Hyperresearch stray cleanup and vault-root guard

Task KB-OS-cleanup, 2 rounds, rock: 6, category: Other. Continuation: KB-OS-okf-evaluation.

Root cause

• The /hyperresearch entry skill (Step 0) runs hyperresearch init . whenever .hyperresearch/ is missing in the literal working directory. The CLI has no vault-path option: Vault.discover walks up from the current directory only.
• A run started from a KB session made D:\FSS\KB a vault, creating .hyperresearch/, research/ and a 15 KB CLAUDE.md at the KB root.
• A 2026-09-15 cleanup moved the vault into KB/archive/ but left KB/CLAUDE.md behind. That file auto-loads into every KB session and tells agents to write research/... relative to the current directory, so KB/research/runs/ regrew 80 minutes later.
• The real vault sat at /home/ta, so ~/CLAUDE.md loaded into every session under the home folder (monorepo, ai-config, utils). This was confirmed in a monorepo session transcript.

What changed

• KB root cleaned. Moved out: archive/, research/, CLAUDE.md and apps/. The apps/ folder held two empty sd-app stubs that Obsidian created when a dead repo-relative link was clicked on 2026-09-01. Nothing was unique, because the curated copies live in the vault. Talbot then deleted the moved-aside folder.
• Vault moved from /home/ta to /home/ta/hyperresearch/. The status output was identical apart from the path: 152 notes, 301 research files. The vault database stores relative paths, so the move was safe. ~ and the KB now return NO_VAULT.
• Guard hook deployed (ai-config c0fcfa1, 4dcce3c). claude/hooks/hyperresearch-root-guard.sh is a PreToolUse Bash hook that blocks hyperresearch init|install|setup in command position anywhere except ~/hyperresearch; install --global is allowed.
  • Test suite: 16/16 pass, including mention-only cases.
  • Live check: a real call was blocked, and a command that only mentioned the words ran.
• herdr research tab added to TABS in ~/utils/herdr-workspace.sh and created live, with its working directory set to ~/hyperresearch.
• Software Dev/ stays in Core/Processes, by Talbot’s decision. Its folder note now says why: Processes owns the standards and IT runs them.
• OKF evaluation spun out as KB-OS-okf-evaluation.

Gotchas

• Settings drift. The ai-config settings.wsl.json still held model: claude-sonnet-5, which Talbot’s /model switch had already removed from the deployed settings. Deploying unchanged would have silently reverted him to Sonnet, so the key was removed from source first. This is the “diff before you deploy” rule working as intended.
• First guard version over-matched. A substring match blocked the agent’s own test command because the text contained the trigger words. The fix was to match command position only.
• hyperresearch repair re-injects CLAUDE.md at the vault root by default. Deleting that file is never a durable fix; the vault’s location is.

Lesson candidates (pending Talbot’s approval, not promoted)

1. A tool that creates its working folder in the current directory and injects a CLAUDE.md needs that CLAUDE.md removed as part of any cleanup, because it keeps steering sessions there. Target: ai-config/LESSONS.md.
2. Bash guard hooks should match only in command position, and their test suite needs cases that merely mention the trigger. Target: ai-config/LESSONS.md.

Files

• Core/AI/Skills/DASHBOARD.md (hyperresearch row: vault root, start rule, guard)
• Core/Processes/Software Dev/Software Dev.md (“why here” note)
• Core/IT/Utils/Custom/herdr-workspace.md (research tab)
• ai-config: claude/hooks/hyperresearch-root-guard.sh, claude/settings.wsl.json