@event4u/agent-config 14.7.0 → 14.9.0

package/src/scripts/condense.ts

@@ -263,7 +263,9 @@ export {
     type ClaudePathsPlan,
 } from '../install/claudePathsPlan.js';
 import { rule_in_scope } from '../install/ruleInScope.js';
-import { isExclusivelyPackageOnly, partitionActive, setPartitionAnnounce } from '../install/partitionEligibility.js'; // ADR-236
+import { pruneEmptyDirs } from './_lib/prune_empty_dirs.js';
+import { commandsWithheld, partitionActive, personaPartition, setPartitionAnnounce } from '../install/partitionEligibility.js'; // ADR-236
+import { dedupableRules, partitionRulesForDir } from '../install/ruleLayerPartition.js'; // ADR-236, per-host evidence
 import { _claude_paths_plan, derive_trigger_globs } from '../install/claudePathsPlan.js';
 
 const _HERE = path.dirname(fileURLToPath(import.meta.url)); // <repo>/src/scripts
@@ -439,15 +441,6 @@ function _read_augment_rules_use_symlinks(): boolean {
     return false;
 }
 
-/**
- * Per-tool user-scope rule directory, for the scope-dedup below. Only tools
- * whose host reads a user-scope rules directory can have a redundant twin;
- * everything else has nothing to de-duplicate against.
- */
-const USER_SCOPE_RULE_DIRS: Readonly<Record<string, string>> = {
-    '.claude/rules': path.join('.claude', 'rules'),
-};
-
 function _read_projection_scope_dedup(): boolean {
     const data = load_agent_settings({ project_path: MODULE_STATE.SETTINGS_FILE });
     const projection = data['projection'];
@@ -464,60 +457,6 @@ function _read_projection_scope_dedup(): boolean {
     return false;
 }
 
-/**
- * Rules whose user-scope twin is BYTE-IDENTICAL to the source, i.e. safe to
- * skip at project scope: the host still loads the same text, once instead of
- * twice, so nothing the model sees changes.
- *
- * Byte-identity is the whole safety argument and is not negotiable. Keying on
- * the filename alone would silently let a stale globally-installed copy win
- * whenever the two scopes hold different versions — which is the NORMAL state
- * while developing the package (measured: 110/110 shared filenames differing in
- * bytes). This is deliberately not the thin-projection mechanism: no rule
- * becomes trigger-gated, so the quality floor that disabled thin projection
- * does not apply here.
- */
-function _dedupable_rules(tool_dir: string, rules: readonly string[], userHome: string): Set<string> {
-    const relative = USER_SCOPE_RULE_DIRS[tool_dir];
-    if (relative === undefined) {
-        return new Set();
-    }
-    // A hostile or simply absent $HOME must make the dedup inert, not
-    // adventurous. In a container `$HOME` is often unset (so `homedir()` can
-    // resolve to `/`) or world-writable, and this function decides which rules
-    // to STOP emitting — reading an unexpected tree there is how a projection
-    // silently loses a rule. Council review of PR #1055 raised exactly this.
-    let userDirStat: fs.Stats;
-    const userDir = path.join(userHome, relative);
-    try {
-        userDirStat = fs.statSync(userDir);
-    } catch {
-        return new Set();
-    }
-    if (!userDirStat.isDirectory()) {
-        return new Set();
-    }
-    // World-writable user scope: anyone on the box could plant a byte-identical
-    // twin and thereby delete a rule from the project projection. Refuse.
-    if ((userDirStat.mode & 0o002) !== 0) {
-        _print(`  ⚠️  ${tool_dir}: user-scope rules dir is world-writable — scope-dedup skipped`);
-        return new Set();
-    }
-    const skip = new Set<string>();
-    for (const rule of rules) {
-        const twin = path.join(userDir, rule);
-        const source = path.join(MODULE_STATE.RULES_SOURCE, rule);
-        try {
-            if (!_isFile(twin) || !_isFile(source)) continue;
-            if (fs.readFileSync(twin).equals(fs.readFileSync(source))) {
-                skip.add(rule);
-            }
-        } catch {
-            // An unreadable twin is simply not de-duplicable — emit the project copy.
-        }
-    }
-    return skip;
-}
 
 function _lean_projection_mode(): string {
     const data = load_agent_settings({ project_path: MODULE_STATE.SETTINGS_FILE });
@@ -1132,11 +1071,22 @@ function _scoped_rule_basenames(): string[] {
         // is its fourth consumer, after the router compiler, the dist writer, and
         // check_sync. Same predicate in all four; that is the point.
         .filter((p) => !skip_compile_disabled_rule(`rules/${path.basename(p)}`))
-        .filter((p) => !partitionActive(MODULE_STATE.PROJECT_ROOT) || isExclusivelyPackageOnly(p))
         .map((p) => path.basename(p))
         .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
 }
 
+/** Adapter over {@link partitionRulesForDir}; that module carries the reasoning. */
+export function partition_rules_for_dir(
+    tool_dir: string,
+    rules: readonly string[],
+    user_home: string = process.env['HOME'] ?? os.homedir(),
+): string[] {
+    return partitionRulesForDir({
+        toolDir: tool_dir, rules, userHome: user_home, announce: _print,
+        projectRoot: MODULE_STATE.PROJECT_ROOT, rulesSource: MODULE_STATE.RULES_SOURCE,
+    });
+}
+
 /**
  * The emit plan of {@link generate_rule_symlinks}: active tool dir → the exact
  * rule basenames it projects there.
@@ -1161,8 +1111,12 @@ export function projected_rule_trees(
     const dedup_on = _read_projection_scope_dedup();
     const out: Record<string, string[]> = {};
     for (const tool_dir of Object.keys(_filter_tool_dirs(TOOL_DIRS))) {
-        const skip = dedup_on ? _dedupable_rules(tool_dir, rules, user_home) : new Set<string>();
-        out[tool_dir] = rules.filter((r) => !skip.has(r));
+        const skip = dedup_on
+            ? dedupableRules({ toolDir: tool_dir, rules, userHome: user_home,
+                  rulesSource: MODULE_STATE.RULES_SOURCE, announce: _print })
+            : new Set<string>();
+        const kept = rules.filter((r) => !skip.has(r));
+        out[tool_dir] = partition_rules_for_dir(tool_dir, kept, user_home);
     }
     return out;
 }
@@ -1281,7 +1235,10 @@ export function generate_rule_symlinks(): number {
 }
 
 export function generate_windsurfrules(): number {
-    const rules = _scoped_rule_basenames();
+    // Windsurf's LEGACY single-file surface — same host, so the same evidence, keyed
+    // on `.windsurf/rules`. Without this line removing the per-run filter regressed
+    // it 13 → 113: the per-run filter had been covering it by accident.
+    const rules = partition_rules_for_dir('.windsurf/rules', _scoped_rule_basenames());
     const parts = ['# Auto-generated from dist/agent-src/rules/ — do not edit directly\n'];
     for (const rule of rules) {
         const p = path.join(MODULE_STATE.RULES_SOURCE, rule);
@@ -1451,12 +1408,16 @@ function _clean_modern_dir(target_dir: string, valid_names: ReadonlySet<string>)
 export function generate_cursor_mdc_rules(): number {
     const scope = _read_rule_workspaces();
     const pack_scope = _read_rule_packs();
-    const rules = _rglobSorted(MODULE_STATE.RULES_SOURCE, '*.md')
+    let rules = _rglobSorted(MODULE_STATE.RULES_SOURCE, '*.md')
         .filter((p) => _isFile(p))
         .filter((p) => rule_in_scope(p, scope, pack_scope))
         // ADR-004 manual rules are reference-only — never auto-injected into a
         // per-tool tree. Same predicate as generate_rule_symlinks.
         .filter((p) => !_is_manual_rule(p));
+    // ADR-236 per-host partition (src/install/ruleLayerPartition.ts). Narrowing the
+    // list is a REMOVAL, because `_clean_modern_dir` below sweeps to `valid`.
+    const kept = new Set(partition_rules_for_dir('.cursor/rules', rules.map((r) => path.basename(r))));
+    rules = rules.filter((r) => kept.has(path.basename(r)));
     const stems = rules.map((r) => path.basename(r, '.md'));
     const valid = new Set([
         ...stems.map((s) => `${s}.mdc`),
@@ -1473,12 +1434,15 @@ export function generate_cursor_mdc_rules(): number {
 export function generate_windsurf_modern_rules(): number {
     const scope = _read_rule_workspaces();
     const pack_scope = _read_rule_packs();
-    const rules = _rglobSorted(MODULE_STATE.RULES_SOURCE, '*.md')
+    let rules = _rglobSorted(MODULE_STATE.RULES_SOURCE, '*.md')
         .filter((p) => _isFile(p))
         .filter((p) => rule_in_scope(p, scope, pack_scope))
         // ADR-004 manual rules are reference-only — never auto-injected into a
         // per-tool tree. Same predicate as generate_rule_symlinks.
         .filter((p) => !_is_manual_rule(p));
+    // ADR-236 per-host partition — same shape as the cursor emitter above.
+    const kept = new Set(partition_rules_for_dir('.windsurf/rules', rules.map((r) => path.basename(r))));
+    rules = rules.filter((r) => kept.has(path.basename(r)));
     const valid = new Set(rules.map((r) => path.basename(r)));
     _clean_modern_dir(_WINDSURF_RULES_DIR(), valid);
     for (const rule of rules) {
@@ -1781,18 +1745,16 @@ function _nested_command_subpath(source_file: string): string | null {
 /**
  * Project-scope `.claude/commands/<cluster>/<sub>.md` — the colon form.
  *
- * Before this, the package repo's own `.claude/` carried NO commands
- * directory: every command reached Claude Code as a hyphen-named skill
- * wrapper in `.claude/skills/`, while the colon form existed only in the
- * user-global tree written by `install.ts`. Every clustered command was
- * therefore listed TWICE for anyone with a global install
- * (`roadmap-process-full` AND `roadmap:process-full`), costing 4,214 GPT tok
- * of always-loaded catalog for zero added reach — measured 2026-08-02.
+ * Before this, the package repo's own `.claude/` carried NO commands directory:
+ * every command reached Claude Code as a hyphen-named skill wrapper in
+ * `.claude/skills/`, while the colon form existed only in the user-global tree
+ * written by `install.ts`. Every clustered command was therefore listed TWICE
+ * for anyone with a global install (`roadmap-process-full` AND
+ * `roadmap:process-full`), costing 4,214 GPT tok of catalog — measured 2026-08-02.
  *
  * Emitting the nested form here lets `generate_claude_commands` stop wrapping
  * the clustered commands: one listing, same reachability, and reachability no
- * longer depends on a global deploy having run. Claude Code dedupes project
- * and user scope by name, so the two copies of `/cluster:sub` collapse.
+ * longer depends on a global deploy. Dedup AND precedence: `commandsWithheld`.
  *
  * ADR-003 (colon canonical for clusters) and ADR-044 (flat commands stay
  * hyphenated) both hold: flat commands are untouched and keep their wrapper.
@@ -1800,6 +1762,8 @@ function _nested_command_subpath(source_file: string): string | null {
 export function generate_claude_project_commands(
     active_command_slugs: ReadonlySet<string> | null = null,
 ): number {
+    if (commandsWithheld(MODULE_STATE.PROJECT_ROOT)) active_command_slugs = new Set<string>();
+    // Returns before the stale sweep — invariant, see `commandsWithheld`.
     if (!_isDir(path.join(MODULE_STATE.PROJECT_ROOT, 'src', 'domains'))) {
         return 0;
     }
@@ -1816,8 +1780,7 @@ export function generate_claude_project_commands(
 
     const target_root = _CLAUDE_COMMANDS_DIR();
     const valid = new Set(nested.map(([, sub]) => `${sub}.md`));
-    // Sweep stale links first: a renamed or deleted command must not linger as
-    // a dangling `/cluster:sub`.
+    // Sweep stale links first — a renamed, deleted or WITHHELD command must not linger.
     if (_exists(target_root)) {
         for (const item of _rglobSorted(target_root, '*.md')) {
             const rel = _relativeToPosix(item, target_root);
@@ -1825,6 +1788,7 @@ export function generate_claude_project_commands(
                 fs.unlinkSync(item);
             }
         }
+        pruneEmptyDirs(target_root); // else the gate counts 40 empty cluster dirs as 40 commands
     }
 
     let count = 0;
@@ -2297,7 +2261,7 @@ export function generate_persona_symlinks(): number {
         .map((p) => path.basename(p))
         .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
     void personas;
-    const list = direct;
+    const partition = personaPartition(MODULE_STATE.PROJECT_ROOT, direct);
     const tool_dirs = _filter_tool_dirs(PERSONA_TOOL_DIRS);
     let total = 0;
     for (const [tool_dir, rel_prefix] of Object.entries(tool_dirs)) {
@@ -2305,11 +2269,11 @@ export function generate_persona_symlinks(): number {
         _mkdirp(target_dir);
         for (const item of _iterdirSorted(target_dir)) {
             const name = path.basename(item);
-            if (_isSymlink(item) && !list.includes(name) && name !== 'README.md') {
+            if (_isSymlink(item) && !partition.listFor(tool_dir).includes(name) && name !== 'README.md') {
                 fs.unlinkSync(item);
             }
         }
-        for (const persona of list) {
+        for (const persona of partition.listFor(tool_dir)) {
             const link = path.join(target_dir, persona);
             const target = path.join(rel_prefix, persona);
             if (_existsOrSymlink(link)) {
@@ -2319,9 +2283,8 @@ export function generate_persona_symlinks(): number {
             total += 1;
         }
     }
-    info(
-        `  ✅  Created ${total} persona symlinks across ${Object.keys(tool_dirs).length} tool directories (${list.length} personas each)`,
-    );
+    const per_dir = Object.keys(tool_dirs).map((d) => `${d}=${partition.countFor(d)}`);
+    info(`  ✅  Created ${total} persona symlinks — ${per_dir.join(' · ')}${partition.note}`);
     return total;
 }
 
@@ -2521,10 +2484,17 @@ export function project_to_augment(): void {
     const current = new Set<string>();
     let written = 0;
     if (_exists(src_rules)) {
-        const rules = _iterdirSorted(src_rules)
-            .filter((p) => p.endsWith('.md') && _isFile(p))
-            .map((p) => path.basename(p))
-            .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+        // ADR-236 per-host partition, ahead of the `use_symlinks` branch so both
+        // writers narrow; the `existing` minus `current` sweep below makes it a
+        // removal. This emitter never had the scope or ADR-004 manual filters
+        // either — why its count is 15 and the symlink trees' 13. Pre-existing.
+        const rules = partition_rules_for_dir(
+            '.augment/rules',
+            _iterdirSorted(src_rules)
+                .filter((p) => p.endsWith('.md') && _isFile(p))
+                .map((p) => path.basename(p))
+                .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)),
+        );
         for (const rule of rules) {
             const target = path.join(dst_rules, rule);
             if (_isSymlink(target) || _existsOrSymlink(target)) {

package/src/scripts/council_cli.ts

@@ -106,7 +106,8 @@ import {
     renderPostureLines,
     type FallbackPosture,
 } from './_lib/council_fallback_posture.js';
-import { buildFallbackOptions } from './_lib/council_fallback_wiring.js';
+import { wireCouncilFallback } from './_lib/council_fallback_wiring.js';
+import { BILLING_SUBCOMMANDS, billingArgSpec, handleBillingCommand, printBillingGate } from './_lib/billing_grant_cli.js';
 import {
     type ClassificationResult,
     type SizeFitVerdict,
@@ -880,19 +881,11 @@ function build_members(settings: Dict, opts: BuildMembersOptions = {}): External
                 'prints the resolved path.',
         );
     }
-    if (fallback_out !== null) {
-        // Absent/malformed block means `false`, never a throw. Why quota
-        // fall-through is opt-in: `FallbackPolicy.apiOnQuota`.
-        const fallback_cfg = _isDict(ai['fallback']) ? (ai['fallback'] as Dict) : {};
-        fallback_out.options = buildFallbackOptions({
-            apiOnQuota: _pyBool(fallback_cfg['api_on_quota']),
-            hasApiRung: (p) => _API_PROVIDERS.has(p),
-            memberConfig: (p) => ((members_cfg[p] as Dict) || {}) as Dict,
-            modelOverride: (p) => (overrides[p] as string | undefined) ?? null,
-            constructApi: _construct_api_member,
-            emit: appendEvent,
-        });
-    }
+    wireCouncilFallback(fallback_out, ai, {
+        repoRoot: REPO_ROOT, isDict: _isDict, membersCfg: members_cfg, overrides,
+        hasApiRung: (p) => _API_PROVIDERS.has(p),
+        constructApi: _construct_api_member, emit: appendEvent,
+    });
     return members;
 }
 
@@ -2668,6 +2661,7 @@ function cmd_run(
     quorum_out.result = post_run.quorum;
     skipped.push(...post_run.absent);
     recordRoundObservations(REPO_ROOT, members, responses, classifyCliFailure);
+    printBillingGate(fallback_out.options?.parked ?? [], { repoRoot: REPO_ROOT, stdout: _stdout, stderr: _stderr });
     // Attendance telemetry for the reading that actually decided the pass.
     // `post_run.absent` is the mid-flight set only; the construction-time
     // skips already went out under `phase: 'pre_run'` from `build_members`,
@@ -3509,7 +3503,7 @@ interface Args {
     json: boolean;
 }
 
-const _SUBCOMMANDS = ['estimate', 'run', 'debate', 'render', 'replay', 'quota', 'shadow-report', 'status'];
+const _SUBCOMMANDS = ['estimate', 'run', 'debate', 'render', 'replay', 'quota', 'shadow-report', 'status', ...BILLING_SUBCOMMANDS];
 
 const _TOP_USAGE =
     `usage: ${_PROG} [-h]\n` +
@@ -3698,7 +3692,7 @@ function _specsFor(cmd: string): { positionals: string[]; opts: OptSpec[]; requi
                 requiredOpts: [],
             };
         default:
-            return { positionals: [], opts: [], requiredOpts: [] };
+            return billingArgSpec(cmd) ?? { positionals: [], opts: [], requiredOpts: [] };
     }
 }
 
@@ -3902,6 +3896,8 @@ function main(argv: string[] | null = null): number {
         if (args.cmd === 'status') {
             return cmd_status(args);
         }
+        const billing = handleBillingCommand(String(args.cmd), _getattr(args, 'run_id', null), { repoRoot: REPO_ROOT, stdout: _stdout, stderr: _stderr });
+        if (billing !== null) return billing;
     } catch (exc) {
         if (exc instanceof CouncilDisabledError) {
             _stderr(`❌  council:${args.cmd}: ${exc.message}\n`);

package/src/scripts/detect_ai_tells.ts

@@ -111,6 +111,93 @@ export function scanHiddenUnicode(text: string): HiddenUnicodeFinding[] {
   }));
 }
 
+/** One codepoint the strip considered, and what it decided. */
+export interface CarrierRecord {
+  /** `U+XXXX` form, so a record is readable without decoding. */
+  codepoint: string;
+  /** The class `_classify` returned — never a second class list. */
+  cls: string;
+  /** Codepoint index (not UTF-16 index) in the input. */
+  offset: number;
+  disposition: "removed" | "preserved";
+  /** Why it was preserved. `null` when removed. */
+  reason: string | null;
+}
+
+export interface CarrierStripResult {
+  out: string;
+  removed: number;
+  preserved: number;
+  records: CarrierRecord[];
+}
+
+/**
+ * Remove hidden-Unicode carriers from OUTPUT prose — context-aware, opt-in.
+ *
+ * ## Why this is not `_sanitize`
+ *
+ * `lint_hidden_unicode._sanitize` drops every `_classify`-flagged codepoint
+ * unconditionally and then applies `NFKC`. That is correct for its own callers —
+ * it repairs a source FILE — and it is wrong for a deliverable, because
+ * `_ZERO_WIDTH` contains `0x200C` and `0x200D`. A blind pass therefore destroys
+ * emoji ZWJ sequences and complex-script joiners, which are legitimate content.
+ * This function keeps `_classify` as the single source of truth for *what is a
+ * candidate* and adds exactly one predicate for *whether to remove it*.
+ *
+ * ## The predicate
+ *
+ * A flagged codepoint is removed only when the codepoints on BOTH sides are
+ * ASCII (`< 0x80`) or absent. A carrier between two ASCII characters is doing
+ * no linguistic work; one adjacent to any non-ASCII character might be a
+ * joiner, so it stays.
+ *
+ * Deliberately conservative, and the asymmetry is the point: the failure mode
+ * is a preserved carrier, never a corrupted word. That makes this a HYGIENE
+ * pass and not a security control — the injection vector is covered on the
+ * INGESTION side by `scanHiddenUnicode`, whose contract is to warn and never
+ * strip, and which this function does not touch.
+ *
+ * Not a detector-evasion tool: it removes invisible characters and alters no
+ * visible prose. That exclusion is permanent.
+ */
+export function stripCarrierUnicode(text: string): CarrierStripResult {
+  const cps = [...text].map((ch) => ch.codePointAt(0) ?? 0);
+  const kept: string[] = [];
+  const records: CarrierRecord[] = [];
+  let removed = 0;
+  let preserved = 0;
+
+  for (let i = 0; i < cps.length; i += 1) {
+    const cp = cps[i] as number;
+    const cls = _classify(cp);
+    if (cls === null) {
+      kept.push(String.fromCodePoint(cp));
+      continue;
+    }
+    // `undefined` at either end is "absent", which counts as ASCII-side: a
+    // carrier at a boundary has no neighbour to be joining.
+    const before = cps[i - 1];
+    const after = cps[i + 1];
+    const asciiSide = (n: number | undefined): boolean => n === undefined || n < 0x80;
+    const strip = asciiSide(before) && asciiSide(after);
+    records.push({
+      codepoint: `U+${cp.toString(16).toUpperCase().padStart(4, "0")}`,
+      cls,
+      offset: i,
+      disposition: strip ? "removed" : "preserved",
+      reason: strip ? null : "adjacent to a non-ASCII codepoint — may be a joiner",
+    });
+    if (strip) {
+      removed += 1;
+    } else {
+      preserved += 1;
+      kept.push(String.fromCodePoint(cp));
+    }
+  }
+
+  return { out: kept.join(""), removed, preserved, records };
+}
+
 interface Thresholds {
   maxHard: number;
   maxScore: number;

package/src/scripts/dispatch_r2_reviewer.ts

@@ -698,6 +698,44 @@ function isoSeconds(d: Date): string {
     return d.toISOString().replace(/\.\d{3}Z$/, 'Z');
 }
 
+/**
+ * The return-envelope POINTER — one line-shaped field, delivered on the
+ * dominant dispatch path.
+ *
+ * ## Why a pointer and not the contract
+ *
+ * 240 chars is not a round number: it is `MAX_RESPONSE_LINE_CHARS`
+ * (`_lib/subagent_response.ts`), so the pointer is one line-shaped field by the
+ * contract's own measure. Inlining the shape would put a fourth copy of it in
+ * the tree, and a fourth copy is how the contract came to have three
+ * inconsistent states.
+ *
+ * ## Why THIS dispatcher
+ *
+ * `road-to-subagent-envelope-adoption` step 1.1 says the dominant path, "and it
+ * does not fan out to both". The dominant path is **not answerable from the
+ * ledger** — 1,725 of 1,845 post-split stops carry a null `agent_type`, which is
+ * the 8 % start↔stop join rate recorded elsewhere, so no stop can be attributed
+ * to a dispatcher. Decided on invocation surface instead: this file is wired
+ * into `/create-pr` and read by three gates (`check_completion_review`,
+ * `lint_evidence_artifacts`, `probe_review_binding_drift`), while
+ * `team_dispatch` sits behind an ai_team host flag and one `/team delegate`
+ * command. It is also the leg with ZERO prior contract hits, so the dominant
+ * path and the absent one are the same file.
+ *
+ * ## What it does not change
+ *
+ * The findings table stays the artefact — the gates read the file, not the
+ * envelope. Per the four-boundary separation in the response contract, this
+ * touches the DELIVERY boundary only: what the final message is. It adds no
+ * lifecycle status and does not alter the body schema.
+ */
+export const RETURN_ENVELOPE_POINTER =
+    'Final message = the return envelope and nothing else: ' +
+    '{summary, handoff, confidence, findings, risks}. Shape + the ' +
+    'write-to-disk-first rule: contexts/execution/subagent-response-contract.md. ' +
+    'The findings table stays a file.';
+
 function reviewerPrompt(args: {
     slug: string;
     headSha: string;
@@ -781,6 +819,10 @@ function reviewerPrompt(args: {
         `**Honest-null:** 0 findings, scope ${args.scopeHash}, reviewed <YYYY-MM-DD>`,
         '```',
         '',
+        '## Return channel',
+        '',
+        RETURN_ENVELOPE_POINTER,
+        '',
     ].join('\n');
 }
 

package/src/scripts/external_sources_denylist.json

@@ -62,7 +62,10 @@
     "\\bagent-reach\\b",
     "panniantong",
     "virgiliojr94",
-    "book-to-skill"
+    "book-to-skill",
+    "project-codeguard",
+    "\\bcodeguard\\b",
+    "\\bcosai\\b"
   ],
   "skip_paths": [
     "src/scripts/check_no_external_sources.py",

package/src/scripts/generate_capabilities_index.ts

@@ -268,6 +268,45 @@ function _getStr(d: Dict, key: string, dflt: string): string {
     return String(v);
 }
 
+/**
+ * What the runtime hooks actually DO, in four states and no others.
+ *
+ * The four: `detects` (it looks and reports nothing a host reads), `warns` (it
+ * reports through the host, and the host may ignore it), `blocks` (it can
+ * refuse), and `not-enforceable-on-host` (the slot does not exist there).
+ *
+ * WHY THIS BLOCK EXISTS. `CAPABILITIES.yaml` carried no prompt-injection entry
+ * at all, and saying nothing is a different defect from saying too much: a
+ * reader looking for injection coverage found absence, which reads as "not
+ * covered" rather than as "a warn-only scanner exists and ships off". This is
+ * the constructive half of a source proposal whose other half — "remove claims
+ * that equate a warn-hook with prevention" — had nothing to remove.
+ *
+ * `blocks` is never legal for the injection scanner on ANY host, and the value
+ * is DERIVED from `hook_manifest.yaml` rather than typed here: `fail_closed:
+ * false` plus `severity: advisory` is what makes it `warns`, so a manifest edit
+ * that gave it teeth would have to change this row too. A hand-written `blocks`
+ * would be the coverage inflation `untrusted-input-defense` refuses, one file
+ * over.
+ */
+function _runtime_enforcement_lines(): string[] {
+    return [
+        'runtime_enforcement:',
+        '  # Four states, and no others: detects | warns | blocks | not-enforceable-on-host.',
+        '  # Derived from src/scripts/hook_manifest.yaml (fail_closed + severity), never',
+        '  # hand-written — a manifest row that gained teeth would have to change this one.',
+        '  - hook: injection-scan',
+        '    slot: post_tool_use',
+        '    state: warns',
+        '    default: off',
+        '    blocks_legal_on_any_host: false',
+        '    reason: ' +
+            _scalar(
+                'fail_closed: false + severity: advisory in hook_manifest.yaml — it reports through the host and cannot refuse, so it warns and never blocks. Ships enabled: false; the detector was measured at 99.00% recall and a 0.85% false-positive rate over internal/bench/corpora/encoding-channels/ before any default flip is even discussable.<!-- claim:injection-scan-corpus-rates -->',
+            ),
+    ];
+}
+
 export function build(): string {
     const packs = _load_packs();
     const skillMap = _skill_packs();
@@ -360,6 +399,8 @@ export function build(): string {
         }
     }
     lines.push('');
+    lines.push(..._runtime_enforcement_lines());
+    lines.push('');
     lines.push('gaps:');
     if (gaps.length > 0) {
         const sortedGaps = [...gaps].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));

package/src/scripts/git_authorization_hook.ts

@@ -153,6 +153,19 @@ export type GitOp =
   | "branch"
   | "pr-create"
   | "pr-merge"
+  /**
+   * Enabling auto-merge. Its OWN op, not a plain merge and not nothing.
+   *
+   * Irreversible in the same sense a merge is: it commits the outcome to a
+   * condition the agent does not control, and the merge then happens with
+   * nobody in the loop. Before this split, `gh pr merge --auto` classified
+   * identically to a plain merge (the pattern is `\bgh\s+pr\s+merge\b`, and
+   * `--auto` is invisible to it), and the GraphQL mutation classified as
+   * NOTHING — `ghApiWrite()` needs a REST path and a write method, and
+   * `gh api graphql -f query='mutation{enablePullRequestAutoMerge...}'` has
+   * neither.
+   */
+  | "pr-merge-auto"
   | "tag"
   | "release"
   | "publish";
@@ -163,6 +176,7 @@ export const ALL_OPS: readonly GitOp[] = [
   "branch",
   "pr-create",
   "pr-merge",
+  "pr-merge-auto",
   "tag",
   "release",
   "publish",
@@ -185,8 +199,29 @@ const PHRASES: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
     op: "pr-create",
     re: /\b(erstell(e|en)?|mach(e|en)?|leg(e|en)?\s+an|(er)?(ö|oe)ffne|open|create|raise|aufmachen)\b[^.\n]{0,30}\b(pr|pull[- ]request)\b|\b(pr|pull[- ]request)\b[^.\n]{0,20}\b(erstellen|aufmachen|anlegen|(er)?(ö|oe)ffnen)\b/i,
   },
-  // `merge` as an ACTION, never as the noun in "merge conflict" / "merge commit".
-  { op: "pr-merge", re: /\b(merge|merg(e|en|st|t)|zusammenf(ü|ue)hren|reinmergen)\b(?!\s*[- ]?(conflict|konflikt|commit|base|queue|state|status))/i },
+  // `merge` as an ACTION, never as the noun in "merge conflict" / "merge commit",
+  // and never under a NEGATION.
+  //
+  // The negation half closes a measured defect: probed directly against
+  // `classifyAuthorization`, "nicht mergen", "don't merge this" and
+  // "never auto-merge" each returned ["pr-merge"] — a prompt saying DO NOT
+  // MERGE authorized a merge. The noun-sense lookahead was never a negator.
+  //
+  // The lookBEHIND is line-scoped by `[^.!?\n]` on purpose, the same scoping
+  // `turn_end_gate_hook.ts` uses for its own negation exclusion (`:330`) and
+  // its negated-claim window (`:490-493`). A sentence boundary ends a
+  // negation's reach: "Do not push. Merge PR #12." is two instructions, and a
+  // guard that let the first suppress the second would silently stop
+  // authorizing merges the user DID order — the failure mode that is worse
+  // than the defect, because nothing happens and nothing says why.
+  //
+  // Reusing that vocabulary rather than inventing a third is deliberate: two
+  // negation vocabularies in one tree drift, and the drift is invisible until
+  // a prompt lands in the gap between them.
+  {
+    op: "pr-merge",
+    re: /(?<!\b(nicht|nichts|kein(e|en|em|er|es)?|niemals|nie|no|not|dont|don't|never|without|ohne)\b[^.!?\n]{0,30})\b(merge|merg(e|en|st|t)|zusammenf(ü|ue)hren|reinmergen)\b(?!\s*[- ]?(conflict|konflikt|commit|base|queue|state|status))/i,
+  },
   // A tag is an ACTION here — bare "Tag" is the German word for day, and
   // "Version" is an ordinary noun. Both authorized a BLOCK op before this.
   { op: "tag", re: /\b(tagge(n|st)?|tag\s+(setzen|anlegen|erstellen)|git\s+tag|--tags|--follow-tags)\b/i },
@@ -267,10 +302,20 @@ export function isAffirmative(prose: string): boolean {
 }
 
 /** Executable commands a user may paste, mapped to the op they authorize. */
-const PASTED_COMMANDS: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
+const PASTED_COMMANDS: ReadonlyArray<{ op: GitOp | null; re: RegExp }> = [
   { op: "publish", re: /\bnpm\s+publish\b/i },
   { op: "tag", re: /\bgit\s+push\s+[^\n]*--tags\b|\bgit\s+tag\s+-a\b/i },
   { op: "release", re: /\bgh\s+release\s+create\b/i },
+  // ORDER IS LOAD-BEARING: the auto variants precede the plain merge, because
+  // the first match wins and `gh pr merge 12 --auto` also matches the plain
+  // pattern. Same rule the block-side table states for `git push --tags`.
+  //
+  // The DE-ESCALATING forms come first of all, and they map to no op at all:
+  // `--disable-auto` and `disablePullRequestAutoMerge` turn the capability OFF.
+  // Requiring merge authorization to switch auto-merge off is a live deadlock,
+  // and it is why this cannot ship after the split rather than with it.
+  { op: null, re: /\bgh\s+pr\s+merge\b[^\n]*--disable-auto\b|\bdisablePullRequestAutoMerge\b/i },
+  { op: "pr-merge-auto", re: /\bgh\s+pr\s+merge\b[^\n]*--auto\b|\benablePullRequestAutoMerge\b/i },
   { op: "pr-merge", re: /\bgh\s+pr\s+merge\b/i },
   { op: "pr-create", re: /\bgh\s+pr\s+create\b/i },
   { op: "push", re: /\bgit\s+push\b/i },
@@ -355,10 +400,15 @@ export function classifyAuthorization(prompt: string): {
     }
     for (const line of _commandLines(fence)) {
       for (const { op, re } of PASTED_COMMANDS) {
-        if (re.test(line)) {
+        if (!re.test(line)) continue;
+        // FIRST MATCH WINS, and the table is ordered most-specific-first. A
+        // de-escalating form carries `op: null` — it matched, so no later
+        // pattern may claim the line, and it authorizes nothing.
+        if (op !== null) {
           authorized.add(op);
           evidence[op] = `pasted command: "${line.slice(0, 80)}"`;
         }
+        break;
       }
     }
   }