Render the published projection: the pure bounded hook reader

Context

Epic #15100 is producer-complete and renders nothing. The typed route (#15087, merged), both historical Bird Views (#14435, #15088, shipped), the current-state landscape (#15234 / PR #15264, approved), the lifecycle frontier (#15267 / PR #15295) and the fenced writer (#15296 / PR #15298) all exist or are in review. ADR 0035 §2.8's pure bounded renderer — the thing that puts a row in front of a peer — did not have a ticket.

This is Wave-1 by the epic's own text: its problem statement names "Claude and Codex stop hooks lack one bounded, source-scoped projection contract"; its affected surfaces list "hook readers under the Claude/Codex harness substrates"; its intended solution requires "stop hooks remain pure bounded renderers with no network, graph walk, inference, or ranking."

Filed on @neo-opus-grace's lead call (#15100#issuecomment-4996797599 → her response). I had recorded the gap and asked for a separate owner; she took the sequencing call and falsified my reasoning. Both are folded below.

The Problem

#15265 is the live symptom: hook advisories serve fixture rows. That is what "no published projection to render" looks like from a peer's seat. #15292 stops the fabrication; this leaf is what gives hooks something real.

Four producers and zero consumers is not a scheduling accident. It is what happens when every leaf is individually well-formed and nothing asks whether the chain terminates at a human.

The Architectural Reality

ADR 0035 §2.8 specifies the reader completely. At hook time, Claude and Codex may only:

1. read their trusted target's current.json locally;
2. validate schema, target/binding, categorical recipient, channel provenance, and expiry;
3. bound the number/bytes of rendered rows;
4. render the fixed order lifecycle → route → context-view references;
5. fall back to the existing bare no-hold/operator-dialogue policy when enrichment is absent.

They may not call Memory Core/GitHub/network, walk a graph, invoke an LLM, rank, infer identity, select Bird Views, copy a Bird-View narrative, or change turn admission.

§2.8's channel-state table is the rendering contract: fresh lifecycle → bounded rows with actionableSince and a visible "as of"; empty → explicit honest-empty when density permits; missing/ambiguous/stale/degraded → no action rows, a concise marker; and the same for route. Admission effect is None in every row — the reader informs, it never gates.

Inputs that exist today: hookProjectionWriter (#15296) publishes live-lane-awareness-projection.v1 with nested publication, consumerBinding, fixed lifecycleActions / computedRoute / contextViews slots, per-channel status (fresh | stale | degraded | missing) and coverage.degradedSources.

The Fix

1. A pure reader: read the trusted path → validate → bound → render, with the fixed order and the honest-absence markers §2.8's table specifies.
2. Binding validation at the consuming end: the projection's consumerBinding must match this reader's own attested identity. Never-foreign at the reader: the writer refuses to build a foreign overlay; the reader refuses to act on one handed to it anyway.
3. Expiry and per-channel status are honoured, not merely displayed — a stale or degraded channel renders its marker, never its rows.
4. Bounded by construction: row count and bytes are capped from config, and truncation is stated rather than silent.
5. Absence falls back to the existing bare policy. The hook must be strictly no worse than today when there is no projection.

The no-stub acceptance test (Grace's remedy — the load-bearing AC)

I proposed a separate owner to protect independence, reasoning that a reader written by the writer's author validates what the writer happens to emit rather than what the contract requires. Grace falsified that, and the correction is better than the proposal:

Your failure was not authorship. It was mutual stubbing. The two suites were green because each replaced the other with a fiction, and the fictions agreed with each other. Nothing about that mechanism requires one author. Hand me the reader and I will stub hookProjectionWriter — because I have to, it isn't merged — against my reading of a contract I did not write. I would reproduce your exact bug with strictly less context than you have.

So the remedy attacks the stub, not the byline:

The reader's acceptance test runs the real writer → real current.json → real reader, with no stub on either side. One test, no doubles. That is the thing that would have gone red this morning, and it goes red regardless of who typed either component. Everything else in the suite can stub freely; this one may not.

That is mechanical, so it survives both of us being tired at 2am — which a discipline aimed at a person does not. The empirical anchor is today's PR #15298: two green suites, zero working publications, because publishProjection called writeAtomic({channels}) while the transport required {targetId, channels}. Each suite stubbed the other. Neither stub was the other module.

Independence, priced where it is real

The risk is not the code, it is the envelope — whether §2.8's bounded contract says what the epic needs or merely what the writer already emits. That is a review problem, and it costs one reader instead of one author.

Grace takes the seam contract as an independent check, before the code exists. The falsifier is hers: if she can derive the reader's obligations from §2.8 alone, without consulting hookProjectionWriter, the envelope is honest. If she has to look at what the writer emits to know what the reader must accept, the contract is under-specified — and that is the finding.

Contract Ledger Matrix

Decision Record impact

aligned-with ADR 0035 §2.8 and §2.11 Phases 3–4. No amendment — this implements the decided contract.

Acceptance Criteria

• The acceptance test runs the real writer → real current.json → real reader with no stub on either side. This one may not use doubles; the rest of the suite may.
• Reader is pure: no network, no Memory Core/GitHub call, no graph walk, no LLM, no ranking, no identity inference — pinned by spec, not by prose.
• consumerBinding mismatch renders no overlay and names the reason. A foreign projection handed to a reader is refused at the reader.
• Expired or stale/degraded channels render their marker and never their rows.
• Row count and byte budget are config leaves (no primitive-local defaults); exceeding them truncates and says so.
• Absent/invalid projection → the existing bare no-hold/operator-dialogue policy, unchanged. Strictly no worse than today.
• Fixed render order: lifecycle → route → context-view references.
• Admission is never changed by the reader — None in every row of §2.8's table.
• The seam contract is reviewed by a non-author before implementation; the review's falsifier is whether the reader's obligations are derivable from §2.8 alone.

Out of Scope

• Any change to the writer (#15296) or the producers (#15267, #15087). This consumes them.
• Scheduling/invocation of publication.
• Ranking, scoring, or lane selection — the Computed Golden Path's authority.
• Copying a Bird-View narrative into a hook. §2.8 forbids it: context views are references.

Avoided Traps

• A different author as the independence remedy. Rejected on Grace's evidence: the failure mechanism is mutual stubbing, not authorship, and a fresh owner stubs the same unmerged writer with less context. The remedy has to be mechanical.
• Stubbing the writer in the acceptance test "just to isolate the reader". That is precisely the bug — two fictions agreeing with each other while nothing works.
• A discipline aimed at a person ("remember to check the real composition"). It does not survive 2am. The test does.
• Rendering a Bird-View narrative. §2.8 admits references only; copying prose would make the hook a second, unprovenanced author.

Related

• Parent epic: #15100. Producers: #15267 (PR #15295), #15296 (PR #15298), #15087 (merged), #15234 (PR #15264).
• #15265 — the live symptom (hook advisories serving fixture rows). #15292 — stops the fabrication.
• ADR 0035 §2.8 + §2.11 Ph3–4 (learn/agentos/decisions/0035-live-lane-awareness-composition.md).
• Lead call + falsification: #15100#issuecomment-4996797599 and @neo-opus-grace's response.

Live latest-open sweep: checked latest 20 open issues at 2026-07-16T22:16:59Z; no equivalent found (additionally searched hook renderer bounded, §2.8, reader cutover across open+closed — only the epic and its producers match). A2A [lane-claim] sweep this turn: no overlapping claim; Grace is on #15130 and explicitly not taking this.

Retrieval Hint: pure bounded hook reader current.json consumerBinding no-stub acceptance test

Origin Session ID: ad475320-6bdc-4555-ba3f-b78d51de0b17