@event4u/agent-config 9.25.0 → 9.26.0

package/src/scripts/check_gate_coverage.ts

@@ -363,6 +363,7 @@ export function main(argv: readonly string[]): number {
     );
   }
   const hardening = report_hardening_ratchet();
+  const selfTest = report_self_test_ratchet();
   if (failed.length > 0) {
     process.stdout.write(`❌  ${String(failed.length)} gate(s) failed the coverage floor.\n`);
     return 1;
@@ -370,6 +371,9 @@ export function main(argv: readonly string[]): number {
   if (hardening !== 0) {
     return hardening;
   }
+  if (selfTest !== 0) {
+    return selfTest;
+  }
   process.stdout.write('✅  every enforced gate cleared its coverage floor.\n');
   return 0;
 }
@@ -400,6 +404,69 @@ export function report_hardening_ratchet(): number {
   return verdict.ok ? 0 : 1;
 }
 
+/**
+ * Registered gates that carry no `--self-test` and no exemption — the count
+ * that must not RISE.
+ *
+ * `_lib/gate_self_test.ts` proves a gate DISCRIMINATES: it drives the real
+ * binary through cases that must reject and cases that must accept, with a
+ * `minRejectCases` floor so an all-accepting suite cannot satisfy it. A gate
+ * that emits an enforced `scanned:` count has proven it read something; only a
+ * self-test proves the reading changes the verdict.
+ *
+ * ## Why this is a NON-ADOPTER count and not an adoption column
+ *
+ * The roadmap item asked for adoption as a column in `gate-coverage.yml`,
+ * ratcheted upward. That is the exact shape `report_hardening_ratchet` above
+ * rejects in this same file — a coverage-percentage ratchet "tracks how far the
+ * fix has spread and can never regress, so it grades the solution instead of
+ * the problem". Inverting it fixes that: the number below can regress (a new
+ * registered gate written without a self-test raises it), and the target is 0.
+ * That is also the shape the sibling adoption ratchet already uses —
+ * `check_gate_completeness`'s ledger baseline is a shrink-only count of
+ * non-adopters, not a rising percentage.
+ *
+ * Population is the MANIFEST, not every script under `src/scripts`: a self-test
+ * is a claim about a gate CI runs against a floor. Padding the manifest to move
+ * this number would add a floor per row, which is the opposite of gaming.
+ *
+ * Exemption marker: `// self-test-exempt: <reason>` with a non-empty reason. A
+ * bare marker does not count — same discipline as `// no-index:` and
+ * `// ledger-exempt:`.
+ */
+export function list_self_test_non_adopters(
+  dir = path.join(REPO_ROOT, 'src/scripts'),
+  ids: ReadonlySet<string> = enforced_manifest_ids(),
+): string[] {
+  const out: string[] = [];
+  for (const id of [...ids].sort()) {
+    let src: string;
+    try {
+      src = fs.readFileSync(path.join(dir, `${id}.ts`), 'utf8');
+    } catch {
+      // A registered id with no readable script cannot prove discrimination.
+      out.push(id);
+      continue;
+    }
+    const adopts = /_lib\/gate_self_test\.js/.test(src);
+    const exempt = /\/\/\s*self-test-exempt:\s*\S/.test(src);
+    if (!adopts && !exempt) out.push(id);
+  }
+  return out;
+}
+
+/** Ratchet wrapper for {@link list_self_test_non_adopters}. */
+export function report_self_test_ratchet(): number {
+  const missing = list_self_test_non_adopters();
+  const verdict = checkRatchet({
+    gate: 'gate-self-test:registered-non-adopters',
+    actual: missing.length,
+    repoRoot: REPO_ROOT,
+  });
+  process.stdout.write(`  ${verdict.ok ? '✅' : '❌'} ${verdict.message}\n`);
+  return verdict.ok ? 0 : 1;
+}
+
 /**
  * Manifest ids whose `scanned:` line is actually ENFORCED against a floor.
  *

package/src/scripts/check_hook_bundle_freshness.ts

@@ -0,0 +1,183 @@
+#!/usr/bin/env tsx
+/**
+ * Fail when the self-hosted hook bundle is older than the hook sources it
+ * bundles — i.e. when this repo's own agent is running a hook fix that has
+ * not been built.
+ *
+ * WHY THIS EXISTS — measured, not hypothetical.
+ *
+ * The Claude hook command resolves its dispatcher in two steps: the installed
+ * package copy (`node_modules/@event4u/agent-config/dist/hooks/dispatch.js`)
+ * if present, else this repo's OWN `dist/hooks/dispatch.js`. In the
+ * agent-config repo the second branch always wins — that is the dogfooding
+ * path, and it is the only place these hooks are exercised before release.
+ *
+ * `dist/hooks/dispatch.js` is UNTRACKED (a build artifact) and is produced
+ * only by `npm run build:hooks`, which no Taskfile target, no `task ci`
+ * target, and no workflow invokes. `prepack` runs the full build, so a
+ * PUBLISHED package is always fresh and consumers are unaffected. The gap is
+ * local and it is exactly where the testing happens.
+ *
+ * Consequence, observed on 2026-08-06: the conformance round-2 PR (#1195)
+ * merged four hook fixes — among them the language-mirror pin — while the
+ * running bundle was from 07:27 that morning, before any of them existed.
+ * Ten hook sources were newer than the bundle. In the very session that
+ * shipped the language fix, the scanner counted four German-prompt /
+ * English-reply violations: the fix was merged, correct, and not loaded.
+ *
+ * A hook fix that cannot reach the agent that wrote it is indistinguishable
+ * from no fix, and nothing said so. This gate says so.
+ *
+ * WHAT IT DOES NOT DO: it never builds. Building into a live hook path is a
+ * documented hazard in this repo (an esbuild run that overwrites the
+ * dispatcher a running hook is executing can wedge the tool loop), so the
+ * remedy is printed for a human to run deliberately.
+ *
+ * Exit codes: 0 = fresh, or no self-hosted bundle to check · 1 = stale.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { parse as parseYaml } from "yaml";
+
+import { reportScanned } from "./_lib/scan_scope.js";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(HERE, "..", "..");
+const BUNDLE = path.join("dist", "hooks", "dispatch.js");
+const MANIFEST = path.join("src", "scripts", "hook_manifest.yaml");
+const HOOK_DIR = path.join("src", "scripts", "hooks");
+const REMEDY = "npm run build:hooks";
+
+/** Every source whose edit changes the bundle's behaviour. */
+export function bundledSources(root: string): string[] {
+  const out = new Set<string>();
+
+  const manifestAbs = path.join(root, MANIFEST);
+  if (fs.existsSync(manifestAbs)) {
+    out.add(MANIFEST);
+    try {
+      const doc = parseYaml(fs.readFileSync(manifestAbs, "utf-8")) as {
+        concerns?: Record<string, { script?: string }>;
+      };
+      for (const def of Object.values(doc?.concerns ?? {})) {
+        const s = def?.script;
+        // A concern script is bundled wherever it lives, not only under hooks/.
+        if (typeof s === "string" && s.endsWith(".ts")) out.add(s);
+      }
+    } catch {
+      // A malformed manifest is another gate's problem; still check the dir.
+    }
+  }
+
+  const hookDirAbs = path.join(root, HOOK_DIR);
+  if (fs.existsSync(hookDirAbs)) {
+    for (const e of fs.readdirSync(hookDirAbs, { withFileTypes: true })) {
+      if (e.isFile() && e.name.endsWith(".ts")) out.add(path.join(HOOK_DIR, e.name));
+    }
+  }
+
+  return [...out].filter((rel) => fs.existsSync(path.join(root, rel))).sort();
+}
+
+export interface Result {
+  /** No self-hosted bundle → the installed package copy is authoritative. */
+  skipped: boolean;
+  bundleMtimeMs: number;
+  /** Sources strictly newer than the bundle, newest first. */
+  stale: { file: string; mtimeMs: number }[];
+  checked: number;
+}
+
+export function check(root: string): Result {
+  const bundleAbs = path.join(root, BUNDLE);
+  if (!fs.existsSync(bundleAbs)) {
+    return { skipped: true, bundleMtimeMs: 0, stale: [], checked: 0 };
+  }
+  const bundleMtimeMs = fs.statSync(bundleAbs).mtimeMs;
+  const sources = bundledSources(root);
+  const stale = sources
+    .map((file) => ({ file, mtimeMs: fs.statSync(path.join(root, file)).mtimeMs }))
+    .filter((s) => s.mtimeMs > bundleMtimeMs)
+    .sort((a, b) => b.mtimeMs - a.mtimeMs);
+  return { skipped: false, bundleMtimeMs, stale, checked: sources.length };
+}
+
+function stamp(ms: number): string {
+  return new Date(ms).toISOString().replace("T", " ").slice(0, 16);
+}
+
+export function main(argv: string[] = process.argv.slice(2)): number {
+  const root = REPO_ROOT;
+  const quiet = argv.includes("--quiet");
+  const r = check(root);
+
+  // Scope hardening: publish the count and refuse a silent zero. The one
+  // legitimate zero is the absent self-hosted bundle — an optional input, and
+  // the reason survives the manifest's own test ("if the scan root were
+  // deleted, would this still make sense?"): with no bundle there is no stale
+  // dispatcher to catch, which is a correct verdict rather than blindness.
+  reportScanned({
+    gate: "check_hook_bundle_freshness",
+    scanned: r.checked,
+    units: "bundled hook source(s)",
+    roots: [BUNDLE, HOOK_DIR, MANIFEST],
+    ...(r.skipped
+      ? {
+          allowEmpty:
+            "OPTIONAL_INPUT: no self-hosted dist/hooks/dispatch.js — this repo is not " +
+            "running its own bundle (fresh checkout / CI), so there is nothing to compare against.",
+        }
+      : {}),
+  });
+
+  // A gate that scans nothing must SAY it scanned nothing — a silent green
+  // here is indistinguishable from a pass.
+  if (r.skipped) {
+    if (!quiet) {
+      process.stdout.write(
+        `✅  OK  hook bundle: no self-hosted ${BUNDLE} — the installed package copy is in use, nothing to check\n`,
+      );
+    }
+    return 0;
+  }
+
+  if (r.stale.length === 0) {
+    if (!quiet) {
+      process.stdout.write(
+        `✅  OK  hook bundle: fresh (built ${stamp(r.bundleMtimeMs)}, ${String(r.checked)} bundled source(s) checked)\n`,
+      );
+    }
+    return 0;
+  }
+
+  console.error(
+    `❌  hook bundle is STALE — the running dispatcher predates ${r.stale.length} of ${r.checked} bundled source(s).`,
+  );
+  console.error(`    ${BUNDLE} built ${stamp(r.bundleMtimeMs)}; newer sources:`);
+  for (const s of r.stale.slice(0, 10)) {
+    console.error(`      ${stamp(s.mtimeMs)}  ${s.file}`);
+  }
+  if (r.stale.length > 10) console.error(`      … and ${r.stale.length - 10} more`);
+  console.error("");
+  console.error(`    Your hooks are running the OLD code. Rebuild:  ${REMEDY}`);
+  console.error(
+    "    (This gate never builds for you — writing into a live hook path can wedge the tool loop.)",
+  );
+  return 1;
+}
+
+const invokedDirectly = ((): boolean => {
+  const entry = process.argv[1];
+  if (entry === undefined) return false;
+  try {
+    return fs.realpathSync(path.resolve(entry)) === fs.realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+})();
+
+if (invokedDirectly) {
+  process.exit(main());
+}

package/src/scripts/conformance_scan.ts

@@ -139,6 +139,15 @@ export function isInjectedBody(text: string): boolean {
   return text.length > 2500 && classify(text).language === "en";
 }
 
+/**
+ * Harness-generated text that occupies an assistant turn but is not the
+ * assistant writing. Round-2 self-scan: 8 of 9 "violations" in one session were
+ * `API Error: 529 Overloaded` retry banners. Counting the harness as the model
+ * inflates the very number this scan exists to report honestly.
+ */
+const HARNESS_TEXT =
+  /^(API Error:|Request (timed out|was aborted)|\[Request interrupted|Error: |Credit balance is too low|You've hit your|Prompt is too long)/i;
+
 /** Rough English-opener test for the language check (first prose line only). */
 const EN_OPENER =
   /^(let me|i'?ll |i'?m |found it|ok[,. ]|okay|alright|here'?s|now[,. ]|looking|checking|reading|running|the |this |that |there |we |you |good |right[,. ]|perfect|done[.,]|all |confirmed|correct)/i;
@@ -152,6 +161,7 @@ export function scanSession(sessionId: string, lines: string[]): SessionReport {
   };
 
   let pinned: "de" | "en" | null = null;
+  let pendingPoll: { at: string; cmd: string } | null = null;
   let authorized = new Set<GitOp>();
   let sawPending = false;
   let evaluationsThisTurn = 0;
@@ -167,6 +177,25 @@ export function scanSession(sessionId: string, lines: string[]): SessionReport {
       continue;
     }
 
+    // Tool results arrive as `user` entries carrying `toolUseResult`.
+    if (entry["type"] === "user" && entry["toolUseResult"] !== undefined && pendingPoll !== null) {
+      const raw = entry["toolUseResult"];
+      const out = typeof raw === "string" ? raw : JSON.stringify(raw);
+      const pending = pendingCount(out);
+      if (pending !== null && pending > 0) {
+        sawPending = true;
+      } else if (isVacuousOutput(out) || (pending === 0 && !sawPending)) {
+        report.violations.push({
+          check: "vacuous-evidence",
+          session: sessionId,
+          at: pendingPoll.at,
+          detail: `CI poll read as settled without an in-flight observation: ${out.slice(0, 90)}`,
+        });
+      }
+      pendingPoll = null;
+      continue;
+    }
+
     const ut = userText(entry);
     if (ut !== null) {
       if (isInjectedBody(ut)) {
@@ -181,6 +210,7 @@ export function scanSession(sessionId: string, lines: string[]): SessionReport {
       authorized = new Set(classifyAuthorization(ut).authorized);
       sawPending = false;
       evaluationsThisTurn = 0;
+      pendingPoll = null;
       continue;
     }
 
@@ -194,6 +224,9 @@ export function scanSession(sessionId: string, lines: string[]): SessionReport {
       report.assistant_turns += 1;
       if (pinned === "de") {
         const first = prose.split("\n").find((l) => l.trim()) ?? "";
+        if (HARNESS_TEXT.test(first.trim())) {
+          continue; // harness banner, not the assistant's prose
+        }
         const c = classify(first);
         if (first.length > 12 && (c.language === "en" || EN_OPENER.test(first.trim()))) {
           report.violations.push({
@@ -220,21 +253,14 @@ export function scanSession(sessionId: string, lines: string[]): SessionReport {
           });
         }
         if (isCiPoll(cmd)) {
-          // A settle claim needs a prior in-flight observation in the same turn.
-          // The transcript carries the poll but not always its output, so this
-          // check only fires on the shape it can actually read.
-          const out = typeof entry["toolUseResult"] === "string" ? entry["toolUseResult"] : "";
-          const pending = out ? pendingCount(out) : null;
-          if (pending !== null && pending > 0) {
-            sawPending = true;
-          } else if (out && (isVacuousOutput(out) || (pending === 0 && !sawPending))) {
-            report.violations.push({
-              check: "vacuous-evidence",
-              session: sessionId,
-              at,
-              detail: `CI poll read as settled without an in-flight observation: ${out.slice(0, 90)}`,
-            });
-          }
+          // The RESULT of this call arrives on the NEXT entry, and that entry is
+          // role `user` — not assistant. The first version read
+          // `entry["toolUseResult"]` off the assistant entry, where it never
+          // exists: measured on a 20 MB transcript, 1913 entries carry the key
+          // and all 1913 are `user`. So this check could not fire at all and the
+          // scan printed a permanent `✅ vacuous-evidence 0` — a false green in
+          // the one report whose job is to say whether the gates bite.
+          pendingPoll = { at, cmd };
         }
       }
 
@@ -269,7 +295,8 @@ export function scanSession(sessionId: string, lines: string[]): SessionReport {
 
 /** Default Claude Code transcript store for a project directory. */
 export function defaultStore(projectDir: string): string {
-  const slug = projectDir.replace(/\//g, "-");
+  // Claude Code slugs BOTH separators and dots: /Users/x/.claude → -Users-x--claude.
+  const slug = projectDir.replace(/[/.]/g, "-");
   return path.join(process.env["HOME"] ?? "", ".claude", "projects", slug);
 }
 
@@ -362,7 +389,10 @@ export function main(argv?: string[]): number {
   if (out) {
     fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`, "utf8");
   }
-  process.stdout.write(json ? `${JSON.stringify(report, null, 2)}\n` : `${render(report)}\n`);
+  // fs.writeSync, not process.stdout.write: `process.exit()` below does not
+  // flush an async pipe write, so `--json | jq` reproducibly received a
+  // truncated 64 KB document with no error (measured: 85,169 vs 65,536 bytes).
+  fs.writeSync(1, json ? `${JSON.stringify(report, null, 2)}\n` : `${render(report)}\n`);
   return 0;
 }
 

package/src/scripts/dispatch_r2_reviewer.ts

@@ -548,16 +548,38 @@ function reviewerPrompt(args: {
     ].join('\n');
 }
 
+/**
+ * The findings skeleton, carrying `prompt_hash`.
+ *
+ * The contract's most dangerous residual is the PROMPT channel (§ 5): the
+ * dispatcher fixes the reviewer's inputs but not the instructions wrapped around
+ * them, so "a hash-verified artefact is not evidence of an unbiased review" — its
+ * recorded case zero is an honest-null whose prompt stated prior rounds were
+ * clean, where a later unsteered round on the identical scope found seven
+ * defects.
+ *
+ * Writing the hash of the prompt THIS dispatcher built makes the channel
+ * attributable: the artefact now records which prompt produced it, so a review
+ * run against a different prompt is distinguishable from one run against the
+ * dispatcher's. `--verify` re-derives it from the same inputs and compares.
+ *
+ * It does not CLOSE the residual and is not sold as doing so: the same host that
+ * authors a steered prompt could hash the steered text. The gain is an
+ * attributable record where there was none, which is what turns the audit trail
+ * (§ 2.7, round records are never edited in place) into something a contradicting
+ * later round can be checked against.
+ */
 function findingsSkeleton(args: {
     slug: string;
     headSha: string;
     scopeHash: string;
     reviewedDate: string;
     manifest: string;
+    promptHash: string;
 }): string {
     return [
         `# Findings: ${args.slug}`,
-        `<!-- completion-review: v1 | reviewed: ${args.reviewedDate} | scope: ${args.scopeHash} | diff: ${args.headSha} | reviewer: r2-fresh-subagent-${args.slug} -->`,
+        `<!-- completion-review: v1 | reviewed: ${args.reviewedDate} | scope: ${args.scopeHash} | diff: ${args.headSha} | reviewer: r2-fresh-subagent-${args.slug} | prompt_hash: ${args.promptHash} -->`,
         '',
         args.manifest,
         '',
@@ -890,7 +912,14 @@ function runDispatch(args: Args): number {
         acHash: hashes.ac_hash,
         dispatched,
     });
-    const skeleton = findingsSkeleton({ slug, headSha, scopeHash: hashes.scope_hash, reviewedDate, manifest });
+    const skeleton = findingsSkeleton({
+        slug,
+        headSha,
+        scopeHash: hashes.scope_hash,
+        reviewedDate,
+        manifest,
+        promptHash: sha256(promptText),
+    });
 
     fs.mkdirSync(inputDirAbs, { recursive: true });
     fs.writeFileSync(path.join(inputDirAbs, 'diff.patch'), scopeDiffText, 'utf-8');

package/src/scripts/git_authorization_hook.ts

@@ -83,16 +83,65 @@ export const ALL_OPS: readonly GitOp[] = [
  * cost latency on every turn and be unauditable.
  */
 const PHRASES: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
-  { op: "commit", re: /\b(commit(e|et|ten|ted|ting)?|committe|einchecken)\b/i },
-  { op: "push", re: /\b(push(e|en|ed|ing)?|hochladen|hochschieben|raufschieben)\b/i },
-  { op: "branch", re: /\b(branch(e|es)?|zweig|feature-branch|erstelle einen branch)\b/i },
-  { op: "pr-create", re: /\b(pull[- ]request|pr\b|mach(e|en)? (einen|nen) pr|erstelle .{0,20}pr)\b/i },
-  { op: "pr-merge", re: /\b(merge[nrd]?|mergen|zusammenführen|zusammenfuehren|reinmergen|gemerged)\b/i },
-  { op: "tag", re: /\b(tag(ge|gen|ged|ging)?|version(iere|ieren)?)\b/i },
-  { op: "release", re: /\b(release[nd]?|releasen|veröffentlich(e|en|ung)|veroeffentlich(e|en))\b/i },
-  { op: "publish", re: /\b(publish(e|en|ed|ing)?|npm publish|publiziere[n]?)\b/i },
+  { op: "commit", re: /\b(commit(e|et|te|ten)?|committe|einchecken)\b/i },
+  { op: "push", re: /\b(push(e|en|t)?|hochladen|hochschieben|raufschieben)\b/i },
+  { op: "branch", re: /\b(branch|feature-branch|zweig)\b/i },
+  // A creation verb is required — "schau dir den PR an" is not "open a PR".
+  {
+    op: "pr-create",
+    re: /\b(erstell(e|en)?|mach(e|en)?|leg(e|en)?\s+an|(er)?(ö|oe)ffne|open|create|raise|aufmachen)\b[^.\n]{0,30}\b(pr|pull[- ]request)\b|\b(pr|pull[- ]request)\b[^.\n]{0,20}\b(erstellen|aufmachen|anlegen|(er)?(ö|oe)ffnen)\b/i,
+  },
+  // `merge` as an ACTION, never as the noun in "merge conflict" / "merge commit".
+  { op: "pr-merge", re: /\b(merge|merg(e|en|st|t)|zusammenf(ü|ue)hren|reinmergen)\b(?!\s*[- ]?(conflict|konflikt|commit|base|queue|state|status))/i },
+  // A tag is an ACTION here — bare "Tag" is the German word for day, and
+  // "Version" is an ordinary noun. Both authorized a BLOCK op before this.
+  { op: "tag", re: /\b(tagge(n|st)?|tag\s+(setzen|anlegen|erstellen)|git\s+tag|--tags|--follow-tags)\b/i },
+  // "die release notes sind falsch" is a noun phrase, not an authorization.
+  {
+    op: "release",
+    re: /\b(releasen?|ver(ö|oe)ffentlich(e|en))\b(?!\s*[- ]?(notes?|branch|candidate|pr\b|datum|date|zweig))/i,
+  },
+  { op: "publish", re: /\b(publish(e|en)?|publiziere[n]?)\b/i },
 ];
 
+/**
+ * Lines that are pasted TOOL OUTPUT rather than the user instructing.
+ *
+ * Round-2 adversarial review: an UNFENCED paste of a `git push … rejected`
+ * trace authorized `push` through the prose matcher — i.e. the gate
+ * pre-authorized the exact scenario it was built to stop. Fenced pastes were
+ * already handled; prose was not.
+ */
+const OUTPUT_LINE =
+  /^\s*(To\s+\S+|remote:|error:|fatal:|hint:|warning:|!\s|\?\?\s|\s*\^|[-+]{3}\s|@@\s|\$\s|>\s|\d+\s+(pass|fail)|npm ERR!|Error:|Traceback|at\s+\S+:\d+)/i;
+
+/**
+ * A prompt that ASKS about an operation does not authorize it.
+ *
+ * `question-not-instruction` states this for the agent; the ledger needs it
+ * too. "was macht npm publish eigentlich genau?" authorized a real publish
+ * before this check.
+ */
+export function isInterrogative(prose: string): boolean {
+  const t = prose.trim();
+  if (!t) {
+    return false;
+  }
+  const hasImperative =
+    /\b(mach|mache|bitte|leg|lege|erstell|erstelle|f(ü|ue)hr|f(ü|ue)hre|setz|setze|starte|los|jetzt|go ahead|do it|ja[,.]?\s|ok[,.]?\s)\b/i.test(
+      t,
+    );
+  if (hasImperative) {
+    return false;
+  }
+  return (
+    /\?\s*$/.test(t) ||
+    /^(was|wie|warum|wieso|weshalb|wann|wer|welche[rs]?|wo|ist|sind|kann|kannst|k(ö|oe)nnen|soll|sollen|darf|d(ü|ue)rfen|why|what|how|when|which|who|is|are|can|could|should|does|do)\b/i.test(
+      t,
+    )
+  );
+}
+
 /** Executable commands a user may paste, mapped to the op they authorize. */
 const PASTED_COMMANDS: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
   { op: "publish", re: /\bnpm\s+publish\b/i },
@@ -155,8 +204,15 @@ export function classifyAuthorization(prompt: string): {
   const authorized = new Set<GitOp>();
   const evidence: Record<string, string> = {};
 
-  for (const { op, re } of PHRASES) {
-    const m = re.exec(prose);
+  // Drop pasted tool output from the prose before matching (C4), then refuse
+  // to read a question as an instruction (C3).
+  const instruction = prose
+    .split("\n")
+    .filter((l) => !OUTPUT_LINE.test(l))
+    .join("\n");
+
+  for (const { op, re } of isInterrogative(instruction) ? [] : PHRASES) {
+    const m = re.exec(instruction);
     if (m) {
       authorized.add(op);
       evidence[op] = `prose: "${m[0]}"`;
@@ -164,6 +220,15 @@ export function classifyAuthorization(prompt: string): {
   }
 
   for (const fence of fences) {
+    // A fence that also carries tool OUTPUT is a transcript of something that
+    // already happened, not a command the user is handing over. Pasting
+    //   $ git push origin main
+    //   ! [rejected] …
+    // is showing a failure, and reading it as "authorized push" is exactly the
+    // implicit-continuation misread this gate exists to stop.
+    if (fence.split("\n").some((l) => OUTPUT_LINE.test(l))) {
+      continue;
+    }
     for (const line of _commandLines(fence)) {
       for (const { op, re } of PASTED_COMMANDS) {
         if (re.test(line)) {

package/src/scripts/hook_manifest.yaml

@@ -163,6 +163,25 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+    # Per-concern tool filter — the dispatcher skips this concern in-process on
+    # any other tool. See `_concern_matches_tool` in hooks/dispatch_hook.ts for
+    # the semantics (absent = every event, "*" = the same, non-tool events are
+    # never filtered) and for why the filter is NOT a host `matcher`.
+    #
+    # This set is not a guess: the hook's entire branch surface is
+    # `name === 'Grep' || name === 'Glob'` and `name === 'Read'`
+    # (code_graph_nudge_hook.ts), and a test pins the manifest list against it.
+    #
+    # Deliberately NOT declared on the three blocking PreToolUse guards
+    # (block-no-verify, block-kernel-rule-writes, block-config-weakening): their
+    # tool sets span host-specific naming variants (`Bash` / `BashTool` /
+    # `launch-process` / `launch_process`, `str-replace-editor` /
+    # `str_replace_editor` / `save-file` / …), so a list that misses one variant
+    # silently disables a security guard on that host. The concerns already
+    # re-read `tool_name` and return early; paying one dispatch to keep a guard
+    # correct is the right trade, and the cheap filter is reserved for advisory
+    # concerns whose set is provable from their own source.
+    tools: [Grep, Glob, Read]
   # road-to-reachable-code-memory Phase 4 — session_end learning-sidecar
   # aggregation. Joins the EXISTING session_end concern set (no new platform
   # wiring). Aggregates agents/memory/intake/*.jsonl through the learning

package/src/scripts/hooks/block_no_verify.ts

@@ -339,7 +339,9 @@ function _check_command(cmd: string): [boolean, string] {
             if (/\bgit\b/.test(cmd)) {
                 return [
                     true,
-                    'command parse failed (shlex) on a git-containing command — fail-closed (git-history-discipline)',
+                    'command parse failed (shlex) on a git-containing command — fail-closed (git-history-discipline). \n'
+                    + 'Most common cause: an apostrophe or backtick inside a heredoc commit message in the SAME compound command as `git`. \n'
+                    + 'Fix: write the message to a file and use `git commit -F <file>` — do not retry the heredoc.',
                 ];
             }
             return [false, ''];