fix(claude-code-hermit): narrow the unattended metrics writer to typed ledger verbs

[gtapps]

Summary

append-metrics.ts took an arbitrary path and an arbitrary JSON payload, validating only that JSON.parse succeeded. It sat in the sealed unattended permission allow-list, so the grant it held amounted to write any JSON to any path. This replaces it with two writers scoped to the ledger each one owns, and moves three observation sources into the scripts that actually compute them.

The security narrowing was the motivating change, but the larger find came out of verification: the prose-mediated observation path had never worked. Across the live fleet, observations.jsonl contained only script-written startup-drift rows — not a single cost-spike or behavior-digest row had ever been recorded. Both asked the model to re-read a log, redo arithmetic a script had already done, and hand-format the result. Those are now written by the code that derives them.

Changes

New writers

• observations.ts observe <dir> <source> — stdin-only, typed. Sources are an enum, ts is stamped by the script, session_id resolves from runtime.json. Only the three model-authored sources are invocable; cost-spike, behavior-digest and startup-drift are rejected because the scripts that compute them own them.
• proposal.ts event <dir> responded|resolved --id= — the same treatment for the two proposal-metrics rows skill prose used to assemble as JSON. Named event, not metric, so it can't be confused with the existing metrics reader one character away in a dispatcher whose unknown-verb branch exits 0.

Deterministic sources move to their owners

• reflect-precheck.ts writes cost-spike and startup-drift; checkCostSpike now returns its figures instead of discarding them.
• transcript-digest.ts --record-observation writes behavior-digest, with the wakes >= 20 && productive/wakes < 0.25 threshold moved out of prose. The flag is opt-in so the digest stays a pure read for ad-hoc runs.

Consequences

• Every remaining prose caller now passes free text, so the writer is stdin-only — the argv quoting hazard and the lint that policed it are deleted, not retargeted.
• The cost-spike label is date-scoped (cost-spike:<YYYY-MM-DD>) with today_total/median_7d as fields. Carrying the running total in the label, as the prose row did, would have defeated the ledger's exact-pattern dedup and written a fresh row on every precheck run of a spike day.
• metrics_event is gone from the reflect eval-runner schema — a model-authored JSON string appended after only a JSON.parse check, and always derivable from proposal_id. A stale runner sending one is now rejected rather than silently trusted.
• HERMIT_ALLOW swaps to Bash(bun */scripts/observations.ts observe *); the old entry is retired via HERMIT_OBSOLETE so permissions-sync scrubs it from installed hermits.

Test plan

• bun test from plugins/claude-code-hermit — 3230 pass, 0 fail (exit 0).
• bunx tsc --noEmit from the repo root — exit 0.
• bash tests/run-all.sh in plugins/claude-code-dev-hermit — all suites 0 failed.
• New coverage: stdin apostrophe/$/quote survival, deterministic sources refused from the CLI, per-source origin rules, empty/multiline/oversized labels writing nothing, ERROR|<token> at exit 0 vs exit 1 on mis-invocation, all four proposal.ts event error paths, and a dedup regression test asserting two precheck runs on the same spike day with different running totals produce exactly one row.
• Live smoke in a scratch hermit dir: both writers produce well-formed rows; a label containing bob's spend spiked: $5.00 round-trips verbatim.
• Grep sweep: zero live append-metrics invocations remain; the only hits are the HERMIT_OBSOLETE entry, its assertion, and comments explaining the replacement.

Notes for review

• Readers were left alone deliberately — historical responded/resolved rows still parse, and reader outcomes are asserted by field rather than by byte comparison.
• One reviewer finding was refuted with evidence and not applied: tightening the id regex to /^PROP-\d+$/ would reject 81 of the 106 proposal_id values in the live ledger, including every created row proposal.ts writes itself.
• Out of scope, flagged for separate work: defer→accept (and dismiss→accept) never emit an accept event because responded is first-response-only, so those proposals are permanently counted as unaccepted — an existing bug that feeds a 30% kill gate.