bean 2.0.0 — Rust runtime, oracle gate, native hooks

Rust runtime (bean-check + bean-verify + bean-run + bean-hook), the 2.0 oracle gate, and native Stop-hook coupling for Claude Code and Codex. JS line preserved on js-reference as the conformance spec. 24/24 conformance + driver + gate; CI green. See CHANGELOG 2.0.0.

Author: aid-ninja

.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
 	},
 	"metadata": {
 		"description": "bean — a recursive convergence loop for large tasks: investigate, record evidence, compile, revise beliefs, repeat until converged. Runs on the grainulator runtime. Modeled on how the Fable model actually worked.",
-		"version": "1.2.0"
+		"version": "2.0.0"
 	},
 	"plugins": [
 		{
@@ -16,7 +16,7 @@
 				"url": "https://github.com/grainulation/bean.git"
 			},
 			"description": "Execution-discipline skill for Claude Code and Codex",
-			"version": "1.2.0",
+			"version": "2.0.0",
 			"author": {
 				"name": "Grainulation"
 			},

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "bean",
-	"version": "1.2.0",
+	"version": "2.0.0",
 	"description": "Run a task as a recursive convergence loop: investigate the most decisive open question, record evidence in a claim ledger, let a compiler score what is still weak or contradictory, revise beliefs, and loop until it converges. Runs on grainulator/wheat (or a built-in ledger). Verbose by default.",
 	"author": {
 		"name": "Grainulation"

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "bean",
-	"version": "1.2.0",
+	"version": "2.0.0",
 	"description": "A documentation-only Codex plugin adding one explicit /bean skill: run a task as a recursive convergence loop — investigate, record evidence in a ledger, compile, revise beliefs, and loop until converged.",
 	"author": {
 		"name": "Grainulation"

.github/workflows/ci.yml

@@ -32,3 +32,16 @@ jobs:
       - name: Zero runtime-dependency guard
         run: |
           node -e "const p=require('./package.json'); if (p.dependencies && Object.keys(p.dependencies).length) { console.error('bean ships zero runtime dependencies (devDependencies only)'); process.exit(1); } console.log('ok: zero runtime dependencies');"
+
+  # The Rust runtime (bean 2.0) is gated by the differential conformance oracle: the JS
+  # bean-check is the reference, the Rust port must match it on every fixture.
+  conformance:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Differential conformance (JS reference vs Rust)
+        run: node test/conformance.mjs

.github/workflows/release.yml

@@ -0,0 +1,68 @@
+name: release
+
+# Cut a release by pushing a tag: git tag v2.0.0 && git push origin v2.0.0
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+
+jobs:
+  # Build the runtime on a NATIVE runner per platform (no cross-compilation), package the four
+  # binaries into a per-target tarball, and upload as a workflow artifact.
+  build:
+    strategy:
+      matrix:
+        include:
+          - os: macos-latest
+            target: aarch64-apple-darwin
+          - os: macos-13
+            target: x86_64-apple-darwin
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+          - os: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Build (release)
+        run: cargo build --release --manifest-path rs/Cargo.toml
+      - name: Package
+        run: |
+          set -eu
+          dir="bean-${GITHUB_REF_NAME}-${{ matrix.target }}"
+          mkdir -p "$dir"
+          cp rs/target/release/bean-check rs/target/release/bean-verify \
+             rs/target/release/bean-run rs/target/release/bean-hook "$dir"/
+          cp README.md LICENSE "$dir"/ 2>/dev/null || true
+          tar -czf "$dir.tar.gz" "$dir"
+          shasum -a 256 "$dir.tar.gz" > "$dir.tar.gz.sha256"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.target }}
+          path: |
+            bean-*.tar.gz
+            bean-*.tar.gz.sha256
+
+  # Gather all platform tarballs and publish the GitHub release.
+  release:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          path: dist
+          merge-multiple: true
+      - name: Publish release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: dist/*
+          generate_release_notes: true
+          body: |
+            bean ${{ github.ref_name }} — Rust runtime (gate + verify + driver + native Stop hook).
+
+            Prebuilt binaries per platform are attached. Or build from source:
+            `git clone … && ./install.sh` (requires Rust; the binary itself has no runtime deps).

.gitignore

@@ -6,3 +6,8 @@ review/
 bean-stalk.md
 **/.bean/state.json
 
+rs/target/
+/bin/bean-check
+/bin/bean-verify
+/bin/bean-run
+/bin/bean-hook

CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 2.0.0 — unreleased (Rust runtime)
+
+bean 2.0 reimplements the runtime as a **single Rust static binary** (no install dependency —
+Node was itself the dependency that undercut "runs anywhere"), reconverging with the Bran core,
+and **couples it to execution natively** in both Claude Code and Codex via their Stop hooks. The
+JS line is preserved on the `js-reference` branch as the behavior spec; it is not shipped.
+
+### The runtime (`rs/`, four binaries)
+
+- **`bean-check`** — the compiler: static checks, temporal checks (state/dry-round/budget), and
+  the 2.0 **oracle gate** (verification mode `compat`/`advisory`/`strict`, `verified_by`,
+  recorded verdicts, `converged-with-residuals` exit 4). Certificate is byte-identical to the JS
+  reference when no 2.0 field is present, and binds the full regime when the gate is active.
+- **`bean-verify`** — the only execution path for oracles: runs a declared command (argv, no
+  shell, claim JSON on stdin) and writes a scrubbed verdict; `bean-check` adjudicates it.
+- **`bean-run`** — the driver: per round it injects the compiler signal into the agent's prompt,
+  records emitted claims, and enforces linear progress (stuck detection). Model-agnostic
+  `--agent` command.
+- **`bean-hook`** — the native Stop hook for Claude Code and Codex (shared contract): blocks the
+  agent from finishing a bean-tracked task until the loop converges; inert when no `.bean/`
+  ledger exists; honors the loop guard. `--register` wires it into settings.json / hooks.json.
+
+### Bootstrap mechanic + tests
+
+The JS `bean-check` is the independent reference; the Rust port is held to it by a **differential
+conformance oracle** (`test/conformance.mjs`): 14 differential checks (static + temporal,
+certificates byte-identical) + 2 driver-smoke + 8 oracle-gate behavioral = **24/24**, run in CI
+alongside the Node tests.
+
+### Install
+
+`./install.sh` builds the binaries and registers the native Stop hook for both clients — "install,
+then it just works." Requires Rust; the shipped binary has no runtime dependency.
+
 ## 1.2.0 — 2026-06-19
 
 The "not quite there" release. The core failure was _satisficing_: the loop under-delivered

hooks/hooks.json

@@ -0,0 +1,15 @@
+{
+	"hooks": {
+		"Stop": [
+			{
+				"matcher": "",
+				"hooks": [
+					{
+						"type": "command",
+						"command": "\"${CLAUDE_PLUGIN_ROOT}\"/bin/bean-hook"
+					}
+				]
+			}
+		]
+	}
+}

install.sh

@@ -1,39 +1,63 @@
 #!/usr/bin/env bash
 #
-# bean installer (fallback to the plugin marketplace).
-# Copies the bean skill + command into your Claude Code config, and the skill into
-# your Codex config when present. Documentation-only: no dependencies, no servers.
+# bean installer — builds the Rust runtime and wires it into Claude Code (and Codex).
+#
+# What you get after this:
+#   - the bean runtime binaries (bean-check, bean-verify, bean-run, bean-hook) built into ./bin
+#   - the /bean skill installed
+#   - a native Stop hook registered so bean COUPLES to execution: an agent can't finish a
+#     bean-tracked task (one with a .bean/ ledger) until the loop converges. Inert otherwise.
 #
 # Usage:
-#   ./install.sh                 # install for the current user
-#   CLAUDE_CONFIG_DIR=... ./install.sh
+#   ./install.sh                         # build + install for the current user
+#   CLAUDE_CONFIG_DIR=... ./install.sh   # custom Claude config dir
 #
+# Requires: Rust (cargo). No runtime dependencies — the binaries are self-contained.
 set -euo pipefail
 
 REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-
 CLAUDE_DIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
 CODEX_DIR="${CODEX_CONFIG_DIR:-$HOME/.codex}"
 
+build_runtime() {
+	command -v cargo >/dev/null 2>&1 || {
+		echo "  ERROR: cargo (Rust) is required to build the bean runtime." >&2
+		echo "         Install from https://rustup.rs and re-run." >&2
+		exit 1
+	}
+	echo "  building the Rust runtime (release)..."
+	cargo build --release --quiet --manifest-path "$REPO_DIR/rs/Cargo.toml"
+	mkdir -p "$REPO_DIR/bin"
+	for b in bean-check bean-verify bean-run bean-hook; do
+		cp "$REPO_DIR/rs/target/release/$b" "$REPO_DIR/bin/$b"
+	done
+	echo "  binaries -> $REPO_DIR/bin (bean-check, bean-verify, bean-run, bean-hook)"
+}
+
 install_claude() {
 	mkdir -p "$CLAUDE_DIR/skills"
 	rm -rf "$CLAUDE_DIR/skills/bean"
 	cp -R "$REPO_DIR/skills/bean" "$CLAUDE_DIR/skills/bean"
-	echo "  installed bean -> $CLAUDE_DIR/skills/bean (provides /bean)"
+	echo "  skill -> $CLAUDE_DIR/skills/bean (provides /bean)"
+	# register the native Stop hook (idempotent JSON merge into settings.json)
+	"$REPO_DIR/bin/bean-hook" --register "$CLAUDE_DIR" | sed 's/^/  /'
 }
 
 install_codex() {
 	if [ -d "$CODEX_DIR" ]; then
 		mkdir -p "$CODEX_DIR/skills"
 		rm -rf "$CODEX_DIR/skills/bean"
 		cp -R "$REPO_DIR/skills/bean" "$CODEX_DIR/skills/bean"
-		echo "  installed bean -> $CODEX_DIR/skills/bean"
+		echo "  skill -> $CODEX_DIR/skills/bean"
+		# Codex's Stop hook uses the SAME contract as Claude's; register into hooks.json
+		"$REPO_DIR/bin/bean-hook" --register "$CODEX_DIR" hooks.json | sed 's/^/  /'
 	else
 		echo "  (Codex config dir $CODEX_DIR not found — skipping Codex install)"
 	fi
 }
 
 echo "Installing bean..."
+build_runtime
 install_claude
 install_codex
-echo "Done. Restart your client, then invoke /bean."
+echo "Done. Restart Claude Code. In a project, run /bean; the Stop hook keeps the loop honest."