@christang/keel 5.3.9 → 5.5.0

package/README.md

@@ -114,6 +114,47 @@ keel --init  →  keel context  →  /opsx:apply (pick one task)
    →  task-complete  →  /opsx:sync · /opsx:archive
 ```
 
+On the Claude target, the session-start hook also shows that state to **you**, not only to the
+agent — one line, before you type anything:
+
+```
+Keel: add-user-auth#2.1 — next: task-start. Disposable projection; OpenSpec and Git are the authority.
+```
+
+Set `KEEL_SESSION_PANEL=1` to draw it as a framed panel with the Keel mark instead. It is off by
+default, and turning it on changes nothing but the presentation — the same status and the same
+next command are in both forms.
+
+### Standing authorization
+
+Keel asks before a repository action it has no authority for, and it asks again next session,
+because a permission granted in conversation does not survive a context reset. Declare it once in
+`keel/config.yaml` instead:
+
+```yaml
+authorize:          # accepted names: commit, push, release, archive
+  - commit
+  - push
+```
+
+A task that authors no `Autonomy boundary:` inherits the declaration, and the compiled capsule
+names `keel/config.yaml` as that entry's source so an inherited authorization is never mistaken
+for one the task decided. A task that authors its own boundary keeps it.
+
+Three things the declaration is not:
+
+- **Not a way past a gate.** It authorizes the action, never the proof. `keel gate task-complete`
+  returns exactly the same verdict, and the same failure text, whether or not you declared
+  anything.
+- **Not a trigger.** It removes a confirmation, not the step that reaches the action. Nothing
+  schedules itself, and no next task is selected for you.
+- **Not open-ended.** The four names above are the whole vocabulary. An unrecognized entry is
+  reported with the accepted names and the declaration authorizes nothing until you fix it — a
+  typo never becomes a silent grant.
+
+The block is absent by default, and a repository that declares nothing behaves exactly as it did
+before this feature existed. `keel --doctor` reports what is declared.
+
 ### Full vs Lite
 
 Use **Full mode** (the OpenSpec flow above) for new features, interface or protocol changes,
@@ -149,7 +190,8 @@ Keel splits verification into two layers so a slow suite never blocks your push:
   run at CI or at `keel gate change-close`.
 
 A task's `Verify` checks stay fast; the slow or exhaustive layer belongs to the full gate, not the
-local pre-push. Declare your fast check once in `keel/config.yaml`:
+local pre-push. Declare your fast check in `keel/config.yaml`, the same file that holds your
+standing authorization:
 
 ```yaml
 fast_check: npm test -- --fast   # your project's seconds-scale check

package/assets/bootstrap/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- keel:start version=5.3.9 -->
+<!-- keel:start version=5.5.0 -->
 ## Keel Bootstrap
 
 - Start every session with `keel context`; OpenSpec artifacts and Git are the only durable authority — never native memory, goals, or transcripts.

package/assets/openspec/schemas/keel-spec-driven/schema.yaml

@@ -126,8 +126,12 @@ artifacts:
       Keel agent. Keel-managed work executes in the current agent conversation;
       do not hand execution to another agent, subagent, or operator unless the
       selected task or user explicitly authorizes it.
-      Autonomy boundary defaults to hard-stop. A pre-authorized fallback must
-      state an exact reversible bound and the evidence required after use.
+      Autonomy boundary defaults to hard-stop for every action the repository
+      has not standing-authorized in `keel/config.yaml`; a declared action is
+      inherited only by a task that authored no boundary of its own, and the
+      capsule names the declaration as that entry's source. A pre-authorized
+      fallback must state an exact reversible bound and the evidence required
+      after use.
 
       Use `Coupling: none` by default. When `Coupling: required`, define one
       complete candidate, its allowed provisional failures, completion gate,

package/assets/openspec/schemas/keel-spec-driven/templates/tasks.md

@@ -2,10 +2,14 @@
      Record only task-specific authority. Omitted fields inherit versioned
      defaults: Owner is the current Keel agent, Mode is implementation, Read
      is the change proposal/design/specs/tasks plus discovered repository
-     context, Acceptance derives from Covers, autonomy defaults to hard-stop,
-     Coupling defaults to none, helpers stay read-only/evidence-only, and
-     commit, push, sync, archive, and cross-task continuation stay
-     unauthorized. Declare a field only when it differs from these defaults. -->
+     context, Acceptance derives from Covers, Coupling defaults to none, and
+     helpers stay read-only/evidence-only. Autonomy defaults to hard-stop, and
+     commit, push, sync, archive, and cross-task continuation stay unauthorized,
+     EXCEPT where `keel/config.yaml` standing-authorizes an action: a task that
+     authors no `Autonomy boundary:` inherits that declaration, and the capsule
+     names the declaration as the entry's source. A standing authorization
+     removes the confirmation, never the gate, evidence, or Review.
+     Declare a field only when it differs from these defaults. -->
 
 ## 1. <!-- Task Group Name -->
 

package/bin/keel.js

@@ -44,6 +44,10 @@ const {
   renderGuard,
   startGuard,
 } = require("../src/core/guard");
+const {
+  STANDING_AUTHORIZATION_ACTIONS,
+  readStandingAuthorization,
+} = require("../src/core/config");
 
 const PACKAGE_ROOT = path.resolve(__dirname, "..");
 const PACKAGE_JSON = require(path.join(PACKAGE_ROOT, "package.json"));
@@ -1033,6 +1037,8 @@ function keelOpenSpecOverlay(action) {
           "- When implementation exposes a material expectation, acceptance boundary, or user-owned decision absent from durable authority, stop before implementing that choice, rerun `keel-align-expectations`, and reauthor the affected proposal/design/spec/task authority first.",
           "- A discovered repository fact that does not change accepted behavior or scope may be recorded and execution continues inside the existing task boundary without a product interview.",
           "- Invoke OpenSpec through `keel openspec` (for example `keel openspec validate`); a bare `openspec` command may not be on PATH.",
+          "- Consult the repository's standing authorization in `keel/config.yaml` before asking the user to confirm a repository action: a standing-authorized action proceeds without a per-occurrence confirmation, and an undeclared action still requires the confirmation it requires today.",
+          "- A standing authorization covers the action and never substitutes for a gate, evidence, or Review; it removes the confirmation, not the record, and it is not a trigger to perform the action.",
         ]
       : [
           "- The current agent owns final sync/archive decisions and must verify task evidence, follow-up ownership, and completion gates before proceeding.",
@@ -1043,6 +1049,8 @@ function keelOpenSpecOverlay(action) {
           "- Invoke OpenSpec through `keel openspec` (for example `keel openspec validate`); a bare `openspec` command may not be on PATH.",
           "- When `/opsx:sync` has already promoted the change's spec delta, run the archive with `--skip-specs` so the promoted delta is not re-applied; archive is not idempotent over an already-synced delta.",
           "- After archiving, run `keel guard clear` to drop the change's guard manifest; the read-only gate never clears it for you.",
+          "- A repository that standing-authorizes `archive` in `keel/config.yaml` does not need the per-occurrence archive confirmation; a repository that declares nothing still needs it.",
+          "- The completion gate and follow-up ownership checks still run unchanged under a standing authorization; it removes the confirmation, not the proof.",
         ];
 
   const lines = [
@@ -1344,10 +1352,11 @@ function runDoctor(options) {
 
   printTargetSurface(repo, options.target);
   printLensSurface(repo, options.target);
+  const authorizationOk = printStandingAuthorizationSurface(repo);
   printFastPrePushSurface(repo);
   printSourceRepoCliResolution(repo);
 
-  return checkStatus;
+  return authorizationOk ? checkStatus : 1;
 }
 
 // Only meaningful in Keel's own repository: a bare `keel` resolves to the
@@ -1390,6 +1399,37 @@ function gitConfigHooksPath(repo) {
   return value || null;
 }
 
+function printStandingAuthorizationSurface(repo) {
+  process.stdout.write("\nStanding authorization:\n");
+  const { declared, unknown } = readStandingAuthorization(repo);
+  if (unknown.length > 0) {
+    printDoctorLine(
+      "authorize",
+      "failed",
+      `keel/config.yaml declares unrecognized ${
+        unknown.length === 1 ? "action" : "actions"
+      }: ${unknown.join(", ")}; accepted names are `
+        + `${STANDING_AUTHORIZATION_ACTIONS.join(", ")}. The whole declaration `
+        + "authorizes nothing until it is corrected"
+    );
+    return false;
+  }
+  printDoctorLine(
+    "authorize",
+    declared.length > 0 ? "ok" : "none",
+    declared.length > 0
+      ? `declared in keel/config.yaml: ${declared.join(", ")}`
+      : "undeclared; every action stays hard-stop"
+  );
+  for (const action of STANDING_AUTHORIZATION_ACTIONS) {
+    printDoctorLine(
+      action,
+      declared.includes(action) ? "authorized" : "not authorized"
+    );
+  }
+  return true;
+}
+
 function printFastPrePushSurface(repo) {
   process.stdout.write("\nFast pre-push surface:\n");
   const fastCheck = readFastCheck(repo);

package/package.json

@@ -2,7 +2,7 @@
   "name": "@christang/keel",
   "displayName": "Keel",
   "description": "Keel OpenSpec execution discipline CLI for Claude Code, Codex, and OpenCode.",
-  "version": "5.3.9",
+  "version": "5.5.0",
   "license": "MIT",
   "repository": {
     "type": "git",

package/plugins/keel/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.3.9",
+  "version": "5.5.0",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/plugins/keel/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "keel",
-  "version": "5.3.9",
+  "version": "5.5.0",
   "description": "Keel OpenSpec execution discipline: stateless continuity, task capsules, deterministic gates, and expectation alignment for Codex and Claude Code.",
   "author": {
     "name": "TanglmChris",

package/plugins/keel/scripts/session-start.js

@@ -15,9 +15,11 @@ const fs = require("fs");
 const path = require("path");
 const { spawnSync } = require("child_process");
 
-// This text is injected into the agent and never rendered for the human, so
-// without an explicit instruction the projection reaches nobody who can catch
-// it being wrong. Every branch carries the same phrase, degraded ones included.
+// This text is injected into the agent; the human reads the `systemMessage`
+// line instead. Both channels ship on every branch, degraded ones included,
+// and neither makes the other redundant: the host's line says what the state
+// is, and this instruction is what surfaces the state the agent actually
+// worked from, which is the one a user can catch being wrong.
 const DISCLOSURE = "to the user in your first reply";
 
 const TIMEOUT_MS = Number(process.env.KEEL_HOOK_TIMEOUT_MS || 8000) || 8000;
@@ -32,15 +34,77 @@ function readStdin() {
   }
 }
 
-function emit(context) {
-  process.stdout.write(
-    `${JSON.stringify({
-      hookSpecificOutput: {
-        hookEventName: "SessionStart",
-        additionalContext: context,
-      },
-    })}\n`
+// The human line rides the host's `systemMessage` field, which is rendered to
+// the person at session start without waiting for them to type. It is a second
+// channel, not a replacement: `additionalContext` still carries the full
+// projection to the agent, and a host that does not recognize the field simply
+// ignores it and leaves today's behavior intact.
+function emit(context, humanMessage) {
+  const payload = {};
+  if (humanMessage) payload.systemMessage = humanMessage;
+  payload.hookSpecificOutput = {
+    hookEventName: "SessionStart",
+    additionalContext: context,
+  };
+  process.stdout.write(`${JSON.stringify(payload)}\n`);
+}
+
+// Stated on the human line as well as the model payload: the person reading it
+// at session start is the one who must not mistake a projection for authority.
+const DISPOSABLE = "Disposable projection; OpenSpec and Git are the authority.";
+
+// The Keel mark. A keel is the carina, the ridge on a bird's sternum, so the
+// animal that literally has one is a bird. Every cell is drawn from
+// U+2580–U+259F — the same block-element family as the host's own startup
+// banner — because those code points are East-Asian-Ambiguous width: pinning
+// the charset is what keeps the rows aligned under a CJK locale, and matters
+// more than the shape. The rows are padded to equal width so that a future
+// edit which breaks the rectangle is caught rather than silently skewed.
+const MARK = [
+  "▙▖▛▀▜  ▛▀▜▗▟",
+  "  ▌█▐  ▌█▐  ",
+  "  ▙▄▟▚▞▙▄▟  ",
+].join("\n");
+
+// The frame is modelled on the host's own welcome panel and draws from
+// U+2500–U+257F, a different range than the mark. Its width is the longest
+// content row, so a long change name widens the panel instead of being cut:
+// the identifier is the most useful thing in the projection, and truncating
+// the payload to preserve the frame would invert what the frame is for.
+// Leads with a newline because the host prefixes the message with
+// `<hookEvent>:<source> says: `, which would otherwise push the top rule out
+// of line with the rows beneath it.
+// Opt-in. The single line is what answers the reported problem — nobody is
+// told anything at session start — and it ships on. The panel is presentation,
+// and presentation that appears unbidden in every session of every install
+// should be chosen rather than inherited. The allowlist is explicit so a typo
+// leaves the default in place instead of quietly switching it on.
+const PANEL_TITLE = "Keel";
+const PANEL_ENABLED = /^(1|true|on|yes)$/i.test(
+  String(process.env.KEEL_SESSION_PANEL || "").trim()
+);
+
+function panel(lines) {
+  if (!PANEL_ENABLED) return lines.join(" ");
+  const rows = [...MARK.split("\n"), "", ...lines];
+  const width = Math.max(
+    ...rows.map((row) => row.length),
+    PANEL_TITLE.length + 8
   );
+  const centred = rows.map((row) => {
+    if (!row) return "";
+    const isMark = /^[▀-▟ ]+$/.test(row);
+    if (!isMark) return row;
+    const pad = Math.floor((width - row.length) / 2);
+    return " ".repeat(pad) + row;
+  });
+  const head = `─── ${PANEL_TITLE} `;
+  return [
+    "",
+    `╭${head}${"─".repeat(width + 2 - head.length)}╮`,
+    ...centred.map((row) => `│ ${row.padEnd(width)} │`),
+    `╰${"─".repeat(width + 2)}╯`,
+  ].join("\n");
 }
 
 function runKeel(cwd, args) {
@@ -53,11 +117,18 @@ function runKeel(cwd, args) {
   });
 }
 
+// A degraded projection needs the human line most: a hook that fails silently
+// is indistinguishable from a hook that never ran, which is how this whole
+// failure mode was reported in the first place.
 function fallback(reason) {
   emit(
     `Keel hook fallback: ${reason} Run \`keel context\` manually; `
       + "OpenSpec and Git remain the durable authority. Report this failure "
-      + `and that command ${DISCLOSURE}.`
+      + `and that command ${DISCLOSURE}.`,
+    panel([
+      `Keel: projection unavailable — ${reason} Next: keel context.`,
+      DISPOSABLE,
+    ])
   );
 }
 
@@ -112,8 +183,14 @@ function main() {
       : "Keel session projection (disposable; OpenSpec and Git are the durable authority):";
 
   const lines = [header];
+  let human = [];
   if (context.status === "ready" && context.selection) {
     const task = context.selection.task ? `#${context.selection.task}` : "";
+    human = [
+      `Keel: ${context.selection.change}${task} — next: `
+        + `${context.nextAction ? context.nextAction.kind : "unknown"}.`,
+      DISPOSABLE,
+    ];
     lines.push(
       `- context ready: ${context.selection.change}${task} `
         + `(${context.selection.source}); next action: `
@@ -142,8 +219,18 @@ function main() {
       );
     }
   } else {
-    lines.push(`- context status: ${context.status || "unknown"}.`);
-    for (const reason of (context.reasons || []).slice(0, MAX_REASONS)) {
+    const status = context.status || "unknown";
+    const reasons = (context.reasons || []).slice(0, MAX_REASONS);
+    human = [
+      `Keel: ${status}`
+        + (reasons.length > 0
+          ? ` — ${String(reasons[0]).slice(0, MAX_REASON_LENGTH)}`
+          : "")
+        + " Next: keel context.",
+      DISPOSABLE,
+    ];
+    lines.push(`- context status: ${status}.`);
+    for (const reason of reasons) {
       lines.push(`- reason: ${String(reason).slice(0, MAX_REASON_LENGTH)}`);
     }
     lines.push(
@@ -152,7 +239,7 @@ function main() {
     );
   }
   lines.push(`- report this state ${DISCLOSURE}; it authorizes nothing.`);
-  emit(lines.join("\n"));
+  emit(lines.join("\n"), panel(human));
   return 0;
 }
 

package/scripts/validate_plugin.py

@@ -37,8 +37,8 @@ REQUIRED_SCRIPTS = [
     "scripts/validate_plugin.py",
 ]
 
-PACKAGE_VERSION = "5.3.9"
-PROTOCOL_VERSION = "5.3.9"
+PACKAGE_VERSION = "5.5.0"
+PROTOCOL_VERSION = "5.5.0"
 LEGACY_MANAGED_START = "<!-- keel:start version=2.1 -->"
 OPENSPEC_SCHEMA_NAME = "keel-spec-driven"
 # Mirrors KEEL_PACKAGE_NAME in scripts/install_to_repo.py, one of the two
@@ -2087,6 +2087,12 @@ def assert_openspec_overlay(path: Path, action: str) -> str | None:
                 "source expectations",
                 "Rough future slices",
                 "cannot mark tasks complete",
+                # A confirmation the owner already declared is routed to the
+                # declaration; one they did not declare is still asked for, and
+                # neither case touches the proof.
+                "standing-authorized action proceeds without",
+                "undeclared action still requires",
+                "never substitutes for a gate",
             ]
         )
     else:
@@ -2098,6 +2104,8 @@ def assert_openspec_overlay(path: Path, action: str) -> str | None:
                 "durable follow-up owner",
                 "explicit discard reason",
                 "cannot archive, sync, change acceptance, or bypass completion gates",
+                "standing-authorizes `archive`",
+                "completion gate and follow-up ownership checks still run",
             ]
         )
     for snippet in required:
@@ -8940,10 +8948,17 @@ def run_session_start_hook(
     *,
     keel_cli: str,
     timeout_ms: int | None = None,
+    panel: str | None = None,
 ) -> subprocess.CompletedProcess[str]:
     env = dict(os.environ)
     env["KEEL_CLI"] = keel_cli
     env["CLAUDE_PLUGIN_ROOT"] = str(ROOT / PLUGIN_ROOT)
+    # The suite must decide the panel's state rather than inherit whatever the
+    # developer running it has exported, or the default-off assertion would
+    # pass or fail by accident of the shell.
+    env.pop("KEEL_SESSION_PANEL", None)
+    if panel is not None:
+        env["KEEL_SESSION_PANEL"] = panel
     if timeout_ms is not None:
         env["KEEL_HOOK_TIMEOUT_MS"] = str(timeout_ms)
     return subprocess.run(
@@ -8969,10 +8984,98 @@ def session_start_context(result: subprocess.CompletedProcess[str]) -> str | Non
     return output.get("additionalContext")
 
 
-# The projection is delivered through additionalContext, which the host injects
-# into the agent and never renders for the human. Every branch must therefore
-# carry the instruction to relay it, including — especially — the degraded ones,
-# because a projection nobody sees is a projection nobody checks.
+def session_start_message(result: subprocess.CompletedProcess[str]) -> str | None:
+    """The human-visible half of the projection, carried on `systemMessage`."""
+    if not result.stdout.strip():
+        return None
+    return json.loads(result.stdout).get("systemMessage")
+
+
+# Each branch pairs its human message with the tokens a person needs in order to
+# act: what the state is, and which command moves it. The degraded branches are
+# the load-bearing rows — a fallback nobody sees is the bug this pair of channels
+# exists to close.
+HUMAN_BRANCH_TOKENS = {
+    "ready": ("demo#1.1",),
+    "idle": ("idle", "keel context"),
+    "ambiguous": ("ambiguous", "keel context"),
+    "missing-CLI": ("missing or incompatible", "keel context"),
+    "malformed": ("malformed", "keel context"),
+    "timeout": ("failed or timed out", "keel context"),
+}
+HUMAN_AUTHORITY_TOKEN = "OpenSpec and Git"
+
+# The mark is drawn only from the block-element range the host's own banner uses.
+# That range is East-Asian-Ambiguous width, so a terminal under a CJK locale
+# renders every one of these cells the same way it already renders the banner —
+# which is the whole reason the charset is pinned rather than the shape.
+MARK_RANGE = (0x2580, 0x259F)
+MARK_ROWS = 3
+BORDER_RANGE = (0x2500, 0x257F)
+
+
+def panel_rows(message: str) -> list[str]:
+    """The rendered panel: everything after the leading newline."""
+    return message[1:].split("\n") if message.startswith("\n") else []
+
+
+def is_mark_row(content: str) -> bool:
+    """A mark row is non-empty and drawn only from blocks and inner spaces.
+
+    The inner spaces are load-bearing shape - they are the owl's eye gaps - so
+    the charset test admits them rather than stripping the row down to its
+    glyphs and demanding every remaining cell be a block.
+    """
+    return bool(content.strip()) and all(
+        c == " " or MARK_RANGE[0] <= ord(c) <= MARK_RANGE[1] for c in content
+    )
+
+
+def panel_problem(message: str) -> str | None:
+    """The panel must close.
+
+    A frame turns a one-cell width error from a cosmetic skew into visibly
+    broken output, so every row is checked for equal width rather than trusted.
+    The mark keeps its own charset check: the border draws from U+2500-U+257F
+    and the mark from U+2580-U+259F, and mixing them is what would misalign
+    under a locale that renders one range wide.
+    """
+    if not message.startswith("\n"):
+        return "human message does not open with a newline before the panel"
+    rows = panel_rows(message)
+    if len(rows) < MARK_ROWS + 3:
+        return f"panel has {len(rows)} rows, too few to frame the mark"
+    if not (rows[0].startswith("╭") and rows[0].endswith("╮")):
+        return f"panel top rule is not a rule: {rows[0]!r}"
+    if "Keel" not in rows[0]:
+        return "panel top rule carries no title"
+    if not (rows[-1].startswith("╰") and rows[-1].endswith("╯")):
+        return f"panel bottom rule is not a rule: {rows[-1]!r}"
+    for row in rows[1:-1]:
+        if not (row.startswith("│") and row.endswith("│")):
+            return f"panel body row is not enclosed: {row!r}"
+    widths = {len(row) for row in rows}
+    if len(widths) != 1:
+        return f"panel rows are ragged: widths {sorted(widths)}"
+    marks = [row[2:-2] for row in rows[1:-1] if is_mark_row(row[2:-2])]
+    if len(marks) != MARK_ROWS:
+        return f"panel carries {len(marks)} mark rows, expected {MARK_ROWS}"
+    return None
+
+
+def panel_content(message: str) -> str:
+    """The panel with its frame and mark taken away."""
+    rows = panel_rows(message)
+    kept = [row[2:-2] for row in rows[1:-1] if not is_mark_row(row[2:-2])]
+    return " ".join(part.strip() for part in kept if part.strip())
+
+
+# additionalContext is the agent's half of the projection; the human reads the
+# systemMessage line asserted above. Every branch must still carry the
+# instruction to relay it, including — especially — the degraded ones. The two
+# checks are not redundant: one proves the state was shown, this one proves the
+# agent was told to say which state it is working from, and only the second can
+# expose the two disagreeing.
 SESSION_START_DISCLOSURE = "to the user in your first reply"
 
 # A host loads its plugins once per session, so the projection can be absent for
@@ -9172,6 +9275,134 @@ def validate_native_plugin_session_start_scenario() -> int:
             report(repr(hang_context))
             return 1
 
+        # Every branch is exercised in both forms. The panel is opt-in, so the
+        # default run is the one that ships; the enabled run only proves the
+        # decoration still assembles when asked for. Both must carry the same
+        # information, which is what keeps the switch from costing anything.
+        branches = (
+            ("ready", ready_repo, real_cli, None),
+            ("idle", idle_repo, real_cli, None),
+            ("ambiguous", ambiguous_repo, real_cli, None),
+            ("missing-CLI", ready_repo, "keel-definitely-missing-cli-xyz", None),
+            ("malformed", ready_repo, f'node "{malformed_cli}"', None),
+            ("timeout", ready_repo, f'node "{hang_cli}"', 700),
+        )
+        for label, repo, cli, timeout_ms in branches:
+            for panel_env in (None, "1"):
+                result = run_session_start_hook(
+                    repo, codex_event, keel_cli=cli,
+                    timeout_ms=timeout_ms, panel=panel_env,
+                )
+                mode = "default" if panel_env is None else "panel"
+                message = session_start_message(result)
+                if not message:
+                    report(
+                        f"native-plugin-session-start {label}/{mode} branch "
+                        "emitted no human-visible message, so that state "
+                        "reaches only the agent and nobody can catch it being "
+                        "wrong."
+                    )
+                    return 1
+                if label == "ambiguous" and "alpha#1.1" in message:
+                    report(
+                        f"native-plugin-session-start {label}/{mode} human "
+                        "message named a guessed owner."
+                    )
+                    return 1
+                if panel_env is None:
+                    decoration = [
+                        c for c in message
+                        if MARK_RANGE[0] <= ord(c) <= MARK_RANGE[1]
+                        or BORDER_RANGE[0] <= ord(c) <= BORDER_RANGE[1]
+                    ]
+                    if decoration:
+                        report(
+                            f"native-plugin-session-start {label} draws the "
+                            f"panel without being asked: {decoration[:6]!r}"
+                        )
+                        return 1
+                    if "\n" in message:
+                        report(
+                            f"native-plugin-session-start {label} default "
+                            f"message is not a single line: {message!r}"
+                        )
+                        return 1
+                    carried = message
+                else:
+                    problem = panel_problem(message)
+                    if problem:
+                        report(
+                            f"native-plugin-session-start {label} {problem}"
+                        )
+                        return 1
+                    # Neither frame nor mark may be load-bearing: take both
+                    # away and the message still has to say what the state is
+                    # and which command moves it.
+                    carried = panel_content(message)
+                absent = [
+                    token
+                    for token in (
+                        *HUMAN_BRANCH_TOKENS[label], HUMAN_AUTHORITY_TOKEN
+                    )
+                    if token not in carried
+                ]
+                if absent:
+                    report(
+                        f"native-plugin-session-start {label}/{mode} message "
+                        f"omits {absent}: {carried!r}"
+                    )
+                    return 1
+
+        # A value outside the allowlist must leave the default in place, so a
+        # typo cannot silently switch the decoration on.
+        typo = session_start_message(
+            run_session_start_hook(
+                idle_repo, codex_event, keel_cli=real_cli, panel="yeah"
+            )
+        ) or ""
+        if "\n" in typo or "╭" in typo:
+            report(
+                "native-plugin-session-start enabled the panel for a value "
+                f"outside the allowlist: {typo!r}"
+            )
+            return 1
+
+        # The panel sizes to its content. A change name longer than every other
+        # row must widen the frame rather than be cut, because the identifier
+        # is the thing the reader came for.
+        long_name = "a-deliberately-long-change-name-that-exceeds-the-panel-default"
+        wide_repo = tmp / "wide"
+        write_text(
+            wide_repo / f"openspec/changes/{long_name}/tasks.md",
+            task_contract_fixture(),
+        )
+        wide_message = session_start_message(
+            run_session_start_hook(wide_repo, codex_event, keel_cli=real_cli, panel="1")
+        ) or ""
+        problem = panel_problem(wide_message)
+        if problem:
+            report(f"native-plugin-session-start wide panel {problem}")
+            return 1
+        if long_name not in panel_content(wide_message):
+            report(
+                "native-plugin-session-start truncated the change name to fit "
+                f"the panel: {panel_content(wide_message)!r}"
+            )
+            return 1
+        narrow_message = session_start_message(
+            run_session_start_hook(
+                idle_repo, codex_event, keel_cli=real_cli, panel="1"
+            )
+        ) or ""
+        wide = len(panel_rows(wide_message)[0])
+        narrow = len(panel_rows(narrow_message)[0])
+        if wide <= narrow:
+            report(
+                "native-plugin-session-start panel width is fixed, not derived "
+                f"from content: wide={wide} narrow={narrow}"
+            )
+            return 1
+
     hooks_config = json.loads(
         (ROOT / PLUGIN_ROOT / "hooks/hooks.json").read_text(encoding="utf-8")
     )
@@ -10888,6 +11119,405 @@ def validate_verification_layering_docs_scenario() -> int:
     return 0
 
 
+STANDING_AUTHORIZATION_ACTIONS = ("commit", "push", "release", "archive")
+
+
+def write_authorize_config(repo: Path, body: str) -> None:
+    (repo / "keel").mkdir(parents=True, exist_ok=True)
+    (repo / "keel" / "config.yaml").write_text(body, encoding="utf-8")
+
+
+def validate_standing_authorization_declaration_scenario() -> int:
+    with tempfile.TemporaryDirectory(prefix="keel-authorize-") as raw_tmp:
+        root = Path(raw_tmp)
+
+        # M1 — a declared action is authorized; an undeclared one is not.
+        declared = root / "declared"
+        declared.mkdir()
+        write_authorize_config(
+            declared,
+            "fast_check: echo declared-check\n"
+            "authorize:\n"
+            "  - commit\n"
+            "  - push\n",
+        )
+        out = run_keel(declared, "--doctor").stdout
+        if "Standing authorization:" not in out:
+            report("standing-authorization: doctor has no standing authorization surface.")
+            report(out)
+            return 1
+        for needle in ("commit: authorized", "push: authorized"):
+            if needle not in out:
+                report(f"standing-authorization: declared action not reported: {needle}")
+                report(out)
+                return 1
+        for needle in ("release: not authorized", "archive: not authorized"):
+            if needle not in out:
+                report(f"standing-authorization: undeclared action not reported: {needle}")
+                report(out)
+                return 1
+
+        # M2 — absent, blockless, and empty declarations all authorize nothing,
+        # and none of them disturbs the fast_check surface that shares the file.
+        absent = root / "absent"
+        absent.mkdir()
+        blockless = root / "blockless"
+        blockless.mkdir()
+        write_authorize_config(blockless, "fast_check: echo blockless-check\n")
+        empty = root / "empty"
+        empty.mkdir()
+        write_authorize_config(
+            empty, "fast_check: echo empty-check\nauthorize:\n"
+        )
+        for repo, label, fast in (
+            (absent, "absent", None),
+            (blockless, "blockless", "echo blockless-check"),
+            (empty, "empty", "echo empty-check"),
+        ):
+            out = run_keel(repo, "--doctor").stdout
+            if "authorize: none" not in out:
+                report(
+                    f"standing-authorization: {label} repo does not report an "
+                    "undeclared authorization surface."
+                )
+                report(out)
+                return 1
+            if "authorized" in out.replace("not authorized", ""):
+                report(
+                    f"standing-authorization: {label} repo reports an authorized action."
+                )
+                report(out)
+                return 1
+            expected_fast = f"fast_check: ok - declared in keel/config.yaml: {fast}"
+            if fast is not None and expected_fast not in out:
+                report(
+                    f"standing-authorization: {label} repo lost its fast_check line."
+                )
+                report(out)
+                return 1
+            if fast is None and "fast_check: none" not in out:
+                report("standing-authorization: absent repo lost its fast_check line.")
+                report(out)
+                return 1
+
+        # M3 — an unrecognized name is reported with the accepted set, exits
+        # non-zero, and authorizes nothing that sits beside it.
+        unknown = root / "unknown"
+        unknown.mkdir()
+        write_authorize_config(
+            unknown,
+            "authorize:\n  - commit\n  - deploy\n",
+        )
+        result = run_keel(unknown, "--doctor")
+        combined = result.stdout + result.stderr
+        if result.returncode == 0:
+            report("standing-authorization: an unrecognized action name exited zero.")
+            report(combined)
+            return 1
+        if "deploy" not in combined:
+            report("standing-authorization: the error does not name the offending entry.")
+            report(combined)
+            return 1
+        for action in STANDING_AUTHORIZATION_ACTIONS:
+            if action not in combined:
+                report(
+                    "standing-authorization: the error does not name accepted "
+                    f"action {action}."
+                )
+                report(combined)
+                return 1
+        if "commit: authorized" in combined:
+            report(
+                "standing-authorization: a rejected declaration still authorized "
+                "the entry beside the bad one."
+            )
+            report(combined)
+            return 1
+
+    report("standing-authorization-declaration scenario passed.")
+    return 0
+
+
+def standing_authorization_task(boundary: str = "") -> str:
+    return (
+        "- [ ] 1.1 Behavior\n"
+        "  - Covers:\n"
+        "    - E1: public behavior\n"
+        "  - Touch:\n"
+        "    - src/feature.js\n"
+        "  - Verify:\n"
+        "    - Strategy: evidence-first\n"
+        "    - M1: node test.js proves the public behavior\n"
+        + boundary
+        + "  - Evidence:\n"
+        "    - Contract: pending\n"
+        "    - M1: pending\n"
+        "    - Review:\n"
+        "      - Status: pending\n"
+        "      - Acceptance check: pending\n"
+        "      - Scope check: pending\n"
+        "      - Findings: pending\n"
+        "    - Blocker: none\n"
+    )
+
+
+def standing_authorization_autonomy(repo: Path) -> list[str] | None:
+    result = run_keel(
+        repo,
+        "gate",
+        "task-start",
+        "--change",
+        "demo",
+        "--task",
+        "1.1",
+        "--json",
+        "--no-guard",
+    )
+    try:
+        payload = json.loads(result.stdout)
+    except json.JSONDecodeError:
+        return None
+    contract = payload.get("contract") or {}
+    capsule = contract.get("capsule") or {}
+    boundaries = capsule.get("boundaries") or {}
+    return boundaries.get("autonomy")
+
+
+def validate_standing_authorization_inheritance_scenario() -> int:
+    with tempfile.TemporaryDirectory(prefix="keel-authinherit-") as raw_tmp:
+        root = Path(raw_tmp)
+
+        # M1 — a task that authored no boundary inherits the declaration, and
+        # the capsule says where the authorization came from.
+        inherits = root / "inherits"
+        inherits.mkdir()
+        write_gate_fixture(inherits, standing_authorization_task())
+        write_authorize_config(inherits, "authorize:\n  - commit\n")
+        autonomy = standing_authorization_autonomy(inherits)
+        if autonomy is None:
+            report("standing-authorization-inheritance: task-start returned no capsule autonomy.")
+            return 1
+        inherited = [entry for entry in autonomy if "commit" in entry]
+        if not inherited:
+            report(
+                "standing-authorization-inheritance: a declared action did not "
+                f"reach the capsule autonomy boundary: {autonomy}"
+            )
+            return 1
+        if not any("keel/config.yaml" in entry for entry in inherited):
+            report(
+                "standing-authorization-inheritance: the inherited entry does "
+                f"not name the repository declaration as its source: {autonomy}"
+            )
+            return 1
+
+        # M2 — an authored boundary is returned unchanged, with nothing
+        # inherited beside it.
+        authored = root / "authored"
+        authored.mkdir()
+        write_gate_fixture(
+            authored,
+            standing_authorization_task(
+                "  - Autonomy boundary:\n"
+                "    - Default: hard-stop\n"
+                "    - Pre-authorized fallback: revert the fixture file and record M1\n"
+            ),
+        )
+        write_authorize_config(authored, "authorize:\n  - commit\n  - push\n")
+        autonomy = standing_authorization_autonomy(authored)
+        if autonomy is None:
+            report("standing-authorization-inheritance: authored-boundary task did not compile.")
+            return 1
+        if "Pre-authorized fallback: revert the fixture file and record M1" not in autonomy:
+            report(
+                "standing-authorization-inheritance: the authored boundary was "
+                f"not preserved: {autonomy}"
+            )
+            return 1
+        if any("keel/config.yaml" in entry for entry in autonomy):
+            report(
+                "standing-authorization-inheritance: the declaration overrode an "
+                f"authored boundary: {autonomy}"
+            )
+            return 1
+
+        # M3 — an action the declaration does not name still hard-stops.
+        autonomy = standing_authorization_autonomy(inherits)
+        if autonomy is None:
+            report("standing-authorization-inheritance: re-compilation returned no autonomy.")
+            return 1
+        if any("push" in entry or "release" in entry for entry in autonomy):
+            report(
+                "standing-authorization-inheritance: an undeclared action was "
+                f"authorized: {autonomy}"
+            )
+            return 1
+        if not any(entry.startswith("Default: hard-stop") for entry in autonomy):
+            report(
+                "standing-authorization-inheritance: the hard-stop default "
+                f"disappeared for undeclared actions: {autonomy}"
+            )
+            return 1
+
+    report("standing-authorization-inheritance scenario passed.")
+    return 0
+
+
+def validate_standing_authorization_never_weakens_scenario() -> int:
+    """A declaration removes a confirmation. It must not remove a proof.
+
+    Every check here compares an authorizing repository against an identical
+    one that declares nothing. The declaration is proven inert on the gate
+    result, on the failure text, and on continuity selection — the three places
+    a reader might otherwise assume authorization had bought something.
+    """
+
+    complete_task = (
+        "- [ ] 1.1 Behavior\n"
+        "  - Covers:\n"
+        "    - E1: public behavior\n"
+        "  - Touch:\n"
+        "    - src/feature.js\n"
+        "  - Verify:\n"
+        "    - Strategy: evidence-first\n"
+        "    - M1: node test.js proves the public behavior\n"
+        "  - Evidence:\n"
+        "    - Contract: pending\n"
+        "    - M1: node test.js printed ok\n"
+        "    - Review:\n"
+        "      - Status: pass\n"
+        "      - Acceptance check: reviewed\n"
+        "      - Scope check: reviewed\n"
+        "      - Findings: none\n"
+        "    - Blocker: none\n"
+    )
+    missing_evidence_task = complete_task.replace(
+        "    - M1: node test.js printed ok\n", "    - M1: pending\n"
+    )
+
+    def gate_result(repo: Path, stage: str) -> dict | None:
+        result = run_keel(
+            repo, "gate", stage, "--change", "demo", "--task", "1.1", "--json"
+        )
+        try:
+            payload = json.loads(result.stdout)
+        except json.JSONDecodeError:
+            return None
+        return {
+            "status": payload.get("status"),
+            "problems": sorted(
+                (problem.get("code", ""), problem.get("message", ""))
+                for problem in payload.get("problems") or []
+            ),
+        }
+
+    def pair(root: Path, name: str, tasks: str) -> tuple[Path, Path]:
+        authorizing = root / f"{name}-authorizing"
+        authorizing.mkdir()
+        write_gate_fixture(authorizing, tasks)
+        write_authorize_config(
+            authorizing,
+            "authorize:\n  - commit\n  - push\n  - release\n  - archive\n",
+        )
+        silent = root / f"{name}-silent"
+        silent.mkdir()
+        write_gate_fixture(silent, tasks)
+        # Positive control. Every check below compares these two repositories
+        # and passes when they agree, so a declaration that silently failed to
+        # reach the capsule would make each comparison trivially true and prove
+        # nothing. Assert the difference exists before asserting it is inert.
+        live = standing_authorization_autonomy(authorizing) or []
+        inert = standing_authorization_autonomy(silent) or []
+        if not any("keel/config.yaml" in entry for entry in live):
+            report(
+                f"standing-authorization-inert: the {name} authorizing fixture "
+                f"never actually authorized anything: {live}"
+            )
+            raise AssertionError("authorizing fixture is not authorizing")
+        if any("keel/config.yaml" in entry for entry in inert):
+            report(
+                f"standing-authorization-inert: the {name} silent fixture "
+                f"declared something: {inert}"
+            )
+            raise AssertionError("silent fixture is not silent")
+        return authorizing, silent
+
+    with tempfile.TemporaryDirectory(prefix="keel-authinert-") as raw_tmp:
+        root = Path(raw_tmp)
+
+        # M1 — completion returns the same status and problem set either way.
+        authorizing, silent = pair(root, "complete", complete_task)
+        for repo in (authorizing, silent):
+            if gate_result(repo, "task-start") is None:
+                report("standing-authorization-inert: task-start produced no JSON.")
+                return 1
+        authorized_result = gate_result(authorizing, "task-complete")
+        silent_result = gate_result(silent, "task-complete")
+        if authorized_result is None or silent_result is None:
+            report("standing-authorization-inert: task-complete produced no JSON.")
+            return 1
+        if authorized_result != silent_result:
+            report(
+                "standing-authorization-inert: a declaration changed the "
+                f"completion gate result: {authorized_result} != {silent_result}"
+            )
+            return 1
+
+        # M2 — a repo authorizing every action still fails for missing evidence,
+        # with unchanged failure text.
+        authorizing, silent = pair(root, "missing", missing_evidence_task)
+        for repo in (authorizing, silent):
+            if gate_result(repo, "task-start") is None:
+                report("standing-authorization-inert: task-start produced no JSON.")
+                return 1
+        authorized_result = gate_result(authorizing, "task-complete")
+        silent_result = gate_result(silent, "task-complete")
+        if authorized_result is None or silent_result is None:
+            report("standing-authorization-inert: task-complete produced no JSON.")
+            return 1
+        if authorized_result.get("status") == "pass":
+            report(
+                "standing-authorization-inert: authorizing every action let a "
+                "task with missing evidence pass completion."
+            )
+            return 1
+        if authorized_result != silent_result:
+            report(
+                "standing-authorization-inert: a declaration changed the failure "
+                f"text: {authorized_result} != {silent_result}"
+            )
+            return 1
+
+        # M3 — a declaration selects nothing and starts nothing.
+        def continuity(repo: Path) -> dict | None:
+            result = run_keel(repo, "context", "--json")
+            try:
+                payload = json.loads(result.stdout)
+            except json.JSONDecodeError:
+                return None
+            return {
+                "status": payload.get("status"),
+                "selection": payload.get("selection"),
+                "nextAction": payload.get("nextAction"),
+            }
+
+        authorizing, silent = pair(root, "context", complete_task)
+        authorized_context = continuity(authorizing)
+        silent_context = continuity(silent)
+        if authorized_context is None or silent_context is None:
+            report("standing-authorization-inert: keel context produced no JSON.")
+            return 1
+        if authorized_context != silent_context:
+            report(
+                "standing-authorization-inert: a declaration changed continuity "
+                f"selection: {authorized_context} != {silent_context}"
+            )
+            return 1
+
+    report("standing-authorization-never-weakens scenario passed.")
+    return 0
+
+
 def validate_fast_check_config_scaffold_scenario() -> int:
     with tempfile.TemporaryDirectory(prefix="keel-fastcfg-") as raw_tmp:
         repo = Path(raw_tmp)
@@ -14268,6 +14898,18 @@ SCENARIOS: tuple = (
     ("update-pack-install", validate_update_pack_install_scenario),
     ("update-default-registry", validate_update_default_registry_scenario),
     ("verification-layering-docs", validate_verification_layering_docs_scenario),
+    (
+        "standing-authorization-declaration",
+        validate_standing_authorization_declaration_scenario,
+    ),
+    (
+        "standing-authorization-inheritance",
+        validate_standing_authorization_inheritance_scenario,
+    ),
+    (
+        "standing-authorization-never-weakens",
+        validate_standing_authorization_never_weakens_scenario,
+    ),
     ("fast-check-config-scaffold", validate_fast_check_config_scaffold_scenario),
     ("fast-pre-push-hooks", validate_fast_pre_push_hooks_scenario),
     ("fast-pre-push-doctor", validate_fast_pre_push_doctor_scenario),

package/src/core/config.js

@@ -0,0 +1,49 @@
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+
+// The closed vocabulary of actions a repository may standing-authorize. It is
+// closed so an entry outside it can be reported by name: a free-form grant
+// cannot tell a typo from a decision, and silently dropping one leaves the
+// author believing they authorized something they did not.
+const STANDING_AUTHORIZATION_ACTIONS = ["commit", "push", "release", "archive"];
+
+const CONFIG_RELATIVE_PATH = path.join("keel", "config.yaml");
+
+// The declaration shares keel/config.yaml with fast_check, so the reader stays
+// line-oriented rather than pulling in a YAML dependency for a format Keel
+// controls and keeps flat on purpose.
+function readStandingAuthorization(repo) {
+  const configPath = path.join(repo, "keel", "config.yaml");
+  const declared = [];
+  const unknown = [];
+  if (!fs.existsSync(configPath)) return { declared, unknown };
+  let inBlock = false;
+  for (const line of fs.readFileSync(configPath, "utf8").split(/\r?\n/)) {
+    if (/^\s*#/.test(line)) continue;
+    if (/^authorize\s*:\s*$/.test(line)) {
+      inBlock = true;
+      continue;
+    }
+    if (!inBlock) continue;
+    if (line.trim() === "") continue;
+    const entry = line.match(/^\s+-\s*(\S+)\s*$/);
+    // Anything that is not a list item closes the block; the next top-level
+    // key belongs to the rest of the file.
+    if (!entry) break;
+    if (STANDING_AUTHORIZATION_ACTIONS.includes(entry[1])) declared.push(entry[1]);
+    else unknown.push(entry[1]);
+  }
+  // Fail closed. A declaration Keel cannot fully read authorizes nothing,
+  // because the alternative is granting the entries beside a typo while the
+  // author believes they granted the typo too.
+  if (unknown.length > 0) return { declared: [], unknown };
+  return { declared, unknown };
+}
+
+module.exports = {
+  CONFIG_RELATIVE_PATH,
+  STANDING_AUTHORIZATION_ACTIONS,
+  readStandingAuthorization,
+};

package/src/core/task-contract.js

@@ -4,6 +4,11 @@ const crypto = require("crypto");
 const fs = require("fs");
 const path = require("path");
 
+const {
+  CONFIG_RELATIVE_PATH,
+  readStandingAuthorization,
+} = require("./config");
+
 const SUPPORTED_MODES = new Set([
   "implementation",
   "diagnose-only",
@@ -844,6 +849,20 @@ function compileTaskContract(repo, change, task) {
   if (!autonomy.some((item) => /^Default:/i.test(item))) {
     autonomy.unshift("Default: hard-stop");
   }
+  // A repository declaration supplies the default a task did not author; it
+  // never edits one the task did, because a repository-wide default that could
+  // override a task's stated boundary would make the capsule unreadable on its
+  // own. The entry names its source so an inherited authorization is never
+  // mistaken for one this task decided.
+  if (explicitAutonomy.length === 0) {
+    const { declared } = readStandingAuthorization(repo);
+    if (declared.length > 0) {
+      autonomy.push(
+        `Standing authorization (${CONFIG_RELATIVE_PATH.split(path.sep).join("/")}): `
+          + declared.join(", ")
+      );
+    }
+  }
   if (!autonomy.some((item) => /^Pre-authorized fallback:/i.test(item))) {
     autonomy.push("Pre-authorized fallback: none");
   }