@devrik-tools/claude-gates 0.4.0 → 0.7.0

package/plugins/gates/hooks/gates/forge-flow/index.mjs

@@ -1,134 +1,134 @@
-// forge-flow — the enforcer forge cannot be. A forge MCP directs a pipeline but cannot
-// intercept Edit/Write/Bash, so nothing makes you actually use it. This gate closes that
-// hole: in a project that ADOPTED forge, a code-mutating action is denied unless there is
-// an active forge run for this project — so every change goes through the pipeline and you
-// always know which phase you are in.
-//
-// justification: no existing tool covers this. A forge MCP audit (see memory
-// forge-mcp-auditoria-flujo) confirmed the structural hole: an MCP cannot gate other tools;
-// only a Claude Code PreToolUse hook can. This is that hook.
-//
-// ── When it acts (never surprises you) ──────────────────────────────────────────────
-// Only when the project adopted forge — a marker on disk (.ai/forge.json, or `forge: true`
-// in .ai/config.json). In any other project it stays silent. Off by default in the
-// registry, so it never fires unless a project turns it on.
-//
-// ── How it checks (deterministic, no judgment) ──────────────────────────────────────
-// forge persists its runs in a SQLite DB (global by default). This gate reads that DB with
-// node:sqlite (a Node built-in — no npm, contract intact) and looks for an active run whose
-// cwd matches this project. Absent → deny with an actionable message. The DB unreadable or
-// node:sqlite unavailable → allow (fail open: a broken lookup must not block all work).
-
-import { existsSync, readFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { runGate, deny, warn, toolInGroups } from '../../lib/hook-io.mjs';
-
-const GATE_ID = 'forge-flow';
-const CONFIG_KEY = 'requireForgeRunToEdit';
-
-// Any code-mutating surface: native write/shell AND their MCP equivalents. `execution`
-// already unions write+shell+mcp__ide__executeCode, and toolInGroups adds the mcp__* signal
-// match — so an MCP filesystem-write or shell-exec tool no longer slips past the enforcer.
-const ACTING_GROUPS = ['execution'];
-const PROJECT_ROOT_MARKERS = ['.git', '.ai'];
-const DEFAULT_FORGE_DB = join('.forge', 'forge-mcp.db');
-const FORGE_MARKER_FILE = join('.ai', 'forge.json');
-const PROJECT_CONFIG_FILE = join('.ai', 'config.json');
-
-function projectRootOf(startDirectory) {
-  let current = startDirectory;
-  while (true) {
-    if (
-      PROJECT_ROOT_MARKERS.some((marker) => existsSync(join(current, marker)))
-    ) {
-      return current;
-    }
-    const parent = dirname(current);
-    if (parent === current) return null;
-    current = parent;
-  }
-}
-
-function readJson(path) {
-  try {
-    return JSON.parse(readFileSync(path, 'utf8'));
-  } catch {
-    return null;
-  }
-}
-
-/** True when this project opted into forge: a marker file, or forge:true in .ai/config.json. */
-function projectAdoptedForge(root) {
-  if (existsSync(join(root, FORGE_MARKER_FILE))) return true;
-  const config = readJson(join(root, PROJECT_CONFIG_FILE));
-  return config?.forge === true;
-}
-
-/**
- * True when forge has an active run whose cwd is this project. Reads forge's SQLite DB with
- * node:sqlite (imported dynamically so an older Node without it degrades instead of
- * throwing). Any failure — module missing, DB absent, locked, unreadable, schema drift —
- * returns true: the gate must fail OPEN, since a broken lookup must never block every edit.
- */
-// Returns one of three verdicts, so a broken lookup no longer masquerades as "run present":
-//   { state: 'active' }   → a run for this project exists; allow.
-//   { state: 'none' }     → DB readable, no active run for this project; deny.
-//   { state: 'unknown', reason } → DB absent/locked/corrupt/schema-drift, or node:sqlite
-//                                   missing; we cannot tell. Warn (visible) but allow, so a
-//                                   broken DB never blocks all work AND never disables the
-//                                   enforcer silently — the earlier code returned true here,
-//                                   which looked identical to "run present".
-async function forgeRunState(root, forgeDatabasePath) {
-  if (!existsSync(forgeDatabasePath)) return { state: 'none' }; // no DB yet → no runs → deny
-  try {
-    const { DatabaseSync } = await import('node:sqlite');
-    const database = new DatabaseSync(forgeDatabasePath, { readOnly: true });
-    const rows = database
-      .prepare("SELECT cwd FROM runs WHERE status = 'active'")
-      .all();
-    database.close();
-    return rows.some((row) => String(row.cwd) === root)
-      ? { state: 'active' }
-      : { state: 'none' };
-  } catch (error) {
-    return { state: 'unknown', reason: error?.message ?? String(error) };
-  }
-}
-
-const DENY_MESSAGE =
-  'This project uses forge, but there is no active forge run for it. Every change should ' +
-  'go through the pipeline so the next step is always clear. Start or resume a run ' +
-  '(forge_start / forge_next) before editing — that is how forge tells you which phase ' +
-  'you are in. To work outside the pipeline, turn this gate off in .ai/config.json.';
-
-runGate(
-  {
-    id: GATE_ID,
-    configKey: CONFIG_KEY,
-    enabledByDefault: false,
-    defaultParams: { forgeDatabasePath: join(homedir(), DEFAULT_FORGE_DB) },
-  },
-  async ({ toolName, parameters }) => {
-    if (!toolInGroups(toolName, ACTING_GROUPS)) return;
-
-    const root = projectRootOf(process.cwd());
-    if (!root) return; // no project
-    if (!projectAdoptedForge(root)) return; // project did not opt into forge
-
-    const forgeDatabasePath =
-      parameters.forgeDatabasePath ?? join(homedir(), DEFAULT_FORGE_DB);
-    const result = await forgeRunState(root, forgeDatabasePath);
-
-    if (result.state === 'active') return; // pipeline is running → allow
-    if (result.state === 'none') deny(GATE_ID, DENY_MESSAGE); // no run → block
-    // state 'unknown': the DB could not be read. Allow so a broken lookup never freezes work,
-    // but surface it loudly — a silent allow here would disable the enforcer without a trace.
-    warn(
-      GATE_ID,
-      `forge enforcement is degraded: the forge DB could not be read (${result.reason}). ` +
-        'Allowing this action, but the pipeline is NOT being enforced. Check that forge is ' +
-        `installed and ${forgeDatabasePath} is readable, or turn this gate off if intended.`,
-    );
-  },
-);
+// forge-flow — the enforcer forge cannot be. A forge MCP directs a pipeline but cannot
+// intercept Edit/Write/Bash, so nothing makes you actually use it. This gate closes that
+// hole: in a project that ADOPTED forge, a code-mutating action is denied unless there is
+// an active forge run for this project — so every change goes through the pipeline and you
+// always know which phase you are in.
+//
+// justification: no existing tool covers this. A forge MCP audit (see memory
+// forge-mcp-auditoria-flujo) confirmed the structural hole: an MCP cannot gate other tools;
+// only a Claude Code PreToolUse hook can. This is that hook.
+//
+// ── When it acts (never surprises you) ──────────────────────────────────────────────
+// Only when the project adopted forge — a marker on disk (.ai/forge.json, or `forge: true`
+// in .ai/config.json). In any other project it stays silent. Off by default in the
+// registry, so it never fires unless a project turns it on.
+//
+// ── How it checks (deterministic, no judgment) ──────────────────────────────────────
+// forge persists its runs in a SQLite DB (global by default). This gate reads that DB with
+// node:sqlite (a Node built-in — no npm, contract intact) and looks for an active run whose
+// cwd matches this project. Absent → deny with an actionable message. The DB unreadable or
+// node:sqlite unavailable → allow (fail open: a broken lookup must not block all work).
+
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { runGate, deny, warn, toolInGroups } from '../../lib/hook-io.mjs';
+
+const GATE_ID = 'forge-flow';
+const CONFIG_KEY = 'requireForgeRunToEdit';
+
+// Any code-mutating surface: native write/shell AND their MCP equivalents. `execution`
+// already unions write+shell+mcp__ide__executeCode, and toolInGroups adds the mcp__* signal
+// match — so an MCP filesystem-write or shell-exec tool no longer slips past the enforcer.
+const ACTING_GROUPS = ['execution'];
+const PROJECT_ROOT_MARKERS = ['.git', '.ai'];
+const DEFAULT_FORGE_DB = join('.forge', 'forge-mcp.db');
+const FORGE_MARKER_FILE = join('.ai', 'forge.json');
+const PROJECT_CONFIG_FILE = join('.ai', 'config.json');
+
+function projectRootOf(startDirectory) {
+  let current = startDirectory;
+  while (true) {
+    if (
+      PROJECT_ROOT_MARKERS.some((marker) => existsSync(join(current, marker)))
+    ) {
+      return current;
+    }
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/** True when this project opted into forge: a marker file, or forge:true in .ai/config.json. */
+function projectAdoptedForge(root) {
+  if (existsSync(join(root, FORGE_MARKER_FILE))) return true;
+  const config = readJson(join(root, PROJECT_CONFIG_FILE));
+  return config?.forge === true;
+}
+
+/**
+ * True when forge has an active run whose cwd is this project. Reads forge's SQLite DB with
+ * node:sqlite (imported dynamically so an older Node without it degrades instead of
+ * throwing). Any failure — module missing, DB absent, locked, unreadable, schema drift —
+ * returns true: the gate must fail OPEN, since a broken lookup must never block every edit.
+ */
+// Returns one of three verdicts, so a broken lookup no longer masquerades as "run present":
+//   { state: 'active' }   → a run for this project exists; allow.
+//   { state: 'none' }     → DB readable, no active run for this project; deny.
+//   { state: 'unknown', reason } → DB absent/locked/corrupt/schema-drift, or node:sqlite
+//                                   missing; we cannot tell. Warn (visible) but allow, so a
+//                                   broken DB never blocks all work AND never disables the
+//                                   enforcer silently — the earlier code returned true here,
+//                                   which looked identical to "run present".
+async function forgeRunState(root, forgeDatabasePath) {
+  if (!existsSync(forgeDatabasePath)) return { state: 'none' }; // no DB yet → no runs → deny
+  try {
+    const { DatabaseSync } = await import('node:sqlite');
+    const database = new DatabaseSync(forgeDatabasePath, { readOnly: true });
+    const rows = database
+      .prepare("SELECT cwd FROM runs WHERE status = 'active'")
+      .all();
+    database.close();
+    return rows.some((row) => String(row.cwd) === root)
+      ? { state: 'active' }
+      : { state: 'none' };
+  } catch (error) {
+    return { state: 'unknown', reason: error?.message ?? String(error) };
+  }
+}
+
+const DENY_MESSAGE =
+  'This project uses forge, but there is no active forge run for it. Every change should ' +
+  'go through the pipeline so the next step is always clear. Start or resume a run ' +
+  '(forge_start / forge_next) before editing — that is how forge tells you which phase ' +
+  'you are in. To work outside the pipeline, turn this gate off in .ai/config.json.';
+
+runGate(
+  {
+    id: GATE_ID,
+    configKey: CONFIG_KEY,
+    enabledByDefault: false,
+    defaultParams: { forgeDatabasePath: join(homedir(), DEFAULT_FORGE_DB) },
+  },
+  async ({ toolName, parameters }) => {
+    if (!toolInGroups(toolName, ACTING_GROUPS)) return;
+
+    const root = projectRootOf(process.cwd());
+    if (!root) return; // no project
+    if (!projectAdoptedForge(root)) return; // project did not opt into forge
+
+    const forgeDatabasePath =
+      parameters.forgeDatabasePath ?? join(homedir(), DEFAULT_FORGE_DB);
+    const result = await forgeRunState(root, forgeDatabasePath);
+
+    if (result.state === 'active') return; // pipeline is running → allow
+    if (result.state === 'none') deny(GATE_ID, DENY_MESSAGE); // no run → block
+    // state 'unknown': the DB could not be read. Allow so a broken lookup never freezes work,
+    // but surface it loudly — a silent allow here would disable the enforcer without a trace.
+    warn(
+      GATE_ID,
+      `forge enforcement is degraded: the forge DB could not be read (${result.reason}). ` +
+        'Allowing this action, but the pipeline is NOT being enforced. Check that forge is ' +
+        `installed and ${forgeDatabasePath} is readable, or turn this gate off if intended.`,
+    );
+  },
+);

package/plugins/gates/hooks/gates/implementation-pipeline/index.mjs

@@ -1,187 +1,187 @@
-// implementation-pipeline — denies a delegation that sends a builder subagent straight
-// to writing code without the prompt declaring the pipeline stages around it:
-// definition (where the context came from), writing's own verification plan, and a
-// separate reviewer for validation/QA/closure. Migrated from
-// ~/.claude/hooks/guard-pipeline-de-implementacion.mjs.
-//
-// ── What a project can configure (params) ───────────────────────────────────────────
-//   builderSubagents   subagent types that count as builders — the ones this gate
-//                       holds to the pipeline. Replaces the built-in list wholesale.
-//   exemptSubagents     subagent types exempt outright: read-only pipeline stages that
-//                       cannot be required to declare a pipeline around themselves.
-//                       Replaces the built-in list wholesale.
-// The defaults live here, in the source, so a project reads them and knows exactly what
-// its override replaces.
-//
-// ── Off by default, and quiet outside its narrow trigger ───────────────────────────
-// This gate only evaluates a delegation whose prompt declares a STANDARD/HIGH-RISK
-// level, uses an implementation verb, targets a builder subagent, and is not about the
-// harness itself. A prompt that only describes work, or that is read-only/exploratory,
-// never reaches the check.
-
-import {
-  runGate,
-  deny,
-  toolInGroups,
-  delegationPromptOf,
-} from '../../lib/hook-io.mjs';
-
-const GATE_ID = 'implementation-pipeline';
-const CONFIG_KEY = 'requireImplementationPipeline';
-
-const DEFAULT_BUILDER_SUBAGENTS = [
-  'frontend',
-  'backend',
-  'worker',
-  'worker-senior',
-  'general-purpose',
-];
-
-const DEFAULT_EXEMPT_SUBAGENTS = [
-  'scout',
-  'explore',
-  'plan',
-  'revision',
-  'contraste',
-  'test-planner',
-  'qa',
-  'ui',
-  'ux',
-];
-
-function withWordBoundary(alternation) {
-  return new RegExp(
-    `(?:^|[^\\p{L}\\p{N}_])(?:${alternation})(?:[^\\p{L}\\p{N}_]|$)`,
-    'iu',
-  );
-}
-
-const IMPLEMENTATION_VERBS = withWordBoundary(
-  'implementa|implementar|implement(á|é)|agreg(a|á)|agregar|añad(e|í)|añadir|cre(a|á)|crear|' +
-    'arregl(a|á)|arreglar|cambi(a|á)|cambiar|migr(a|á)|migrar|' +
-    'corrige|corregir|correg(í|ir)|constru(ye|í)|construir|modific(a|á)|modificar|' +
-    'refactoriz(a|á)|refactorizar|elimin(a|á)|eliminar|reescrib(e|í)|reescribir|desplieg(a|á)|desplegar|' +
-    'escrib(í|e)|escribir|implement\\w*|writ(?:e|ing)|creat\\w*|fix\\w*|build\\w*|refactor\\w*|migrat\\w*|' +
-    'add\\w*|remov\\w*|delet\\w*|modify|modifies|modifying|rewrit\\w*',
-);
-
-/** Declared LEVEL near the word "level"/"classification" in Spanish or English, matching
- * the plugin-wide convention (see risk-level.mjs). */
-const DEMANDING_LEVEL_PATTERN =
-  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\b(STANDARD|HIGH-RISK)\b/iu;
-const EXEMPT_LEVEL_PATTERN =
-  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\b(QUESTION|MICRO)\b/iu;
-const HIGH_RISK_PATTERN =
-  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\bHIGH-RISK\b/iu;
-
-const HARNESS_PATTERN =
-  /(\.claude[\\/]|hooks[\\/]|plugins[\\/]gates|settings\.json|[\\/]agents[\\/]\w|[\\/]rules[\\/]\w|[\\/]skills[\\/]\w)/i;
-
-// Several small patterns instead of one long alternation: a single big regex here
-// tripped the linter's regex-complexity limit. Any one matching counts as declared.
-const REVIEWER_NAME_PATTERN =
-  /\b(reviewer|revisor|separate review|revisi[oó]n separada|contraste|auditor)\b/i;
-const REVIEWER_LABEL_PATTERN = /(review|revisi[oó]n)\s*:/i;
-const REVIEWER_ACTION_EN_PATTERN =
-  /\breview\s+(?:the\s+)?(?:diff|result|work)\b/i;
-const REVIEWER_ACTION_ES_PATTERN =
-  /\brevisa\s+(?:el\s+)?(?:diff|resultado|trabajo)\b/i;
-const REVIEWER_CODE_REVIEW_PATTERN = /code.review/i;
-
-function reviewerStageDeclared(prompt) {
-  return (
-    REVIEWER_NAME_PATTERN.test(prompt) ||
-    REVIEWER_LABEL_PATTERN.test(prompt) ||
-    REVIEWER_ACTION_EN_PATTERN.test(prompt) ||
-    REVIEWER_ACTION_ES_PATTERN.test(prompt) ||
-    REVIEWER_CODE_REVIEW_PATTERN.test(prompt)
-  );
-}
-
-const DEFINITION_PATTERN =
-  /\b(scout|reconnaissance|reconocimiento|prior exploration|explora(?:ci[oó]n)? previa|verified context|contexto verificado|asserts\.md|brief\.md)\b/i;
-const WRITING_PATTERN =
-  /\b(test|tests|prueba|pruebas|vitest|jest|playwright|typecheck|lint|verification|verificaci[oó]n|verification criteria)\b/i;
-
-/** The three pipeline stages this gate requires be declared, in this order. */
-const REQUIRED_STAGES = [
-  {
-    id: 'definition',
-    isDeclared: (prompt) => DEFINITION_PATTERN.test(prompt),
-    missing:
-      'DEFINITION: does not declare where the context came from (a prior scout, read-only exploration, or an already-written asserts/brief).',
-    line: 'Verified context: <path to the cited asserts/brief> — or: a prior scout ran, findings at <path>.',
-  },
-  {
-    id: 'writing',
-    isDeclared: (prompt) => WRITING_PATTERN.test(prompt),
-    missing:
-      'WRITING: does not declare what is verified nor with what command. A builder does not validate its own work without a criterion written beforehand.',
-    line: 'Verification: <exact command> and what is expected. Anything that cannot run is reported OMITTED, never PASS.',
-  },
-  {
-    id: 'reviewer',
-    isDeclared: reviewerStageDeclared,
-    missing:
-      'REVIEWER: does not declare who reviews the result. Whoever implements does not validate their own work.',
-    line: 'Review: the coordinator reviews the diff and the evidence before closing — or: a read-only `revision`/`contraste` agent reviews it.',
-  },
-];
-
-function isExempt(toolInput, prompt, builderSubagents, exemptSubagents) {
-  const subagentType = String(
-    toolInput.subagent_type ?? toolInput.subagentType ?? '',
-  ).toLowerCase();
-  if (exemptSubagents.includes(subagentType)) return true;
-  // An unknown type is not assumed to be a builder: the safe side here is not to
-  // invent requirements for agents this gate cannot classify.
-  if (subagentType && !builderSubagents.includes(subagentType)) return true;
-  if (EXEMPT_LEVEL_PATTERN.test(prompt)) return true;
-  if (!DEMANDING_LEVEL_PATTERN.test(prompt)) return true;
-  if (!IMPLEMENTATION_VERBS.test(prompt)) return true;
-  if (HARNESS_PATTERN.test(prompt)) return true;
-  return false;
-}
-
-runGate(
-  {
-    id: GATE_ID,
-    configKey: CONFIG_KEY,
-    enabledByDefault: false,
-    defaultParams: {
-      builderSubagents: DEFAULT_BUILDER_SUBAGENTS,
-      exemptSubagents: DEFAULT_EXEMPT_SUBAGENTS,
-    },
-  },
-  ({ toolName, toolInput, parameters }) => {
-    if (!toolInGroups(toolName, ['delegation'])) return;
-
-    const prompt = delegationPromptOf(toolInput);
-    if (!prompt.trim()) return;
-
-    const builderSubagents =
-      parameters.builderSubagents ?? DEFAULT_BUILDER_SUBAGENTS;
-    const exemptSubagents =
-      parameters.exemptSubagents ?? DEFAULT_EXEMPT_SUBAGENTS;
-    if (isExempt(toolInput, prompt, builderSubagents, exemptSubagents)) return;
-
-    const missingStages = REQUIRED_STAGES.filter(
-      (stage) => !stage.isDeclared(prompt),
-    );
-    if (missingStages.length === 0) return;
-
-    const isHighRisk = HIGH_RISK_PATTERN.test(prompt);
-    const details = missingStages.map((stage) => stage.missing).join(' ');
-    const lines = missingStages.map((stage) => `  ${stage.line}`).join('\n');
-
-    deny(
-      GATE_ID,
-      `This delegation is going to build code but skips ${missingStages.length} pipeline ` +
-        `stage(s). ${details} ${
-          isHighRisk
-            ? 'In HIGH-RISK a separate reviewer is not negotiable. '
-            : ''
-        }PASTE THESE LINES INTO THE PROMPT AND RELAUNCH:\n${lines}`,
-    );
-  },
-);
+// implementation-pipeline — denies a delegation that sends a builder subagent straight
+// to writing code without the prompt declaring the pipeline stages around it:
+// definition (where the context came from), writing's own verification plan, and a
+// separate reviewer for validation/QA/closure. Migrated from
+// ~/.claude/hooks/guard-pipeline-de-implementacion.mjs.
+//
+// ── What a project can configure (params) ───────────────────────────────────────────
+//   builderSubagents   subagent types that count as builders — the ones this gate
+//                       holds to the pipeline. Replaces the built-in list wholesale.
+//   exemptSubagents     subagent types exempt outright: read-only pipeline stages that
+//                       cannot be required to declare a pipeline around themselves.
+//                       Replaces the built-in list wholesale.
+// The defaults live here, in the source, so a project reads them and knows exactly what
+// its override replaces.
+//
+// ── Off by default, and quiet outside its narrow trigger ───────────────────────────
+// This gate only evaluates a delegation whose prompt declares a STANDARD/HIGH-RISK
+// level, uses an implementation verb, targets a builder subagent, and is not about the
+// harness itself. A prompt that only describes work, or that is read-only/exploratory,
+// never reaches the check.
+
+import {
+  runGate,
+  deny,
+  toolInGroups,
+  delegationPromptOf,
+} from '../../lib/hook-io.mjs';
+
+const GATE_ID = 'implementation-pipeline';
+const CONFIG_KEY = 'requireImplementationPipeline';
+
+const DEFAULT_BUILDER_SUBAGENTS = [
+  'frontend',
+  'backend',
+  'worker',
+  'worker-senior',
+  'general-purpose',
+];
+
+const DEFAULT_EXEMPT_SUBAGENTS = [
+  'scout',
+  'explore',
+  'plan',
+  'revision',
+  'contraste',
+  'test-planner',
+  'qa',
+  'ui',
+  'ux',
+];
+
+function withWordBoundary(alternation) {
+  return new RegExp(
+    `(?:^|[^\\p{L}\\p{N}_])(?:${alternation})(?:[^\\p{L}\\p{N}_]|$)`,
+    'iu',
+  );
+}
+
+const IMPLEMENTATION_VERBS = withWordBoundary(
+  'implementa|implementar|implement(á|é)|agreg(a|á)|agregar|añad(e|í)|añadir|cre(a|á)|crear|' +
+    'arregl(a|á)|arreglar|cambi(a|á)|cambiar|migr(a|á)|migrar|' +
+    'corrige|corregir|correg(í|ir)|constru(ye|í)|construir|modific(a|á)|modificar|' +
+    'refactoriz(a|á)|refactorizar|elimin(a|á)|eliminar|reescrib(e|í)|reescribir|desplieg(a|á)|desplegar|' +
+    'escrib(í|e)|escribir|implement\\w*|writ(?:e|ing)|creat\\w*|fix\\w*|build\\w*|refactor\\w*|migrat\\w*|' +
+    'add\\w*|remov\\w*|delet\\w*|modify|modifies|modifying|rewrit\\w*',
+);
+
+/** Declared LEVEL near the word "level"/"classification" in Spanish or English, matching
+ * the plugin-wide convention (see risk-level.mjs). */
+const DEMANDING_LEVEL_PATTERN =
+  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\b(STANDARD|HIGH-RISK)\b/iu;
+const EXEMPT_LEVEL_PATTERN =
+  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\b(QUESTION|MICRO)\b/iu;
+const HIGH_RISK_PATTERN =
+  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\bHIGH-RISK\b/iu;
+
+const HARNESS_PATTERN =
+  /(\.claude[\\/]|hooks[\\/]|plugins[\\/]gates|settings\.json|[\\/]agents[\\/]\w|[\\/]rules[\\/]\w|[\\/]skills[\\/]\w)/i;
+
+// Several small patterns instead of one long alternation: a single big regex here
+// tripped the linter's regex-complexity limit. Any one matching counts as declared.
+const REVIEWER_NAME_PATTERN =
+  /\b(reviewer|revisor|separate review|revisi[oó]n separada|contraste|auditor)\b/i;
+const REVIEWER_LABEL_PATTERN = /(review|revisi[oó]n)\s*:/i;
+const REVIEWER_ACTION_EN_PATTERN =
+  /\breview\s+(?:the\s+)?(?:diff|result|work)\b/i;
+const REVIEWER_ACTION_ES_PATTERN =
+  /\brevisa\s+(?:el\s+)?(?:diff|resultado|trabajo)\b/i;
+const REVIEWER_CODE_REVIEW_PATTERN = /code.review/i;
+
+function reviewerStageDeclared(prompt) {
+  return (
+    REVIEWER_NAME_PATTERN.test(prompt) ||
+    REVIEWER_LABEL_PATTERN.test(prompt) ||
+    REVIEWER_ACTION_EN_PATTERN.test(prompt) ||
+    REVIEWER_ACTION_ES_PATTERN.test(prompt) ||
+    REVIEWER_CODE_REVIEW_PATTERN.test(prompt)
+  );
+}
+
+const DEFINITION_PATTERN =
+  /\b(scout|reconnaissance|reconocimiento|prior exploration|explora(?:ci[oó]n)? previa|verified context|contexto verificado|asserts\.md|brief\.md)\b/i;
+const WRITING_PATTERN =
+  /\b(test|tests|prueba|pruebas|vitest|jest|playwright|typecheck|lint|verification|verificaci[oó]n|verification criteria)\b/i;
+
+/** The three pipeline stages this gate requires be declared, in this order. */
+const REQUIRED_STAGES = [
+  {
+    id: 'definition',
+    isDeclared: (prompt) => DEFINITION_PATTERN.test(prompt),
+    missing:
+      'DEFINITION: does not declare where the context came from (a prior scout, read-only exploration, or an already-written asserts/brief).',
+    line: 'Verified context: <path to the cited asserts/brief> — or: a prior scout ran, findings at <path>.',
+  },
+  {
+    id: 'writing',
+    isDeclared: (prompt) => WRITING_PATTERN.test(prompt),
+    missing:
+      'WRITING: does not declare what is verified nor with what command. A builder does not validate its own work without a criterion written beforehand.',
+    line: 'Verification: <exact command> and what is expected. Anything that cannot run is reported OMITTED, never PASS.',
+  },
+  {
+    id: 'reviewer',
+    isDeclared: reviewerStageDeclared,
+    missing:
+      'REVIEWER: does not declare who reviews the result. Whoever implements does not validate their own work.',
+    line: 'Review: the coordinator reviews the diff and the evidence before closing — or: a read-only `revision`/`contraste` agent reviews it.',
+  },
+];
+
+function isExempt(toolInput, prompt, builderSubagents, exemptSubagents) {
+  const subagentType = String(
+    toolInput.subagent_type ?? toolInput.subagentType ?? '',
+  ).toLowerCase();
+  if (exemptSubagents.includes(subagentType)) return true;
+  // An unknown type is not assumed to be a builder: the safe side here is not to
+  // invent requirements for agents this gate cannot classify.
+  if (subagentType && !builderSubagents.includes(subagentType)) return true;
+  if (EXEMPT_LEVEL_PATTERN.test(prompt)) return true;
+  if (!DEMANDING_LEVEL_PATTERN.test(prompt)) return true;
+  if (!IMPLEMENTATION_VERBS.test(prompt)) return true;
+  if (HARNESS_PATTERN.test(prompt)) return true;
+  return false;
+}
+
+runGate(
+  {
+    id: GATE_ID,
+    configKey: CONFIG_KEY,
+    enabledByDefault: false,
+    defaultParams: {
+      builderSubagents: DEFAULT_BUILDER_SUBAGENTS,
+      exemptSubagents: DEFAULT_EXEMPT_SUBAGENTS,
+    },
+  },
+  ({ toolName, toolInput, parameters }) => {
+    if (!toolInGroups(toolName, ['delegation'])) return;
+
+    const prompt = delegationPromptOf(toolInput);
+    if (!prompt.trim()) return;
+
+    const builderSubagents =
+      parameters.builderSubagents ?? DEFAULT_BUILDER_SUBAGENTS;
+    const exemptSubagents =
+      parameters.exemptSubagents ?? DEFAULT_EXEMPT_SUBAGENTS;
+    if (isExempt(toolInput, prompt, builderSubagents, exemptSubagents)) return;
+
+    const missingStages = REQUIRED_STAGES.filter(
+      (stage) => !stage.isDeclared(prompt),
+    );
+    if (missingStages.length === 0) return;
+
+    const isHighRisk = HIGH_RISK_PATTERN.test(prompt);
+    const details = missingStages.map((stage) => stage.missing).join(' ');
+    const lines = missingStages.map((stage) => `  ${stage.line}`).join('\n');
+
+    deny(
+      GATE_ID,
+      `This delegation is going to build code but skips ${missingStages.length} pipeline ` +
+        `stage(s). ${details} ${
+          isHighRisk
+            ? 'In HIGH-RISK a separate reviewer is not negotiable. '
+            : ''
+        }PASTE THESE LINES INTO THE PROMPT AND RELAUNCH:\n${lines}`,
+    );
+  },
+);