@cratylus/canon 0.12.1 → 0.12.3

package/dist/guard-shell.d.ts

@@ -0,0 +1,43 @@
+/** The one cap on what a guard's judge is sent, in bytes: the size of what crosses to the judge.
+ *  A judgement has to fit the time its harness allows a guard (omp kills an extension handler
+ *  at 30 s, a Claude Code cell runs 60 s) and the text a turn or a dispatch carries has no bound. */
+export declare const judgePayloadCapBytes = 12000;
+/** Bounds the judged text to `JUDGE_PAYLOAD_CAP` bytes. `jq` does the cutting because every
+ *  worker already depends on it and it counts bytes (`utf8bytelength`), so a cut never lands
+ *  inside a character. Text over its share is cut and MARKED where it was cut, so the judge
+ *  cannot take the seam for the agent's own words. Written with `String.raw` so its
+ *  backslashes reach the worker verbatim. */
+export declare const judgeClipShell: string;
+/** What a worker that keeps the END of a long text adds to the clip (the turn-end worker alone):
+ *  the last N bytes of stdin, and the marker for text cut off its front. */
+export declare const judgeTailShell: string;
+/**
+ * A refusal never strands the agent: every refusal names a way on, and an agent that holds
+ * one wrong contests it by stating why, the act then proceeding with the contest logged for
+ * the operator.
+ *
+ * Interpolate AFTER the worker has defined `say` and `jq` is known to be present, and set
+ * these first:
+ *   GUARD_ID       the cell id (`purview-guardrail`)
+ *   GUARD_NAME     what the operator reads as the guard (`PURVIEW GUARDRAIL`)
+ *   GUARD_SESSION  the payload's session id, as received
+ *   GUARD_AGENT    the agent the guard judges
+ *   GUARD_ACT      the tool name, or `stop` at the turn end
+ *   GUARD_CALL     the call's compact `tool_input` (unset at the turn end)
+ *   NEUTRAL_ROOT   the `.agents` root, home of the default contest log
+ *
+ * It then offers `contest_heard` (call before judging) and `contest_refused REASON` (call on
+ * a refusal: records REASON and prints the way forward, to be placed after the judge's reason
+ * in what is returned). A refusal of a key stands from the fire that refused it until the next
+ * fire of that key. A contest answers a refusal that stands: a fire is contested, reported and
+ * let through unjudged (exit 0), only when `<key>.refused` exists, whatever it holds, and
+ * `<key>.contest` holds text. Every other fire that reaches `contest_heard` leaves neither file
+ * behind and is judged as usual, a contest written before the refusal it would answer being
+ * discarded unheard, and a block recording its refusal anew. Contest files live in
+ * `$CONTEST_DIR`, named `<key>.refused` and `<key>.contest`, `<key>` being the cksum of the
+ * call's tool name and tool input, or `stop`. The functions use the shell names `contest`,
+ * `refusal`, `log`, `kept` and `again`; a worker leaves them alone.
+ *
+ * Regular template: `\${` and `\\n` are the shell's `${` and `\n`.
+ */
+export declare const contestShell = "case \"$GUARD_SESSION\" in '' | */* | . | ..) GUARD_SESSION=nosession ;; esac\nCONTEST_DIR=\"${TMPDIR:-/tmp}/guardrail-contest/$GUARD_ID/$GUARD_SESSION\"\nCONTEST_AT=\"$CONTEST_DIR/stop\"\n[ \"$GUARD_ACT\" = stop ] || CONTEST_AT=\"$CONTEST_DIR/$(printf '%s %s' \"$GUARD_ACT\" \"${GUARD_CALL:-}\" | cksum | cut -d' ' -f1)\"\ncontest_heard() {\n\trefusal=\"$(cat \"$CONTEST_AT.refused\" 2>/dev/null)\" && contest=\"$(cat \"$CONTEST_AT.contest\" 2>/dev/null)\" || contest=\n\trm -f \"$CONTEST_AT.contest\" \"$CONTEST_AT.refused\"\n\t[ -n \"$contest\" ] || return 0\n\tlog=\"${GUARD_CONTEST_LOG:-$NEUTRAL_ROOT/guardrail/contests.log}\"\n\tmkdir -p \"$(dirname -- \"$log\")\" 2>/dev/null && jq -cn --arg time \"$(date -u +%FT%TZ)\" --arg guard \"$GUARD_ID\" \\\n\t\t--arg session \"$GUARD_SESSION\" --arg agent \"$GUARD_AGENT\" --arg act \"$GUARD_ACT\" --arg refusal \"$refusal\" \\\n\t\t--arg contest \"$contest\" '$ARGS.named' 2>/dev/null >> \"$log\" && kept=\"logged in $log\" || kept=\"the contest was not recorded: $log is not writable\"\n\tsay \"$GUARD_NAME \u2014 contested: this $GUARD_ACT went through unjudged on the agent's reason: $(printf '%s' \"$contest\" | tr '\\n' ' ') ($kept)\"\n\texit 0\n}\ncontest_refused() {\n\tmkdir -p \"$CONTEST_DIR\" 2>/dev/null && printf '%s\\n' \"$1\" > \"$CONTEST_AT.refused\" 2>/dev/null || true\n\t[ \"$GUARD_ACT\" = stop ] && again=\"end the turn again\" || again=\"repeat the same call\"\n\tprintf '%s' \"Act on that reason, or if you hold it wrong state why with this command, then $again; it then goes through unjudged, your reason logged for the operator: printf '%s\\\\n' 'why' > '$CONTEST_AT.contest'\"\n}\n";

package/dist/guard-shell.js

@@ -0,0 +1,85 @@
+// The shell every guard worker shares. It lives outside `hooks/` because every file there is
+// loaded as a hook cell (tooling/project-targets.ts), and a fragment is not a cell.
+/** The one cap on what a guard's judge is sent, in bytes: the size of what crosses to the judge.
+ *  A judgement has to fit the time its harness allows a guard (omp kills an extension handler
+ *  at 30 s, a Claude Code cell runs 60 s) and the text a turn or a dispatch carries has no bound. */
+export const judgePayloadCapBytes = 12_000;
+/** Bounds the judged text to `JUDGE_PAYLOAD_CAP` bytes. `jq` does the cutting because every
+ *  worker already depends on it and it counts bytes (`utf8bytelength`), so a cut never lands
+ *  inside a character. Text over its share is cut and MARKED where it was cut, so the judge
+ *  cannot take the seam for the agent's own words. Written with `String.raw` so its
+ *  backslashes reach the worker verbatim. */
+export const judgeClipShell = String.raw `JUDGE_PAYLOAD_CAP=${judgePayloadCapBytes}
+judge_bytes() { printf '%s' "$1" | wc -c | tr -d ' '; }
+JUDGE_JQ='
+def pre($n): . as $s | if $n <= 0 then "" else {lo: 0, hi: ($s | length)} | until(.lo >= .hi;
+((.lo + .hi + 1) / 2 | floor) as $m | if ($s[:$m] | utf8bytelength) <= $n then .lo = $m else .hi = $m - 1 end) | $s[:.lo] end;
+def suf($n): . as $s | if $n <= 0 then "" else {lo: 0, hi: ($s | length)} | until(.lo >= .hi;
+((.lo + .hi + 1) / 2 | floor) as $m | if ($s[-$m:] | utf8bytelength) <= $n then .lo = $m else .hi = $m - 1 end)
+| if .lo == 0 then "" else $s[-.lo:] end end;
+'
+# --rawfile, never -R: jq 1.7's raw reader corrupts a multibyte character straddling a read boundary.
+judge_ends() {
+jq -n -j --rawfile text /dev/stdin --argjson n "$1" "$JUDGE_JQ"'
+$text | . as $s | ($s | utf8bytelength) as $t | if $t <= $n then $s else
+((($n - 200) / 2) | floor) as $k | ($s | pre($k)) as $h | ($s | suf($k)) as $e
+| ($t - ($h | utf8bytelength) - ($e | utf8bytelength)) as $gone
+| $h + "\n[ELIDED: \($gone) of \($t) bytes from the middle are not shown]\n" + $e end'
+}
+`;
+/** What a worker that keeps the END of a long text adds to the clip (the turn-end worker alone):
+ *  the last N bytes of stdin, and the marker for text cut off its front. */
+export const judgeTailShell = String.raw `judge_keep() { jq -n -j --rawfile text /dev/stdin --argjson n "$1" "$JUDGE_JQ"' $text | suf($n)'; }
+judge_cut() { printf '[ELIDED: the first %s of %s bytes of %s are not shown; what follows is its final part]' "$(($2 - $3))" "$2" "$1"; }
+`;
+/**
+ * A refusal never strands the agent: every refusal names a way on, and an agent that holds
+ * one wrong contests it by stating why, the act then proceeding with the contest logged for
+ * the operator.
+ *
+ * Interpolate AFTER the worker has defined `say` and `jq` is known to be present, and set
+ * these first:
+ *   GUARD_ID       the cell id (`purview-guardrail`)
+ *   GUARD_NAME     what the operator reads as the guard (`PURVIEW GUARDRAIL`)
+ *   GUARD_SESSION  the payload's session id, as received
+ *   GUARD_AGENT    the agent the guard judges
+ *   GUARD_ACT      the tool name, or `stop` at the turn end
+ *   GUARD_CALL     the call's compact `tool_input` (unset at the turn end)
+ *   NEUTRAL_ROOT   the `.agents` root, home of the default contest log
+ *
+ * It then offers `contest_heard` (call before judging) and `contest_refused REASON` (call on
+ * a refusal: records REASON and prints the way forward, to be placed after the judge's reason
+ * in what is returned). A refusal of a key stands from the fire that refused it until the next
+ * fire of that key. A contest answers a refusal that stands: a fire is contested, reported and
+ * let through unjudged (exit 0), only when `<key>.refused` exists, whatever it holds, and
+ * `<key>.contest` holds text. Every other fire that reaches `contest_heard` leaves neither file
+ * behind and is judged as usual, a contest written before the refusal it would answer being
+ * discarded unheard, and a block recording its refusal anew. Contest files live in
+ * `$CONTEST_DIR`, named `<key>.refused` and `<key>.contest`, `<key>` being the cksum of the
+ * call's tool name and tool input, or `stop`. The functions use the shell names `contest`,
+ * `refusal`, `log`, `kept` and `again`; a worker leaves them alone.
+ *
+ * Regular template: `\${` and `\\n` are the shell's `${` and `\n`.
+ */
+export const contestShell = `case "$GUARD_SESSION" in '' | */* | . | ..) GUARD_SESSION=nosession ;; esac
+CONTEST_DIR="\${TMPDIR:-/tmp}/guardrail-contest/$GUARD_ID/$GUARD_SESSION"
+CONTEST_AT="$CONTEST_DIR/stop"
+[ "$GUARD_ACT" = stop ] || CONTEST_AT="$CONTEST_DIR/$(printf '%s %s' "$GUARD_ACT" "\${GUARD_CALL:-}" | cksum | cut -d' ' -f1)"
+contest_heard() {
+	refusal="$(cat "$CONTEST_AT.refused" 2>/dev/null)" && contest="$(cat "$CONTEST_AT.contest" 2>/dev/null)" || contest=
+	rm -f "$CONTEST_AT.contest" "$CONTEST_AT.refused"
+	[ -n "$contest" ] || return 0
+	log="\${GUARD_CONTEST_LOG:-$NEUTRAL_ROOT/guardrail/contests.log}"
+	mkdir -p "$(dirname -- "$log")" 2>/dev/null && jq -cn --arg time "$(date -u +%FT%TZ)" --arg guard "$GUARD_ID" \\
+		--arg session "$GUARD_SESSION" --arg agent "$GUARD_AGENT" --arg act "$GUARD_ACT" --arg refusal "$refusal" \\
+		--arg contest "$contest" '$ARGS.named' 2>/dev/null >> "$log" && kept="logged in $log" || kept="the contest was not recorded: $log is not writable"
+	say "$GUARD_NAME — contested: this $GUARD_ACT went through unjudged on the agent's reason: $(printf '%s' "$contest" | tr '\\n' ' ') ($kept)"
+	exit 0
+}
+contest_refused() {
+	mkdir -p "$CONTEST_DIR" 2>/dev/null && printf '%s\\n' "$1" > "$CONTEST_AT.refused" 2>/dev/null || true
+	[ "$GUARD_ACT" = stop ] && again="end the turn again" || again="repeat the same call"
+	printf '%s' "Act on that reason, or if you hold it wrong state why with this command, then $again; it then goes through unjudged, your reason logged for the operator: printf '%s\\\\n' 'why' > '$CONTEST_AT.contest'"
+}
+`;
+//# sourceMappingURL=guard-shell.js.map

package/dist/guard-shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-shell.js","sourceRoot":"","sources":["../src/guard-shell.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,oFAAoF;AAEpF;;qGAEqG;AACrG,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C;;;;6CAI6C;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAA,qBAAqB,oBAAoB;;;;;;;;;;;;;;;;;CAiBhF,CAAC;AAEF;4EAC4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAA;;CAEvC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;CAoB3B,CAAC"}

package/dist/hooks/purview-guardrail.js

@@ -1,4 +1,4 @@
-import { stanceGuardrailJudgeClip } from './stance-guardrail.js';
+import { contestShell, judgeClipShell } from '../guard-shell.js';
 // purview-guardrail — the gate that makes a ROLE CONTRACT scoreable.
 //
 // A role value now states the arrow the position is over the ladder
@@ -41,19 +41,21 @@ import { stanceGuardrailJudgeClip } from './stance-guardrail.js';
 // contract makes an artifact read a descent, but a read is cheap to undo and a gate that
 // fires on one would wedge every legitimate orientation.
 //
-// FAIL-OPEN, EVIDENCE-CHECKED, RETRY-PROOF. The first two are inherited from the sibling
+// FAIL-OPEN, EVIDENCE-CHECKED, JUDGED-AGAIN. The first two are inherited from the sibling
 // pre-hook, which is also the structural model for the worker. A block whose cited span
 // is not literally in the payload is DISCARDED: a fabricated block is not a lesser
-// error than a missed one. RETRY-PROOF is this guard's own: a refused act stays refused
-// however often it is retried, so a repeat is judged again and never waved through — a
-// cap that lets an identical second call pass unjudged is an exit from the guard.
+// error than a missed one. JUDGED-AGAIN is this guard's own: a retry is judged afresh and
+// refused again on a BLOCK, never waved through, and a refusal never strands the agent: it
+// names the way on, and an agent that holds it wrong contests it by writing why into the
+// file the refusal names, whereupon that call proceeds unjudged and the contest is logged
+// for the operator (`contestShell`, the one fragment every guard worker shares).
 //
 // WHAT THE JUDGE IS HANDED is only what its one decision needs: the test in a few sentences
 // (the rubric), the act and the holder's contract it applies to. The act line names the act
 // and its target and nothing else; the definitions of what an act produces are the rubric's.
 export const purviewGuardrail = {
     id: 'purview-guardrail',
-    residue: 'structural-refusal ↾ mid-turn act ∉ role-arrow · deny-before-fire ⟨descent ⟨write(artifact) ∉ writes⟩ · skipped-rung ⟨dispatch(spec the dispatcher wrote for a unit of the loop) ∄ planner⟩ · dispatch-echo ⟨literal-words ≠ routed-name ∨ own-words⟩⟩ · pass ⟨read · act ∈ reserves · dispatch ↦ plan ∨ implement(unit-name) ∨ assay ∨ integrate ∨ ad-hoc(own-words ∉ loop ↾ contract admits)⟩ · law = the HOLDER-projected role-section ⟨quoted verbatim · ¬ authored-opinion⟩ · shared judge-backend ⟨sibling⟩ · fail-open ∧ evidence-checked ∧ retry-proof ⟨refused ⊢ refused ∀ retry · every call judged · ¬ marker⟩ · judge-hand ≜ test ∧ act ∧ contract ¬ more',
+    residue: 'structural-refusal ↾ mid-turn act ∉ role-arrow · deny-before-fire ⟨descent ⟨write(artifact) ∉ writes⟩ · skipped-rung ⟨dispatch(spec the dispatcher wrote for a unit of the loop) ∄ planner⟩ · dispatch-echo ⟨literal-words ≠ routed-name ∨ own-words⟩⟩ · pass ⟨read · act ∈ reserves · dispatch ↦ plan ∨ implement(unit-name) ∨ assay ∨ integrate ∨ ad-hoc(own-words ∉ loop ↾ contract admits)⟩ · law = the HOLDER-projected role-section ⟨quoted verbatim · ¬ authored-opinion⟩ · shared judge-backend ⟨sibling⟩ · fail-open ∧ evidence-checked ∧ judged-again ⟨retry ↦ judged afresh ∧ refused again on BLOCK · every call judged · ¬ marker⟩ · refusal ↦ way-forward ⟨act on reason ∨ contest ≜ state why ↦ contested call proceeds unjudged ∧ contest logged ↦ operator review⟩ · judge-hand ≜ test ∧ act ∧ contract ¬ more',
     substrate: 'harness',
     // Bound by holding a role at all: the arrow it judges against is the role's own.
     binds: { dimension: 'role' },
@@ -68,72 +70,21 @@ export const purviewGuardrail = {
             targetPath: 'packages/canon/targets/guardrail/purview-guardrail.sh',
             executable: true,
             content: `#!/usr/bin/env sh
-# purview-guardrail — a PreToolUse hook that STRUCTURALLY REFUSES, before the call
-# fires, a mid-turn act that falls outside the arrow the agent's OWN role contract
-# declares.
-#
-# THE LAW IS NOT IN THIS FILE AND NOT IN THE RUBRIC. It is the \`## Role\` section of
-# the persona's deployed Target, read at run time and handed to the judge as the
-# contract to score against. No role text, no agent name and no behavioural opinion is
-# hard-coded anywhere in this gate.
-#
-# SAFETY MODEL (mirrors both siblings):
-#   - SCOPE-ENROLLED by PRESENCE. A persona carrying a stance manifest is judged; every
-#     other scope is silent. No allowlist — the projection that places a persona enrolls
-#     it, and nothing central lists anybody.
-#   - CONTRACT-ENROLLED, one step further. A persona whose Target carries no \`## Role\`
-#     section has no arrow to be outside of, so it is allowed. A gate cannot convict
-#     against a law that was never declared.
-#   - FAILS OPEN, NEVER SILENTLY. Any error (no jq, no input, no Target, judge failure,
-#     unparseable verdict, unexpected error) -> exit 0, and the call goes through WITH A NOTICE
-#     the operator reads (\`say\`: Claude Code's JSON \`systemMessage\`, omp's relayed line) naming
-#     this guard and why it could not judge. Silence is reserved for "judged, pass", "not
-#     enrolled" and "no arrow declared".
-#   - EVIDENCE-CHECKED. A BLOCK must quote, on an \`EVIDENCE:\` line, a span that is literally
-#     present in the payload; a citation that is not there is a fabricated block and is
-#     DISCARDED — and the discard is said, since no verdict then stands.
-#   - RETRY-PROOF. A refused act stays refused however often it is retried: every call is
-#     judged afresh, a repeat of a refused call included, and a BLOCK on it denies it again.
-#     No marker is written and nothing is let through unjudged for having been denied before.
-#
-# INPUT  : Claude Code PreToolUse hook JSON on stdin.
-# OUTPUT : on a purview breach -> a deny decision on stdout + exit 0.
-#          judged, pass -> no stdout + exit 0.
-#          let through with no verdict -> the notice \`say\` prints + exit 0.
-#
-# POSIX sh. Depends on: jq. Missing jq -> the guard says so and allows the call.
+# purview-guardrail — denies a mid-turn act outside the arrow the agent's own \`## Role\` contract declares. Needs jq.
 
 set -eu
+GUARD_ID=purview-guardrail
+GUARD_NAME="PURVIEW GUARDRAIL"
 
-# WHAT AN OPERATOR READS WHEN THE GUARD CANNOT JUDGE, defined before anything that needs a
-# command: the first thing that can be missing is \`jq\`, and a worker run with a PATH holding
-# little beyond \`sh\` and \`cat\` must still say it did not judge, so \`esc\`, \`say\` and \`open\`
-# are builtins only and nothing external runs above the jq check.
-#
-# Claude Code shows the operator a hook's JSON \`systemMessage\` and NOT its plain stdout on
-# exit 0. omp's extension bridge reads the worker's plain stdout, and would relay a JSON object
-# as raw JSON — hence one form per harness, chosen at projection by the harness's own name.
+# Builtins only until jq is checked: a PATH of little but \`sh\` must still be able to say so.
 esc() {
-	_in="$1"
-	_out=""
-	_nl="$(printf '\\nx')"
-	_nl="\${_nl%x}"
-	_tab="$(printf '\\t')"
-	_cr="$(printf '\\r')"
-	while [ -n "$_in" ]; do
-		_rest="\${_in#?}"
-		_c="\${_in%"$_rest"}"
-		case "$_c" in
-			'\\') _c='\\\\' ;;
-			'"') _c='\\"' ;;
-			"$_nl") _c='\\n' ;;
-			"$_tab") _c='\\t' ;;
-			"$_cr") _c='\\r' ;;
-		esac
-		_out="$_out$_c"
-		_in="$_rest"
+	_i="$1"; _o=""; _n="$(printf '\\nx')"; _n="\${_n%x}"; _t="$(printf '\\t')"; _r="$(printf '\\r')"
+	while [ -n "$_i" ]; do
+		_s="\${_i#?}"; _c="\${_i%"$_s"}"
+		case "$_c" in '\\') _c='\\\\' ;; '"') _c='\\"' ;; "$_n") _c='\\n' ;; "$_t") _c='\\t' ;; "$_r") _c='\\r' ;; esac
+		_o="$_o$_c"; _i="$_s"
 	done
-	printf '%s' "$_out"
+	printf '%s' "$_o"
 }
 say() {
 	case "{{fact:harness-name}}" in
@@ -141,110 +92,71 @@ say() {
 		*) printf '%s\\n' "$1" ;;
 	esac
 }
-
 allow() { exit 0; }
-
-# A verdict and a failure are different facts and silence carries only one of them: \`allow\`
-# means "judged, pass" or "not this guard's call", \`open\` means "could not judge" — the call
-# still proceeds, and the operator is told.
-open() {
-	[ -z "\${LOG:-}" ] || printf '%s\\n' "open: $1 tool=\${tool_name:-?} agent=\${agent_type:-?}" >> "$LOG" 2>/dev/null || true
-	say "PURVIEW GUARDRAIL — DARK: $1. This call was NOT judged; the absence of a deny is an absence of a verdict, not a clean one."
-	exit 0
-}
-
-# A PreToolUse hook must never break a session. An unexpected error (a nonzero status reaching
-# the trap) is let through AND SAID; every deliberate \`exit 0\` arrives with status 0.
+open() { say "$GUARD_NAME — DARK: $1. This call was NOT judged."; exit 0; }
 trap 'rc=$?; [ "$rc" -eq 0 ] || open "an unexpected error stopped it (exit status $rc)"; exit 0' EXIT
 
 input="$(cat)"
 [ -n "$input" ] || open "the hook received no input"
-command -v jq >/dev/null 2>&1 || open "jq is not installed, so the hook payload cannot be read"
+command -v jq >/dev/null 2>&1 || open "jq is not installed"
+field() { printf '%s' "$input" | jq -r "$1" 2>/dev/null || true; }
 
-# A GUARD BINDS A PERSONA'S OWN MAIN SESSION AND NO SUBAGENT IT DISPATCHES. A subagent is bounded
-# by what it was handed, judged by its assay and the whole check, and supervised by the main
-# session. Claude Code fires this hook inside a subagent too (settings hooks and the subagent's
-# own front-matter hooks), and there the payload carries \`agent_id\` — present only inside a
-# subagent. A guard that does not bind there is not dark: it exits before it judges and says
-# nothing.
-[ -z "$(printf '%s' "$input" | jq -r '.agent_id // empty' 2>/dev/null || true)" ] || allow
+# Only a subagent's payload carries agent_id; a guard binds the persona's own session.
+[ -z "$(field '.agent_id // empty')" ] || allow
 
-# The sibling Stop hook's deployed dir owns the SHARED judge backend, resolved from
-# this script's own location exactly as the pre-hook resolves it — every hooks root
-# holds the hook dirs as siblings, so this derivation is true at every site this file
-# can land.
-SELF_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
-HOOKS_ROOT="$(dirname -- "$SELF_DIR")"
-JUDGE_DIR="\${STANCE_GUARD_DIR:-$HOOKS_ROOT/stance-guardrail}"
+HOOKS_ROOT="$(dirname -- "$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)")"
 NEUTRAL_ROOT="$(dirname -- "$(dirname -- "$HOOKS_ROOT")")/.agents"
 RUBRIC="\${PURVIEW_RUBRIC:-$NEUTRAL_ROOT/purview-guardrail/purview-judge-prompt.md}"
-JUDGE_CMD="\${STANCE_JUDGE_CMD:-sh $JUDGE_DIR/stance-judge.sh}"
-LOG="\${PURVIEW_GUARD_LOG:-$SELF_DIR/misses.log}"
+JUDGE_CMD="\${STANCE_JUDGE_CMD:-sh \${STANCE_GUARD_DIR:-$HOOKS_ROOT/stance-guardrail}/stance-judge.sh}"
 
-cwd="$(printf '%s' "$input" | jq -r '.cwd // empty' 2>/dev/null || true)"
-[ -n "$cwd" ] && cd "$cwd" 2>/dev/null || true
+cd "$(field '.cwd // empty')" 2>/dev/null || true
 
-# --- scope gate: the persona's OWN stance manifest -------------------------------------------
-# The scope is the one the harness hands over: \`stance_scope\` where a dispatcher sits in the
-# persona's own scope (omp), else the persona directory of the agent the payload NAMES
-# (\`agent_type\`, Claude Code — none on a bare session) under this harness's home, one hop above
-# the hooks root. Presence of the manifest is enrollment; no agent list lives here.
-stance_scope="$(printf '%s' "$input" | jq -r '.stance_scope // empty' 2>/dev/null || true)"
+# Enrolled by the persona's stance manifest: \`stance_scope\` (omp) or \`agent_type\` (Claude Code).
+stance_scope="$(field '.stance_scope // empty')"
 if [ -z "$stance_scope" ]; then
-	named="$(printf '%s' "$input" | jq -r '.agent_type // empty' 2>/dev/null || true)"
+	named="$(field '.agent_type // empty')"
 	case "$named" in '' | */* | . | ..) allow ;; esac
 	stance_scope="$(dirname -- "$HOOKS_ROOT")/{{fact:harness-persona-root}}/$named"
 fi
 manifest="$stance_scope/{{fact:stance-manifest}}"
 [ -f "$manifest" ] || allow
-agent_type="$(jq -r '.agent // empty' "$manifest" 2>/dev/null || true)"
-[ -n "$agent_type" ] || open "the stance manifest at $manifest names no agent, so there is no declared contract to judge against"
+GUARD_AGENT="$(jq -r '.agent // empty' "$manifest" 2>/dev/null || true)"
+[ -n "$GUARD_AGENT" ] || open "the stance manifest at $manifest names no agent"
 
-# --- the LAW: this persona's own projected role contract -------------------------------------
-# A persona scope is \`<root>/personas/<name>\` (claude) or \`<root>/agent/personas/<name>\` (omp), and
-# the Target it was projected from is \`agents/<name>.md\` beside \`personas/\` — two levels out and
-# back down, the same shape of derivation the judge path above uses. Overridable for test rigs.
-AGENT_ROOT="$(dirname -- "$(dirname -- "$stance_scope")")"
-AGENT_MD="\${PURVIEW_AGENT_MD:-$AGENT_ROOT/agents/$agent_type.md}"
-[ -f "$AGENT_MD" ] || open "the agent's projected Target is not at $AGENT_MD, so its declared contract cannot be read"
+AGENT_MD="\${PURVIEW_AGENT_MD:-$(dirname -- "$(dirname -- "$stance_scope")")/agents/$GUARD_AGENT.md}"
+[ -f "$AGENT_MD" ] || open "the agent's Target is not at $AGENT_MD, so its contract cannot be read"
 contract="$(awk '/^## Role$/{f=1;next} /^## /{f=0} f' "$AGENT_MD" 2>/dev/null || true)"
-# A contract that is a BARE TOKEN states no arrow, so there is nothing to be outside
-# of. Only a multi-line contract is scoreable, and saying so here is what keeps the
-# gate from inventing a law for a corpus that has not declared one.
+# A bare-token contract states no arrow.
 [ "$(printf '%s\\n' "$contract" | grep -c '[^[:space:]]')" -ge 2 ] || allow
 
-${stanceGuardrailJudgeClip}
+${judgeClipShell}
+GUARD_ACT="$(field '.tool_name // empty')"
+[ -n "$GUARD_ACT" ] || open "the payload names no tool"
 
-# --- extract the judged payload, branched by act ---------------------------------------------
-tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty' 2>/dev/null || true)"
-[ -n "$tool_name" ] || open "the payload names no tool, so there is no call to judge"
-
-case "$tool_name" in
+case "$GUARD_ACT" in
 	Agent|SendMessage|Task)
-		body="$(printf '%s' "$input" | jq -r '.tool_input.prompt // .tool_input.message // .tool_input.description // ""' 2>/dev/null || true)"
-		target="$(printf '%s' "$input" | jq -r '.tool_input.subagent_type // .tool_input.agent // .tool_input.name // ""' 2>/dev/null || true)"
+		body="$(field '.tool_input.prompt // .tool_input.message // .tool_input.description // ""')"
+		target="$(field '.tool_input.subagent_type // .tool_input.agent // .tool_input.name // ""')"
 		act="DISPATCH to \\\`\${target:-unnamed}\\\`"
 		;;
 	Write|Edit|MultiEdit|NotebookEdit)
-		body="$(printf '%s' "$input" | jq -r '.tool_input.file_path // .tool_input.path // .tool_input.notebook_path // ""' 2>/dev/null || true)"
+		body="$(field '.tool_input.file_path // .tool_input.path // .tool_input.notebook_path // ""')"
+		# Writing the contest file is never refused.
+		case "$body" in */../* | */..) ;; "\${TMPDIR:-/tmp}/guardrail-contest/"*) allow ;; esac
 		act="WRITE to $body"
 		;;
-	*)
-		# DEFENCE IN DEPTH. \`tool.use.pre\` fires on every tool on a harness with no
-		# subject selector; these two classes are the only acts this contract can
-		# convict, and a read is deliberately not one of them.
-		allow ;;
+	*) allow ;;
 esac
-
 [ -n "\${body:-}" ] || allow
 
-# THE JUDGE IS SENT AT MOST JUDGE_PAYLOAD_CAP BYTES, the declared contract and the act included.
-# The contract is a role section a few kilobytes long, so it may hold half the cap at most; the
-# dispatch prompt takes what is left, keeping both ends because its instruction may sit at either,
-# and the seam is marked. The evidence check below then runs against exactly this payload, so a
-# span in text the excerpt elided is discarded like any span that is not there.
+GUARD_SESSION="$(field '.session_id // empty')"
+GUARD_CALL="$(printf '%s' "$input" | jq -c '.tool_input' 2>/dev/null || true)"
+${contestShell}
+contest_heard
+
+# The contract may hold half the cap; evidence is checked against exactly this payload.
 contract="$(printf '%s' "$contract" | judge_ends "$((JUDGE_PAYLOAD_CAP / 2))")"
-head_part="=== THE HOLDER'S DECLARED CONTRACT (agent: $agent_type) ===
+head_part="=== THE HOLDER'S DECLARED CONTRACT (agent: $GUARD_AGENT) ===
 $contract
 === THE ACT ABOUT TO FIRE ===
 $act
@@ -252,61 +164,37 @@ $act
 body="$(printf '%s' "$body" | judge_ends "$((JUDGE_PAYLOAD_CAP - $(judge_bytes "$head_part")))")"
 payload="$head_part$body"
 
-# A refused call stays refused however often it is retried: there is no marker, no cap and
-# no memory of a prior denial. Every call is judged, a repeat of a refused call included.
-
-# --- judge (SHARED backend, OWN rubric) -----------------------------------------------------
-# THE SAME SEAM, UNDER THE SAME NAMES, as the two stance workers: a host that holds a model
-# runs this worker twice around a judgment it makes itself (\`STANCE_EMIT_PAYLOAD\` to receive
-# the payload and rubric, \`STANCE_VERDICT_FILE\` naming the answer). This one read
-# \`PURVIEW_\`-prefixed names of its own, so the omp bridge — which speaks the shared names —
-# got no payload back and purview judged nothing there, on every call, while reading as a
-# guard that had found nothing.
+# A host holding a model runs this twice around its own judgment, under the names the omp bridge speaks.
 if [ -n "\${STANCE_EMIT_PAYLOAD:-}" ]; then
-	jq -cn --arg r "$RUBRIC" --arg p "$payload" '{rubric:$r, payload:$p}'
+	jq -cn --arg r "$RUBRIC" --arg p "$payload" '{rubric:$r,payload:$p}'
 	exit 0
 fi
 if [ -n "\${STANCE_VERDICT_FILE:-}" ]; then
-	verdict="$(cat "\${STANCE_VERDICT_FILE}" 2>/dev/null || true)"
+	verdict="$(cat "$STANCE_VERDICT_FILE" 2>/dev/null || true)"
 	[ -n "$verdict" ] || open "the judge did not answer"
 else
 	verdict="$(printf '%s' "$payload" | $JUDGE_CMD "$RUBRIC" 2>/dev/null)" || open "the judge did not answer"
 fi
 
-decision="$(printf '%s\\n' "$verdict" | sed -n 's/^VERDICT:[[:space:]]*//p' | head -1 | sed 's/[[:space:]]*$//')"
-case "$decision" in
-	PASS) allow ;;  # judged, pass: the one silent verdict
+said() { printf '%s\\n' "$verdict" | sed -n "s/^$1:[[:space:]]*//p" | head -1; }
+case "$(said VERDICT | sed 's/[[:space:]]*$//')" in
+	PASS) allow ;;
 	BLOCK) ;;
-	*) open "the judge's verdict was unparseable (no VERDICT: PASS or VERDICT: BLOCK line)" ;;
+	*) open "the judge's verdict was unparseable" ;;
 esac
 
-reason="$(printf '%s\\n' "$verdict" | sed -n 's/^REASON:[[:space:]]*//p' | head -1)"
-[ -n "$reason" ] || reason="This act falls outside the arrow your role contract declares."
+reason="$(said REASON)"
+[ -n "$reason" ] || reason="This act is outside the arrow your role contract declares."
 
-# --- EVIDENCE CHECK: the cited span must be literally in the payload -------------------------
-# A block naming a span the payload does not contain is a hallucinated block, and a
-# fabricated refusal is not a lesser error than a missed one. Same rule, same reason as
-# the turn-end sibling.
-cited="$(printf '%s\\n' "$verdict" | sed -n 's/^EVIDENCE:[[:space:]]*//p' | head -1)"
+cited="$(said EVIDENCE)"
 if [ -n "$cited" ]; then
 	printf '%s' "$payload" | grep -qF -- "$cited" || {
-		[ -z "\${LOG:-}" ] || printf '%s\\n' "block-discarded: span=$cited tool=$tool_name agent=$agent_type" >> "$LOG" 2>/dev/null || true
-		say "PURVIEW GUARDRAIL — BLOCK DISCARDED: the judge blocked this call but cited a span that is not in it (fabricated): $cited. No verdict stands; this call was NOT judged clean."
+		say "$GUARD_NAME — BLOCK DISCARDED: the judge cited a span that is not in the call (fabricated): $cited. No verdict stands; this call was NOT judged."
 		exit 0
 	}
 fi
 
-feedback="PURVIEW GUARDRAIL — denied this $tool_name call: it falls outside the arrow your own \\
-role contract declares. $reason  Delegation is a THEOREM of that arrow, not an option: an act whose \\
-domain or codomain lies outside it goes to the role that owns it — a decomposition of a shard to a \\
-planner, a build to an implementer, an artifact reading to an assayer, a merge or a whole check to \\
-the integrator. Hand a unit of the loop over by name and carry on with what the contract reserves. \\
-(Legitimate and NOT blocked here: reading anything, dispatching to a planner, routing a unit of the loop \\
-or a closed plan by its name to an implementer, an assayer, the integrator or the agent already running \\
-it, dispatching a request outside the loop to whichever role \\
-or agent fits it in your own rectified words where your contract admits it, and performing any act the \\
-contract's own \\\`reserves\\\` clause names.)"
-
+feedback="$GUARD_NAME — denied this $GUARD_ACT call: $reason Hand an act outside your arrow to the role that owns it, a unit of the loop by name. $(contest_refused "$reason")"
 jq -cn --arg r "$feedback" '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:$r}}'
 exit 0
 `,

package/dist/hooks/purview-guardrail.js.map

@@ -1 +1 @@
-{"version":3,"file":"purview-guardrail.js","sourceRoot":"","sources":["../../src/hooks/purview-guardrail.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,oFAAoF;AACpF,mFAAmF;AACnF,kFAAkF;AAClF,qBAAqB;AACrB,EAAE;AACF,iFAAiF;AACjF,uFAAuF;AACvF,uFAAuF;AACvF,uFAAuF;AACvF,mFAAmF;AACnF,wFAAwF;AACxF,EAAE;AACF,sFAAsF;AACtF,oFAAoF;AACpF,uFAAuF;AACvF,uFAAuF;AACvF,uFAAuF;AACvF,+EAA+E;AAC/E,sFAAsF;AACtF,yEAAyE;AACzE,EAAE;AACF,+DAA+D;AAC/D,4FAA4F;AAC5F,4FAA4F;AAC5F,0BAA0B;AAC1B,gFAAgF;AAChF,2FAA2F;AAC3F,yFAAyF;AACzF,4FAA4F;AAC5F,6FAA6F;AAC7F,yFAAyF;AACzF,yFAAyF;AACzF,8FAA8F;AAC9F,6FAA6F;AAC7F,8FAA8F;AAC9F,6FAA6F;AAC7F,yFAAyF;AACzF,yDAAyD;AACzD,EAAE;AACF,yFAAyF;AACzF,wFAAwF;AACxF,mFAAmF;AACnF,wFAAwF;AACxF,uFAAuF;AACvF,kFAAkF;AAClF,EAAE;AACF,4FAA4F;AAC5F,4FAA4F;AAC5F,6FAA6F;AAE7F,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,EAAE,EAAE,mBAAmB;IACvB,OAAO,EACL,uoBAAuoB;IACzoB,SAAS,EAAE,SAAS;IACpB,iFAAiF;IACjF,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;IAC5B,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,uBAAuB,EAAE,cAAc,CAAC;IACjD,KAAK,EAAE,sBAAsB;IAC7B,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,sBAAsB;YAChC,UAAU,EAAE,uDAAuD;YACnE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkJb,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgGzB;SACI;QACD;YACE,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,0DAA0D;YACtE,UAAU,EAAE,KAAK;YACjB,iFAAiF;YACjF,2EAA2E;YAC3E,6EAA6E;YAC7E,8EAA8E;YAC9E,6BAA6B;YAC7B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;CAuBd;SACI;KACF;CACF,CAAC"}
+{"version":3,"file":"purview-guardrail.js","sourceRoot":"","sources":["../../src/hooks/purview-guardrail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGjE,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,oFAAoF;AACpF,mFAAmF;AACnF,kFAAkF;AAClF,qBAAqB;AACrB,EAAE;AACF,iFAAiF;AACjF,uFAAuF;AACvF,uFAAuF;AACvF,uFAAuF;AACvF,mFAAmF;AACnF,wFAAwF;AACxF,EAAE;AACF,sFAAsF;AACtF,oFAAoF;AACpF,uFAAuF;AACvF,uFAAuF;AACvF,uFAAuF;AACvF,+EAA+E;AAC/E,sFAAsF;AACtF,yEAAyE;AACzE,EAAE;AACF,+DAA+D;AAC/D,4FAA4F;AAC5F,4FAA4F;AAC5F,0BAA0B;AAC1B,gFAAgF;AAChF,2FAA2F;AAC3F,yFAAyF;AACzF,4FAA4F;AAC5F,6FAA6F;AAC7F,yFAAyF;AACzF,yFAAyF;AACzF,8FAA8F;AAC9F,6FAA6F;AAC7F,8FAA8F;AAC9F,6FAA6F;AAC7F,yFAAyF;AACzF,yDAAyD;AACzD,EAAE;AACF,0FAA0F;AAC1F,wFAAwF;AACxF,mFAAmF;AACnF,0FAA0F;AAC1F,2FAA2F;AAC3F,yFAAyF;AACzF,0FAA0F;AAC1F,iFAAiF;AACjF,EAAE;AACF,4FAA4F;AAC5F,4FAA4F;AAC5F,6FAA6F;AAE7F,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,EAAE,EAAE,mBAAmB;IACvB,OAAO,EACL,iyBAAiyB;IACnyB,SAAS,EAAE,SAAS;IACpB,iFAAiF;IACjF,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;IAC5B,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,uBAAuB,EAAE,cAAc,CAAC;IACjD,KAAK,EAAE,sBAAsB;IAC7B,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,sBAAsB;YAChC,UAAU,EAAE,uDAAuD;YACnE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4Db,cAAc;;;;;;;;;;;;;;;;;;;;;;EAsBd,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8Cb;SACI;QACD;YACE,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,0DAA0D;YACtE,UAAU,EAAE,KAAK;YACjB,iFAAiF;YACjF,2EAA2E;YAC3E,6EAA6E;YAC7E,8EAA8E;YAC9E,6BAA6B;YAC7B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;CAuBd;SACI;KACF;CACF,CAAC"}