fix(seeds): YAML escape decoding + domain mapping + PYTHON_CMD

Addresses 3 bugs flagged by Codex CLI during PR Luispitik#9 review. All 3 are
pre-existing in the feat(seeds) commit of PR Luispitik#8.

P1: install.sh hardcoded `python` instead of `$PYTHON_CMD` detected in
Step 1. On systems with only python3 in PATH, seed import failed and was
silently swallowed by `|| true`. Uses `$PYTHON_CMD` now with a warning
fallback when Python is unavailable.

P2: parse_yaml_simple stripped quotes but did not decode backslash
escapes. Seeds with `"spec\.ts"` were stored with literal backslashes,
producing invalid regex. Added _decode_yaml_double_quoted (handles
\ \" \n \t \r) and _decode_yaml_single_quoted (`''` → `'`). Fixes 3
broken seeds: e2e-playwright-selectors, security-headers-vercel,
supabase-rls-auth-uid.

P2: _instinct-activator.sh pre-filters by ALWAYS_DOMAINS + stack-detected
domains when context.md exists. Seed domains workflow-general, testing,
web-development, saas-development are outside both sets so those seeds
never reached regex evaluation. Added DOMAIN_MAP in importer:
workflow-general → operations, testing → quality, web-development →
frontend, saas-development → stripe. original_domain preserved for
traceability.

Tests: 3 new in test-seeds.sh (9-11). Suite 8/8 → 11/11 GREEN.

Credit: bugs identified by Codex CLI (cross-model review).

Author: Nestor Martinez

CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## Unreleased — fixes to seed importer (addressing Codex review of PR #8)
+
+### Fixed
+- **`install.sh:186` — seed import used hardcoded `python` binary**: On Linux/macOS systems where only `python3` is in PATH (the common case — the installer's Step 1 explicitly accepts it), the seed import command failed and was swallowed by `|| true`. The installer reported success but **no seeds were imported into `_instincts-index.json`**. Switched to the `$PYTHON_CMD` detected in Step 1, with a fallback warning when Python is unavailable.
+- **`_seed-import.py:85` — YAML escape sequences not decoded**: The minimal YAML parser stripped surrounding quotes but did not interpret backslash escapes. Seeds with trigger patterns like `"spec\\.ts"` or `"vercel\\.json"` were stored with the literal backslashes, producing invalid regex (`spec\\.ts` matches a literal `\` followed by `.ts`, not `spec.ts`). Added `_decode_yaml_double_quoted` (handles `\\ \" \n \t \r`) and `_decode_yaml_single_quoted` (`''` → `'`). **Fixes 3 broken seeds in the shipped set**: `e2e-playwright-selectors`, `security-headers-vercel`, `supabase-rls-auth-uid`.
+- **`_seed-import.py:120` — seed domains filtered out by activator**: `_instinct-activator.sh` pre-filters by `ALWAYS_DOMAINS` (`_default`, `general`, `git`, `security`, `operations`, `quality`) plus stack-detected domains when a project has `context.md`. Seed domains `workflow-general`, `testing`, `web-development`, `saas-development` are not in either set, so `conventional-commits`, `e2e-playwright-selectors`, `nextjs-suspense-boundary`, `stripe-webhook-verify` never reached regex evaluation in normal project sessions. Added `DOMAIN_MAP` in the importer: `workflow-general → operations`, `testing → quality`, `web-development → frontend`, `saas-development → stripe`. Original domain preserved in new `original_domain` field for traceability.
+
+### Tests
+- 3 new tests in `tests/test-seeds.sh` (Tests 9-11): YAML escape decoding verified against `e2e-playwright-selectors`, domain mapping verified against `testing → quality`, install.sh usage of `$PYTHON_CMD` verified by grep.
+
+### Credit
+Bugs identified by Codex CLI (`/codex:review --base main`) during PR #9 (Laws tier) review. All 3 pre-existing in PR #8 commits.
+
+---
+
 ## v4.4.1 (2026-04-17)
 
 ### Fixed

core/_seed-import.py

@@ -32,6 +32,13 @@
 
 Attribution: seed format originated in fs-cortex (MIT © Fernando Montero).
 Sinapsis extends it with discrete levels via confidence thresholds.
+
+Domain mapping: `_instinct-activator.sh` pre-filters by domain when the project
+has `context.md`. Only `ALWAYS_DOMAINS` ({_default, general, git, security,
+operations, quality}) + stack-detected domains are evaluated. Seed domains
+outside that set (workflow-general, testing, web-development, saas-development)
+are translated to activator-recognized domains at import time so they match
+in the expected contexts.
 """
 from __future__ import annotations
 import argparse
@@ -56,10 +63,53 @@ def default_seeds_dir() -> Path:
     return default_skills_dir() / '_seeds' / 'instincts'
 
 
+def _decode_yaml_double_quoted(s: str) -> str:
+    """Decode escape sequences in a YAML double-quoted scalar.
+
+    Handles: \\\\ → \\, \\" → ", \\n → newline, \\t → tab, \\r → CR.
+    Unknown escapes pass through unchanged (safe for user-authored regex).
+    """
+    out = []
+    i = 0
+    n = len(s)
+    while i < n:
+        c = s[i]
+        if c == '\\' and i + 1 < n:
+            nxt = s[i + 1]
+            if nxt == '\\':
+                out.append('\\')
+                i += 2
+            elif nxt == '"':
+                out.append('"')
+                i += 2
+            elif nxt == 'n':
+                out.append('\n')
+                i += 2
+            elif nxt == 't':
+                out.append('\t')
+                i += 2
+            elif nxt == 'r':
+                out.append('\r')
+                i += 2
+            else:
+                out.append(c)
+                i += 1
+        else:
+            out.append(c)
+            i += 1
+    return ''.join(out)
+
+
+def _decode_yaml_single_quoted(s: str) -> str:
+    """Decode YAML single-quoted scalar: '' → '"""
+    return s.replace("''", "'")
+
+
 def parse_yaml_simple(text: str) -> dict:
     """
     Minimal YAML parser for seed format (flat scalar key: value).
-    Handles single-/double-quoted strings. Ignores nested lists (tags, evidence).
+    Handles single-/double-quoted strings with escape decoding. Ignores nested
+    lists (tags, evidence).
     """
     result = {}
     in_frontmatter = False
@@ -83,13 +133,30 @@ def parse_yaml_simple(text: str) -> dict:
         key = key.strip()
         value = value.strip()
         if value.startswith('"') and value.endswith('"'):
-            value = value[1:-1]
+            value = _decode_yaml_double_quoted(value[1:-1])
         elif value.startswith("'") and value.endswith("'"):
-            value = value[1:-1]
+            value = _decode_yaml_single_quoted(value[1:-1])
         result[key] = value
     return result
 
 
+# Domain translation table: seed domain → activator-recognized domain.
+# Only applied when seed.domain is in this map. Other domains pass through.
+# Rationale: _instinct-activator.sh pre-filters by domain when project context.md
+# exists. Unknown domains get silently skipped before regex evaluation. This
+# table ensures seed instincts are evaluated in the expected contexts.
+DOMAIN_MAP = {
+    'workflow-general': 'operations',
+    'testing': 'quality',
+    'web-development': 'frontend',
+    'saas-development': 'stripe',
+}
+
+
+def map_domain(domain: str) -> str:
+    return DOMAIN_MAP.get(domain, domain)
+
+
 def confidence_to_level(conf_str: str) -> str:
     try:
         c = float(conf_str)
@@ -115,9 +182,11 @@ def iso_from_date(d: str) -> str:
 def map_seed_to_instinct(seed: dict) -> dict:
     source = seed.get('source', 'seed')
     origin = source if source.startswith('seed') else f'seed:{source}'
-    return {
+    raw_domain = seed.get('domain', 'general')
+    mapped_domain = map_domain(raw_domain)
+    instinct = {
         'id': seed['id'],
-        'domain': seed.get('domain', 'general'),
+        'domain': mapped_domain,
         'level': confidence_to_level(seed.get('confidence', '0.5')),
         'trigger_pattern': seed.get('trigger', ''),
         'inject': seed.get('action', ''),
@@ -128,6 +197,9 @@ def map_seed_to_instinct(seed: dict) -> dict:
         'first_triggered': iso_from_date(seed.get('first_seen', '')),
         'sessions_seen': [],
     }
+    if mapped_domain != raw_domain:
+        instinct['original_domain'] = raw_domain
+    return instinct
 
 
 def parse_id_list(value: str) -> set[str]:

install.sh

@@ -183,9 +183,13 @@ chmod +x "$SKILLS_DIR/_seed-import.py" 2>/dev/null || true
 if [ -d "$SCRIPT_DIR/seeds/instincts" ]; then
   mkdir -p "$SKILLS_DIR/_seeds/instincts"
   cp "$SCRIPT_DIR/seeds/instincts"/*.yaml "$SKILLS_DIR/_seeds/instincts/" 2>/dev/null || true
-  python "$SKILLS_DIR/_seed-import.py" \
-    --seeds-dir "$SKILLS_DIR/_seeds/instincts" \
-    --index-path "$SKILLS_DIR/_instincts-index.json" 2>&1 | sed 's/^/    /' || true
+  if [ -n "$PYTHON_CMD" ]; then
+    "$PYTHON_CMD" "$SKILLS_DIR/_seed-import.py" \
+      --seeds-dir "$SKILLS_DIR/_seeds/instincts" \
+      --index-path "$SKILLS_DIR/_instincts-index.json" 2>&1 | sed 's/^/    /' || true
+  else
+    echo -e "${YELLOW}    ! Python 3 not available — skipping seed import${NC}"
+  fi
 fi
 
 echo -e "${GREEN}  OK${NC} 5 hook scripts + dream cycle + dashboard generator + seed importer installed"

tests/test-seeds.sh

@@ -102,6 +102,52 @@ if [ "$LVL_FD" = "draft" ]; then pass "supabase-rls-auth-uid forced to draft"; e
 
 teardown_sandbox
 
+# ─ Test 9: YAML escape decoding (Codex finding) ─
+# "spec\\.ts" in seed YAML must land in JSON as "spec\.ts" (regex-valid),
+# NOT "spec\\\\.ts" (literal backslash in regex — never matches).
+echo "Test 9: YAML escape decoding in trigger_pattern"
+setup_sandbox
+python "$IMPORTER" --seeds-dir "$SEEDS_NATIVE" --index-path "$INDEX_PATH" > /dev/null 2>&1
+# e2e-playwright-selectors has trigger "playwright|e2e|spec\\.ts|..."
+TRIG=$(python -c "import json; d=json.load(open(r'$INDEX_PATH')); m={i['id']:i.get('trigger_pattern','') for i in d.get('instincts',[])}; print(m.get('e2e-playwright-selectors',''))")
+# Correct decoded form should contain 'spec\.ts' (2 chars: backslash + dot literal)
+# Broken form contains 'spec\\.ts' (3 chars: two backslashes + dot)
+if echo "$TRIG" | grep -q 'spec\\\.ts' && ! echo "$TRIG" | grep -q 'spec\\\\\.ts'; then
+  pass "escape decoded: 'spec\\.ts' in trigger"
+else
+  fail "escape not decoded correctly: got '$TRIG'"
+fi
+teardown_sandbox
+
+# ─ Test 10: Domain mapping (Codex finding) ─
+# seed domain 'testing' must be translated to 'quality' (activator-recognized).
+# Also verify original_domain is preserved for traceability.
+echo "Test 10: Domain mapping (testing → quality)"
+setup_sandbox
+python "$IMPORTER" --seeds-dir "$SEEDS_NATIVE" --index-path "$INDEX_PATH" > /dev/null 2>&1
+MAPPED=$(python -c "import json; d=json.load(open(r'$INDEX_PATH')); m={i['id']:i.get('domain','') for i in d.get('instincts',[])}; print(m.get('e2e-playwright-selectors',''))")
+ORIG=$(python -c "import json; d=json.load(open(r'$INDEX_PATH')); m={i['id']:i.get('original_domain','') for i in d.get('instincts',[])}; print(m.get('e2e-playwright-selectors',''))")
+if [ "$MAPPED" = "quality" ] && [ "$ORIG" = "testing" ]; then
+  pass "testing → quality with original_domain preserved"
+else
+  fail "domain mapping broken: mapped=$MAPPED, original=$ORIG"
+fi
+teardown_sandbox
+
+# ─ Test 11: install.sh honors $PYTHON_CMD (Codex finding P1) ─
+# Ensure install.sh does NOT hardcode 'python' — it must reference $PYTHON_CMD
+# detected in Step 1. On systems with only python3 in PATH, hardcoded 'python'
+# would fail silently and no seeds would import.
+echo "Test 11: install.sh uses \$PYTHON_CMD for seed import"
+INSTALL_SH="$SCRIPT_DIR/install.sh"
+if grep -q '"\$PYTHON_CMD" "\$SKILLS_DIR/_seed-import.py"' "$INSTALL_SH"; then
+  pass "install.sh uses \$PYTHON_CMD"
+else
+  fail "install.sh does not reference \$PYTHON_CMD for seed import"
+fi
+
+TOTAL=11
+
 echo ""
 echo "────────────────────────────"
 echo "Results: $PASS/$TOTAL passed, $FAIL failed"