@cratylus/canon 0.8.0 → 0.10.0

package/dist/hooks/purview-guardrail.js

@@ -23,16 +23,22 @@
 // every agent in the corpus composed the fragment it claimed to enforce.
 //
 // WHAT IT BLOCKS is what the arrow excludes, and nothing else:
-//   · a dispatch to a builder for a piece no planner decomposed, from a holder whose
-//     arrow does not write spec — the architect skipping the middle rung;
+//   · a dispatch carrying a spec the dispatcher wrote for a unit of the loop, from a holder
+//     whose arrow does not write spec — the architect skipping the planner, who alone turns
+//     a shard into units;
 //   · a write to the substrate by a holder whose arrow does not write artifact;
-//   · a dispatch whose prompt is the operator's literal words rather than a cut piece
-//     — the same dispatch-echo the stance guard catches at turn end, refused here
-//     because at this moment the contract that convicts it is the ROLE's.
-// WHAT IT PASSES: a dispatch to a planner, a dispatch to an assayer, READING anything,
-// and writing whatever the arrow reserves. Reading is never a block — the architect's
-// contract makes an artifact read a descent, but a read is cheap to undo and a gate
-// that fires on one would wedge every legitimate orientation.
+//   · a dispatch whose prompt is the operator's literal words rather than a routed name or
+//     the holder's own request — the same dispatch-echo the stance guard catches at turn
+//     end, refused here because at this moment the contract that convicts it is the ROLE's.
+// WHAT IT PASSES: a dispatch to a planner, a dispatch routing a unit name to an implementer,
+// a dispatch to an assayer, a dispatch to the integrator, a dispatch outside the loop of
+// realizing the design — a comparison, an audit, a question — in the holder's own words,
+// where the holder's own contract admits it, READING anything, and writing whatever the arrow
+// reserves. The operator saw an ad hoc comparison refused twice because a self-worded prompt
+// was read as a spec; a request is not a spec, the routing discipline binds units of the loop
+// and not everything a holder says to a delegate. Reading is never a block — the architect's
+// contract makes an artifact read a descent, but a read is cheap to undo and a gate that
+// fires on one would wedge every legitimate orientation.
 //
 // FAIL-OPEN, EVIDENCE-CHECKED, RE-ENTRY-CAPPED — all three inherited from the sibling
 // pre-hook, which is also the structural model for the worker. A block whose cited span
@@ -40,8 +46,10 @@
 // error than a missed one.
 export const purviewGuardrail = {
     id: 'purview-guardrail',
-    residue: 'structural-refusal ↾ mid-turn act ∉ role-arrow · deny-before-fire ⟨descent ⟨write(artifact) ∉ writes⟩ · skipped-rung ⟨dispatch(build) ∄ decomposition⟩ · dispatch-echo ⟨literal-words ≠ cut-piece⟩⟩ · pass ⟨read · act ∈ reserves · dispatch ↦ plan ∨ assay⟩ · law = the HOLDER-projected role-section ⟨quoted verbatim · ¬ authored-opinion⟩ · shared judge-backend ⟨sibling⟩ · fail-open ∧ evidence-checked ∧ re-entry-capped',
+    residue: 'structural-refusal ↾ mid-turn act ∉ role-arrow · deny-before-fire ⟨descent ⟨write(artifact) ∉ writes⟩ · skipped-rung ⟨dispatch(spec the dispatcher wrote for a unit of the loop) ∄ planner⟩ · dispatch-echo ⟨literal-words ≠ routed-name ∨ own-words⟩⟩ · pass ⟨read · act ∈ reserves · dispatch ↦ plan ∨ implement(unit-name) ∨ assay ∨ integrate ∨ ad-hoc(own-words ∉ loop ↾ contract admits)⟩ · law = the HOLDER-projected role-section ⟨quoted verbatim · ¬ authored-opinion⟩ · shared judge-backend ⟨sibling⟩ · fail-open ∧ evidence-checked ∧ re-entry-capped',
     substrate: 'harness',
+    // Bound by holding a role at all: the arrow it judges against is the role's own.
+    binds: { dimension: 'role' },
     order: 1,
     events: ['subagent.dispatch.pre', 'tool.use.pre'],
     entry: 'purview-guardrail.sh',
@@ -69,19 +77,82 @@ export const purviewGuardrail = {
 #   - CONTRACT-ENROLLED, one step further. A persona whose Target carries no \`## Role\`
 #     section has no arrow to be outside of, so it is allowed. A gate cannot convict
 #     against a law that was never declared.
-#   - FAILS OPEN. Any error (no jq, no Target, judge failure) -> exit 0.
+#   - FAILS OPEN, NEVER SILENTLY. Any error (no jq, no input, no Target, judge failure,
+#     unparseable verdict, unexpected error) -> exit 0, and the call goes through WITH A NOTICE
+#     the operator reads (\`say\`: Claude Code's JSON \`systemMessage\`, omp's relayed line) naming
+#     this guard and why it could not judge. Silence is reserved for "judged, pass", "not
+#     enrolled" and "no arrow declared".
 #   - EVIDENCE-CHECKED. A BLOCK must quote a span that is literally present in the
-#     payload; a citation that is not there is a fabricated block and is DISCARDED.
-#   - LOOP-SAFE. A re-entry cap: never deny an identical tool_input twice.
+#     payload; a citation that is not there is a fabricated block and is DISCARDED — and the
+#     discard is said, since no verdict then stands.
+#   - LOOP-SAFE. A re-entry cap: never deny an identical tool_input twice. The second,
+#     identical call goes through unjudged, and says so.
 #
 # INPUT  : Claude Code PreToolUse hook JSON on stdin.
 # OUTPUT : on a purview breach -> a deny decision on stdout + exit 0.
-#          otherwise -> no stdout + exit 0.
+#          judged, pass -> no stdout + exit 0.
+#          let through with no verdict -> the notice \`say\` prints + exit 0.
 #
-# POSIX sh. Depends on: jq. Missing jq -> fail open.
+# POSIX sh. Depends on: jq. Missing jq -> the guard says so and allows the call.
 
 set -eu
 
+# WHAT AN OPERATOR READS WHEN THE GUARD CANNOT JUDGE, defined before anything that needs a
+# command: the first thing that can be missing is \`jq\`, and a worker run with a PATH holding
+# little beyond \`sh\` and \`cat\` must still say it did not judge, so \`esc\`, \`say\` and \`open\`
+# are builtins only and nothing external runs above the jq check.
+#
+# Claude Code shows the operator a hook's JSON \`systemMessage\` and NOT its plain stdout on
+# exit 0. omp's extension bridge reads the worker's plain stdout, and would relay a JSON object
+# as raw JSON — hence one form per harness, chosen at projection by the harness's own name.
+esc() {
+	_in="$1"
+	_out=""
+	_nl="$(printf '\\nx')"
+	_nl="\${_nl%x}"
+	_tab="$(printf '\\t')"
+	_cr="$(printf '\\r')"
+	while [ -n "$_in" ]; do
+		_rest="\${_in#?}"
+		_c="\${_in%"$_rest"}"
+		case "$_c" in
+			'\\') _c='\\\\' ;;
+			'"') _c='\\"' ;;
+			"$_nl") _c='\\n' ;;
+			"$_tab") _c='\\t' ;;
+			"$_cr") _c='\\r' ;;
+		esac
+		_out="$_out$_c"
+		_in="$_rest"
+	done
+	printf '%s' "$_out"
+}
+say() {
+	case "{{fact:harness-name}}" in
+		claude) printf '{"systemMessage":"%s"}\\n' "$(esc "$1")" ;;
+		*) printf '%s\\n' "$1" ;;
+	esac
+}
+
+allow() { exit 0; }
+
+# A verdict and a failure are different facts and silence carries only one of them: \`allow\`
+# means "judged, pass" or "not this guard's call", \`open\` means "could not judge" — the call
+# still proceeds, and the operator is told.
+open() {
+	[ -z "\${LOG:-}" ] || printf '%s\\n' "open: $1 tool=\${tool_name:-?} agent=\${agent_type:-?}" >> "$LOG" 2>/dev/null || true
+	say "PURVIEW GUARDRAIL — DARK: $1. This call was NOT judged; the absence of a deny is an absence of a verdict, not a clean one."
+	exit 0
+}
+
+# A PreToolUse hook must never break a session. An unexpected error (a nonzero status reaching
+# the trap) is let through AND SAID; every deliberate \`exit 0\` arrives with status 0.
+trap 'rc=$?; [ "$rc" -eq 0 ] || open "an unexpected error stopped it (exit status $rc)"; exit 0' EXIT
+
+input="$(cat)"
+[ -n "$input" ] || open "the hook received no input"
+command -v jq >/dev/null 2>&1 || open "jq is not installed, so the hook payload cannot be read"
+
 # The sibling Stop hook's deployed dir owns the SHARED judge backend, resolved from
 # this script's own location exactly as the pre-hook resolves it — every hooks root
 # holds the hook dirs as siblings, so this derivation is true at every site this file
@@ -94,33 +165,32 @@ RUBRIC="\${PURVIEW_RUBRIC:-$NEUTRAL_ROOT/purview-guardrail/purview-judge-prompt.
 JUDGE_CMD="\${STANCE_JUDGE_CMD:-sh $JUDGE_DIR/stance-judge.sh}"
 LOG="\${PURVIEW_GUARD_LOG:-$SELF_DIR/misses.log}"
 
-trap 'exit 0' EXIT
-
-allow() { exit 0; }
-note() { printf '%s\\n' "$1" >> "$LOG" 2>/dev/null || true; }
-
-input="$(cat)"
-[ -n "$input" ] || allow
-command -v jq >/dev/null 2>&1 || allow
-
 cwd="$(printf '%s' "$input" | jq -r '.cwd // empty' 2>/dev/null || true)"
 [ -n "$cwd" ] && cd "$cwd" 2>/dev/null || true
 
 # --- scope gate: the persona's OWN stance manifest -------------------------------------------
+# The scope is the one the harness hands over: \`stance_scope\` where a dispatcher sits in the
+# persona's own scope (omp), else the persona directory of the agent the payload NAMES
+# (\`agent_type\`, Claude Code — none on a bare session) under this harness's home, one hop above
+# the hooks root. Presence of the manifest is enrollment; no agent list lives here.
 stance_scope="$(printf '%s' "$input" | jq -r '.stance_scope // empty' 2>/dev/null || true)"
-[ -n "$stance_scope" ] || allow
-manifest="$stance_scope/stance/manifest.json"
+if [ -z "$stance_scope" ]; then
+	named="$(printf '%s' "$input" | jq -r '.agent_type // empty' 2>/dev/null || true)"
+	case "$named" in '' | */* | . | ..) allow ;; esac
+	stance_scope="$(dirname -- "$HOOKS_ROOT")/{{fact:harness-persona-root}}/$named"
+fi
+manifest="$stance_scope/{{fact:stance-manifest}}"
 [ -f "$manifest" ] || allow
 agent_type="$(jq -r '.agent // empty' "$manifest" 2>/dev/null || true)"
-[ -n "$agent_type" ] || allow
+[ -n "$agent_type" ] || open "the stance manifest at $manifest names no agent, so there is no declared contract to judge against"
 
 # --- the LAW: this persona's own projected role contract -------------------------------------
-# A persona scope is \`<root>/agent/personas/<name>\` and the Target it was projected
-# from is \`<root>/agent/agents/<name>.md\` — two levels out and back down, the same
-# shape of derivation the judge path above uses. Overridable for test rigs.
+# A persona scope is \`<root>/personas/<name>\` (claude) or \`<root>/agent/personas/<name>\` (omp), and
+# the Target it was projected from is \`agents/<name>.md\` beside \`personas/\` — two levels out and
+# back down, the same shape of derivation the judge path above uses. Overridable for test rigs.
 AGENT_ROOT="$(dirname -- "$(dirname -- "$stance_scope")")"
 AGENT_MD="\${PURVIEW_AGENT_MD:-$AGENT_ROOT/agents/$agent_type.md}"
-[ -f "$AGENT_MD" ] || allow
+[ -f "$AGENT_MD" ] || open "the agent's projected Target is not at $AGENT_MD, so its declared contract cannot be read"
 contract="$(awk '/^## Role$/{f=1;next} /^## /{f=0} f' "$AGENT_MD" 2>/dev/null || true)"
 # A contract that is a BARE TOKEN states no arrow, so there is nothing to be outside
 # of. Only a multi-line contract is scoreable, and saying so here is what keeps the
@@ -129,13 +199,13 @@ contract="$(awk '/^## Role$/{f=1;next} /^## /{f=0} f' "$AGENT_MD" 2>/dev/null ||
 
 # --- extract the judged payload, branched by act ---------------------------------------------
 tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty' 2>/dev/null || true)"
-[ -n "$tool_name" ] || allow
+[ -n "$tool_name" ] || open "the payload names no tool, so there is no call to judge"
 
 case "$tool_name" in
 	Agent|SendMessage|Task)
 		body="$(printf '%s' "$input" | jq -r '.tool_input.prompt // .tool_input.message // .tool_input.description // ""' 2>/dev/null || true)"
 		target="$(printf '%s' "$input" | jq -r '.tool_input.subagent_type // .tool_input.agent // .tool_input.name // ""' 2>/dev/null || true)"
-		act="DISPATCH to \\\`\${target:-unnamed}\\\` (codomain: the spec this delegate will build from)"
+		act="DISPATCH to \\\`\${target:-unnamed}\\\` (codomain: route when it carries a unit name and address only, spec when it carries instructions the dispatcher wrote for a unit of the loop, request when it carries the dispatcher's own words outside the loop)"
 		;;
 	Write|Edit|MultiEdit|NotebookEdit)
 		body="$(printf '%s' "$input" | jq -r '.tool_input.file_path // .tool_input.path // .tool_input.notebook_path // ""' 2>/dev/null || true)"
@@ -160,28 +230,32 @@ $body"
 session_id="$(printf '%s' "$input" | jq -r '.session_id // "nosession"' 2>/dev/null || echo nosession)"
 sig="$(printf '%s' "$input" | jq -c '.tool_input' 2>/dev/null | cksum | cut -d' ' -f1 2>/dev/null || echo 0)"
 seen="\${TMPDIR:-/tmp}/.purview-pre-$session_id-$sig"
-[ -f "$seen" ] && allow
+[ -f "$seen" ] && open "this exact call was already denied once, so the re-entry cap lets it through unjudged"
 
 # --- judge (SHARED backend, OWN rubric) -----------------------------------------------------
-if [ -n "\${PURVIEW_EMIT_PAYLOAD:-}" ]; then
+# THE SAME SEAM, UNDER THE SAME NAMES, as the two stance workers: a host that holds a model
+# runs this worker twice around a judgment it makes itself (\`STANCE_EMIT_PAYLOAD\` to receive
+# the payload and rubric, \`STANCE_VERDICT_FILE\` naming the answer). This one read
+# \`PURVIEW_\`-prefixed names of its own, so the omp bridge — which speaks the shared names —
+# got no payload back and purview judged nothing there, on every call, while reading as a
+# guard that had found nothing.
+if [ -n "\${STANCE_EMIT_PAYLOAD:-}" ]; then
 	jq -cn --arg r "$RUBRIC" --arg p "$payload" '{rubric:$r, payload:$p}'
 	exit 0
 fi
-if [ -n "\${PURVIEW_VERDICT_FILE:-}" ]; then
-	verdict="$(cat "\${PURVIEW_VERDICT_FILE}" 2>/dev/null || true)"
-	[ -n "$verdict" ] || {
-		note "$(date -u +%Y-%m-%dT%H:%M:%SZ) judge-empty tool=$tool_name agent=$agent_type"
-		allow
-	}
+if [ -n "\${STANCE_VERDICT_FILE:-}" ]; then
+	verdict="$(cat "\${STANCE_VERDICT_FILE}" 2>/dev/null || true)"
+	[ -n "$verdict" ] || open "the judge did not answer"
 else
-	verdict="$(printf '%s' "$payload" | $JUDGE_CMD "$RUBRIC" 2>/dev/null)" || {
-		note "$(date -u +%Y-%m-%dT%H:%M:%SZ) judge-fail tool=$tool_name agent=$agent_type"
-		allow
-	}
+	verdict="$(printf '%s' "$payload" | $JUDGE_CMD "$RUBRIC" 2>/dev/null)" || open "the judge did not answer"
 fi
 
-decision="$(printf '%s\\n' "$verdict" | sed -n 's/^VERDICT:[[:space:]]*//p' | head -1)"
-[ "$decision" = "BLOCK" ] || allow
+decision="$(printf '%s\\n' "$verdict" | sed -n 's/^VERDICT:[[:space:]]*//p' | head -1 | sed 's/[[:space:]]*$//')"
+case "$decision" in
+	PASS) allow ;;  # judged, pass: the one silent verdict
+	BLOCK) ;;
+	*) open "the judge's verdict was unparseable (no VERDICT: PASS or VERDICT: BLOCK line)" ;;
+esac
 
 reason="$(printf '%s\\n' "$verdict" | sed -n 's/^REASON:[[:space:]]*//p' | head -1)"
 [ -n "$reason" ] || reason="This act falls outside the arrow your role contract declares."
@@ -193,8 +267,9 @@ reason="$(printf '%s\\n' "$verdict" | sed -n 's/^REASON:[[:space:]]*//p' | head
 cited="$(printf '%s\\n' "$verdict" | sed -n 's/^SPAN:[[:space:]]*//p' | head -1)"
 if [ -n "$cited" ]; then
 	printf '%s' "$payload" | grep -qF -- "$cited" || {
-		note "$(date -u +%Y-%m-%dT%H:%M:%SZ) evidence-fail tool=$tool_name agent=$agent_type span=$cited"
-		allow
+		[ -z "\${LOG:-}" ] || printf '%s\\n' "block-discarded: span=$cited tool=$tool_name agent=$agent_type" >> "$LOG" 2>/dev/null || true
+		say "PURVIEW GUARDRAIL — BLOCK DISCARDED: the judge blocked this call but cited a span that is not in it (fabricated): $cited. No verdict stands; this call was NOT judged clean."
+		exit 0
 	}
 fi
 
@@ -202,10 +277,13 @@ fi
 
 feedback="PURVIEW GUARDRAIL — denied this $tool_name call: it falls outside the arrow your own \\
 role contract declares. $reason  Delegation is a THEOREM of that arrow, not an option: an act whose \\
-domain or codomain lies outside it goes to the role that owns it — a decomposition to a planner, a \\
-build to an implementer, an artifact reading to an assayer. Hand it over and carry on with what the \\
-contract reserves. (Legitimate and NOT blocked here: reading anything, dispatching to a planner or an \\
-assayer, and performing any act the contract's own \\\`reserves\\\` clause names.)"
+domain or codomain lies outside it goes to the role that owns it — a decomposition of a shard to a \\
+planner, a build to an implementer, an artifact reading to an assayer, a merge or a whole check to \\
+the integrator. Hand a unit of the loop over by name and carry on with what the contract reserves. \\
+(Legitimate and NOT blocked here: reading anything, dispatching to a planner, routing a unit name to \\
+an implementer, an assayer or the integrator, dispatching a request outside the loop to whichever role \\
+or agent fits it in your own rectified words where your contract admits it, and performing any act the \\
+contract's own \\\`reserves\\\` clause names.)"
 
 jq -cn --arg r "$feedback" '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:$r}}'
 exit 0
@@ -251,7 +329,11 @@ durative concept lattice — the design.
 
 An act has a **domain** (the layer it consumes) and a **codomain** (the layer it produces):
 
-- a DISPATCH produces a **spec** — the delegate's instructions are the layer being written;
+- a DISPATCH that carries a unit name and its address only produces a **route**; a DISPATCH that
+  carries instructions the dispatcher wrote for a unit of the loop the contract names produces a
+  **spec** — those instructions are the layer being written; a DISPATCH that carries a request in
+  the dispatcher's own words, outside that loop, produces neither: it is a **request**, and it is
+  in the arrow exactly when the contract says so;
 - a WRITE to a source or config file produces an **artifact**;
 - reading anything at all produces **nothing**, and is never a breach.
 
@@ -263,20 +345,30 @@ whole test, and it is mechanical.
 - **A write whose codomain is \`artifact\` by a holder whose \`writes\` set excludes \`artifact\`.**
   The contract usually names this: \`descent\`. The path in the payload is the evidence.
 - **A dispatch whose codomain is \`spec\` by a holder whose \`writes\` set excludes \`spec\`.** This is
-  the skipped rung: a holder that writes only the design has handed a delegate a spec that no
-  spec-writing role produced. The prompt is the evidence.
-- **A dispatch whose prompt is the operator's literal words rather than a piece the agent cut.** The
-  contract that convicts this is the same clause: a dispatch is a spec, and transcription is not
-  authorship. Evidence is the prompt reading as relayed instructions rather than a bounded piece
-  with its own acceptance.
+  the skipped rung: a holder that writes only the design and its routes has handed a delegate
+  instructions it wrote itself for a unit of the loop — the prompt names a unit or a plan, or tells
+  the delegate what to build, change or verify in a unit's files — where only a planner turns a shard
+  into units. The prompt is the evidence.
+- **A dispatch whose prompt is the operator's literal words** rather than a routed name or the
+  holder's own request. The contract that convicts this is the same clause: transcription is not
+  authorship. Evidence is the prompt reading as the operator's text relayed — addressed to the
+  holder, or in the operator's own voice — rather than as a request the holder rectified and worded
+  itself.
 
 ## What to PASS — and these are the majority
 
 - **Any read.** Reading is outside the test by construction. Even where a contract calls
   artifact-reading a descent, that is a standing discipline, not a mid-turn refusal.
 - **A dispatch to a role the contract explicitly routes to.** Contracts name their delegations
-  (\`⟨C → spec⟩ ↦ plan\`, \`⟨artifact → C⟩ ↦ assay\`). Handing work to a named delegate is the arrow
-  WORKING.
+  (\`⟨C → spec⟩ ↦ planner\`, \`⟨spec → artifact⟩ ↦ implementer\`, \`⟨artifact → C⟩ ↦ assayer\`, the
+  integrator for gate, merge and record). A dispatch to a planner, a dispatch routing a unit name
+  to an implementer, a dispatch to an assayer and a dispatch to the integrator are the arrow
+  WORKING, whether the contract's \`writes\` names \`route\` or not.
+- **A dispatch the contract admits in the holder's own words.** Where the contract states that a
+  request outside the loop — a comparison, an audit, a question — may go to any role or agent that
+  fits it, a dispatch carrying such a request in the holder's own words is the contract working,
+  whichever role it names. It writes no spec: it names no unit of the loop and hands no
+  instructions for building one. Do not read a request's being self-worded as a spec.
 - **Any act the \`reserves\` clause names**, whatever it is.
 - **A write by a holder whose \`writes\` set includes \`artifact\`.** Most agents in most corpora
   build. Do not read a contract's other clauses as narrowing an arrow that plainly permits the act.

package/dist/hooks/purview-guardrail.js.map

@@ -1 +1 @@
-{"version":3,"file":"purview-guardrail.js","sourceRoot":"","sources":["../../src/hooks/purview-guardrail.ts"],"names":[],"mappings":"AAEA,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,oFAAoF;AACpF,mFAAmF;AACnF,kFAAkF;AAClF,qBAAqB;AACrB,EAAE;AACF,iFAAiF;AACjF,uFAAuF;AACvF,uFAAuF;AACvF,uFAAuF;AACvF,mFAAmF;AACnF,wFAAwF;AACxF,EAAE;AACF,sFAAsF;AACtF,oFAAoF;AACpF,uFAAuF;AACvF,uFAAuF;AACvF,uFAAuF;AACvF,+EAA+E;AAC/E,sFAAsF;AACtF,yEAAyE;AACzE,EAAE;AACF,+DAA+D;AAC/D,qFAAqF;AACrF,0EAA0E;AAC1E,gFAAgF;AAChF,sFAAsF;AACtF,kFAAkF;AAClF,0EAA0E;AAC1E,uFAAuF;AACvF,sFAAsF;AACtF,oFAAoF;AACpF,8DAA8D;AAC9D,EAAE;AACF,sFAAsF;AACtF,wFAAwF;AACxF,mFAAmF;AACnF,2BAA2B;AAE3B,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,EAAE,EAAE,mBAAmB;IACvB,OAAO,EACL,iaAAia;IACna,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,uBAAuB,EAAE,cAAc,CAAC;IACjD,KAAK,EAAE,sBAAsB;IAC7B,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,sBAAsB;YAChC,UAAU,EAAE,uDAAuD;YACnE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6Jd;SACI;QACD;YACE,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,0DAA0D;YACtE,UAAU,EAAE,KAAK;YACjB,iFAAiF;YACjF,2EAA2E;YAC3E,6EAA6E;YAC7E,8EAA8E;YAC9E,6BAA6B;YAC7B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0Ed;SACI;KACF;CACF,CAAC"}
+{"version":3,"file":"purview-guardrail.js","sourceRoot":"","sources":["../../src/hooks/purview-guardrail.ts"],"names":[],"mappings":"AAEA,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,oFAAoF;AACpF,mFAAmF;AACnF,kFAAkF;AAClF,qBAAqB;AACrB,EAAE;AACF,iFAAiF;AACjF,uFAAuF;AACvF,uFAAuF;AACvF,uFAAuF;AACvF,mFAAmF;AACnF,wFAAwF;AACxF,EAAE;AACF,sFAAsF;AACtF,oFAAoF;AACpF,uFAAuF;AACvF,uFAAuF;AACvF,uFAAuF;AACvF,+EAA+E;AAC/E,sFAAsF;AACtF,yEAAyE;AACzE,EAAE;AACF,+DAA+D;AAC/D,4FAA4F;AAC5F,4FAA4F;AAC5F,0BAA0B;AAC1B,gFAAgF;AAChF,2FAA2F;AAC3F,yFAAyF;AACzF,4FAA4F;AAC5F,6FAA6F;AAC7F,yFAAyF;AACzF,yFAAyF;AACzF,8FAA8F;AAC9F,6FAA6F;AAC7F,8FAA8F;AAC9F,6FAA6F;AAC7F,yFAAyF;AACzF,yDAAyD;AACzD,EAAE;AACF,sFAAsF;AACtF,wFAAwF;AACxF,mFAAmF;AACnF,2BAA2B;AAE3B,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,EAAE,EAAE,mBAAmB;IACvB,OAAO,EACL,oiBAAoiB;IACtiB,SAAS,EAAE,SAAS;IACpB,iFAAiF;IACjF,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;IAC5B,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,uBAAuB,EAAE,cAAc,CAAC;IACjD,KAAK,EAAE,sBAAsB;IAC7B,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,sBAAsB;YAChC,UAAU,EAAE,uDAAuD;YACnE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmOd;SACI;QACD;YACE,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,0DAA0D;YACtE,UAAU,EAAE,KAAK;YACjB,iFAAiF;YACjF,2EAA2E;YAC3E,6EAA6E;YAC7E,8EAA8E;YAC9E,6BAA6B;YAC7B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwFd;SACI;KACF;CACF,CAAC"}

package/dist/hooks/stance-guardrail-pre.js

@@ -1,3 +1,5 @@
+import { anchorOf } from '@cratylus/schema';
+import { handoff } from '../dimensions/autonomy/handoff.js';
 // stance-guardrail-pre — the BEFORE-THE-CALL twin of `stance-guardrail` (the turn-end
 // cell). It STRUCTURALLY REFUSES, BEFORE the call fires, a mid-turn tool call that
 // collapses out of the intent-driven-expert stance. Two acts, and the acts are what it
@@ -10,19 +12,23 @@
 //
 // IT BINDS TWO ACTS, NOT ONE EVENT PLUS A REGEX. This cell used to read
 // `events: ['tool.use.pre']` + `matcher: 'AskUserQuestion|Agent|SendMessage'` — three
-// claude tool names on a harness-agnostic shape, which the codex adapter dropped
-// without a word, so the hook there fired on EVERY tool call and only the worker's
-// own `*) allow ;;` branch kept it correct. The two acts below were already latent in
-// the residue (`permission-menu` · `dispatch-echo`); naming them moves the narrowing
-// to the adapter, which alone knows which of its tools performs the act. Each adapter
-// computes its own ⟨native event, native selector⟩ pair, and one that can fire an act
-// but not narrow it now SAYS SO through the projection's warnings.
+// claude tool names on a harness-agnostic shape, which an adapter that could not
+// narrow by tool name dropped without a word, so the hook there fired on EVERY tool
+// call and only the worker's own `*) allow ;;` branch kept it correct. The two acts
+// below were already latent in the residue (`permission-menu` · `dispatch-echo`);
+// naming them moves the narrowing to the adapter, which alone knows which of its
+// tools performs the act. Each adapter computes its own ⟨native event, native
+// selector⟩ pair, and one that can fire an act but not narrow it now SAYS SO through
+// the projection's warnings.
 // `test/hook-rule-boundary.test.ts` byte-locks the worker;
 // `test/hook-act-selector.test.ts` holds the seam.
 export const stanceGuardrailPre = {
     id: 'stance-guardrail-pre',
     residue: 'structural-refusal ↾ mid-turn tool-call · deny-before-fire ⟨intent-driven-expert-collapse⟩ ⟨permission-menu · dispatch-echo ⟨literal-transcription ∄ extracted-intent⟩⟩ · pass ⟨reserved · irreversible-outward-consent · substantive-dispatch · intent-ambiguity ↦ elicit⟩ · shared judge-backend ⟨sibling⟩ · loop-safe ⟨re-entry-cap : ¬deny identical twice⟩',
     substrate: 'harness',
+    // Bound by the same composition as its turn-end twin: the stance it enforces is the
+    // one `handoff` declares.
+    binds: { dimension: 'autonomy', value: anchorOf(handoff) },
     order: 1,
     events: ['operator.consult.pre', 'subagent.dispatch.pre'],
     entry: 'stance-guardrail-pre.sh',
@@ -49,22 +55,85 @@ export const stanceGuardrailPre = {
 #   - SCOPE-ENROLLED, exactly as its twin: a scope carrying a stance manifest is judged and
 #     every other scope is silent. No repo opt-in, no allowlist — the projection that places a
 #     persona also enrolls it, and declining the guard means declining the persona.
-#   - FAILS OPEN. Any error (no jq, judge failure, bad input) -> exit 0 (allow the call).
+#   - FAILS OPEN, NEVER SILENTLY. Any error (no jq, no input, judge failure, unparseable verdict,
+#     unexpected error) -> exit 0 (allow the call), and the call goes through WITH A NOTICE the
+#     operator reads (\`say\`: Claude Code's JSON \`systemMessage\`, omp's relayed line) naming this
+#     guard and why it could not judge. Silence is reserved for "judged, pass" and "not enrolled".
 #   - LOOP-SAFE. A re-entry cap: never deny an identical tool_input twice (there is no
-#     stop_hook_active analog for PreToolUse), so it can never wedge a call.
-#   - OBSERVABLE. Judge failures/timeouts are logged (fails open, but a miss is visible).
+#     stop_hook_active analog for PreToolUse), so it can never wedge a call. The second,
+#     identical call goes through unjudged, and says so.
+#   - OBSERVABLE. Every notice is also a line in the miss log.
 #
 # INPUT  : Claude Code PreToolUse hook JSON on stdin (tool_name, tool_input, agent_type
 #          [subagents], session_id, cwd, ...).
 # OUTPUT : on collapse -> stdout
 #          {"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny",
 #           "permissionDecisionReason":"..."}} + exit 0.
-#          otherwise -> no stdout + exit 0 (allow the call).
+#          judged, pass -> no stdout + exit 0 (allow the call).
+#          let through with no verdict -> the notice \`say\` prints + exit 0 (allow the call).
 #
-# POSIX sh. Depends on: jq. Missing jq -> fail open.
+# POSIX sh. Depends on: jq. Missing jq -> the guard says so and allows the call.
 
 set -eu
 
+# WHAT AN OPERATOR READS WHEN THE GUARD CANNOT JUDGE, defined before anything that needs a
+# command: the first thing that can be missing is \`jq\`, and a worker run with a PATH holding
+# little beyond \`sh\` and \`cat\` must still say it did not judge, so \`esc\`, \`say\` and \`open\`
+# are builtins only and nothing external runs above the jq check.
+#
+# Claude Code shows the operator a hook's JSON \`systemMessage\` and NOT its plain stdout on
+# exit 0. omp's extension bridge reads the worker's plain stdout and relays a line naming this
+# guard and DARK to the session, and would relay a JSON object as raw JSON — hence one form per
+# harness, chosen at projection by the harness's own name.
+esc() {
+	_in="$1"
+	_out=""
+	_nl="$(printf '\\nx')"
+	_nl="\${_nl%x}"
+	_tab="$(printf '\\t')"
+	_cr="$(printf '\\r')"
+	while [ -n "$_in" ]; do
+		_rest="\${_in#?}"
+		_c="\${_in%"$_rest"}"
+		case "$_c" in
+			'\\') _c='\\\\' ;;
+			'"') _c='\\"' ;;
+			"$_nl") _c='\\n' ;;
+			"$_tab") _c='\\t' ;;
+			"$_cr") _c='\\r' ;;
+		esac
+		_out="$_out$_c"
+		_in="$_rest"
+	done
+	printf '%s' "$_out"
+}
+say() {
+	case "{{fact:harness-name}}" in
+		claude) printf '{"systemMessage":"%s"}\\n' "$(esc "$1")" ;;
+		*) printf '%s\\n' "$1" ;;
+	esac
+}
+
+allow() { exit 0; }  # emit nothing; the tool call proceeds.
+
+# A verdict and a failure are different facts and silence carries only one of them: \`allow\`
+# means "judged, pass" or "not this guard's call", \`open\` means "could not judge" — the call
+# still proceeds, and the operator is told.
+open() {
+	[ -z "\${LOG:-}" ] || printf '%s\\n' "open: $1 tool=\${tool_name:-?} agent=\${agent_type:-?}" >> "$LOG" 2>/dev/null || true
+	say "STANCE GUARDRAIL (pre) — DARK: $1. This call was NOT judged; the absence of a deny is an absence of a verdict, not a clean one."
+	exit 0
+}
+
+# A PreToolUse hook must never break a session. An unexpected error (a nonzero status reaching
+# the trap) is let through AND SAID; every deliberate \`exit 0\` arrives with status 0.
+trap 'rc=$?; [ "$rc" -eq 0 ] || open "an unexpected error stopped it (exit status $rc)"; exit 0' EXIT
+
+# --- read hook input ------------------------------------------------------------------------
+input="$(cat)"
+[ -n "$input" ] || open "the hook received no input"
+command -v jq >/dev/null 2>&1 || open "jq is not installed, so the hook payload cannot be read"
+
 # The sibling Stop hook's deployed dir owns the SHARED judge + rubric (deployed
 # together, as siblings under the SAME hooks root).
 #
@@ -87,17 +156,6 @@ RUBRIC="\${STANCE_RUBRIC:-$NEUTRAL_ROOT/stance-guardrail/stance-judge-prompt.md}
 JUDGE_CMD="\${STANCE_JUDGE_CMD:-sh $JUDGE_DIR/stance-judge.sh}"
 LOG="\${STANCE_GUARD_LOG:-$SELF_DIR/misses.log}"
 
-# A PreToolUse hook must never break a session. Trap any unexpected error -> allow.
-trap 'exit 0' EXIT
-
-allow() { exit 0; }  # emit nothing; the tool call proceeds.
-note() { printf '%s\\n' "$1" >> "$LOG" 2>/dev/null || true; }
-
-# --- read hook input ------------------------------------------------------------------------
-input="$(cat)"
-[ -n "$input" ] || allow
-command -v jq >/dev/null 2>&1 || allow  # no jq -> cannot parse -> fail open
-
 # The per-repo opt-in is GONE, for the reason its twin states: it asked whether a guard may run in
 # a DIRECTORY, and a stance belongs to the agent, not the checkout. \`cwd\` survives it — the worker
 # still runs where the session runs.
@@ -108,16 +166,23 @@ cwd="$(printf '%s' "$input" | jq -r '.cwd // empty' 2>/dev/null || true)"
 # The twin of the turn-end guard's gate, and inverted for the same reason: an allowlist here was
 # a runtime self-filter over an enrollment the corpus already derives, and it had drifted the way
 # such a list always drifts. Presence of a manifest in this persona's own scope IS enrollment.
-# Absent → silence, never an error, so an unenrolled launch is untouched.
+# Absent → silence, never an error, so an unenrolled launch is untouched. The scope is the one
+# the harness hands over: \`stance_scope\` where a dispatcher sits in the persona's own scope (omp),
+# else the persona directory of the agent the payload NAMES (\`agent_type\`, Claude Code — none on a
+# bare session) under this harness's home, one hop above the hooks root. No agent list here.
 stance_scope="$(printf '%s' "$input" | jq -r '.stance_scope // empty' 2>/dev/null || true)"
-[ -n "$stance_scope" ] || allow
-manifest="$stance_scope/stance/manifest.json"
+if [ -z "$stance_scope" ]; then
+	named="$(printf '%s' "$input" | jq -r '.agent_type // empty' 2>/dev/null || true)"
+	case "$named" in '' | */* | . | ..) allow ;; esac
+	stance_scope="$(dirname -- "$HOOKS_ROOT")/{{fact:harness-persona-root}}/$named"
+fi
+manifest="$stance_scope/{{fact:stance-manifest}}"
 [ -f "$manifest" ] || allow
 agent_type="$(jq -r '.agent // empty' "$manifest" 2>/dev/null || true)"
 
 # --- extract the judged payload, branched by tool -------------------------------------------
 tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty' 2>/dev/null || true)"
-[ -n "$tool_name" ] || allow
+[ -n "$tool_name" ] || open "the payload names no tool, so there is no call to judge"
 
 case "$tool_name" in
 	AskUserQuestion)
@@ -134,10 +199,10 @@ case "$tool_name" in
 		body="$(printf '%s' "$input" | jq -r '.tool_input.prompt // .tool_input.message // .tool_input.description // ""' 2>/dev/null || true)"
 		payload="$tool_name dispatch (the delegate prompt/message): $body" ;;
 	*)
-		allow ;;  # DEFENCE IN DEPTH, and on some harnesses the only narrowing there is:
-		          # claude's adapter computes a selector from the act and this never fires;
-		          # codex has no subject selector, so its projection WARNS and this branch
-		          # is what keeps the guard off every other tool call.
+		allow ;;  # DEFENCE IN DEPTH: every supported adapter computes a selector from the
+		          # act, so this never fires there. A harness that could fire the act but
+		          # not narrow it would WARN in projection, and this branch is what would
+		          # keep the guard off every other tool call.
 esac
 
 [ -n "\${body:-}" ] || allow  # nothing judgeable -> allow
@@ -147,7 +212,7 @@ esac
 session_id="$(printf '%s' "$input" | jq -r '.session_id // "nosession"' 2>/dev/null || echo nosession)"
 sig="$(printf '%s' "$input" | jq -c '.tool_input' 2>/dev/null | cksum | cut -d' ' -f1 2>/dev/null || echo 0)"
 seen="\${TMPDIR:-/tmp}/.stance-pre-$session_id-$sig"
-[ -f "$seen" ] && allow  # already denied this exact input once -> let it through
+[ -f "$seen" ] && open "this exact call was already denied once, so the re-entry cap lets it through unjudged"
 
 # --- judge (SHARED backend + rubric) --------------------------------------------------------
 # The same out-of-process seam the Stop worker carries, and for the same reason: a
@@ -159,19 +224,17 @@ if [ -n "\${STANCE_EMIT_PAYLOAD:-}" ]; then
 fi
 if [ -n "\${STANCE_VERDICT_FILE:-}" ]; then
 	verdict="$(cat "\${STANCE_VERDICT_FILE}" 2>/dev/null || true)"
-	[ -n "$verdict" ] || {
-		note "$(date -u +%Y-%m-%dT%H:%M:%SZ) judge-empty tool=$tool_name agent=\${agent_type:-?}"
-		allow
-	}
+	[ -n "$verdict" ] || open "the judge did not answer"
 else
-	verdict="$(printf '%s' "$payload" | $JUDGE_CMD "$RUBRIC" 2>/dev/null)" || {
-		note "$(date -u +%Y-%m-%dT%H:%M:%SZ) judge-fail tool=$tool_name agent=\${agent_type:-?}"
-		allow
-	}
+	verdict="$(printf '%s' "$payload" | $JUDGE_CMD "$RUBRIC" 2>/dev/null)" || open "the judge did not answer"
 fi
 
-decision="$(printf '%s\\n' "$verdict" | sed -n 's/^VERDICT:[[:space:]]*//p' | head -1)"
-[ "$decision" = "BLOCK" ] || allow  # PASS, empty, or anything but BLOCK -> allow
+decision="$(printf '%s\\n' "$verdict" | sed -n 's/^VERDICT:[[:space:]]*//p' | head -1 | sed 's/[[:space:]]*$//')"
+case "$decision" in
+	PASS) allow ;;  # judged, pass: the one silent verdict
+	BLOCK) ;;
+	*) open "the judge's verdict was unparseable (no VERDICT: PASS or VERDICT: BLOCK line)" ;;
+esac
 
 reason="$(printf '%s\\n' "$verdict" | sed -n 's/^REASON:[[:space:]]*//p' | head -1)"
 [ -n "$reason" ] || reason="This tool call collapsed out of the intent-driven-expert stance."

package/dist/hooks/stance-guardrail-pre.js.map

@@ -1 +1 @@
-{"version":3,"file":"stance-guardrail-pre.js","sourceRoot":"","sources":["../../src/hooks/stance-guardrail-pre.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,mFAAmF;AACnF,uFAAuF;AACvF,SAAS;AACT,wFAAwF;AACxF,6FAA6F;AAC7F,0FAA0F;AAC1F,uFAAuF;AACvF,qEAAqE;AACrE,EAAE;AACF,wEAAwE;AACxE,sFAAsF;AACtF,iFAAiF;AACjF,mFAAmF;AACnF,sFAAsF;AACtF,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,mEAAmE;AACnE,2DAA2D;AAC3D,mDAAmD;AAEnD,MAAM,CAAC,MAAM,kBAAkB,GAAa;IAC1C,EAAE,EAAE,sBAAsB;IAC1B,OAAO,EACL,iWAAiW;IACnW,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;IACzD,KAAK,EAAE,yBAAyB;IAChC,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,0DAA0D;YACtE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4Jd;SACI;KACF;CACF,CAAC"}
+{"version":3,"file":"stance-guardrail-pre.js","sourceRoot":"","sources":["../../src/hooks/stance-guardrail-pre.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAG5D,sFAAsF;AACtF,mFAAmF;AACnF,uFAAuF;AACvF,SAAS;AACT,wFAAwF;AACxF,6FAA6F;AAC7F,0FAA0F;AAC1F,uFAAuF;AACvF,qEAAqE;AACrE,EAAE;AACF,wEAAwE;AACxE,sFAAsF;AACtF,iFAAiF;AACjF,oFAAoF;AACpF,oFAAoF;AACpF,kFAAkF;AAClF,iFAAiF;AACjF,8EAA8E;AAC9E,qFAAqF;AACrF,6BAA6B;AAC7B,2DAA2D;AAC3D,mDAAmD;AAEnD,MAAM,CAAC,MAAM,kBAAkB,GAAa;IAC1C,EAAE,EAAE,sBAAsB;IAC1B,OAAO,EACL,iWAAiW;IACnW,SAAS,EAAE,SAAS;IACpB,oFAAoF;IACpF,0BAA0B;IAC1B,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE;IAC1D,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;IACzD,KAAK,EAAE,yBAAyB;IAChC,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,0DAA0D;YACtE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqNd;SACI;KACF;CACF,CAAC"}