@event4u/agent-config 16.5.0 → 17.0.0

package/src/scripts/hooks/host_docs_pages.yaml

@@ -0,0 +1,75 @@
+# host_docs_pages — vendor pages this tree cites that are NOT a hook contract.
+#
+# WHY THIS FILE EXISTS. `host_lowering.yaml` records, per host, the page each
+# row's answers were read off, and `check_host_docs_digest` watches exactly
+# those pages. Every `docs_url` in that table is a HOOKS page, because that is
+# what a lowering row is about. So a vendor page this tree reads for something
+# else — a listing contract, a catalogue budget — reaches the tree only by
+# accident: nothing re-fetches it, nothing notices when it moves, and the
+# reading goes stale in silence until somebody happens to look.
+#
+# This is the sibling list for those pages. Same four provenance fields as a
+# lowering row's `verified:` block, same watcher, same discipline.
+#
+# WHY IT IS A SEPARATE FILE AND NOT A ROW IN host_lowering.yaml. A lowering row
+# is keyed `(host, surface, slot)` and answers "what does this host do with a
+# dispatcher verdict". A listing page answers nothing of the sort, and a row
+# with every hook column null would be a lie shaped like data. The tables also
+# carry different edit costs: `host_lowering.yaml` is on the plumbing list, so
+# an edit there carries a ratification artifact — correct for a file that
+# decides whether a gate can refuse, and wrong for a list of URLs to re-fetch.
+#
+# WHAT A CHANGED DIGEST MEANS HERE, as in the sibling table: evidence that the
+# page MOVED, never a reading of what it now says. The watcher adopts no
+# upstream text. A human reads the page and re-establishes the row by hand.
+#
+# COLUMNS
+#   docs_url      the page, as the URL that actually serves the body. Record
+#                 the redirect TARGET, never a URL that answers 301 — a digest
+#                 over a redirect body is not a digest over the page.
+#   docs_at       the day a human last READ this page. Not the day its body was
+#                 hashed; those are two events and the sibling table learned
+#                 that the hard way.
+#   docs_digest   sha256 of the body as fetched by the last digest run, or
+#                 `null` when no run has hashed it yet. `null` is an honest
+#                 state, not a gap: it is filled by the first
+#                 `check_host_docs_digest --fetch --write`.
+#   expires       this package's review-by date for the reading. The gate tests
+#                 `expires < today`, so a drifted row is pulled back to the day
+#                 BEFORE detection — "valid through yesterday".
+#   why           one line: what this tree reads off the page, and who reads it.
+#                 A page nobody cites does not belong on this list.
+#
+# CONSUMED BY:
+#   - src/scripts/hooks/host_docs_pages.ts   (reader + surgical writer)
+#   - src/scripts/check_host_docs_digest.ts  (the docs-drift watcher)
+
+pages:
+  claude-code-skills:
+    docs_url: https://code.claude.com/docs/en/skills.md
+    docs_at: 2026-10-19
+    docs_digest: 428fdf2654fa01dcbbece1f6d010e350f646ecbdbec229e7df097f452f06c2b7
+    expires: 2027-10-19
+    why: >-
+      The skill LISTING contract — that the host lists every skill name but
+      keeps descriptions only up to a fraction of the context window, filling by
+      invocation frequency and capping each entry. `src/scripts/_lib/host_listing_model.ts`
+      models that mechanism and cites this page for its numbers; nothing else
+      in this tree establishes any of them. As of the 2026-10-19 read the page
+      states the fraction and the per-entry cap; the chars-per-token ratio rests
+      on an illustration only the 2026-08-22 read carried.
+  codex-skills:
+    docs_url: https://learn.chatgpt.com/docs/build-skills.md
+    docs_at: 2026-10-17
+    docs_digest: ed6e324f747d47adf6f60ee1fca13ba469b3671f55f58c3a78f35947af6919d5
+    expires: 2027-10-17
+    why: >-
+      The second host's skill contract, which road-to-skills-that-arrive-when-called
+      builds its Codex rows on (D3, Phase 0.3, Phase 4): the user root is
+      `$HOME/.agents/skills` and repositories are scanned under `.agents/skills`;
+      the initial list includes each skill's path and uses at most 2% of the
+      context window (8,000 characters when unknown, configurable up to 10,000
+      tokens); descriptions are shortened first and skills may then be omitted
+      with a warning; changes are detected automatically. The old URL
+      `developers.openai.com/codex/skills.md` answers 308 to this one, so the
+      redirect target is recorded.

package/src/scripts/hooks/host_lowering.json

@@ -1 +1 @@
-{"fingerprint":"08575a71d81fd8a5ef9e4b400f4a38cb66c26e1dd701d98f3cdc0bdc9e4758b4:22235","body_fingerprint":"26a02a8e0fb2b6be6eb1def6ae8792c021425598bd672c850e6582726d96a6a5:6376","table":{"schema_version":1,"hosts":{"claude":{"surfaces":{"any":{"entry_shape":"claude-settings-hooks","json_shape":"hook-specific-output","fail_policy":"propagate","timeout_unit":"seconds","timeout_default":null,"verified":{"docs_at":"2026-09-29","docs_url":"https://code.claude.com/docs/en/hooks.md","docs_digest":"9dd68316c1111c118e3ddb82861ac6271a8cd164cee0d371b26165efff35fe88","probe_at":"2026-09-06","host_version":"2.1.263","expires":"2027-09-06"},"slots":{"session_start":{"native":"SessionStart","block_exit":null,"answered_at":"2026-09-29"},"session_end":{"native":"SessionEnd","block_exit":null,"answered_at":"2026-09-29"},"stop":{"native":"Stop","block_exit":2,"answered_at":"2026-09-29"},"user_prompt_submit":{"native":"UserPromptSubmit","block_exit":2,"answered_at":"2026-09-29"},"pre_tool_use":{"native":"PreToolUse","block_exit":2,"answered_at":"2026-09-29"},"post_tool_use":{"native":"PostToolUse","block_exit":null,"answered_at":"2026-09-29"},"pre_compact":{"native":"PreCompact","block_exit":null,"answered_at":"2026-09-29"},"subagent_start":{"native":"SubagentStart","block_exit":null,"answered_at":"2026-09-29"},"subagent_stop":{"native":"SubagentStop","block_exit":null,"answered_at":"2026-09-29"}}}}},"augment":{"surfaces":{"any":{"entry_shape":"augment-settings-hooks","json_shape":"none","fail_policy":"discard","timeout_unit":"unknown","timeout_default":null,"verified":{"docs_at":"2026-09-29","docs_url":"https://docs.augmentcode.com/cli/hooks.md","docs_digest":"e500823be8303717020c1823f670e06d100108f6e3ac4b8d12a46d91fd1898fa","probe_at":null,"host_version":null,"expires":"2027-09-29"},"slots":{"session_start":{"native":"SessionStart","block_exit":null,"answered_at":"2026-09-29"},"session_end":{"native":"SessionEnd","block_exit":null,"answered_at":"2026-09-29"},"stop":{"native":"Stop","block_exit":null,"answered_at":"2026-09-29"},"pre_tool_use":{"native":"PreToolUse","block_exit":null,"answered_at":"2026-09-29"},"post_tool_use":{"native":"PostToolUse","block_exit":null,"answered_at":"2026-09-29"}}}}},"cursor":{"surfaces":{"any":{"entry_shape":"cursor-hooks-json","json_shape":"none","fail_policy":"propagate","timeout_unit":"unknown","timeout_default":null,"verified":{"docs_at":"2026-09-29","docs_url":"https://cursor.com/docs/hooks.md","docs_digest":"7294a2d63b19d79a5283c948afe174cba8b06a7585563d34a2c41b90f5df0d39","probe_at":null,"host_version":null,"expires":"2027-09-29"},"slots":{"session_start":{"native":"sessionStart","block_exit":null,"answered_at":"2026-09-29"},"session_end":{"native":"sessionEnd","block_exit":null,"answered_at":"2026-09-29"},"stop":{"native":"stop","block_exit":null,"answered_at":"2026-09-29"},"user_prompt_submit":{"native":"beforeSubmitPrompt","block_exit":null,"answered_at":"2026-09-29"},"post_tool_use":{"native":"postToolUse","block_exit":null,"answered_at":"2026-09-29"}}}}},"cline":{"surfaces":{"any":{"entry_shape":"cline-per-event-script","json_shape":"none","fail_policy":"discard","timeout_unit":"unknown","timeout_default":null,"verified":{"docs_at":"2026-09-29","docs_url":"https://docs.cline.bot/customization/hooks.md","docs_digest":"ef87561721f4cb80fe6d682b6866d638a4952dd416d36cd5ab398426ce64084b","probe_at":null,"host_version":null,"expires":"2027-09-29"},"slots":{"session_start":{"native":["TaskStart","TaskResume"],"block_exit":null,"answered_at":"2026-09-29"},"session_end":{"native":"TaskComplete","block_exit":null,"answered_at":"2026-09-29"},"stop":{"native":"TaskCancel","block_exit":null,"answered_at":"2026-09-29"},"user_prompt_submit":{"native":"UserPromptSubmit","block_exit":null,"answered_at":"2026-09-29"},"post_tool_use":{"native":"PostToolUse","block_exit":null,"answered_at":"2026-09-29"}}}}},"windsurf":{"surfaces":{"any":{"entry_shape":"windsurf-hooks-json","json_shape":"none","fail_policy":"propagate","timeout_unit":"unknown","timeout_default":null,"verified":{"docs_at":"2026-09-29","docs_url":"https://docs.devin.ai/desktop/cascade/hooks.md","docs_digest":"460ffe7aa91998804920f6722c0153b9948eadd5edafa19582298475a19835a2","probe_at":null,"host_version":null,"expires":"2027-09-29"},"slots":{"session_start":{"native":"post_setup_worktree","block_exit":null,"answered_at":"2026-09-29"},"user_prompt_submit":{"native":"pre_user_prompt","block_exit":null,"answered_at":"2026-09-29"},"stop":{"native":"post_cascade_response","block_exit":null,"answered_at":"2026-09-29"}}}}},"gemini":{"surfaces":{"any":{"entry_shape":"gemini-settings-hooks","json_shape":"none","fail_policy":"propagate","timeout_unit":"unknown","timeout_default":null,"verified":{"docs_at":"2026-09-29","docs_url":"https://geminicli.com/docs/hooks/reference.md","docs_digest":"06d37f2f66812ee78bb46c37a112203376f0bae4d3b8b44ac79d0bda4b86a118","probe_at":null,"host_version":null,"expires":"2027-09-29"},"slots":{"session_start":{"native":"SessionStart","block_exit":null,"answered_at":"2026-09-29","matcher":""},"session_end":{"native":"SessionEnd","block_exit":null,"answered_at":"2026-09-29","matcher":""},"stop":{"native":"AfterAgent","block_exit":null,"answered_at":"2026-09-29","matcher":""},"user_prompt_submit":{"native":"BeforeAgent","block_exit":null,"answered_at":"2026-09-29","matcher":""},"post_tool_use":{"native":"AfterTool","block_exit":null,"answered_at":"2026-09-29","matcher":".*"}}}}},"cowork":{"surfaces":{"any":{"entry_shape":"none","json_shape":"none","fail_policy":"discard","timeout_unit":"unknown","timeout_default":null,"verified":{"docs_at":"2026-09-29","docs_url":null,"docs_digest":null,"probe_at":null,"host_version":null,"expires":"2027-09-29"},"slots":{}}}},"copilot":{"surfaces":{"any":{"entry_shape":"none","json_shape":"none","fail_policy":"discard","timeout_unit":"unknown","timeout_default":null,"verified":{"docs_at":"2026-09-29","docs_url":"https://docs.github.com/en/copilot/concepts/agents/hooks.md","docs_digest":"bfd40aa93ad62133efc17a50f189034f01594dc89a5d31a13a0c541d691acede","probe_at":null,"host_version":null,"expires":"2027-09-29"},"slots":{}}}},"codex":{"surfaces":{"any":{"entry_shape":"none","json_shape":"none","fail_policy":"discard","timeout_unit":"unknown","timeout_default":null,"verified":{"docs_at":"2026-09-29","docs_url":"https://developers.openai.com/codex/hooks.md","docs_digest":"724881d81f1a9fdb35ea42d4851a11b1f6606bbc6e9d2d05c1e8c466fc25c630","probe_at":"2026-10-01","host_version":"0.148.0","expires":"2027-09-29"},"slots":{}}}}}}}
+{"fingerprint":"398a795b1cf7152c8b09aebecd3365edcda74b2893528b8ed021446786da4796:22312","body_fingerprint":"3783687449af9116a2386ef6d31bcaa2f9ddd2b1d9a774d9e9f525b7b6a0c01b:6376","table":{"schema_version":1,"hosts":{"claude":{"surfaces":{"any":{"entry_shape":"claude-settings-hooks","json_shape":"hook-specific-output","fail_policy":"propagate","timeout_unit":"seconds","timeout_default":null,"verified":{"docs_at":"2026-10-19","docs_url":"https://code.claude.com/docs/en/hooks.md","docs_digest":"dd0f114dac70bc7836abd37797fb486d3007d889eeb6bbc88c307ed2587a44ef","probe_at":"2026-09-06","host_version":"2.1.263","expires":"2027-09-06"},"slots":{"session_start":{"native":"SessionStart","block_exit":null,"answered_at":"2026-09-29"},"session_end":{"native":"SessionEnd","block_exit":null,"answered_at":"2026-09-29"},"stop":{"native":"Stop","block_exit":2,"answered_at":"2026-09-29"},"user_prompt_submit":{"native":"UserPromptSubmit","block_exit":2,"answered_at":"2026-09-29"},"pre_tool_use":{"native":"PreToolUse","block_exit":2,"answered_at":"2026-09-29"},"post_tool_use":{"native":"PostToolUse","block_exit":null,"answered_at":"2026-09-29"},"pre_compact":{"native":"PreCompact","block_exit":null,"answered_at":"2026-09-29"},"subagent_start":{"native":"SubagentStart","block_exit":null,"answered_at":"2026-09-29"},"subagent_stop":{"native":"SubagentStop","block_exit":null,"answered_at":"2026-09-29"}}}}},"augment":{"surfaces":{"any":{"entry_shape":"augment-settings-hooks","json_shape":"none","fail_policy":"discard","timeout_unit":"unknown","timeout_default":null,"verified":{"docs_at":"2026-10-14","docs_url":"https://docs.augmentcode.com/cli/hooks.md","docs_digest":"93f421dccdd017099d87b12ffd7fe8f272d8adf750856ddfb200d9b55c695378","probe_at":null,"host_version":null,"expires":"2027-10-14"},"slots":{"session_start":{"native":"SessionStart","block_exit":null,"answered_at":"2026-09-29"},"session_end":{"native":"SessionEnd","block_exit":null,"answered_at":"2026-09-29"},"stop":{"native":"Stop","block_exit":null,"answered_at":"2026-09-29"},"pre_tool_use":{"native":"PreToolUse","block_exit":null,"answered_at":"2026-09-29"},"post_tool_use":{"native":"PostToolUse","block_exit":null,"answered_at":"2026-09-29"}}}}},"cursor":{"surfaces":{"any":{"entry_shape":"cursor-hooks-json","json_shape":"none","fail_policy":"propagate","timeout_unit":"unknown","timeout_default":null,"verified":{"docs_at":"2026-09-29","docs_url":"https://cursor.com/docs/hooks.md","docs_digest":"7294a2d63b19d79a5283c948afe174cba8b06a7585563d34a2c41b90f5df0d39","probe_at":null,"host_version":null,"expires":"2027-09-29"},"slots":{"session_start":{"native":"sessionStart","block_exit":null,"answered_at":"2026-09-29"},"session_end":{"native":"sessionEnd","block_exit":null,"answered_at":"2026-09-29"},"stop":{"native":"stop","block_exit":null,"answered_at":"2026-09-29"},"user_prompt_submit":{"native":"beforeSubmitPrompt","block_exit":null,"answered_at":"2026-09-29"},"post_tool_use":{"native":"postToolUse","block_exit":null,"answered_at":"2026-09-29"}}}}},"cline":{"surfaces":{"any":{"entry_shape":"cline-per-event-script","json_shape":"none","fail_policy":"discard","timeout_unit":"unknown","timeout_default":null,"verified":{"docs_at":"2026-10-14","docs_url":"https://docs.cline.bot/customization/hooks.md","docs_digest":"73b6df1bf5e51589313ea3fcfdd50c0d505530234418adcdc9fe198af61837c2","probe_at":null,"host_version":null,"expires":"2027-10-14"},"slots":{"session_start":{"native":["TaskStart","TaskResume"],"block_exit":null,"answered_at":"2026-09-29"},"session_end":{"native":"TaskComplete","block_exit":null,"answered_at":"2026-09-29"},"stop":{"native":"TaskCancel","block_exit":null,"answered_at":"2026-09-29"},"user_prompt_submit":{"native":"UserPromptSubmit","block_exit":null,"answered_at":"2026-09-29"},"post_tool_use":{"native":"PostToolUse","block_exit":null,"answered_at":"2026-09-29"}}}}},"windsurf":{"surfaces":{"any":{"entry_shape":"windsurf-hooks-json","json_shape":"none","fail_policy":"propagate","timeout_unit":"unknown","timeout_default":null,"verified":{"docs_at":"2026-10-14","docs_url":"https://docs.devin.ai/desktop/cascade/hooks.md","docs_digest":"b9e0cd4772de9e7c4086ecf31bfcb456dc74c3b36516f52c2ff8ec1dd5c1170d","probe_at":null,"host_version":null,"expires":"2027-10-14"},"slots":{"session_start":{"native":"post_setup_worktree","block_exit":null,"answered_at":"2026-09-29"},"user_prompt_submit":{"native":"pre_user_prompt","block_exit":null,"answered_at":"2026-09-29"},"stop":{"native":"post_cascade_response","block_exit":null,"answered_at":"2026-09-29"}}}}},"gemini":{"surfaces":{"any":{"entry_shape":"gemini-settings-hooks","json_shape":"none","fail_policy":"propagate","timeout_unit":"unknown","timeout_default":null,"verified":{"docs_at":"2026-09-29","docs_url":"https://geminicli.com/docs/hooks/reference.md","docs_digest":"06d37f2f66812ee78bb46c37a112203376f0bae4d3b8b44ac79d0bda4b86a118","probe_at":null,"host_version":null,"expires":"2027-09-29"},"slots":{"session_start":{"native":"SessionStart","block_exit":null,"answered_at":"2026-09-29","matcher":""},"session_end":{"native":"SessionEnd","block_exit":null,"answered_at":"2026-09-29","matcher":""},"stop":{"native":"AfterAgent","block_exit":null,"answered_at":"2026-09-29","matcher":""},"user_prompt_submit":{"native":"BeforeAgent","block_exit":null,"answered_at":"2026-09-29","matcher":""},"post_tool_use":{"native":"AfterTool","block_exit":null,"answered_at":"2026-09-29","matcher":".*"}}}}},"cowork":{"surfaces":{"any":{"entry_shape":"none","json_shape":"none","fail_policy":"discard","timeout_unit":"unknown","timeout_default":null,"verified":{"docs_at":"2026-09-29","docs_url":null,"docs_digest":null,"probe_at":null,"host_version":null,"expires":"2027-09-29"},"slots":{}}}},"copilot":{"surfaces":{"any":{"entry_shape":"none","json_shape":"none","fail_policy":"discard","timeout_unit":"unknown","timeout_default":null,"verified":{"docs_at":"2026-09-29","docs_url":"https://docs.github.com/en/copilot/concepts/agents/hooks.md","docs_digest":"bfd40aa93ad62133efc17a50f189034f01594dc89a5d31a13a0c541d691acede","probe_at":null,"host_version":null,"expires":"2027-09-29"},"slots":{}}}},"codex":{"surfaces":{"any":{"entry_shape":"none","json_shape":"none","fail_policy":"discard","timeout_unit":"unknown","timeout_default":null,"verified":{"docs_at":"2026-10-14","docs_url":"https://developers.openai.com/codex/hooks.md","docs_digest":"57166ef03e7059732dd90925d5c42dd4d187eb2625d66cc154d0fbd2edb65f92","probe_at":"2026-10-01","host_version":"0.148.0","expires":"2027-10-14"},"slots":{}}}}}}}

package/src/scripts/hooks/host_lowering.yaml

@@ -50,8 +50,8 @@
 #                    never silently updated. On drift the watcher leaves it
 #                    alone and moves `expires` instead, so the field keeps
 #                    naming the body someone actually read. It is NOT paired
-#                    with `docs_at`, and the committed rows prove why: all nine
-#                    carry `docs_at: 2026-09-29` while the eight digests were
+#                    with `docs_at`, and the first fill proved why: all nine
+#                    carried `docs_at: 2026-09-29` while the eight digests were
 #                    taken 2026-10-01. The two answer different questions —
 #                    `docs_at` when a human read the page for the row's ANSWERS,
 #                    `docs_digest` which body the watcher is comparing against.
@@ -88,15 +88,16 @@ hosts:
         # read was never dated, and the absence was the record. Both are filled
         # now from sources this tree already carries — the 2026-09-06 live probe
         # recorded in `host_semantics.ts` (Claude Code 2.1.263) and a fresh
-        # documentation read on 2026-09-29. `expires` is deliberately unchanged.
+        # documentation read on 2026-09-29, repeated 2026-10-14 and 2026-10-19.
+        # `expires` is deliberately unchanged.
         #
         # The committed `docs_url` was `https://docs.claude.com/en/docs/claude-code/hooks`,
         # which answers 301 and lands on the URL below. Recording the redirect
         # target is what makes a digest reproducible.
         verified:
-          docs_at: 2026-09-29
+          docs_at: 2026-10-19
           docs_url: https://code.claude.com/docs/en/hooks.md
-          docs_digest: 9dd68316c1111c118e3ddb82861ac6271a8cd164cee0d371b26165efff35fe88
+          docs_digest: dd0f114dac70bc7836abd37797fb486d3007d889eeb6bbc88c307ed2587a44ef
           probe_at: 2026-09-06
           host_version: 2.1.263
           expires: 2027-09-06
@@ -121,15 +122,15 @@ hosts:
         fail_policy: discard
         timeout_unit: unknown
         timeout_default: null
-        # Established by a documentation read on 2026-09-29, not by a live
-        # probe — `probe_at` stays null and says so.
+        # Established by a documentation read on 2026-09-29, repeated 2026-10-14, not
+        # by a live probe — `probe_at` stays null and says so.
         verified:
-          docs_at: 2026-09-29
+          docs_at: 2026-10-14
           docs_url: https://docs.augmentcode.com/cli/hooks.md
-          docs_digest: e500823be8303717020c1823f670e06d100108f6e3ac4b8d12a46d91fd1898fa
+          docs_digest: 93f421dccdd017099d87b12ffd7fe8f272d8adf750856ddfb200d9b55c695378
           probe_at: null
           host_version: null
-          expires: 2027-09-29
+          expires: 2027-10-14
         # THE FINDING THIS ROW CARRIES. Augment's own documentation states that
         # `PreToolUse` can block tool execution and shows `exit 2` doing it. The
         # `block_exit: null` below is therefore NOT a claim that the host cannot
@@ -187,12 +188,12 @@ hosts:
         # piece of work, and inventing a citation for them here would be the
         # defect this file was built to remove.
         verified:
-          docs_at: 2026-09-29
+          docs_at: 2026-10-14
           docs_url: https://docs.cline.bot/customization/hooks.md
-          docs_digest: ef87561721f4cb80fe6d682b6866d638a4952dd416d36cd5ab398426ce64084b
+          docs_digest: 73b6df1bf5e51589313ea3fcfdd50c0d505530234418adcdc9fe198af61837c2
           probe_at: null
           host_version: null
-          expires: 2027-09-29
+          expires: 2027-10-14
         slots:
           session_start:      { native: [TaskStart, TaskResume], block_exit: null, answered_at: 2026-09-29 }
           session_end:        { native: TaskComplete,            block_exit: null, answered_at: 2026-09-29 }
@@ -212,12 +213,12 @@ hosts:
         # redirects to `docs.devin.ai`; the redirect target is recorded so the
         # digest is reproducible.
         verified:
-          docs_at: 2026-09-29
+          docs_at: 2026-10-14
           docs_url: https://docs.devin.ai/desktop/cascade/hooks.md
-          docs_digest: 460ffe7aa91998804920f6722c0153b9948eadd5edafa19582298475a19835a2
+          docs_digest: b9e0cd4772de9e7c4086ecf31bfcb456dc74c3b36516f52c2ff8ec1dd5c1170d
           probe_at: null
           host_version: null
-          expires: 2027-09-29
+          expires: 2027-10-14
         slots:
           session_start:      { native: post_setup_worktree,   block_exit: null, answered_at: 2026-09-29 }
           user_prompt_submit: { native: pre_user_prompt,       block_exit: null, answered_at: 2026-09-29 }
@@ -380,8 +381,8 @@ hosts:
         # refusal path on this host, which is exactly what a null means here. It
         # does NOT establish that Codex cannot refuse — this file's header
         # forbids that reading, and two unexcluded explanations remain. The
-        # installed build is 0.148.0 against a current 0.159.3, and the page
-        # that was read describes the current one; and the probe never
+        # installed build was 0.148.0 against a then-current 0.159.3, and the
+        # page read on 2026-09-29 described the current one; and the probe never
         # distinguished "the hook fired and was ignored" from "the matcher never
         # matched", because the instrumented re-run (a hook that records its own
         # input before refusing) was refused by the harness this probe ran
@@ -392,10 +393,10 @@ hosts:
         # armed a refusal this tree cannot demonstrate. The row records the
         # negative instead.
         verified:
-          docs_at: 2026-09-29
+          docs_at: 2026-10-14
           docs_url: https://developers.openai.com/codex/hooks.md
-          docs_digest: 724881d81f1a9fdb35ea42d4851a11b1f6606bbc6e9d2d05c1e8c466fc25c630
+          docs_digest: 57166ef03e7059732dd90925d5c42dd4d187eb2625d66cc154d0fbd2edb65f92
           probe_at: 2026-10-01
           host_version: 0.148.0
-          expires: 2027-09-29
+          expires: 2027-10-14
         slots: {}

package/src/scripts/hooks/host_rate_marker_hook.ts

@@ -0,0 +1,73 @@
+#!/usr/bin/env tsx
+/**
+ * host-rate-marker — the host's own `StopFailure` with error class
+ * `rate_limit` writes the `quota_parked` marker, tagged host-sourced.
+ *
+ * Bound on `agent_error`, onto which Claude's `StopFailure` is lowered. Any
+ * other failure class is not a rate signal and writes nothing. It records and
+ * never acts: nothing here sleeps, retries or relaunches, and the exit is 0 on
+ * every path.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import { writeQuotaParked } from '../_lib/quota_parked.js';
+import { resolveConsumerRoot } from './subagent_ledger_hook.js';
+import { readHookStdin } from './hook_stdin.js';
+import { EXIT_ALLOW } from './exit_codes.js';
+
+type JsonObject = { [k: string]: unknown };
+const isObject = (v: unknown): v is JsonObject => typeof v === 'object' && v !== null && !Array.isArray(v);
+
+/** The host vendor whose plan window a host-sourced marker describes. */
+const HOST_PROVIDER = 'anthropic';
+
+function processEnvelope(envelope: unknown, root: string): number {
+    try {
+        if (!isObject(envelope)) return EXIT_ALLOW;
+        const payload = isObject(envelope['payload']) ? envelope['payload'] : envelope;
+        if (payload['hook_event_name'] !== 'StopFailure' || payload['error'] !== 'rate_limit') return EXIT_ALLOW;
+        const session = payload['session_id'];
+        if (typeof session !== 'string' || session === '') return EXIT_ALLOW;
+        writeQuotaParked(root, session, [HOST_PROVIDER], () => new Date(), 'host');
+    } catch {
+        // A marker that cannot be written is a missed record, never a blocked stop.
+    }
+    return EXIT_ALLOW;
+}
+
+/** String-in entry for tests and the dispatcher. */
+export function run(stdinText: string, root: string): number {
+    let envelope: unknown;
+    try {
+        envelope = stdinText.trim() ? JSON.parse(stdinText) : {};
+    } catch {
+        return EXIT_ALLOW;
+    }
+    return processEnvelope(envelope, root);
+}
+
+export function main(): number {
+    const raw = readHookStdin();
+    let envelope: unknown = {};
+    try {
+        envelope = raw.trim() ? JSON.parse(raw) : {};
+    } catch {
+        return EXIT_ALLOW;
+    }
+    return processEnvelope(envelope, resolveConsumerRoot(envelope as never));
+}
+
+declare const __AGENT_CONFIG_BUNDLE__: boolean | undefined;
+function _isCliEntry(): boolean {
+    if (typeof __AGENT_CONFIG_BUNDLE__ !== 'undefined' && __AGENT_CONFIG_BUNDLE__) return false;
+    if (process.argv[1] === undefined) return false;
+    if (import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) return true;
+    try {
+        return fs.realpathSync(fileURLToPath(import.meta.url)) === fs.realpathSync(path.resolve(process.argv[1]));
+    } catch {
+        return false;
+    }
+}
+if (_isCliEntry()) process.exit(main());

package/src/scripts/hooks/instructions_observer_hook.ts

@@ -0,0 +1,170 @@
+#!/usr/bin/env tsx
+/**
+ * `InstructionsLoaded` observer — capture only.
+ *
+ * Appends one classified line per host load event to
+ * `<machine root>/runtime/arrivals/<session>.jsonl`, the input of that
+ * session's arrival record. It emits nothing to the model and returns 0 on
+ * every path: an instrument that can fail a turn is a mechanism, and this is not
+ * one. Lines carry a file basename, two enums and the host version — never a
+ * path or a file's contents — and never leave the machine. The directory is
+ * this observer's alone; nothing else in the package writes there.
+ *
+ * ONE FILE PER SESSION, BECAUSE THE HOST RUNS THIS EVENT ASYNCHRONOUSLY. A
+ * session start fires one event per loaded file and the hooks run in parallel,
+ * so append order is scheduler order and the reader treats each session as a
+ * set. Retention is the newest {@link KEEP_SESSIONS} session files, each capped
+ * at {@link MAX_SESSION_BYTES}; old files are deleted whole, never rotated.
+ * A line without a session id could never form a record, so it is not written.
+ *
+ * ONE DESCRIPTOR, NO PATH CHECK. The file is opened once with `O_NOFOLLOW` and
+ * `O_NONBLOCK`; the descriptor must be a regular file readable by its owner
+ * alone, and the line is written through it whole or the write is a failure —
+ * so no symlink swapped in between a check and a write can redirect the line,
+ * no FIFO planted at the path can stall the open, and no torn line passes
+ * silently.
+ *
+ * THE BOUNDS, STATED AS WHAT THEY ARE. Every write prunes after it appends, so
+ * the file count can exceed fifty by the writers between their append and their
+ * own prune, and by any writer killed in that gap — until the next write, which
+ * prunes again. The byte cap is checked on the descriptor before the write, so a
+ * file can exceed it by one line (under 2 KiB, every field being a token of at
+ * most 128 characters) per writer racing past the check at once. Neither bound
+ * is a lock, and no lock is taken: a hook that can wait on another hook is a
+ * hook that can stall a session.
+ *
+ * WHAT A RACE CAN AND CANNOT DO. Two processes pruning at once both succeed. A
+ * prune can delete the file of an idle session older than fifty newer ones; if
+ * that session loads a file later, it starts a new file without its start-up
+ * loads, which the record reads as `unknown` — evidence is lost in the
+ * direction that keeps the machine full, never invented.
+ *
+ * A FAILURE LEAVES A DATED MARK, WHERE IT CAN. A write stopped by permissions,
+ * a full disk, a refused symlink or file, or a short write records its date and
+ * error code in `arrivals.last-error` beside the directory. It is the LAST
+ * failure, not a current state: a date older than the newest session file means
+ * the observer has written since. A failure that also prevents writing the mark
+ * — the machine root itself unwritable — leaves none.
+ *
+ * NOT YET BOUND. No manifest row runs this concern, and it is not in the
+ * dispatcher's concern registry, so it adds nothing to the hook bundle until
+ * its binding lands; the binding needs bundle headroom it does not have today.
+ *
+ * KILL SWITCH. `AGENT_CONFIG_INSTRUCTIONS_OBSERVER=off` makes it a no-op without
+ * a reinstall; once the binding above lands, removing that one
+ * `instructions_loaded` row from `hook_manifest.yaml` and reinstalling removes
+ * it entirely. Either is the
+ * response to hook failures, duplicate events, a session-start regression or an
+ * unexplained test break.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+import { event4u_root } from '../_lib/user_global_paths.js';
+import { captureInstructionsLoaded, isSessionFile } from '../_lib/instructions_loaded_event.js';
+import { is_replay_mode } from './state_io.js';
+import { readHookStdin } from './hook_stdin.js';
+import { EXIT_ALLOW } from './exit_codes.js';
+
+export const KILL_SWITCH_ENV = 'AGENT_CONFIG_INSTRUCTIONS_OBSERVER';
+export const KEEP_SESSIONS = 50;
+/** A session file stops growing here (see the header for the overshoot under racing writers). */
+export const MAX_SESSION_BYTES = 256 * 1024;
+
+const C = fs.constants;
+/** `O_NOFOLLOW` is POSIX; where the platform has none the flag is simply absent. */
+const NOFOLLOW = C.O_NOFOLLOW ?? 0;
+/** `O_NONBLOCK` so a FIFO planted at the path cannot stall the open waiting for a reader. */
+const APPEND_NOFOLLOW = C.O_WRONLY | C.O_APPEND | C.O_CREAT | C.O_NONBLOCK | NOFOLLOW;
+const TRUNC_NOFOLLOW = C.O_WRONLY | C.O_TRUNC | C.O_CREAT | C.O_NONBLOCK | NOFOLLOW;
+
+/**
+ * Write `text` through one descriptor opened with `flags`: the descriptor must
+ * be a regular file nobody but its owner can read, under `cap` bytes, and the
+ * write must be whole. Each refusal throws its own code. The size and mode are
+ * checked on the descriptor, never on the path, so nothing swapped in between
+ * a check and the write can redirect it.
+ */
+function writePrivate(file: string, text: string, flags: number, cap = Infinity): void {
+    const fd = fs.openSync(file, flags, 0o600);
+    try {
+        const st = fs.fstatSync(fd);
+        if (!st.isFile() || (st.mode & 0o077) !== 0) throw new Error('EREFUSED');
+        // Every captured field is an ASCII id or boolean, so a line's length is its byte count.
+        if (st.size < cap && fs.writeSync(fd, text) !== text.length) throw new Error('ESHORT');
+    } finally {
+        fs.closeSync(fd);
+    }
+}
+
+/**
+ * The arrivals directory, created `0700` and then verified: a real directory,
+ * not a symlink, with no group or other bits, owned by this user where the
+ * platform reports owners. Anything else throws `EREFUSED_DIR` before a file in
+ * it is opened.
+ */
+function privateDir(dir: string): void {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const st = fs.lstatSync(dir);
+    const uid = process.getuid?.();
+    if (!st.isDirectory() || (st.mode & 0o077) !== 0 || (uid !== undefined && st.uid !== uid)) throw new Error('EREFUSED_DIR');
+}
+
+export function arrivalsDir(env: NodeJS.ProcessEnv = process.env): string {
+    return path.join(event4u_root(env), 'runtime', 'arrivals');
+}
+
+/** Delete all but the newest {@link KEEP_SESSIONS} regular session files; ties broken by name. */
+function prune(dir: string): void {
+    const files: { f: string; t: number }[] = [];
+    for (const f of fs.readdirSync(dir)) {
+        if (!isSessionFile(f)) continue;
+        try {
+            const st = fs.lstatSync(path.join(dir, f));
+            if (st.isFile()) files.push({ f, t: st.mtimeMs });
+        } catch {
+            // Removed by a parallel prune since the listing.
+        }
+    }
+    files.sort((a, b) => b.t - a.t || (a.f < b.f ? -1 : 1));
+    for (const { f } of files.slice(KEEP_SESSIONS)) fs.rmSync(path.join(dir, f), { force: true });
+}
+
+export function processEnvelope(raw: string, env: NodeJS.ProcessEnv = process.env): number {
+    let dir = '';
+    try {
+        if (env[KILL_SWITCH_ENV] === 'off' || is_replay_mode()) return EXIT_ALLOW;
+        dir = arrivalsDir(env);
+        let parsed: unknown = null;
+        try {
+            parsed = JSON.parse(raw);
+        } catch {
+            // An unreadable envelope carries no session to file a line under.
+        }
+        const envelope = (parsed ?? {}) as Record<string, unknown>;
+        const inner = envelope['payload'];
+        // Without HOME no load reads as user-layer, which can only keep the machine full.
+        const cap = captureInstructionsLoaded(typeof inner === 'object' && inner !== null ? inner : envelope, new Date().toISOString(), env['HOME'] ?? '', env);
+        // A line with no session id can never form a record, so it is not written.
+        if (cap.session === null) return EXIT_ALLOW;
+        privateDir(dir);
+        writePrivate(path.join(dir, `${cap.session}.jsonl`), `${JSON.stringify(cap)}\n`, APPEND_NOFOLLOW, MAX_SESSION_BYTES);
+        prune(dir);
+    } catch (e) {
+        try {
+            const code = String((e as NodeJS.ErrnoException).code ?? (e as Error).message);
+            if (dir) writePrivate(`${dir}.last-error`, `${new Date().toISOString()} ${code}\n`, TRUNC_NOFOLLOW);
+        } catch {
+            // Nowhere to record it either; the session is still never failed.
+        }
+    }
+    return EXIT_ALLOW;
+}
+
+export function main(): number {
+    try {
+        return processEnvelope(readHookStdin());
+    } catch {
+        return EXIT_ALLOW;
+    }
+}

package/src/scripts/hooks/interruption_ledger_hook.ts

@@ -56,7 +56,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
-import { derive_session_tag } from '../chat_history.js';
+import { derive_session_tag } from '../_lib/session_tag.js';
 import { unwrap, type JsonObject, type JsonValue } from './envelope.js';
 import { readHookStdin } from './hook_stdin.js';
 import { HANDBACK, finalParagraph, readTranscriptTail } from './turn_end_gate_hook.js';

package/src/scripts/hooks/lazy_concern.ts

@@ -0,0 +1,148 @@
+/**
+ * Concerns the dispatch bundle does NOT inline, and how to load one.
+ *
+ * WHY. Every concern in `concern_registry.ts` is statically imported, so
+ * esbuild folds its whole transitive closure into `dist/hooks/dispatch.js` —
+ * the one bundle every hook event loads. Measured 2026-10-20 from the bundle's
+ * own metafile: `src/scripts/chat_history.ts` and the modules reachable only
+ * through it were 121,219 bytes of a 1,549,961-byte bundle.
+ *
+ * Every byte figure in this header is a point-in-time reading with no
+ * committed artifact behind it. Treat it as unreproduced: before citing one,
+ * re-measure from a `build:hooks` run with `--metafile`, since the bundle
+ * moves with every merge.
+ *
+ * This paragraph used to end "and `chat-history` is bound on `session_start`
+ * alone", and an independent review caught that it is false. The manifest
+ * binds it on FIVE events — `session_start`, `session_end`, `stop`,
+ * `post_tool_use` and `user_prompt_submit` — which makes it close to the
+ * widest-bound concern in the tree, not a narrow one. The claim was read off
+ * the `session_start:` rows without checking the others, and it reached the
+ * budget file, a roadmap, a commit message and a council prompt before anyone
+ * tested it.
+ *
+ * What survives the correction is the SIZE argument, which never depended on
+ * the binding: 121 KB that every event pays is 121 KB whether the concern runs
+ * on one event or five, because the cost is the inlining, not the invocation.
+ * What does NOT survive is "this is the cheapest possible candidate" — the
+ * genuinely narrow ones are `turn-end-gate` (71,928 B, `stop` alone),
+ * `injection-scan` (46,660 B, `post_tool_use` alone), `skill-route`
+ * (31,183 B), `git-authorization` (30,761 B), `session-eol` (27,708 B) and
+ * `handoff-context` (25,220 B). The latency effect of moving THIS one is
+ * unmeasured, and the 2026-10-18 council asked for exactly that measurement.
+ *
+ * An AI council of two providers chose this mechanism on 2026-10-18 for the
+ * egress engine — move the module out into a conditional chunk rather than
+ * raise the byte ceiling, and give the chunk a measured budget of its own
+ * (roadmap decision D9, `src/config/hook-bundle-budget.json`). This applies the
+ * same mechanism to a CONCERN, which `hooks/egress_engine_loader.ts` does not
+ * cover: a concern is reached through the registry and has a spawn fallback
+ * behind it, so the failure shape is different and gets its own loader.
+ *
+ * WHAT HAPPENS WHEN THE CHUNK IS NOT THERE. Nothing silently stops working.
+ * `_run_concern` tries the static registry, then this, then the historical
+ * spawn-per-concern path — which is slower and still correct. A missing or
+ * mis-digested chunk therefore costs latency, never the concern's effect. That
+ * is the whole reason a concern may be moved out at all and an egress engine
+ * may not: there is a correct path behind the fast one.
+ *
+ * WHY `require` AND A COMPUTED SPECIFIER — as in `svg_rules_loader.ts`: a
+ * concern runs synchronously, and a literal specifier would be inlined by
+ * esbuild, which is the cost this exists to avoid.
+ */
+import * as fs from 'node:fs';
+import { createRequire } from 'node:module';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { verifyBundle } from './bundle_integrity.js';
+import type { ConcernMain } from './concern_registry_types.js';
+
+/**
+ * Manifest `script:` path → the chunk basename beside `dist/hooks/dispatch.js`,
+ * and the source module to fall back to when running from the tree.
+ */
+export const LAZY_CONCERNS: Readonly<Record<string, { readonly chunk: string; readonly source: string }>> =
+    Object.freeze({
+        'src/scripts/chat_history.ts': Object.freeze({
+            chunk: 'chat_history.chunk.cjs',
+            source: path.join('..', 'chat_history'),
+        }),
+    });
+
+declare const __AGENT_CONFIG_BUNDLE__: boolean | undefined;
+
+function isBundled(): boolean {
+    return typeof __AGENT_CONFIG_BUNDLE__ !== 'undefined' && __AGENT_CONFIG_BUNDLE__;
+}
+
+/** Where a lazy concern loads from: the sibling chunk when bundled, the source module otherwise. */
+export function lazyConcernSpecifier(script: string, selfUrl: string, bundled: boolean): string | null {
+    const entry = LAZY_CONCERNS[script];
+    if (entry === undefined) return null;
+    const selfPath = fileURLToPath(selfUrl);
+    const dir = path.dirname(selfPath);
+    if (bundled) return path.join(dir, entry.chunk);
+    const ext = selfPath.endsWith('.ts') ? '.ts' : '.js';
+    return path.join(dir, `${entry.source}${ext}`);
+}
+
+/**
+ * From the source tree the concern is TypeScript whose imports name `.js`
+ * siblings, which a plain `require` cannot resolve outside a `tsx` process.
+ * `tsx`'s own require resolves them; the specifier is computed so esbuild never
+ * pulls `tsx` into the bundle, where this branch is not taken.
+ */
+function sourceRequire(req: NodeJS.Require): (id: string, from: string) => unknown {
+    try {
+        const api = req(['tsx', 'cjs', 'api'].join('/')) as { require?: (id: string, from: string) => unknown };
+        if (typeof api.require === 'function') return api.require;
+    } catch {
+        // tsx absent: a plain require is the only reader left.
+    }
+    return (id: string) => req(id);
+}
+
+/**
+ * The concern's `main`, or `null` when the chunk is absent, mis-digested or
+ * does not export one. Every failure is a value: the caller falls back to the
+ * spawn path, which is what makes a missing chunk a latency cost rather than a
+ * lost effect.
+ */
+export function loadLazyConcernUncached(
+    script: string,
+    selfUrl: string = import.meta.url,
+    bundled: boolean = isBundled(),
+): ConcernMain | null {
+    try {
+        const specifier = lazyConcernSpecifier(script, selfUrl, bundled);
+        if (specifier === null || !fs.existsSync(specifier)) return null;
+        // No sidecar, a malformed one or a mismatch: the chunk is not the one built.
+        if (bundled && verifyBundle(specifier).state !== 'ok') return null;
+        const req = createRequire(selfUrl);
+        const mod = (bundled ? req(specifier) : sourceRequire(req)(specifier, fileURLToPath(selfUrl))) as Record<
+            string,
+            unknown
+        >;
+        const main = mod['main'];
+        return typeof main === 'function' ? (main as ConcernMain) : null;
+    } catch {
+        return null;
+    }
+}
+
+const cache = new Map<string, ConcernMain | null>();
+
+/** The concern's `main` or `null`; cached per process, failures included. */
+export function loadLazyConcern(script: string, selfUrl: string = import.meta.url): ConcernMain | null {
+    const key = `${selfUrl}\u0000${script}`;
+    if (cache.has(key)) return cache.get(key) ?? null;
+    const loaded = loadLazyConcernUncached(script, selfUrl);
+    cache.set(key, loaded);
+    return loaded;
+}
+
+/** Test seam: forget every cached load. Never called by the hook path. */
+export function _resetLazyConcernCache(): void {
+    cache.clear();
+}