@event4u/agent-config 16.1.0 → 16.3.0

package/src/scripts/hook_manifest.yaml

@@ -35,6 +35,28 @@
 # eight new concerns spread across eight events violate it zero times.
 #
 # `decision: rejected` is a first-class row. A recorded refusal is the point.
+#
+# `effect:` — what a concern DELIVERS to a turn, from a closed set. Read by the
+# neighbour census (`agent-config doctor neighbours`), which has to say what
+# sharing an event with another package's hook entry actually risks.
+#
+# The axis is OBSERVABLE DELIVERY, never primary purpose. An independent review
+# found the distinction load-bearing: a shadow concern whose purpose is
+# verification but which emits nothing and never blocks delivers a RECORD, so it
+# is `telemetry`. Classify by what a turn can tell happened.
+#
+#   permission    can REFUSE the thing it fires on. Equivalent to
+#                 `severity: blocking`, and `lint_hook_manifest` enforces the
+#                 equivalence in both directions. "Can refuse" is the whole
+#                 definition — it is not "decides authorization", so a gate that
+#                 refuses on a quality threshold is `permission` too.
+#   context       puts text in front of the model
+#   verification  checks a claim or a shape and REPORTS what it found
+#   telemetry     records state, a ledger, a counter
+#   memory        reads or writes the memory layer
+#   notification  tells the human something and changes nothing else
+#   formatting    reshapes a command or a generated file
+#
 schema_version: 1
 
 concerns:
@@ -43,6 +65,7 @@ concerns:
     args: [hook-dispatch]
     fail_closed: false
     severity: advisory
+    effect: telemetry
     needs_payload_bodies: [result]
   # Restore persisted memory session index (road-to-memory-retrieval-economy
   # P5). session_start only: the dispatcher forwards the returned `context`
@@ -56,6 +79,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: memory
   # One-shot handoff injection (road-to-agent-handoff-resume Phase 3).
   # session_start only: if `agent-config handoff` wrote
   # agents/runtime/state/handoff-context.md, inject it as spotlighted DATA
@@ -67,6 +91,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: context
   # Debounced since road-to-per-turn-hook-economy step 3.1 (D-3). It used to
   # re-shell the dashboard regenerator through tsx on EVERY roadmap write — a
   # cold tsx start per write, in exactly the roadmap-heavy workflow this repo
@@ -90,17 +115,20 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: formatting
     needs_payload_bodies: [input]
   onboarding-gate:
     script: src/scripts/onboarding_gate_hook.ts
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
   context-hygiene:
     script: src/scripts/context_hygiene_hook.ts
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
   # Phase 5 — Tier-1 hook for the verify-before-complete rule. Records
   # observable evidence of verification commands (tests, quality tools,
   # builds) into agents/state/verify-before-complete/<digest>.json — ONE FILE
@@ -120,6 +148,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
     needs_payload_bodies: [input, result]
   # Phase 5 — Tier-1 hook for the minimal-safe-diff rule. Counts unique
   # files touched per turn into agents/runtime/state/minimal-safe-diff.json and
@@ -139,22 +168,40 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
     needs_payload_bodies: [input]
   minimal-safe-diff:
     script: src/scripts/minimal_safe_diff_hook.ts
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
     needs_payload_bodies: [input]
   # road-to-security-pillar.md P3.2 — PostToolUse prompt-injection scanner.
   # Warn-in-context (exit 2), never blocks. Default-OFF: no-ops unless
   # hooks.injection_scan.enabled is true in .agent-settings.yml. The runtime
   # backstop layered on the always-on untrusted-input-defense rule.
+  #
+  # THE INPUT IT READS, AND WHY IT CANNOT MOVE TO A BLOCKING SLOT
+  # (road-to-a-content-scanner-on-a-slot-that-can-refuse 1.1). It scans the
+  # tool RESULT -- fetched pages, file reads, MCP/tool responses -- which is
+  # why it declares `result` below. `pre_tool_use` is the only slot on this
+  # host with a non-null `block_exit`, and a pre-call payload has no tool
+  # response in it: the `result` body class resolves to `tool_response` /
+  # `toolResponse` / `tool_result` / `toolUseResult` (hooks/payload_stub.ts),
+  # none of which exist before the call runs. So rebinding for the deny would
+  # leave the scanner reading the arguments it was never written to inspect --
+  # more enforcing-looking and strictly less detecting. It stays on
+  # `post_tool_use` and the published claims say `detected, not blocked`;
+  # `docs/enforcement-by-host.md` § "The slot rows are not a statement about
+  # any concern" carries the reasoning, and `check_enforcement_matrix` prints
+  # the per-host binding audit that keeps it from drifting back.
   injection-scan:
     script: src/scripts/injection_scan_hook.ts
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
     needs_payload_bodies: [input, result]
   # road-to-security-hardening Phase 3 — PreToolUse guard turning the
   # git-history-discipline Iron Law into a deterministic gate. Blocks
@@ -168,6 +215,7 @@ concerns:
     args: []
     fail_closed: true
     severity: blocking
+    effect: permission
     needs_payload_bodies: [input]
   # road-to-ai-employee-borrowings Phase 1 — kernel immutability Layer 1.
   # PreToolUse guard: DENIES Write/Edit/NotebookEdit (and cross-platform
@@ -185,6 +233,29 @@ concerns:
     args: []
     fail_closed: true
     severity: blocking
+    effect: permission
+    needs_payload_bodies: [input]
+  # road-to-a-kernel-that-guards-its-plumbing 1.2 — the build-output half of
+  # "one mechanism per file class". PreToolUse guard: DENIES Write/Edit/
+  # NotebookEdit and the shell write shapes whose target is
+  # `dist/hooks/dispatch.js` (the esbuild bundle) or `hooks/hooks.json` (the
+  # host binding file). Both are GENERATED — by `npm run build:hooks` and by
+  # condense.ts via `task sync` — so a hand edit is never legitimate, and a
+  # hand-edited bundle reaches every dispatch while being invisible in a source
+  # review. The plumbing SOURCES beside them (hook_manifest.yaml,
+  # host_lowering.yaml, the *-dispatcher.sh trampolines, both budget files) are
+  # edited on purpose all the time and carry the ADR-268 § 4 ratification
+  # RECORD instead — check_kernel_edit_ratified, path set extended by step 1.1.
+  # The legitimate builds pass: they reach these files through a build tool,
+  # not through a redirect / in-place sed / tee / mv shape. fail_closed: true —
+  # the guarantee is about a DETECTED write; a malformed envelope with no
+  # target allows. No agent-accessible override; the fix is to rebuild.
+  block-plumbing-writes:
+    script: src/scripts/hooks/block_plumbing_writes.ts
+    args: []
+    fail_closed: true
+    severity: blocking
+    effect: permission
     needs_payload_bodies: [input]
   # road-to-asked-not-parked Phase 5.1 — one question per structured-ask call.
   # PreToolUse guard: DENIES a call to a host's native question picker whose
@@ -214,6 +285,7 @@ concerns:
     args: []
     fail_closed: false
     severity: blocking
+    effect: permission
     tools: [AskUserQuestion, AskQuestion, UserQuestion, ask_user_question, ask_question, user_question]
     needs_payload_bodies: [input]
   # road-to-source-silence Phase 4.2 — the write-time half of source
@@ -236,6 +308,7 @@ concerns:
     args: []
     fail_closed: false
     severity: blocking
+    effect: permission
     needs_payload_bodies: [input]
   # road-to-renewal-leverage Phase 2 — "fix the code, not the config".
   # PreToolUse guard over the recorded allowlist-growth antipattern
@@ -252,6 +325,7 @@ concerns:
     args: []
     fail_closed: false
     severity: blocking
+    effect: permission
     needs_payload_bodies: [input]
   # token-saving Phase 3 — PreToolUse RTK-wrap nudge. DETERMINISTIC: keys off a
   # live `which rtk` probe (not the self-reported flag). When rtk is installed
@@ -266,6 +340,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: formatting
     needs_payload_bodies: [input]
   # road-to-anti-slop-detector Phase 3 — OPTIONAL PreToolUse anti-slop nudge.
   # Runs the lint_design_slop registry against about-to-be-written UI content
@@ -279,6 +354,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
     needs_payload_bodies: [input]
   # road-to-frontend-power E1.1 / E1.2 / E1.3 — the DELIVERY carrier the 0.0 %
   # UI-write measurement never had. One script on two slots:
@@ -305,6 +381,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
     needs_payload_bodies: [input]
   # `advisory`, and the code MATCHES the declaration rather than the prose.
   #
@@ -330,6 +407,7 @@ concerns:
     args: ['--slot', 'stop']
     fail_closed: false
     severity: advisory
+    effect: notification
   # road-to-frontend-skill-application Phase 4 — OPTIONAL PreToolUse UI-route
   # nudge. On a Write/Edit to a UI surface with no design consultation latched
   # this session, WARNS (exit 2) naming the route; a read or search touching a
@@ -345,6 +423,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
     needs_payload_bodies: [input]
   # road-to-a-graph-that-is-shipped 1.2 — PreToolUse code-graph CONTEXT line,
   # replacing the ADR-124 Phase 4 nudge concern, whose hook was deleted in the
@@ -401,6 +480,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
   # road-to-autonomous-auto-mode — the carrier for `token-efficiency` § One
   # command per Bash call. That rule is `type: auto`, so its triggers match the
   # PROMPT, and no prompt announces that the next tool call will be chained;
@@ -447,23 +527,35 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
     needs_payload_bodies: [input]
   code-graph-context:
     script: src/scripts/hooks/code_graph_context_hook.ts
     args: []
     fail_closed: false
     severity: advisory
+    effect: context
     # Per-concern tool filter — the dispatcher skips this concern in-process on
     # any other tool. See `_concern_matches_tool` in hooks/dispatch_hook.ts for
     # the semantics (absent = every event, "*" = the same, non-tool events are
     # never filtered) and for why the filter is NOT a host `matcher`.
     #
     # This set is not a guess: the hook's entire branch surface is
-    # `name === 'Grep' || name === 'Glob'` and `name === 'Read'`
-    # (code_graph_context_hook.ts), and a test pins the manifest list against it.
+    # `name === 'Grep' || name === 'Glob'`, `name === 'Read'` and
+    # `name === 'Bash'` (code_graph_context_hook.ts), and a test pins the
+    # manifest list against it.
+    #
+    # `Bash` is the ONE host-named tool declared here, and the caveat the
+    # blocking-guard paragraph below raises applies to it: on a host that calls
+    # the shell `launch-process` or `BashTool` this concern will not see it. That
+    # is a missed advisory line, not a disabled guard — the trade the paragraph
+    # below refuses for a security hook is the right one for a context line, and
+    # the alternative (dropping the filter) would dispatch this concern on every
+    # tool call in the session.
     #
-    # Deliberately NOT declared on the three blocking PreToolUse guards
-    # (block-no-verify, block-kernel-rule-writes, block-config-weakening): their
+    # Deliberately NOT declared on the four blocking PreToolUse guards
+    # (block-no-verify, block-kernel-rule-writes, block-plumbing-writes,
+    # block-config-weakening): their
     # tool sets span host-specific naming variants (`Bash` / `BashTool` /
     # `launch-process` / `launch_process`, `str-replace-editor` /
     # `str_replace_editor` / `save-file` / …), so a list that misses one variant
@@ -471,7 +563,7 @@ concerns:
     # re-read `tool_name` and return early; paying one dispatch to keep a guard
     # correct is the right trade, and the cheap filter is reserved for advisory
     # concerns whose set is provable from their own source.
-    tools: [Grep, Glob, Read]
+    tools: [Grep, Glob, Read, Bash]
     needs_payload_bodies: [input]
   # road-to-reachable-code-memory Phase 4 — session_end learning-sidecar
   # aggregation. Joins the EXISTING session_end concern set (no new platform
@@ -487,6 +579,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: memory
   # Phase 2 of road-to-hooks-actually-fire-in-consumers — session_start
   # gate that surfaces the marketplace-install-but-unscaffolded shape.
   # Writes .augment/.first-run-action-needed.md + one stderr line so
@@ -497,6 +590,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
   # session-profile-activation Phase 1 — emits a one-line staleness notice
   # when a new session starts with a `runtime.active_packs` overlay carried
   # over from a previous session. Never resets (option a, explicit
@@ -506,6 +600,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
   # Defense-in-depth twin of the update-command wrapper refresh
   # (cmd_upgrade / cmd_refresh). On session_start, re-stamps a stale
   # project-local ./agent-config wrapper from the canonical template so
@@ -516,6 +611,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
   # road-to-install-path-convergence Phase 4 — duplicate-surface probe.
   # Reads src/config/surface-matrix.yml, existence-checks declared duplicate
   # classes, nudges ONCE per day (state: agents/runtime/state/
@@ -526,6 +622,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
   # road-to-team-mode Phase 4 — managed Review-Gate circuit breaker.
   # Runs AFTER the plugin's own Stop gate: reads the persisted gate job
   # record, counts consecutive BLOCK verdicts per session, injects the
@@ -538,6 +635,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
   # Reply-shape backstop for the direct-answers rule (reply-close): a PR
   # created THIS turn must end the reply as the literal last raw URL. This
   # PostToolUse hook fires right after a PR *create* (gh pr create, or a
@@ -550,6 +648,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
     needs_payload_bodies: [input, result]
   # Push-settle reminder — the second half of "a push closes its own loop".
   # The pre-push hook answers "is this push safe to make"; nothing answered "is
@@ -565,6 +664,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
     needs_payload_bodies: [input, result]
   # Language-mirror pin — carries the ONE fact the transcript cannot express:
   # which language the human actually typed. 47 skill/slash-command bodies were
@@ -578,6 +678,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: context
   # Git-authorization ledger — records which git ops the user's OWN WORDS
   # authorize this turn. Writes state only; never blocks.
   git-authorization:
@@ -585,6 +686,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
   # The blocking half was REMOVED by owner decision on 2026-09-04 (ADR-254).
   # It refused authorizations the owner had in fact given: a guardrail sentence
   # inside an authorization ("never merge empty PRs") read as a withdrawal and
@@ -616,6 +718,7 @@ concerns:
     args: []
     fail_closed: false
     severity: blocking
+    effect: permission
     needs_payload_bodies: [input]
   # Canary injection — deterministic carrier for the
   # session-canary rule (greet-by-name at task start + reply-close markers
@@ -638,6 +741,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: context
   # Council-availability fact. Carries whether a council is configured and from
   # where, because the always-loaded layer refers to the council conditionally
   # and never says how to check. Measured 2026-08-08: an agent announced "kein
@@ -650,6 +754,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
   # Org-telemetry disclosure (road-to-org-telemetry Phase 3.2; ADR-233 § D5).
   # `org-pack` is the only consent class in this suite granted by somebody
   # OTHER than the person it binds — an org administrator, once, for every
@@ -663,6 +768,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
   # road-to-org-telemetry Phase 2 (step 2.1) — session-end Class-A flush.
   # Checks whether the outbound spool has bytes and, if so, spawns a DETACHED
   # sender and returns. It makes no network call in the session's own process,
@@ -691,6 +797,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
   # Self-repair intake (road-to-self-repair Phase 1). Two slots, one queue:
   # user_prompt_submit opens a record when the user states the agent worked
   # wrongly and injects the open-queue line; stop runs the deterministic
@@ -702,6 +809,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
   # Shared per-session register (road-to-parallel-session-coordination) — writes
   # this session into <git-common-dir>/agent-sessions/<session_id>.json so every
   # other worktree of the repo can see it, and on session_start injects the live
@@ -735,6 +843,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
   # road-to-orchestrator-discipline-carriers Phase 3 (F6) — deterministic
   # PostToolUse orchestration-telemetry capture. Fires only on an Agent/Task
   # tool-use completion (the two observed subagent-dispatch tool names) and
@@ -747,6 +856,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
     tools: [Agent, Task]
     needs_payload_bodies: [input, result]
   # road-to-org-telemetry Phase 1 (step 1.2) — Class-A usage capture. Fires
@@ -790,6 +900,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
     # Provable from the hook's own source: the only branch surface is
     # `extractToolName(payload) !== SKILL_TOOL_NAME`.
     tools: [Skill]
@@ -836,6 +947,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
     nudge_rank: 1
   # road-to-inbox-harvest-2026-08-d-runtime-skill-routing Phase 2 — binds the
   # deterministic task→skill ranker, which had shipped with ZERO production
@@ -859,6 +971,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: context
     nudge_rank: 2
   # road-to-trigger-delivered-rule-bodies Phase 1 — the DELIVERY twin of
   # `skill-route` above: same two slots, opposite payload policy. `skill-route`
@@ -897,6 +1010,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: context
     needs_payload_bodies: [input]
   # road-to-orchestrator-discipline-carriers Phase 5 (F4-lite) — end-review
   # nudge. Fires ONLY when the session mutated tracked+untracked, non-doc
@@ -924,11 +1038,13 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
   end-review-nudge:
     script: src/scripts/hooks/end_review_nudge_hook.ts
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
     # road-to-stop-gate-honesty step 3.1 — skipped on a refusal RETRY.
     # ARGUMENT, per concern as that step requires: the F2 fire gate is a
     # once-per-session marker, and this concern's own header records that a
@@ -969,6 +1085,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
   # road-to-conformance-round5 Phase 3 — the FIRST concern that can refuse a
   # turn-END. Round 5 measured the reason: both blocking carriers reached zero
   # violations, neither advisory carrier did, and 19 language violations
@@ -992,16 +1109,34 @@ concerns:
   # detector's own trigger conditions, which is the same shape `delegation-nudge`
   # uses — no signal, no output. `hooks.turn_end_gate.*` is in REMOVED_KEYS.
   #
-  # fail_closed: FALSE, deliberately and unlike every other blocking concern
-  # here: a crash in a turn-end gate must let the turn END. Failing closed on
-  # this slot does not degrade the session, it wedges it. Re-entrancy is two
-  # independent layers (`stop_hook_active`; a marker keyed on the last USER
-  # message, never the reply) — see the hook's file header.
+  # fail_closed: FALSE — and read what that flag still DOES before changing it.
+  # Since the dispatcher resolves rc >= 3 by SEVERITY it no longer decides the
+  # crash branch at all; it decides the stdin-read-failure deny
+  # (`stdin_failure_policy._is_fail_closed_blocking`), and nothing else. An
+  # independent review named the old wording a reviewer trap: an operator
+  # reading "fail_closed: false — a crash must let the turn END" would believe
+  # they were configuring crash behaviour, and flipping it would change the
+  # read-failure deny instead. The REASON it was set false is still true —
+  # failing closed on a turn-end gate does not degrade the session, it wedges
+  # it — but the flag is no longer what delivers it.
+  #
+  # What answers it now lives in the dispatcher, which is the only layer that
+  # can: a blocking `stop` concern spends its refusal ONCE, and on the retry the
+  # host marks (`stop_hook_active`) a crash falls back to fail-open and the turn
+  # ends. The hook's own two re-entrancy layers cannot do this job — both run
+  # INSIDE `main()`, so a crash never reaches them.
+  #
+  # The trade is deliberate: one refused Stop buys a guard that no longer
+  # permits every turn end precisely when it is broken, and the second Stop
+  # releases. Re-entrancy inside the hook stays what it was (`stop_hook_active`;
+  # a marker keyed on the last USER message, never the reply) — see the hook's
+  # file header.
   turn-end-gate:
     script: src/scripts/hooks/turn_end_gate_hook.ts
     args: []
     fail_closed: false
     severity: blocking
+    effect: permission
   # Comment-discipline advisory — the write-time half of
   # `lint_code_comments`. Scans the TEXT JUST WRITTEN (Write ->
   # tool_input.content, Edit -> tool_input.new_string), never the file on
@@ -1022,6 +1157,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
     tools: [Write, Edit]
     needs_payload_bodies: [input]
   # road-to-token-economy-cache Phase 5.1/5.2 — edit-shape advisory. Fires
@@ -1039,6 +1175,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
     # Provable from the hook's own source: the only branch surface is
     # `toolName !== 'Write'` — same cheap-filter discipline as
     # `orchestration-record`'s [Agent, Task].
@@ -1060,6 +1197,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
     # Provable from the hook's own source: READ_TOOLS ∪ WRITE_TOOLS.
     tools: [Read, Edit, Write]
     needs_payload_bodies: [input]
@@ -1094,6 +1232,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: memory
     # Provable from the hook's own source: the union of the `tools` sets on
     # RECALL_RULES — COMMAND_TOOLS (rules 1 and 4) ∪ EDIT_TOOLS (rules 2, 3).
     tools: [Bash, Edit, Write, MultiEdit, str-replace-editor, save-file, launch-process]
@@ -1117,6 +1256,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
   # road-to-long-horizon-execution Phase 1 (H-1) — the stop slot's first
   # WORK-REMAINING concern. No-op unless this session claimed a roadmap
   # (`sessions:claim`) whose frontmatter says `execution.mode: autonomous`;
@@ -1129,6 +1269,12 @@ concerns:
   # always. Events: agents/runtime/state/run-continuation.jsonl. Kill switch:
   # AGENT_CONFIG_NO_RUN_CONTINUATION=1. fail_closed: false — the only block
   # it ever emits is the one carrying its own continuation text.
+  # fail_closed: false — and as for `turn-end-gate` above, the dispatcher now
+  # resolves rc >= 3 by SEVERITY rather than by this flag, so a crash here
+  # refuses the first Stop and releases on the retry. What the flag still
+  # decides is the stdin-read-failure deny, not crash behaviour; changing it
+  # changes that and nothing else. The only block this concern DECIDES to emit
+  # is still the one carrying its own continuation text.
   run-continuation:
     script: src/scripts/hooks/run_continuation_hook.ts
     args: []
@@ -1142,6 +1288,7 @@ concerns:
     # mechanism was inert on the one verified host. `turn-end-gate` above sits
     # on the same slot and declares `blocking` for exactly this reason.
     severity: blocking
+    effect: permission
   # road-to-user-out-of-the-loop Phase 0 Step 1 — the interruption ledger.
   # Every Stop, classifies whether the turn that just ended put a synchronous
   # contact to the user and appends one `{run_id, turn, kind, class, roadmap}`
@@ -1167,6 +1314,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
     # road-to-stop-gate-honesty step 3.1 — skipped on a refusal RETRY, and this
     # is the flag with the real saving.
     # ARGUMENT, per concern: `alreadyRecorded(ledgerPath, run_id, turn)` dedupes
@@ -1200,6 +1348,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
   # road-to-inbox-harvest-2026-08-d-context-ledger Phase 1 Step 1.1 — the
   # tool-result byte counter. `hook-token-budget.json` registers the gap it
   # closes in its own words: bytes-into-context from tool RESULTS are
@@ -1224,6 +1373,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
   # road-to-subagent-lifecycle-integrity Phase 3 Step 1 — spawn guard, SHADOW
   # ONLY, per docs/contracts/concern-activation-policy.md. On every Agent/Task
   # call it appends one `spawn_guard_shadow` line recording what a guard WOULD
@@ -1244,6 +1394,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
     tools: [Agent, Task]
   # road-to-source-first-frontend Phase 3 Steps 1-2 — source-first gate, SHADOW
   # ONLY, per docs/contracts/concern-activation-policy.md. On every
@@ -1268,11 +1419,15 @@ concerns:
   # to advisory is pre-registered in the hook header.
   #
   # Never blocks, never warns: exit 0 on every path. fail_closed: false.
+  # `effect: telemetry`, not `verification`, and the script's own header is why:
+  # "it emits nothing to the model and it never blocks". A shadow concern
+  # records what a gate WOULD have said; recording is what it delivers.
   source-first-gate:
     script: src/scripts/hooks/source_first_gate_hook.ts
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
     needs_payload_bodies: [input]
   # road-to-runtime-event-journal Phase 1 step 1.4 — the journal's hook binding
   # (AI council 2026-08-28, decision 3). `_lib/runtime_journal.ts` shipped bound
@@ -1316,6 +1471,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
 
 # Role axis (road-to-token-economy-dispatch Phase 2). The dispatcher reads
 # AGENT_CONFIG_SESSION_ROLE (resolved via _lib/session_role.ts — set ONLY by
@@ -1387,12 +1543,22 @@ platforms:
     session_start:    [chat-history, hot-context, handoff-context, session-canary, council-availability, telemetry-disclosure, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register]
     session_end:      [chat-history, memory-learn, session-register, roadmap-progress, telemetry-flush]
     stop:             [chat-history, verify-before-complete, self-repair, session-register, roadmap-progress, design-pass-stop]
-    pre_tool_use:     [block-no-verify, evidence-independence, block-kernel-rule-writes, block-config-weakening, block-speaking-inbox-dir, rtk-wrap, design-slop, ui-route-nudge, code-graph-context, chain-nudge, ship-diff-volume, reread-guard, memory-recall]
+    pre_tool_use:     [block-no-verify, evidence-independence, block-kernel-rule-writes, block-plumbing-writes, block-config-weakening, block-speaking-inbox-dir, rtk-wrap, design-slop, ui-route-nudge, code-graph-context, chain-nudge, ship-diff-volume, reread-guard, memory-recall]
     post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, tool-result-bytes, edit-shape, comment-discipline, design-pass]
 
   claude:
     ask:              native
-    session_start:    [chat-history, hot-context, handoff-context, session-canary, council-availability, telemetry-disclosure, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register, review-baseline, journal-record]
+    session_start:    [chat-history, hot-context, handoff-context, session-canary, council-availability, telemetry-disclosure, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register, review-baseline, journal-record, rule-inject]
+    # `rule-inject` is bound here for ONE source: `compact`
+    # (road-to-a-rule-carrier-that-works-outside-the-repo step 1.6). The concern
+    # returns before reading anything on `startup`, `resume`, `clear` and
+    # `fork`, so this binding costs a function call per session on every other
+    # source. It exists because `pre_compact` can only re-ARM delivery — it
+    # cannot deliver, since the host is about to discard the context it would
+    # emit into. The law sections of the pre-compaction seen-set are sent here
+    # instead, under the same 8,000-character budget, which is the half the
+    # concern's own header used to end at: a rule whose trigger does not recur
+    # was not restored at all.
     session_end:      [chat-history, memory-learn, session-register, roadmap-progress, telemetry-flush, journal-record]
     stop:             [chat-history, verify-before-complete, team-review-gate, end-review-nudge, obligation-settle, turn-end-gate, self-repair, session-register, session-eol, interruption-ledger, roadmap-progress, design-pass-stop, suggestion-capture, journal-record, run-continuation]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, delegation-nudge, skill-route, git-authorization, session-canary, self-repair, session-register, rule-inject, suggestion-capture, journal-record]
@@ -1419,7 +1585,7 @@ platforms:
     # (+16,329 GPT tok, +69 % on the thin rule layer) are in
     # `project_thin_rules.path_only_ids`; the receiver is
     # `agents/roadmaps/stubs/road-to-a-path-route-under-delivery.md`.
-    pre_tool_use:     [block-no-verify, evidence-independence, block-kernel-rule-writes, block-config-weakening, block-speaking-inbox-dir, one-question-per-ask, rtk-wrap, design-slop, ui-route-nudge, code-graph-context, chain-nudge, ship-diff-volume, reread-guard, spawn-guard-shadow, source-first-gate, memory-recall]
+    pre_tool_use:     [block-no-verify, evidence-independence, block-kernel-rule-writes, block-plumbing-writes, block-config-weakening, block-speaking-inbox-dir, one-question-per-ask, rtk-wrap, design-slop, ui-route-nudge, code-graph-context, chain-nudge, ship-diff-volume, reread-guard, spawn-guard-shadow, source-first-gate, memory-recall]
     post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, tool-result-bytes, edit-shape, comment-discipline, language-mirror, design-pass, journal-record]
     # `language-mirror` — round-5 § 6.1. `pre_compact` sets a pin-lost marker;
     # the `post_tool_use` entry above re-emits the pin exactly once while that
@@ -1466,7 +1632,7 @@ platforms:
     # still costs the dispatch, and its entire output is thrown away.
     stop:             [chat-history, verify-before-complete, self-repair, session-register, roadmap-progress, design-pass-stop]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, self-repair, session-register]
-    pre_tool_use:     [block-no-verify, evidence-independence, block-kernel-rule-writes, block-config-weakening, block-speaking-inbox-dir, rtk-wrap, design-slop, ui-route-nudge, code-graph-context, chain-nudge, ship-diff-volume, reread-guard, spawn-guard-shadow, source-first-gate, memory-recall]
+    pre_tool_use:     [block-no-verify, evidence-independence, block-kernel-rule-writes, block-plumbing-writes, block-config-weakening, block-speaking-inbox-dir, rtk-wrap, design-slop, ui-route-nudge, code-graph-context, chain-nudge, ship-diff-volume, reread-guard, spawn-guard-shadow, source-first-gate, memory-recall]
     post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, tool-result-bytes, edit-shape, comment-discipline, design-pass]
     # subagent-ledger IS bound here, unlike the two nudges above, and the
     # difference is the delivery channel rather than the platform: the nudges
@@ -1571,6 +1737,18 @@ native_event_aliases:
     Stop:              stop
     UserPromptSubmit:  user_prompt_submit
     PostToolUse:       post_tool_use
+    # A FAILING tool call does not fire `PostToolUse` at all — it fires
+    # `PostToolUseFailure`, which until now was bound to nothing, so the
+    # verification recorder never saw a red command and `verification_runs`
+    # could only ever hold passes. Observed on 2.1.286, three one-shot sessions,
+    # exactly one of the two events per call — not inferred from the event list.
+    # Lowered onto the SAME canonical slot rather than given a canonical event
+    # of its own: one slot, one concern list, no change to the event vocabulary.
+    # Deliberately claude-only. Cowork is Claude Code underneath and the rows
+    # below duplicate this vocabulary, but this pair was measured on claude and
+    # on no other host, and an alias row asserting a host behaviour nobody
+    # observed is the defect class this suite keeps finding in its own tables.
+    PostToolUseFailure: post_tool_use
     PreToolUse:        pre_tool_use
     PreCompact:        pre_compact
     # road-to-subagent-lifecycle-integrity Phase 1 Step 1. Both tokens were