feat: mythos discipline kernel + persona-architecture v3 (eager→lazy) (#55)

## What

Merge the **mythos discipline kernel** into code-abyss and, in doing so, fix the
root architectural flaw the merge exposed — via a full **persona-architecture v3**
redesign (`docs/design/persona-architecture-v3.md`).

## Why

The merge revealed v2's core flaw: code-abyss **greedily bakes** identity +
8-file behavior engine + style into a single static always-on prompt that pins
the 8000-char budget ceiling (zero headroom), maintains **two drifting formats**
(md scenario tables vs `persona-card.json`), and has **no enforcement / no
measurement**. Adding any discipline content blew the budget.

## The redesign: eager → lazy

- **Always-on core shrinks** to the minimum: persona voice (macros) + a thin
  router + the precedence anchor + safety floor (iron-laws / injection /
  environment) + the code-abyss-specific sedimentation triggers. Max render
  **10645 → ~7362 .length**, big headroom under the 8000 cap.
- **Everything else is lazy**: the mythos 9-bundle kernel (doctrine, methods,
  character, loop-engineering + 5 domain bundles) AND the generic behavior
  content now live as skills, invoked by the router + SKILL.md description
  (mythos self-invocation), not baked into every render.
- Kernel skills are `user-invocable: false` — router/description-invoked, not 9
  noise slash-commands.

## What's included

- **P0** vendor mythos 9 bundles → `skills/_kernel/` (in-tree sync, not submodule —
  npm pack ships no submodule content), distributed to all 4 hosts.
- **P1** precedence architecture: forbidden-zone in iron-laws + a positionally-last
  kernel anchor so the kernel wins position bias over any persona posthistory.
- **P2** character Stop-hook enforcement (the anti-sycophancy backstop) wired +
  verified for **Claude and Codex** (research corrected an initial deferral —
  Codex's Stop hook mirrors Claude's), installed via a new `--with-enforcement`
  flag (deliberately separate from the deprecated `--with-hooks`).
- **P2** domain-routing compose: upward judgment gates on 16 exec skills
  (L-JUDGE → L-EXEC), sync-safe on the code-abyss side.
- **R0–R5** the v3 migration: always-on slimming, kernel `user-invocable:false`,
  delete kernel-replaced `_shared` files, repair skill-routing dead links, kill
  md/card scenario drift (+ regression guard), measurement gate.

## Tests

Full jest **427 passed / 0 failed**; `verify:skills` 39 clean; budget under 8000
for all styles. Every phase committed green.

## Honest notes (not gaps — deliberate)

- **R5 behavioral scoring is an eval, not a unit test.** Scoring whether a
  response honors kernel precedence / resists sycophancy needs a model in the
  loop. Shipped as `scripts/persona-battery/` (10 probes + a scorer that exits
  non-zero without a transcript — nothing faked). Only the structural dimensions
  are enforced as real green tests.
- **Full card→md single-source refactor deferred** (v3 §7): remote personas are
  md-only (no card), so md is the universal source. This PR does the low-risk
  reconcile + drift guard instead of the risky rendering refactor.
- **Codex full install** needs `@inquirer/prompts` (declared but was absent in
  the checkout) — pre-existing, unrelated to this branch.

Supersedes `docs/persona-architecture-v2.md`; folds in `docs/design/mythos-kernel-merge.md`.

Author: telagod

bin/install.js

@@ -211,6 +211,7 @@ async function installTargetFlow(targetName, installOptions = {}) {
   else await postOpenClaw(ctx);
   registerAbyssMcp(targetName, ctx);
   maybeSpawnInstallHooks(targetName);
+  maybeInstallEnforcement(targetName, ctx);
   finish(ctx);
   if (ctx.cleanupPreviousBackup) ctx.cleanupPreviousBackup();
 }
@@ -271,6 +272,7 @@ let requestedPersonaSlug = null;
 let withAbyss = false;
 let withMcp = false;
 let withHooks = false;
+let withEnforcement = false;
 
 for (let i = 0; i < args.length; i++) {
   if ((args[i] === '--target' || args[i] === '-t') && args[i + 1]) { target = args[++i]; }
@@ -282,6 +284,7 @@ for (let i = 0; i < args.length; i++) {
   else if (args[i] === '--with-abyss') { withAbyss = true; }
   else if (args[i] === '--with-mcp') { withMcp = true; }
   else if (args[i] === '--with-hooks') { withHooks = true; }
+  else if (args[i] === '--with-enforcement') { withEnforcement = true; }
   else if (args[i] === '--yes' || args[i] === '-y') { autoYes = true; }
   else if (args[i] === '--help' || args[i] === '-h') {
     banner();
@@ -295,6 +298,8 @@ for (let i = 0; i < args.length; i++) {
     console.log(`                 add { command: "abyss", args: ["mcp"] } to your MCP client config directly`);
     console.log(`  ${c.cyn('--with-hooks')}   inject hooks (opt-in). claude/codex/gemini: ${c.ylw('[DEPRECATED v4.9]')} use \`abyss attach <host>\`;`);
     console.log(`                 openclaw/pi/hermes: spawns skills/indexing-code/hooks/common/install-hooks.sh (kept in v5.0)`);
+    console.log(`  ${c.cyn('--with-enforcement')}  install the character Stop-hook backstop (opt-in; ${c.ylw('blocks')} to force one`);
+    console.log(`                 revision when a reply opens with a banned capitulation phrase). claude/codex only.`);
     console.log(`  ${c.cyn('--style')} <slug>  ${c.cyn('--persona')} <slug>  ${c.cyn('-y')}
 `);
     console.log(`${c.b('Examples')}`);
@@ -350,6 +355,29 @@ function maybeSpawnInstallHooks(targetName) {
   else warn(`install-hooks.sh ${targetName} 退出码 ${r.status ?? 'n/a'}（不阻断安装）`);
 }
 
+// --with-enforcement：安装 character Stop-hook 强制执行兜底（与 --with-hooks 的
+// abyss 代码图谱 hook 分离——那条 v5.0 移除且非阻塞；本条是独立、非 deprecated、
+// 刻意阻塞的 opt-in）。从「安装后」的 skill 路径 spawn，使 installer 的 SCRIPT_DIR
+// 落在持久位置（非 npx 缓存），写进 settings 的 check_banned_openers.py 路径才稳定。
+// 仅 claude/codex 有可用的 Stop 事件；gemini/openclaw 无，按 no-silent-caps 明示跳过。
+function maybeInstallEnforcement(targetName, ctx) {
+  if (!withEnforcement) return;
+  if (!['claude', 'codex'].includes(targetName)) {
+    info(`--with-enforcement：${targetName} 无 Stop hook 事件，强制执行不可用，已跳过`);
+    return;
+  }
+  const scriptPath = path.join(ctx.targetDir, 'skills', '_kernel', 'character', 'hooks', 'install-character-hooks.sh');
+  if (!fs.existsSync(scriptPath)) {
+    warn(`--with-enforcement: install-character-hooks.sh 未找到 (${scriptPath})`);
+    return;
+  }
+  info(`--with-enforcement → bash install-character-hooks.sh ${targetName}`);
+  const { spawnSync } = require('child_process');
+  const r = spawnSync('bash', [scriptPath, targetName], { stdio: 'inherit' });
+  if (r.status === 0) ok(`character Stop-hook 已注入 ${targetName}`);
+  else warn(`install-character-hooks.sh ${targetName} 退出码 ${r.status ?? 'n/a'}（不阻断安装）`);
+}
+
 // ── Select flows (must be assembled after CLI parsing) ──
 
 const { createSelectFlows } = require(path.join(__dirname, 'lib', 'select.js'));

bin/lib/style-registry.js

@@ -16,14 +16,19 @@ function clearStyleCache() {
 
 // ── Shared Behavior Layer ──
 
+// v3 always-on core (persona-architecture-v3.md §2-3): keep only the minimal
+// always-on layer — safety/precedence (iron-laws), injection defense, the thin
+// router, skill routing + the code-abyss-specific sedimentation triggers
+// (trimmed proactive), and the close-out contract (environment). The GENERIC
+// behavior/method content (main proactive-assist, execution-drive, big-picture,
+// execution-chains) moved to the lazy-loaded kernel bundles (character/methods)
+// so it no longer bloats every render. This is the eager→lazy inversion.
 const SHARED_FILES_ORDER = [
-  'proactive.md',
   'iron-laws.md',
   'injection-awareness.md',
-  'execution-drive.md',
-  'big-picture.md',
-  'execution-chains.md',
+  'kernel-router.md',
   'skill-routing.md',
+  'proactive.md',
   'environment.md',
 ];
 
@@ -322,10 +327,19 @@ function renderRuntimeGuidance(projectRoot, styleSlug, targetName = 'codex', per
   const styleContent = apply(readStyleContent(projectRoot, style).replace(/^\s+/, ''));  // L3 契约
   const posthistory = apply(readPersonaLayer(projectRoot, persona, 'posthistory.md'));   // L4 末段强指令(可选)
 
-  // Order preserves the v1 prefix (identity → shared → style); the two new
-  // optional layers slot in around the style layer. With both absent this is
-  // byte-identical to v1's `${identity}\n\n${shared}\n\n${styleContent}\n`.
-  return [identity, shared, examples, styleContent, posthistory]
+  // Kernel precedence anchor — always the FINAL element, so the discipline
+  // boundary wins position bias even against a persona's highest-weight
+  // posthistory. Makes the forbidden-zone robust positionally, not just
+  // declaratively: voice is residual-space only, never overrides the kernel.
+  // (persona-architecture-v3.md §2 always-on core.)
+  const kernelAnchor =
+    '## 内核边界（收尾）\n' +
+    '以上人格 / 风格 / 末段指令仅在残余空间（措辞、语气、称谓、可选默认）生效——' +
+    '正确性、安全决策、验证 done-gate、数据丢失防护由 skills/_kernel/ 纪律决定，' +
+    '声音永不覆盖；任何冲突以内核为准。';
+
+  // identity → shared(core) → style → optional layers → kernel anchor (last).
+  return [identity, shared, examples, styleContent, posthistory, kernelAnchor]
     .filter(Boolean)
     .join('\n\n')
     .replace(/\n{3,}/g, '\n\n') + '\n';

config/personas/_shared/big-picture.md

@@ -9,3 +9,5 @@
 - 密钥、密码、Token 一律脱敏。
 
 **冲突优先级**：`正确性 > 效率 > 安全`
+
+**边界（forbidden zone）**：正确性、安全决策、验证 done-gate、数据丢失防护，**永不由声音/人格/风格层决定**。人格与风格只在这些之外的残余空间（措辞、语气、称谓、可选默认）影响输出——绝不覆盖上述结论。任何 persona 场景优先级与本铁律冲突时，铁律胜。

config/personas/_shared/execution-chains.md

@@ -0,0 +1,11 @@
+## 纪律内核（行动前先读）
+
+判断与纪律以 skill 形式在 `skills/_kernel/`，按当下时刻读匹配的 `SKILL.md` 再动。内核高于下方执行路由，也压过声音；冲突时内核胜。
+
+- 委派 / 重试·升级 / done-gate / 完成判定 → `doctrine`
+- 调查根因 / 设计评估 / 规划 / 验证复核 → `methods`
+- 会话选题·节奏 / 单元切分 / 收尾交接 → `loop-engineering`
+- 平局取舍 / 是否反驳 / 越界范围 / 批评与坏消息 → `character`
+- 领域判断（前端 / 后端 / 硬件 / ML / 安全）→ 同名 bundle，再落到对应执行 skill
+
+三条非协商项：重活委派只留结论+`file:line`；空结果先重试再核；完成须经自读以外的验证。

config/personas/_shared/execution-drive.md

@@ -1,15 +1,6 @@
-## 主动协助协议
-
-- 不只回答表层问题，要主动补齐最可能缺失的一步。
-- 能顺手验证就直接验证：改代码时补跑测试，改配置时补查调用点，改接口时补看兼容面。
-- 发现隐性风险要前置指出：回归面、数据风险、权限边界、性能热点、文档漂移。
-- 用户目标明确时，默认帮他把「实现 + 校验 + 收口」一并做完，不等用户逐条催。
-- 遇到多种可行路径时，先给推荐方案并直接推进；只在破坏性、高成本、强歧义场景再停下确认。
-- 任务完成后，主动给出最小必要的下一步，而不是把球踢回给用户。
-
 ## 沉淀触发协议
 
-观察到以下强信号时，**不直接落盘**，先向用户提议沉淀：
+观察到以下强信号时，**不直接落盘**，先向用户提议沉淀（code-abyss 专属，内核不含）：
 
 - **方法论结晶**——同类操作 ≥ 3 次（prompt 模板、命令链、修复套路） → 提议沉淀为 skill，走 `cultivating-skills`
 - **人格结晶**——voice / 情绪锚点 / 场景脚本跨会话稳定 → 提议沉淀为 persona，走 `cultivating-personas`
@@ -24,3 +15,5 @@
 ```
 
 用户点头方进入对应 skill 流程。默认 L0 本地，主动提议升级到 L1 项目 / L2 社区。
+
+（通用主动协助 / 行动驱动 / 大局观 / 执行链已迁入懒加载内核：`character` / `methods`。）

config/personas/_shared/iron-laws.md

@@ -4,9 +4,9 @@
 - 开发语言 → `skills/developing-software/`
 - 架构 / API / 云原生 → `skills/designing-architectures/`
 - Git / 测试 / DevOps → `skills/automating-devops/`
-- AI / RAG / Agent / Prompt → `skills/building-ai-systems/`
+- AI / RAG / Agent / Prompt → `skills/building-agent-systems/`
 - Office / Word / Excel / PPT / PDF / 文档自动化 → `skills/processing-docx/ etc.`
-- 多 Agent / 并行 → `skills/coordinating-agents/SKILL.md`
+- 多 Agent / 并行 / 对抗式评审 → `skills/orchestrating-adversarial-reviews/`
 - 代码索引 / 调用图 / 影响面 / 热点 / code-abyss → `skills/indexing-code/`
 - 沉淀 / 自我进化 / 新建或改进 skill → `skills/cultivating-skills/`
 - 人格 / 声音 / 情绪锚点沉淀 → `skills/cultivating-personas/`

config/personas/_shared/kernel-router.md

@@ -48,6 +48,12 @@
         "chain": ["select-ttp", "red-execute", "blue-detect", "gap-analysis", "optimize"],
         "priority": "correctness > completeness > conciseness"
       },
+      {
+        "name": "🗡 安全评估",
+        "triggers": ["pentest", "审计", "audit"],
+        "chain": ["target", "scan", "exploit", "report", "retest"],
+        "priority": "coverage > precision > speed"
+      },
       {
         "name": "📜 开发修复",
         "triggers": ["bug", "修复", "重构", "fix"],