@devrik-tools/claude-gates 0.7.2 → 0.9.0

package/plugins/gates/hooks/gates/force-parallel/index.mjs

@@ -1,134 +1,92 @@
-// force-parallel — nudges toward parallelizing independent delegations. WARN-only: it
-// never denies, because a PreToolUse hook sees one tool call at a time and has no way to
-// know whether the delegations it observed COULD have been sent together — only that they
-// arrived one after another.
+// force-parallel — denies delegations that keep arriving one turn at a time instead of as a
+// batch. Deterministic: when the sequential count hits the threshold, the delegation is
+// blocked outright — the agent must collect independent delegations and send them together.
 //
-// justification: no existing tool covers this. brief-before-delegate/intent-flow/risk-level
-// gate the CONTENT of a single delegation prompt; none of them look across delegations in
-// the same session to notice a sequential pattern.
-//
-// ── Honest limitation (read before trusting this gate) ──────────────────────────────
-// A PreToolUse hook fires once per tool call, synchronously, with no visibility into what
-// the model is "thinking" or whether independent work existed to batch. This gate can only
-// count consecutive delegation calls that land close together in wall-clock time and warn
-// after a threshold — it cannot prove they were independent, and it cannot force the model
-// to have sent them in one message (Claude Code's own turn structure decides that, not a
-// hook). Treat the warning as a nudge for the NEXT delegation, never as proof of a missed
-// opportunity on the ones already sent.
-//
-// ── What a project can configure (params) ───────────────────────────────────────────
-//   sequentialThreshold      consecutive delegations (within the window) before warning.
-//   sequentialWindowMs       how close in time two delegations must land to count as the
-//                            same sequential run; a gap resets the count.
-//   sequentialJustifiedMarker  a marker token in the delegation prompt that escapes the
-//                            warning — a declared reason not to parallelize is a decision.
-// The defaults live here, in the source, so a project reads them and knows exactly what
-// its override replaces.
-//
-// ── State ─────────────────────────────────────────────────────────────────────────────
-// Per-session count + last-delegation timestamp, persisted at
-// os.tmpdir()/claude-gates/force-parallel/<sessionId>/state.json — process-local state
-// would not survive across the separate process each hook invocation spawns.
+// Decisions: delegations landing within BATCH_GAP_MS of each other are ONE batch (a parallel
+// launch in a single message) and do not raise the sequential count; only a gap between the
+// batch threshold and `sequentialWindowMs` counts as sequential, and a longer gap resets.
+// State lives in the shared session store (sanitized session segment, project-keyed bucket
+// when the payload has no session id, atomic writes, TTL pruning).
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
 import {
   runGate,
-  warn,
+  deny,
   toolInGroups,
   delegationPromptOf,
 } from '../../lib/hook-io.mjs';
+import {
+  readSessionState,
+  writeSessionState,
+} from '../../lib/session-state.mjs';
 
 const GATE_ID = 'force-parallel';
 const CONFIG_KEY = 'warnSequentialDelegations';
 
-const DELEGATION_GROUPS = ['delegation'];
 const DEFAULT_SEQUENTIAL_THRESHOLD = 3;
 const DEFAULT_SEQUENTIAL_WINDOW_MS = 120000;
 const DEFAULT_JUSTIFIED_MARKER = 'SEQUENTIAL-JUSTIFIED';
 const MS_PER_SECOND = 1000;
-
-const STATE_ROOT = join(tmpdir(), 'claude-gates', 'force-parallel');
-const STATE_FILE = 'state.json';
-const UNKNOWN_SESSION = 'unknown-session';
-
-function statePathFor(sessionId) {
-  const safeSessionId = String(sessionId || UNKNOWN_SESSION).replace(
-    /[^\w-]/g,
-    '_',
-  );
-  return join(STATE_ROOT, safeSessionId, STATE_FILE);
+const BATCH_GAP_MS = 2000;
+
+const ORDINAL_SUFFIXES = { 1: 'st', 2: 'nd', 3: 'rd' };
+const TEENS_FROM = 11;
+const TEENS_TO = 13;
+const HUNDRED = 100;
+const TEN = 10;
+
+function ordinal(number) {
+  const lastTwo = number % HUNDRED;
+  if (lastTwo >= TEENS_FROM && lastTwo <= TEENS_TO) return `${number}th`;
+  return `${number}${ORDINAL_SUFFIXES[number % TEN] ?? 'th'}`;
 }
 
-function readState(path) {
-  if (!existsSync(path)) return { count: 0, lastAt: 0 };
-  try {
-    const parsed = JSON.parse(readFileSync(path, 'utf8'));
-    return {
-      count: Number(parsed.count) || 0,
-      lastAt: Number(parsed.lastAt) || 0,
-    };
-  } catch {
-    return { count: 0, lastAt: 0 };
-  }
+function nextCount(previous, now, windowMs) {
+  const gap = now - previous.lastAt;
+  if (gap > windowMs) return 1;
+  if (gap < BATCH_GAP_MS) return Math.max(previous.count, 1);
+  return previous.count + 1;
 }
 
-function writeState(path, state) {
-  mkdirSync(join(path, '..'), { recursive: true });
-  writeFileSync(path, JSON.stringify(state), 'utf8');
-}
-
-const WARN_MESSAGE =
-  'This is the {count}th delegation sent one-by-one within {windowSeconds}s. If the ' +
-  'remaining work is independent, launch the next batch together in a single message ' +
-  '(multiple tool calls) instead of one delegation per turn. If this delegation ' +
-  'genuinely depends on a prior result, ignore this and mark the prompt with ' +
-  '"{marker}" to skip the warning next time.';
-
 runGate(
   {
     id: GATE_ID,
     configKey: CONFIG_KEY,
-    enabledByDefault: false,
+    enabledByDefault: true,
     defaultParams: {
       sequentialThreshold: DEFAULT_SEQUENTIAL_THRESHOLD,
       sequentialWindowMs: DEFAULT_SEQUENTIAL_WINDOW_MS,
       sequentialJustifiedMarker: DEFAULT_JUSTIFIED_MARKER,
     },
   },
-  ({ toolName, toolInput, sessionId, parameters }) => {
-    if (!toolInGroups(toolName, DELEGATION_GROUPS)) return;
+  ({ toolName, toolInput, sessionId, parameters, cwd }) => {
+    if (!toolInGroups(toolName, ['delegation'])) return;
 
-    const marker =
-      parameters.sequentialJustifiedMarker ?? DEFAULT_JUSTIFIED_MARKER;
+    const marker = String(parameters.sequentialJustifiedMarker ?? '');
     const prompt = delegationPromptOf(toolInput);
-    if (prompt.includes(marker)) return; // declared reason not to parallelize: no warning
+    if (marker && prompt.includes(marker)) return;
 
-    const threshold =
-      parameters.sequentialThreshold ?? DEFAULT_SEQUENTIAL_THRESHOLD;
-    const windowMs =
-      parameters.sequentialWindowMs ?? DEFAULT_SEQUENTIAL_WINDOW_MS;
-
-    const statePath = statePathFor(sessionId);
-    const state = readState(statePath);
+    const stateOptions = { cwd };
+    const stored = readSessionState(GATE_ID, sessionId, {}, stateOptions);
+    const previous = {
+      count: Number(stored.count) || 0,
+      lastAt: Number(stored.lastAt) || 0,
+    };
     const now = Date.now();
+    const count = nextCount(previous, now, parameters.sequentialWindowMs);
+    writeSessionState(GATE_ID, sessionId, { count, lastAt: now }, stateOptions);
 
-    const withinWindow = now - state.lastAt <= windowMs;
-    const nextCount = withinWindow ? state.count + 1 : 1;
+    if (count < parameters.sequentialThreshold) return;
 
-    writeState(statePath, { count: nextCount, lastAt: now });
-
-    if (nextCount < threshold) return;
-
-    warn(
+    const windowSeconds = Math.round(
+      parameters.sequentialWindowMs / MS_PER_SECOND,
+    );
+    deny(
       CONFIG_KEY,
-      WARN_MESSAGE.replace('{count}', String(nextCount))
-        .replace(
-          '{windowSeconds}',
-          String(Math.round(windowMs / MS_PER_SECOND)),
-        )
-        .replace('{marker}', marker),
+      `This is the ${ordinal(count)} delegation sent one-by-one within ${windowSeconds}s. ` +
+        'Independent delegations MUST be launched together in a single message (multiple tool ' +
+        'calls in one response). Collect the remaining independent delegations and send them as ' +
+        'a batch. If this delegation genuinely depends on a prior result, add ' +
+        `"${marker || DEFAULT_JUSTIFIED_MARKER}" to the prompt to declare the dependency.`,
     );
   },
 );

package/plugins/gates/hooks/gates/forge-flow/index.mjs

@@ -1,94 +1,53 @@
-// forge-flow — the enforcer forge cannot be. A forge MCP directs a pipeline but cannot
-// intercept Edit/Write/Bash, so nothing makes you actually use it. This gate closes that
-// hole: in a project that ADOPTED forge, a code-mutating action is denied unless there is
-// an active forge run for this project — so every change goes through the pipeline and you
-// always know which phase you are in.
-//
-// justification: no existing tool covers this. A forge MCP audit (see memory
-// forge-mcp-auditoria-flujo) confirmed the structural hole: an MCP cannot gate other tools;
-// only a Claude Code PreToolUse hook can. This is that hook.
-//
-// ── When it acts (never surprises you) ──────────────────────────────────────────────
-// Only when the project adopted forge — a marker on disk (.ai/forge.json, or `forge: true`
-// in .ai/config.json). In any other project it stays silent. Off by default in the
-// registry, so it never fires unless a project turns it on.
-//
-// ── How it checks (deterministic, no judgment) ──────────────────────────────────────
-// forge persists its runs in a SQLite DB (global by default). This gate reads that DB with
-// node:sqlite (a Node built-in — no npm, contract intact) and looks for an active run whose
-// cwd matches this project. Absent → deny with an actionable message. The DB unreadable or
-// node:sqlite unavailable → allow (fail open: a broken lookup must not block all work).
+// forge-flow — in a project that ADOPTED forge (.ai/forge.json, or `forge: true` in
+// .ai/config.json), a code-mutating action is denied unless forge has an active run for
+// this project. A forge MCP cannot intercept Edit/Write/Bash; only this hook can.
+// The run's cwd may be the project root or any ANCESTOR of it (a monorepo run covers its
+// packages); paths are compared normalized, case-insensitively on Windows.
+// The DB is read with node:sqlite (a built-in, so the plugin stays npm-free). A DB that is
+// absent means no runs → deny; a DB that cannot be read means "unknown" → warn and allow,
+// so a broken lookup never freezes work and never disables the enforcer silently.
 
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { join } from 'node:path';
+import { projectRootOf, readJsonOrNull } from '../../lib/config.mjs';
 import { runGate, deny, warn, toolInGroups } from '../../lib/hook-io.mjs';
 
 const GATE_ID = 'forge-flow';
 const CONFIG_KEY = 'requireForgeRunToEdit';
 
-// Any code-mutating surface: native write/shell AND their MCP equivalents. `execution`
-// already unions write+shell+mcp__ide__executeCode, and toolInGroups adds the mcp__* signal
-// match — so an MCP filesystem-write or shell-exec tool no longer slips past the enforcer.
 const ACTING_GROUPS = ['execution'];
-const PROJECT_ROOT_MARKERS = ['.git', '.ai'];
-const DEFAULT_FORGE_DB = join('.forge', 'forge-mcp.db');
+const DEFAULT_FORGE_DB_PATH = join(homedir(), '.forge', 'forge-mcp.db');
 const FORGE_MARKER_FILE = join('.ai', 'forge.json');
 const PROJECT_CONFIG_FILE = join('.ai', 'config.json');
 
-function projectRootOf(startDirectory) {
-  let current = startDirectory;
-  while (true) {
-    if (
-      PROJECT_ROOT_MARKERS.some((marker) => existsSync(join(current, marker)))
-    ) {
-      return current;
-    }
-    const parent = dirname(current);
-    if (parent === current) return null;
-    current = parent;
-  }
+function projectAdoptedForge(root) {
+  if (existsSync(join(root, FORGE_MARKER_FILE))) return true;
+  return readJsonOrNull(join(root, PROJECT_CONFIG_FILE))?.forge === true;
 }
 
-function readJson(path) {
-  try {
-    return JSON.parse(readFileSync(path, 'utf8'));
-  } catch {
-    return null;
-  }
+function normalizeDirectory(path) {
+  let normalized = String(path ?? '').replace(/\\/g, '/');
+  while (normalized.endsWith('/')) normalized = normalized.slice(0, -1);
+  return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
 }
 
-/** True when this project opted into forge: a marker file, or forge:true in .ai/config.json. */
-function projectAdoptedForge(root) {
-  if (existsSync(join(root, FORGE_MARKER_FILE))) return true;
-  const config = readJson(join(root, PROJECT_CONFIG_FILE));
-  return config?.forge === true;
+function runCovers(runCwd, root) {
+  const run = normalizeDirectory(runCwd);
+  const project = normalizeDirectory(root);
+  return run !== '' && (project === run || project.startsWith(`${run}/`));
 }
 
-/**
- * True when forge has an active run whose cwd is this project. Reads forge's SQLite DB with
- * node:sqlite (imported dynamically so an older Node without it degrades instead of
- * throwing). Any failure — module missing, DB absent, locked, unreadable, schema drift —
- * returns true: the gate must fail OPEN, since a broken lookup must never block every edit.
- */
-// Returns one of three verdicts, so a broken lookup no longer masquerades as "run present":
-//   { state: 'active' }   → a run for this project exists; allow.
-//   { state: 'none' }     → DB readable, no active run for this project; deny.
-//   { state: 'unknown', reason } → DB absent/locked/corrupt/schema-drift, or node:sqlite
-//                                   missing; we cannot tell. Warn (visible) but allow, so a
-//                                   broken DB never blocks all work AND never disables the
-//                                   enforcer silently — the earlier code returned true here,
-//                                   which looked identical to "run present".
-async function forgeRunState(root, forgeDatabasePath) {
-  if (!existsSync(forgeDatabasePath)) return { state: 'none' }; // no DB yet → no runs → deny
+async function forgeRunState(root, databasePath) {
+  if (!existsSync(databasePath)) return { state: 'none' };
   try {
     const { DatabaseSync } = await import('node:sqlite');
-    const database = new DatabaseSync(forgeDatabasePath, { readOnly: true });
+    const database = new DatabaseSync(databasePath, { readOnly: true });
     const rows = database
       .prepare("SELECT cwd FROM runs WHERE status = 'active'")
       .all();
     database.close();
-    return rows.some((row) => String(row.cwd) === root)
+    return rows.some((row) => runCovers(row.cwd, root))
       ? { state: 'active' }
       : { state: 'none' };
   } catch (error) {
@@ -96,39 +55,48 @@ async function forgeRunState(root, forgeDatabasePath) {
   }
 }
 
+// The registry documents `forgeDbPath`; `forgeDatabasePath` is the name earlier configs
+// used. A declared forgeDbPath wins; otherwise whichever of the two was set applies.
+function configuredDatabasePath(parameters) {
+  const { forgeDbPath, forgeDatabasePath } = parameters;
+  if (typeof forgeDbPath === 'string' && forgeDbPath !== DEFAULT_FORGE_DB_PATH)
+    return forgeDbPath;
+  return typeof forgeDatabasePath === 'string' && forgeDatabasePath
+    ? forgeDatabasePath
+    : DEFAULT_FORGE_DB_PATH;
+}
+
 const DENY_MESSAGE =
   'This project uses forge, but there is no active forge run for it. Every change should ' +
   'go through the pipeline so the next step is always clear. Start or resume a run ' +
   '(forge_start / forge_next) before editing — that is how forge tells you which phase ' +
-  'you are in. To work outside the pipeline, turn this gate off in .ai/config.json.';
+  `you are in. To work outside the pipeline, set ${CONFIG_KEY} to false in .ai/config.json.`;
 
 runGate(
   {
     id: GATE_ID,
     configKey: CONFIG_KEY,
     enabledByDefault: false,
-    defaultParams: { forgeDatabasePath: join(homedir(), DEFAULT_FORGE_DB) },
+    defaultParams: {
+      forgeDbPath: DEFAULT_FORGE_DB_PATH,
+      forgeDatabasePath: DEFAULT_FORGE_DB_PATH,
+    },
   },
-  async ({ toolName, parameters }) => {
+  async ({ toolName, parameters, cwd }) => {
     if (!toolInGroups(toolName, ACTING_GROUPS)) return;
 
-    const root = projectRootOf(process.cwd());
-    if (!root) return; // no project
-    if (!projectAdoptedForge(root)) return; // project did not opt into forge
-
-    const forgeDatabasePath =
-      parameters.forgeDatabasePath ?? join(homedir(), DEFAULT_FORGE_DB);
-    const result = await forgeRunState(root, forgeDatabasePath);
+    const root = projectRootOf(cwd);
+    if (!root || !projectAdoptedForge(root)) return;
 
-    if (result.state === 'active') return; // pipeline is running → allow
-    if (result.state === 'none') deny(CONFIG_KEY, DENY_MESSAGE); // no run → block
-    // state 'unknown': the DB could not be read. Allow so a broken lookup never freezes work,
-    // but surface it loudly — a silent allow here would disable the enforcer without a trace.
+    const databasePath = configuredDatabasePath(parameters);
+    const result = await forgeRunState(root, databasePath);
+    if (result.state === 'active') return;
+    if (result.state === 'none') deny(CONFIG_KEY, DENY_MESSAGE);
     warn(
       CONFIG_KEY,
       `forge enforcement is degraded: the forge DB could not be read (${result.reason}). ` +
         'Allowing this action, but the pipeline is NOT being enforced. Check that forge is ' +
-        `installed and ${forgeDatabasePath} is readable, or turn this gate off if intended.`,
+        `installed and ${databasePath} is readable, or turn this gate off if intended.`,
     );
   },
 );

package/plugins/gates/hooks/gates/implementation-pipeline/index.mjs

@@ -1,34 +1,34 @@
-// implementation-pipeline — denies a delegation that sends a builder subagent straight
-// to writing code without the prompt declaring the pipeline stages around it:
-// definition (where the context came from), writing's own verification plan, and a
-// separate reviewer for validation/QA/closure. Migrated from
-// ~/.claude/hooks/guard-pipeline-de-implementacion.mjs.
+// implementation-pipeline — denies a STANDARD/HIGH-RISK implementation delegation whose
+// prompt does not declare the pipeline around the build: where the context came from
+// (definition), what is verified and how (writing), and who reviews the result (reviewer).
 //
-// ── What a project can configure (params) ───────────────────────────────────────────
-//   builderSubagents   subagent types that count as builders — the ones this gate
-//                       holds to the pipeline. Replaces the built-in list wholesale.
-//   exemptSubagents     subagent types exempt outright: read-only pipeline stages that
-//                       cannot be required to declare a pipeline around themselves.
-//                       Replaces the built-in list wholesale.
-// The defaults live here, in the source, so a project reads them and knows exactly what
-// its override replaces.
-//
-// ── Off by default, and quiet outside its narrow trigger ───────────────────────────
-// This gate only evaluates a delegation whose prompt declares a STANDARD/HIGH-RISK
-// level, uses an implementation verb, targets a builder subagent, and is not about the
-// harness itself. A prompt that only describes work, or that is read-only/exploratory,
-// never reaches the check.
+// Decisions: every non-exempt subagent is a builder — an absent or unknown subagent_type is
+// not a reason to skip the check, only the exempt list is. A negated mention ("do not write
+// tests", "no brief.md yet") does not satisfy a stage. Work on the agent harness itself
+// (.claude/, .ai/, CLAUDE.md...) is exempt; ordinary app paths such as src/hooks/ are not.
 
+import {
+  DEFAULT_EXEMPT_SUBAGENTS,
+  DEMANDING_LEVELS,
+  LEVELS,
+  allMatches,
+  isHarnessWork,
+  isImplementationRequest,
+  isSubagentNamedIn,
+  operativeLevelOf,
+} from '../../lib/delegation.mjs';
 import {
   runGate,
   deny,
   toolInGroups,
   delegationPromptOf,
 } from '../../lib/hook-io.mjs';
+import { withUnicodeWordBoundary } from '../../lib/signals.mjs';
 
 const GATE_ID = 'implementation-pipeline';
 const CONFIG_KEY = 'requireImplementationPipeline';
 
+// Kept for config compatibility: every non-exempt type is held to the pipeline.
 const DEFAULT_BUILDER_SUBAGENTS = [
   'frontend',
   'backend',
@@ -37,46 +37,11 @@ const DEFAULT_BUILDER_SUBAGENTS = [
   'general-purpose',
 ];
 
-const DEFAULT_EXEMPT_SUBAGENTS = [
-  'scout',
-  'explore',
-  'plan',
-  'revision',
-  'contraste',
-  'test-planner',
-  'qa',
-  'ui',
-  'ux',
-];
-
-function withWordBoundary(alternation) {
-  return new RegExp(
-    `(?:^|[^\\p{L}\\p{N}_])(?:${alternation})(?:[^\\p{L}\\p{N}_]|$)`,
-    'iu',
-  );
-}
-
-const IMPLEMENTATION_VERBS = withWordBoundary(
-  'implementa|implementar|implement(á|é)|agreg(a|á)|agregar|añad(e|í)|añadir|cre(a|á)|crear|' +
-    'arregl(a|á)|arreglar|cambi(a|á)|cambiar|migr(a|á)|migrar|' +
-    'corrige|corregir|correg(í|ir)|constru(ye|í)|construir|modific(a|á)|modificar|' +
-    'refactoriz(a|á)|refactorizar|elimin(a|á)|eliminar|reescrib(e|í)|reescribir|desplieg(a|á)|desplegar|' +
-    'escrib(í|e)|escribir|implement\\w*|writ(?:e|ing)|creat\\w*|fix\\w*|build\\w*|refactor\\w*|migrat\\w*|' +
-    'add\\w*|remov\\w*|delet\\w*|modify|modifies|modifying|rewrit\\w*',
+const NEGATION_LOOK_BACK = 15;
+const NEGATION_PATTERN = withUnicodeWordBoundary(
+  "no|not|don'?t|do not|sin|never",
 );
 
-/** Declared LEVEL near the word "level"/"classification" in Spanish or English, matching
- * the plugin-wide convention (see risk-level.mjs). */
-const DEMANDING_LEVEL_PATTERN =
-  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\b(STANDARD|HIGH-RISK)\b/iu;
-const EXEMPT_LEVEL_PATTERN =
-  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\b(QUESTION|MICRO)\b/iu;
-const HIGH_RISK_PATTERN =
-  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\bHIGH-RISK\b/iu;
-
-const HARNESS_PATTERN =
-  /(\.claude[\\/]|hooks[\\/]|plugins[\\/]gates|settings\.json|[\\/]agents[\\/]\w|[\\/]rules[\\/]\w|[\\/]skills[\\/]\w)/i;
-
 // Several small patterns instead of one long alternation: a single big regex here
 // tripped the linter's regex-complexity limit. Any one matching counts as declared.
 const REVIEWER_NAME_PATTERN =
@@ -103,18 +68,26 @@ const DEFINITION_PATTERN =
 const WRITING_PATTERN =
   /\b(test|tests|prueba|pruebas|vitest|jest|playwright|typecheck|lint|verification|verificaci[oó]n|verification criteria)\b/i;
 
-/** The three pipeline stages this gate requires be declared, in this order. */
+function isNegated(prompt, match) {
+  const from = Math.max(0, match.index - NEGATION_LOOK_BACK);
+  return NEGATION_PATTERN.test(prompt.slice(from, match.index));
+}
+
+function hasAffirmativeMention(prompt, pattern) {
+  return allMatches(pattern, prompt).some((match) => !isNegated(prompt, match));
+}
+
 const REQUIRED_STAGES = [
   {
     id: 'definition',
-    isDeclared: (prompt) => DEFINITION_PATTERN.test(prompt),
+    isDeclared: (prompt) => hasAffirmativeMention(prompt, DEFINITION_PATTERN),
     missing:
       'DEFINITION: does not declare where the context came from (a prior scout, read-only exploration, or an already-written asserts/brief).',
     line: 'Verified context: <path to the cited asserts/brief> — or: a prior scout ran, findings at <path>.',
   },
   {
     id: 'writing',
-    isDeclared: (prompt) => WRITING_PATTERN.test(prompt),
+    isDeclared: (prompt) => hasAffirmativeMention(prompt, WRITING_PATTERN),
     missing:
       'WRITING: does not declare what is verified nor with what command. A builder does not validate its own work without a criterion written beforehand.',
     line: 'Verification: <exact command> and what is expected. Anything that cannot run is reported OMITTED, never PASS.',
@@ -128,19 +101,11 @@ const REQUIRED_STAGES = [
   },
 ];
 
-function isExempt(toolInput, prompt, builderSubagents, exemptSubagents) {
-  const subagentType = String(
-    toolInput.subagent_type ?? toolInput.subagentType ?? '',
-  ).toLowerCase();
-  if (exemptSubagents.includes(subagentType)) return true;
-  // An unknown type is not assumed to be a builder: the safe side here is not to
-  // invent requirements for agents this gate cannot classify.
-  if (subagentType && !builderSubagents.includes(subagentType)) return true;
-  if (EXEMPT_LEVEL_PATTERN.test(prompt)) return true;
-  if (!DEMANDING_LEVEL_PATTERN.test(prompt)) return true;
-  if (!IMPLEMENTATION_VERBS.test(prompt)) return true;
-  if (HARNESS_PATTERN.test(prompt)) return true;
-  return false;
+function isExempt(toolInput, prompt, exemptSubagents) {
+  if (isSubagentNamedIn(toolInput, exemptSubagents)) return true;
+  if (!DEMANDING_LEVELS.has(operativeLevelOf(prompt))) return true;
+  if (!isImplementationRequest(prompt)) return true;
+  return isHarnessWork(prompt);
 }
 
 runGate(
@@ -158,19 +123,14 @@ runGate(
 
     const prompt = delegationPromptOf(toolInput);
     if (!prompt.trim()) return;
-
-    const builderSubagents =
-      parameters.builderSubagents ?? DEFAULT_BUILDER_SUBAGENTS;
-    const exemptSubagents =
-      parameters.exemptSubagents ?? DEFAULT_EXEMPT_SUBAGENTS;
-    if (isExempt(toolInput, prompt, builderSubagents, exemptSubagents)) return;
+    if (isExempt(toolInput, prompt, parameters.exemptSubagents)) return;
 
     const missingStages = REQUIRED_STAGES.filter(
       (stage) => !stage.isDeclared(prompt),
     );
     if (missingStages.length === 0) return;
 
-    const isHighRisk = HIGH_RISK_PATTERN.test(prompt);
+    const isHighRisk = operativeLevelOf(prompt) === LEVELS.HIGH_RISK;
     const details = missingStages.map((stage) => stage.missing).join(' ');
     const lines = missingStages.map((stage) => `  ${stage.line}`).join('\n');