2.0.1: fix-first hardening from the cross-model (Codex) review

Codex reviewed the shipped 2.0 and found several fail-open bugs (worst kind in a gate) +
conformance gaps. All fixed with regression coverage:

- bean-hook fails CLOSED on an active ledger (checker missing/crash/unknown-status -> block).
- invalid run.json / state.json -> exit 3 (was: silent compat fallback / temporal reset).
- a `residual` tag no longer launders a failing/stale/undeclared verifier (it blocks).
- bean-verify: a nonzero exit can't be upgraded to pass by stdout JSON.
- inputs_hash is byte-based and recurses into directories (dirs previously -> "absent");
  identical in bean-check and bean-verify.
- bean-run treats converged-with-residuals (exit 4) as terminal.
- Rust emits the coverage warnings it had dropped; multi-claim claims_hash matches the
  reference (\x01 line join). Differential now compares warnings + multi-claim temporal +
  residual+failing-oracle (27 checks).
- certificate binds a canonical oracle-spec hash (cmd+inputs); schemas carry the 2.0 fields;
  SECURITY.md describes bean-run's --agent surface; release workflow smoke-tests artifacts;
  marketplace Stop hook degrades via a shim when no binary is present.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: aid-ninja

.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
 	},
 	"metadata": {
 		"description": "bean — a recursive convergence loop for large tasks: investigate, record evidence, compile, revise beliefs, repeat until converged. Runs on the grainulator runtime. Modeled on how the Fable model actually worked.",
-		"version": "2.0.0"
+		"version": "2.0.1"
 	},
 	"plugins": [
 		{
@@ -16,7 +16,7 @@
 				"url": "https://github.com/grainulation/bean.git"
 			},
 			"description": "Execution-discipline skill for Claude Code and Codex",
-			"version": "2.0.0",
+			"version": "2.0.1",
 			"author": {
 				"name": "Grainulation"
 			},

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "bean",
-	"version": "2.0.0",
+	"version": "2.0.1",
 	"description": "Run a task as a recursive convergence loop: investigate the most decisive open question, record evidence in a claim ledger, let a compiler score what is still weak or contradictory, revise beliefs, and loop until it converges. Runs on grainulator/wheat (or a built-in ledger). Verbose by default.",
 	"author": {
 		"name": "Grainulation"

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
 	"name": "bean",
-	"version": "2.0.0",
+	"version": "2.0.1",
 	"description": "A documentation-only Codex plugin adding one explicit /bean skill: run a task as a recursive convergence loop — investigate, record evidence in a ledger, compile, revise beliefs, and loop until converged.",
 	"author": {
 		"name": "Grainulation"

.github/workflows/release.yml

@@ -33,6 +33,18 @@ jobs:
           targets: ${{ matrix.target }}
       - name: Build (release)
         run: cargo build --release --target ${{ matrix.target }} --manifest-path rs/Cargo.toml
+      - name: Smoke the built binaries
+        # only run native binaries (cross-built targets can't execute on this host)
+        if: ${{ !(matrix.os == 'macos-latest' && matrix.target == 'x86_64-apple-darwin') }}
+        run: |
+          set -eu
+          out="rs/target/${{ matrix.target }}/release"
+          "$out/bean-check" --help >/dev/null
+          "$out/bean-check" --dir test/fixtures/converged --no-state >/dev/null   # exit 0 ready
+          if "$out/bean-check" --dir test/fixtures/open-risk --no-state; then
+            echo "expected blocked exit"; exit 1
+          fi
+          echo "smoke ok for ${{ matrix.target }}"
       - name: Package
         run: |
           set -eu

CHANGELOG.md

@@ -1,6 +1,36 @@
 # Changelog
 
-## 2.0.0 — unreleased (Rust runtime)
+## 2.0.1 — fix-first hardening (independent review)
+
+A cross-model (Codex) review of the shipped 2.0 runtime found several **fail-open** bugs (the
+worst kind in a gate) and conformance gaps. All fixed, with regression coverage:
+
+- **Fail closed, not open.** The Stop hook (`bean-hook`) now BLOCKS on an active `.bean` ledger
+  if `bean-check` can't run / returns no JSON / returns an unknown status (was: allow stop).
+  An existing-but-invalid `run.json` or `state.json` now errors (exit 3) instead of silently
+  reverting to compat / resetting temporal state.
+- **A residual can't launder a failing oracle.** A claim that declares a verifier which then
+  fails/staled/errored now BLOCKS regardless of a `residual` tag; residual fallback applies
+  only when no verifier is declared at all.
+- **`bean-verify`: a nonzero exit can't be upgraded to `pass`** by a `{"verdict":"pass"}` on
+  stdout (JSON may only downgrade/explain).
+- **Real freshness for directory inputs.** `inputs_hash` is now byte-based and recurses into
+  declared directories (a `inputs: ["src/"]` previously collapsed to "absent", so changes were
+  never detected). Identical in `bean-check` and `bean-verify`.
+- **`bean-run` treats `converged-with-residuals` (exit 4) as terminal** instead of looping to
+  stuck.
+- **Conformance parity restored & widened.** Rust now emits the coverage warnings
+  (`W_SINGLE_SOURCE`/`W_MONOCULTURE`) it had dropped; the multi-claim `claims_hash` delimiter
+  now matches the reference (`\x01` line join — single-claim tests had hidden the drift). The
+  differential now compares warnings, with new multi-claim temporal and residual+failing-oracle
+  cases (27 conformance + driver + gate checks).
+- **Polish:** certificate binds a canonical hash of each oracle spec (cmd+inputs); schemas carry
+  the 2.0 fields (`verification`/`oracles`/`verified_by`); `SECURITY.md` describes the real
+  execution surface (incl. `bean-run`'s `--agent` command); the release workflow smoke-tests each
+  built binary before upload; the marketplace Stop hook degrades gracefully via a shim when no
+  binary is present.
+
+## 2.0.0 — Rust runtime
 
 bean 2.0 reimplements the runtime as a **single Rust static binary** (no install dependency —
 Node was itself the dependency that undercut "runs anywhere"), reconverging with the Bran core,

SECURITY.md

@@ -10,15 +10,19 @@ bean is a small skill plus a self-contained runtime (Rust binaries, no runtime d
 no telemetry). `bean-check` is a pure adjudicator — it only reads/writes local `.bean/*`
 files and makes no network calls.
 
-The one execution surface to know about is the **2.0 oracle gate**: `bean-verify` (and the
-`bean-run` driver) run **commands you declare** in `.bean/run.json` `oracles` — arbitrary
-local code, by design, and they can reach the network if a declared command does. They run
-with `shell:false` (argv only, no shell interpolation) and only when you opt in
-(`verification.mode: strict`/`advisory` with a `verified_by` claim). Treat a `run.json` like
-a makefile: only run a ledger whose oracle commands you trust. The native Stop hook
-(`bean-hook`) only ever runs `bean-check` (no oracle execution) and is inert without a
-`.bean/` ledger. The other likely concern is prompt-injection or misleading guidance in the
-skill text.
+The execution surfaces to know about (all `shell:false` — argv only, no shell interpolation):
+
+- **`bean-verify`** runs the **oracle commands you declare** in `.bean/run.json` `oracles` —
+  arbitrary local code, by design, which can reach the network if a declared command does.
+- **`bean-run`** runs the **`--agent` command you pass it** each round, and triggers oracles
+  via `bean-verify`. It is an explicit driver you invoke, not something the hook starts.
+- **`bean-check`** and **`bean-hook`** execute no oracles. `bean-check` is a pure adjudicator
+  (reads ledger/verdicts only); `bean-hook` only runs `bean-check`, and is inert without a
+  `.bean/` ledger.
+
+Treat a `run.json` like a makefile: only run a ledger whose oracle commands (and any agent
+command) you trust. The other likely concern is prompt-injection or misleading guidance in
+the skill text.
 
 Please report any concern via GitHub Security Advisories on this repository (preferred),
 or by email to security@grainulator.app.

hooks/bean-stop.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# bean Stop-hook shim (marketplace path). Locates the bean-hook binary and execs it (passing
+# the Stop payload through on stdin). If the binary isn't present yet — e.g. a marketplace
+# install where you haven't run ./install.sh or dropped a prebuilt binary — it exits 0 (allow
+# the stop) so the hook degrades gracefully instead of erroring on every turn.
+bin="$(command -v bean-hook 2>/dev/null || true)"
+if [ -z "$bin" ] && [ -x "${CLAUDE_PLUGIN_ROOT:-}/bin/bean-hook" ]; then
+	bin="${CLAUDE_PLUGIN_ROOT}/bin/bean-hook"
+fi
+[ -z "$bin" ] && exit 0
+exec "$bin"

hooks/hooks.json

@@ -6,7 +6,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "\"${CLAUDE_PLUGIN_ROOT}\"/bin/bean-hook"
+						"command": "\"${CLAUDE_PLUGIN_ROOT}\"/hooks/bean-stop.sh"
 					}
 				]
 			}

package-lock.json

@@ -1,6 +1,6 @@
 {
 	"name": "@grainulation/bean",
-	"version": "2.0.0",
+	"version": "2.0.1",
 	"description": "A recursive convergence loop for Claude Code and Codex: investigate, record evidence in a claim ledger, compile, revise beliefs, and loop until converged. Ships bean-check, a zero-dependency convergence compiler that exits nonzero until the loop converges; grainulator/wheat optional. Verbose by default.",
 	"type": "module",
 	"private": false,