@ccoalm/ccl-skills 0.18.1 → 0.18.2

package/dist/assets/marketplace/plugins/ccl-skills/hooks/test_skill_loading.py

@@ -0,0 +1,278 @@
+#!/usr/bin/env python3
+"""Bounded skill-loading checkpoints on synthetic host events and files."""
+import importlib.util
+import json
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+from unittest.mock import patch
+from types import SimpleNamespace
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+class SkillLoadingTests(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.root = Path(self.tmp.name).resolve()
+        self.log = self.root / 'transcript.jsonl'
+        self.log.write_text('')
+        self.env = dict(os.environ, TMPDIR=str(self.root), CLAUDE_PLUGIN_ROOT=str(ROOT))
+        for key in ('GIT_DIR', 'GIT_WORK_TREE', 'GIT_COMMON_DIR', 'GIT_INDEX_FILE'):
+            self.env.pop(key, None)
+
+    def payload(self, tool='Edit', **extra):
+        return {'hook_event_name': 'PreToolUse', 'tool_name': tool,
+                'tool_input': {'file_path': str(self.root / 'source.py')},
+                'session_id': 'synthetic', 'transcript_path': str(self.log),
+                'cwd': str(self.root), **extra}
+
+    def run_hook(self, payload, name='owner-dispatch-guard.sh'):
+        result = subprocess.run(['bash', str(ROOT / 'hooks' / name)],
+                                input=json.dumps(payload), text=True, capture_output=True,
+                                env=self.env, cwd=self.root, timeout=10)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stderr, '')
+        return json.loads(result.stdout) if result.stdout else {}
+
+    def decision(self, value):
+        return value.get('hookSpecificOutput', {}).get('permissionDecision')
+
+    def append(self, *events):
+        with self.log.open('a') as stream:
+            for event in events:
+                stream.write(json.dumps(event) + '\n')
+
+    def loaded(self, ident='load'):
+        self.append({'type': 'assistant', 'message': {'content': [
+            {'type': 'tool_use', 'id': ident, 'name': 'Skill',
+             'input': {'skill': 'ccl-skills:multi-agent-delegation'}}]}},
+            {'type': 'user', 'message': {'content': [
+                {'type': 'tool_result', 'tool_use_id': ident, 'content': 'Loaded owner'}]}})
+
+    def compact_event(self, event):
+        return self.run_hook({'hook_event_name': event, 'session_id': 'synthetic',
+                              'transcript_path': str(self.log), 'cwd': str(self.root)},
+                             'skill-context-compact.sh')
+
+    def compact(self):
+        self.assertEqual(self.compact_event('PreCompact'), {})
+        return self.compact_event('PostCompact')
+
+    def boundary(self):
+        self.append({'type': 'compacted', 'payload': {'message': 'summary'}})
+
+    def attempts(self):
+        return len(list(self.root.glob('ccl-skill-loading-*/*/attempt-*')))
+
+    def test_default_checkpoint_without_repo_opt_in_replans_once(self):
+        result = self.run_hook(self.payload())
+        self.assertEqual(self.decision(result), 'deny')
+        reason = result['hookSpecificOutput']['permissionDecisionReason']
+        self.assertIn('multi-agent-delegation', reason)
+        self.assertIn('implementation', reason.lower())
+        self.assertNotIn('permissionDecision":"ask', json.dumps(result))
+        self.assertEqual(self.run_hook(self.payload()), {})
+
+    def test_native_patch_and_all_targets(self):
+        patch = '*** Begin Patch\n*** Add File: README.md\n+doc\n*** Add File: src/new.ts\n+code\n*** End Patch'
+        value = self.run_hook(self.payload('apply_patch', tool_input={'command': patch}))
+        self.assertEqual(self.decision(value), 'deny')
+
+    def test_read_only_document_and_unparseable_edits_do_not_consume_checkpoint(self):
+        for tool, args in [('Read', {'file_path': 'source.py'}),
+                           ('Bash', {'command': 'cat source.py'}),
+                           ('Edit', {'file_path': 'README.md'}),
+                           ('apply_patch', {'command': '*** Begin Patch\n*** Add File: README.md\n+doc\n*** End Patch'})]:
+            with self.subTest(tool=tool, args=args):
+                self.assertEqual(self.run_hook(self.payload(tool, tool_input=args)), {})
+        self.assertEqual(self.decision(self.run_hook(self.payload())), 'deny')
+
+    def test_existing_malformed_patch_denial_is_not_changed(self):
+        result = self.run_hook(self.payload('apply_patch', tool_input={'command': 'invalid'}))
+        self.assertEqual(self.decision(result), 'deny')
+        self.assertIn('malformed', result['hookSpecificOutput']['permissionDecisionReason'])
+
+    def test_session_actor_and_transcript_scopes_are_independent(self):
+        self.assertEqual(self.decision(self.run_hook(self.payload())), 'deny')
+        for extra in ({'session_id': 'other'}, {'agent_id': 'worker-a'}, {'agent_id': 'worker-b'}):
+            with self.subTest(extra=extra):
+                self.assertEqual(self.decision(self.run_hook(self.payload(**extra))), 'deny')
+                self.assertEqual(self.run_hook(self.payload(**extra)), {})
+        other = self.root / 'other.jsonl'
+        other.write_text('')
+        self.assertEqual(self.decision(self.run_hook(self.payload(transcript_path=str(other)))), 'deny')
+
+    def test_native_compaction_boundary_rearms_without_erasing_old_audit(self):
+        self.loaded()
+        self.assertEqual(self.decision(self.run_hook(self.payload())), 'deny')
+        self.append({'type': 'system', 'subtype': 'compact_boundary', 'compactMetadata': {'trigger': 'auto'}})
+        self.assertEqual(self.decision(self.run_hook(self.payload())), 'deny')
+        self.assertEqual(self.run_hook(self.payload()), {})
+        self.append({'type': 'compacted', 'payload': {'message': 'summary'}})
+        self.assertEqual(self.decision(self.run_hook(self.payload())), 'deny')
+
+    def test_quoted_compaction_does_not_rearm(self):
+        self.run_hook(self.payload())
+        self.append({'type': 'user', 'message': {'content': [
+            {'type': 'text', 'text': '{"type":"compacted","payload":{}}'}]}})
+        self.assertEqual(self.run_hook(self.payload()), {})
+
+    def test_postcompact_rearms_before_transcript_boundary_is_flushed(self):
+        self.loaded()
+        self.run_hook(self.payload())
+        result = self.compact()
+        self.assertEqual(result, {})
+        self.assertEqual(self.decision(self.run_hook(self.payload())), 'deny')
+        # A deferred boundary for the same completed compaction is not another
+        # checkpoint. Only an actual later PostCompact event rearms this window.
+        self.append({'type': 'compacted', 'payload': {'message': 'summary'}})
+        self.assertEqual(self.run_hook(self.payload()), {})
+
+    def test_missing_identity_and_unwritable_state_never_deny_forever(self):
+        for payload in (self.payload(session_id=''), self.payload(transcript_path=None)):
+            self.assertNotEqual(self.decision(self.run_hook(payload)), 'deny')
+        self.env['TMPDIR'] = str(self.root / 'does-not-exist')
+        self.assertNotEqual(self.decision(self.run_hook(self.payload())), 'deny')
+
+    def test_existing_engine_deny_ask_and_advisory_are_preserved(self):
+        plugin = self.root / 'plugin'
+        engine = plugin / 'scripts/owner-dispatch/owner-dispatch.sh'
+        engine.parent.mkdir(parents=True)
+        self.env['CLAUDE_PLUGIN_ROOT'] = str(plugin)
+        for decision in ('deny', 'ask'):
+            value = {'hookSpecificOutput': {'hookEventName': 'PreToolUse',
+                     'permissionDecision': decision, 'permissionDecisionReason': 'existing boundary'}}
+            engine.write_text("#!/bin/sh\nprintf '%s\\n' '" + json.dumps(value) + "'\n")
+            self.assertEqual(self.run_hook(self.payload()), value)
+        advisory = {'hookSpecificOutput': {'hookEventName': 'PreToolUse', 'additionalContext': 'existing advisory'}}
+        engine.write_text("#!/bin/sh\nprintf '%s\\n' '" + json.dumps(advisory) + "'\n")
+        value = self.run_hook(self.payload())
+        self.assertEqual(self.decision(value), 'deny')
+        self.assertEqual(value['hookSpecificOutput']['additionalContext'], 'existing advisory')
+        self.assertEqual(self.run_hook(self.payload()), advisory)
+
+    def test_missing_routing_rule_does_not_spend_attempt(self):
+        spec = importlib.util.spec_from_file_location('checkpoint_rule_test', ROOT / 'hooks/skill-loading.py')
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+        with patch.dict(os.environ, self.env), patch.object(module, 'routing_rule', side_effect=ValueError):
+            with self.assertRaises(ValueError):
+                module.handle(self.payload(), {})
+        self.assertEqual(self.attempts(), 0)
+        self.assertEqual(self.decision(self.run_hook(self.payload())), 'deny')
+
+    def test_invalid_engine_output_falls_back_to_original_bytes(self):
+        engine = self.root / 'plugin/scripts/owner-dispatch/owner-dispatch.sh'
+        engine.parent.mkdir(parents=True)
+        self.env['CLAUDE_PLUGIN_ROOT'] = str(self.root / 'plugin')
+        for output in ('diagnostic\n{"decision":"block"}', '[]', '{"decision":"block"}\n{}'):
+            with self.subTest(output=output):
+                engine.write_text("#!/bin/sh\nprintf '%s' '" + output + "'\n")
+                result = subprocess.run(['bash', str(ROOT / 'hooks/owner-dispatch-guard.sh')],
+                                        input=json.dumps(self.payload()), text=True, capture_output=True,
+                                        env=self.env, cwd=self.root, timeout=10)
+                self.assertEqual(result.returncode, 0)
+                self.assertEqual(result.stderr, '')
+                self.assertEqual(result.stdout, output)
+                self.assertEqual(self.attempts(), 0)
+
+    def test_delegation_load_and_checkpoint_are_current_context_scoped(self):
+        for tool in ('Agent', 'spawn_agent'):
+            with self.subTest(tool=tool):
+                payload = self.payload(tool, session_id=tool, tool_input={'prompt': 'synthetic task'})
+                result = self.run_hook(payload, 'guard-delegation-owner.sh')
+                self.assertEqual(self.decision(result), 'deny')
+                self.assertEqual(self.run_hook(payload, 'guard-delegation-owner.sh'), {})
+        self.loaded()
+        warm = self.payload('spawn_agent', session_id='warm', tool_input={})
+        self.assertEqual(self.run_hook(warm, 'guard-delegation-owner.sh'), {})
+        self.append({'type': 'compacted', 'payload': {'message': 'summary'}})
+        self.assertEqual(self.decision(self.run_hook(warm, 'guard-delegation-owner.sh')), 'deny')
+        self.loaded('fresh')
+        self.assertEqual(self.run_hook(warm, 'guard-delegation-owner.sh'), {})
+
+    def test_postcompact_high_watermark_prevents_old_delegation_load_resurrection(self):
+        self.loaded()
+        payload = self.payload('spawn_agent', tool_input={})
+        self.assertEqual(self.run_hook(payload, 'guard-delegation-owner.sh'), {})
+        self.compact()
+        self.assertEqual(self.decision(self.run_hook(payload, 'guard-delegation-owner.sh')), 'deny')
+        self.loaded('after-event')
+        self.assertEqual(self.run_hook(payload, 'guard-delegation-owner.sh'), {})
+
+    def test_precompact_alone_preserves_warm_context_and_attempt_cap(self):
+        self.loaded()
+        self.run_hook(self.payload())
+        self.assertEqual(self.compact_event('PreCompact'), {})
+        self.assertEqual(self.run_hook(self.payload()), {})
+        self.assertEqual(self.run_hook(self.payload('spawn_agent'), 'guard-delegation-owner.sh'), {})
+        self.assertEqual(self.attempts(), 1)
+
+    def test_delayed_old_read_after_postcompact_is_not_fresh_proof(self):
+        self.boundary()
+        self.compact()
+        self.loaded('delayed-old-pair')
+        value = self.run_hook(self.payload('spawn_agent'), 'guard-delegation-owner.sh')
+        self.assertEqual(self.decision(value), 'deny')
+        self.assertEqual(self.attempts(), 1)
+
+    def test_new_boundary_and_full_load_after_postcompact_need_no_checkpoint(self):
+        self.compact()
+        self.boundary()
+        self.loaded('fresh')
+        self.assertEqual(self.run_hook(self.payload('spawn_agent'), 'guard-delegation-owner.sh'), {})
+        self.assertEqual(self.attempts(), 0)
+
+    def test_boundary_flushed_before_postcompact_is_compared_with_precompact(self):
+        self.boundary()
+        self.compact_event('PreCompact')
+        self.boundary()
+        self.compact_event('PostCompact')
+        self.loaded('fresh')
+        self.assertEqual(self.run_hook(self.payload('spawn_agent'), 'guard-delegation-owner.sh'), {})
+        self.assertEqual(self.attempts(), 0)
+
+    def test_missing_precompact_does_not_accept_existing_boundary(self):
+        self.boundary()
+        self.compact_event('PostCompact')
+        self.loaded('delayed')
+        value = self.run_hook(self.payload('spawn_agent'), 'guard-delegation-owner.sh')
+        self.assertEqual(self.decision(value), 'deny')
+
+    def test_replaced_or_shrunken_transcript_never_restores_old_proof(self):
+        self.loaded()
+        self.compact()
+        self.log.rename(self.root / 'old.jsonl')
+        self.loaded('replacement-old')
+        value = self.run_hook(self.payload('spawn_agent'), 'guard-delegation-owner.sh')
+        self.assertIn('unavailable', value.get('systemMessage', ''))
+        self.assertEqual(self.attempts(), 0)
+        self.compact()
+        self.log.write_text('')
+        value = self.run_hook(self.payload('spawn_agent'), 'guard-delegation-owner.sh')
+        self.assertIn('unavailable', value.get('systemMessage', ''))
+
+    def test_boundary_arriving_between_snapshots_cannot_upgrade_old_proof(self):
+        spec = importlib.util.spec_from_file_location('checkpoint_test', ROOT / 'hooks/skill-loading.py')
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+        record = {'generation': 'a' * 32, 'offset': 100, 'device': 1, 'inode': 1,
+                  'before_context': 'start:0'}
+        state = SimpleNamespace(read=lambda: record, close=lambda: None,
+                                claim_attempt=lambda *args: True)
+        snapshots = iter([
+            {'context_complete': True, 'context_id': 'offset:100',
+             'completed_skills': ['ccl-skills:multi-agent-delegation']},
+            {'context_complete': True, 'context_id': 'native:200:after', 'completed_skills': []}])
+        reader = SimpleNamespace(context_transcript=lambda *a, **kw: next(snapshots))
+        info = SimpleNamespace(st_dev=1, st_ino=1, st_size=1000)
+        with patch.object(module, 'State', return_value=state), \
+                patch.object(module, 'normalizer', return_value=reader), \
+                patch.object(module, 'regular_info', return_value=info):
+            self.assertEqual(self.decision(module.handle(self.payload('spawn_agent'), {})), 'deny')
+if __name__ == '__main__':
+    unittest.main()

package/dist/assets/marketplace/plugins/ccl-skills/packages/opencode-plugin/ccl-skills.ts

@@ -52,6 +52,7 @@ const UPDATE_REMINDER_MARKER = "CCL Skills Update Reminder"
 // silently inactive in OpenCode.
 const OPENCODE_HOOK_BINDINGS = Object.freeze({
   "session-start.sh": "experimental.chat.system.transform",
+  "skill-context-compact.sh": "event:session.compacted:PreCompact/PostCompact bridge",
   "guard-edit-isolation.sh": "tool.execute.before:edit/write/apply_patch",
   "owner-dispatch-guard.sh": "tool.execute.before:edit/write/apply_patch/bash",
   "guard-merge-authorization.sh": "tool.execute.before:bash",
@@ -64,6 +65,7 @@ const OPENCODE_HOOK_BINDINGS = Object.freeze({
   "subagent-start.sh": "tool.execute.before:task/agent",
   "owner-dispatch-stop.sh": "event:session.idle/session.status",
   "skill-extraction-gate-stop.sh": "event:session.idle/session.status",
+  "proposed-next-stop.sh": "event:session.idle/session.status",
 })
 
 type HookJson = {
@@ -516,7 +518,10 @@ export const CclSkills = async (context: {
           type: "assistant",
           message: { content: [{ type: "tool_use", id: targets.length === 1 ? callID : `${callID}-${index}`, name: "Edit", input: { file_path: filePath } }] },
         }))
-      } else {
+      } else if (tool !== "skill") {
+        // A pending native Skill is held in pendingSkills, not represented as a
+        // malformed Claude Skill request. Emit its paired evidence only after
+        // the native completion proves the loaded source belongs to CCL.
         appendTranscript(sessionID, {
           type: "assistant",
           message: { content: [{ type: "tool_use", id: callID, name: toolName, input: {} }] },
@@ -535,13 +540,13 @@ export const CclSkills = async (context: {
             ].join("\n"),
           )
         }
-        const hookPayload = payload(sessionID, { tool_name: "Edit", tool_input: { ...args, file_path: filePath } })
+        const hookPayload = payload(sessionID, { hook_event_name: "PreToolUse", tool_name: "Edit", tool_input: { ...args, file_path: filePath } })
         enforce(runHook(hooksRoot, "guard-edit-isolation.sh", hookPayload, directory, 10_000), "ccl-skills edit-isolation guard")
         enforce(runHook(hooksRoot, "owner-dispatch-guard.sh", hookPayload, directory, 10_000), "ccl-skills owner-dispatch guard")
       }
 
       if (tool === "bash") {
-        const hookPayload = payload(sessionID, { tool_name: "Bash", tool_input: args })
+        const hookPayload = payload(sessionID, { hook_event_name: "PreToolUse", tool_name: "Bash", tool_input: args })
         enforce(runHook(hooksRoot, "owner-dispatch-guard.sh", hookPayload, directory, 10_000), "ccl-skills owner-dispatch guard")
         const merge = runHook(hooksRoot, "guard-merge-authorization.sh", hookPayload, directory, 10_000)
         if (merge.status !== "ok" && potentialLandingCommand(args.command)) {
@@ -561,7 +566,7 @@ export const CclSkills = async (context: {
       }
 
       if (tool === "task" || tool === "agent") {
-        const hookPayload = payload(sessionID, { tool_name: toolName, tool_input: args })
+        const hookPayload = payload(sessionID, { hook_event_name: "PreToolUse", tool_name: toolName, tool_input: args })
         const delegation = runHook(hooksRoot, "guard-delegation-owner.sh", hookPayload, directory, 10_000)
         const delegationReason = permission(delegation).reason ?? ""
         enforce(delegation, "ccl-skills delegation-owner guard")
@@ -616,9 +621,21 @@ export const CclSkills = async (context: {
           ? (properties.info as { id: string }).id
           : ""
       if (!sessionID) return
-      if (event.type === "session.deleted" || event.type === "session.idle" || (properties.status as { type?: string } | undefined)?.type === "idle") {
+      if (event.type === "session.compacted" && (typeof properties.sessionID !== "string" || !properties.sessionID)) return
+      if (event.type === "session.deleted" || event.type === "session.compacted" || event.type === "session.idle" || (properties.status as { type?: string } | undefined)?.type === "idle") {
         for (const key of pendingSkills.keys()) if (key.startsWith(`${sessionID}\0`)) pendingSkills.delete(key)
       }
+      if (event.type === "session.compacted") {
+        // OpenCode emits this only after successful compaction, with sessionID.
+        // Preserve actor identity: the shared hook selects agent_transcript_path
+        // for children, so a child's reset cannot invalidate its parent's reads.
+        // PreCompact here snapshots the bridge's completed-event boundary; it is
+        // not a claim that OpenCode emitted a native pre-compaction callback.
+        runHook(hooksRoot, "skill-context-compact.sh", payload(sessionID, { hook_event_name: "PreCompact" }), directory, 5_000)
+        appendTranscript(sessionID, { type: "system", subtype: "compact_boundary" })
+        runHook(hooksRoot, "skill-context-compact.sh", payload(sessionID, { hook_event_name: "PostCompact" }), directory, 5_000)
+        return
+      }
       if (event.type === "session.deleted") {
         const path = transcriptPath(sessionID)
         if (path) rmSync(path, { force: true })
@@ -630,10 +647,14 @@ export const CclSkills = async (context: {
       if (!isIdle || idleInFlight.has(sessionID)) return
       idleInFlight.add(sessionID)
       try {
-        const stopPayload = payload(sessionID, { stop_hook_active: false })
+        // Idle events do not carry an authoritative final assistant message.
+        // Formatting backstops stay unverifiable rather than reading stale text
+        // from the intentionally metadata-only adapter transcript.
+        const stopPayload = payload(sessionID, { hook_event_name: "Stop", stop_hook_active: false, last_assistant_message: null })
         const results = [
           runHook(hooksRoot, "owner-dispatch-stop.sh", stopPayload, directory, 10_000),
           runHook(hooksRoot, "skill-extraction-gate-stop.sh", stopPayload, directory, 15_000),
+          runHook(hooksRoot, "proposed-next-stop.sh", stopPayload, directory, 5_000),
         ]
         const reasons = results
           .filter((result) => result.output?.decision === "block" && typeof result.output.reason === "string")

package/dist/assets/marketplace/plugins/ccl-skills/scripts/owner-dispatch/README.md

@@ -25,13 +25,21 @@ This subsystem is that gate. It mirrors the repo's existing `guard-edit-isolatio
 PreToolUse pattern and is built on the hook decision model in
 `skills/llm-inference-integration/references/agent-lifecycle-hooks.md`.
 
+The plugin also supplies a separate default skill-loading checkpoint. On the first
+precise source edit it returns one agent-facing denial so the agent can apply the
+canonical routing rule, load missing implementation skills and retry. It does not
+guess an owner from a file extension, request user approval, or verify a boundary
+record. Its cap is per actor and context; blind retries and parallel siblings can
+proceed. The configured engine's decisions take precedence. The opt-in and CI
+contracts below describe this subsystem, not that bounded recovery checkpoint.
+
 ## Surfaces (defense in depth)
 
 | Surface | When | Hard? | Bypassable? |
 |---|---|---|---|
-| `PreToolUse` (Edit/Write/MultiEdit/NotebookEdit + Bash) → `owner-dispatch-guard.sh` | at the first product-code edit (**fires in subagents too** — Claude Code runs PreToolUse inside dispatched workers, carrying `agent_id`) | Claude: precise file edits `ask` (or `deny` if `strict`); **Bash writes are record-only — silent allow, no prompt** (they only drop an activity marker for the Stop backstop). Codex: advisory (ignores the decision). | Yes — the Bash heuristic never blocks (it over-matches read-only commands, so prompting on it is pure noise); many Bash write forms also slip it. This surface is a fast nudge on precise edits, not the gate. |
-| `SubagentStart` → `subagent-start.sh` | when any subagent is spawned | injects a slim, **self-gating** ccl-skills routing pointer (impl/test/design/doc workers invoke their owning skill; read-only workers ignore it) — SessionStart's routing is NOT inherited by subagents, so this is their only see-it surface. Informational: SubagentStart **cannot block**. | n/a — additive context only; never overrides an owner-set the controller named in the dispatch prompt. |
-| `Stop` / `SubagentStop` → `owner-dispatch-stop.sh` | at session/subagent end, **only if that actor actually changed gated code** (current tree diffed against a baseline snapshot taken at the first touch) with no boundary or with required owners not actually invoked | Claude: blocks **once per actor per session** — `SubagentStop` verifies `agent_transcript_path` when present; a legacy controller-transcript fallback never uses strict empty-set proof. Zero Skill calls are a miss only when the worker tool-event shape is verifiable. `agent_id` scopes activity/cap/waiver so siblings do not contaminate each other. Codex: advisory. | one-block cap + fail-open for unreadable/malformed/shape-drifted evidence + evidence-gate (read-only / rejected / reverted / pre-existing-dirty actors never block) means it never traps the user. |
+| `PreToolUse` (Edit/Write/MultiEdit/NotebookEdit + Bash) → `owner-dispatch-guard.sh` | at the first product-code edit (**fires in subagents too** — Claude Code runs PreToolUse inside dispatched workers, carrying `agent_id`) | Claude precise edits use `ask`, or `deny` under `strict`. Codex `apply_patch` uses advisory context by default and `deny` under `strict`; its native hook parser rejects `ask`. **Bash writes are record-only — silent allow, no prompt** (they only drop an activity marker for the Stop backstop). | Yes — the Bash heuristic never blocks (it over-matches read-only commands, so prompting on it is pure noise); many Bash write forms also slip it. This surface is a fast nudge on precise edits, not the gate. |
+| `SubagentStart` → `subagent-start.sh` | when any subagent is spawned | injects a slim, **self-gating** ccl-skills routing pointer (impl/test/design/doc workers invoke their owning skill; read-only workers ignore it) for the new actor. Informational: SubagentStart **cannot block**. | n/a — additive context only; never overrides an owner-set the controller named in the dispatch prompt. |
+| `Stop` / `SubagentStop` → `owner-dispatch-stop.sh` | at session/subagent end, **only if that actor actually changed gated code** (current tree diffed against a baseline snapshot taken at the first touch) with no boundary or with required owners not actually invoked | Claude/Codex native hooks: block **once per actor per session** — `SubagentStop` verifies `agent_transcript_path` when present; a legacy controller-transcript fallback never uses strict empty-set proof. Zero Skill calls are a miss only when the worker tool-event shape is verifiable. `agent_id` scopes activity/cap/waiver so siblings do not contaminate each other. | one-block cap + fail-open for unreadable/malformed/shape-drifted evidence + evidence-gate (read-only / rejected / reverted / pre-existing-dirty actors never block) means it never traps the user. |
 | `ci` subcommand (pre-commit / CI) | at commit/merge | host-agnostic; rejects gated changes lacking an updated map, and rejects changes that remove/disable/malform the config or point the artifact off-tree | The durable backstop — **but only as un-bypassable as the CI job itself** (needs pipelines-must-succeed + protected branch + CODEOWNERS, per the repo deployment checklist). |
 
 ## Safety posture (every default is the safe one)
@@ -47,18 +55,18 @@ PreToolUse pattern and is built on the hook decision model in
   malformed config ⇒ silent allow (treated as not-opted-in). An unwritable/unsafe state dir ⇒
   allow (and `strict` downgrades to `ask`). The cheap opt-in walk runs before any git/jq, so a
   non-opted repo pays almost nothing.
-- **Default `ask`, not `deny`.** Hard `deny` is the explicit `strict:true` opt-in, is
-  Claude-only, and applies **only to the precise Edit/Write/MultiEdit/NotebookEdit file
-  paths** — a write-like **Bash** command is matched only heuristically (it over-matches
+- **Engine default `ask`, strict `deny`.** Codex converts the default `ask` to advisory
+  context because its native parser rejects that decision. The separate default source-edit
+  checkpoint adds one bounded agent-facing denial. Engine `strict:true` applies **only to
+  precise file paths** — a write-like **Bash** command is matched only heuristically (it over-matches
   read-only commands and can never be sure), so it is **record-only: silent allow, never a
   prompt and never a deny**, even under `strict`. The Stop hook + `ci` catch what the Bash
   heuristic can only hint at. `strict` also downgrades to `ask` when the state dir can't be
   written (so it can never brick a repo).
-- **Agent self-resolves the boundary; it is not a user-authorization prompt.** The deny/ask/Stop
-  message is addressed to the **agent**: invoke the owning skills, then `record --owners` to clear
-  the boundary — do not punt it to the user as an approval. It clears **only this gate**; separate
-  user-authorized actions (merge, push, destructive cleanup, scope/product decisions) still require
-  the user. `record` takes out a **per-worktree TTL lease**, not a per-slice token: it stays
+- **The agent can resolve the owner boundary.** Invoke the owning skills, then `record --owners`.
+  Claude `ask` requests host approval; explanatory text cannot suppress that prompt.
+  Resolving the boundary clears **only this gate**, and grants no authority for merge, push,
+  destructive cleanup or scope/product decisions. `record` takes out a **per-worktree TTL lease**, not a per-slice token: it stays
   valid until the TTL expires as long as work continues forward from the recorded commit
   (committing does NOT invalidate it; switching to a divergent line does). The gate cannot
   tell two deliveries apart inside one lease, so a second slice on the same line within the
@@ -69,10 +77,10 @@ PreToolUse pattern and is built on the hook decision model in
 - **`strict:true` is a maintainer/config decision, not an agent prompt-reduction knob, and not a
   safety guarantee.** Flipping `strict` is committed, team-wide repo config — make it a separate
   reviewed config-only change, never something an agent toggles inside a product edit to stop being
-  prompted. What it buys is narrow: it reduces **Claude** user prompts for *precise file-edit* hooks
-  by turning `ask` into an agent-facing `deny` the agent self-clears. It does **not** make the gate
-  safe on its own — it is fail-open, downgrades to `ask` when the state dir is unwritable, never
-  hard-denies heuristic Bash, is advisory on Codex, and does not replace CI / protected branches /
+  prompted. For precise edits, it turns Claude `ask` or Codex advisory context into an agent-facing
+  `deny` that the agent self-clears. It does **not** make the gate
+  safe on its own — it is fail-open, downgrades to `ask` (Codex advisory) when state is unwritable, never
+  hard-denies heuristic Bash, and does not replace CI / protected branches /
   CODEOWNERS / human map review (the durable backstop).
 - **Stop / SubagentStop never traps the user.** It requires a real `session_id` (fail-open
   without one), inspects only the current `PWD` repo, blocks **at most once per actor per

package/dist/assets/marketplace/plugins/ccl-skills/scripts/owner-dispatch/owner-dispatch.sh

@@ -20,8 +20,8 @@
 #   - FAIL-OPEN: any internal error (missing jq/git, parse failure, unwritable/unsafe
 #     state dir, missing session id) ALLOWS the action. A broken gate must never brick
 #     editing, and no error path may fail-CLOSED.
-#   - DEFAULT `ask`, NOT `deny`: hard `deny` is the explicit `strict:true` opt-in, is
-#     Claude-Code-only (Codex ignores the decision), applies ONLY to precise
+#   - DEFAULT `ask`, NOT `deny`: hard `deny` is the explicit `strict:true` opt-in
+#     on compatible native Claude/Codex hooks. It applies ONLY to precise
 #     Edit/Write/MultiEdit/NotebookEdit file paths (never the heuristic Bash match),
 #     and is downgraded to `ask` when the boundary state dir is not safely writable
 #     (so strict can never brick a repo whose state dir is unavailable).
@@ -54,10 +54,17 @@ AIDKEY=""         # filename-safe, INJECTIVE key for agent_id, computed by jq @b
                   # collide on the same marker). Empty iff no agent_id. Scopes the activity
                   # marker / block-cap / waiver to ONE subagent.
 
+HOST_INPUT="$(cd "$(dirname "$SELF")/../.." && pwd)/hooks/host-input.py"
+HOST_TOOL=""
+
 # ----- fail-open helpers ------------------------------------------------------
 allow_pretool() { exit 0; }   # no output => allow
 allow_stop()    { exit 0; }   # no output => allow stop
 emit_pretool_deny() { # $1 reason  $2 decision(deny|ask)
+  if [ "$2" = ask ] && [ "$HOST_TOOL" = apply_patch ]; then
+    jq -nc --arg r "$1" '{hookSpecificOutput:{hookEventName:"PreToolUse",additionalContext:("Advisory owner routing: " + $r)}}'
+    exit 0
+  fi
   jq -nc --arg r "$1" --arg d "$2" \
     '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:$d,permissionDecisionReason:$r}}'
   exit 0
@@ -393,6 +400,10 @@ boundary_state() { # $1 root  -> echo valid|expired|discontinuous|absent
 # Emit the base skill names invoked in a transcript, ONE PER LINE (strip any "prefix:").
 invoked_skills() { # $1 transcript-path
   [ -n "$1" ] && [ -r "$1" ] || return 0
+  if have python3 && [ -r "$HOST_INPUT" ]; then
+    python3 "$HOST_INPUT" transcript "$1" 2>/dev/null | jq -r '.requested_skills[] | if startswith("ccl-skills:") then ltrimstr("ccl-skills:") else . end' 2>/dev/null
+    return 0
+  fi
   # Per-line jq (JSONL); tolerate malformed lines. A line's message.content[] may
   # carry tool_use blocks. input.skill is "ccl-skills:foo" or bare "foo".
   jq -rR '
@@ -415,6 +426,10 @@ invoked_skills() { # $1 transcript-path
 # transcript or Skill-event shape drifted" without turning valid-JSON drift into a trap.
 transcript_has_verifiable_invocation_shape() { # $1 transcript-path
   [ -n "$1" ] && [ -r "$1" ] || return 1
+  if have python3 && [ -r "$HOST_INPUT" ]; then
+    python3 "$HOST_INPUT" transcript "$1" 2>/dev/null | jq -e '.verifiable' >/dev/null 2>&1
+    return $?
+  fi
   jq -seR '
     [ split("\n")[]
       | try fromjson catch empty
@@ -666,6 +681,30 @@ cmd_pretool() {
   AIDKEY=$(printf '%s' "$input" | aid_key_from)                          # injective key (jq, raw JSON)
   tool=$(printf '%s' "$input" | jq -r '.tool_name // empty' 2>/dev/null)
 
+  HOST_TOOL="${1:-$tool}"
+  if [ "$tool" = apply_patch ]; then
+    # Inspect every target, including moves and deletions. A safe first path
+    # must not short-circuit checks of the remaining paths in the same patch.
+    have python3 && [ -r "$HOST_INPUT" ] || emit_pretool_deny "owner-dispatch cannot inspect apply_patch: Python input normalizer unavailable." deny
+    local normalized target converted response deny_response="" advisory_response=""
+    normalized=$(printf '%s' "$input" | python3 "$HOST_INPUT" paths 2>/dev/null) || emit_pretool_deny "owner-dispatch cannot inspect apply_patch input." deny
+    [ "$(printf '%s' "$normalized" | jq -r '.malformed_patch')" = false ] || emit_pretool_deny "owner-dispatch cannot inspect malformed apply_patch targets." deny
+    while IFS= read -r -d '' target; do
+      converted=$(printf '%s' "$input" | jq -c --arg p "$target" '.tool_name="Edit" | .tool_input={file_path:$p}')
+      response=$(printf '%s' "$converted" | cmd_pretool apply_patch)
+      [ -n "$response" ] || continue
+      if printf '%s' "$response" | jq -e '.hookSpecificOutput.permissionDecision == "deny"' >/dev/null 2>&1; then
+        [ -n "$deny_response" ] || deny_response="$response"
+      else
+        [ -n "$advisory_response" ] || advisory_response="$response"
+      fi
+    done < <(printf '%s' "$normalized" | jq -j '.paths[] | . + "\u0000"')
+    # An advisory first target must not hide a later strict denial. Inspect all
+    # targets before emitting one response so activity evidence is complete too.
+    [ -n "$deny_response" ] && { printf '%s\n' "$deny_response"; exit 0; }
+    [ -n "$advisory_response" ] && { printf '%s\n' "$advisory_response"; exit 0; }
+    allow_pretool
+  fi
   case "$tool" in
     Edit|Write|MultiEdit|NotebookEdit)
       fp=$(printf '%s' "$input" | jq -r '.tool_input.file_path // .tool_input.notebook_path // .tool_input.path // empty' 2>/dev/null)

package/dist/assets/marketplace/plugins/ccl-skills/skills/product-rd-workflow/references/pre-final-continuation-gate.md

@@ -93,7 +93,7 @@ At the start of the next turn, recover intent in this order:
 2. For short assent, read back the original wording of the most recent still-active concrete proposal and check that later messages or task state have not withdrawn or superseded its action, scope, or authority. Quote that original proposal when stating the recovered action and scope; a summary or paraphrase alone cannot bind short assent. If recovery adds an action or broadens that quoted scope, select `blocked:` and ask. One recoverable action can bind with or without a marker; a stale, repeated, or conflicting marker is an assistant formatting defect to repair.
 3. If materially different proposals remain unresolved, or scope/authority is still unclear, ask one targeted question about that uncertainty. Do not ask the user to repair a marker or repeat a clear instruction. A marker alone never supplies missing authority.
 
-Use the active owner's entry and safety gates for the recovered action. An authorized task includes necessary fixes, tests and review by default; neither a router nor a dispatched owner may discard that authority by relabeling its turn or exhausting an internal review sequence. Apply the owning review checkpoint and record `continuation_basis=existing-task-scope` with cumulative history in the caller-owned task artifact, not runtime JSON. Legacy `human_decision_required` / `continuation_authorization_required` values first require checking existing authority, not asking again. Explicit user cost, round-count and stop limits prevail; new scope, missing authority or real tradeoffs need a decision. Continuation grants no merge, publication or waiver authority. This is a prose contract, not a host-enforced hook; it cannot prove compliance by a task that never loads it.
+- Use the active owner's entry and safety gates for the recovered action. An authorized task includes necessary fixes, tests and review by default; neither a router nor a dispatched owner may discard that authority by relabeling its turn or exhausting an internal review sequence. Apply the owning review checkpoint and record `continuation_basis=existing-task-scope` with cumulative history in the caller-owned task artifact, not runtime JSON. Legacy `human_decision_required` / `continuation_authorization_required` values first require checking existing authority, not asking again. Explicit user cost, round-count and stop limits prevail; new scope, missing authority or real tradeoffs need a decision. Continuation grants no merge, publication or waiver authority. Intent recovery and authorization remain prose obligations. The optional `proposed-next-stop.sh` backstop checks only missing handoff labels on hosts providing a current final message and observable delivery evidence; a label or hook receipt never proves the action is correct, authorized or complete.
 
 ## Gate triggers and outcome contract
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/source-register.md

@@ -697,3 +697,7 @@ The pending classification above is superseded by the executed source comparison
 | 评审模式把被评审仓库自己入库的约定文件引在候选之后交给评审员：从仓库根到每个改动路径的每层目录取 `AGENTS.override.md`（否则 `AGENTS.md`）、`CLAUDE.md`、`.claude/CLAUDE.md`，根在前，32 KiB 以内；未入库和 `CLAUDE.local.md` 一律不读（不得外发给别家评审模型），链接、非 UTF-8、超预算的整份省略并记原因，永不因约定文件让评审失败；有引用时加 `repository_contract` concern，要求评审员报改动违反的规则和规则本身的缺陷（`Contract defect:`），规则只作数据、不能为缺陷开脱 | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: no; firing-path: command:skills/code-review/scripts/test_review_gate.sh | `updated` | Owner key `code-review/SKILL.md`（入口未改）；改动在 `skills/code-review/scripts/review_gate.py`（`repository_contract_section`、profile 与结果的 `repository_contract` 字段、条件 concern、trust boundary 一句）、`skills/code-review/references/staged-review-contract.md`、`skills/code-review/references/development-completion.md`（偏离约定要在 plan intent 里声明、`Contract defect:` 的处置、不许悄悄放松约定文件），`skills/code-review/scripts/test_review_client_compat.py` 的 provider mock 改为放行控制器自己的 git 读取；共享读取函数 `read_bounded_regular_file` 逐级打开目录中途失败时不再泄漏已持有的目录描述符（修复前 100 次失败读取后打开的描述符由 4 个涨到 254 个，约定文件被逐个省略时会反复触发）。发现规则按两家宿主一手文档核对（Codex：每层目录 override 优先、根到深拼接、默认 32 KiB；Claude Code：`CLAUDE.md` 或 `.claude/CLAUDE.md`，`CLAUDE.local.md` 是个人文件）。`candidate_sha256` 在追加前算定，引用内容不能增加候选路径；challenge、complete、wording-only 不附加。不读 `@path` 导入、`.claude/rules`、宿主配置的备用文件名（结果里 `sources_not_read` 列明）。RED-baseline（applied，differential）：在副本上分别去掉「只收已入库文件」、去掉 override 优先、不加 concern，三条约定用例里恰好两条变红、其余用例全绿；base 版控制器配新套件时三条约定用例全红；中间目录被换成链接、带第二个硬链接的约定文件都被省略且内容不进评审包。 |
 | 产品研发验证门里「评审后有实质改动才全量重跑」的「实质」一词删除：评审后的任何改动（含测试 / 文档）都触发全量重跑，作者不能自行判定改动无关紧要 | `product-rd-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/product-rd-workflow/SKILL.md#any post-review change, tests/docs included | `updated` | Owner key `product-rd-workflow/SKILL.md`（改一句，字数与字节都不增）。Observed failure 同上一条生产会话：它把评审后的提交归为「只有测试和文档」而没有重审，原句的「实质」正好给了这个归类余地。RED-baseline 同上：红的一半是生产失效，隔离探针在改前文本上未复现，改动效果未被证明。 |
 | 提炼流程的增量复查上限由两次改为五次（用户裁决），同步 `skills/skill-extraction-workflow/SKILL.md`、`dual-track-review-gate.md`、`extraction-quickstart.md` 与被测试钉住的原文；本行按指针取代 127 轮评审线那一行里的「最多两次」 | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: no; firing-path: file:skills/skill-extraction-workflow/references/dual-track-review-gate.md#After five delta passes a still-open P0/P1 | `updated` | Owner key `skill-extraction-workflow/SKILL.md`（同一行内省 6 字节，入口不增长）。delta 复查改为 `--base <已评审提交>` 取增量，使它绑定工作区并留下 PR hook 读取的本机回执。RED-baseline（applied）：`test_extraction_review_gate.sh` 钉住的短语由两次改为五次后，对 base 文本变红、对 head 文本变绿。 |
+| Host boundary normalization preserves shared isolation and authorization rules while native inventory separates installation from trust | `worktree-isolation` / `multi-agent-delegation` / `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:hooks/guard-edit-isolation.sh | updated | `specs/129-host-hook-compatibility/plan.md` binds synthetic baseline failures, patch/delegation transcript normalization, bounded target authorization, startup context budgets and native trust diagnostics. Tests cover malformed/multiple/moved paths, incomplete skill reads, revoked/expired/wrong-target grants and incomplete or wrong-plugin hook inventories. Trust receipts remain distinct from runtime effect. |
+| Missing delivery handoffs receive a bounded current-message formatting reminder | `product-rd-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/product-rd-workflow/references/pre-final-continuation-gate.md#checks only missing handoff labels | updated | `product-rd-workflow/SKILL.md` owns the shared handoff rule; `specs/129-host-hook-compatibility/plan.md` records the absent-hook baseline and 18 native-shaped cases. The startup cue and Stop backstop preserve current user scope, pure artifacts and host loop prevention. A marker proves neither authorization nor completion; unsupported host final-message data remains unverifiable. |
+| Catalog fixtures pair candidate contracts with candidate hook executables | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_check_ccl_skill_catalog.sh | updated | `skill-extraction-workflow/SKILL.md` owns the fixture contract. The pristine case failed when a candidate ledger referenced a new hook absent from the committed clone. Copying the candidate hook tree with its skill contracts restores the complete fixture; the existing catalog suite passes without changing gate predicates. |
+| Source editing and delegation receive one bounded skill-loading replan per actor and current context | `product-rd-workflow` / `multi-agent-delegation` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:hooks/test_skill_loading.py | updated | `agent-context/session-start.md` supplies the transition rule and `hooks/skill-loading.py` implements its bounded checkpoint; both named owner skill entries are unchanged in this round. `specs/129-host-hook-compatibility/plan.md` records the missing default first-edit checkpoint, stale post-compaction evidence and incomplete-read false positive. The checkpoint defers one precise edit or cold dispatch attempt, uses the canonical transition rule, never asks the user to approve skill loading, and preserves configured decisions. PreCompact snapshots the previous native boundary; PostCompact invalidates old visibility, and only a confirmed new boundary permits fresh full-read evidence. Guidance is delivered on subsequent PreToolUse. A capped retry or parallel sibling can proceed, so a reminder is neither correct-owner proof nor a substitute for opt-in enforcement. Native execution and model adherence are separate validation claims. |

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_skill_catalog.sh

@@ -60,6 +60,11 @@ new_case() {
   rm -rf "$CASE_DIR/skills"
   mkdir -p "$CASE_DIR/skills"
   cp -R "$candidate_skill_root/skills/." "$CASE_DIR/skills/"
+  # Candidate ledger firing paths may name a newly added shipped hook. Keep the
+  # executable surface with its candidate contracts instead of committed HEAD.
+  rm -rf "$CASE_DIR/hooks"
+  mkdir -p "$CASE_DIR/hooks"
+  cp -R "$REPO_ROOT/hooks/." "$CASE_DIR/hooks/"
   cp "$REPO_ROOT/docs/SKILLS.md" "$CASE_DIR/docs/SKILLS.md"
   cp "$REPO_ROOT/agent-context/session-start.md" "$CASE_DIR/agent-context/session-start.md"
   cp "$candidate_eval_root/eval/routing-tasks.jsonl" "$CASE_DIR/eval/routing-tasks.jsonl"

package/dist/assets/marketplace/plugins/ccl-skills/skills/worktree-isolation/SKILL.md

@@ -147,7 +147,7 @@ worktree 的活一旦**集成进目标分支**就完了，立刻清理（唯一
 **合并执行协议（canonical——always-on 层「硬纪律 1」指向本节，两面同步修改；执行配方只放这里，不进 always-on 层）**：
 1. **按目标判断授权**：用户已要求“做完并合并”“发布这个版本”等端到端结果时，必需的提交、推送、创建/更新 MR、平台合并和既定发布步骤默认已授权；不要求等 MR 创建后再说一次“合并”。授权限于当前目标，持续至完成、撤回或范围变更；普通补充消息和范围内修复不撤销目标授权。agent 先展示已核对的范围、源→目标、MR 链接、head SHA、CI/验证状态和执行顺序；展示是执行义务，不新增审批。只要求单项、准备或待审时不得扩展成发布。单个“合并”仍指当前唯一 MR；显式“批量合并 N”仍只覆盖已展示计划内至多 N 次合并（该计数授权 4 小时有效，用户新消息清除剩余额度）。目标不明、混入无关变更或额外高风险动作时，只暂停对应动作并确认。
 2. **变化先核验**：目标/批量授权内由 agent 完成的修复、新提交或新建 MR，先刷新检查、评审与状态，不重复请求权限。单个对象授权后 head 改变、混入第三方或目标外内容、或多个 MR 指向不明时再确认。CI 从运行中变为通过本身不是权限失效；失败和冲突先诊断修复，不能绕过门禁。
-   **宿主机械放行阀**：Claude Code 的 `hooks/merge-authorization-prompt.sh` 只识别单独“合并/merge”或“批量合并 N”等锚定指令，`hooks/guard-merge-authorization.sh` 消费一次/计数额度；它不能从自然语言目标推导授权，目标授权也不会自动生成哨兵。若真实宿主拒绝且没有已获授权的正常审批路径，说明宿主限制并请求最小放行，不得自行写哨兵、关闸或换工具绕过。直推默认分支、auto-merge/排队/`--admin` 及一条命令内多个合并仍不放行；其他宿主按实际权限机制和上述目标边界执行。
+   **宿主机械放行阀**：平台合并前读 `references/hook-authorization.md`，核对锚定指令、仓库/编号、额度期限及暂停/撤销。它不推导发布目标或未来 PR 归属；机械额度缺失、暂停或过期不等于目标授权不存在。若真实宿主拒绝且没有已获授权的正常审批路径，说明宿主限制并请求最小放行，不得自行写哨兵、关闸或换工具绕过。直推默认分支、auto-merge/排队/`--admin` 及一条命令内多个合并仍不放行；其他宿主按实际权限机制和上述目标边界执行。
 3. **执行建议（agent 防呆，不增加用户负担）**：获授权后的执行一次性立即合并、不转 auto-merge/排队；显式点名目标 MR/PR（glab/gh 缺省都解析"当前分支"，同分支多 MR/PR 时会合错对象）；建议把自己已知的 head SHA 作为守卫传给命令：`glab mr merge <iid> --sha <head SHA> --auto-merge=false --yes` / `gh pr merge <PR号|URL> --merge --match-head-commit <head SHA>`（合并策略显式给 `--merge`/`--squash`/`--rebase`，缺省会进交互）。守卫被平台拒绝时重新读取目标并按第 2 条核验授权范围。**一次性合并授权按「命令被放行」消耗，不按「合并成功」消耗**：命令因你自己的参数错误而失败（自造不存在的 flag、SHA 用前缀而非平台现读的完整值、点错 MR 号）同样烧掉这次授权，该机械额度需重新放行；没有此宿主限制的目标授权不因参数错误失效，确认前次未合并后修正重试。所以执行前把 flag 与取值当成不可凭记忆的东西核一遍——**flag 拼写以本机该 CLI 的 `--help` 为准**（同名工具跨版本/跨平台差异很大，"我记得有这个 flag" 是最常见的烧授权方式），**SHA 一律从平台 API 现读完整值**（前缀补全会被守卫拒成 409）。已实测两次：一次前缀补全 409，一次自造 `--merge`（该版本 glab 无此 flag，合并策略缺省即 merge commit）——守卫两次都按设计挡住了错误合并，代价都是让用户重新授权一次。
 4. **仓库策略例外**：仓库强制 merge queue / auto-merge、或只能直推默认分支时，停下把该仓的合并语义摆给用户裁决，不得套用立即合并流程近似执行。
 5. **合并后自查**：合并后核对实际合入内容与本次交付预期一致，发现超出如实报告用户裁决（回滚/接受），不得静默带过。

package/dist/assets/marketplace/plugins/ccl-skills/skills/worktree-isolation/references/hook-authorization.md

@@ -0,0 +1,13 @@
+# Hook 合并授权
+
+以下执行额度规则受 [合并执行协议](../SKILL.md) 的目标授权、验证和安全边界约束。`hooks/merge-authorization-prompt.sh` 从用户指令生成额度，`hooks/guard-merge-authorization.sh` 在平台合并命令放行时消费额度。
+
+## 指令与有效期
+
+支持原有单独“合并/merge”和“批量合并 N”，另支持完整单行“完成并合并 PR #123 / MR !123”（英文 `finish and merge PR #123`）。原有单次/计数额度仍被任何新消息清除。
+
+新形式只绑定当前 `origin` 仓库和指定编号，原始 60 分钟内消费一次；单独“继续/继续吧/进度/状态/continue/status/progress”保留原额度和到期时间，“停止/停一下/不要合并/撤销合并授权/stop/pause/cancel merge”撤销，其他消息暂停机械额度，之后“继续”不能恢复。
+
+## 执行命令
+
+新形式的执行命令必须是单条直接 `gh pr merge` 或 `glab mr merge`，显式编号；gh 使用 `--repo host/owner/repo` 并指定策略，glab 使用 `--repo https://host/namespace/repo` 并指定 `--auto-merge=false --yes`，可附完整 head SHA，其他参数和 API 形式保持未核验。