@event4u/agent-config 10.1.0 → 10.2.0

package/src/scripts/hooks/delegation_nudge_hook.ts

@@ -128,10 +128,35 @@ function _isObject(v: unknown): v is JsonObject {
 const FILE_TOKEN_RE =
   /`?\b[\w][\w.\-]{0,80}\.(ts|tsx|js|jsx|mjs|cjs|py|php|rb|go|rs|java|kt|swift|md|mdx|json|ya?ml|css|scss|less|html|vue|svelte|sql|sh|bash|c|cpp|h|hpp|cs|toml|xml)\b`?/gi;
 
-export function detectEnumeratedFiles(text: string): number {
+/**
+ * The unique file tokens themselves, lower-cased and stripped of backticks.
+ *
+ * `detectEnumeratedFiles` needs only the size, but `conformance_scan`'s
+ * `task-completeness` check needs the IDENTITIES: it asks which of the files a
+ * prompt enumerated were actually touched, which a count cannot answer. Exposing
+ * them here rather than re-matching `FILE_TOKEN_RE` in the scanner keeps one
+ * regex in the tree — a second copy is the "second artefact to keep in sync"
+ * that would let the classifier and the measurement disagree silently, which is
+ * the property `conformance_scan`'s own header requires of every classifier it
+ * imports.
+ */
+/**
+ * Minimum unique file tokens before the FILE shape counts as a delegable
+ * signal (F7, review). Named rather than inlined because `conformance_scan`'s
+ * `task-completeness` check gates on the same floor: a prompt whose file
+ * enumeration is below it is not treated as naming a deliverable SET by either
+ * reader, and two copies of the number would let them disagree about which
+ * prompts are in scope.
+ */
+export const FILE_SIGNAL_FLOOR = 3;
+
+export function enumeratedFileTokens(text: string): string[] {
   const matches = text.match(FILE_TOKEN_RE) ?? [];
-  const unique = new Set(matches.map((m) => m.replace(/`/g, "").toLowerCase()));
-  return unique.size;
+  return [...new Set(matches.map((m) => m.replace(/`/g, "").toLowerCase()))];
+}
+
+export function detectEnumeratedFiles(text: string): number {
+  return enumeratedFileTokens(text).length;
 }
 
 /**
@@ -246,12 +271,12 @@ export function extractTaskSignals(text: string): ExtractedSignals {
   const conjunction = detectMultiDeliverableConjunction(text);
   const forEach = detectForEachShape(text);
 
-  // F7 (review): a bare file-token count below 3 is common and NOT itself
-  // evidence of independent, parallelizable work — "rename a.ts to b.ts"
-  // names 2 files but is one mechanical edit, not two delegable slices. The
-  // explicit "N files/Dateien" phrase (`detectExplicitSliceCount`) is a
+  // F7 (review): a bare file-token count below FILE_SIGNAL_FLOOR is common and
+  // NOT itself evidence of independent, parallelizable work — "rename a.ts to
+  // b.ts" names 2 files but is one mechanical edit, not two delegable slices.
+  // The explicit "N files/Dateien" phrase (`detectExplicitSliceCount`) is a
   // stronger, author-stated signal and keeps its existing floor of N>=2.
-  const fileSignal = fileCount >= 3 ? fileCount : 0;
+  const fileSignal = fileCount >= FILE_SIGNAL_FLOOR ? fileCount : 0;
 
   let slices = Math.max(fileSignal, explicit, conjunction);
   if (slices === 0 && forEach) {

package/src/scripts/hooks/evidence_independence.ts

@@ -135,9 +135,27 @@ export function isEvaluationPrompt(prompt: string): boolean {
  * ON, so the second-dispatch block requires a self-reference. The pre-loaded-
  * verdict block does NOT: steering an evaluator is wrong whatever it is
  * pointed at.
+ *
+ * That fix was still too wide, and the cross-project session audit (2026-08-12)
+ * measured the cost: `road-to-release-truth/fc1ff181` turn 3 fanned out 16
+ * IMPLEMENTATION workers, and 15 were classified self-scoped on one phrase —
+ * `this branch`. In context it read "two conversions already landed on this
+ * branch in exactly the style you should match", i.e. it named WHERE the work
+ * happens. A worktree dispatch prompt carries that phrase by construction
+ * ("Work in <worktree> (branch …)"), so on a hook-bound host the guard ate 15
+ * of 16 workers — the exact behaviour `evaluator-independence` § "When it does
+ * NOT fire" promises is out of scope ("…or IMPLEMENT is not evaluation and is
+ * not gated").
+ *
+ * So the self-reference must name a SUBJECT a verdict can be shopped for — a
+ * diff, a change, a patch — never the LOCATION the work happens in. `this
+ * branch` is dropped for that reason; `my branch` stays, because the possessive
+ * makes it a claim about the agent's own work rather than an address. `this pr`
+ * stays for the same reason `this diff` does: a PR is a thing reviewers render
+ * verdicts on, whereas a branch is where you stand while working.
  */
 const SELF_SCOPE_RE =
-  /\b(my (work|change|diff|implementation|code|fix|patch|branch|pr)|this (diff|change|branch|pr|delta|implementation|patch)|the delta|the change i|what i (wrote|built|changed|implemented)|i just (wrote|built|changed|implemented))\b/i;
+  /\b(my (work|change|diff|implementation|code|fix|patch|branch|pr)|this (diff|change|pr|delta|implementation|patch)|the delta|the change i|what i (wrote|built|changed|implemented)|i just (wrote|built|changed|implemented))\b/i;
 
 export function isSelfScoped(prompt: string): boolean {
   return SELF_SCOPE_RE.test(prompt);
@@ -251,16 +269,50 @@ export function decide(
     return { exit: EXIT_ALLOW, stdout: "", stderr: "", evaluations: priorEvaluations };
   }
 
+  // WARN, not block — a deliberate severity decision, not an oversight.
+  //
+  // This branch decides from PROSE ALONE: `isEvaluationPrompt` and `isSelfScoped`
+  // both infer intent from a natural-language prompt, and no structured fact
+  // corroborates them. Under the tier rule in `docs/contracts/hook-architecture-v1.md`
+  // (§ What a concern may block on) that is Tier 3, and Tier 3 may only warn.
+  //
+  // It is written from measurement, not taste. A 16-way fan-out of IMPLEMENTATION
+  // subagents lost 15 workers to this branch, because `isEvaluationPrompt` fired
+  // on the unavoidable words review/audit/check and `isSelfScoped` on the phrase
+  // `this branch` — an address every worktree dispatch prompt carries. Narrowing
+  // the phrase list fixed that instance; the council convened on the design
+  // (anthropic + openai, 2026-08-12, quorum 2/2) held that no finite pattern can
+  // bound the false-positive set, and that a prompt — unlike a shell command —
+  // has no grammar to anchor an "invoked vs named" discriminator to.
+  //
+  // What is NOT downgraded: the pre-loaded-verdict block above. That one matches
+  // a literal steering formulation ("NO-FINDINGS is expected and welcome"), which
+  // IS the violation rather than evidence of one, so it keeps blocking.
+  //
+  // The route back to blocking is structural, not another regex: a `role` /
+  // `evidence_scope` field the dispatcher sets at the call site, where the caller
+  // knows by construction whether it is commissioning an evaluation. Then this
+  // branch reads a field instead of guessing, and becomes Tier 1.
+  // exit 0 + `decision: "warn"` on stdout is how this dispatcher carries an
+  // advisory — NOT exit 2. The internal ladder's `2 = warn` is read as BLOCK by
+  // Claude Code's native PreToolUse contract, which is the defect that made an
+  // advisory guard a hard deny once already; the same shape here would have kept
+  // the fan-out blocked while claiming to warn.
   if (priorEvaluations >= 1) {
     return {
-      exit: EXIT_BLOCK,
-      stdout: "",
-      stderr:
-        `Blocked: second evaluation dispatch of your own work in this turn (verdict ` +
-        `shopping). One evaluation has already run; commissioning another with a ` +
-        `different prompt or scope selects the answer instead of measuring it. ` +
-        `Report what the first pass returned, then re-plan.\n`,
-      evaluations: priorEvaluations,
+      exit: EXIT_ALLOW,
+      stdout: `${JSON.stringify({
+        decision: "warn",
+        reason:
+          `Second evaluation dispatch of your own work in this turn. If both passes ` +
+          `judge the SAME subject, that is verdict shopping — commissioning another ` +
+          `with a different prompt or scope selects the answer instead of measuring ` +
+          `it. Report what the first pass returned, then re-plan. If this is an ` +
+          `implementation fan-out rather than a second review, carry on: this check ` +
+          `reads prose and cannot tell the two apart with certainty.`,
+      })}\n`,
+      stderr: "",
+      evaluations: priorEvaluations + 1,
     };
   }
 

package/src/scripts/hooks/session_eol_hook.ts

@@ -17,6 +17,16 @@
  * SILENCE, never a block (fail-open); hooks cannot inject `/clear`, so the
  * recycle action itself stays advisory-carried by design (roadmap 5.1).
  *
+ * Counter-check (second warn path, also once per session): when the advisory
+ * fired on an earlier Stop and no envelope written since then exists, inject
+ * one further line saying so — the advisory recommends an action whose next
+ * step destroys the session, so recommending it without ever checking the
+ * result is how a silent write failure becomes total context loss. Stamped by
+ * `missing_envelope_warned_at`, gated on the same threshold, so the emergency
+ * off-switch silences BOTH paths. Two independent emitters, at most one line
+ * each per session — the budget the Stop slot carries from this hook is two,
+ * not one.
+ *
  * Phase 4.2 (read surface): every Stop also overwrites
  * `agents/runtime/state/context-fill.json` with the machine-readable fill
  * level + threshold state — display substrate for an external statusline;
@@ -35,6 +45,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import recycleThresholdConfig from '../../config/recycle-threshold-budget.json';
 
+import { RECYCLE_ENVELOPE_REL } from '../_lib/recycle_envelope_paths.js';
 import {
     emptyCounters,
     eolSessionKey,
@@ -67,6 +78,13 @@ export interface SessionEolState {
     counters: EolCounters;
     /** ISO stamp when the recycle advisory fired for this session (F2), or null. */
     advisory_fired_at: string | null;
+    /**
+     * ISO stamp when the follow-up "advised, but no envelope exists" line
+     * fired, or null. Separate from `advisory_fired_at` so the counter-check
+     * is once-per-session in its own right: one reminder is a safety net, one
+     * per Stop for the rest of the session is a nag the reader learns to skip.
+     */
+    missing_envelope_warned_at?: string | null;
     updated_at: string;
 }
 
@@ -105,6 +123,10 @@ export function readState(file: string): SessionEolState {
                 counters: parsed.counters,
                 advisory_fired_at:
                     typeof parsed.advisory_fired_at === 'string' ? parsed.advisory_fired_at : null,
+                missing_envelope_warned_at:
+                    typeof parsed.missing_envelope_warned_at === 'string'
+                        ? parsed.missing_envelope_warned_at
+                        : null,
                 updated_at: typeof parsed.updated_at === 'string' ? parsed.updated_at : '',
             };
         }
@@ -115,10 +137,70 @@ export function readState(file: string): SessionEolState {
         schema_version: 1,
         counters: emptyCounters(),
         advisory_fired_at: null,
+        missing_envelope_warned_at: null,
         updated_at: '',
     };
 }
 
+/**
+ * Is there a recycle envelope under this workspace, written since `since`?
+ *
+ * Two properties, both load-bearing:
+ *
+ * **Only ENOENT counts as missing.** `fs.existsSync` swallows every error into
+ * `false`, so an unreadable directory (EACCES on a mounted or root-owned tree)
+ * would read as "no envelope" and produce the manufactured "your envelope is
+ * gone" warning this check exists to avoid. `statSync` + an errno test is the
+ * only shape that can tell the two apart.
+ *
+ * **Freshness, not mere existence.** The consumer moves the envelope aside at
+ * session_start, so a file still sitting here belongs to a session that never
+ * cleared. Counting it would silence the warning in the case it exists to
+ * catch, and worse: `/clear` would then resume the successor from another
+ * session's state — a wrong resume instead of an empty one. An envelope whose
+ * `written_at` predates the advisory is not this session's.
+ */
+export function envelopeExists(workspaceRoot: string, since: string | null = null): boolean {
+    const target = path.join(workspaceRoot, RECYCLE_ENVELOPE_REL);
+    let raw: string;
+    try {
+        raw = fs.readFileSync(target, 'utf-8');
+    } catch (exc) {
+        // ENOENT is the real "no envelope"; anything else is a failed CHECK,
+        // and a failed check must never assert absence.
+        return (exc as NodeJS.ErrnoException)?.code !== 'ENOENT';
+    }
+    if (since === null) return true;
+    try {
+        const written = (JSON.parse(raw) as { written_at?: unknown }).written_at;
+        // Unparseable or undated: present, and not provably stale. Treat it as
+        // this session's — the alternative warns about a file that is there.
+        if (typeof written !== 'string') return true;
+        return Date.parse(written) >= Date.parse(since);
+    } catch {
+        return true;
+    }
+}
+
+/**
+ * The follow-up line: the advisory already fired, and no envelope arrived.
+ *
+ * This is the half of the reported minimum fix that lives outside the command
+ * — the hook that recommends the call making the same counter-check before the
+ * operator acts on it. Whatever stopped the write (a wrong root, a refusal
+ * scrolled past, a forgotten step), the state visible here is identical, and
+ * the next action the advisory recommended is the one that destroys the
+ * session.
+ */
+export function buildMissingEnvelopeLine(workspaceRoot: string): string {
+    return (
+        `recycle advised earlier, but no envelope exists at ` +
+        `${path.join(workspaceRoot, RECYCLE_ENVELOPE_REL)} — /clear now starts the successor ` +
+        `from nothing. Re-run \`agent-config session:recycle\` and check that it prints the ` +
+        `absolute path it wrote before clearing.`
+    );
+}
+
 /**
  * Resolve the recycle threshold (Phase 3.1): the per-process override wins
  * (tests; `0` = advisory lane off), else the committed constant from
@@ -136,13 +218,22 @@ export function readThresholdTokens(): number | null {
     return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : null;
 }
 
-/** The exactly-one advisory line injected past threshold (Phase 3.2). */
+/**
+ * The exactly-one advisory line injected past threshold (Phase 3.2).
+ *
+ * The `/clear` half is conditional on purpose. An earlier wording read
+ * `run X … then /clear`, which is an instruction to destroy the session with
+ * no check in between — and a reader who followed it while the command was
+ * silently writing nothing lost everything. The proof to wait for is the
+ * absolute path the command prints; naming it costs one clause.
+ */
 export function buildAdvisoryLine(tokens: number, threshold: number): string {
     return (
         `context past recycle threshold (${tokens.toLocaleString('en-US')} of ` +
         `${threshold.toLocaleString('en-US')} tokens): run \`agent-config session:recycle\` to ` +
-        `write the recycle envelope, then /clear — the successor session resumes from the ` +
-        `envelope at session_start (road-to-token-economy-recycling)`
+        `write the recycle envelope. It prints the absolute path it wrote — /clear only after ` +
+        `you have seen that line. The successor session then resumes from the envelope at ` +
+        `session_start (road-to-token-economy-recycling)`
     );
 }
 
@@ -213,10 +304,29 @@ export function main(): number {
         tokens >= threshold &&
         state.advisory_fired_at === null;
 
+    // The counter-check: the advisory fired on an EARLIER Stop (so `state`,
+    // the pre-update snapshot, already carries the stamp) and no envelope has
+    // appeared since. It can never collide with `shouldAdvise` — that branch
+    // requires `advisory_fired_at === null` — so at most one line is emitted
+    // per Stop, and this one at most once per session.
+    //
+    // `threshold !== null` gates it for the same reason the advisory is gated:
+    // `AGENT_RECYCLE_THRESHOLD_TOKENS=0` is documented as the emergency switch
+    // for the whole advisory lane, and a lane that keeps one more warn after
+    // being switched off is not off.
+    const shouldWarnMissing =
+        threshold !== null &&
+        state.advisory_fired_at !== null &&
+        (state.missing_envelope_warned_at ?? null) === null &&
+        !envelopeExists(workspaceRoot, state.advisory_fired_at);
+
     const nextState: SessionEolState = {
         schema_version: 1,
         counters,
         advisory_fired_at: shouldAdvise ? now : state.advisory_fired_at,
+        missing_envelope_warned_at: shouldWarnMissing
+            ? now
+            : (state.missing_envelope_warned_at ?? null),
         updated_at: now,
     };
     try {
@@ -237,6 +347,16 @@ export function main(): number {
         );
         return EXIT_WARN;
     }
+    if (shouldWarnMissing) {
+        process.stdout.write(
+            `${JSON.stringify({
+                decision: 'warn',
+                reason: 'session-eol: recycle advised, no envelope written',
+                additional_context: buildMissingEnvelopeLine(workspaceRoot),
+            })}\n`,
+        );
+        return EXIT_WARN;
+    }
     return 0;
 }
 

package/src/scripts/hooks/turn_end_gate_hook.ts

@@ -400,6 +400,34 @@ export function readCiSettled(workspaceRoot: string): { seen: boolean; settled:
 const _COMPLETION_RE =
     /(^|\n)\s*(?:\*\*)?(?:fertig\b|damit ist alles erledigt|aufgabe erledigt|alles erledigt\b|komplett(?:er)? (?:auftrag|abgearbeitet)|der komplette auftrag ist durch|done[.!]|all done\b|task complete)/i;
 
+/**
+ * The line the claim was found on says the opposite of a claim.
+ *
+ * A line-anchored keyword cannot tell "Fertig." from "Fertig ist der Fix noch
+ * nicht." — both open with the same token, and the second is exactly the honest
+ * status report this gate exists to ENCOURAGE. Measured 2026-08-12: three of ten
+ * realistic closings were refused, and all three were "not done yet" lines.
+ *
+ * This is a negation check on the SAME line, not another attempt to enumerate
+ * completion phrasings. The council that reviewed this guard (anthropic +
+ * openai, 2026-08-12) stated the bound plainly: a finite pattern cannot cover an
+ * infinite false-positive set, so extending the keyword list again would repeat
+ * the move that has already failed three times on the sibling git guard. What
+ * makes a block defensible here is not the pattern — it is that the pattern only
+ * fires as a TRIGGER to consult structured CI state (`ci.settled`), which is the
+ * council's Tier-2 shape. This check removes the cases where the prose itself
+ * already contradicts the trigger.
+ */
+const _NEGATED_CLAIM_RE =
+    /\b(noch nicht|nicht fertig|nicht durch|wäre verfrüht|ist verfrüht|not yet|not done|isn'?t done|nein)\b/i;
+
+/** The line `at` falls on — the scope a negation has to appear in to count. */
+function _lineAround(prose: string, at: number): string {
+    const start = prose.lastIndexOf('\n', at) + 1;
+    const end = prose.indexOf('\n', at);
+    return prose.slice(start, end === -1 ? prose.length : end);
+}
+
 export function detectCompletionClaim(
     reply: string,
     ci: { seen: boolean; settled: boolean },
@@ -410,6 +438,9 @@ export function detectCompletionClaim(
     const m = _COMPLETION_RE.exec(prose);
     if (!m) return null;
     const at = m.index;
+    // The trigger fired, but the line it fired on negates it — a status report,
+    // not a claim. Refusing these punishes exactly the honesty the gate wants.
+    if (_NEGATED_CLAIM_RE.test(_lineAround(prose, at))) return null;
     return {
         detector: 'completion',
         evidence: prose.slice(at, at + 120).trim(),