@devrik-tools/claude-gates 0.6.0 → 0.7.1

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
       "name": "gates",
       "source": "./plugins/gates",
       "description": "PreToolUse gates: destructive-command blocks, protected paths, delegation/spec/quality rules, tool-discovery and forge-pipeline enforcement. Which gates run is decided by .ai/config.json (project) or ~/.claude/claude-gates/config.json (global).",
-      "version": "0.6.0"
+      "version": "0.7.1"
     },
     {
       "name": "tasks",
       "source": "./plugins/tasks",
       "description": "Deterministic task tracking: the model registers tasks via the CLI, a UserPromptSubmit hook reminds of open tasks every few messages, and a SessionStart hook lists active tasks when a session opens.",
-      "version": "0.6.0"
+      "version": "0.7.1"
     }
   ]
 }

package/README.es.md

@@ -30,7 +30,7 @@ npx @devrik-tools/claude-gates init
 
 Reinicia la sesión de Claude Code (o ejecuta `/plugin`) para que los hooks carguen.
 
-> **¿Por qué dos cosas?** El plugin **siempre trae los 40 gates**; la configuración decide
+> **¿Por qué dos cosas?** El plugin **siempre trae los 41 gates**; la configuración decide
 > **cuáles se ejecutan**. Así puedes prender uno sin reinstalar: es una línea en un JSON.
 
 ---
@@ -56,6 +56,12 @@ Si algún gate bloquea, la herramienta no se ejecuta.
 - **WARN**: la acción necesita criterio → el gate inyecta un aviso y deja seguir.
 - **Silencio**: el caso común. Un gate no molesta si no hay nada que objetar.
 
+Todo mensaje DENY/WARN lleva el prefijo `[configKey]` — el nombre exacto de la clave para
+buscar (o apagar/ajustar) bajo `"gates"` en `.ai/config.json`, por ejemplo
+`[blockPathsOutsideRootWhitelist] '...' no está en la whitelist.` significa que la
+configuración es `blockPathsOutsideRootWhitelist` en la tabla de abajo, no otro nombre que
+haya que adivinar o traducir desde un id corto de gate.
+
 Cada gate es **autocontenido** (solo Node built-ins, sin dependencias en tiempo de
 ejecución), así que funciona aunque instales uno suelto por fuera.
 
@@ -88,6 +94,7 @@ ejecución), así que funciona aunque instales uno suelto por fuera.
 |---|---|---|
 | `feature-catalog` | on | Una sola feature en progreso; cerrar exige asserts y revisión. |
 | `sdd-specs` | off | Exige requirements/design/tasks no vacíos antes de implementar. |
+| `brief-approved` | on | Exige una aprobación del usuario registrada (`status: approved` + cita) en el brief de la feature citada antes de implementar. |
 | `implementation-pipeline` | off | Exige declarar definición → escritura → validación → QA → cierre. |
 | `mandatory-flow` | off | Exige una tarea activa con contrato antes de implementar. |
 | `test-matrix` | off | Exige una matriz de tests (los tipos que el requerimiento vuelve obligatorios). |
@@ -128,7 +135,7 @@ ejecución), así que funciona aunque instales uno suelto por fuera.
 | `doctor` | on | Al iniciar la sesión, corre el validador de entorno y solo habla si algo falla. |
 | `ask-adoption` | on | En un proyecto que nunca respondió, hace que el asistente pregunte qué adoptar. |
 | `wiring-check` | on | Avisa cuando un hook registrado falta o un script quedó huérfano. |
-| `capability-map` | off | En cada mensaje, inyecta el catálogo de capacidades del proyecto — skills, agents/subagents, comandos — como dato compacto, y lo persiste en `.ai/capability-map.json` (como el mapa de herramientas). Autosincronizado desde el disco. Nunca bloquea. |
+| `capability-map` | on | Cada `injectEveryMessages` mensajes (default 10; siempre en la primera corrida y cuando se agrega/borra una capacidad), inyecta el catálogo de capacidades del proyecto — skills, agents/subagents, comandos — como dato compacto, y lo persiste en `.ai/capability-map.json` (como el mapa de herramientas). Autosincronizado desde el disco. Nunca bloquea. |
 
 ---
 
@@ -170,10 +177,23 @@ ves y editas cada perilla:
   (saltea el chequeo de staged-lint por un commit), `[wip]` (permite un commit
   deliberadamente amplio, no atómico). `dependency-skills` se exime vía su lista
   `depsWithoutOwnApi`.
-- **Inyección de capacidades:** `capability-map` (off por defecto) es totalmente ajustable —
+- **Inyección de capacidades:** `capability-map` (on por defecto) es totalmente ajustable —
   elegí qué tipos exponer (`"kinds": ["skills", "agents", "commands"]`), limitá cada blurb
-  (`maxClauseChars`), agregá raíces extra por tipo, o apagá la persistencia
-  (`"persist": false`) y apuntá el mapa a otro archivo (`mapFile`).
+  (`maxClauseChars`, default 120), agregá raíces extra por tipo, regulá cada cuánto se
+  re-inyecta el catálogo completo (`injectEveryMessages`, default 10 — el archivo persistido
+  se refresca igual en cada mensaje), o apagá la persistencia (`"persist": false`) y apuntá
+  el mapa a otro archivo (`mapFile`). Las skills también se escanean por defecto en
+  `~/.agents/skills`, `<proyecto>/.agents/skills`, `~/.ai/skills` y `<proyecto>/.ai/skills`
+  (raíces exclusivas de skills que usan otros instaladores además de `.claude/skills` — sin
+  necesidad de configurar nada), sumadas a cualquier `extraSkillsDirs` que el proyecto
+  declare. Una descripción que no entra en `maxClauseChars` cae al truncado mecánico por
+  palabra completa, pero podés escribir a mano un resumen mejor por capacidad en
+  `~/.claude/blurb-overrides.json` (global) o `<proyecto>/<blurbOverridesFile>` (default
+  `.ai/blurb-overrides.json`, el proyecto gana por clave) — un mapa
+  `{ "nombre-skill": "resumen corto" }`, usado tal cual en vez del corte mecánico. El
+  re-escaneo de una capacidad se saltea (se reusa su blurb tal cual) cuando el disco no
+  cambió desde el último escaneo (mismos archivos fuente, mismos mtimes); borrar una
+  skill/agente/comando saca su entrada del mapa en la corrida siguiente.
 
 ---
 

package/README.md

@@ -29,7 +29,7 @@ npx @devrik-tools/claude-gates init
 
 Restart the Claude Code session (or run `/plugin`) so the hooks load.
 
-> **Why two things?** The plugin **always ships all 40 gates**; the config decides **which
+> **Why two things?** The plugin **always ships all 41 gates**; the config decides **which
 > ones run**. So you can turn one on without reinstalling — it is one line in a JSON file.
 
 ---
@@ -55,6 +55,11 @@ If any gate blocks, the tool does not run.
 - **WARN**: the action needs judgment → the gate injects a note and lets it proceed.
 - **Silence**: the common path. A gate never nags when there is nothing to object to.
 
+Every DENY/WARN message is prefixed `[configKey]` — the exact key name to look up (or turn
+off/tune) under `"gates"` in `.ai/config.json`, e.g. `[blockPathsOutsideRootWhitelist] '...'
+is not on the whitelist.` means the setting is `blockPathsOutsideRootWhitelist` in the table
+below, not some other name you'd have to guess or map from a short gate id.
+
 Every gate is **self-contained** (Node built-ins only, no runtime dependencies), so it
 works even if you install one on its own.
 
@@ -90,6 +95,7 @@ works even if you install one on its own.
 | ------------------------- | --- | -------------------------------------------------------------------- |
 | `feature-catalog`         | on  | A single feature in progress; closing requires asserts and review.   |
 | `sdd-specs`               | off | Requires non-empty requirements/design/tasks before implementing.    |
+| `brief-approved`          | on  | Requires a recorded user approval (`status: approved` + quote) on the cited feature's brief before implementing. |
 | `implementation-pipeline` | off | Requires declaring definition → writing → validation → QA → closure. |
 | `mandatory-flow`          | off | Requires an active task with a contract before implementing.         |
 | `test-matrix`             | off | Requires a test matrix (the types the requirement makes mandatory).  |
@@ -134,7 +140,7 @@ works even if you install one on its own.
 | `doctor`         | on  | On session start, runs the environment validator and only speaks on failure.                                                                                                                        |
 | `ask-adoption`   | on  | In a project that never answered, makes the assistant ask what to adopt.                                                                                                                            |
 | `wiring-check`   | on  | Warns when a registered hook is missing or a script is orphaned.                                                                                                                                     |
-| `capability-map` | off | On every message, injects the project's capability catalog — skills, agents/subagents, commands — as compact data, and persists it to `.ai/capability-map.json` (like the tool map). Autosynced from disk. Never blocks. |
+| `capability-map` | on | Every `injectEveryMessages` messages (default 10; always on the first run and whenever a capability is added/removed), injects the project's capability catalog — skills, agents/subagents, commands — as compact data, and persists it to `.ai/capability-map.json` (like the tool map). Autosynced from disk. Never blocks. |
 
 ---
 
@@ -183,10 +189,22 @@ see and edit every knob:
   `lint-ok: <reason>` (a documented linter false positive), `[skip-lint]` (skip the
   staged-lint check for one commit), `[wip]` (allow one deliberately broad,
   non-atomic commit). `dependency-skills` opts out via its `depsWithoutOwnApi` list.
-- **Capability injection:** `capability-map` (off by default) is fully tunable — pick which
+- **Capability injection:** `capability-map` (on by default) is fully tunable — pick which
   kinds to surface (`"kinds": ["skills", "agents", "commands"]`), cap each blurb
-  (`maxClauseChars`), add extra roots per kind, or turn off persistence (`"persist": false`)
-  and point the map file elsewhere (`mapFile`).
+  (`maxClauseChars`, default 120), add extra roots per kind, throttle how often the full
+  catalog is re-injected (`injectEveryMessages`, default 10 — the persisted map file itself
+  still refreshes every message), or turn off persistence (`"persist": false`) and point the
+  map file elsewhere (`mapFile`). Skills are also scanned by default under `~/.agents/skills`,
+  `<project>/.agents/skills`, `~/.ai/skills` and `<project>/.ai/skills` (skill-only roots some
+  installers use besides `.claude/skills` — no config needed), in addition to any
+  `extraSkillsDirs` the project declares. A description too long to fit `maxClauseChars`
+  falls back to mechanical word-boundary truncation, but you can hand-write a better one-line
+  summary per capability in `~/.claude/blurb-overrides.json` (global) or
+  `<project>/<blurbOverridesFile>` (default `.ai/blurb-overrides.json`, project wins per
+  key) — a `{ "skill-name": "short summary" }` map, used verbatim instead of the mechanical
+  cut. A capability's re-scan is skipped (its blurb reused verbatim) whenever disk is
+  unchanged since the last scan (same set of source files, same mtimes); removing a
+  skill/agent/command drops its entry from the map on the very next run.
 
 ---
 

package/cli/smoke-fixtures.json

@@ -157,6 +157,20 @@
       "needsState": true,
       "note": "auto-off unless a features tree exists; needs seeded .ai/feature_list.json + features dir."
     },
+    {
+      "id": "brief-approved",
+      "configKey": "requireApprovedBriefBeforeImplementing",
+      "enabledByDefault": false,
+      "type": "deny",
+      "payload": {
+        "tool_name": "Agent",
+        "tool_input": {
+          "prompt": "Nivel: STANDARD\nImplementa .ai/features/checkout/brief.md."
+        }
+      },
+      "needsState": true,
+      "note": "auto-off unless a features tree exists; needs a seeded .ai/features/<name>/brief.md with no approved frontmatter."
+    },
     {
       "id": "implementation-pipeline",
       "configKey": "requireImplementationPipeline",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrik-tools/claude-gates",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Installable, deterministic gates (hooks) for Claude Code: block destructive commands, protected paths, and enforce delegation/spec/quality rules. Configurable per project.",
   "keywords": [
     "claude-code",

package/plugins/gates/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gates",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Deterministic gates for Claude Code: destructive-command blocks, protected paths, delegation briefs, spec-driven flow and session-start validation. Selection lives in config, not in code.",
   "author": {
     "name": "Devrik"

package/plugins/gates/hooks/gates/atomic-commit/index.mjs

@@ -208,7 +208,7 @@ runGate(
 
     if (countedNatures.size > maxNatures) {
       deny(
-        GATE_ID,
+        CONFIG_KEY,
         `This commit mixes ${countedNatures.size} kinds of change ` +
           `(${[...countedNatures].join(', ')}) — a commit should be one cohesive change ` +
           `(max ${maxNatures}). Split it: stage and commit one nature at a time (e.g. the ` +
@@ -219,7 +219,7 @@ runGate(
 
     if (counted.length > maxFiles) {
       deny(
-        GATE_ID,
+        CONFIG_KEY,
         `This commit stages ${counted.length} reviewable files (max ${maxFiles}) — too large ` +
           `to review as one unit. Split it into smaller, cohesive commits (docs/assets/` +
           `generated files are not counted). Add "${escapeHatch}" for one deliberately broad commit.`,

package/plugins/gates/hooks/gates/audit-before-build/index.mjs

@@ -53,7 +53,7 @@ function checkDelegation(toolInput) {
   if (AUDIT_EVIDENCE_PATTERN.test(prompt)) return;
 
   deny(
-    GATE_ID,
+    CONFIG_KEY,
     'Delegating creation of a new script/checker/gate/hook/linter/tool without evidence of a prior audit. State what you searched and why no existing tool covers this (e.g. "audited and no existing tool...").',
   );
 }
@@ -84,7 +84,7 @@ function checkWrite(toolInput, parameters) {
   if (INLINE_JUSTIFICATION_PATTERN.test(content)) return;
 
   deny(
-    GATE_ID,
+    CONFIG_KEY,
     `Creating a new executable tool at ${filePath} without a justification comment (e.g. "justification: ..."). Document why no existing tool covers this before building a new one.`,
   );
 }

package/plugins/gates/hooks/gates/autonomous-mode/index.mjs

@@ -45,6 +45,6 @@ runGate(
   },
   ({ toolName }) => {
     if (!toolInGroups(toolName, QUESTION_GROUPS)) return;
-    deny(GATE_ID, DENY_MESSAGE);
+    deny(CONFIG_KEY, DENY_MESSAGE);
   },
 );

package/plugins/gates/hooks/gates/bash-commands/index.mjs

@@ -173,7 +173,7 @@ function checkDestructive(command, parameters) {
       : [entry, 'Destructive command is not allowed.'],
   );
   for (const [source, reason] of denyPairs) {
-    if (compile(source).test(normalized)) deny(GATE_ID, reason);
+    if (compile(source).test(normalized)) deny(CONFIG_KEY, reason);
   }
 
   // rm -rf over a protected area: areas read from config at runtime, so editing
@@ -184,12 +184,12 @@ function checkDestructive(command, parameters) {
     rmRfAreas.length > 0 &&
     compile(rmRfSourceFrom(rmRfAreas)).test(command)
   ) {
-    deny(GATE_ID, "'rm -rf' over a protected area is not allowed.");
+    deny(CONFIG_KEY, "'rm -rf' over a protected area is not allowed.");
   }
 
   if (parameters.embeddedInterpreterEnabled) {
     const reason = checkEmbeddedInterpreter(command);
-    if (reason) deny(GATE_ID, reason);
+    if (reason) deny(CONFIG_KEY, reason);
   }
 }
 

package/plugins/gates/hooks/gates/block-remote-publish/index.mjs

@@ -131,9 +131,9 @@ runGate(
     for (const [source, reason] of parameters.publishRules) {
       const pattern = compile(source);
       if (isShell) {
-        if (pattern.test(shellCommand)) deny(GATE_ID, reason);
+        if (pattern.test(shellCommand)) deny(CONFIG_KEY, reason);
       } else if (hasRealPublishIntent(command, pattern)) {
-        deny(GATE_ID, reason);
+        deny(CONFIG_KEY, reason);
       }
     }
   },

package/plugins/gates/hooks/gates/brief-approved/index.mjs

@@ -0,0 +1,216 @@
+// brief-approved — denies an implementation delegation (STANDARD/HIGH-RISK, an
+// implementation verb) that targets a feature whose brief/spec has no recorded human
+// approval. Migrated from a real incident: the assistant took an ambiguous user reply
+// ("hagamos el brief") as approval of a spec it had already written, delegated
+// implementation straight away, and never pasted the full brief into the chat for the
+// user to confirm line by line. `sdd-specs` already blocks implementing a feature with
+// NO contract at all; this gate blocks implementing a feature whose contract exists but
+// was never actually approved by the user — a distinct failure this incident exposed.
+//
+// ── What "approved" means here (deliberately narrow) ────────────────────────────────
+// A hook cannot read the chat, so it cannot verify the assistant actually pasted the
+// full brief and that the user actually read it. What IS checkable: the brief file
+// itself carries a frontmatter block written ONLY once that confirmation happened —
+//   ---
+//   status: approved
+//   approved_at: <ISO timestamp>
+//   approval_quote: "<user's own words>"
+//   ---
+// The gate does not (cannot) verify the quote is genuine; it verifies the field exists
+// and is non-empty, which at minimum forces the assistant to stop and produce a
+// specific artifact instead of silently inferring consent from a vague reply.
+//
+// ── Auto-off when there is no brief to approve ──────────────────────────────────────
+// Same discovery as sdd-specs: only fires once a feature contract tree exists under
+// .ai/features/<name>/ (or the configured catalog's sibling `features` dir) AND that
+// feature has a brief.md/asserts.md file. A project with no such file for the cited
+// feature is out of this gate's scope (sdd-specs already denies that case).
+//
+// ── What is NOT configurable (base, non-negotiable) ─────────────────────────────────
+// The frontmatter field names (status/approved_at/approval_quote) are fixed, not a
+// project param — a configurable field name would let a delegation "approve" itself by
+// pointing the gate at whatever key it just wrote.
+
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import {
+  runGate,
+  deny,
+  toolInGroups,
+  delegationPromptOf,
+} from '../../lib/hook-io.mjs';
+
+const GATE_ID = 'brief-approved';
+const CONFIG_KEY = 'requireApprovedBriefBeforeImplementing';
+
+const CATALOG_FILE_NAME = 'feature_list.json';
+const DEFAULT_CATALOG_LOCATIONS = [
+  join('.ai', CATALOG_FILE_NAME),
+  CATALOG_FILE_NAME,
+];
+
+const DEFAULT_EXEMPT_SUBAGENTS = [
+  'explore',
+  'plan',
+  'scout',
+  'revision',
+  'contraste',
+  'test-planner',
+  'qa',
+  'ui',
+  'ux',
+];
+
+/** Files that count as a feature's contract; the first one found on disk is the one
+ * checked for approval (mirrors sdd-specs' CONTRACT_FILES precedence). */
+const CONTRACT_FILES = [
+  'brief.md',
+  'requirements.md',
+  'design.md',
+  'tasks.md',
+  'asserts.md',
+];
+
+const APPROVED_FRONTMATTER_PATTERN = /^---\r?\n(?<body>[\s\S]*?)\r?\n---/;
+const APPROVED_STATUS_PATTERN = /^status:[ \t]*approved[ \t]*$/im;
+const APPROVAL_QUOTE_PATTERN = /^approval_quote:[ \t]*(\S.*)$/im;
+
+function withWordBoundary(alternation) {
+  return new RegExp(
+    `(?<![\\p{L}\\p{N}_])(${alternation})(?![\\p{L}\\p{N}_])`,
+    'iu',
+  );
+}
+
+const IMPLEMENTATION_VERBS = withWordBoundary(
+  'implementa|implementar|implement(á|é)|agreg(a|á)|agregar|añad(e|í)|añadir|cre(a|á)|crear|' +
+    'arregl(a|á)|arreglar|cambi(a|á)|cambiar|migr(a|á)|migrar|' +
+    'corrige|corregir|correg(í|ir)|constru(ye|í)|construir|modific(a|á)|modificar|' +
+    'refactoriz(a|á)|refactorizar|elimin(a|á)|eliminar|reescrib(e|í)|reescribir|desplieg(a|á)|desplegar|' +
+    'escrib(í|e)|escribir|implement\\w*|writ(e|ing)|creat\\w*|fix\\w*|build\\w*|refactor\\w*|migrat\\w*|' +
+    'add\\w*|remov\\w*|delet\\w*|modify|modifies|modifying|rewrit\\w*',
+);
+
+const DEMANDING_LEVEL_PATTERN =
+  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\b(STANDARD|HIGH-RISK)\b/iu;
+const EXEMPT_LEVEL_PATTERN =
+  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\b(QUESTION|MICRO)\b/iu;
+
+function findCatalog(catalogLocations) {
+  for (const relative of catalogLocations) {
+    const path = join(process.cwd(), relative);
+    if (existsSync(path)) return path;
+  }
+  return null;
+}
+
+function contractTreeRootFor(catalogPath) {
+  const candidates = catalogPath
+    ? [join(dirname(catalogPath), 'features')]
+    : [];
+  candidates.push(join(process.cwd(), '.ai', 'features'));
+  candidates.push(join(process.cwd(), 'features'));
+  for (const candidate of candidates) {
+    if (existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+
+/** The first existing contract file's path for a feature, or null if none exists. */
+function contractFileFor(treeRoot, featureName) {
+  if (!treeRoot) return null;
+  const featureDirectory = join(treeRoot, featureName);
+  if (!existsSync(featureDirectory)) return null;
+  for (const file of CONTRACT_FILES) {
+    const path = join(featureDirectory, file);
+    if (existsSync(path)) return path;
+  }
+  return null;
+}
+
+/** Whether a contract file's frontmatter records a real approval: `status: approved`
+ * plus a non-empty `approval_quote`. Both must be present — status alone is a label
+ * the assistant could set on itself with no evidence a quote was ever collected. */
+function isApproved(contractPath) {
+  let content;
+  try {
+    content = readFileSync(contractPath, 'utf8');
+  } catch {
+    return false;
+  }
+  const frontmatter = APPROVED_FRONTMATTER_PATTERN.exec(content)?.groups?.body;
+  if (!frontmatter) return false;
+  if (!APPROVED_STATUS_PATTERN.test(frontmatter)) return false;
+  const quoteMatch = APPROVAL_QUOTE_PATTERN.exec(frontmatter);
+  const quote = quoteMatch?.[1]?.replace(/^["']|["']$/g, '').trim();
+  return Boolean(quote);
+}
+
+function isExemptDelegation(toolInput, prompt, exemptSubagents) {
+  const subagentType = String(
+    toolInput.subagent_type ?? toolInput.subagentType ?? '',
+  ).toLowerCase();
+  if (exemptSubagents.includes(subagentType)) return true;
+  if (EXEMPT_LEVEL_PATTERN.test(prompt)) return true;
+  if (!DEMANDING_LEVEL_PATTERN.test(prompt)) return true;
+  if (!IMPLEMENTATION_VERBS.test(prompt)) return true;
+  return false;
+}
+
+function featureNamesCitedIn(prompt) {
+  const pattern = /\.(?:ai)[\\/]features[\\/]([\w.@-]+)/gi;
+  const names = [];
+  let match;
+  while ((match = pattern.exec(prompt)) !== null) names.push(match[1]);
+  return names;
+}
+
+runGate(
+  {
+    id: GATE_ID,
+    configKey: CONFIG_KEY,
+    enabledByDefault: true,
+    defaultParams: {
+      catalogLocations: DEFAULT_CATALOG_LOCATIONS,
+      exemptSubagents: DEFAULT_EXEMPT_SUBAGENTS,
+    },
+  },
+  ({ toolName, toolInput, parameters }) => {
+    if (!toolInGroups(toolName, ['delegation'])) return;
+
+    const prompt = delegationPromptOf(toolInput);
+    if (!prompt.trim()) return;
+
+    const exemptSubagents =
+      parameters.exemptSubagents ?? DEFAULT_EXEMPT_SUBAGENTS;
+    if (isExemptDelegation(toolInput, prompt, exemptSubagents)) return;
+
+    const citedFeatures = featureNamesCitedIn(prompt);
+    if (citedFeatures.length === 0) return; // no citation: nothing this gate can check
+
+    const catalogLocations =
+      parameters.catalogLocations ?? DEFAULT_CATALOG_LOCATIONS;
+    const catalogPath = findCatalog(catalogLocations);
+    const treeRoot = contractTreeRootFor(catalogPath);
+    if (!treeRoot) return; // no SDD harness adopted: stay silent
+
+    const unapproved = citedFeatures.filter((feature) => {
+      const contractPath = contractFileFor(treeRoot, feature);
+      if (!contractPath) return false; // sdd-specs already denies this case
+      return !isApproved(contractPath);
+    });
+
+    if (unapproved.length === 0) return;
+
+    deny(
+      CONFIG_KEY,
+      `This implementation delegation cites feature(s) [${unapproved.join(', ')}] ` +
+        'whose brief/contract has no recorded approval. Paste the FULL brief into the ' +
+        'chat, get an explicit confirmation from the user (not a vague "dale"/"sigamos" ' +
+        '— an actual sentence confirming they read it), then add this frontmatter to ' +
+        'the top of the contract file before relaunching:\n' +
+        '---\nstatus: approved\napproved_at: <ISO timestamp>\n' +
+        'approval_quote: "<the user\'s own confirming words>"\n---',
+    );
+  },
+);

package/plugins/gates/hooks/gates/brief-before-delegate/index.mjs

@@ -209,7 +209,7 @@ function denyTooShort(prompt) {
   const excerpt = prompt.slice(0, PROMPT_EXCERPT_LENGTH);
   const ellipsis = prompt.length > PROMPT_EXCERPT_LENGTH ? '…' : '';
   deny(
-    GATE_ID,
+    CONFIG_KEY,
     `This delegation asks for implementation ("${excerpt}${ellipsis}") in a ${prompt.length}-character ` +
       'prompt — too short to carry a goal, steps and a done-when criterion. State what this aims to ' +
       'achieve, what concretely needs doing (as a list or steps), and how completion is verified, then ' +
@@ -222,7 +222,7 @@ function reportMissingSignals(missing) {
 
   if (missing.length < TOTAL_REQUIRED_SIGNALS) {
     warn(
-      GATE_ID,
+      CONFIG_KEY,
       `This implementation delegation does not recognizably state: ${missing.join('; ')}. ` +
         'If it is already there under different wording, proceed — this is only a warning. ' +
         'Otherwise add it before the subagent starts blind.',
@@ -231,7 +231,7 @@ function reportMissingSignals(missing) {
   }
 
   deny(
-    GATE_ID,
+    CONFIG_KEY,
     'This delegation asks for implementation but states neither as a list nor recognizable prose: ' +
       `${missing.join('; ')}. Add to the prompt: (1) the GOAL — what this aims to achieve; ` +
       '(2) the STEPS — concrete files/actions, as a list; (3) the CRITERION — how completion is ' +