@cratylus/canon 0.1.3 → 0.3.0

package/dist/dimensions/capabilities/film-production.js

@@ -0,0 +1,8 @@
+// The craft the software SERVES, not the software. Its decomposition is the
+// production ladder every studio already runs, and the two laws a generative
+// pipeline most often collapses: IDENTITY (is this the same character) and
+// CONTINUITY (does the staging flow) are different problems with different
+// instruments, and an art-bible entry is approved ONCE and applied everywhere
+// rather than re-specified per shot.
+export const filmProduction = `film-production ≜ ⟨development breakdown art-bible shot-design continuity cut⟩ ⟨identity ⊥ continuity⟩ ⟨art-bible ≜ approve-once · apply-everywhere⟩ ⟨industry-standard ≻ invention⟩`;
+//# sourceMappingURL=film-production.js.map

package/dist/dimensions/capabilities/film-production.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"film-production.js","sourceRoot":"","sources":["../../../src/dimensions/capabilities/film-production.ts"],"names":[],"mappings":"AAEA,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,8EAA8E;AAC9E,qCAAqC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAiB,sLAAsL,CAAC"}

package/dist/dimensions/capabilities/generative-video.d.ts

@@ -0,0 +1,2 @@
+import type { Capabilities } from '../../manifest.js';
+export declare const generativeVideo: Capabilities;

package/dist/dimensions/capabilities/generative-video.js

@@ -0,0 +1,8 @@
+// The generative half of the craft — what the community, not the studio, has
+// standardized. The load-bearing clause is the third: reference conditioning is
+// STATELESS (every request re-presents every reference; the model remembers
+// nothing between shots), so whatever carries identity across a production is
+// the ledger, never the model. Identity-lock is ranked: a trained adapter beats
+// reference conditioning beats prompt-only description.
+export const generativeVideo = `generative-video ≜ ⟨model-selection conditioning identity-lock drift-control⟩ ⟨conditioning stateless ⇒ ledger = the-memory⟩ ⟨identity-lock ≜ adapter ≻ reference ≻ prompt⟩ ⟨community-recommendation ≻ invention⟩`;
+//# sourceMappingURL=generative-video.js.map

package/dist/dimensions/capabilities/generative-video.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generative-video.js","sourceRoot":"","sources":["../../../src/dimensions/capabilities/generative-video.ts"],"names":[],"mappings":"AAEA,6EAA6E;AAC7E,gFAAgF;AAChF,4EAA4E;AAC5E,8EAA8E;AAC9E,gFAAgF;AAChF,wDAAwD;AACxD,MAAM,CAAC,MAAM,eAAe,GAAiB,oNAAoN,CAAC"}

package/dist/dimensions/formality/plain.js

@@ -10,7 +10,7 @@
 // for shorter replies buys prose with behaviour.
 //
 // REGISTER ONLY. The closing tail a report owes its operator is `autonomy`'s —
-// `check-in` names it, because what a reply must CONTAIN at the end is report
+// `handoff` names it, because what a reply must CONTAIN at the end is report
 // structure, not a register. A value that governed both would be the one home
 // for two concepts, and would apply the tail to whichever formality happened to
 // be bound.

package/dist/dimensions/formality/plain.js.map

@@ -1 +1 @@
-{"version":3,"file":"plain.js","sourceRoot":"","sources":["../../../src/dimensions/formality/plain.ts"],"names":[],"mappings":"AAEA,4EAA4E;AAC5E,0EAA0E;AAC1E,2EAA2E;AAC3E,4EAA4E;AAC5E,gEAAgE;AAChE,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,iDAAiD;AACjD,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,YAAY;AACZ,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,gFAAgF;AAChF,yEAAyE;AACzE,EAAE;AACF,iFAAiF;AACjF,4EAA4E;AAC5E,iFAAiF;AACjF,+EAA+E;AAC/E,8EAA8E;AAC9E,EAAE;AACF,uEAAuE;AACvE,iFAAiF;AACjF,gFAAgF;AAChF,iFAAiF;AACjF,kFAAkF;AAClF,gFAAgF;AAChF,iFAAiF;AACjF,MAAM,CAAC,MAAM,KAAK,GAAc,yYAAyY,CAAC"}
+{"version":3,"file":"plain.js","sourceRoot":"","sources":["../../../src/dimensions/formality/plain.ts"],"names":[],"mappings":"AAEA,4EAA4E;AAC5E,0EAA0E;AAC1E,2EAA2E;AAC3E,4EAA4E;AAC5E,gEAAgE;AAChE,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,iDAAiD;AACjD,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,gFAAgF;AAChF,YAAY;AACZ,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,gFAAgF;AAChF,yEAAyE;AACzE,EAAE;AACF,iFAAiF;AACjF,4EAA4E;AAC5E,iFAAiF;AACjF,+EAA+E;AAC/E,8EAA8E;AAC9E,EAAE;AACF,uEAAuE;AACvE,iFAAiF;AACjF,gFAAgF;AAChF,iFAAiF;AACjF,kFAAkF;AAClF,gFAAgF;AAChF,iFAAiF;AACjF,MAAM,CAAC,MAAM,KAAK,GAAc,yYAAyY,CAAC"}

package/dist/hook-cells.js

@@ -6,8 +6,11 @@
 // (claude adapter: `turn.end` → Stop, `subagent.end` → SubagentStop) and carries
 // their VERBATIM worker payloads so the projector stages them under `hooks/<id>/`
 // (no file copy — the bytes come from the cell). Only `harness`-substrate cells
-// register in settings.json; a `git`-substrate cell (praxis-continuity) fires in
-// git's process and is byte-locked but not serialized here.
+// register in settings.json, and every surviving cell is one: the corpus's single
+// `git`-substrate cell, `praxis-continuity`, retired with the praxis plan mirror it
+// nudged about. The routing for a non-harness substrate is not hypothetical — it is
+// exercised the moment such a cell exists again — but nothing carries it today, and
+// a header claiming a live example is a claim a reader cannot check.
 //
 // The cell shapes are the schema's type kernel (`@cratylus/schema`); this
 // module is the composition root that NAMES the concrete cells and nothing more.

package/dist/hook-cells.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-cells.js","sourceRoot":"","sources":["../src/hook-cells.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,2EAA2E;AAC3E,kFAAkF;AAClF,mFAAmF;AACnF,4EAA4E;AAC5E,iFAAiF;AACjF,kFAAkF;AAClF,gFAAgF;AAChF,iFAAiF;AACjF,4DAA4D;AAC5D,EAAE;AACF,0EAA0E;AAC1E,iFAAiF;AACjF,oFAAoF;AACpF,iFAAiF;AACjF,+EAA+E;AAE/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAG9D,wFAAwF;AACxF,MAAM,CAAC,MAAM,gBAAgB,GAAwB;IACnD,eAAe;IACf,kBAAkB;IAClB,iBAAiB;CAClB,CAAC"}
+{"version":3,"file":"hook-cells.js","sourceRoot":"","sources":["../src/hook-cells.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,2EAA2E;AAC3E,kFAAkF;AAClF,mFAAmF;AACnF,4EAA4E;AAC5E,iFAAiF;AACjF,kFAAkF;AAClF,gFAAgF;AAChF,kFAAkF;AAClF,oFAAoF;AACpF,oFAAoF;AACpF,oFAAoF;AACpF,qEAAqE;AACrE,EAAE;AACF,0EAA0E;AAC1E,iFAAiF;AACjF,oFAAoF;AACpF,iFAAiF;AACjF,+EAA+E;AAE/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAG9D,wFAAwF;AACxF,MAAM,CAAC,MAAM,gBAAgB,GAAwB;IACnD,eAAe;IACf,kBAAkB;IAClB,iBAAiB;CAClB,CAAC"}

package/dist/hooks/deploy-drift-notice.js

@@ -33,7 +33,7 @@
 // copy with nothing further to say. That is not hypothetical and it is not rare —
 // it is the ORDINARY shape of work here, where a session edits a cell, projects it,
 // and keeps going under the version it just replaced. The 16-hour-old projection of
-// an agent's own governing cell was this; so was a `praxis` edit that landed under a
+// an agent's own governing cell was this; so was a `plan` edit that landed under a
 // running session hours later.
 //
 // `prompt.submit` IS THE RE-ARM, and it is the same question at a finer grain rather

package/dist/hooks/deploy-drift-notice.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-drift-notice.js","sourceRoot":"","sources":["../../src/hooks/deploy-drift-notice.ts"],"names":[],"mappings":"AAEA,kFAAkF;AAClF,kEAAkE;AAClE,EAAE;AACF,oFAAoF;AACpF,qFAAqF;AACrF,gFAAgF;AAChF,sFAAsF;AACtF,0EAA0E;AAC1E,mFAAmF;AACnF,gFAAgF;AAChF,qFAAqF;AACrF,EAAE;AACF,sFAAsF;AACtF,sFAAsF;AACtF,qFAAqF;AACrF,iFAAiF;AACjF,8BAA8B;AAC9B,EAAE;AACF,qFAAqF;AACrF,sFAAsF;AACtF,oFAAoF;AACpF,uFAAuF;AACvF,kFAAkF;AAClF,2BAA2B;AAC3B,EAAE;AACF,sFAAsF;AACtF,oFAAoF;AACpF,kEAAkE;AAClE,EAAE;AACF,mFAAmF;AACnF,oFAAoF;AACpF,kFAAkF;AAClF,kFAAkF;AAClF,oFAAoF;AACpF,oFAAoF;AACpF,qFAAqF;AACrF,+BAA+B;AAC/B,EAAE;AACF,qFAAqF;AACrF,qFAAqF;AACrF,oFAAoF;AACpF,oFAAoF;AACpF,uFAAuF;AACvF,sFAAsF;AACtF,kFAAkF;AAClF,mFAAmF;AACnF,uFAAuF;AACvF,EAAE;AACF,uFAAuF;AACvF,qFAAqF;AACrF,uFAAuF;AACvF,wFAAwF;AACxF,wFAAwF;AACxF,yFAAyF;AACzF,yFAAyF;AACzF,yFAAyF;AACzF,0FAA0F;AAC1F,wFAAwF;AACxF,0BAA0B;AAC1B,EAAE;AACF,sFAAsF;AACtF,mFAAmF;AACnF,yFAAyF;AACzF,oFAAoF;AACpF,uEAAuE;AACvE,EAAE;AACF,mFAAmF;AACnF,8CAA8C;AAC9C,gFAAgF;AAChF,2EAA2E;AAC3E,EAAE;AACF,qFAAqF;AACrF,oFAAoF;AACpF,qFAAqF;AACrF,8BAA8B;AAC9B,gDAAgD;AAChD,gDAAgD;AAChD,oFAAoF;AACpF,6EAA6E;AAC7E,qFAAqF;AACrF,kFAAkF;AAClF,sFAAsF;AACtF,oFAAoF;AACpF,EAAE;AACF,sFAAsF;AACtF,mFAAmF;AACnF,wFAAwF;AACxF,gDAAgD;AAChD,gDAAgD;AAChD,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,wFAAwF;AACxF,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,4CAA4C;AAC5C,EAAE;AACF,gFAAgF;AAChF,qFAAqF;AACrF,6EAA6E;AAC7E,uFAAuF;AACvF,iEAAiE;AACjE,EAAE;AACF,qFAAqF;AACrF,iFAAiF;AACjF,mFAAmF;AACnF,iFAAiF;AACjF,EAAE;AACF,sFAAsF;AACtF,+EAA+E;AAC/E,kFAAkF;AAClF,iFAAiF;AACjF,gDAAgD;AAChD,qFAAqF;AACrF,oFAAoF;AACpF,6EAA6E;AAC7E,yEAAyE;AACzE,iFAAiF;AACjF,wEAAwE;AACxE,qFAAqF;AACrF,4EAA4E;AAC5E,qFAAqF;AACrF,gFAAgF;AAChF,gFAAgF;AAChF,kFAAkF;AAClF,mFAAmF;AACnF,kFAAkF;AAClF,mFAAmF;AACnF,kFAAkF;AAClF,EAAE;AACF,oFAAoF;AACpF,iFAAiF;AACjF,sFAAsF;AACtF,2DAA2D;AAC3D,EAAE;AACF,+EAA+E;AAC/E,uFAAuF;AACvF,qFAAqF;AACrF,4EAA4E;AAC5E,oFAAoF;AACpF,oFAAoF;AACpF,6BAA6B;AAE7B,MAAM,CAAC,MAAM,iBAAiB,GAAa;IACzC,EAAE,EAAE,qBAAqB;IACzB,OAAO,EACL,i8BAAi8B;IACn8B,SAAS,EAAE,SAAS;IACpB,MAAM,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,KAAK,EAAE,wBAAwB;IAC/B,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,MAAM,EAAE;QACN;YACE,EAAE,EAAE,OAAO;YACX,IAAI,EAAE,oVAAoV;SAC3V;QACD;YACE,EAAE,EAAE,YAAY;YAChB,4EAA4E;YAC5E,sEAAsE;YACtE,IAAI,EAAE,qNAAqN;SAC5N;QACD;YACE,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,sQAAsQ;SAC7Q;KACF;IACD,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,wBAAwB;YAClC,UAAU,EAAE,yDAAyD;YACrE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiQd;SACI;KACF;CACF,CAAC"}
+{"version":3,"file":"deploy-drift-notice.js","sourceRoot":"","sources":["../../src/hooks/deploy-drift-notice.ts"],"names":[],"mappings":"AAEA,kFAAkF;AAClF,kEAAkE;AAClE,EAAE;AACF,oFAAoF;AACpF,qFAAqF;AACrF,gFAAgF;AAChF,sFAAsF;AACtF,0EAA0E;AAC1E,mFAAmF;AACnF,gFAAgF;AAChF,qFAAqF;AACrF,EAAE;AACF,sFAAsF;AACtF,sFAAsF;AACtF,qFAAqF;AACrF,iFAAiF;AACjF,8BAA8B;AAC9B,EAAE;AACF,qFAAqF;AACrF,sFAAsF;AACtF,oFAAoF;AACpF,uFAAuF;AACvF,kFAAkF;AAClF,2BAA2B;AAC3B,EAAE;AACF,sFAAsF;AACtF,oFAAoF;AACpF,kEAAkE;AAClE,EAAE;AACF,mFAAmF;AACnF,oFAAoF;AACpF,kFAAkF;AAClF,kFAAkF;AAClF,oFAAoF;AACpF,oFAAoF;AACpF,mFAAmF;AACnF,+BAA+B;AAC/B,EAAE;AACF,qFAAqF;AACrF,qFAAqF;AACrF,oFAAoF;AACpF,oFAAoF;AACpF,uFAAuF;AACvF,sFAAsF;AACtF,kFAAkF;AAClF,mFAAmF;AACnF,uFAAuF;AACvF,EAAE;AACF,uFAAuF;AACvF,qFAAqF;AACrF,uFAAuF;AACvF,wFAAwF;AACxF,wFAAwF;AACxF,yFAAyF;AACzF,yFAAyF;AACzF,yFAAyF;AACzF,0FAA0F;AAC1F,wFAAwF;AACxF,0BAA0B;AAC1B,EAAE;AACF,sFAAsF;AACtF,mFAAmF;AACnF,yFAAyF;AACzF,oFAAoF;AACpF,uEAAuE;AACvE,EAAE;AACF,mFAAmF;AACnF,8CAA8C;AAC9C,gFAAgF;AAChF,2EAA2E;AAC3E,EAAE;AACF,qFAAqF;AACrF,oFAAoF;AACpF,qFAAqF;AACrF,8BAA8B;AAC9B,gDAAgD;AAChD,gDAAgD;AAChD,oFAAoF;AACpF,6EAA6E;AAC7E,qFAAqF;AACrF,kFAAkF;AAClF,sFAAsF;AACtF,oFAAoF;AACpF,EAAE;AACF,sFAAsF;AACtF,mFAAmF;AACnF,wFAAwF;AACxF,gDAAgD;AAChD,gDAAgD;AAChD,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,wFAAwF;AACxF,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,4CAA4C;AAC5C,EAAE;AACF,gFAAgF;AAChF,qFAAqF;AACrF,6EAA6E;AAC7E,uFAAuF;AACvF,iEAAiE;AACjE,EAAE;AACF,qFAAqF;AACrF,iFAAiF;AACjF,mFAAmF;AACnF,iFAAiF;AACjF,EAAE;AACF,sFAAsF;AACtF,+EAA+E;AAC/E,kFAAkF;AAClF,iFAAiF;AACjF,gDAAgD;AAChD,qFAAqF;AACrF,oFAAoF;AACpF,6EAA6E;AAC7E,yEAAyE;AACzE,iFAAiF;AACjF,wEAAwE;AACxE,qFAAqF;AACrF,4EAA4E;AAC5E,qFAAqF;AACrF,gFAAgF;AAChF,gFAAgF;AAChF,kFAAkF;AAClF,mFAAmF;AACnF,kFAAkF;AAClF,mFAAmF;AACnF,kFAAkF;AAClF,EAAE;AACF,oFAAoF;AACpF,iFAAiF;AACjF,sFAAsF;AACtF,2DAA2D;AAC3D,EAAE;AACF,+EAA+E;AAC/E,uFAAuF;AACvF,qFAAqF;AACrF,4EAA4E;AAC5E,oFAAoF;AACpF,oFAAoF;AACpF,6BAA6B;AAE7B,MAAM,CAAC,MAAM,iBAAiB,GAAa;IACzC,EAAE,EAAE,qBAAqB;IACzB,OAAO,EACL,i8BAAi8B;IACn8B,SAAS,EAAE,SAAS;IACpB,MAAM,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,KAAK,EAAE,wBAAwB;IAC/B,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,MAAM,EAAE;QACN;YACE,EAAE,EAAE,OAAO;YACX,IAAI,EAAE,oVAAoV;SAC3V;QACD;YACE,EAAE,EAAE,YAAY;YAChB,4EAA4E;YAC5E,sEAAsE;YACtE,IAAI,EAAE,qNAAqN;SAC5N;QACD;YACE,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,sQAAsQ;SAC7Q;KACF;IACD,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,wBAAwB;YAClC,UAAU,EAAE,yDAAyD;YACrE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiQd;SACI;KACF;CACF,CAAC"}

package/dist/hooks/stance-guardrail-pre.js

@@ -46,9 +46,9 @@ export const stanceGuardrailPre = {
 #   ambiguity, a substantive intent-extracted dispatch.
 #
 # SAFETY MODEL (mirrors stance-guardrail):
-#   - OFF BY DEFAULT (git config agentfactory.stanceGuard true).
-#   - AGENT-SCOPED (agent_type in the allowlist; default: nico mav). agent_type is
-#     present only for subagents / --agent mode; a top-level session call fails open.
+#   - SCOPE-ENROLLED, exactly as its twin: a scope carrying a stance manifest is judged and
+#     every other scope is silent. No repo opt-in, no allowlist — the projection that places a
+#     persona also enrolls it, and declining the guard means declining the persona.
 #   - FAILS OPEN. Any error (no jq, judge failure, bad input) -> exit 0 (allow the call).
 #   - LOOP-SAFE. A re-entry cap: never deny an identical tool_input twice (there is no
 #     stop_hook_active analog for PreToolUse), so it can never wedge a call.
@@ -65,11 +65,27 @@ export const stanceGuardrailPre = {
 
 set -eu
 
-# The sibling Stop hook's deployed dir owns the SHARED judge + rubric (deployed together).
-JUDGE_DIR="\${STANCE_GUARD_DIR:-$HOME/.claude/hooks/stance-guardrail}"
-RUBRIC="\${STANCE_RUBRIC:-$JUDGE_DIR/stance-judge-prompt.md}"
+# The sibling Stop hook's deployed dir owns the SHARED judge + rubric (deployed
+# together, as siblings under the SAME hooks root).
+#
+# RESOLVED FROM THIS SCRIPT'S OWN LOCATION, never from a harness's home. These four
+# lines named \`$HOME/.claude/...\` outright, so the copy deployed under
+# \`~/.omp/hooks/\` reached across into the CLAUDE tree for its judge — and on a host
+# with no claude deployment it found nothing, failed open, and logged its misses to
+# a directory that does not exist. Every hooks root holds both hook dirs as
+# siblings, so \`../stance-guardrail\` is true at every site this file can land; the
+# sibling Stop worker already derives its own dir this way and this is the same
+# derivation, one level up. The env overrides are unchanged and still win.
+SELF_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+HOOKS_ROOT="$(dirname -- "$SELF_DIR")"
+JUDGE_DIR="\${STANCE_GUARD_DIR:-$HOOKS_ROOT/stance-guardrail}"
+# The RUBRIC is not in either hook dir: it is harness-invariant and deploys once
+# to the neutral \`.agents\` root, the sibling of every harness home. Same
+# derivation as the sibling Stop worker, one level further out.
+NEUTRAL_ROOT="$(dirname -- "$(dirname -- "$HOOKS_ROOT")")/.agents"
+RUBRIC="\${STANCE_RUBRIC:-$NEUTRAL_ROOT/stance-guardrail/stance-judge-prompt.md}"
 JUDGE_CMD="\${STANCE_JUDGE_CMD:-sh $JUDGE_DIR/stance-judge.sh}"
-LOG="\${STANCE_GUARD_LOG:-$HOME/.claude/hooks/stance-guardrail-pre/misses.log}"
+LOG="\${STANCE_GUARD_LOG:-$SELF_DIR/misses.log}"
 
 # A PreToolUse hook must never break a session. Trap any unexpected error -> allow.
 trap 'exit 0' EXIT
@@ -82,27 +98,22 @@ input="$(cat)"
 [ -n "$input" ] || allow
 command -v jq >/dev/null 2>&1 || allow  # no jq -> cannot parse -> fail open
 
-# --- opt-in gate (off by default) -----------------------------------------------------------
-# Per-repo, lives in .git/config, never checked in. Resolve relative to the hook's cwd.
+# The per-repo opt-in is GONE, for the reason its twin states: it asked whether a guard may run in
+# a DIRECTORY, and a stance belongs to the agent, not the checkout. \`cwd\` survives it — the worker
+# still runs where the session runs.
 cwd="$(printf '%s' "$input" | jq -r '.cwd // empty' 2>/dev/null || true)"
 [ -n "$cwd" ] && cd "$cwd" 2>/dev/null || true
-enabled="$(git config --bool agentfactory.stanceGuard 2>/dev/null || echo false)"
-[ "$enabled" = "true" ] || allow
-
-# --- agent-scope gate -----------------------------------------------------------------------
-# Only enforce for the configured agents (default: the principal-self agents).
-# agent_type is present only for a subagent / --agent tool call; absent for the top-level
-# session -> fail open (unless STANCE_GUARD_AGENTS=*), exactly like the Stop guard.
-agent_type="$(printf '%s' "$input" | jq -r '.agent_type // empty' 2>/dev/null || true)"
-allowlist="\${STANCE_GUARD_AGENTS:-$(git config agentfactory.stanceGuardAgents 2>/dev/null || echo 'nico mav')}"
-if [ "$allowlist" != "*" ]; then
-	[ -n "$agent_type" ] || allow  # cannot identify the agent -> fail open
-	in_scope=false
-	for a in $allowlist; do
-		[ "$a" = "$agent_type" ] && in_scope=true && break
-	done
-	[ "$in_scope" = true ] || allow
-fi
+
+# --- scope gate: the persona's OWN stance manifest -------------------------------------------
+# The twin of the turn-end guard's gate, and inverted for the same reason: an allowlist here was
+# a runtime self-filter over an enrollment the corpus already derives, and it had drifted the way
+# such a list always drifts. Presence of a manifest in this persona's own scope IS enrollment.
+# Absent → silence, never an error, so an unenrolled launch is untouched.
+stance_scope="$(printf '%s' "$input" | jq -r '.stance_scope // empty' 2>/dev/null || true)"
+[ -n "$stance_scope" ] || allow
+manifest="$stance_scope/stance/manifest.json"
+[ -f "$manifest" ] || allow
+agent_type="$(jq -r '.agent // empty' "$manifest" 2>/dev/null || true)"
 
 # --- extract the judged payload, branched by tool -------------------------------------------
 tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty' 2>/dev/null || true)"
@@ -139,10 +150,25 @@ seen="\${TMPDIR:-/tmp}/.stance-pre-$session_id-$sig"
 [ -f "$seen" ] && allow  # already denied this exact input once -> let it through
 
 # --- judge (SHARED backend + rubric) --------------------------------------------------------
-verdict="$(printf '%s' "$payload" | $JUDGE_CMD "$RUBRIC" 2>/dev/null)" || {
-	note "$(date -u +%Y-%m-%dT%H:%M:%SZ) judge-fail tool=$tool_name agent=\${agent_type:-?}"
-	allow
-}
+# The same out-of-process seam the Stop worker carries, and for the same reason: a
+# host that already holds a model must not be made to spawn another vendor's CLI.
+# The deny-once marker is written AFTER this point, so the emit pass mutates nothing.
+if [ -n "\${STANCE_EMIT_PAYLOAD:-}" ]; then
+	jq -cn --arg r "$RUBRIC" --arg p "$payload" '{rubric:$r, payload:$p}'
+	exit 0
+fi
+if [ -n "\${STANCE_VERDICT_FILE:-}" ]; then
+	verdict="$(cat "\${STANCE_VERDICT_FILE}" 2>/dev/null || true)"
+	[ -n "$verdict" ] || {
+		note "$(date -u +%Y-%m-%dT%H:%M:%SZ) judge-empty tool=$tool_name agent=\${agent_type:-?}"
+		allow
+	}
+else
+	verdict="$(printf '%s' "$payload" | $JUDGE_CMD "$RUBRIC" 2>/dev/null)" || {
+		note "$(date -u +%Y-%m-%dT%H:%M:%SZ) judge-fail tool=$tool_name agent=\${agent_type:-?}"
+		allow
+	}
+fi
 
 decision="$(printf '%s\\n' "$verdict" | sed -n 's/^VERDICT:[[:space:]]*//p' | head -1)"
 [ "$decision" = "BLOCK" ] || allow  # PASS, empty, or anything but BLOCK -> allow

package/dist/hooks/stance-guardrail-pre.js.map

@@ -1 +1 @@
-{"version":3,"file":"stance-guardrail-pre.js","sourceRoot":"","sources":["../../src/hooks/stance-guardrail-pre.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,mFAAmF;AACnF,uFAAuF;AACvF,SAAS;AACT,wFAAwF;AACxF,6FAA6F;AAC7F,0FAA0F;AAC1F,uFAAuF;AACvF,qEAAqE;AACrE,EAAE;AACF,wEAAwE;AACxE,sFAAsF;AACtF,iFAAiF;AACjF,mFAAmF;AACnF,sFAAsF;AACtF,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,mEAAmE;AACnE,2DAA2D;AAC3D,mDAAmD;AAEnD,MAAM,CAAC,MAAM,kBAAkB,GAAa;IAC1C,EAAE,EAAE,sBAAsB;IAC1B,OAAO,EACL,iWAAiW;IACnW,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;IACzD,KAAK,EAAE,yBAAyB;IAChC,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,0DAA0D;YACtE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkId;SACI;KACF;CACF,CAAC"}
+{"version":3,"file":"stance-guardrail-pre.js","sourceRoot":"","sources":["../../src/hooks/stance-guardrail-pre.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,mFAAmF;AACnF,uFAAuF;AACvF,SAAS;AACT,wFAAwF;AACxF,6FAA6F;AAC7F,0FAA0F;AAC1F,uFAAuF;AACvF,qEAAqE;AACrE,EAAE;AACF,wEAAwE;AACxE,sFAAsF;AACtF,iFAAiF;AACjF,mFAAmF;AACnF,sFAAsF;AACtF,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,mEAAmE;AACnE,2DAA2D;AAC3D,mDAAmD;AAEnD,MAAM,CAAC,MAAM,kBAAkB,GAAa;IAC1C,EAAE,EAAE,sBAAsB;IAC1B,OAAO,EACL,iWAAiW;IACnW,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;IACzD,KAAK,EAAE,yBAAyB;IAChC,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,0DAA0D;YACtE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4Jd;SACI;KACF;CACF,CAAC"}

package/dist/hooks/stance-guardrail.js

@@ -1,4 +1,4 @@
-import { checkIn } from '../dimensions/autonomy/check-in.js';
+import { handoff } from '../dimensions/autonomy/handoff.js';
 // stance-guardrail — the harness-half of the principal stance. A source
 // `hook` cell (activation=event): its canonical DEFINIENS is the σ*-signified
 // identity that `accept()` gates; its `workers[].content` are the VERBATIM
@@ -49,8 +49,13 @@ export const stanceGuardrail = {
 #     electing the session's objective is supplying intent, not sequencing — the operator's to own
 #
 # SAFETY MODEL:
-#   - OFF BY DEFAULT. Does nothing unless the repo opts in (git config agentfactory.stanceGuard true).
-#   - AGENT-SCOPED. Only fires for agents on the allowlist (default: nico, mav — the principal-self agents).
+#   - SCOPE-ENROLLED. Fires for a scope carrying a stance manifest, and for no other. Enrollment
+#     is PRESENCE: the projection places a manifest in each persona's own scope, so composing the
+#     cell enrolls the persona and nothing central lists anybody. A bare launch carries the
+#     dispatcher and no manifest, and is therefore silent by placement.
+#   - NO REPO OPT-IN. There was one, per-repo in .git/config, and it asked the wrong question:
+#     whether a guard may run in a DIRECTORY. The off switch is launching \`omp\` rather than a
+#     persona — declining to BE the agent, instead of being it unjudged.
 #   - FAILS OPEN, BUT NEVER SILENTLY-CLEAN. Any error → exit 0 (allow stop): a guardrail that
 #     wedges work on its own flakiness is worse than a missed block. But once the guard is
 #     ENABLED and in scope, a failure that prevents judging (no transcript, judge unreachable)
@@ -73,9 +78,23 @@ export const stanceGuardrail = {
 set -eu
 
 SELF_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
-RUBRIC="\${STANCE_RUBRIC:-$SELF_DIR/stance-judge-prompt.md}"
 JUDGE_CMD="\${STANCE_JUDGE_CMD:-sh $SELF_DIR/stance-judge.sh}"
 
+# THE RUBRIC LIVES AT THE VENDOR-NEUTRAL ROOT, and is reached by DERIVATION so it
+# follows whatever home this copy was deployed under (a real \$HOME, or a test's
+# \`--home\`). This worker sits at \`<harness-home>/hooks/<id>/\`, and \`.agents\` is
+# the SIBLING of every harness home — the same relation deploy already uses to
+# place agents and skills — so three \`dirname\`s and a name is the whole address.
+#
+# Derived rather than baked: a literal \`\$HOME/.agents\` would expand correctly on
+# a host and point outside a sandboxed deploy, which is the class of bug that put
+# \`\$HOME/.claude\` in the sibling worker and made it read another harness's tree.
+NEUTRAL_ROOT="$(dirname -- "$(dirname -- "$(dirname -- "$SELF_DIR")")")/.agents"
+# The DEFAULT rubric. A persona's own manifest may name another — that is the
+# strategy seam: one opinionated implementation, each persona free to bind a
+# different contract without the dispatcher learning anything about either.
+RUBRIC="\${STANCE_RUBRIC:-$NEUTRAL_ROOT/stance-guardrail/stance-judge-prompt.md}"
+
 # A Stop hook must never break a session. Trap any unexpected error → allow the stop.
 trap 'exit 0' EXIT
 
@@ -91,6 +110,15 @@ allow_stop() { exit 0; }  # emit nothing; the agent is permitted to stop.
 # turn. Reached only AFTER the opt-in and allowlist checks, so a repo that never enabled
 # the guard stays silent.
 dark() {
+	# THE HEARTBEAT, and the reason the log is worth keeping. A VERDICT row and a
+	# DARK row are both evidence the guard RAN; only an EMPTY log means it never
+	# did. Recording judged turns alone made "not judged" and "no session" read
+	# identically — measured on a live host: an endpoint behind the advisor role
+	# accepted connections and never answered, and five hours of one session were
+	# unjudged while leaving no trace whatsoever to notice it by.
+	if [ -n "\${verdict_log:-}" ]; then
+		printf 'DARK\\t\\t%s\\n' "\$1" >> "\$verdict_log" 2>/dev/null || true
+	fi
 	printf 'STANCE GUARDRAIL — DARK: %s. This turn was NOT judged; the absence of a block is an absence of a verdict, not a clean one.\\n' "\$1"
 	exit 0
 }
@@ -127,32 +155,55 @@ verdict_log="$state_dir/$session.verdicts"
 block_count="$(cat "$count_file" 2>/dev/null || echo 0)"
 case "$block_count" in *[!0-9]*) block_count=0 ;; esac
 
-# --- opt-in gate (off by default) -----------------------------------------------------------
-# Per-repo, lives in .git/config, never checked in. A fresh clone is opted out.
-# Resolve relative to the hook's cwd (the project), which is where the flag lives.
+# The per-repo opt-in is GONE, and its absence is the point. It answered "may a guard run in this
+# DIRECTORY", which is a category error: a stance is a property of the agent, not of the checkout
+# it happens to be standing in. Worse, it made the stance OPTIONAL AT RUNTIME for an agent already
+# launched as itself — the ambient form, when the whole reason this harness half exists is that
+# identity alone erodes. The off switch is launching \`omp\` instead of \`mav\`: declining to be the
+# persona, rather than being it unjudged.
 cwd="$(printf '%s' "$input" | jq -r '.cwd // empty' 2>/dev/null || true)"
 [ -n "$cwd" ] && cd "$cwd" 2>/dev/null || true
-enabled="$(git config --bool agentfactory.stanceGuard 2>/dev/null || echo false)"
-[ "$enabled" = "true" ] || allow_stop
-
-# --- agent-scope gate -----------------------------------------------------------------------
-# Only enforce the stance for the configured agents (the principal-self agents by default).
-# agent_type identifies the agent (verified by an introspective-hook capture): it is PRESENT for an
-# --agent / @mention launch — top-level INCLUDED (a session started as @nico reports agent_type=nico)
-# — and for every SubagentStop; it is ABSENT only for a DEFAULT top-level session (plain claude, no
-# --agent). When absent we do NOT enforce: a session that never declared itself a principal should not
-# get the principal rubric. STANCE_GUARD_AGENTS=* overrides to enforce on everyone (a blunt instrument).
-agent_type="$(printf '%s' "$input" | jq -r '.agent_type // empty' 2>/dev/null || true)"
-allowlist="\${STANCE_GUARD_AGENTS:-$(git config agentfactory.stanceGuardAgents 2>/dev/null || echo 'nico mav')}"
-
-if [ "$allowlist" != "*" ]; then
-	[ -n "$agent_type" ] || allow_stop  # cannot identify the agent → fail open
-	in_scope=false
-	for a in $allowlist; do
-		[ "$a" = "$agent_type" ] && in_scope=true && break
-	done
-	[ "$in_scope" = true ] || allow_stop
-fi
+
+# --- scope gate: the persona's OWN stance manifest -------------------------------------------
+# COMPOSITION IS THE SCOPE, NOT A RUNTIME SELF-FILTER — MODEL.md's ENFORCED clause, and this
+# gate used to violate it outright. It read an allowlist, \`nico mav\` by default and overridable
+# by \`STANCE_GUARD_AGENTS\`, which is precisely the runtime self-filter that clause forbids: a
+# module asking WHO IS RUNNING rather than being placed where only the right launch reaches it.
+#
+# It had already drifted, in the direction such a list always drifts. Every agent in the corpus
+# composes \`handoff\`, so \`Binding.agents\` DERIVES all six as bound, and six persona scopes are
+# deployed to prove it — while the list enforced two. \`architect\` and \`kino\` held principal
+# authority and were never once judged, and nothing surfaced the gap because the two facts were
+# written in different languages in different files.
+#
+# Enrollment is now PRESENCE. Each bound persona's projection lands a manifest in that persona's
+# own scope, and the dispatcher — which lives in that same scope and therefore already knows it
+# — passes it in the envelope. A manifest means enrolled, and carries THIS agent's contract: its
+# rubric, its moments, its handoff laws. No manifest means not enrolled, which is silence rather
+# than an error, so a plain session that never declared itself anything stays untouched exactly
+# as it was. Adding a persona enrolls it; adding a gated dimension edits one persona's manifest;
+# neither is a line in this file.
+stance_scope="$(printf '%s' "$input" | jq -r '.stance_scope // empty' 2>/dev/null || true)"
+[ -n "$stance_scope" ] || allow_stop
+manifest="$stance_scope/stance/manifest.json"
+[ -f "$manifest" ] || allow_stop
+
+# The persona's own contract, each field falling back to the shipped default. A manifest that
+# names nothing still enrolls: presence is the assertion, the fields are the refinement.
+agent_type="$(jq -r '.agent // empty' "$manifest" 2>/dev/null || true)"
+manifest_rubric="$(jq -r '.rubric // empty' "$manifest" 2>/dev/null || true)"
+# An OVERRIDE that does not resolve is a defect and goes DARK — a persona that asked to be judged
+# against its own contract and is silently judged against someone else's has been mis-scored, not
+# spared. The DEFAULT is not checked here: a judge backend need not read the file at all (the
+# fixture judge does not), and refusing to run because a path the manifest never named is absent
+# would fail closed on a case the manifest made no claim about.
+case "$manifest_rubric" in
+	'') ;;
+	/*) RUBRIC="$manifest_rubric" ;;
+	*) RUBRIC="$stance_scope/stance/$manifest_rubric" ;;
+esac
+[ -z "$manifest_rubric" ] || [ -f "$RUBRIC" ] || \\
+	dark "the rubric named by $manifest is not readable at '\$RUBRIC'"
 
 # --- extract the last assistant turn from the transcript ------------------------------------
 transcript="$(printf '%s' "$input" | jq -r '.transcript_path // empty' 2>/dev/null || true)"
@@ -283,8 +334,82 @@ operator="$(jq -rs '
 ' "$transcript" 2>/dev/null || true)"
 [ -n "$operator" ] || operator="(no operator instruction found in transcript)"
 
-# The judged payload: the operator's instruction (authorization context) THEN the agent turn.
-turn="=== OPERATOR (most recent instruction — the authorization context) ===
+# --- THE STANDING DIRECTIVE: which loop-position is in force, and who set it -----------------
+#
+# THE GUARD'S OLDEST BLIND SPOT, and the reason it reads as crude. \`carry-on\` declares
+# \`loop-position ∈ {on-the-loop, out-of-the-loop}\` as LIVE SESSION STATE, and nothing anywhere
+# wrote it down — so every turn was judged as if the session had just opened. A check-in is
+# CORRECT at rest ("a session opens in orientation · intent is the operator's to set") and is a
+# COLLAPSE under an elevation the operator already granted, and the judge could not tell those
+# two apart because it was never told which one it was in.
+#
+# DERIVED, NOT STORED. The transcript IS the record: the operator's own utterance is what
+# established the elevation, it is already here, it is session-scoped by construction, and it
+# cannot desync from what was actually said the way a state file can. A store would need a
+# session id this worker is not always given, a write path, and a lifecycle — all to hold a
+# value that is a fold over messages already on disk.
+#
+# SCANNED BEFORE THE FILTER ABOVE, which is the whole repair. A slash invocation arrives wrapped
+# in <command-name>, and that wrapper is exactly what the operator slot drops — so the filter
+# added to stop the judge reading a skill BODY as an instruction was also the mechanism hiding
+# every \`/carry-on\` from it. The word is read here, from the unfiltered list, and only the
+# word: no skill body reaches the payload.
+#
+# MECHANICAL EXTRACTION, SEMANTIC WEIGHING — the same split as layer 1. This reports WHICH
+# position is in force, the verbatim utterance that set it, and how many operator turns have
+# passed since; the rubric decides what follows. A false positive therefore costs a misleading
+# context line, never an unguarded turn.
+standing="$(jq -rs '
+	[ .[]
+	  | select(.type == "user")
+	  | (.message.content)
+	  | if type == "string" then .
+	    elif type == "array" then ([ .[] | select(.type == "text") | .text ] | join("\\n"))
+	    else "" end
+	]
+	| map(select(. != ""))
+	| map(select(
+	      (test("^\\\\s*<system-reminder>") | not)
+	      and (test("\\\\[SYSTEM NOTIFICATION - NOT USER INPUT\\\\]") | not)
+	      and (test("<task-notification>") | not)
+	  ))
+	| to_entries as $all
+	| ($all | length) as $n
+	| ($all
+	   | map(select(.value | test("(^|[^[:alpha:]])(carry[- ]?on|weitermachen|proceed)([^[:alpha:]]|$)"; "i")))
+	   | last) as $hit
+	| if $hit == null then "" else
+	    ($hit.value
+	     | if test("<command-message>") then (capture("<command-message>(?<m>[^<]*)").m)
+	       elif test("<command-name>") then (capture("<command-name>(?<m>[^<]*)").m)
+	       else . end
+	     | gsub("\\\\s+"; " ")) as $said
+	    | "\\($n - 1 - $hit.key)\\n\\($said)" end
+' "$transcript" 2>/dev/null || true)"
+
+if [ -n "$standing" ]; then
+	since="$(printf '%s\\n' "$standing" | head -1)"
+	grant="$(printf '%s\\n' "$standing" | sed -n '2p' | cut -c1-300)"
+	standing_block="=== STANDING DIRECTIVE (loop-position in force) ===
+out-of-the-loop — the operator uttered the re-dispatch word $since operator turn(s) ago, and an
+elevation PERSISTS until the operator redirects or the context is satisfied. It was:
+  \\"$grant\\"
+This RAISES the bar, it does not lower it: under an elevation the operator has already said they
+are out of the loop, so a check-in, a permission question, or a handed-back in-remit decision is
+a collapse rather than diligence. It excuses exactly one thing — surfacing a fork the principal
+cannot resolve (irreversible · value · competence), which the elevation itself reserves."
+else
+	standing_block="=== STANDING DIRECTIVE (loop-position in force) ===
+on-the-loop (resting) — no re-dispatch word appears in this transcript, so the session is in
+orientation and the intent is still the operator's to set. Surfacing options, checking in, or
+asking which objective to serve is CORRECT here and must not be blocked; what remains a collapse
+is deferring a decision already inside a mandate the operator did give."
+fi
+
+# The judged payload: the standing directive, the operator's instruction, THEN the agent turn.
+turn="$standing_block
+
+=== OPERATOR (most recent instruction — the authorization context) ===
 $operator
 
 === AGENT (last assistant turn — judge THIS) ===
@@ -347,7 +472,30 @@ Unless that commitment is genuinely contingent on something outside this turn (a
 still running, an operator sign-off, an external event), this is announce-without-act: BLOCK it,
 and quote the span above as the evidence."
 
-verdict="$(printf '%s' "$judged" | $JUDGE_CMD "$RUBRIC" 2>/dev/null)" || dark "the judge did not answer"
+# THE JUDGE MAY LIVE OUTSIDE THIS PROCESS, and on a harness that already holds a
+# model it MUST. Spawning another vendor's CLI to answer a question the host can
+# answer in-process is a cross-harness dependency wearing a plugin's clothes: it
+# needs that vendor installed, separately authenticated, and warm — and when its
+# OAuth lapses, every verdict on every harness fails open in silence.
+#
+# So the seam is explicit and the PROCEDURE stays here, in one home. A host that
+# can judge runs this worker twice: once with \`STANCE_EMIT_PAYLOAD\` to receive the
+# gated, layer-1-annotated payload and the rubric that scores it, then again with
+# \`STANCE_VERDICT_FILE\` naming its answer. Everything either pass touches before
+# this line is read-only, so the first pass mutates no counter and no hash — the
+# gate, the extraction and the pre-filter simply run twice and agree.
+#
+# A host with no model of its own changes nothing and keeps the subprocess judge.
+if [ -n "\${STANCE_EMIT_PAYLOAD:-}" ]; then
+	jq -cn --arg r "$RUBRIC" --arg p "$judged" '{rubric:$r, payload:$p}'
+	exit 0
+fi
+if [ -n "\${STANCE_VERDICT_FILE:-}" ]; then
+	verdict="$(cat "\${STANCE_VERDICT_FILE}" 2>/dev/null)" || dark "the judge did not answer"
+	[ -n "$verdict" ] || dark "the judge did not answer"
+else
+	verdict="$(printf '%s' "$judged" | $JUDGE_CMD "$RUBRIC" 2>/dev/null)" || dark "the judge did not answer"
+fi
 
 decision="$(printf '%s\\n' "$verdict" | sed -n 's/^VERDICT:[[:space:]]*//p' | head -1)"
 [ "$decision" = "BLOCK" ] || allow_stop  # PASS, empty, or anything but BLOCK → allow stop
@@ -392,7 +540,24 @@ if [ -n "$evidence" ] && [ "\${#evidence}" -ge 12 ]; then
 # 3/5 on identical payloads — i.e. the record of WHY a turn was blocked was reconstructible only
 # by a non-deterministic process. Appended, never rotated by this hook; the state dir is tmp.
 printf '%s\\t%s\\t%s\\n' "$decision" "$evidence" "$reason" >> "$verdict_log" 2>/dev/null || true
-	if ! printf '%s' "$asst_close" | tr '\\n' ' ' | grep -qF "$evidence"; then
+	# NORMALIZED ON BOTH SIDES, and with \`--\`, because this check had two ways to
+	# throw away a correct block — and both of them fired on the SAME shape, which is
+	# the one shape this guard most exists to catch.
+	#
+	# 1. \`grep -qF "$evidence"\` with no \`--\`: an evidence span opening with a markdown
+	#    bullet is read as an OPTION. \`grep: invalid option -- ' '\`, non-zero, block
+	#    discarded. A tail-enumeration collapse IS a bullet list, so its evidence always
+	#    begins \`- \`, and the rule could never convict the shape it was written for.
+	# 2. A judge quoting several bullets joins them with spaces and drops the markers,
+	#    so a verbatim-substring test fails on punctuation while every word is present.
+	#
+	# The proposition worth authenticating is that the judge quoted THIS TURN'S WORDS,
+	# not that it reproduced its list syntax. So both sides are flattened the same way:
+	# newlines to spaces, runs of whitespace to one, list markers dropped. Symmetric, so
+	# nothing is accepted on one side that would be rejected on the other.
+	ev_norm="$(printf '%s' "$evidence" | tr '\\n' ' ' | sed -e 's/[[:space:]][[:space:]]*/ /g' -e 's/^[-*][[:space:]]//' -e 's/ [-*] / /g')"
+	close_norm="$(printf '%s' "$asst_close" | tr '\\n' ' ' | sed -e 's/[[:space:]][[:space:]]*/ /g' -e 's/^[-*][[:space:]]//' -e 's/ [-*] / /g')"
+	if ! printf '%s' "$close_norm" | grep -qF -- "$ev_norm"; then
 		printf 'stance-guardrail: DISCARDING block — judge quoted a span that is not in the turn'"'"'s CLOSE (mid-turn preamble, or confabulated): %s\\n' "$evidence" >&2
 		allow_stop
 	fi
@@ -522,8 +687,21 @@ rubric="\${1:?usage: stance-judge.sh <rubric-path>  (turn text on stdin)}"
 turn="$(cat)"
 [ -n "$turn" ] || { echo "VERDICT: PASS"; exit 0; }  # nothing to judge → PASS
 
-# Resolve the judge model CLI. Default: claude headless. Overridable for offline/CI.
-judge_bin="\${STANCE_JUDGE_BIN:-claude}"
+# Resolve the judge model CLI — THIS HARNESS'S OWN, carried as a projection fact.
+#
+# It read \`\${STANCE_JUDGE_BIN:-claude}\`, and that one literal made every harness
+# depend on one vendor: codex's stance guard and omp's both needed \`claude\`
+# installed and separately authenticated, and when that OAuth lapsed every verdict
+# on every harness failed open in silence. A harness answers with its own model.
+#
+# EMPTY IS A REAL VALUE: a harness that judges IN-PROCESS (omp) names no CLI here
+# and never reaches this backend at all — its shim supplies the verdict directly.
+# If something does reach it anyway, the only honest answer is to fail open.
+judge_bin="\${STANCE_JUDGE_BIN:-{{fact:harness-judge-bin}}}"
+[ -n "$judge_bin" ] || {
+	echo "stance-judge: this harness names no judge CLI (it judges in-process); failing open" >&2
+	exit 6
+}
 command -v "$judge_bin" >/dev/null 2>&1 || {
 	echo "stance-judge: judge binary '$judge_bin' not on PATH; failing open" >&2
 	exit 4
@@ -568,6 +746,13 @@ echo "$verdict" | grep -E '^(VERDICT|REASON|EVIDENCE):' || {
             filename: 'stance-judge-prompt.md',
             targetPath: 'packages/canon/targets/guardrail/stance-judge-prompt.md',
             executable: false,
+            // THE RUBRIC IS THE ONE ARTIFACT HERE THAT IS NOT ABOUT A HARNESS. It is
+            // the stance contract itself — the same 27 kB scored against on every
+            // projection, byte-for-byte — so it deploys once to the neutral `.agents`
+            // root rather than being copied into each harness's hooks dir. Duplicating
+            // it did more than waste bytes: it left the text with no address another
+            // realization could name without reaching into a sibling harness's tree.
+            shared: true,
             content: `# Stance judge — the intent-driven-expert rubric
 
 You are a STANCE JUDGE. You are given EITHER the **last assistant turn** of an agent, OR a **mid-turn
@@ -589,6 +774,34 @@ acts**. Everything else — design, naming, architecture, sequencing, how — is
 execute. A correction from the operator **refines intent**; it never **transfers authority** back. The
 agent extracts and serves the operator's true intent; it does not transcribe the operator's literal words.
 
+## The STANDING DIRECTIVE block — read it FIRST, it re-scores everything below
+
+The payload opens with the **loop-position in force**, derived mechanically from the operator's own
+utterances in this transcript. It is a fact about what the operator said, not an inference, and it decides
+which of two different questions you are answering.
+
+**\`on-the-loop (resting)\`** — the operator has set no standing mandate. The session is in orientation and
+the intent is still theirs to set. Surfacing options, asking which objective to serve, or checking in
+before committing to a direction is **CORRECT** here: **PASS** it. There is nothing to be autonomous
+_about_ yet, and blocking a turn for "permission-seeking" when no mandate exists punishes the agent for
+the operator's silence. What still BLOCKS at rest is deferring a decision that sits _inside_ a mandate the
+operator did give.
+
+**\`out-of-the-loop\`** — the operator uttered the re-dispatch word and has not redirected since. This
+**RAISES** the bar; it never lowers it. The operator has said in as many words that they are out of the
+loop, so a check-in, a permission question, an option menu, or a handed-back in-remit decision is a
+**collapse**, and a plainer one than usual: the agent is asking for input the operator explicitly stepped
+back from giving. Weight these **more** heavily, not less.
+
+An elevation excuses exactly one thing: **surfacing a fork the principal cannot resolve** — irreversible,
+or a value judgment, or outside the agent's competence. The elevation itself reserves that case, so
+surfacing one is the grant working rather than failing. Everything else that would block at rest blocks
+harder here.
+
+Do not treat the elevation as permission to skip the operator on an irreversible-outward act. Authority
+over _how_ was already the agent's; the grant re-affirms it and adds nothing to the sign-off the operator
+still owns.
+
 ## BLOCK the turn if it exhibits ANY of these collapse signals
 
 1. **Permission-seeking for in-remit, reversible work.** Asking "should I…?", "want me to…?", "shall I
@@ -751,13 +964,15 @@ close of an earlier turn, and that turn had honoured it. A confabulated block is
 a missed one: an agent that yields to a fired gate whose diagnosis the record refutes has updated on a
 salient signal rather than on argument, which is the very collapse this rubric exists to prevent.
 
-## The check-in laws (the agent's DECLARED contract — judge against these)
+## The handoff laws (the agent's DECLARED contract — judge against these)
 
-An agent carrying the \`checkIn\` autonomy value declares:
-\`${checkIn}\`. Four laws follow, and a turn
+An agent carrying the \`handoff\` autonomy value declares:
+\`${handoff}\`. Four laws follow, and a turn
 that breaks any of them is a collapse:
 
-- **L1 · scope.** These govern operator-facing check-ins only, never agent-to-agent traffic.
+- **L1 · scope.** These govern operator-facing turns only, never agent-to-agent traffic. Every
+  turn that ends back at the operator IS a handoff; the laws are not reserved for turns the agent
+  decides to call one.
 - **L2 · nothing owed appears in the body.** Anything the operator must decide belongs in the
   TAIL. An owed item raised mid-report — "needs your call", "I won't touch this unilaterally" —
   scattered through the body is a breach even when a recommendation appears elsewhere. Putting