v7.70.0

Pairs with engine-service-v0.1.145, unchanged from 7.69.0: no engine cut, no
changeset, no deploy. A client-only release. The plugin shrinks: the 41 entries
conexus/PENDING_RELEASE.md held become live at this pin (the cleanup's hook,
command, skill and agent deletions, and the doc-drift command fixes); see
conexus/CHANGELOG.md.

Fixed

• Doc drift an outside critique measured is corrected: the RDR index, a promised hook, five slash commands, two unresolved citations and the stale bead export (nexus-aruua; from the 2026-10-03 outside critique, T2 nexus/outside-critique-nexus-ecosystem-2026-10-04). docs/rdr.md no longer promises a session-start reconciliation hook that never ran and was deleted; it says nx rdr set-status writes file and T2 together. docs/rdr/README.md gains the two rows it omitted (RDR-123, RDR-124, both superseded by RDR-127), corrects RDR-120 and RDR-130 to Closed, and restores RDR-201's title cell, which held the word "Closed". conexus/commands/rdr-list.md and the nexus.hooks.rdr_verb docstring stop describing a SessionStart reconciliation or a set-status that never writes T2: the verb mirrors a flip onto T2 best-effort and nx rdr preamble rdr-audit prints the drift that remains. The five commands that said "all data is pre-loaded above, no additional tool calls needed" (devonthink-index, rdr-list, rdr-gate, rdr-fix, rdr-accept) now say the data is the ! preamble's output and tell the agent to gather it when the preamble did not run, instead of forbidding the fetch. The nexus skill's hydration example no longer attributes the 300-record cap to ChromaDB. RDR-090's RDR-326 and RDR-170's RDR-651 citations, which name no record in this repo, now say so inline (651 is the conexus-side cutover). .beads/issues.jsonl, a May 2026 export of 255 rows that readers took for the store, is untracked and ignored like interactions.jsonl; tests/fixtures/bead_ids.txt remains the committed bead artifact, and the agent docs no longer tell anyone to commit the export.
• nx doctor reads GET /v1/status on a mint-armed cloud box (nexus-z0o2p.40). fetch_engine_status sent whatever bearer the endpoint resolver returned, and on a box that authenticates with per-request data tokens the resolver returns an empty one by design, so the public edge answered 403 and the Ownerless writes and Engine reaper rows said "not applicable: the engine's status endpoint could not be read", in green, on every cloud install, while tests/e2e/cloud-client-path-gate.sh read the same endpoint because it mints the data token first. The probe now mints the data token for the resolved endpoint and the default tenant when no static token resolves; a static-token or local box is unchanged, and a mint failure still reads as "could not be read". Measured on the live 0.1.145 engine: the row now reports engine mode=log-only: no ownerless chunk write since the engine started, the reading RDR-223's flip criterion is taken from.

Removed

• The develop-freeze mechanism and the unused routing library in the wheel are deleted, with their tests (cleanup step A5, nexus-0r1uz). scripts/develop-freeze.sh and scripts/lib/develop-freeze.sh are gone, and scripts/git-push-develop.sh no longer reads board/develop-freeze: PUSH_REFUSED_FROZEN (exit 12), PUSH_REFUSED_FREEZE_UNKNOWN (exit 13), PUSH_FREEZE_OPEN, PUSH_FREEZE_OVERRIDDEN, PUSH_FREEZE_UNCHECKED and NX_PUSH_FREEZE_OVERRIDE no longer exist. The lock leg and the scope audit are unchanged, and under NX_PUSH_SKIP_LOCK the script no longer resolves the installed nx. tests/scripts/test_develop_freeze_sh.py, the fake nx the freeze tests used and the freeze class in the push-script tests are deleted, as are the freeze step in the release skill and the freeze paragraph in AGENTS.md rule 8. src/nexus/hooks/_routing_lib.py (949 lines) had no importer once the subagent git-write verb went at step A4; tests/test_routing_hooks.py and tests/test_routing_fail_closed_boundary.py now exercise the plugin-resident conexus/hooks/scripts/routing/_lib.py that the two live guards import, and the cases that only covered the wheel copy's lease-grace read are deleted. The hook-file floors in tests/hooks/test_t2_prefix_scan.py match the tree, and conexus/README.md says the core server registers 2 internal hook_* tools, not 12.

• The deploy tracker (nexus.deploy_tracker, nx service record-deploy) and the rehearsal hop manifest (scripts/gen_rehearsal_hop_manifest.py, tests/test_rehearsal_seed_coverage_lint.py, tests/data/rehearsal_old_tag_changesets.json) are deleted with their tests and docs (cleanup step 10b, nexus-0r1uz). Both were left behind by steps 10 and 9. The deployed-engine-version T2 tracker is no longer written; nx service probe reads the live /version. scripts/check_wire_contract_pairing.py has no deploy-record dependency and is unchanged. service/src/test changed in comments only, so they no longer cite the deleted files.

• The release battery is collapsed to three legs and one preflight; the one-shot e2e gates and the migration-rehearsal modes other than package-upgrade and acquire are deleted (cleanup step 11, nexus-0r1uz). tests/e2e/release-battery.sh now runs tests/e2e/release-preflight.sh and then, in one parallel group, fresh-install-mvv.sh (mvv), migration-rehearsal/run.sh --package-upgrade (pkgup) and local-service-gate.sh (lsg). The artifacts build leg, --artifacts reuse, the manifest and tree-identity helpers (build-artifacts.sh, lib/artifact_manifest.py, lib/tree_identity.py) and the candmig, smoke, shakedown, dtok, upshakeout, genflip, pluginls, hookskew, janitor, pins and shakeout legs are gone. release-preflight.sh absorbs scripts/pins-preflight.sh and the mandatory-pins gate: it runs check_engine_release_floor.py --ledger-only, the ci-evidence required-context tests, the mandatory_regression_pin selection (exact count, zero skip budget, gh token resolved from the real HOME) and the pin sweep (lint bucket with its non-vacuity floor, the non-lint pin tests, wire-contract pairing, ruff check src). Deleted: release-sandbox.sh (and its smoke, shakedown and tmux modes), upgrade-shakeout.sh, local-index-memory-gate.sh, published-client-write-gate.sh, data-token-cli-gate.sh, admission-load-gate.sh, rdr195-voyage-mvv.sh, rdr208-mvv/ (its three helper scripts moved to hook-surface-shakeout/, which uses them), warm-reindex-skip-gate.sh, gen-flip-live-holder.sh, plugin-lockstep-gate.sh, mandatory-pins-gate.sh, scripts/credential_janitor.py, the cc-catalog-decomposition-smoke.sh scenario, and the plugin-surface-smoke.yml workflow (its only job ran the deleted smoke). migration-rehearsal/run.sh accepts only --package-upgrade and --acquire (the post-publish gate against the published bytes, kept because the engine-release skill names it); the cold, era-hop, guided, stranded-redirect, hole-punch, fullstack, shakeout, shakeout-e2e, candidate-migration, comprehensive/stress and --with-cloud modes, their drivers, Dockerfiles and libs, and the cold-install-rehearsal, era-hop-mvv, guided-upgrade-mvv and stranded-redirect-rehearsal workflows are deleted. scripts/cut_plugin_release.py's cut battery drops its sandbox-smoke step. The nightly workflow's mandatory-pins step runs the same pytest selection inline. The tests that existed only for the deleted scripts go with them, and the lint allowlists, ceilings and floors that named them are lowered to the measured values. The release skill drops Steps 1c, 6, 6b and 6c, the engine-release skill drops Steps 3 and 3c, and docs/contributing.md drops 7b to 7f (numbers left as they were).

• The nx rdr preamble rdr-close and phase-review-gate verbs and nexus.phase_review_sentinel are deleted, with their tests; the two skills are trimmed (cleanup step 13, nexus-0r1uz). Both verbs had no caller once their slash commands were deleted, and the hook that read the phase-review sentinel went at step A2. rdr-close took the Problem Statement Replay gate (--pointers validation, the legacy-RDR grandfathering warning), the --force and --force-implemented audit lines, the Revision History check, the open-bead warning and the rdr-close-active T1 marker. phase-review-gate took the Pass 1 / Pass 2 §Approach cross-walk, its three parsers and the PASSED sentinel file. Kept: nx rdr set-status (the close flip), the §Implementation Plan extractor that rdr-gate's plan-grammar check uses, and the override-audit rows rdr-audit reads. conexus/skills/rdr-close/SKILL.md keeps the critic step (the override reason now comes from the user, not a flag), the post-mortem and the T3 archival; conexus/skills/phase-review-gate/SKILL.md is now a short manual checklist, and the docs, registry and README no longer say it blocks anything. Tests removed: tests/test_phase_review_sentinel.py (12) and the rdr-close and phase-review-gate cases in tests/test_rdr_preamble.py (63 test functions to 47), tests/test_rdr_process_records.py (28 to 23) and tests/test_rdr_set_status.py (50 to 47).

• The engine release floor is one script with one mode more, and the arming relay, the record-deploy leg and the lint-leg floor script are deleted (cleanup step 10, nexus-0r1uz). scripts/check_client_release_precondition.py is folded into scripts/check_engine_release_floor.py as --client-precondition [TAG]: same hand table, DATA EFFECT relay check, ledger check and exit codes (0, 1, 2), and its tests move over. Deleted: check_release_arming and the cross-repo attestation relay under docs/release-arming/ (the README and seven JSON attestations); --record-deploy-from-gate-report, --no-record-deploy, the exit-3 tracker refusal and $NX_GATE_REPORT_DIR handling in the floor script (the bare post-tag verify is now the floor plus source ancestry and writes nothing; nx service record-deploy --gate-report-dir is unchanged and is the way to record a deploy); --ack-client-lag in every mode and the acked bucket of classify_unshipped (a non-additive ## Unshipped entry now blocks until its client half ships). A non-additive pairing still must not tag before conexus has the redeploy staged, but that is now a human confirmation the release skill names, not a check. scripts/check_lint_leg_non_vacuity.py is replaced by an inline passed-count assertion at its three call sites (the lint job at 400, each test shard at 1500, and tests/e2e/release-preflight.sh); it reads pytest's own summary line, so a mass-skip that exits 0 still fails. The floor tests go from 169 to 39 functions, the signing workflow tests from 21 to 5, the draft/promote tests from 7 to 3 and the wire-contract lint from 27 to 8 by tabling cases that differed only in data; tests/test_wixar_lint_leg_substrate_none.py is deleted with the script it backstopped. .test_durations.json pruned.

• The bd-close review gate, Stop verification, the phase-review close gate and the StopFailure, PostCompact and divergence-language hooks are deleted with their MCP tools, config reader, registrations, tests and docs (cleanup steps A2 and A3, nexus-0r1uz). Source: nexus.hooks.pre_close_verification, stop_verification, verification_config, phase_review_close_gate, stop_failure, post_compact, divergence_language_guard and _plugin; nexus._hook_runtime._config (the NX_ORCH_STOP_GUARD resolver nothing reads any more); the plugin's routing/phase_review_close_requires_gate.py and divergence-language-scan.py. The nx-hook verbs pre-close-verification and phase-review-close-gate are gone (an older plugin that still names one gets the unknown-verb notice and exit 0, so a bd close is no longer gated on a review marker or a phase-gate sentinel). The five MCP tools hook_pre_close_verification, hook_stop_verification, hook_stop_failure, hook_post_compact and hook_divergence_language_guard are removed, so the MCP wire snapshot moves (59 tools to 54) and nexus.mcp.hooks keeps hook_auto_approve and hook_subagent_start; DECIDING_HOOKS is auto_approve alone and the _NEVER_TOOL_TIER carve-out for the deleted fail-closed rule goes with it. nexus.config loses get_verification_config, the verification defaults section and detect_test_command (the .nexus.yml verification: keys are ignored), nexus.garbage loses the close-gate-backstop/ sweep (directories an older client left are no longer reaped), and nexus._hook_runtime._io loses structured_field, stop_decision and HookResult.exit_code. nexus.phase_review_sentinel stays, but nothing reads the sentinel now. The routing registry keeps subagent_git_write_requires_orchestrator and credential_print_guard; PreToolUse Bash carries two hooks, down from four. Docs: the review-completed marker prohibition in the two reviewer agents, the code-review skill and the shared context protocol, docs/configuration.md § Verification, and the architecture and MCP-server tables.

• The subagent git-write guard is one copy, and its tests and the credential-print guard's are behaviour tables (cleanup step A4, nexus-0r1uz). src/nexus/hooks/subagent_git_write_gate.py (1,480 lines) and its subagent-git-write-gate nx-hook verb are deleted: hooks.json never ran them (every release, 7.58.0 on, wires the plugin script conexus/hooks/scripts/routing/subagent_git_write_requires_orchestrator.py directly), so the deny rules the plugin runs are unchanged. The routing_stats verb-to-rule mapping that existed only for that verb goes with it. tests/test_routing_subagent_git_write.py goes from 479 collected cases to 29 and now drives the plugin script instead of the wheel verb: the deny shapes are tables grouped by bypass family (write verbs, global flags, chained and nested, git spellings, quoting and escapes, shell-wrapped text, spliced expansions, accepted false positives), with the offending command in each assertion, plus the allow tables, the main-conversation, linked-worktree, escape-token and fail-closed cases, and the two copies' parity pins are gone. tests/test_routing_credential_print_guard.py goes from 173 to 9: one test per shape table, and the fail-closed cases kept. src/nexus/hooks/_routing_lib.py is no longer imported by any wheel verb; only tests read it, and it is left for step A5.

• The RDR tooling tests are collapsed to one test per behaviour (cleanup step 14, nexus-0r1uz). tests/test_rdr_preamble.py goes from 236 test functions to 63: cases that differed only in their input are now rows of parametrized tables (every old input is kept, each row's id names it and each assertion message names the failing row), and the two tests that grepped skill files for heading variants are deleted. tests/test_rdr_audit_skill.py (34 test functions to 3) and tests/test_rdr_audit_incident_template.py (16 to 1) keep only the wiring and the template's enum pins; their prose greps are deleted (test_plugin_structure.py owns skill structure). tests/test_rdr_set_status.py folds its 22 single-edge tests into one edge table. No source change and no behaviour pin removed.

• The RDR-184 expectations ledger, the RDR-205 tuple projection and the behaviour/capability census are deleted with their hooks, verbs, MCP tools, doctor rows and tests (cleanup step A1, nexus-0r1uz). Nothing in the repo reads or writes them any more. Source: nexus.hooks.expectations, ledger_verbs, agent_dispatch_expect, subagent_start_stamp, subagent_stop, subagent_stop_scans, subagent_start_tuple, subagent_stop_tuple, tuple_projection, tuple_ledger_project and behaviour_census; nexus.census, nexus._session_end_census and nx census (capability, dispatches); the plugin's behaviour_census.py. The nx-hook verbs expectations_expect, expectations_census, expectations_undeclared, expectations_reconcile, agent-dispatch-expect, subagent-start-stamp, subagent-stop, subagent-start-tuple, subagent-stop-tuple and behaviour-census are gone with the exit-code-propagation path only the expectations_ verbs used (an older plugin that still names one now gets the unknown-verb notice and exit 0). The five MCP tools hook_agent_dispatch_expect, hook_subagent_start_stamp, hook_subagent_stop, hook_subagent_start_tuple and hook_subagent_stop_tuple are removed, so the MCP wire snapshot moves (64 tools to 59) and nexus.mcp.hooks.DECIDING_HOOKS loses subagent_stop. SessionEnd no longer writes a capability census row; HttpTelemetryStore.record_capability_census and query_capability_census are gone (the engine table, its trim and the engine template ledger/<session_id> stay, and nx doctor --fix still trims old rows). nx doctor loses the tuple-projection supplementary row and the orchestration-hook plugin floor row. stop_verification keeps its close-gate backstop but no longer reconciles the ledger (it now carries its own ISO-timestamp and session-id helpers). mailbox_drain now holds its own endpoint resolution instead of importing the projector's. Also deleted: tests/e2e/post-publish-dispatch-check.sh and its test, cc-validation scenarios 21 and 27, leg 8d of the fresh-install MVV and leg G of the cloud client-path gate, the nx-hook AGENTS.md rule, and the orchestration skill's Background-Teammate Ledger and wait-for-a-report sections.

• Four pieces of RDR tooling that nothing called are deleted, each with its tests and docs (cleanup step 12, nexus-0r1uz). nx rdr lint (no invoker in CI, pre-commit, skills or hooks). nx rdr repeat and src/nexus/rdr_repeat.py (never wired). The nx rdr preamble rdr-show verb (the rdr-show skill does its own reads and never called it). The rdr-audit scheduling templates: scripts/cron-rdr-audit.sh, scripts/launchd/ and scripts/cron/ with their READMEs, and the /conexus:rdr-audit schedule and unschedule subcommands that printed them (list, status and history stay). nx rdr now has set-status and preamble.

• The RDR-201 release decision table and its copies are deleted; the verdicts live in the two gate scripts (cleanup step 6, nexus-0r1uz). docs/tables/release-choreography.toml, the router scripts/release_choreography.py, the message catalog scripts/release_messages.py, the enumerator scripts/enumerate_release_cells.py and its two fixtures (release_cells.json, release_cell_texts.json) are gone, with the tests that pinned them to each other (the parity harness, the enumerator and router tests, the release-incident cells and the preflight verdict-extraction test). scripts/check_engine_release_floor.py and scripts/check_client_release_precondition.py print each verdict and return each exit code inline, byte for byte what the table path printed (the frozen per-cell text fixture passed against the inlined scripts before it was deleted). Two things went with the table and are not replaced: an unmapped DeployTrackerError subclass now exits 3 with the usual TRACKER NOT RECORDED line instead of exit 2, and an unexpected exception escaping either gate is a traceback and exit 1, where the table path's wrapper mapped it to exit 2. RDR-201 stays; its rdr-lifecycle table is unchanged.

• CI process machinery deleted (cleanup step 8, nexus-0r1uz). scripts/ci_status.py (the fold of the conexus CI board posts into a per-commit verdict), scripts/check_ci_commit_coverage.py with .github/workflows/ci-commit-coverage-audit.yml, and scripts/scheduled_workflow_watchdog.py with .github/workflows/scheduled-failure-watch.yml are gone, with their tests and .test_durations.json entries. To read a commit's CI, make one call to gh api repos/Hellblazer/nexus/commits/<sha>/check-runs; the board itself is conexus-side and untouched. The watchdog workflow's second job, engine-floor-verify (the daily bare re-run of check_engine_release_floor.py against the live cloud), went with it: a paired release's deploy is now verified only by the human POST-TAG VERIFY the gate's acceptance message names. AGENTS.md rule 7, docs/contributing.md and the release skill say so.

• CI runs on GitHub-hosted runners only: the qwen-linux and hellmini-ci routes, the runner probes and the host-specific post-publish ceremony are deleted (cleanup step 7, nexus-0r1uz). ci.yml loses the route step, the ci_runner output and the test-qwen job; pytest-gate now requires the hosted shards. service-ci.yml loses its route step and java_runner output, and the Java job runs on ubuntu-latest. Deleted with them: qwen-linux-isolation-probe.yml, hellmini-ci-isolation-probe.yml, hellmini-probe.yml, scripts/qwen-hand-run.sh, scripts/qwentescence_local_supervisor_gate.py (and release-skill Step 11d), scripts/check_inbound_relay_acks.py, scripts/check_agent_verify_claims.py, scripts/check_deferral_staleness.py, their tests, and docs/contributing.md § First run of the qwen-linux route. The hellmini runner stays for release legs. The repository variables QWEN_CI_PUSH_RUNNER and SERVICE_CI_PUSH_RUNNER no longer do anything and can be deleted.

• One-shot engine-release rehearsals and proofs are deleted, each with its tests and its skill and AGENTS.md steps (cleanup step 9, nexus-0r1uz). scripts/check_pitr_fork_walk.py with tests/e2e/two-walk-check.sh and its decision tests, and the engine-release skill's Step 6a that handed its invocations to conexus. scripts/check_rdr194_cc5_delivery_gate.py and the skill's Step 3d. scripts/check_release_workflow_shape.py, tests/e2e/migration-rehearsal/lib/shakeout_shape_check.sh and the call in migration-rehearsal/run.sh, with the AGENTS.md "PRE-TAG gate: release-workflow SHAPE" bullet. The candidate-engine proof: tests/e2e/lib/candidate_engine.{py,sh}, its stub and shell test, the release battery's --cut, --candidate-engine, --accept-candidate-mismatch and --expected-engine-lag options (and the NX_CUT_MODE, NX_CANDIDATE_ENGINE and NX_CANDIDATE_EXPECT_OWNERLESS_MODE variables), the identity and refusals reads in fresh-install-mvv.sh, data-token-cli-gate.sh, local-service-gate.sh, release-sandbox.sh, rehearse_shakeout.sh and rehearse_candidate_migration.sh, and the skill's Step 3f. scripts/check_engine_cut_riders.py keeps only its sizes subcommand, which scripts/promote_engine_release.sh runs at the draft-to-published gate; the ancestry subcommand, the RIDERS list and the skill's Step 2b are gone. The dtok battery leg now runs only when named in --only. tests/scripts/test_release_battery_end_to_end.py keeps the leg-selection, red-leg and pins-leg cases.