Adaptive enforcement

Tama observes hook outcomes, learns only from structurally complete runs and causally identified owner corrections, and may automatically weaken only an etiquette hook from enforce to warn. It never disables a hook and never edits hook source.

#Safety invariants

• Integrity hooks always enforce. Failure history, frustration, model output, runtime state, and repair output cannot move them into warning mode.
• Advisory hooks never block. Only etiquette hooks may enter warn, and the automatic ceiling is warning, never off.
• A hook-process failure is infrastructure failure, not a hook verdict. Tier policy decides whether that failure blocks, warns, or is ignored.
• Repair remains proposal-only. Applying source or installing the adaptive runner requires owner consent supplied outside the agent session.

#Threshold-free state machine

Each hook starts in observing. A complete failed run closed by a real pass establishes the recovered baseline. A later complete, non-singleton failure run is a new record only when it strictly exceeds that hook's baseline. A source-verifiable etiquette hook then moves from enforcement to warning.

There are no strike counts, time windows, percentiles, expiry timers, or owner-tuned thresholds. Cold start cannot weaken a hook. A warned hook returns to enforcement only after its verified source digest changes and the new source completes a real successful run; time passing changes nothing.

#Facts before projections

Every transition appends and synchronizes an immutable fact before publishing disposable per-hook projections. Missing or corrupt projections rebuild from the journal. A missing, corrupt, incomplete, or unwritable fact journal fails toward enforcement and reports persistence failure; it never authorizes warning mode.

#Causal owner feedback

Blocked decisions are grouped by session and interaction episode. On the next owner prompt, Tama considers only the most recent episode group from that session. A direct correction of that blocked action may record a source-bound contested-block fact. General frustration, an ambiguous complaint, a missing session identity, or model disagreement is recommendation evidence only.

A correction counts when it names the hook, or when it is worded as a direct correction; frustration language is neither required nor sufficient. Both entry points that see an owner prompt feed this: the per-provider runner and the shared runtime the providers talk to. If the shared runtime fed neither the causal record nor the bridge, a machine driven only through it would never contest anything, the replay corpus would stay empty and tama adaptive repair would refuse every candidate for want of labeled cases. If that is what you see, check that the installed hook release is built from a revision carrying the shared-runtime feed.

#Prompts the harness wrote itself

An owner prompt is a prompt a person typed. A harness that writes prompts of its own — a Pursuit stage, an autonomy run, an automatic continuation — says so in the prompt event with "prompt_author": "automation"; Jeden sets it on every such turn and "operator" on the rest. The adaptive bridge neither contests a block nor records frustration from an automation prompt, and the frustration drafter drafts no rule from one: its log reads AUTOMATION_PROMPT in ~/.shared-hooks/auto_rules.log. A drafter run that was handed no prompt logs NO_PROMPT_VARIABLE with the variable and the system's error, and one handed an empty prompt logs EMPTY_PROMPT, so a run that drafted nothing always says why. A payload that names no author is treated as the owner's, because the interactive harnesses submit only what a person typed.

Without the field, a stage instruction such as "do not execute commands" read as an owner correction and was drafted into rules whose patterns refused every shell command. tama rules list shows what the drafter recorded, and tama rules remove --id <id> removes a rule no stored owner message carries.

#Telemetry transport

Each runner invocation owns one immutable telemetry segment, synchronizes it, and atomically publishes it closed. Transcript Lake validates frame count, source digest, and payload digest; masks and publishes deterministic output; commits its cursor; and only then writes a digest-bound acknowledgement. Tama may reclaim a source segment only after validating that acknowledgement. Lake failure leaves source segments intact and never changes enforcement.

#Repair and migration

Blocks add real payloads to the replay corpus. Explicit corrections label false positives; uncontested blocks remain unlabeled. A repair candidate needs labeled cases and becomes only a proposal after required blocks still block, confirmed false positives pass, and the hook executes successfully.

Runtime state belongs under ~/.hooks-adaptive/ or HOOKS_ADAPTIVE_STATE, never in the repository. Legacy overrides, provenance, and fixed-threshold artifacts are quarantined instead of imported as authority. Every migration therefore cold-starts in enforcement and earns a new baseline from complete runs.

#Failure posture

Runner failure remains fail-closed. Telemetry failure cannot change a verdict. Persistence failure cannot authorize a weaker mode. Unverifiable source identity prevents automatic warning and recovery. Losing observability or adaptive state never turns a safety hook off.