@event4u/agent-config 9.27.0 → 9.29.0

package/src/scripts/forensics_report.ts

@@ -0,0 +1,333 @@
+/**
+ * Forensic analyzers — hotspot risk + change coupling from `git log` alone
+ * (road-to-judgment-and-forensic-evidence Phase 3; pack `forensics`,
+ * default-off, read-only, advisory).
+ *
+ * Two deterministic analyzers over a PINNED revision range:
+ *
+ *   hotspot(file)   = norm(change_frequency) × norm(complexity)
+ *                     complexity = LOC + total indentation units (tabs = 1,
+ *                     4 spaces = 1) of the file in the working tree — a cheap,
+ *                     language-agnostic indentation proxy, documented rather
+ *                     than clever. A hotspot is a place to LOOK, never a code
+ *                     quality verdict (both inputs can be correct for a file).
+ *
+ *   coupling(A,B)   = co_changes(A,B) / min(changes(A), changes(B))
+ *                     over commits with ≤ max_commit_files files (bulk sweeps
+ *                     poison coupling; skipped commits are counted in the
+ *                     report, never silently dropped).
+ *
+ *   boundary_contradictions — coupling pairs ABOVE the threshold whose files
+ *   live in different top-level modules. Recorded as a finding CLASS (the
+ *   intended boundaries and the actual change pattern disagree), not as a
+ *   failure — per the roadmap's step 3.6.
+ *
+ * Determinism bar (step 3.3): byte-stable output on a frozen fixture — same
+ * inputs, same bytes. Inputs are the git log for the pinned range plus file
+ * metrics; `--log-file` + `--metrics-file` inject both for fixture tests, so
+ * the analyzer's whole pipeline is exercised without a live repo. All maps
+ * are sorted before emission; scores are rounded to 4 decimals.
+ *
+ * Advisory wiring (step 3.4): `--findings-out` emits
+ * review-findings.schema.json-shaped items with kind `correctness` and
+ * severity `low|medium` — non-blocking by construction in
+ * `check_finding_dispositions.isBlocking` — for ingestion into the existing
+ * release findings ledger (`check_finding_dispositions --ingest`).
+ *
+ * Gaming risk: an empty scan (dead range, wrong cwd) yielding a green "no
+ * hotspots" report — mitigated by the shared scan-scope helper: zero scanned
+ * commits throws (DeadScopeError), it never publishes an empty finding set
+ * (step 3.2). Residual: a range that is real but trivially small still
+ * produces low-signal output; the report publishes commit + file counts so a
+ * reader can judge the denominator.
+ */
+// ledger-exempt: on-demand advisory analyzer, not a CI gate — the report JSON
+// itself carries the full denominator (scanned commits/files) per run.
+import * as fs from 'node:fs';
+import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+
+import { reportScanned } from './_lib/scan_scope.js';
+
+interface Params {
+    max_commit_files: number;
+    coupling_threshold: number;
+    min_cochanges: number;
+    top_hotspots: number;
+}
+const DEFAULTS: Params = {
+    max_commit_files: 50,
+    coupling_threshold: 0.5,
+    min_cochanges: 3,
+    top_hotspots: 25,
+};
+
+interface Commit {
+    hash: string;
+    files: string[];
+}
+
+/** Parse `git log --pretty=format:'C %H' --name-only` output. */
+export function parseLog(text: string): Commit[] {
+    const commits: Commit[] = [];
+    let current: Commit | null = null;
+    for (const raw of text.split('\n')) {
+        const line = raw.trimEnd();
+        if (line.startsWith('C ')) {
+            if (current) commits.push(current);
+            current = { hash: line.slice(2).trim(), files: [] };
+        } else if (line.length > 0 && current) {
+            current.files.push(line);
+        }
+    }
+    if (current) commits.push(current);
+    return commits;
+}
+
+function gitLog(range: string): string {
+    return execFileSync('git', ['log', '--pretty=format:C %H', '--name-only', range], {
+        encoding: 'utf8',
+        maxBuffer: 256 * 1024 * 1024,
+    });
+}
+
+/** LOC + indentation units — the documented complexity proxy. */
+export function complexityOf(content: string): number {
+    const lines = content.split('\n');
+    let indent = 0;
+    for (const l of lines) {
+        const m = /^[\t ]*/.exec(l);
+        const ws = m ? m[0] : '';
+        let units = 0;
+        let spaces = 0;
+        for (const ch of ws) {
+            if (ch === '\t') units += 1;
+            else spaces += 1;
+        }
+        units += Math.floor(spaces / 4);
+        indent += units;
+    }
+    return lines.length + indent;
+}
+
+function liveComplexity(file: string): number | null {
+    try {
+        const st = fs.statSync(file);
+        if (!st.isFile()) return null;
+        const buf = fs.readFileSync(file);
+        if (buf.includes(0)) return null; // binary
+        return complexityOf(buf.toString('utf8'));
+    } catch {
+        return null; // deleted / renamed away — frequency without complexity
+    }
+}
+
+function round4(n: number): number {
+    return Math.round(n * 10000) / 10000;
+}
+
+/** First path segment — the module boundary the router treats as independent. */
+export function moduleOf(file: string): string {
+    const parts = file.split('/');
+    if (parts.length >= 2 && (parts[0] === 'src' || parts[0] === 'tests' || parts[0] === 'docs')) {
+        return `${parts[0]}/${parts[1] ?? ''}`;
+    }
+    return parts[0] ?? file;
+}
+
+interface Hotspot {
+    file: string;
+    changes: number;
+    complexity: number | null;
+    score: number;
+}
+interface CouplingPair {
+    a: string;
+    b: string;
+    co_changes: number;
+    changes_a: number;
+    changes_b: number;
+    coupling: number;
+    cross_module: boolean;
+}
+
+export interface Report {
+    mode: string;
+    range: string;
+    params: Params;
+    scanned: { commits: number; commits_skipped_bulk: number; files: number };
+    hotspots: Hotspot[];
+    coupling: CouplingPair[];
+    boundary_contradictions: CouplingPair[];
+}
+
+export function analyze(
+    commits: Commit[],
+    params: Params,
+    complexity: (file: string) => number | null,
+    range: string,
+    mode: string,
+): Report {
+    const changes = new Map<string, number>();
+    const co = new Map<string, number>();
+    let skipped = 0;
+    for (const c of commits) {
+        const files = [...new Set(c.files)].sort();
+        if (files.length > params.max_commit_files) {
+            skipped++;
+            continue;
+        }
+        for (const f of files) changes.set(f, (changes.get(f) ?? 0) + 1);
+        for (let i = 0; i < files.length; i++) {
+            for (let j = i + 1; j < files.length; j++) {
+                const key = `${files[i]}\u0000${files[j]}`;
+                co.set(key, (co.get(key) ?? 0) + 1);
+            }
+        }
+    }
+
+    const files = [...changes.keys()].sort();
+    const complexities = new Map<string, number | null>();
+    for (const f of files) complexities.set(f, complexity(f));
+    let maxChanges = 0;
+    for (const v of changes.values()) if (v > maxChanges) maxChanges = v;
+    let maxComplexity = 0;
+    for (const v of complexities.values()) if (v !== null && v > maxComplexity) maxComplexity = v;
+
+    const hotspots: Hotspot[] = files
+        .map((f) => {
+            const ch = changes.get(f) ?? 0;
+            const cx = complexities.get(f) ?? null;
+            const score =
+                cx === null || maxChanges === 0 || maxComplexity === 0
+                    ? 0
+                    : round4((ch / maxChanges) * (cx / maxComplexity));
+            return { file: f, changes: ch, complexity: cx, score };
+        })
+        .filter((h) => h.score > 0)
+        .sort((a, b) => b.score - a.score || a.file.localeCompare(b.file))
+        .slice(0, params.top_hotspots);
+
+    const coupling: CouplingPair[] = [];
+    for (const [key, n] of [...co.entries()].sort()) {
+        if (n < params.min_cochanges) continue;
+        const [a, b] = key.split('\u0000') as [string, string];
+        const ca = changes.get(a) ?? 0;
+        const cb = changes.get(b) ?? 0;
+        const denom = Math.min(ca, cb);
+        if (denom === 0) continue;
+        const strength = round4(n / denom);
+        if (strength < params.coupling_threshold) continue;
+        coupling.push({
+            a,
+            b,
+            co_changes: n,
+            changes_a: ca,
+            changes_b: cb,
+            coupling: strength,
+            cross_module: moduleOf(a) !== moduleOf(b),
+        });
+    }
+    coupling.sort((x, y) => y.coupling - x.coupling || x.a.localeCompare(y.a) || x.b.localeCompare(y.b));
+
+    return {
+        mode,
+        range,
+        params,
+        scanned: {
+            commits: commits.length - skipped,
+            commits_skipped_bulk: skipped,
+            files: files.length,
+        },
+        hotspots,
+        coupling,
+        boundary_contradictions: coupling.filter((p) => p.cross_module),
+    };
+}
+
+/** Same id convention as self_review_gate.findingId — the schema pins ^[0-9a-f]{12}$. */
+function forensicsFindingId(kind: string, title: string, file: string): string {
+    return createHash('sha256').update(`${kind}|${title}|${file}`).digest('hex').slice(0, 12);
+}
+
+/** Findings-schema-shaped advisory items — non-blocking by construction. */
+export function toFindings(report: Report): Record<string, unknown> {
+    const findings: Record<string, unknown>[] = [];
+    for (const h of report.hotspots.slice(0, 10)) {
+        const title = `hotspot: ${h.file} (score ${String(h.score)})`;
+        findings.push({
+            finding_id: forensicsFindingId('correctness', title, h.file),
+            severity: 'low',
+            kind: 'correctness',
+            title,
+            detail: `${String(h.changes)} changes in range × complexity ${String(h.complexity ?? 'n/a')} — a place to look, not a quality verdict.`,
+            file: h.file,
+        });
+    }
+    for (const p of report.boundary_contradictions) {
+        const title = `boundary contradiction: ${p.a} <-> ${p.b} (coupling ${String(p.coupling)})`;
+        findings.push({
+            finding_id: forensicsFindingId('correctness', title, p.a),
+            severity: 'medium',
+            kind: 'correctness',
+            title,
+            detail: `Cross-module co-change ${String(p.co_changes)}/${String(Math.min(p.changes_a, p.changes_b))} above threshold ${String(report.params.coupling_threshold)} — the intended module boundary and the actual change pattern disagree. A finding class, not a failure.`,
+            file: p.a,
+        });
+    }
+    return { schema_version: 1, findings };
+}
+
+function stringifyReport(report: Report): string {
+    return JSON.stringify(report, null, 2) + '\n';
+}
+
+function argValue(argv: string[], flag: string): string | null {
+    const i = argv.indexOf(flag);
+    return i >= 0 ? (argv[i + 1] ?? null) : null;
+}
+
+function main(argv: string[]): number {
+    const range = argValue(argv, '--range');
+    const logFile = argValue(argv, '--log-file');
+    const metricsFile = argValue(argv, '--metrics-file');
+    const outFile = argValue(argv, '--out');
+    const findingsOut = argValue(argv, '--findings-out');
+    if (!range && !logFile) {
+        process.stderr.write(
+            'usage: forensics_report (--range <rev-range> | --log-file <fixture>) [--metrics-file <json>] [--out <file>] [--findings-out <file>]\n',
+        );
+        return 2;
+    }
+    const params: Params = { ...DEFAULTS };
+    const text = logFile ? fs.readFileSync(logFile, 'utf8') : gitLog(range as string);
+    const commits = parseLog(text);
+    let complexity: (file: string) => number | null = liveComplexity;
+    if (metricsFile) {
+        const metrics = JSON.parse(fs.readFileSync(metricsFile, 'utf8')) as Record<string, number>;
+        complexity = (f) => (Object.prototype.hasOwnProperty.call(metrics, f) ? metrics[f]! : null);
+    }
+    const report = analyze(commits, params, complexity, range ?? `log-file:${logFile ?? ''}`, 'run');
+
+    // Loud-fail on an empty scan BEFORE anything is written — a report over
+    // nothing is not a report, and it must not exist on disk either (throws
+    // DeadScopeError when zero commits were analyzed).
+    reportScanned({
+        gate: 'forensics_report',
+        scanned: report.scanned.commits,
+        units: 'commit(s)',
+        roots: [range ?? (logFile as string)],
+    });
+
+    const json = stringifyReport(report);
+    if (outFile) fs.writeFileSync(outFile, json);
+    process.stdout.write(json);
+    if (findingsOut) fs.writeFileSync(findingsOut, JSON.stringify(toFindings(report), null, 2) + '\n');
+    return 0;
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+    process.exit(main(process.argv.slice(2)));
+}
+
+export { main };

package/src/scripts/hook_manifest.yaml

@@ -319,6 +319,29 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+  # Council-availability fact. Carries whether a council is configured and from
+  # where, because the always-loaded layer refers to the council conditionally
+  # and never says how to check. Measured 2026-08-08: an agent announced "kein
+  # Council konfiguriert (keine .agent-settings.yml)" and substituted a weaker
+  # path; the council was configured user-globally the whole time, and the
+  # project tree is never searched for it (ADR-104). Advisory: supplies a fact,
+  # never blocks.
+  council-availability:
+    script: src/scripts/council_availability_hook.ts
+    args: []
+    fail_closed: false
+    severity: advisory
+  # Self-repair intake (road-to-self-repair Phase 1). Two slots, one queue:
+  # user_prompt_submit opens a record when the user states the agent worked
+  # wrongly and injects the open-queue line; stop runs the deterministic
+  # detectors over the finished turn and records silently (a reminder fired
+  # after the reply cannot shape it). ADVISORY by construction — it records,
+  # it never gates; the outward step is a separate, user-run CLI command.
+  self-repair:
+    script: src/scripts/self_repair_hook.ts
+    args: []
+    fail_closed: false
+    severity: advisory
   # Shared per-session register (road-to-parallel-session-coordination) — writes
   # this session into <git-common-dir>/agent-sessions/<session_id>.json so every
   # other worktree of the repo can see it, and on session_start injects the live
@@ -351,22 +374,70 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+  # road-to-orchestrator-discipline-carriers Phase 3 (F6) — deterministic
+  # PostToolUse orchestration-telemetry capture. Fires only on an Agent/Task
+  # tool-use completion (the two observed subagent-dispatch tool names) and
+  # appends one `orchestration_record` line — no model step, replacing the
+  # measured 0.27% model-carried capture rate for future dispatches. Silent
+  # on every path (never writes to stdout); exit 0 always, including a
+  # malformed envelope or a write failure. fail_closed: false.
+  orchestration-record:
+    script: src/scripts/hooks/orchestration_record_hook.ts
+    args: []
+    fail_closed: false
+    severity: advisory
+    tools: [Agent, Task]
+  # road-to-orchestrator-discipline-carriers Phase 4 (F3-lite) — conditional
+  # delegation nudge. Extracts cheap structural signals from the SUBMITTED
+  # prompt (enumerated file lists, "for each"/"alle …" shapes, explicit slice
+  # counts, ordered-plan markers, multi-deliverable conjunctions), classifies
+  # via `classifyTask`, and — only on a positive do-in-parallel/do-in-steps
+  # verdict — reports `{decision:"warn", reason, additional_context}` at exit
+  # 2, mirroring `language-mirror`'s shipped delivery pattern so the verdict
+  # line actually reaches `hookSpecificOutput.additionalContext` on the
+  # verified `claude` platform. Silence is the anti-canary default: no
+  # enumerated signal → no injection at all. Never blocks the turn — see the
+  # hook's file header for the `host_semantics.emitFor` proof. fail_closed:
+  # false.
+  delegation-nudge:
+    script: src/scripts/hooks/delegation_nudge_hook.ts
+    args: []
+    fail_closed: false
+    severity: advisory
+  # road-to-orchestrator-discipline-carriers Phase 5 (F4-lite) — end-review
+  # nudge. Fires ONLY when the session mutated tracked+untracked, non-doc
+  # files beyond MUTATION_LINE_THRESHOLD (50 lines; untracked files added
+  # post-review, F6) AND no reviewer ran this session (scanned from the
+  # Stop payload's `transcript_path`) AND this session has not already
+  # fired once (F2 — a once-per-session gate; state under
+  # agents/runtime/state/end-review-nudge/, gitignored). On fire, reports
+  # `{decision:"warn", reason, additional_context}` at exit 2 (same delivery
+  # pattern as `language-mirror`/`delegation-nudge` above) and appends one
+  # `review_skipped` telemetry line — hook-carried, not model-carried — so a
+  # future blocking decision has a measured distribution to cite. Never
+  # blocks the turn — see the hook's file header for the `host_semantics.
+  # emitFor` proof. fail_closed: false.
+  end-review-nudge:
+    script: src/scripts/hooks/end_review_nudge_hook.ts
+    args: []
+    fail_closed: false
+    severity: advisory
 
 platforms:
   augment:
-    session_start:    [chat-history, hot-context, handoff-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register]
+    session_start:    [chat-history, hot-context, handoff-context, session-canary, council-availability, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register]
     session_end:      [chat-history, memory-learn, session-register]
-    stop:             [chat-history, hot-context, verify-before-complete, session-register]
+    stop:             [chat-history, hot-context, verify-before-complete, self-repair, session-register]
     pre_tool_use:     [block-no-verify, block-unauthorized-git, evidence-independence, block-kernel-rule-writes, block-config-weakening, rtk-wrap, design-slop, code-graph-nudge]
-    post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder]
+    post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, orchestration-record]
 
   claude:
-    session_start:    [chat-history, hot-context, handoff-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register]
+    session_start:    [chat-history, hot-context, handoff-context, session-canary, council-availability, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register]
     session_end:      [chat-history, memory-learn, session-register]
-    stop:             [chat-history, hot-context, verify-before-complete, team-review-gate, session-register]
-    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, session-register]
+    stop:             [chat-history, hot-context, verify-before-complete, team-review-gate, end-review-nudge, self-repair, session-register]
+    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, delegation-nudge, git-authorization, session-canary, self-repair, session-register]
     pre_tool_use:     [block-no-verify, block-unauthorized-git, evidence-independence, block-kernel-rule-writes, block-config-weakening, rtk-wrap, design-slop, code-graph-nudge]
-    post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder]
+    post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, orchestration-record]
 
   # Cowork — the Claude desktop app's local-agent-mode runtime, built
   # on top of the Claude Code CLI. Same lifecycle vocabulary, same
@@ -383,12 +454,22 @@ platforms:
   # Decision matrix + upstream blockers tracked in
   # agents/settings/contexts/chat-history-platform-hooks.md § Cowork.
   cowork:
-    session_start:    [chat-history, hot-context, handoff-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register]
+    session_start:    [chat-history, hot-context, handoff-context, session-canary, council-availability, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register]
     session_end:      [chat-history, memory-learn, session-register]
-    stop:             [chat-history, hot-context, verify-before-complete, session-register]
-    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, session-register]
+    # end-review-nudge and delegation-nudge are DELIBERATELY NOT bound on
+    # this platform (F10, review) — cowork-dispatcher.sh's own header states
+    # it "always exit[s] 0" and its dispatch line discards the dispatcher's
+    # exit code AND stdout unconditionally (`>/dev/null 2>&1 || true`). Both
+    # concerns' delivery depends entirely on `additional_context` reaching
+    # the model via stdout at the verified exit-2 warn path — a delivery this
+    # trampoline makes structurally impossible regardless of which platform
+    # is later verified to forward it. Binding them here would be dead
+    # weight: the concern still runs (git diff, transcript scan, classifier),
+    # still costs the dispatch, and its entire output is thrown away.
+    stop:             [chat-history, hot-context, verify-before-complete, self-repair, session-register]
+    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, self-repair, session-register]
     pre_tool_use:     [block-no-verify, block-unauthorized-git, evidence-independence, block-kernel-rule-writes, block-config-weakening, rtk-wrap, design-slop, code-graph-nudge]
-    post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder]
+    post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, orchestration-record]
 
   # Phase 7.5 — Cursor. `.cursor/hooks.json` (project) is read by the
   # IDE and CLI; `~/.cursor/hooks.json` (user) is opt-in via
@@ -398,11 +479,11 @@ platforms:
   # IDE-only — CLI-only users fall back to /checkpoint per
   # agents/settings/contexts/chat-history-platform-hooks.md.
   cursor:
-    session_start:      [chat-history, hot-context, handoff-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register]
+    session_start:      [chat-history, hot-context, handoff-context, session-canary, council-availability, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register]
     session_end:        [chat-history, memory-learn, session-register]
-    stop:               [chat-history, hot-context, verify-before-complete, session-register]
-    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, session-register]
-    post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder]
+    stop:               [chat-history, hot-context, verify-before-complete, self-repair, session-register]
+    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, self-repair, session-register]
+    post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, orchestration-record]
 
   # Phase 7.6 — Cline. Hooks live under `.clinerules/hooks/<HookName>`
   # (project, no file extension, must be executable per Cline docs) or
@@ -413,11 +494,11 @@ platforms:
   # both map to session_start. TaskCancel maps to stop because the
   # session is interrupted with partial state (mirrors Augment Stop).
   cline:
-    session_start:      [chat-history, hot-context, handoff-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register]
+    session_start:      [chat-history, hot-context, handoff-context, session-canary, council-availability, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register]
     session_end:        [chat-history, memory-learn, session-register]
-    stop:               [chat-history, hot-context, verify-before-complete, session-register]
-    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, session-register]
-    post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder]
+    stop:               [chat-history, hot-context, verify-before-complete, self-repair, session-register]
+    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, self-repair, session-register]
+    post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, orchestration-record]
 
   # Phase 7.7 — Windsurf (Cascade). Hooks live at `.windsurf/hooks.json`
   # (project) or `~/.codeium/windsurf/hooks.json` (user). Cascade has
@@ -432,11 +513,11 @@ platforms:
   # surface to record verification commands; documented limitation).
   # minimal-safe-diff is omitted entirely on Windsurf for the same reason.
   windsurf:
-    session_start:      [chat-history, hot-context, handoff-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, profile-staleness, wrapper-freshness, surface-probe, session-register]
-    stop:               [chat-history, hot-context, verify-before-complete, session-register]
+    session_start:      [chat-history, hot-context, handoff-context, session-canary, council-availability, first-run-gate, onboarding-gate, verify-before-complete, profile-staleness, wrapper-freshness, surface-probe, session-register]
+    stop:               [chat-history, hot-context, verify-before-complete, self-repair, session-register]
     # language-mirror IS bound here: unlike minimal-safe-diff it needs only the
     # user_prompt_submit slot, which Windsurf has.
-    user_prompt_submit: [chat-history, verify-before-complete, language-mirror, git-authorization, session-canary, session-register]
+    user_prompt_submit: [chat-history, verify-before-complete, language-mirror, git-authorization, session-canary, self-repair, session-register]
 
   # Phase 7.8 — Gemini CLI. Hooks live at `.gemini/settings.json`
   # (project) or `~/.gemini/settings.json` (user). Per Gemini docs
@@ -449,11 +530,11 @@ platforms:
   # turn-check semantics. AfterAgent fires when the agent loop ends
   # — this is our `stop` slot.
   gemini:
-    session_start:      [chat-history, hot-context, handoff-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register]
+    session_start:      [chat-history, hot-context, handoff-context, session-canary, council-availability, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register]
     session_end:        [chat-history, memory-learn, session-register]
-    stop:               [chat-history, hot-context, verify-before-complete, session-register]
-    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, session-register]
-    post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder]
+    stop:               [chat-history, hot-context, verify-before-complete, self-repair, session-register]
+    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, self-repair, session-register]
+    post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, orchestration-record]
 
   # Phase 7.9 — Copilot has no hook surface. Concerns route through
   # rule-only fallback; the dispatcher silently no-ops on --platform copilot.

package/src/scripts/hooks/block_no_verify.ts

@@ -20,12 +20,21 @@
  *   2 — warn  (not used by this guard)
  *
  * No ALLOW_NO_VERIFY-style env bypass is provided. See src/rules/git-history-discipline.md
+ *
+ * WHAT THIS GUARD DOES NOT SEE. Command substitutions ARE now checked — see
+ * `_check_command` for why they were not, and why the well-formed case was the
+ * unprotected one. What remains uncovered is an invocation whose command word
+ * only exists at runtime (`P=commit; git $P --no-verify` via indirection, or a
+ * word composed by `xargs`). Those execute under bash and are not classified
+ * here. Stated rather than left implied: this file's own round-5 defect was a
+ * docstring that described coverage it did not have.
  */
 
 import * as fs from 'node:fs';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import * as path from 'node:path';
 import { readHookStdin } from './hook_stdin.js';
+import { substitutionPayloads } from './block_unauthorized_git.js';
 
 const _HERE = fileURLToPath(import.meta.url);
 
@@ -384,8 +393,36 @@ export function _looks_like_git_invocation(cmd: string, depth = 0): boolean {
     return false;
 }
 
-/** Return (blocked, reason). Fail-closed on parse error for git commands. */
-function _check_command(cmd: string): [boolean, string] {
+/**
+ * Return (blocked, reason). Fail-closed on parse error for git commands.
+ *
+ * COMMAND SUBSTITUTIONS ARE CHECKED SEPARATELY, and the reason they were not is
+ * the shape of the hole: this file does split on `$(` and backtick, but only
+ * inside `_looks_like_git_invocation`, which runs exclusively in the
+ * shlex-failure branch. A well-formed `echo "$(git commit --no-verify)"` parses
+ * cleanly, so shlex succeeds, the substitution stays inside one token, and
+ * `_git_base` never sees git. The more parseable the command, the less it was
+ * protected. Classification inside the payload is by command position, so a
+ * substitution that INVOKES git is checked and one that merely names it in an
+ * argument is not — matching what `block_unauthorized_git` does one level up.
+ *
+ * Heredoc bodies are removed before extraction: a backtick or `$(` inside a
+ * commit message being written to a file is data, and feeding it back through
+ * this function is exactly the false positive the round-5 repair closed.
+ */
+function _check_command(cmd: string, depth = 0): [boolean, string] {
+    if (depth <= 3) {
+        const withoutHeredocs = cmd.replace(
+            /<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1[\s\S]*?^\s*\2\s*$/gm,
+            '<<HEREDOC',
+        );
+        for (const payload of substitutionPayloads(withoutHeredocs)) {
+            const [blocked, reason] = _check_command(payload, depth + 1);
+            if (blocked) {
+                return [true, reason];
+            }
+        }
+    }
     let tokens: string[];
     try {
         tokens = shlexSplit(cmd);