@ccoalm/ccl-skills 0.18.10 → 0.18.11

package/dist/assets/marketplace/plugins/ccl-skills/hooks/host-input.py

@@ -579,8 +579,8 @@ def machine_artifact(text):
     return False
 
 
-def stop_notice(payload, lane, message):
-    """Cap notice attempts only; these markers never establish verification."""
+def claim_notice(payload, lane):
+    """True on this lane's first attempt, False on a repeat, None when state is unavailable."""
     try:
         # Reuse the installed runtime's owned-directory/no-follow/atomic claim
         # protections. Minimal vendored runtimes may omit this optional helper.
@@ -596,14 +596,19 @@ def stop_notice(payload, lane, message):
         info = module.regular_info(path)
         state = module.State(key)
         try:
-            if not state.claim_attempt('stop-notice-' + lane, [info.st_dev, info.st_ino]):
-                return None
+            return bool(state.claim_attempt('stop-notice-' + lane, [info.st_dev, info.st_ino]))
         finally:
             state.close()
     except Exception:
-        # Missing identity, a broken optional helper or unsafe/unavailable state
-        # must not invent success. This boundary only controls advisory output.
-        pass
+        return None
+
+
+def stop_notice(payload, lane, message):
+    """Cap notice attempts only; these markers never establish verification."""
+    # Missing identity, a broken optional helper or unsafe/unavailable state must
+    # not invent success: the notice still shows. This only controls advisory output.
+    if claim_notice(payload, lane) is False:
+        return None
     return {'systemMessage': message}
 
 
@@ -721,6 +726,75 @@ def doc_closeout_note(payload):
             'the substance stays as the owning skill decided.'.format(names))
 
 
+# Every request re-reads the whole context, so a long session's token cost grows
+# with its size, and a 1M-token window compacts only near its limit by default.
+# The notice goes to the user only (systemMessage, never the model's context),
+# once per band per transcript, and reads just the transcript tail.
+CONTEXT_BANDS = (300000, 600000)
+CONTEXT_TAIL_BYTES = 1024 * 1024
+
+
+def last_context_tokens(path):
+    """Context size of the latest real Claude request, or None when unknown."""
+    descriptor = os.open(path, os.O_RDONLY | os.O_NONBLOCK)
+    with os.fdopen(descriptor, 'rb') as stream:
+        metadata = os.fstat(stream.fileno())
+        if not stat.S_ISREG(metadata.st_mode):
+            return None
+        stream.seek(max(0, metadata.st_size - CONTEXT_TAIL_BYTES))
+        tail = stream.read(CONTEXT_TAIL_BYTES)
+    for line in reversed(tail.split(b'\n')):
+        if b'"usage"' not in line:
+            continue
+        try:
+            event = json.loads(line)
+        except ValueError:
+            continue
+        if not isinstance(event, dict) or event.get('type') != 'assistant' or event.get('isSidechain'):
+            continue
+        message = event.get('message')
+        usage = message.get('usage') if isinstance(message, dict) else None
+        if not isinstance(usage, dict):
+            continue
+        total = 0
+        for key in ('input_tokens', 'cache_read_input_tokens', 'cache_creation_input_tokens'):
+            value = usage.get(key)
+            if isinstance(value, int) and not isinstance(value, bool) and value > 0:
+                total += value
+        if total:
+            return total
+    return None
+
+
+def context_notice(payload):
+    path = payload.get('transcript_path')
+    if not isinstance(path, str) or not path:
+        return None
+    tokens = last_context_tokens(path)
+    reached = [band for band in CONTEXT_BANDS if tokens is not None and tokens >= band]
+    if not reached:
+        return None
+    message = ('本会话上下文约 {} 万 token：之后每次请求都会重读这些内容，长会话的 token 主要花在这里。'
+               '当前交付收口后可先写好交接再 /clear 开新会话；或用 /autocompact 把自动压缩提前'
+               '（如 /autocompact 400k）。此提示只显示给你，不影响当前任务。').format(tokens // 10000)
+    # Optional information: without the state helper it stays quiet rather than
+    # repeating on every stop.
+    return message if claim_notice(payload, 'context-{}k'.format(reached[-1] // 1000)) is True else None
+
+
+def with_context_notice(payload, result):
+    try:
+        notice = context_notice(payload) if isinstance(payload, dict) else None
+    except Exception:  # advisory: a failed size check never costs another notice
+        notice = None
+    if not notice:
+        return result
+    result = dict(result or {})
+    result['systemMessage'] = (result['systemMessage'] + '\n' + notice
+                               if result.get('systemMessage') else notice)
+    return result
+
+
 def proposed_next(payload):
     if (not isinstance(payload, dict) or payload.get('hook_event_name') != 'Stop'
             or payload.get('stop_hook_active') is not False):
@@ -818,12 +892,14 @@ def main():
                 raise ValueError('oversized input')
             payload = json.loads(raw)
             result = (extraction_overflow(payload) if sys.argv[1] == 'extraction-overflow'
-                      else proposed_next(payload))
+                      else with_context_notice(payload, proposed_next(payload)))
             if result:
                 print(json.dumps(result))
         except TranscriptTruncated:
             result = stop_notice(payload, 'handoff-overflow',
                                  'Delivery handoff reminder unverified: transcript scan exceeded its bounded limit.')
+            if sys.argv[1] == 'proposed-next':
+                result = with_context_notice(payload, result)
             if result:
                 print(json.dumps(result))
         except (OSError, ValueError, TypeError, IndexError, AttributeError):

package/dist/assets/marketplace/plugins/ccl-skills/hooks/task-entry.sh

@@ -1,15 +1,36 @@
 #!/usr/bin/env bash
-# Deliver the canonical task entry before sampling, without inspecting the prompt.
+# Deliver the canonical task entry before sampling. The prompt is never classified
+# or echoed. One structural check spots a prompt that is exactly one
+# <task-notification> envelope, the turn the host starts itself to deliver a
+# background completion: that turn keeps the skill-loading and unfinished-work
+# boundary but not the routing list, which SessionStart already keeps in context.
 SCRIPT_DIR="$(cd "$(dirname "$0")" 2>/dev/null && pwd)"
 if ! command -v python3 >/dev/null 2>&1; then
   printf 'ccl-skills task-entry: python3 unavailable; task entry omitted\n' >&2
   printf '{}\n'
   exit 0
 fi
-python3 - "$SCRIPT_DIR/../agent-context/session-start.md" <<'PY'
+# fd 3 carries the hook input; stdin is the heredoc program. A closed stdin reads
+# as empty input, which keeps the entry.
+if ! { : 3<&0; } 2>/dev/null; then exec 0</dev/null; fi
+python3 - "$SCRIPT_DIR/../agent-context/session-start.md" 3<&0 <<'PY'
 import json
+import os
 import sys
 
+host_turn = False
+try:
+    with os.fdopen(3, 'rb') as hook_input:
+        raw = hook_input.read(1048577)
+    payload = json.loads(raw) if len(raw) <= 1048576 else None
+    prompt = payload.get('prompt') if isinstance(payload, dict) else None
+    envelope = prompt.strip() if isinstance(prompt, str) else ''
+    host_turn = (envelope.startswith('<task-notification>') and envelope.endswith('</task-notification>')
+                 and envelope.count('<task-notification>') == 1 and envelope.count('</task-notification>') == 1)
+except (OSError, ValueError, RecursionError):
+    # Unreadable input keeps the full entry: trimming is only for a proven host turn.
+    host_turn = False
+
 try:
     with open(sys.argv[1], 'rb') as stream:
         raw = stream.read(32769)
@@ -35,7 +56,7 @@ try:
                 'Inspect failure evidence, research or change the approach, repair safely and rerun the relevant checks. '
                 'A report alone does not complete it. Continue available authorized work; hand back only for a '
                 'required user decision or unavailable authority/resource, stating the concrete blocker.\n\n')
-    context = '<ccl-task-entry>\n' + boundary + entry + '\n</ccl-task-entry>'
+    context = '<ccl-task-entry>\n' + (boundary.rstrip('\n') if host_turn else boundary + entry) + '\n</ccl-task-entry>'
     if len(context.encode('utf-8')) > 4096:
         raise ValueError('oversized entry')
     print(json.dumps({'hookSpecificOutput': {

package/dist/assets/marketplace/plugins/ccl-skills/hooks/test_proposed_next.py

@@ -541,6 +541,77 @@ class ProposedNextTests(unittest.TestCase):
         (self.hooks / 'host-input.py').unlink()
         self.assertIn('unavailable', self.run_hook().get('systemMessage', ''))
 
+    def usage_event(self, context, cache_read=None, model='claude-opus-5-5'):
+        read = context - 2000 if cache_read is None else cache_read
+        return {'type': 'assistant', 'message': {'model': model, 'content': [{'type': 'text', 'text': 'ok'}],
+                'usage': {'input_tokens': 2, 'cache_read_input_tokens': read,
+                          'cache_creation_input_tokens': context - 2 - read, 'output_tokens': 50}}}
+
+    def run_with_state(self, payload=None):
+        # The once-per-band cap uses the optional state helper; give it a private TMPDIR.
+        shutil.copyfile(ROOT / 'hooks/skill-loading.py', self.hooks / 'skill-loading.py')
+        state = self.root.parent / (self.root.name + '-state')
+        state.mkdir(exist_ok=True)
+        value = self.payload if payload is None else payload
+        result = subprocess.run(['bash', str(self.hooks / 'proposed-next-stop.sh')],
+                                input=json.dumps(value), text=True, capture_output=True, cwd=self.root,
+                                env=dict(os.environ, TMPDIR=str(state)))
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stderr, '')
+        return json.loads(result.stdout) if result.stdout else {}
+
+    def test_large_context_notice_is_user_only_and_once_per_band(self):
+        self.events([self.usage_event(120000), self.usage_event(299999)])
+        self.assertEqual(self.run_with_state(), {})
+        self.events([self.usage_event(120000), self.usage_event(321000)])
+        first = self.run_with_state()
+        self.assertEqual(set(first), {'systemMessage'})  # shown to the user, never a block or model context
+        self.assertIn('32 万', first['systemMessage'])
+        self.assertIn('/autocompact', first['systemMessage'])
+        self.assertIn('/clear', first['systemMessage'])
+        self.assertEqual(self.run_with_state(), {})  # same band: no repeat
+        self.events([self.usage_event(321000), self.usage_event(612000)])
+        second = self.run_with_state()
+        self.assertIn('61 万', second.get('systemMessage', ''))
+        self.assertEqual(self.run_with_state(), {})
+
+    def test_large_context_notice_stays_quiet_without_its_state_helper(self):
+        # Without the once-per-band record the notice would repeat on every stop, so
+        # it is withheld; notices that must show (handoff overflow) still show.
+        self.events([self.usage_event(450000)])
+        self.assertFalse((self.hooks / 'skill-loading.py').exists())
+        self.assertEqual(self.run_hook(), {})
+        self.assertEqual(self.run_hook(), {})
+
+    def test_large_context_notice_rides_with_a_continuation_reminder(self):
+        self.events([self.usage_event(450000)])
+        payload = dict(self.payload, last_assistant_message='Fixed.\n\nproposed-next: run the integration suite')
+        value = self.run_with_state(payload)
+        self.assertEqual(value.get('decision'), 'block')
+        self.assertIn('proposed-next:', value['reason'])
+        self.assertIn('45 万', value.get('systemMessage', ''))
+        self.assertNotIn('万 token', value['reason'])  # the model-facing reason stays unchanged
+
+    def test_large_context_notice_reads_only_the_latest_real_claude_usage(self):
+        # A trailing zero-usage (synthetic) entry is skipped; Codex shapes and huge
+        # trailing tool output without usage stay quiet; the notice never needs the
+        # bounded full-transcript scan.
+        synthetic = self.usage_event(0, cache_read=0, model='<synthetic>')
+        synthetic['message']['usage'] = {'input_tokens': 0, 'cache_read_input_tokens': 0,
+                                         'cache_creation_input_tokens': 0, 'output_tokens': 0}
+        self.events([self.usage_event(330000), synthetic])
+        self.assertIn('33 万', self.run_with_state().get('systemMessage', ''))
+        self.setUp()
+        self.events([{'type': 'event_msg', 'payload': {'type': 'token_count', 'info': {
+            'last_token_usage': {'input_tokens': 900000}}}}])
+        self.assertEqual(self.run_with_state(), {})
+        self.setUp()
+        self.events([self.usage_event(500000)] + [{'type': 'user', 'text': 'x' * 400000}] * 3)
+        self.assertEqual(self.run_with_state(), {})
+        self.setUp()
+        self.events([{'type': 'ignored'}] * 20000 + [self.usage_event(700000)])
+        self.assertIn('70 万', self.run_with_state().get('systemMessage', ''))
+
     def test_scan_is_bounded_and_no_filesystem_markers_are_written(self):
         self.events([{'type': 'ignored'}] * 20000 + self.claude_load())
         before = set(self.root.rglob('*'))

package/dist/assets/marketplace/plugins/ccl-skills/hooks/test_task_entry.py

@@ -80,6 +80,69 @@ class TaskEntryTests(unittest.TestCase):
         self.assertIn('A report alone does not complete it', context)
         self.assertIn('required user decision or unavailable authority/resource', context)
 
+    def test_host_task_notification_turn_keeps_only_the_boundary(self):
+        # The host also runs UserPromptSubmit on turns it starts itself; a background
+        # completion arrives as one <task-notification> envelope. SessionStart keeps the
+        # routing list in context (also after compaction), so that turn drops only the
+        # list; the skill-loading and unfinished-work boundary appears nowhere else and
+        # matters most when a background check has just failed.
+        expected, _ = self.run_hook(prompt='Add a feature')
+        full = expected['hookSpecificOutput']['additionalContext']
+        for prompt in ['<task-notification>\n<task-id>b1</task-id>\n<status>failed</status>\n</task-notification>',
+                       '\n  <task-notification><task-id>b2</task-id></task-notification>']:
+            with self.subTest(prompt=prompt[:30]):
+                output, error = self.run_hook(prompt=prompt)
+                self.assertEqual(error, '')
+                context = output['hookSpecificOutput']['additionalContext']
+                self.assertIn('unrun, failed or inconclusive verification is unfinished work', context)
+                self.assertIn('Before task-specific investigation or substantive analysis', context)
+                self.assertTrue(context.startswith('<ccl-task-entry>') and context.endswith('</ccl-task-entry>'))
+                self.assertNotIn('<!-- ccl:entry-routing:start -->', context)
+                self.assertNotIn('**product-rd-workflow**', context)
+                self.assertLess(len(context), len(full) // 2)
+        # Controls: a human prompt that merely mentions the envelope still gets the
+        # entry, as does input the hook cannot parse.
+        for prompt in ['Why did <task-notification> fire twice?', 'task-notification arrived',
+                       '<task-notification><task-id>b3</task-id></task-notification>\nWhat does this mean?',
+                       '<task-notification> pasted without its closing tag',
+                       '<task-notification>first</task-notification>\nCompare these.\n'
+                       '<task-notification>second</task-notification>']:
+            with self.subTest(prompt=prompt):
+                output, _ = self.run_hook(prompt=prompt)
+                self.assertEqual(output, expected)
+
+    def test_unreadable_hook_input_keeps_the_entry(self):
+        expected, _ = self.run_hook(prompt='Add a feature')
+        for raw in ['', 'not json', json.dumps(['<task-notification>']),
+                    json.dumps({'prompt': 42}), json.dumps({'prompt': '<task-notification>' + 'x' * 2_000_000}),
+                    '[' * 500000 + ']' * 500000]:
+            with self.subTest(raw=raw[:30]):
+                with tempfile.TemporaryDirectory(prefix='ccl-task-entry-') as directory:
+                    root = Path(directory)
+                    (root / 'hooks').mkdir()
+                    (root / 'agent-context').mkdir()
+                    shutil.copyfile(ROOT / 'hooks/task-entry.sh', root / 'hooks/task-entry.sh')
+                    (root / 'agent-context/session-start.md').write_text(
+                        (ROOT / 'agent-context/session-start.md').read_text())
+                    result = subprocess.run(['bash', str(root / 'hooks/task-entry.sh')], input=raw,
+                                            text=True, capture_output=True, timeout=5,
+                                            cwd=root, env={'PATH': os.environ['PATH']})
+                    self.assertEqual(result.returncode, 0, result.stderr)
+                    self.assertEqual(json.loads(result.stdout), expected)
+        # A closed stdin is read as empty input, never a silent hook.
+        with tempfile.TemporaryDirectory(prefix='ccl-task-entry-') as directory:
+            root = Path(directory)
+            (root / 'hooks').mkdir()
+            (root / 'agent-context').mkdir()
+            shutil.copyfile(ROOT / 'hooks/task-entry.sh', root / 'hooks/task-entry.sh')
+            (root / 'agent-context/session-start.md').write_text(
+                (ROOT / 'agent-context/session-start.md').read_text())
+            result = subprocess.run(['bash', '-c', 'bash "$1" <&-', 'x', str(root / 'hooks/task-entry.sh')],
+                                    text=True, capture_output=True, timeout=5,
+                                    cwd=root, env={'PATH': os.environ['PATH']})
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertEqual(json.loads(result.stdout), expected)
+
     def test_missing_or_invalid_source_is_observable_and_fail_soft(self):
         for source, missing in [('', True), ('not a routing document', False),
                                 ('<!-- ccl:entry-routing:end -->', False),

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/references/development-completion.md

@@ -34,10 +34,10 @@ Before completion or landing handoff, report the actual diff classification and
 
 ## Review continuation checkpoint
 
-Necessary in-scope review inherits the existing task authority, including review of a fix made after an earlier pass. Five renewed runs trigger a progress checkpoint, not an authorization request. At that checkpoint, and before each later renewed run:
+Necessary in-scope review inherits the existing task authority, including review of a fix made after an earlier pass. Five renewed runs trigger a progress checkpoint, not an authorization request. The controller counts conclusive runs in the worktree receipt and, from the sixth, returns `continuation_checkpoint` in its output; a review that records no receipt is counted by you. At that checkpoint, and before each later renewed run:
 
 1. Check current scope and any explicit user stop, count, cost or time limit. Honor a host permission denial or unavailable resource through its normal recovery path; task authority never bypasses it. Ask only for a missing decision or authority that the next action actually needs.
-2. Record what changed, the disposition of the previous findings, and what new evidence the next pass should obtain. When findings recur without progress, change the method or gather different evidence before calling again. Continue available in-scope repair and tests; park only work that needs an unavailable decision or resource.
+2. Record what changed, the disposition of the previous findings, and what new evidence the next pass should obtain. When findings recur without progress, change the method or gather different evidence before calling again. When the same class of finding keeps returning, even though each instance was fixed, decide whether the capability that keeps producing it should be narrowed or removed before patching it again, and record that decision. Continue available in-scope repair and tests; park only work that needs an unavailable decision or resource.
 3. Run the necessary review of the changed candidate without requesting permission per pass. Keep the tracked chain's own round ceiling and each invocation's timeout. A terminal chain stays terminal; use the owning lane's documented fresh-review or delta-pass path, and never reset an unchanged candidate's chain merely to obtain zero findings. Record the real pass history; an automatic pass is not a newly human-requested one.
 
 The checkpoint waives no review, challenge, evidence or readiness requirement. A missing conclusive pass or unresolved P0/P1 remains pending regardless of how many passes have run. If the current candidate already has valid review and dispositions, reuse them and finish.

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/review_gate.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 
 import argparse
 import errno
+import fcntl
 import hashlib
 import json
 import math
@@ -1646,10 +1647,67 @@ def open_directory_without_links(path: str) -> int:
     return fd
 
 
-def record_local_review(anchor: dict[str, Any] | None, result: dict[str, Any]) -> None:
-    """Best-effort local receipt of the last conclusive review; never fails it."""
+# development-completion.md "Review continuation checkpoint": the first review plus
+# five renewed runs. The count lives in the worktree's receipt because a count kept
+# in prose does not survive long sessions, compaction or a new session on the same
+# worktree, and a loop in which every round fixes something never looks stuck.
+REVIEW_CHECKPOINT_RUNS = 6
+
+
+def prior_local_review(receipt_fd: int) -> dict[str, Any]:
+    try:
+        descriptor = os.open(
+            LOCAL_REVIEW_RECEIPT_FILE, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=receipt_fd
+        )
+    except OSError:
+        return {}
+    try:
+        if not stat.S_ISREG(os.fstat(descriptor).st_mode):
+            return {}
+        data = os.read(descriptor, 65537)
+    except OSError:
+        # A prior receipt that cannot be read only loses the count, never the new receipt.
+        return {}
+    finally:
+        os.close(descriptor)
+    try:
+        value = json.loads(data) if len(data) <= 65536 else None
+    except (ValueError, RecursionError):
+        return {}
+    return value if isinstance(value, dict) else {}
+
+
+def conclusive_review_runs(prior: dict[str, Any], mode: Any) -> int:
+    runs = prior.get("conclusive_runs")
+    if not (isinstance(runs, int) and not isinstance(runs, bool) and runs >= 0):
+        # A receipt written before the count existed still proves one run.
+        runs = 1 if prior.get("mode") in ("review", "challenge") else 0
+    return runs + (1 if mode in ("review", "challenge") else 0)
+
+
+def continuation_checkpoint(runs: Any, first_recorded_at: Any) -> dict[str, Any] | None:
+    if not isinstance(runs, int) or isinstance(runs, bool) or runs < REVIEW_CHECKPOINT_RUNS:
+        return None
+    return {
+        "conclusive_review_runs": runs,
+        "first_review_recorded_at": first_recorded_at if isinstance(first_recorded_at, str) else None,
+        "rule": "code-review references/development-completion.md#review-continuation-checkpoint",
+        "before_next_run": [
+            "record what changed and the disposition of the previous findings",
+            "when the same class of finding keeps returning, even if each instance was fixed, decide whether the "
+            "capability producing it should be narrowed or removed before patching it again",
+            "check the remaining findings against the requester's own words; findings outside the request are "
+            "dispositioned, not implemented",
+        ],
+    }
+
+
+def record_local_review(anchor: dict[str, Any] | None, result: dict[str, Any]) -> dict[str, Any] | None:
+    """Best-effort local receipt of the last conclusive review; never fails it.
+
+    Returns the receipt it wrote, or None when nothing was recorded."""
     if not anchor:
-        return
+        return None
     receipt = {
         "schema_version": 1,
         "head": anchor["head"],
@@ -1673,12 +1731,19 @@ def record_local_review(anchor: dict[str, Any] | None, result: dict[str, Any]) -
         # under it since then is not the one the anchor described.
         opened = os.fstat(git_fd)
         if [opened.st_dev, opened.st_ino] != anchor.get("git_dir_identity"):
-            return
+            return None
         try:
             os.mkdir(LOCAL_REVIEW_RECEIPT_DIR, 0o700, dir_fd=git_fd)
         except FileExistsError:
             pass
         receipt_fd = os.open(LOCAL_REVIEW_RECEIPT_DIR, directory_flags, dir_fd=git_fd)
+        # Serialize read-increment-replace so overlapping review and challenge
+        # completions in one worktree cannot both read N and write N + 1.
+        fcntl.flock(receipt_fd, fcntl.LOCK_EX)
+        prior = prior_local_review(receipt_fd)
+        receipt["conclusive_runs"] = conclusive_review_runs(prior, receipt["mode"])
+        first = prior.get("first_recorded_at") or prior.get("recorded_at")
+        receipt["first_recorded_at"] = first if isinstance(first, str) else receipt["recorded_at"]
         temporary = f".last-review.{os.getpid()}.{secrets.token_hex(8)}"
         file_fd = os.open(
             temporary,
@@ -1697,8 +1762,9 @@ def record_local_review(anchor: dict[str, Any] | None, result: dict[str, Any]) -
             dst_dir_fd=receipt_fd,
         )
         temporary = None
+        return receipt
     except OSError:
-        pass
+        return None
     finally:
         if temporary is not None and receipt_fd is not None:
             try:
@@ -5190,7 +5256,12 @@ def main(argv: list[str] | None = None) -> int:
                 if time.monotonic() >= gate_deadline:
                     apply_gate_timeout(result)
                     return emit(result, 2)
-                record_local_review(review_anchor, result)
+                receipt = record_local_review(review_anchor, result)
+                checkpoint = continuation_checkpoint(
+                    (receipt or {}).get("conclusive_runs"), (receipt or {}).get("first_recorded_at")
+                )
+                if checkpoint:
+                    result["continuation_checkpoint"] = checkpoint
                 return emit(result, 0)
             if completed.returncode == 0 and status in {"passed", "findings"}:
                 payload.update(

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_review_gate.sh

@@ -4931,6 +4931,118 @@ out="$(REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.s
 check "a bare --diff-file review records no receipt" \
   '[ "$rc" = 0 ] && json_fields "$out" status=passed && [ ! -e "$contract_repo/.git/ccl-code-review" ]'
 
+# The continuation checkpoint is counted, not remembered: the receipt carries the
+# worktree's conclusive review runs, and the sixth (the first review plus five
+# renewed runs) brings the checkpoint into the gate's own output.
+counting_out="$(PYTHONPATH="$WORK/harness/scripts" python3 - "$WORK" <<'PY' 2>&1
+import json, os, sys, review_gate
+root = os.path.realpath(os.path.join(sys.argv[1], "run-count"))
+gd = os.path.join(root, "gitdir")
+os.makedirs(gd)
+st = os.stat(gd)
+anchor = {"git_dir": gd, "git_dir_identity": [st.st_dev, st.st_ino], "head": "a" * 40, "worktree_clean": True}
+receipt_path = os.path.join(gd, "ccl-code-review", "last-review.json")
+runs = [review_gate.record_local_review(anchor, {"mode": mode, "status": "findings"})["conclusive_runs"]
+        for mode in ["review", "challenge", "review", "complete", "review", "review", "challenge"]]
+assert runs == [1, 2, 3, 3, 4, 5, 6], runs
+first = json.load(open(receipt_path))["first_recorded_at"]
+assert review_gate.continuation_checkpoint(5, first) is None
+assert review_gate.continuation_checkpoint(True, first) is None
+cp = review_gate.continuation_checkpoint(6, first)
+assert cp["conclusive_review_runs"] == 6 and cp["first_review_recorded_at"] == first, cp
+assert any("narrowed or removed" in step for step in cp["before_next_run"]), cp
+assert any("own words" in step for step in cp["before_next_run"]), cp
+# A receipt written before the count existed still proves one run.
+json.dump({"mode": "review", "recorded_at": "2026-01-01T00:00:00Z"}, open(receipt_path, "w"))
+receipt = review_gate.record_local_review(anchor, {"mode": "review"})
+assert receipt["conclusive_runs"] == 2 and receipt["first_recorded_at"] == "2026-01-01T00:00:00Z", receipt
+# Corrupt or hostile prior values restart the count; they never cost the new receipt.
+for bad in ["not json", json.dumps({"conclusive_runs": True, "mode": "complete"}),
+            json.dumps({"conclusive_runs": -3}), json.dumps([1]), "x" * 70000]:
+    open(receipt_path, "w").write(bad)
+    receipt = review_gate.record_local_review(anchor, {"mode": "review"})
+    assert receipt is not None and receipt["conclusive_runs"] == 1, (bad[:20], receipt)
+# A prior receipt that is a link is never read through, and the write replaces the link.
+target = os.path.join(root, "elsewhere.json")
+json.dump({"conclusive_runs": 40, "mode": "review"}, open(target, "w"))
+os.unlink(receipt_path)
+os.symlink(target, receipt_path)
+receipt = review_gate.record_local_review(anchor, {"mode": "review"})
+assert receipt is not None and receipt["conclusive_runs"] == 1 and not os.path.islink(receipt_path), receipt
+assert json.load(open(target))["conclusive_runs"] == 40
+# A prior receipt the parser cannot finish (nesting too deep) is invalid, never fatal.
+real_loads = review_gate.json.loads
+def too_deep(*args, **kwargs):
+    raise RecursionError("maximum recursion depth exceeded")
+review_gate.json.loads = too_deep
+open(receipt_path, "w").write("[" * 30000 + "]" * 30000)
+receipt = review_gate.record_local_review(anchor, {"mode": "review"})
+review_gate.json.loads = real_loads
+assert receipt is not None and receipt["conclusive_runs"] == 1, receipt
+# Overlapping completions cannot lose an increment because the whole
+# read-increment-replace runs under an exclusive lock on the receipt directory.
+# Checked where it matters, not by racing writers: when the controller opens the
+# prior receipt and when it replaces it, a second open of that directory cannot
+# take even a shared lock, and no lock call falls between the two, so the lock
+# is never released or changed in between.
+import fcntl
+receipt_dir = os.path.join(gd, "ccl-code-review")
+real_open, real_replace, real_flock = review_gate.os.open, review_gate.os.replace, review_gate.fcntl.flock
+def exclusively_locked():
+    probe = real_open(receipt_dir, os.O_RDONLY | os.O_DIRECTORY)
+    try:
+        real_flock(probe, fcntl.LOCK_SH | fcntl.LOCK_NB)
+    except BlockingIOError:
+        return True
+    finally:
+        os.close(probe)
+    return False
+seen = []
+def watched_open(path, flags, *args, **kwargs):
+    if path == review_gate.LOCAL_REVIEW_RECEIPT_FILE and not flags & (os.O_WRONLY | os.O_RDWR):
+        seen.append(("read", exclusively_locked()))
+    return real_open(path, flags, *args, **kwargs)
+def watched_replace(src, dst, *args, **kwargs):
+    if dst == review_gate.LOCAL_REVIEW_RECEIPT_FILE:
+        seen.append(("replace", exclusively_locked()))
+    return real_replace(src, dst, *args, **kwargs)
+def watched_flock(fd, operation):
+    seen.append(("flock", operation))
+    return real_flock(fd, operation)
+with open(receipt_path, "w") as handle:
+    json.dump({"mode": "review", "conclusive_runs": 40, "first_recorded_at": "2026-01-01T00:00:00Z"}, handle)
+review_gate.os.open, review_gate.os.replace, review_gate.fcntl.flock = watched_open, watched_replace, watched_flock
+try:
+    receipt = review_gate.record_local_review(anchor, {"mode": "challenge"})
+finally:
+    review_gate.os.open, review_gate.os.replace, review_gate.fcntl.flock = real_open, real_replace, real_flock
+kinds = [kind for kind, _ in seen]
+assert kinds.count("read") == 1 and kinds.count("replace") == 1, seen
+read_at, replace_at = kinds.index("read"), kinds.index("replace")
+assert read_at < replace_at and seen[read_at][1] and seen[replace_at][1], seen
+assert "flock" not in kinds[read_at:replace_at], seen
+stored = json.load(open(receipt_path))
+assert stored == receipt and stored["conclusive_runs"] == 41, (stored, receipt)
+assert stored["first_recorded_at"] == "2026-01-01T00:00:00Z", stored
+print("run_count_ok")
+PY
+)"
+check "conclusive review runs are counted per worktree; the checkpoint starts at the sixth" \
+  '[ "$counting_out" = run_count_ok ]'
+
+mkdir -p "$contract_repo/.git/ccl-code-review"
+printf '{"mode":"review","conclusive_runs":5,"first_recorded_at":"2026-01-01T00:00:00Z"}\n' >"$receipt_file"
+reset_case passed unavailable unavailable
+out="$(run_contract_gate --mode review)"; rc=$?
+check "the sixth conclusive run carries the continuation checkpoint in the gate output" \
+  '[ "$rc" = 0 ] && json_fields "$out" continuation_checkpoint.conclusive_review_runs=6 continuation_checkpoint.first_review_recorded_at=2026-01-01T00:00:00Z && [ "$(jq -r .conclusive_runs "$receipt_file")" = 6 ]'
+printf '{"mode":"review","conclusive_runs":3}\n' >"$receipt_file"
+reset_case passed unavailable unavailable
+out="$(run_contract_gate --mode review)"; rc=$?
+check "an earlier run carries no checkpoint" \
+  '[ "$rc" = 0 ] && json_lacks "$out" continuation_checkpoint && [ "$(jq -r .conclusive_runs "$receipt_file")" = 4 ]'
+rm -rf "$contract_repo/.git/ccl-code-review"
+
 # The completion checkpoint is what the pull-request reminder reads as disposed:
 # on the same whole-worktree candidate it replaces the review's receipt with a
 # passed one; a checkpoint that fails leaves the receipt as it was.

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/source-register.md

@@ -762,3 +762,9 @@ The pending classification above is superseded by the executed source comparison
 | A review does not report a requested fix of a pre-existing defect as droppable, and the requester's words in `--focus` reach every reviewer under the egress scan | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: no; firing-path: command:skills/code-review/scripts/test_review_gate.sh | updated | Owner key `code-review/SKILL.md`. An adversarial challenge read "each fix for a risk that predates the change" as asking reviewers to drop a requested fix of an older defect. In the build and release concern and in the manual prompt, the clause now covers only a pre-existing risk that the request does not cover and the change does not expose or worsen; the controller test fails on the previous text. A requested-fix replay (neutral domain, read by hand) found no run calling the fix droppable under either wording (Claude 0/6 each, Codex 0/3 each), so the reading did not reproduce and the narrowing aligns the text with its intent. New tests show `--focus` reaching the reviewer profile and a fallback reviewer, and a credential-shaped value blocking non-Claude egress; controller copies that drop the focus or skip the profile scan fail them. A reviewer-scope rerun read by hand: only the new text called an unrequested configuration switch unneeded (0/4 to 4/4). The matched-plan control behind the earlier row first carried an unrequested weekly step that reviewers flagged (Claude 5/6, Codex 3/3) and a regex had miscounted; with the step removed, no run raised a scope finding. |
 | A deterministic check that `make test` does not run surfaces only in CI after a push; the real-repository ledger audit runs in the fast lane and names its fix, and the delta-pass step names its entrypoint for a delta the extraction lane does not own | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_check_ccl_regressions.sh | updated | Owner key `skill-extraction-workflow/SKILL.md`. In one reviewed round CI went red on a stale line-cited obligation ledger after `make test` and the quick checker were green: the real-repository audit ran only in the heavy lane. With one line inserted above a cited carrier, main's fast lane passed and the candidate's fails on that audit, printing a `render` command that clears it when run as printed; a carrier whose text changed fails render and audit with another code, so the hint cannot hide a dropped obligation. `test_obligation_ledger.sh` runs the printed command and fails against the previous tool. Two rounds improvised chain ids after the extraction wrapper refused a delta it did not own; the delta-pass step in `dual-track-review-gate.md` now names both entrypoints, and the generic call it documents passes the controller's preconditions. |
 | The extraction lane's ownership refusal points at the delta-pass recipe for a delta it does not own | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_review_gate.sh | updated | Owner key `code-review/SKILL.md`. A delta pass over files the extraction lane does not own was refused with no route forward, and two rounds improvised a review-chain call to the generic controller. The refusal now names the delta-pass step that documents the call; the controller test asserts it and fails against the previous controller, where it is the only failure. The ownership precondition itself is unchanged. |
+| The review controller counts conclusive runs per worktree and returns the continuation checkpoint from the sixth; the checkpoint names the same-class decision | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_review_gate.sh | updated | Owner key `code-review/SKILL.md`. In a month of sessions single changes ran 13 to 49 conclusive review runs, several after the five-run checkpoint existed; the controller kept only the last receipt, so the count lived in the agent's memory across hours and compactions. The receipt now carries `conclusive_runs` (review and challenge only) and the output carries `continuation_checkpoint` from the sixth run; the suite's three new checks fail against the previous controller, which after six runs records no count. Replay with only the latest finding visible: with the checkpoint object 6/6 answers stepped back before patching, without it 2/6. The added same-class sentence alone measured at ceiling (6/6 with the old or the new text when three findings are listed side by side) and is not claimed as a behavior change. |
+| The review receipt counter keeps counting through an unparseable prior receipt and overlapping writers | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_review_gate.sh | updated | Owner key `code-review/SKILL.md`. The round's adversarial challenge found that a prior receipt nested deeply enough to make the parser raise RecursionError escaped the corrupt-receipt fallback, and that overlapping review and challenge completions could both read N and write N + 1. The parser failure now counts as an invalid receipt, and the read-increment-replace holds a lock on the receipt directory. In the suite's counting unit the previous controller fails on the recursion case; with the lock removed, 24 overlapping writers recorded 4 to 7 runs in three trials, and 24 with it. |
+| The receipt lock check holds the lock itself instead of relying on writers overlapping | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_review_gate.sh | updated | Owner key `code-review/SKILL.md`. The round's delta review found that the overlapping-writer check proves the lock only when the writers happen to overlap; run one after another, they would pass with the lock removed. The check now takes the receipt directory lock itself, requires the writer to be still waiting a second after it started, rewrites the count while holding the lock, and requires the writer to increment that value. Against copies of the controller, removing the lock failed 8 of 8 runs on the waiting check, reading the prior receipt before taking the lock failed 8 of 8 on the count, and the unchanged controller passed 8 of 8. The previous check also failed both mutants in 5 of 5 runs on the same machine, so the gain is independence from scheduling, not a newly caught defect. |
+| The receipt lock check signals from the writer's own lock call, so no wait decides its result | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_review_gate.sh | updated | Owner key `code-review/SKILL.md`. Supersedes the previous row's claim of scheduling independence: the next delta review found that a writer paused between signalling its start and reaching the lock lets both mutants pass once the one-second wait expires. The writer now signals from inside its exclusive lock call on the receipt directory, and the holder rewrites the count only after that signal; unlock and cleanup run in `finally`, the writer is a daemon and every wait is bounded. Against copies of the controller, each run with and without a forced two-second pause in the writer: the unchanged controller passed 8 of 8; removing the lock and taking a shared lock each failed 8 of 8 on the missing signal; reading the prior receipt before the lock failed 8 of 8 on the count. |
+| The receipt lock check asserts the exclusive lock at the receipt read and replace instead of racing writers | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_review_gate.sh | updated | Owner key `code-review/SKILL.md`. Supersedes the two rows above for the check's design. Three successive delta reviews each found a controller variant that a racing-writer check let through: writers that did not overlap, a writer paused past a wait, a lock released before the read. The class was closed by changing the method instead of patching a fourth time. When the controller opens the prior receipt and when it replaces it, the check requires that a second open of the receipt directory cannot take even a shared lock, and then that the count increments the value read. Against copies of the controller, three runs each, the unchanged controller passed; removing the lock, a shared lock, a lock on another descriptor, reading before the lock, unlocking before the read and unlocking before the replace each failed on the recorded lock states. |
+| The receipt lock check also requires the lock to be held without interruption between the read and the replace, and reads the stored receipt back | `code-review` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/code-review/scripts/test_review_gate.sh | updated | Owner key `code-review/SKILL.md`. The delta review of the previous row's check, the sixth conclusive run in the worktree and the first to return the continuation checkpoint, found that probes at the read and the replace pass a controller that unlocks and relocks in between, and that the check trusted the returned receipt over the stored one. The check now records every lock call during the controller's call and requires none between the read and the replace, and it compares the stored receipt with the returned one. Against copies of the controller, three runs each: the unchanged controller passed; unlocking and relocking between the read and the replace failed on the recorded lock calls, and a stored count or start time that differs from the returned one, applied to the last call only, failed on the stored receipt; the six variants from the previous row still failed. |

package/dist/assets/release.json

@@ -1,8 +1,8 @@
 {
   "schema": 1,
   "npmPackage": "@ccoalm/ccl-skills",
-  "version": "0.18.10",
-  "sourceCommit": "f21b49962fdb23d7a1c3a0376e6872e30517a8c4",
+  "version": "0.18.11",
+  "sourceCommit": "1e07f1c777ba010542c5d97d5eaa9c3c64506f38",
   "sourceState": "clean",
   "files": [
     {
@@ -82,7 +82,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/hooks/host-input.py",
-      "sha256": "058e78598435050d1c0af1ff721d4fee5d049c5a442a71d9ed9fd22b6d70a307",
+      "sha256": "34a1f1c7b5dfc22b80d739663683cfebd30434800987db16f50423246d79f0ad",
       "mode": 420
     },
     {
@@ -157,7 +157,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/hooks/task-entry.sh",
-      "sha256": "f75f318e1e1fc9ff2c2f89b3a2dec563e95d3c0a817155d8c4e78bb936ba54f9",
+      "sha256": "577cd5341e2540d3ae3b0ac7910fd281b360ae34a6a09c8c852827c36ec7f6f9",
       "mode": 493
     },
     {
@@ -187,7 +187,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/hooks/test_proposed_next.py",
-      "sha256": "10a73c9577931bef33462cd9388a899a2d79b62255fdea5f32e322ae2a7569b5",
+      "sha256": "1de3753e036f87aa1823e0c53ce31c39840501af4ec6667ab62b6c04f0d716f1",
       "mode": 493
     },
     {
@@ -222,7 +222,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/hooks/test_task_entry.py",
-      "sha256": "2d7e487f12fce3a090d089a45d9296334c7213126b0925012783f2ccc29afcad",
+      "sha256": "f86e65ba1301882568a64d5d4665d8843d0b4871b860fb65dd4ed477744145e8",
       "mode": 493
     },
     {
@@ -347,7 +347,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/code-review/references/development-completion.md",
-      "sha256": "d8f1383fc2bc6b0215d445c4cf085a7a9850f21b2eb192c21b6e4375dc60d50c",
+      "sha256": "1047377aaf3f42498ec2b300316b801aea2311b2684ed8a944b392d21e26f0ce",
       "mode": 420
     },
     {
@@ -452,7 +452,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/code-review/scripts/review_gate.py",
-      "sha256": "c4f4c737f6d4bea424c4211fda17f82254316701f1468f25d501319c6f12652e",
+      "sha256": "ba57bfe8478550c1be3eb826de0638890c03a316a2cc9e7d086005e2495fd900",
       "mode": 493
     },
     {
@@ -557,7 +557,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/code-review/scripts/test_review_gate.sh",
-      "sha256": "45858022182bf50fb4ff3d3570415ec46cc15615e5289fccfd0a281d54d24b84",
+      "sha256": "888c4293e4fd091a48a715295369566e01c2c06397f2f019431e22c6a55041f9",
       "mode": 493
     },
     {
@@ -2207,7 +2207,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/source-register.md",
-      "sha256": "ec0b2db8f331b31ec13fb96c9c408f86eff37871dbad1a413884a134481e3d5c",
+      "sha256": "0c69b7ef4e68d579be780328551153114b7f0960e4adc6f2be54406b21fc5d28",
       "mode": 420
     },
     {
@@ -3533,5 +3533,5 @@
       "mode": 420
     }
   ],
-  "snapshotHash": "083025cdc46f79701f6448e0a83308520bfd69772ced4f6d7a958c7015fd3374"
+  "snapshotHash": "28d8ffdb54ff423aa8c7947ac1ace08ac32d314ff0a71b80697caf29bb0b85f2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ccoalm/ccl-skills",
-	"version": "0.18.10",
+	"version": "0.18.11",
   "description": "Reusable workflows that help coding agents plan, build, test, review, and release software — for Claude Code, Codex, and OpenCode",
 	"keywords": ["skills", "agent-skills", "claude", "claude-code", "codex", "opencode", "agent", "ai", "ai-agents", "cli", "anthropic", "developer-tools"],
   "type": "module",