feat(rfc-008): P3c — classifier runtime-sources taxonomy.json (R4/F4/F6)

[lantisprime]

RFC-008 P3c — classifier runtime-sources taxonomy.json (R4 / F4 / F6)

Part of RFC-008. The classifier-runtime-sourcing slice of P3 (independent of the P3b-2 tier layer and P3d em-recall purification, per workplan v125).

What changes

command-classifier.sh now sources its label vocabulary from patterns/taxonomy.json at runtime via a zero-dep node helper and fails closed if the resolved set drifts from the _priority() case-arms — the single bash label authority CI already pins == taxonomy (assertion 7b). This eliminates the hand-maintained label list by construction (F4 / OQ-2-closed).

• _ensure_taxonomy_synced guard fronts both public emitters (classify_command + classify_path); it never overrides the two non-overridable labels — marker_write (deadlock-class-1 escape hatch) and unsafe_complex (already maximally blocking).
• Resolution: candidate 1 = $HOME/.episodic-memory/patterns/taxonomy.json (== install GLOBAL_DIR); candidate 2 = a conditional in-repo climb gated on repo sentinels and a classifier realpath round-trip — the installed layout can never read an ambient parent taxonomy.json (authority-root containment; cd -P realpath handles the /var→/private/var class).
• install.mjs co-deploys taxonomy.json to the same global root, coupled to the classifier deploy (inside --install-hooks) so a no-hooks install never advances the taxonomy while the classifier stays stale. Emits a divergent-classifier WARN (pre-P3c-no-helper vs post-P3c split).
• validate-bp-contract.mjs assertion 7c (robust parser, not grep): the guard is defined + called from both entry points, and emit-site label literals ⊆ taxonomy. extractPriorityArms allowlists declare -f _priority (an inert read).

Tests

Suite	Result
test-command-classifier.sh (regression)	430/0
test-classifier-taxonomy-sync.sh (new)	18/0
test-validate-bp-contract.mjs (7c + allowlist)	103/0
test-install-hooks.sh (T20 co-deploy/WARN + BLOCKER regression)	92/0
live E2E (real install → deployed classify → drift fail-closed)	8/0

test-command-classifier.sh + test-classifier-taxonomy-sync.sh wired into CI (plugin-validate.yml).

Review trail

• Plan: negative-scenario-planner HOLD (3 P1) + codex R1 HOLD(5) → R2 HOLD(2) → R3 ACCEPT.
• Code: negative-scenario-reviewer ACCEPT — 4 adversarial axes (authority-root fail-OPEN, fail-OPEN under error, marker_write exemption, validator allowlist bypass) all fail-closed with shell repros.
• PR-level: codex R1 REJECT — 1 BLOCKER (no-hooks install advanced the global taxonomy unwarned → silent taxonomy_drift). Fixed (taxonomy deploy coupled to classifier + T20a2 regression). claude-subagent R2 ACCEPT (consensus converged).

Defers (per workplan v125)

Plugin override interface + F3 runtime alert → P3b-2; TSV→NDJSON → P4; em-recall purification → P3d.

🤖 Generated with Claude Code

[lantiscooperdev]

Bot review — RFC-008 P3c (classifier runtime-sourcing)

Automated multi-layer review summary (agent-run; user approval still required to merge).

Verification (artifacts)

• test-command-classifier.sh 430/0 (regression — existing classifications unaffected)
• test-classifier-taxonomy-sync.sh 18/0 (drift / unresolved / malformed / empty / marker escape / classify_path / symlink / ambient-reject / candidate-2 proof / non-exported guard)
• test-validate-bp-contract.mjs 103/0 (assertion 7c + declare -f allowlist FP control)
• test-install-hooks.sh 92/0 (co-deploy byte-equal, both WARN branches, no-hooks coupling regression)
• live E2E 8/0 (real install → deployed classify → tampered-taxonomy fail-closed)
• validate-bp-contract --project . = OK

Review layers

• Plan — negative-scenario-planner HOLD (3 P1) + codex 3 rounds → ACCEPT.
• Code — negative-scenario-reviewer ACCEPT; 4 adversarial axes fail-closed with shell repros (authority-root fail-OPEN, fail-OPEN under error, marker_write exemption, validator allowlist bypass).
• PR-level — codex R1 caught a real BLOCKER (no-hooks install advanced the global taxonomy unwarned → silent taxonomy_drift); fixed by coupling the taxonomy deploy to the classifier deploy + a T20a2 regression test; R2 ACCEPT (consensus).

Key safety properties confirmed

• Fail-closed never overrides marker_write (deadlock escape) or unsafe_complex.
• Installed-layout classifier cannot read an ambient parent taxonomy.json (sentinels + realpath round-trip).
• Install write-root == runtime read-root ($HOME/.episodic-memory/patterns); taxonomy + classifier advance together.

Residual (no action)

• F6 (theoretical): taxonomy deploy is existsSync-guarded while the classifier deploys unconditionally — repo-corruption-only path, covered by the committed taxonomy.json + CI assertion 7.

Recommending the changes are sound; leaving final approval to the maintainer.