CaptureInput decode out of the REST handler into exported package funcs, so the MCP capture tool (#55 relay) reuses the exact same auth precedence and wire shape — one implementation, not two. No behaviour change to POST /capture. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-23 00:21:11 +02:00
mathias	c307b72bd5	Merge pull request 'feat: I5 audit path + classification-aware degradation (#54 , capture 49e)' (#60 ) from feat/capture-audit-degradation into main CI / Lint / Test / Vet (push) Successful in 13s Details CI / Mirror to GitHub (push) Successful in 4s Details	2026-06-22 21:57:52 +00:00