@event4u/agent-config 16.2.0 → 16.4.0

package/src/scripts/hook_manifest.yaml

@@ -35,6 +35,28 @@
 # eight new concerns spread across eight events violate it zero times.
 #
 # `decision: rejected` is a first-class row. A recorded refusal is the point.
+#
+# `effect:` — what a concern DELIVERS to a turn, from a closed set. Read by the
+# neighbour census (`agent-config doctor neighbours`), which has to say what
+# sharing an event with another package's hook entry actually risks.
+#
+# The axis is OBSERVABLE DELIVERY, never primary purpose. An independent review
+# found the distinction load-bearing: a shadow concern whose purpose is
+# verification but which emits nothing and never blocks delivers a RECORD, so it
+# is `telemetry`. Classify by what a turn can tell happened.
+#
+#   permission    can REFUSE the thing it fires on. Equivalent to
+#                 `severity: blocking`, and `lint_hook_manifest` enforces the
+#                 equivalence in both directions. "Can refuse" is the whole
+#                 definition — it is not "decides authorization", so a gate that
+#                 refuses on a quality threshold is `permission` too.
+#   context       puts text in front of the model
+#   verification  checks a claim or a shape and REPORTS what it found
+#   telemetry     records state, a ledger, a counter
+#   memory        reads or writes the memory layer
+#   notification  tells the human something and changes nothing else
+#   formatting    reshapes a command or a generated file
+#
 schema_version: 1
 
 concerns:
@@ -43,6 +65,7 @@ concerns:
     args: [hook-dispatch]
     fail_closed: false
     severity: advisory
+    effect: telemetry
     needs_payload_bodies: [result]
   # Restore persisted memory session index (road-to-memory-retrieval-economy
   # P5). session_start only: the dispatcher forwards the returned `context`
@@ -56,6 +79,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: memory
   # One-shot handoff injection (road-to-agent-handoff-resume Phase 3).
   # session_start only: if `agent-config handoff` wrote
   # agents/runtime/state/handoff-context.md, inject it as spotlighted DATA
@@ -67,6 +91,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: context
   # Debounced since road-to-per-turn-hook-economy step 3.1 (D-3). It used to
   # re-shell the dashboard regenerator through tsx on EVERY roadmap write — a
   # cold tsx start per write, in exactly the roadmap-heavy workflow this repo
@@ -90,17 +115,20 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: formatting
     needs_payload_bodies: [input]
   onboarding-gate:
     script: src/scripts/onboarding_gate_hook.ts
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
   context-hygiene:
     script: src/scripts/context_hygiene_hook.ts
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
   # Phase 5 — Tier-1 hook for the verify-before-complete rule. Records
   # observable evidence of verification commands (tests, quality tools,
   # builds) into agents/state/verify-before-complete/<digest>.json — ONE FILE
@@ -120,6 +148,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
     needs_payload_bodies: [input, result]
   # Phase 5 — Tier-1 hook for the minimal-safe-diff rule. Counts unique
   # files touched per turn into agents/runtime/state/minimal-safe-diff.json and
@@ -139,12 +168,14 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
     needs_payload_bodies: [input]
   minimal-safe-diff:
     script: src/scripts/minimal_safe_diff_hook.ts
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
     needs_payload_bodies: [input]
   # road-to-security-pillar.md P3.2 — PostToolUse prompt-injection scanner.
   # Warn-in-context (exit 2), never blocks. Default-OFF: no-ops unless
@@ -170,6 +201,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
     needs_payload_bodies: [input, result]
   # road-to-security-hardening Phase 3 — PreToolUse guard turning the
   # git-history-discipline Iron Law into a deterministic gate. Blocks
@@ -183,6 +215,7 @@ concerns:
     args: []
     fail_closed: true
     severity: blocking
+    effect: permission
     needs_payload_bodies: [input]
   # road-to-ai-employee-borrowings Phase 1 — kernel immutability Layer 1.
   # PreToolUse guard: DENIES Write/Edit/NotebookEdit (and cross-platform
@@ -200,6 +233,7 @@ concerns:
     args: []
     fail_closed: true
     severity: blocking
+    effect: permission
     needs_payload_bodies: [input]
   # road-to-a-kernel-that-guards-its-plumbing 1.2 — the build-output half of
   # "one mechanism per file class". PreToolUse guard: DENIES Write/Edit/
@@ -221,6 +255,7 @@ concerns:
     args: []
     fail_closed: true
     severity: blocking
+    effect: permission
     needs_payload_bodies: [input]
   # road-to-asked-not-parked Phase 5.1 — one question per structured-ask call.
   # PreToolUse guard: DENIES a call to a host's native question picker whose
@@ -250,6 +285,7 @@ concerns:
     args: []
     fail_closed: false
     severity: blocking
+    effect: permission
     tools: [AskUserQuestion, AskQuestion, UserQuestion, ask_user_question, ask_question, user_question]
     needs_payload_bodies: [input]
   # road-to-source-silence Phase 4.2 — the write-time half of source
@@ -272,6 +308,7 @@ concerns:
     args: []
     fail_closed: false
     severity: blocking
+    effect: permission
     needs_payload_bodies: [input]
   # road-to-renewal-leverage Phase 2 — "fix the code, not the config".
   # PreToolUse guard over the recorded allowlist-growth antipattern
@@ -288,6 +325,7 @@ concerns:
     args: []
     fail_closed: false
     severity: blocking
+    effect: permission
     needs_payload_bodies: [input]
   # token-saving Phase 3 — PreToolUse RTK-wrap nudge. DETERMINISTIC: keys off a
   # live `which rtk` probe (not the self-reported flag). When rtk is installed
@@ -302,6 +340,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: formatting
     needs_payload_bodies: [input]
   # road-to-anti-slop-detector Phase 3 — OPTIONAL PreToolUse anti-slop nudge.
   # Runs the lint_design_slop registry against about-to-be-written UI content
@@ -315,6 +354,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
     needs_payload_bodies: [input]
   # road-to-frontend-power E1.1 / E1.2 / E1.3 — the DELIVERY carrier the 0.0 %
   # UI-write measurement never had. One script on two slots:
@@ -341,6 +381,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
     needs_payload_bodies: [input]
   # `advisory`, and the code MATCHES the declaration rather than the prose.
   #
@@ -366,6 +407,7 @@ concerns:
     args: ['--slot', 'stop']
     fail_closed: false
     severity: advisory
+    effect: notification
   # road-to-frontend-skill-application Phase 4 — OPTIONAL PreToolUse UI-route
   # nudge. On a Write/Edit to a UI surface with no design consultation latched
   # this session, WARNS (exit 2) naming the route; a read or search touching a
@@ -381,6 +423,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
     needs_payload_bodies: [input]
   # road-to-a-graph-that-is-shipped 1.2 — PreToolUse code-graph CONTEXT line,
   # replacing the ADR-124 Phase 4 nudge concern, whose hook was deleted in the
@@ -437,6 +480,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
   # road-to-autonomous-auto-mode — the carrier for `token-efficiency` § One
   # command per Bash call. That rule is `type: auto`, so its triggers match the
   # PROMPT, and no prompt announces that the next tool call will be chained;
@@ -483,20 +527,31 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
     needs_payload_bodies: [input]
   code-graph-context:
     script: src/scripts/hooks/code_graph_context_hook.ts
     args: []
     fail_closed: false
     severity: advisory
+    effect: context
     # Per-concern tool filter — the dispatcher skips this concern in-process on
     # any other tool. See `_concern_matches_tool` in hooks/dispatch_hook.ts for
     # the semantics (absent = every event, "*" = the same, non-tool events are
     # never filtered) and for why the filter is NOT a host `matcher`.
     #
     # This set is not a guess: the hook's entire branch surface is
-    # `name === 'Grep' || name === 'Glob'` and `name === 'Read'`
-    # (code_graph_context_hook.ts), and a test pins the manifest list against it.
+    # `name === 'Grep' || name === 'Glob'`, `name === 'Read'` and
+    # `name === 'Bash'` (code_graph_context_hook.ts), and a test pins the
+    # manifest list against it.
+    #
+    # `Bash` is the ONE host-named tool declared here, and the caveat the
+    # blocking-guard paragraph below raises applies to it: on a host that calls
+    # the shell `launch-process` or `BashTool` this concern will not see it. That
+    # is a missed advisory line, not a disabled guard — the trade the paragraph
+    # below refuses for a security hook is the right one for a context line, and
+    # the alternative (dropping the filter) would dispatch this concern on every
+    # tool call in the session.
     #
     # Deliberately NOT declared on the four blocking PreToolUse guards
     # (block-no-verify, block-kernel-rule-writes, block-plumbing-writes,
@@ -508,7 +563,7 @@ concerns:
     # re-read `tool_name` and return early; paying one dispatch to keep a guard
     # correct is the right trade, and the cheap filter is reserved for advisory
     # concerns whose set is provable from their own source.
-    tools: [Grep, Glob, Read]
+    tools: [Grep, Glob, Read, Bash]
     needs_payload_bodies: [input]
   # road-to-reachable-code-memory Phase 4 — session_end learning-sidecar
   # aggregation. Joins the EXISTING session_end concern set (no new platform
@@ -524,6 +579,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: memory
   # Phase 2 of road-to-hooks-actually-fire-in-consumers — session_start
   # gate that surfaces the marketplace-install-but-unscaffolded shape.
   # Writes .augment/.first-run-action-needed.md + one stderr line so
@@ -534,6 +590,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
   # session-profile-activation Phase 1 — emits a one-line staleness notice
   # when a new session starts with a `runtime.active_packs` overlay carried
   # over from a previous session. Never resets (option a, explicit
@@ -543,6 +600,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
   # Defense-in-depth twin of the update-command wrapper refresh
   # (cmd_upgrade / cmd_refresh). On session_start, re-stamps a stale
   # project-local ./agent-config wrapper from the canonical template so
@@ -553,6 +611,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
   # road-to-install-path-convergence Phase 4 — duplicate-surface probe.
   # Reads src/config/surface-matrix.yml, existence-checks declared duplicate
   # classes, nudges ONCE per day (state: agents/runtime/state/
@@ -563,6 +622,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
   # road-to-team-mode Phase 4 — managed Review-Gate circuit breaker.
   # Runs AFTER the plugin's own Stop gate: reads the persisted gate job
   # record, counts consecutive BLOCK verdicts per session, injects the
@@ -575,6 +635,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
   # Reply-shape backstop for the direct-answers rule (reply-close): a PR
   # created THIS turn must end the reply as the literal last raw URL. This
   # PostToolUse hook fires right after a PR *create* (gh pr create, or a
@@ -587,6 +648,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
     needs_payload_bodies: [input, result]
   # Push-settle reminder — the second half of "a push closes its own loop".
   # The pre-push hook answers "is this push safe to make"; nothing answered "is
@@ -602,6 +664,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
     needs_payload_bodies: [input, result]
   # Language-mirror pin — carries the ONE fact the transcript cannot express:
   # which language the human actually typed. 47 skill/slash-command bodies were
@@ -615,6 +678,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: context
   # Git-authorization ledger — records which git ops the user's OWN WORDS
   # authorize this turn. Writes state only; never blocks.
   git-authorization:
@@ -622,6 +686,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
   # The blocking half was REMOVED by owner decision on 2026-09-04 (ADR-254).
   # It refused authorizations the owner had in fact given: a guardrail sentence
   # inside an authorization ("never merge empty PRs") read as a withdrawal and
@@ -653,6 +718,7 @@ concerns:
     args: []
     fail_closed: false
     severity: blocking
+    effect: permission
     needs_payload_bodies: [input]
   # Canary injection — deterministic carrier for the
   # session-canary rule (greet-by-name at task start + reply-close markers
@@ -675,6 +741,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: context
   # Council-availability fact. Carries whether a council is configured and from
   # where, because the always-loaded layer refers to the council conditionally
   # and never says how to check. Measured 2026-08-08: an agent announced "kein
@@ -687,6 +754,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
   # Org-telemetry disclosure (road-to-org-telemetry Phase 3.2; ADR-233 § D5).
   # `org-pack` is the only consent class in this suite granted by somebody
   # OTHER than the person it binds — an org administrator, once, for every
@@ -700,6 +768,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
   # road-to-org-telemetry Phase 2 (step 2.1) — session-end Class-A flush.
   # Checks whether the outbound spool has bytes and, if so, spawns a DETACHED
   # sender and returns. It makes no network call in the session's own process,
@@ -728,6 +797,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
   # Self-repair intake (road-to-self-repair Phase 1). Two slots, one queue:
   # user_prompt_submit opens a record when the user states the agent worked
   # wrongly and injects the open-queue line; stop runs the deterministic
@@ -739,6 +809,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
   # Shared per-session register (road-to-parallel-session-coordination) — writes
   # this session into <git-common-dir>/agent-sessions/<session_id>.json so every
   # other worktree of the repo can see it, and on session_start injects the live
@@ -772,6 +843,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
   # road-to-orchestrator-discipline-carriers Phase 3 (F6) — deterministic
   # PostToolUse orchestration-telemetry capture. Fires only on an Agent/Task
   # tool-use completion (the two observed subagent-dispatch tool names) and
@@ -784,6 +856,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
     tools: [Agent, Task]
     needs_payload_bodies: [input, result]
   # road-to-org-telemetry Phase 1 (step 1.2) — Class-A usage capture. Fires
@@ -827,6 +900,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
     # Provable from the hook's own source: the only branch surface is
     # `extractToolName(payload) !== SKILL_TOOL_NAME`.
     tools: [Skill]
@@ -836,6 +910,25 @@ concerns:
     # the large one, and this concern records a usage FACT rather than an
     # outcome, so the result class would be paid for and discarded.
     needs_payload_bodies: [input]
+  # road-to-neighbours-that-pull-their-weight step 3.3, decision D12 (owner,
+  # 2026-10-06) — foreign MCP tool NAMES, observed for `doctor neighbours`.
+  # DEFAULT-ON LOCAL OBSERVATION THAT BYPASSES THE TELEMETRY OPT-IN, by design:
+  # the store is a local census input under gitignored `agents/runtime/`, no
+  # transport reads it, and gating it on the org switch would print `0` on
+  # every install. A concern of its own rather than a branch of
+  # `telemetry-usage`, whose exact-match `tools: [Skill]` filter meant the
+  # dispatcher never called that branch (council 2026-10-02, both seats).
+  # No `tools:` key — MCP names are not enumerable and matching is exact; the
+  # hook's `mcp__` prefix test is the filter. No `needs_payload_bodies` — the
+  # dispatcher serves it size-only stubs for `tool_input` and `tool_response`,
+  # so it receives the tool name and nothing it could leak. Silent, exit 0
+  # always, emits nothing (no hook-token-budget row). fail_closed: false.
+  mcp-usage-observation:
+    script: src/scripts/hooks/mcp_usage_observation_hook.ts
+    args: []
+    fail_closed: false
+    severity: advisory
+    effect: telemetry
   # road-to-orchestrator-discipline-carriers Phase 4 (F3-lite) — conditional
   # delegation nudge. Extracts cheap structural signals from the SUBMITTED
   # prompt (enumerated file lists, "for each"/"alle …" shapes, explicit slice
@@ -873,6 +966,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
     nudge_rank: 1
   # road-to-inbox-harvest-2026-08-d-runtime-skill-routing Phase 2 — binds the
   # deterministic task→skill ranker, which had shipped with ZERO production
@@ -896,6 +990,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: context
     nudge_rank: 2
   # road-to-trigger-delivered-rule-bodies Phase 1 — the DELIVERY twin of
   # `skill-route` above: same two slots, opposite payload policy. `skill-route`
@@ -934,6 +1029,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: context
     needs_payload_bodies: [input]
   # road-to-orchestrator-discipline-carriers Phase 5 (F4-lite) — end-review
   # nudge. Fires ONLY when the session mutated tracked+untracked, non-doc
@@ -961,11 +1057,13 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
   end-review-nudge:
     script: src/scripts/hooks/end_review_nudge_hook.ts
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
     # road-to-stop-gate-honesty step 3.1 — skipped on a refusal RETRY.
     # ARGUMENT, per concern as that step requires: the F2 fire gate is a
     # once-per-session marker, and this concern's own header records that a
@@ -1006,6 +1104,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
   # road-to-conformance-round5 Phase 3 — the FIRST concern that can refuse a
   # turn-END. Round 5 measured the reason: both blocking carriers reached zero
   # violations, neither advisory carrier did, and 19 language violations
@@ -1029,16 +1128,34 @@ concerns:
   # detector's own trigger conditions, which is the same shape `delegation-nudge`
   # uses — no signal, no output. `hooks.turn_end_gate.*` is in REMOVED_KEYS.
   #
-  # fail_closed: FALSE, deliberately and unlike every other blocking concern
-  # here: a crash in a turn-end gate must let the turn END. Failing closed on
-  # this slot does not degrade the session, it wedges it. Re-entrancy is two
-  # independent layers (`stop_hook_active`; a marker keyed on the last USER
-  # message, never the reply) — see the hook's file header.
+  # fail_closed: FALSE — and read what that flag still DOES before changing it.
+  # Since the dispatcher resolves rc >= 3 by SEVERITY it no longer decides the
+  # crash branch at all; it decides the stdin-read-failure deny
+  # (`stdin_failure_policy._is_fail_closed_blocking`), and nothing else. An
+  # independent review named the old wording a reviewer trap: an operator
+  # reading "fail_closed: false — a crash must let the turn END" would believe
+  # they were configuring crash behaviour, and flipping it would change the
+  # read-failure deny instead. The REASON it was set false is still true —
+  # failing closed on a turn-end gate does not degrade the session, it wedges
+  # it — but the flag is no longer what delivers it.
+  #
+  # What answers it now lives in the dispatcher, which is the only layer that
+  # can: a blocking `stop` concern spends its refusal ONCE, and on the retry the
+  # host marks (`stop_hook_active`) a crash falls back to fail-open and the turn
+  # ends. The hook's own two re-entrancy layers cannot do this job — both run
+  # INSIDE `main()`, so a crash never reaches them.
+  #
+  # The trade is deliberate: one refused Stop buys a guard that no longer
+  # permits every turn end precisely when it is broken, and the second Stop
+  # releases. Re-entrancy inside the hook stays what it was (`stop_hook_active`;
+  # a marker keyed on the last USER message, never the reply) — see the hook's
+  # file header.
   turn-end-gate:
     script: src/scripts/hooks/turn_end_gate_hook.ts
     args: []
     fail_closed: false
     severity: blocking
+    effect: permission
   # Comment-discipline advisory — the write-time half of
   # `lint_code_comments`. Scans the TEXT JUST WRITTEN (Write ->
   # tool_input.content, Edit -> tool_input.new_string), never the file on
@@ -1059,6 +1176,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
     tools: [Write, Edit]
     needs_payload_bodies: [input]
   # road-to-token-economy-cache Phase 5.1/5.2 — edit-shape advisory. Fires
@@ -1076,6 +1194,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
     # Provable from the hook's own source: the only branch surface is
     # `toolName !== 'Write'` — same cheap-filter discipline as
     # `orchestration-record`'s [Agent, Task].
@@ -1097,6 +1216,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: verification
     # Provable from the hook's own source: READ_TOOLS ∪ WRITE_TOOLS.
     tools: [Read, Edit, Write]
     needs_payload_bodies: [input]
@@ -1131,6 +1251,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: memory
     # Provable from the hook's own source: the union of the `tools` sets on
     # RECALL_RULES — COMMAND_TOOLS (rules 1 and 4) ∪ EDIT_TOOLS (rules 2, 3).
     tools: [Bash, Edit, Write, MultiEdit, str-replace-editor, save-file, launch-process]
@@ -1154,6 +1275,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: notification
   # road-to-long-horizon-execution Phase 1 (H-1) — the stop slot's first
   # WORK-REMAINING concern. No-op unless this session claimed a roadmap
   # (`sessions:claim`) whose frontmatter says `execution.mode: autonomous`;
@@ -1166,6 +1288,12 @@ concerns:
   # always. Events: agents/runtime/state/run-continuation.jsonl. Kill switch:
   # AGENT_CONFIG_NO_RUN_CONTINUATION=1. fail_closed: false — the only block
   # it ever emits is the one carrying its own continuation text.
+  # fail_closed: false — and as for `turn-end-gate` above, the dispatcher now
+  # resolves rc >= 3 by SEVERITY rather than by this flag, so a crash here
+  # refuses the first Stop and releases on the retry. What the flag still
+  # decides is the stdin-read-failure deny, not crash behaviour; changing it
+  # changes that and nothing else. The only block this concern DECIDES to emit
+  # is still the one carrying its own continuation text.
   run-continuation:
     script: src/scripts/hooks/run_continuation_hook.ts
     args: []
@@ -1179,6 +1307,7 @@ concerns:
     # mechanism was inert on the one verified host. `turn-end-gate` above sits
     # on the same slot and declares `blocking` for exactly this reason.
     severity: blocking
+    effect: permission
   # road-to-user-out-of-the-loop Phase 0 Step 1 — the interruption ledger.
   # Every Stop, classifies whether the turn that just ended put a synchronous
   # contact to the user and appends one `{run_id, turn, kind, class, roadmap}`
@@ -1204,6 +1333,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
     # road-to-stop-gate-honesty step 3.1 — skipped on a refusal RETRY, and this
     # is the flag with the real saving.
     # ARGUMENT, per concern: `alreadyRecorded(ledgerPath, run_id, turn)` dedupes
@@ -1237,6 +1367,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
   # road-to-inbox-harvest-2026-08-d-context-ledger Phase 1 Step 1.1 — the
   # tool-result byte counter. `hook-token-budget.json` registers the gap it
   # closes in its own words: bytes-into-context from tool RESULTS are
@@ -1261,6 +1392,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
   # road-to-subagent-lifecycle-integrity Phase 3 Step 1 — spawn guard, SHADOW
   # ONLY, per docs/contracts/concern-activation-policy.md. On every Agent/Task
   # call it appends one `spawn_guard_shadow` line recording what a guard WOULD
@@ -1281,6 +1413,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
     tools: [Agent, Task]
   # road-to-source-first-frontend Phase 3 Steps 1-2 — source-first gate, SHADOW
   # ONLY, per docs/contracts/concern-activation-policy.md. On every
@@ -1305,11 +1438,15 @@ concerns:
   # to advisory is pre-registered in the hook header.
   #
   # Never blocks, never warns: exit 0 on every path. fail_closed: false.
+  # `effect: telemetry`, not `verification`, and the script's own header is why:
+  # "it emits nothing to the model and it never blocks". A shadow concern
+  # records what a gate WOULD have said; recording is what it delivers.
   source-first-gate:
     script: src/scripts/hooks/source_first_gate_hook.ts
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
     needs_payload_bodies: [input]
   # road-to-runtime-event-journal Phase 1 step 1.4 — the journal's hook binding
   # (AI council 2026-08-28, decision 3). `_lib/runtime_journal.ts` shipped bound
@@ -1353,6 +1490,7 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    effect: telemetry
 
 # Role axis (road-to-token-economy-dispatch Phase 2). The dispatcher reads
 # AGENT_CONFIG_SESSION_ROLE (resolved via _lib/session_role.ts — set ONLY by
@@ -1425,11 +1563,21 @@ platforms:
     session_end:      [chat-history, memory-learn, session-register, roadmap-progress, telemetry-flush]
     stop:             [chat-history, verify-before-complete, self-repair, session-register, roadmap-progress, design-pass-stop]
     pre_tool_use:     [block-no-verify, evidence-independence, block-kernel-rule-writes, block-plumbing-writes, block-config-weakening, block-speaking-inbox-dir, rtk-wrap, design-slop, ui-route-nudge, code-graph-context, chain-nudge, ship-diff-volume, reread-guard, memory-recall]
-    post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, tool-result-bytes, edit-shape, comment-discipline, design-pass]
+    post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, mcp-usage-observation, tool-result-bytes, edit-shape, comment-discipline, design-pass]
 
   claude:
     ask:              native
-    session_start:    [chat-history, hot-context, handoff-context, session-canary, council-availability, telemetry-disclosure, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register, review-baseline, journal-record]
+    session_start:    [chat-history, hot-context, handoff-context, session-canary, council-availability, telemetry-disclosure, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register, review-baseline, journal-record, rule-inject]
+    # `rule-inject` is bound here for ONE source: `compact`
+    # (road-to-a-rule-carrier-that-works-outside-the-repo step 1.6). The concern
+    # returns before reading anything on `startup`, `resume`, `clear` and
+    # `fork`, so this binding costs a function call per session on every other
+    # source. It exists because `pre_compact` can only re-ARM delivery — it
+    # cannot deliver, since the host is about to discard the context it would
+    # emit into. The law sections of the pre-compaction seen-set are sent here
+    # instead, under the same 8,000-character budget, which is the half the
+    # concern's own header used to end at: a rule whose trigger does not recur
+    # was not restored at all.
     session_end:      [chat-history, memory-learn, session-register, roadmap-progress, telemetry-flush, journal-record]
     stop:             [chat-history, verify-before-complete, team-review-gate, end-review-nudge, obligation-settle, turn-end-gate, self-repair, session-register, session-eol, interruption-ledger, roadmap-progress, design-pass-stop, suggestion-capture, journal-record, run-continuation]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, delegation-nudge, skill-route, git-authorization, session-canary, self-repair, session-register, rule-inject, suggestion-capture, journal-record]
@@ -1457,7 +1605,7 @@ platforms:
     # `project_thin_rules.path_only_ids`; the receiver is
     # `agents/roadmaps/stubs/road-to-a-path-route-under-delivery.md`.
     pre_tool_use:     [block-no-verify, evidence-independence, block-kernel-rule-writes, block-plumbing-writes, block-config-weakening, block-speaking-inbox-dir, one-question-per-ask, rtk-wrap, design-slop, ui-route-nudge, code-graph-context, chain-nudge, ship-diff-volume, reread-guard, spawn-guard-shadow, source-first-gate, memory-recall]
-    post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, tool-result-bytes, edit-shape, comment-discipline, language-mirror, design-pass, journal-record]
+    post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, mcp-usage-observation, tool-result-bytes, edit-shape, comment-discipline, language-mirror, design-pass, journal-record]
     # `language-mirror` — round-5 § 6.1. `pre_compact` sets a pin-lost marker;
     # the `post_tool_use` entry above re-emits the pin exactly once while that
     # marker is set, then clears it. One extra injection per compaction EVENT —
@@ -1504,7 +1652,7 @@ platforms:
     stop:             [chat-history, verify-before-complete, self-repair, session-register, roadmap-progress, design-pass-stop]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, self-repair, session-register]
     pre_tool_use:     [block-no-verify, evidence-independence, block-kernel-rule-writes, block-plumbing-writes, block-config-weakening, block-speaking-inbox-dir, rtk-wrap, design-slop, ui-route-nudge, code-graph-context, chain-nudge, ship-diff-volume, reread-guard, spawn-guard-shadow, source-first-gate, memory-recall]
-    post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, tool-result-bytes, edit-shape, comment-discipline, design-pass]
+    post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, mcp-usage-observation, tool-result-bytes, edit-shape, comment-discipline, design-pass]
     # subagent-ledger IS bound here, unlike the two nudges above, and the
     # difference is the delivery channel rather than the platform: the nudges
     # depend on stdout reaching the model, which this trampoline discards by
@@ -1529,7 +1677,7 @@ platforms:
     session_end:        [chat-history, memory-learn, session-register, roadmap-progress, telemetry-flush]
     stop:               [chat-history, verify-before-complete, self-repair, session-register, roadmap-progress, design-pass-stop]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, self-repair, session-register]
-    post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, tool-result-bytes, edit-shape, comment-discipline, design-pass]
+    post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, mcp-usage-observation, tool-result-bytes, edit-shape, comment-discipline, design-pass]
 
   # Phase 7.6 — Cline. Hooks live under `.clinerules/hooks/<HookName>`
   # (project, no file extension, must be executable per Cline docs) or
@@ -1545,7 +1693,7 @@ platforms:
     session_end:        [chat-history, memory-learn, session-register, roadmap-progress, telemetry-flush]
     stop:               [chat-history, verify-before-complete, self-repair, session-register, roadmap-progress, design-pass-stop]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, self-repair, session-register]
-    post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, tool-result-bytes, edit-shape, comment-discipline, design-pass]
+    post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, mcp-usage-observation, tool-result-bytes, edit-shape, comment-discipline, design-pass]
 
   # Phase 7.7 — Windsurf (Cascade). Hooks live at `.windsurf/hooks.json`
   # (project) or `~/.codeium/windsurf/hooks.json` (user). Cascade has
@@ -1583,7 +1731,7 @@ platforms:
     session_end:        [chat-history, memory-learn, session-register, roadmap-progress, telemetry-flush]
     stop:               [chat-history, verify-before-complete, self-repair, session-register, roadmap-progress, design-pass-stop]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, self-repair, session-register]
-    post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, tool-result-bytes, edit-shape, comment-discipline, design-pass]
+    post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, mcp-usage-observation, tool-result-bytes, edit-shape, comment-discipline, design-pass]
 
   # Phase 7.9 — this package binds no hook on Copilot and has measured none
   # there. Concerns route through rule-only fallback; the dispatcher silently
@@ -1608,6 +1756,18 @@ native_event_aliases:
     Stop:              stop
     UserPromptSubmit:  user_prompt_submit
     PostToolUse:       post_tool_use
+    # A FAILING tool call does not fire `PostToolUse` at all — it fires
+    # `PostToolUseFailure`, which until now was bound to nothing, so the
+    # verification recorder never saw a red command and `verification_runs`
+    # could only ever hold passes. Observed on 2.1.286, three one-shot sessions,
+    # exactly one of the two events per call — not inferred from the event list.
+    # Lowered onto the SAME canonical slot rather than given a canonical event
+    # of its own: one slot, one concern list, no change to the event vocabulary.
+    # Deliberately claude-only. Cowork is Claude Code underneath and the rows
+    # below duplicate this vocabulary, but this pair was measured on claude and
+    # on no other host, and an alias row asserting a host behaviour nobody
+    # observed is the defect class this suite keeps finding in its own tables.
+    PostToolUseFailure: post_tool_use
     PreToolUse:        pre_tool_use
     PreCompact:        pre_compact
     # road-to-subagent-lifecycle-integrity Phase 1 Step 1. Both tokens were