@event4u/agent-config 14.1.0 → 14.4.0

package/src/scripts/decision_memo.ts

@@ -0,0 +1,325 @@
+/**
+ * decision_memo — the decision-memo channel (UOTL Phase 4.3, sequenced by
+ * road-to-long-horizon-execution Phase 2.2).
+ *
+ * ## What this is for
+ *
+ * A question the agent resolves without contacting the user is only
+ * legitimate if the resolution is REVIEWABLE afterwards. Before this, a
+ * medium-impact resolution left no trace at all: the run either halted (a
+ * contact) or decided silently (no record). Neither is what the ladder wants
+ * between those two — the memo is.
+ *
+ * One file per resolution under
+ * `agents/runtime/state/decisions/<run>/NNN.md`, monotonic index per run.
+ * Local-only: the whole `agents/runtime/` tree is gitignored, so a memo never
+ * reaches a commit unless a human copies it out.
+ *
+ * ## Why a writer script rather than "the agent writes a markdown file"
+ *
+ * Two properties a prose instruction cannot give:
+ *
+ * - **The shape cannot drift.** Every memo carries the same five fields the
+ *   roadmap names — question, chosen option, reasoning, resolver, confidence —
+ *   because the writer refuses a memo missing any of them. A directory of
+ *   free-form notes is not a channel, it is a folder.
+ * - **The index is monotonic and gap-free per run**, so "003 exists but 002
+ *   does not" is impossible and a reader can tell a pruned memo from an
+ *   unwritten one.
+ *
+ * ## What it deliberately does NOT do
+ *
+ * It does not decide anything, and it does not gate. A memo is a record of a
+ * resolution that already happened; making the writer refuse a resolution
+ * would put a decision gate in an observability surface, which is the shape
+ * `roadmap-progress` and the interruption ledger both stay clear of.
+ *
+ * It also carries no locked-class check, and that is not an omission to fix
+ * here: `high_impact` and `user_required` are refused at the SCHEMA
+ * (`config.ts::_build_decision_resolution`), before any model sees a route.
+ * A second check in the writer would read as the enforcement point and put
+ * the real one out of mind — the schema is the gate, this is the ledger.
+ */
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+export const DECISIONS_DIR_REL = path.join('agents', 'runtime', 'state', 'decisions');
+
+/** The five fields the roadmap names, and nothing optional among them. */
+export interface DecisionMemo {
+    /** The question as it was actually open — not a summary of the answer. */
+    question: string;
+    /** The option taken, stated so a reader can see what was NOT taken. */
+    chosen: string;
+    /** Why. The load-bearing field: without it the memo is a log line. */
+    reasoning: string;
+    /** Which rung resolved it — `agent`, `second-model:<provider>`, `council`. */
+    resolver: string;
+    /** Self-assessed, `high` | `medium` | `low`. Never a number. */
+    confidence: 'high' | 'medium' | 'low';
+}
+
+const CONFIDENCE: ReadonlySet<string> = new Set(['high', 'medium', 'low']);
+
+/**
+ * A run id has to be a filename component. `safe` here is deliberately
+ * narrow rather than a sanitiser: a run id that needs escaping is a caller
+ * bug, and silently rewriting it would put two runs in one directory.
+ */
+export function isSafeRunId(runId: string): boolean {
+    return /^[A-Za-z0-9_-]{1,64}$/.test(runId);
+}
+
+export function runDir(repoRoot: string, runId: string): string {
+    return path.join(repoRoot, DECISIONS_DIR_REL, runId);
+}
+
+/**
+ * The next index for this run — one past the highest `NNN.md` present.
+ *
+ * Reads the directory rather than a counter file: a counter that drifts from
+ * the directory is a second source of truth, and the directory is the one a
+ * human reads.
+ */
+export function nextIndex(dir: string): number {
+    let entries: string[];
+    try {
+        entries = fs.readdirSync(dir);
+    } catch {
+        return 1;
+    }
+    let max = 0;
+    for (const name of entries) {
+        const m = /^(\d{3})\.md$/.exec(name);
+        if (m === null) continue;
+        const n = Number.parseInt(m[1] as string, 10);
+        if (Number.isFinite(n) && n > max) max = n;
+    }
+    return max + 1;
+}
+
+/** Refusal reasons, as a list so a caller can report all of them at once. */
+export function validate(memo: Partial<DecisionMemo>): string[] {
+    const problems: string[] = [];
+    for (const field of ['question', 'chosen', 'reasoning', 'resolver'] as const) {
+        const v = memo[field];
+        if (typeof v !== 'string' || v.trim() === '') {
+            problems.push(`${field} is required and must be non-empty`);
+        }
+    }
+    const c = memo.confidence;
+    if (typeof c !== 'string' || !CONFIDENCE.has(c)) {
+        problems.push(`confidence must be one of high | medium | low (got ${String(c)})`);
+    }
+    return problems;
+}
+
+export function render(memo: DecisionMemo, index: number, stampedAt: string): string {
+    return [
+        `# Decision ${String(index).padStart(3, '0')}`,
+        '',
+        `- **Resolver:** ${memo.resolver}`,
+        `- **Confidence:** ${memo.confidence}`,
+        `- **Recorded:** ${stampedAt}`,
+        '',
+        '## Question',
+        '',
+        memo.question.trim(),
+        '',
+        '## Chosen',
+        '',
+        memo.chosen.trim(),
+        '',
+        '## Reasoning',
+        '',
+        memo.reasoning.trim(),
+        '',
+    ].join('\n');
+}
+
+export interface WriteResult {
+    path: string;
+    index: number;
+}
+
+/**
+ * Write one memo. Throws on a validation failure — a memo that cannot be
+ * written is a caller bug and must not degrade into a partial record.
+ */
+export function writeMemo(
+    repoRoot: string,
+    runId: string,
+    memo: DecisionMemo,
+    opts: { now?: () => Date } = {},
+): WriteResult {
+    if (!isSafeRunId(runId)) {
+        throw new Error(
+            `decision_memo: run id ${JSON.stringify(runId)} is not a safe filename ` +
+                `component (letters, digits, _ and - only, 1..64 chars)`,
+        );
+    }
+    const problems = validate(memo);
+    if (problems.length > 0) {
+        throw new Error(`decision_memo: refusing an incomplete memo — ${problems.join('; ')}`);
+    }
+    const dir = runDir(repoRoot, runId);
+    fs.mkdirSync(dir, { recursive: true });
+    const stamp = (opts.now ?? ((): Date => new Date()))().toISOString();
+    // Claim the slot with `wx` and retry on collision, rather than
+    // read-then-write.
+    //
+    // R2 review, finding 10. `nextIndex` followed by a plain `writeFileSync`
+    // is a read-then-write with no lock: two memos written for the same run
+    // concurrently — the unattended or parallel lane this module exists for,
+    // or simply two shell calls — compute the same index and the second
+    // silently overwrites the first. That breaks the exact property the header
+    // sells as this module's reason to exist ("monotonic and gap-free per run,
+    // so a reader can tell a pruned memo from an unwritten one"), because a
+    // LOST memo leaves no gap at all.
+    //
+    // The bound is generous and finite: a loop that cannot fail would hide a
+    // permission error as a hang.
+    const MAX_ATTEMPTS = 64;
+    for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
+        const index = nextIndex(dir);
+        const file = path.join(dir, `${String(index).padStart(3, '0')}.md`);
+        try {
+            fs.writeFileSync(file, render(memo, index, stamp), { encoding: 'utf-8', flag: 'wx' });
+            return { path: file, index };
+        } catch (err) {
+            // EEXIST means another writer took this index between the read and
+            // the write — re-read and take the next one. Anything else (EACCES,
+            // ENOSPC) is a real failure and must not be retried into a hang.
+            if ((err as NodeJS.ErrnoException).code !== 'EEXIST') throw err;
+        }
+    }
+    throw new Error(
+        `decision_memo: could not claim an index for run ${JSON.stringify(runId)} ` +
+            `after ${MAX_ATTEMPTS} attempts — another writer is taking every slot`,
+    );
+}
+
+/** Every memo of one run, in index order. */
+export function listMemos(repoRoot: string, runId: string): string[] {
+    const dir = runDir(repoRoot, runId);
+    let entries: string[];
+    try {
+        entries = fs.readdirSync(dir);
+    } catch {
+        return [];
+    }
+    return entries
+        .filter((n) => /^\d{3}\.md$/.test(n))
+        .sort()
+        .map((n) => path.join(dir, n));
+}
+
+const USAGE = `usage: decision_memo write --run <id> --question <q> --chosen <c> \\
+                        --reasoning <r> --resolver <who> --confidence <high|medium|low>
+       decision_memo list --run <id>
+
+Records one autonomously-resolved question so it is reviewable after the run.
+Writes agents/runtime/state/decisions/<run>/NNN.md — local-only (gitignored).
+
+--run takes ANY slug, and that freedom has a cost worth stating (R2 round 4,
+finding 3): interruption_report attributes memos to a run by joining on the
+session-derived run id, so a memo written under a hand-picked slug is counted
+by 'run:supervise --digest' (which counts directories) and NOT by the report's
+median_memos_per_run (which joins). The two disagree about the same files, and
+the report's zero reads as "no memos" rather than "no join".
+
+To be attributable, pass the id the ledger uses:
+  agent-config run:supervise --digest    # lists the session ids in play
+A free-form slug is still valid and still recorded — it is simply a memo about
+a run the report cannot name.
+
+Locked classes (high_impact, user_required) are refused at the CONFIG SCHEMA,
+never here: this is the ledger, not the gate.
+`;
+
+function argValue(argv: string[], flag: string): string | null {
+    const i = argv.indexOf(flag);
+    if (i === -1 || i + 1 >= argv.length) return null;
+    return argv[i + 1] ?? null;
+}
+
+export function main(argv: string[] = process.argv.slice(2)): number {
+    const sub = argv[0] ?? '';
+    if (sub === '' || sub === '--help' || sub === '-h') {
+        process.stdout.write(USAGE);
+        return sub === '' ? 2 : 0;
+    }
+    const repoRoot = argValue(argv, '--root') ?? process.cwd();
+    const runId = argValue(argv, '--run');
+    if (runId === null) {
+        process.stderr.write('decision_memo: --run <id> is required\n');
+        return 2;
+    }
+
+    if (sub === 'list') {
+        const memos = listMemos(repoRoot, runId);
+        if (memos.length === 0) {
+            process.stdout.write(`decision_memo: no memos for run ${runId}\n`);
+            return 0;
+        }
+        for (const m of memos) {
+            process.stdout.write(`${path.relative(repoRoot, m)}\n`);
+        }
+        return 0;
+    }
+
+    if (sub !== 'write') {
+        process.stderr.write(`decision_memo: unknown subcommand '${sub}'\n${USAGE}`);
+        return 2;
+    }
+
+    const memo: Partial<DecisionMemo> = {
+        question: argValue(argv, '--question') ?? '',
+        chosen: argValue(argv, '--chosen') ?? '',
+        reasoning: argValue(argv, '--reasoning') ?? '',
+        resolver: argValue(argv, '--resolver') ?? '',
+        confidence: (argValue(argv, '--confidence') ?? '') as DecisionMemo['confidence'],
+    };
+    const problems = validate(memo);
+    if (problems.length > 0) {
+        process.stderr.write(`decision_memo: ${problems.join('; ')}\n`);
+        return 2;
+    }
+    try {
+        const res = writeMemo(repoRoot, runId, memo as DecisionMemo);
+        process.stdout.write(`${path.relative(repoRoot, res.path)}\n`);
+        return 0;
+    } catch (exc) {
+        process.stderr.write(`${exc instanceof Error ? exc.message : String(exc)}\n`);
+        return 2;
+    }
+}
+
+/**
+ * The realpath-comparing form, not a `basename` test: an installed projection
+ * and macOS `/var` → `/private/var` both make `argv[1]` a symlink whose URL
+ * differs from `import.meta.url`, and a naive comparison silently no-ops the
+ * CLI. Same shape as `interruption_report.ts::_isCliEntry`.
+ */
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
+if (_isCliEntry()) {
+    process.exit(main());
+}

package/src/scripts/dispatch_r2_reviewer.ts

@@ -426,35 +426,170 @@ export function expectedHashes(args: {
     return {
         scope_hash: sha256(args.scopeDiffText),
         roadmap_hash: args.roadmapText == null ? 'none' : sha256(args.roadmapText),
-        ac_hash: args.acText == null ? 'none' : sha256(args.acText),
+        // ONE predicate, shared with the prompt builder. An empty extraction
+        // used to hash to e3b0c44298fc…b855 — the SHA-256 of the empty string,
+        // which looks like a real hash in the manifest and re-derives
+        // identically on `--verify-current`, so the gate confirmed a criteria
+        // set that was never there. `'none'` is the value that already means
+        // "no input" for `roadmap_hash`; an absent AC block gets the same word.
+        ac_hash: hasAcceptanceCriteria(args.acText) ? sha256(args.acText as string) : 'none',
     };
 }
 
 /**
- * Extract the `## Acceptance Criteria` section — from that heading (inclusive)
- * to the next `## ` heading or EOF. No section → empty string.
+ * Does an extraction carry acceptance criteria?
+ *
+ * The single predicate behind BOTH the manifest's `ac_hash` and the reviewer
+ * prompt's roadmap line. It exists because the first version of this fix encoded
+ * the same question twice — truthiness in {@link expectedHashes}, an explicit
+ * `!== null && !== ''` at the call site — and the two agreed only for as long as
+ * `''` stayed the sole reachable falsy value. Refining one alone (this `.trim()`,
+ * for instance) would then have made the manifest record a hash while the prompt
+ * told the reviewer there were no criteria: the same two-places-disagree failure
+ * this module was being repaired for, one level up. Caught by the R2 review of
+ * that very fix.
+ *
+ * Whitespace-only counts as absent. The inline collector can emit blank lines
+ * between a criterion and its loose-list continuation, so a result that is
+ * structurally non-empty and semantically empty is reachable.
+ */
+export function hasAcceptanceCriteria(acText: string | null | undefined): boolean {
+    return typeof acText === 'string' && acText.trim() !== '';
+}
+
+/**
+ * Extract a roadmap's acceptance criteria in either form the tree uses.
+ *
+ * Two forms, because roadmap authors write both and the reviewer needs whichever
+ * one is present:
+ *
+ * 1. A `## Acceptance Criteria` section — from that heading (inclusive) to the
+ *    next `## ` heading or EOF.
+ * 2. Inline `- **AC-n:**` bullets, declared per phase with no section heading —
+ *    collected with their indented continuation lines.
+ *
+ * Neither form → empty string, and every caller must treat that as "no criteria"
+ * rather than as an extracted-and-empty block: see {@link expectedHashes} and the
+ * prompt's roadmap line.
+ *
+ * The heading form is tried first and wins outright when found. Measured
+ * 2026-08-18 over the 44 active roadmaps: 21 heading-only, 7 inline-only, 0
+ * carrying both, 16 carrying neither — so the two forms do not currently
+ * co-occur and a precedence rule is a guard against a future file rather than a
+ * choice between live populations.
+ *
+ * WHY THE INLINE FORM WAS MISSING, stated because this is the second instance of
+ * the same defect class in this one function. The first was case sensitivity
+ * (`## Acceptance criteria` extracted nothing, found by the zcs-close R2 review
+ * 2026-08-09). The second is this: an inline-only roadmap yielded `''`, nothing
+ * downstream noticed, and the reviewer was handed a 0-byte
+ * `acceptance-criteria.md` under a prompt that said the criteria had been
+ * extracted. The R2 reviewer is the independent check on AC conformance, so
+ * blinding it while the artefact reads as though it checked is the
+ * gate-that-scans-nothing-exits-green shape one layer up.
  */
 export function extractAcceptanceCriteria(roadmapText: string): string {
     const lines = roadmapText.split('\n');
     let start = -1;
     for (let i = 0; i < lines.length; i++) {
-        // Case-insensitive: the tree carries both `## Acceptance Criteria` and
+        // Case-insensitive, and NOT anchored at the end of the line.
+        //
+        // Case first: the tree carries both `## Acceptance Criteria` and
         // `## Acceptance criteria`; a case-sensitive match silently extracted
         // nothing for the latter (found by the zcs-close R2 review, 2026-08-09).
-        if (/^## acceptance criteria\s*$/i.test(lines[i] as string)) {
+        //
+        // The end-anchor was the same defect wearing a different mask, and it was
+        // LIVE: `\s*$` rejected a heading carrying a qualifier, so
+        // `## Acceptance criteria (per phase, on promotion to ready)` and
+        // `## Acceptance criteria (anti-dump — the review-s own rule)` extracted
+        // nothing. Two roadmaps, measured 2026-08-18 — and they had been counted
+        // as "declares no criteria" by the very census that motivated this fix,
+        // which is how a matcher tuned to its own measurement hides its misses.
+        if (/^##\s+acceptance criteria\b/i.test(lines[i] as string)) {
             start = i;
             break;
         }
     }
-    if (start === -1) return '';
-    let end = lines.length;
-    for (let i = start + 1; i < lines.length; i++) {
-        if (/^## /.test(lines[i] as string)) {
-            end = i;
-            break;
+    if (start !== -1) {
+        let end = lines.length;
+        for (let i = start + 1; i < lines.length; i++) {
+            if (/^## /.test(lines[i] as string)) {
+                end = i;
+                break;
+            }
+        }
+        return lines.slice(start, end).join('\n');
+    }
+    return extractInlineAcceptanceCriteria(lines);
+}
+
+/**
+ * An inline criterion bullet, at any indent and with either bullet marker.
+ *
+ * Indent-tolerant so a nested criterion is emitted as its own row rather than
+ * folded into its parent as a continuation line — folding made the extraction
+ * shape, and therefore `ac_hash`, a function of indentation depth. Neither the
+ * `*` marker nor a nested criterion occurs in the tree today (measured
+ * 2026-08-18 across all 44 active roadmaps: zero of each), so this is a guard
+ * against a future file, not a fix for a live population.
+ */
+const AC_BULLET_RE = /^\s*[-*]\s+\*\*AC-/;
+
+/**
+ * Collect inline `- **AC-n:**` bullets and their continuation lines.
+ *
+ * A continuation line is indented and non-blank. Bullets are emitted in file
+ * order and separated by nothing but their own newline: each one is
+ * self-labelling (`AC-0`, `AC-1`, …), so a synthetic section heading would be
+ * text this function invented rather than text the roadmap declared.
+ *
+ * Two stopping rules, and the second is the subtle one:
+ *
+ * - another criterion bullet ends the current one, at any indent — see
+ *   {@link AC_BULLET_RE};
+ * - a blank line ends it ONLY when the next non-blank line is not an indented
+ *   continuation. Markdown loose lists separate a bullet from its second
+ *   paragraph with exactly that blank line, so breaking on the blank
+ *   unconditionally truncated the criterion and emitted a PARTIAL extraction —
+ *   which then hashed to a real value and read as complete. That is the
+ *   looks-like-success shape this whole function exists to remove, relocated
+ *   from "empty but claimed" to "half but claimed"; caught by the R2 review of
+ *   the first version. No roadmap uses a loose continuation today (measured
+ *   2026-08-18: zero across all 44), so this is latent-defect removal.
+ */
+function extractInlineAcceptanceCriteria(lines: readonly string[]): string {
+    const out: string[] = [];
+    for (let i = 0; i < lines.length; i++) {
+        if (!AC_BULLET_RE.test(lines[i] as string)) continue;
+        out.push(lines[i] as string);
+        let j = i + 1;
+        while (j < lines.length) {
+            const line = lines[j] as string;
+            // A sibling or nested criterion owns itself; hand it back to the
+            // outer loop rather than absorbing it.
+            if (AC_BULLET_RE.test(line)) break;
+            if (/^\s+\S/.test(line)) {
+                out.push(line);
+                j++;
+                continue;
+            }
+            if (line.trim() !== '') break;
+            // Blank: look past the run of blanks for an indented continuation.
+            let k = j;
+            while (k < lines.length && (lines[k] as string).trim() === '') k++;
+            const resumes =
+                k < lines.length &&
+                /^\s+\S/.test(lines[k] as string) &&
+                !AC_BULLET_RE.test(lines[k] as string);
+            if (!resumes) break;
+            for (let b = j; b < k; b++) out.push(lines[b] as string);
+            j = k;
         }
+        // Resume the outer scan AT the line that stopped the walk, so a
+        // criterion bullet that ended this one is still matched.
+        i = j - 1;
     }
-    return lines.slice(start, end).join('\n');
+    return out.join('\n');
 }
 
 /**
@@ -576,11 +711,29 @@ function reviewerPrompt(args: {
     headSha: string;
     scopeHash: string;
     roadmapGiven: boolean;
+    acGiven: boolean;
     changedFiles: readonly string[];
 }): string {
-    const roadmapLine = args.roadmapGiven
-        ? '- roadmap under review: `roadmap.md` (Acceptance Criteria extracted to `acceptance-criteria.md`)'
-        : '- roadmap under review: none (`acceptance-criteria.md` is empty)';
+    // Three states, not two. Branching on `roadmapGiven` alone told the reviewer
+    // "Acceptance Criteria extracted" whenever a roadmap was supplied — including
+    // when the extraction returned nothing and the file beside it was 0 bytes. A
+    // reviewer told the criteria are in a file it finds empty has no way to tell
+    // an extraction failure from a roadmap that genuinely declares none, so it
+    // cannot report the gap.
+    //
+    // The empty branch reports the EXTRACTION, never the roadmap. Its first
+    // version said "it declares NO acceptance criteria" — a claim the extractor
+    // cannot establish, since an unrecognised shape produces the identical empty
+    // result. That turned a silent failure into an affirmative false statement
+    // handed to the one independent check on AC conformance, which is strictly
+    // worse: silence invites a look, a false assertion forecloses it. Caught by
+    // the R2 review of the first version, and it was not hypothetical — the
+    // trailing-text heading it names was live in two roadmaps.
+    const roadmapLine = !args.roadmapGiven
+        ? '- roadmap under review: none (`acceptance-criteria.md` is empty)'
+        : args.acGiven
+          ? '- roadmap under review: `roadmap.md` (Acceptance Criteria extracted to `acceptance-criteria.md`)'
+          : '- roadmap under review: `roadmap.md` — NO acceptance criteria could be EXTRACTED from it, in either recognised form (an `## Acceptance criteria` heading, or inline `- **AC-n:**` bullets), so `acceptance-criteria.md` is empty. Two different things produce that result and the dispatcher cannot tell them apart: the roadmap declares none, or it declares them in a shape the extractor does not recognise. Open `roadmap.md`, decide which, and report a finding if the criteria are there.';
     return [
         `# R2 completion review — ${args.slug}`,
         '',
@@ -1037,6 +1190,7 @@ function runDispatch(args: Args): number {
         headSha,
         scopeHash: hashes.scope_hash,
         roadmapGiven: roadmapText !== null,
+        acGiven: hasAcceptanceCriteria(acText),
         changedFiles,
     });
     const manifest = deriveManifest({

package/src/scripts/hook_manifest.json

@@ -0,0 +1 @@
+{"fingerprint":"4834904a:65187","manifest":{"schema_version":1,"concerns":{"chat-history":{"script":"src/scripts/chat_history.ts","args":["hook-dispatch"],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["result"]},"hot-context":{"script":"src/scripts/hot_context_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"handoff-context":{"script":"src/scripts/handoff_context_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"roadmap-progress":{"script":"src/scripts/roadmap_progress_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"onboarding-gate":{"script":"src/scripts/onboarding_gate_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"context-hygiene":{"script":"src/scripts/context_hygiene_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"verify-before-complete":{"script":"src/scripts/before_complete_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input","result"]},"ship-diff-volume":{"script":"src/scripts/hooks/ship_diff_volume_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"minimal-safe-diff":{"script":"src/scripts/minimal_safe_diff_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"injection-scan":{"script":"src/scripts/injection_scan_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input","result"]},"block-no-verify":{"script":"src/scripts/hooks/block_no_verify.ts","args":[],"fail_closed":true,"severity":"blocking","needs_payload_bodies":["input"]},"block-kernel-rule-writes":{"script":"src/scripts/hooks/block_kernel_rule_writes.ts","args":[],"fail_closed":true,"severity":"blocking","needs_payload_bodies":["input"]},"block-config-weakening":{"script":"src/scripts/hooks/block_config_weakening.ts","args":[],"fail_closed":false,"severity":"blocking","needs_payload_bodies":["input"]},"rtk-wrap":{"script":"src/scripts/hooks/rtk_wrap_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"design-slop":{"script":"src/scripts/hooks/design_slop_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"ui-route-nudge":{"script":"src/scripts/hooks/ui_route_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"code-graph-nudge":{"script":"src/scripts/hooks/code_graph_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Grep","Glob","Read"],"needs_payload_bodies":["input"]},"memory-learn":{"script":"src/scripts/memory_learn_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"first-run-gate":{"script":"src/scripts/first_run_gate_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"profile-staleness":{"script":"src/scripts/profile_staleness_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"wrapper-freshness":{"script":"src/scripts/wrapper_freshness_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"surface-probe":{"script":"src/scripts/surface_probe_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"team-review-gate":{"script":"src/scripts/team_review_gate_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"pr-url-reminder":{"script":"src/scripts/pr_url_reminder_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input","result"]},"language-mirror":{"script":"src/scripts/language_mirror_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"git-authorization":{"script":"src/scripts/git_authorization_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"block-unauthorized-git":{"script":"src/scripts/hooks/block_unauthorized_git.ts","args":[],"fail_closed":true,"severity":"blocking","needs_payload_bodies":["input"]},"evidence-independence":{"script":"src/scripts/hooks/evidence_independence.ts","args":[],"fail_closed":false,"severity":"blocking","needs_payload_bodies":["input"]},"session-canary":{"script":"src/scripts/session_canary_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"council-availability":{"script":"src/scripts/council_availability_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"telemetry-disclosure":{"script":"src/scripts/telemetry_disclosure_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"self-repair":{"script":"src/scripts/self_repair_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"session-register":{"script":"src/scripts/session_register_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"orchestration-record":{"script":"src/scripts/hooks/orchestration_record_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Agent","Task"],"needs_payload_bodies":["input","result"]},"telemetry-usage":{"script":"src/scripts/hooks/telemetry_usage_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Skill"],"needs_payload_bodies":["input"]},"delegation-nudge":{"script":"src/scripts/hooks/delegation_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","nudge_rank":1},"skill-route":{"script":"src/scripts/hooks/skill_route_hook.ts","args":[],"fail_closed":false,"severity":"advisory","nudge_rank":2},"end-review-nudge":{"script":"src/scripts/hooks/end_review_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","skip_on_refusal_retry":true},"turn-end-gate":{"script":"src/scripts/hooks/turn_end_gate_hook.ts","args":[],"fail_closed":false,"severity":"blocking"},"edit-shape":{"script":"src/scripts/hooks/edit_shape_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Write"],"needs_payload_bodies":["input"]},"reread-guard":{"script":"src/scripts/hooks/reread_guard_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Read","Edit","Write"],"needs_payload_bodies":["input"]},"session-eol":{"script":"src/scripts/hooks/session_eol_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"run-continuation":{"script":"src/scripts/hooks/run_continuation_hook.ts","args":[],"fail_closed":false,"severity":"blocking"},"interruption-ledger":{"script":"src/scripts/hooks/interruption_ledger_hook.ts","args":[],"fail_closed":false,"severity":"advisory","skip_on_refusal_retry":true},"subagent-ledger":{"script":"src/scripts/hooks/subagent_ledger_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"tool-result-bytes":{"script":"src/scripts/hooks/tool_result_bytes_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"spawn-guard-shadow":{"script":"src/scripts/hooks/spawn_guard_shadow_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Agent","Task"]}},"roles":{"worker":{"drop":["delegation-nudge","skill-route","end-review-nudge","council-availability","team-review-gate","self-repair","session-eol","interruption-ledger"]}},"platforms":{"augment":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress"],"pre_tool_use":["block-no-verify","block-unauthorized-git","evidence-independence","block-kernel-rule-writes","block-config-weakening","rtk-wrap","design-slop","ui-route-nudge","code-graph-nudge","ship-diff-volume","reread-guard"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape"]},"claude":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress"],"stop":["chat-history","hot-context","verify-before-complete","team-review-gate","end-review-nudge","turn-end-gate","self-repair","session-register","session-eol","interruption-ledger","roadmap-progress","run-continuation"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","delegation-nudge","skill-route","git-authorization","session-canary","self-repair","session-register"],"pre_tool_use":["block-no-verify","block-unauthorized-git","evidence-independence","block-kernel-rule-writes","block-config-weakening","rtk-wrap","design-slop","ui-route-nudge","code-graph-nudge","ship-diff-volume","reread-guard","spawn-guard-shadow"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","language-mirror"],"pre_compact":["language-mirror","hot-context"],"subagent_start":["subagent-ledger"],"subagent_stop":["subagent-ledger"]},"cowork":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"pre_tool_use":["block-no-verify","block-unauthorized-git","evidence-independence","block-kernel-rule-writes","block-config-weakening","rtk-wrap","design-slop","ui-route-nudge","code-graph-nudge","ship-diff-volume","reread-guard","spawn-guard-shadow"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape"],"subagent_start":["subagent-ledger"],"subagent_stop":["subagent-ledger"]},"cursor":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape"]},"cline":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape"]},"windsurf":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","profile-staleness","wrapper-freshness","surface-probe","session-register"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register"],"user_prompt_submit":["chat-history","verify-before-complete","language-mirror","git-authorization","session-canary","self-repair","session-register"]},"gemini":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape"]},"copilot":{"fallback_only":true}},"native_event_aliases":{"augment":{"SessionStart":"session_start","SessionEnd":"session_end","Stop":"stop","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use"},"claude":{"SessionStart":"session_start","SessionEnd":"session_end","Stop":"stop","UserPromptSubmit":"user_prompt_submit","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use","PreCompact":"pre_compact","SubagentStart":"subagent_start","SubagentStop":"subagent_stop"},"cowork":{"SessionStart":"session_start","SessionEnd":"session_end","Stop":"stop","UserPromptSubmit":"user_prompt_submit","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use","PreCompact":"pre_compact","SubagentStart":"subagent_start","SubagentStop":"subagent_stop"},"cursor":{"sessionStart":"session_start","sessionEnd":"session_end","stop":"stop","beforeSubmitPrompt":"user_prompt_submit","postToolUse":"post_tool_use","preToolUse":"pre_tool_use","preCompact":"pre_compact"},"cline":{"TaskStart":"session_start","TaskResume":"session_start","TaskComplete":"session_end","TaskCancel":"stop","UserPromptSubmit":"user_prompt_submit","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use","PreCompact":"pre_compact"},"windsurf":{"pre_user_prompt":"user_prompt_submit","post_cascade_response":"stop","post_setup_worktree":"session_start"},"gemini":{"SessionStart":"session_start","SessionEnd":"session_end","BeforeAgent":"user_prompt_submit","AfterAgent":"stop","BeforeTool":"pre_tool_use","AfterTool":"post_tool_use"}}}}