fix: CoalBoard v1.3.2 — coalboardMode:off no longer silences self-update (board-audit)

Board-audit LOW (verify-triaged + 3-sub applied + reviewed, review=SHIP, 28 tests green):
the conductor returned early on boardOff, suppressing the SessionStart self-update check —
but coalboardMode (the board AND-gate) and updateMode (self-update) are orthogonal
off-switches. Now the board's UserPromptSubmit path is skipped when off while the
SessionStart self-update still fires per its own updateMode. + the companion test (had
encoded the bug).

Gate: build + verify + 28 tests PASS.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: HetCreep

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "coalboard",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "description": "CoalBoard — a diverse-lens consensus & debate board. Its primary auto-trigger is the error-not-allowed slice (security/crypto, migrations, high-precision math); convened manually it generalizes to any hard problem worth several perspectives. On a critical task, with consent, it spawns diverse epistemic lenses in parallel — empirical (live source-grounding), formal (logic), and a show-me skeptic — a judge synthesizes on VERIFIED inputs, an independent out-of-frame solver breaks ties, and the human signs off. Guarantees bounded cost (no whack-a-mole) and zero-breakage (staging); improves correctness without claiming a reliability number. Cross-agent (any subagent platform; Claude Code adds cost-optimized tiering). Zero-dependency, offline, no API keys.",
   "author": { "name": "HetCreep" },
   "homepage": "https://github.com/TheColliery/CoalBoard",

CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to CoalBoard are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow SemVer (the canonical version lives in `.claude-plugin/plugin.json`).
 
+## [1.3.2] — 2026-06-21
+
+**PATCH** — board-audit fix (verify-triaged from the whole-Colliery nasa board); bugfix only.
+
+### Fixed
+- **`coalboardMode:off` no longer silences self-update.** The conductor returned early on `boardOff`, which also suppressed the SessionStart self-update check — but the board AND-gate (`coalboardMode`) and self-update (`updateMode`) are ORTHOGONAL (independent off-switches). Now the board's UserPromptSubmit path is skipped when off while the SessionStart self-update still fires per its own `updateMode`. (+ the companion test, which had encoded the bug.)
+
+Gate: build + verify + 28 tests PASS.
+
 ## [1.3.1] — 2026-06-21
 
 **PATCH**: report-context sharpen + doc sibling-consistency; no change to the board flow or config.

hooks/coalboard-conductor.js

@@ -109,12 +109,13 @@ function updateDue(cfg) {
 
 function main() {
   const cfg = readCfg();
-  if (boardOff(cfg)) return;
+  const off = boardOff(cfg);
   let input = {};
   try { const p = JSON.parse(readStdin() || '{}'); if (p && typeof p === 'object' && !Array.isArray(p)) input = p; } catch {}
   const event = input.hook_event_name || input.hookEventName || '';
 
   if (event === 'UserPromptSubmit') {
+    if (off) return; // the board AND-gate is gated by coalboardMode; self-update is orthogonal (SessionStart only).
     const reasons = detect(input.prompt || input.user_prompt || '', cfg);
     if (!reasons.length) return;
     const nonLatin = hasNonLatin(input.prompt || input.user_prompt || '')
@@ -127,11 +128,13 @@ function main() {
   // stays silent (Phoenix #13 zero-noise — the hook is wired to SessionStart + UserPromptSubmit;
   // never emit on an unexpected/unknown event).
   if (event !== 'SessionStart') return;
-  let msg = "[CoalBoard] Consensus board available. On an error-not-allowed task (security/crypto, DB/financial migration, high-precision math), WITH the user's consent, convene the board: diverse lenses debate in parallel -> a judge synthesizes on VERIFIED inputs -> staged to .coalboard/proposed/ -> the human signs off. Off ~90% of the time; never touches live files until verified + approved. Judge EVERY prompt by semantic INTENT, not only the English Layer-1 keywords -- a non-English or obfuscated critical task matches no keyword seed yet still warrants the board.";
+  // The board contract is gated by coalboardMode; self-update is ORTHOGONAL (its own off-switch
+  // is updateMode), so it still fires when the board is off — the two keys are independent.
+  let msg = off ? '' : "[CoalBoard] Consensus board available. On an error-not-allowed task (security/crypto, DB/financial migration, high-precision math), WITH the user's consent, convene the board: diverse lenses debate in parallel -> a judge synthesizes on VERIFIED inputs -> staged to .coalboard/proposed/ -> the human signs off. Off ~90% of the time; never touches live files until verified + approved. Judge EVERY prompt by semantic INTENT, not only the English Layer-1 keywords -- a non-English or obfuscated critical task matches no keyword seed yet still warrants the board.";
   if (updateDue(cfg)) {
-    msg += ' [self-update due] Offer the /coalboard:update check (compare the latest git tag to the installed version, then offer `claude plugin update`). Consent-gated; the hook only scheduled it.';
+    msg += (msg ? ' ' : '[CoalBoard] ') + '[self-update due] Offer the /coalboard:update check (compare the latest git tag to the installed version, then offer `claude plugin update`). Consent-gated; the hook only scheduled it.';
   }
-  process.stdout.write(msg);
+  if (msg) process.stdout.write(msg);
 }
 
 try { main(); } catch { /* Phoenix #4: fail-silent, never crash the host */ }

plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "coalboard",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "description": "CoalBoard — a diverse-lens consensus & debate board. Its primary auto-trigger is the error-not-allowed slice (security/crypto, migrations, high-precision math); convened manually it generalizes to any hard problem worth several perspectives. On a critical task, with consent, it spawns diverse epistemic lenses in parallel — empirical (live source-grounding), formal (logic), and a show-me skeptic — a judge synthesizes on VERIFIED inputs, an independent out-of-frame solver breaks ties, and the human signs off. Guarantees bounded cost (no whack-a-mole) and zero-breakage (staging); improves correctness without claiming a reliability number. Cross-agent (any subagent platform; Claude Code adds cost-optimized tiering). Zero-dependency, offline, no API keys.",
   "author": { "name": "HetCreep" },
   "homepage": "https://github.com/TheColliery/CoalBoard",

plugin/hooks/coalboard-conductor.js

@@ -109,12 +109,13 @@ function updateDue(cfg) {
 
 function main() {
   const cfg = readCfg();
-  if (boardOff(cfg)) return;
+  const off = boardOff(cfg);
   let input = {};
   try { const p = JSON.parse(readStdin() || '{}'); if (p && typeof p === 'object' && !Array.isArray(p)) input = p; } catch {}
   const event = input.hook_event_name || input.hookEventName || '';
 
   if (event === 'UserPromptSubmit') {
+    if (off) return; // the board AND-gate is gated by coalboardMode; self-update is orthogonal (SessionStart only).
     const reasons = detect(input.prompt || input.user_prompt || '', cfg);
     if (!reasons.length) return;
     const nonLatin = hasNonLatin(input.prompt || input.user_prompt || '')
@@ -127,11 +128,13 @@ function main() {
   // stays silent (Phoenix #13 zero-noise — the hook is wired to SessionStart + UserPromptSubmit;
   // never emit on an unexpected/unknown event).
   if (event !== 'SessionStart') return;
-  let msg = "[CoalBoard] Consensus board available. On an error-not-allowed task (security/crypto, DB/financial migration, high-precision math), WITH the user's consent, convene the board: diverse lenses debate in parallel -> a judge synthesizes on VERIFIED inputs -> staged to .coalboard/proposed/ -> the human signs off. Off ~90% of the time; never touches live files until verified + approved. Judge EVERY prompt by semantic INTENT, not only the English Layer-1 keywords -- a non-English or obfuscated critical task matches no keyword seed yet still warrants the board.";
+  // The board contract is gated by coalboardMode; self-update is ORTHOGONAL (its own off-switch
+  // is updateMode), so it still fires when the board is off — the two keys are independent.
+  let msg = off ? '' : "[CoalBoard] Consensus board available. On an error-not-allowed task (security/crypto, DB/financial migration, high-precision math), WITH the user's consent, convene the board: diverse lenses debate in parallel -> a judge synthesizes on VERIFIED inputs -> staged to .coalboard/proposed/ -> the human signs off. Off ~90% of the time; never touches live files until verified + approved. Judge EVERY prompt by semantic INTENT, not only the English Layer-1 keywords -- a non-English or obfuscated critical task matches no keyword seed yet still warrants the board.";
   if (updateDue(cfg)) {
-    msg += ' [self-update due] Offer the /coalboard:update check (compare the latest git tag to the installed version, then offer `claude plugin update`). Consent-gated; the hook only scheduled it.';
+    msg += (msg ? ' ' : '[CoalBoard] ') + '[self-update due] Offer the /coalboard:update check (compare the latest git tag to the installed version, then offer `claude plugin update`). Consent-gated; the hook only scheduled it.';
   }
-  process.stdout.write(msg);
+  if (msg) process.stdout.write(msg);
 }
 
 try { main(); } catch { /* Phoenix #4: fail-silent, never crash the host */ }

scripts/lib/conductor.test.mjs

@@ -90,13 +90,28 @@ test('emoji in an English prompt -> CRITICAL signal but NO non-English nudge (em
   } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
 });
 
-test('coalboardMode:off -> fully silent on every event', () => {
+test('coalboardMode:off -> board contract + AND-gate silent, but self-update is orthogonal', () => {
   const tmp = mk();
   try {
     writeCfg(tmp, { coalboardMode: 'off' });
+    // SessionStart: the board contract is suppressed, but the self-update is due (fresh sandbox,
+    // updateMode defaults to ask) -> only the self-update directive fires, NOT the board contract.
     const r1 = run({ hook_event_name: 'SessionStart' }, tmp, tmp);
     const r2 = run({ hook_event_name: 'UserPromptSubmit', prompt: 'fix the auth crypto bug' }, tmp, tmp);
-    assert.equal(r1.status, 0); assert.equal(r1.stdout, '');
+    assert.equal(r1.status, 0);
+    assert.match(r1.stdout, /self-update due/, 'self-update is orthogonal to the board and still fires when off');
+    assert.doesNotMatch(r1.stdout, /Consensus board available/, 'the board contract is suppressed when coalboardMode:off');
+    assert.equal(r2.status, 0); assert.equal(r2.stdout, '', 'the UserPromptSubmit AND-gate stays silent when the board is off');
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+test('coalboardMode:off + updateMode:off -> fully silent on every event', () => {
+  const tmp = mk();
+  try {
+    writeCfg(tmp, { coalboardMode: 'off', updateMode: 'off' });
+    const r1 = run({ hook_event_name: 'SessionStart' }, tmp, tmp);
+    const r2 = run({ hook_event_name: 'UserPromptSubmit', prompt: 'fix the auth crypto bug' }, tmp, tmp);
+    assert.equal(r1.status, 0); assert.equal(r1.stdout, '', 'board off + update off -> SessionStart fully silent');
     assert.equal(r2.status, 0); assert.equal(r2.stdout, '');
   } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
 });