@event4u/agent-config 9.35.0 → 10.0.0

package/src/scripts/hook_manifest.yaml

@@ -60,8 +60,12 @@ concerns:
     severity: advisory
   # Phase 5 — Tier-1 hook for the verify-before-complete rule. Records
   # observable evidence of verification commands (tests, quality tools,
-  # builds) into agents/runtime/state/verify-before-complete.json. The rule body
-  # cites that file as the source of truth for "verified this turn?".
+  # builds) into agents/state/verify-before-complete.json — the path the code
+  # actually writes (`before_complete_hook.STATE_FILE`); this comment said
+  # `agents/runtime/state/` until round 7, which is a directory it never used.
+  # The rule body cites that file as the source of truth for "verified this
+  # turn?". Since round 7 it also carries `ci_last`, the session-scoped CI-settle
+  # negative that `turn-end-gate` reads to refuse a premature completion claim.
   verify-before-complete:
     script: src/scripts/before_complete_hook.ts
     args: []
@@ -152,6 +156,21 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+  # road-to-frontend-skill-application Phase 4 — OPTIONAL PreToolUse UI-route
+  # nudge. On a Write/Edit to a UI surface with no design consultation latched
+  # this session, WARNS (exit 2) naming the route; a read or search touching a
+  # design surface latches consultation and silences it. Anti-loop: at most 2
+  # nudges per session. It does NOT read the two UI rules — the UI-surface
+  # decision comes from _lib/ui_surface.ts — so it runs parallel to them rather
+  # than consuming their triggers, and it is a nudge, never a block, so
+  # "enforced_by: none" on those rules stays honest.
+  # Default-OFF (hooks.ui_route_nudge.enabled).
+  # fail_closed: false.
+  ui-route-nudge:
+    script: src/scripts/hooks/ui_route_nudge_hook.ts
+    args: []
+    fail_closed: false
+    severity: advisory
   # ADR-124 Phase 4 — OPTIONAL PreToolUse code-graph nudge. When a code-graph
   # source is present and the agent is about to search/read source, WARNS
   # (exit 2) once per session to query the graph first (or rebuild if stale,
@@ -432,10 +451,12 @@ concerns:
   # mismatch (19 measured) — because building the unsafe part twice is how a
   # second detector becomes a second outage.
   #
-  # DEFAULT OFF (`hooks.turn_end_gate.enabled`), per the council
-  # recorded in round 6: the mechanism exists and soaks before it binds. Both
-  # detectors are default ON *within* the master switch, which is round 5
-  # § 3.6's ask read so that both hold at once.
+  # ALWAYS ARMED — no settings surface (2026-08-12). It shipped default-OFF on
+  # the round-6 council's "soak before it binds", and the maintainer removed the
+  # switch on the ground that a concern which is off cannot soak: the flag made
+  # the soak it protected unreachable. Whether the gate fires is decided by each
+  # detector's own trigger conditions, which is the same shape `delegation-nudge`
+  # uses — no signal, no output. `hooks.turn_end_gate.*` is in REMOVED_KEYS.
   #
   # fail_closed: FALSE, deliberately and unlike every other blocking concern
   # here: a crash in a turn-end gate must let the turn END. Failing closed on
@@ -528,7 +549,7 @@ platforms:
     session_start:    [chat-history, hot-context, handoff-context, session-canary, council-availability, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe, session-register]
     session_end:      [chat-history, memory-learn, session-register]
     stop:             [chat-history, hot-context, verify-before-complete, self-repair, session-register]
-    pre_tool_use:     [block-no-verify, block-unauthorized-git, evidence-independence, block-kernel-rule-writes, block-config-weakening, rtk-wrap, design-slop, code-graph-nudge, reread-guard]
+    pre_tool_use:     [block-no-verify, block-unauthorized-git, evidence-independence, block-kernel-rule-writes, block-config-weakening, rtk-wrap, design-slop, ui-route-nudge, code-graph-nudge, reread-guard]
     post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, orchestration-record, edit-shape]
 
   claude:
@@ -536,7 +557,7 @@ platforms:
     session_end:      [chat-history, memory-learn, session-register]
     stop:             [chat-history, hot-context, verify-before-complete, team-review-gate, end-review-nudge, turn-end-gate, self-repair, session-register, session-eol]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, delegation-nudge, git-authorization, session-canary, self-repair, session-register]
-    pre_tool_use:     [block-no-verify, block-unauthorized-git, evidence-independence, block-kernel-rule-writes, block-config-weakening, rtk-wrap, design-slop, code-graph-nudge, reread-guard]
+    pre_tool_use:     [block-no-verify, block-unauthorized-git, evidence-independence, block-kernel-rule-writes, block-config-weakening, rtk-wrap, design-slop, ui-route-nudge, code-graph-nudge, reread-guard]
     post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, orchestration-record, edit-shape, language-mirror]
     # round-5 § 6.1 — the ONLY binding on this slot in the tree. `pre_compact`
     # sets a pin-lost marker; the `post_tool_use` entry above re-emits the pin
@@ -575,7 +596,7 @@ platforms:
     # still costs the dispatch, and its entire output is thrown away.
     stop:             [chat-history, hot-context, verify-before-complete, self-repair, session-register]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization, session-canary, self-repair, session-register]
-    pre_tool_use:     [block-no-verify, block-unauthorized-git, evidence-independence, block-kernel-rule-writes, block-config-weakening, rtk-wrap, design-slop, code-graph-nudge, reread-guard]
+    pre_tool_use:     [block-no-verify, block-unauthorized-git, evidence-independence, block-kernel-rule-writes, block-config-weakening, rtk-wrap, design-slop, ui-route-nudge, code-graph-nudge, reread-guard]
     post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, orchestration-record, edit-shape]
 
   # Phase 7.5 — Cursor. `.cursor/hooks.json` (project) is read by the

package/src/scripts/hooks/block_no_verify.ts

@@ -409,31 +409,104 @@ export function _looks_like_git_invocation(cmd: string, depth = 0): boolean {
  * Heredoc bodies are removed before extraction: a backtick or `$(` inside a
  * commit message being written to a file is data, and feeding it back through
  * this function is exactly the false positive the round-5 repair closed.
+ *
+ * ROUND 7 — THREAT MODEL for extending that removal to the shlex path (§ 2.1).
+ * Until round 7 the stripped string fed only `substitutionPayloads`; `shlexSplit`
+ * still received the RAW command. Both halves of that were measured, on this
+ * branch, before anything changed:
+ *
+ *   `git commit -F - <<'EOF' … maintainer's … EOF`   → BLOCKED   (false positive)
+ *   `bash <<EOF … git commit --no-verify … EOF`       → ALLOWED   (real bypass)
+ *
+ * So this is not the round-6 trade of one false positive for two false negatives.
+ * The bypass PRE-EXISTS: with the body inline, `shlexSplit` succeeds, the tokens
+ * are `bash <<EOF git commit --no-verify EOF`, command position is `bash`, and
+ * `_git_base` never sees git. Stripping before shlex fixes the false positive;
+ * scanning the bodies fixes the bypass. Both directions verified by probe.
+ *
+ * What an attacker can hide in a heredoc body, and how each is handled:
+ *
+ *   - a body consumed by a SHELL (`sh`/`bash`/`zsh`/`ksh`, with or without a path
+ *     prefix or an `env` prefix) IS a command list → scanned recursively.
+ *   - a body consumed by anything else (`git commit -F -`, `cat > f`, `tee`) is
+ *     DATA. Scanning it would re-open the exact false positive above, since a
+ *     commit message may legitimately contain the words `--no-verify`.
+ *   - an UNTERMINATED heredoc never matches the delimiter, so nothing is stripped
+ *     and the raw string still reaches shlex — the fail-closed branch keeps it.
+ */
+
+/** One heredoc: its body, and whether a shell is the thing consuming it. */
+interface Heredoc {
+    body: string;
+    shellConsumed: boolean;
+}
+
+/**
+ * Command position on the line that opens the heredoc is a shell interpreter, so
+ * the body is a command list rather than data. Anchored to the segment start or a
+ * shell separator, exactly like `_looks_like_git_invocation` does one level up —
+ * a bare mention of `bash` in an argument must not promote a message to code.
  */
+const _SHELL_CONSUMER_RE =
+    /(?:^|[|&;]|\$\(|`)\s*(?:env\s+(?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)*)?(?:\S*\/)?(?:ba|z|k)?sh\b/;
+
+export function _heredocs(cmd: string): { stripped: string; docs: Heredoc[] } {
+    const re = /<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1([\s\S]*?)^\s*\2\s*$/gm;
+    const docs: Heredoc[] = [];
+    let stripped = '';
+    let last = 0;
+    let m: RegExpExecArray | null;
+    while ((m = re.exec(cmd)) !== null) {
+        const lineStart = cmd.lastIndexOf('\n', m.index) + 1;
+        const prefix = cmd.slice(lineStart, m.index);
+        docs.push({ body: m[3] ?? '', shellConsumed: _SHELL_CONSUMER_RE.test(prefix) });
+        stripped += cmd.slice(last, m.index) + '<<HEREDOC';
+        last = m.index + m[0].length;
+    }
+    stripped += cmd.slice(last);
+    return { stripped, docs };
+}
+
 function _check_command(cmd: string, depth = 0): [boolean, string] {
+    // Round 7 § 2.2 — the stripped string now feeds shlex as well, not only the
+    // substitution scan. `<<HEREDOC` is a plain token, so an apostrophe in a
+    // commit message can no longer abort the parse of the command carrying it.
+    const { stripped, docs } = depth <= 3 ? _heredocs(cmd) : { stripped: cmd, docs: [] };
     if (depth <= 3) {
-        const withoutHeredocs = cmd.replace(
-            /<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1[\s\S]*?^\s*\2\s*$/gm,
-            '<<HEREDOC',
-        );
-        for (const payload of substitutionPayloads(withoutHeredocs)) {
+        for (const payload of substitutionPayloads(stripped)) {
             const [blocked, reason] = _check_command(payload, depth + 1);
             if (blocked) {
                 return [true, reason];
             }
         }
+        // A shell-consumed body is a command list, so it is checked like one.
+        for (const doc of docs) {
+            if (!doc.shellConsumed) {
+                continue;
+            }
+            const [blocked, reason] = _check_command(doc.body, depth + 1);
+            if (blocked) {
+                return [true, reason];
+            }
+        }
     }
     let tokens: string[];
     try {
-        tokens = shlexSplit(cmd);
+        tokens = shlexSplit(stripped);
     } catch (e) {
         if (e instanceof ShlexError) {
-            if (_looks_like_git_invocation(cmd)) {
+            // Tested against the string that actually failed to parse. Round 7
+            // § 2.4: the message no longer prescribes the message-in-a-file
+            // workaround, because a TERMINATED heredoc is now stripped before
+            // this point and can no longer be the cause. What reaches here is
+            // genuinely unbalanced quoting — an unterminated heredoc, or an odd
+            // quote outside one — which bash itself refuses to run.
+            if (_looks_like_git_invocation(stripped)) {
                 return [
                     true,
                     'command parse failed (shlex) on a git-containing command — fail-closed (git-history-discipline). \n'
-                    + 'Most common cause: an apostrophe or backtick inside a heredoc commit message in the SAME compound command as `git`. \n'
-                    + 'Fix: write the message to a file and use `git commit -F <file>` — do not retry the heredoc.',
+                    + 'The quoting is unbalanced OUTSIDE any terminated heredoc — an unterminated heredoc, or an odd quote. \n'
+                    + 'bash refuses this command too; fix the quoting rather than working around the guard.',
                 ];
             }
             return [false, ''];

package/src/scripts/hooks/concern_registry.ts

@@ -54,6 +54,7 @@ import { main as blockConfigWeakeningMain } from './block_config_weakening.js';
 import { main as rtkWrapMain } from './rtk_wrap_hook.js';
 import { main as designSlopMain } from './design_slop_hook.js';
 import { main as codeGraphNudgeMain } from './code_graph_nudge_hook.js';
+import { main as uiRouteNudgeMain } from './ui_route_nudge_hook.js';
 import { main as orchestrationRecordMain } from './orchestration_record_hook.js';
 import { main as delegationNudgeMain } from './delegation_nudge_hook.js';
 import { main as endReviewNudgeMain } from './end_review_nudge_hook.js';
@@ -97,6 +98,7 @@ export const CONCERN_REGISTRY: Readonly<Record<string, ConcernMain>> = {
     'src/scripts/hooks/rtk_wrap_hook.ts': rtkWrapMain as ConcernMain,
     'src/scripts/hooks/design_slop_hook.ts': designSlopMain as ConcernMain,
     'src/scripts/hooks/code_graph_nudge_hook.ts': codeGraphNudgeMain as ConcernMain,
+    'src/scripts/hooks/ui_route_nudge_hook.ts': uiRouteNudgeMain as ConcernMain,
     'src/scripts/hooks/orchestration_record_hook.ts': orchestrationRecordMain as ConcernMain,
     'src/scripts/hooks/delegation_nudge_hook.ts': delegationNudgeMain as ConcernMain,
     'src/scripts/hooks/end_review_nudge_hook.ts': endReviewNudgeMain as ConcernMain,

package/src/scripts/hooks/design_slop_hook.ts

@@ -23,6 +23,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { type DesignContext } from "../design_slop_rules.js";
+import { UI_EXT } from "../_lib/ui_surface.js";
 import { loadDesignContext, scanFile } from "../lint_design_slop.js";
 import { readHookStdin } from "./hook_stdin.js";
 
@@ -30,7 +31,6 @@ const SETTINGS_FILE = ".agent-settings.yml";
 const EXIT_ALLOW = 0;
 const EXIT_WARN = 2;
 const DEGRADE_AFTER = 3; // surfaces of the same file::rule signature before going silent
-const UI_EXT = /\.(html|htm|css|scss|sass|less|vue|svelte|astro|jsx|tsx)$/i;
 
 type JsonValue = string | number | boolean | null | JsonValue[] | { [k: string]: JsonValue };
 type JsonObject = { [k: string]: JsonValue };

package/src/scripts/hooks/turn_end_gate_hook.ts

@@ -58,19 +58,41 @@
  * matching ordinal reads as already-refused, so on such a host layer 2
  * degrades to "may under-refuse" and layer 1 is the real guard.
  *
- * ## Default OFF — and why, given the roadmap says otherwise
- *
- * `road-to-conformance-round5.md` § 3.6 asks for a kill-switch per
- * detector, "default on". The council recorded in round 6 (2026-08-08)
- * asked for the mechanism to be opt-in, "defaulting to off, so the
- * mechanism exists and soaks before it binds" — two prior hook-severity
- * mistakes plus a turn-end blast radius made default-on uninsurable in
- * their reading. Both are satisfied literally: the MASTER switch
- * (`hooks.turn_end_gate.enabled`) is default OFF, and WITHIN it every
- * detector is default ON. A maintainer who opts in gets all of them without
- * further configuration; until then this concern is a no-op that costs one
- * settings-cascade read per turn-end. Detector C landed under the same rule —
- * the master switch was NOT flipped when it shipped.
+ * ## Always armed — the switch was removed, and why
+ *
+ * This gate shipped behind `hooks.turn_end_gate.enabled`, default OFF, on the
+ * council's round-6 reading: "the mechanism exists and soaks before it binds."
+ * The maintainer removed the switch on 2026-08-12, and the decisive argument
+ * was that the soak the switch was protecting could never happen — a concern
+ * that is off does not run, so "merged in its own PR with its own soak period"
+ * (the second condition of `blocker: stop-refusal-decision`) was unsatisfiable
+ * for as long as the condition's own mechanism stayed disabled. A default-off
+ * safety gate is not a soaking gate; it is an absent one.
+ *
+ * What replaces the switch is not "always refuse". It is the detectors' own
+ * trigger conditions, which is where the judgement belonged in the first
+ * place: A fires only on a closing paragraph that promises work, B only when a
+ * language pin exists AND the reply misses it, C only when the turn edited a
+ * file and then ran nothing. Silence is the default on every ordinary turn.
+ * `delegation-nudge` is the sibling precedent — no structural signal, no
+ * output at all.
+ *
+ * The cost of removing the switch, stated once because it is real: a
+ * false-positive detector can no longer be turned off by configuration, only
+ * by a revert. That is bounded rather than open-ended — the two re-entrancy
+ * layers below cap a misfire at ONE extra turn, never a wedge — and it is the
+ * reason a new detector ships only with a measured false-positive corpus.
+ *
+ * MEASURE IT ON YOUR OWN CORPUS, and the instruction moved here on purpose:
+ * it used to live in the settings description that this change deleted, and
+ * `src/config/pack-size-budget.json` cites that description as the reason
+ * `measure_turn_end_gate.ts` is shipped rather than excluded from the pack. So
+ * the pointer is restated rather than dropped —
+ * `./scripts-run src/scripts/measure_turn_end_gate --store <transcript dir>`
+ * re-derives each detector's fire rate against your own transcripts. No rate is
+ * quoted in this file: the round-5 number moved twice while the instrument
+ * itself was being corrected, and a fixed figure in a shipped comment would be
+ * a moving target presented as a constant.
  *
  * CONTRACT: dispatcher-internal exit is 1 (EXIT_BLOCK) on a fire, 0
  * otherwise. `fail_closed: false` — deliberately. A crash in a turn-end
@@ -94,13 +116,15 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
-import { load_agent_settings } from '../_lib/agent_settings.js';
 import {
     classify,
     isSyntheticPrompt,
     STATE_FILE as LANGUAGE_STATE_FILE,
     type Verdict,
 } from '../language_mirror_hook.js';
+// Round 7 § Phase 1 — the CI-settle producer. Imported for its STATE_FILE only,
+// so the consumer cannot read a path the producer does not write.
+import { STATE_FILE as CI_STATE_FILE } from '../before_complete_hook.js';
 import { isSafeTranscriptPath } from './end_review_nudge_hook.js';
 import { unwrap, type JsonObject, type JsonValue } from './envelope.js';
 import { readHookStdin } from './hook_stdin.js';
@@ -121,7 +145,7 @@ const EXIT_ALLOW = 0;
 export const TRANSCRIPT_READ_MAX_BYTES = 8 * 1024 * 1024; // 8 MB
 
 /** Detector identity, used in the state marker and the refusal text. */
-export type DetectorId = 'promissory' | 'language' | 'verification';
+export type DetectorId = 'promissory' | 'language' | 'verification' | 'completion';
 
 export interface Finding {
     detector: DetectorId;
@@ -323,7 +347,84 @@ export interface LanguagePin {
     language: Verdict;
 }
 
-/** Read the pin the language-mirror hook wrote. Absent ⇒ no obligation. */
+/**
+ * Round 7 § Phase 1 — where the CI-settle fact comes from, and why not from here.
+ *
+ * The obvious implementation reads the unsettled state out of the transcript this
+ * hook already parses. It cannot: `_toolCalls` keeps only name, command and target
+ * path, so a tool RESULT — where the pending count lives — is never read; and
+ * `toolCalls` is reset at every genuine user prompt by design, while the measured
+ * failure is a completion claim in a LATER turn than the poll. Building it that way
+ * meant reversing an invariant this file argues for two functions down.
+ *
+ * So the producer is `before_complete_hook`, which already sees tool output on
+ * `post_tool_use` and already owns the `pendingCount` predicate. It writes
+ * `ci_last` into `agents/state/verify-before-complete.json` and this reads it.
+ *
+ * NO network call, deliberately. Asking `gh pr checks` here would put a network
+ * round-trip on every turn-end; `road-to-hook-latency-repair` exists because that
+ * cost is real. The rejected alternative is named so the next author does not
+ * re-derive it.
+ *
+ * ASYMMETRY that makes the cross-turn read legitimate where the reader refuses it
+ * for verification: a stale POSITIVE ("I verified") wrongly vouches for work it
+ * never saw. A stale NEGATIVE ("CI was not settled") only ever refuses more often.
+ * Same freshness invariant, opposite failure direction.
+ */
+export function readCiSettled(workspaceRoot: string): { seen: boolean; settled: boolean } {
+    try {
+        const raw = fs.readFileSync(path.join(workspaceRoot, CI_STATE_FILE), 'utf-8');
+        const decoded: unknown = JSON.parse(raw);
+        if (typeof decoded === 'object' && decoded !== null && !Array.isArray(decoded)) {
+            const ci = (decoded as Record<string, unknown>)['ci_last'];
+            if (typeof ci === 'object' && ci !== null && !Array.isArray(ci)) {
+                return { seen: true, settled: (ci as Record<string, unknown>)['settled'] === true };
+            }
+        }
+    } catch {
+        // absent, unreadable, or malformed — all mean "no CI was observed", and a
+        // session that never polled CI must never be refused for it.
+    }
+    return { seen: false, settled: false };
+}
+
+/**
+ * A completion claim in the delivered reply. Deliberately narrow: the German and
+ * English closings the corpus actually produced, anchored to a line so a mid-reply
+ * "fertig" inside a sentence about something else does not fire.
+ *
+ * Measured shapes it must catch (round 7, § Phase 1): "Fertig, Matze." ·
+ * "Damit ist alles erledigt." · "Aufgabe erledigt." · "der komplette Auftrag ist
+ * durch".
+ */
+const _COMPLETION_RE =
+    /(^|\n)\s*(?:\*\*)?(?:fertig\b|damit ist alles erledigt|aufgabe erledigt|alles erledigt\b|komplett(?:er)? (?:auftrag|abgearbeitet)|der komplette auftrag ist durch|done[.!]|all done\b|task complete)/i;
+
+export function detectCompletionClaim(
+    reply: string,
+    ci: { seen: boolean; settled: boolean },
+): Finding | null {
+    // A session that never read CI has nothing to be premature about.
+    if (!ci.seen || ci.settled) return null;
+    const prose = visibleProse(reply);
+    const m = _COMPLETION_RE.exec(prose);
+    if (!m) return null;
+    const at = m.index;
+    return {
+        detector: 'completion',
+        evidence: prose.slice(at, at + 120).trim(),
+        reason:
+            'a completion claim while the last CI read was not settled — ' +
+            'read the verdict, then claim it (verify-before-complete)',
+    };
+}
+
+/**
+ * Read the pin the language-mirror hook wrote. Absent ⇒ no obligation.
+ *
+ * (R2 finding 8: this line was left 73 lines above, where inserting `readCiSettled`
+ * had stranded it — so it documented the wrong function and this one had none.)
+ */
 export function readLanguagePin(workspaceRoot: string): Verdict {
     try {
         const raw = fs.readFileSync(path.join(workspaceRoot, LANGUAGE_STATE_FILE), 'utf-8');
@@ -688,78 +789,6 @@ function _messageText(content: unknown): string | null {
     return parts.length > 0 ? parts.join('\n') : null;
 }
 
-// ---------------------------------------------------------------------------
-// Settings — master OFF, detectors ON within it
-// ---------------------------------------------------------------------------
-
-export interface GateSettings {
-    enabled: boolean;
-    promissory: boolean;
-    language: boolean;
-    verification: boolean;
-}
-
-/**
- * YAML spellings a human writes for "on". The `yaml` package parses to the 1.2
- * core schema, where `yes` is the STRING "yes" rather than a boolean — so a
- * maintainer who writes `enabled: yes` means it, and a reader that silently
- * treats it as off is the R2 finding-6b defect wearing a parser instead of a
- * regex. Anything not in this set is off; there is no truthiness guessing.
- */
-function _isOn(v: unknown): boolean | null {
-    if (typeof v === 'boolean') return v;
-    if (typeof v !== 'string') return null;
-    const s = v.trim().toLowerCase();
-    if (s === 'true' || s === 'yes' || s === 'on') return true;
-    if (s === 'false' || s === 'no' || s === 'off') return false;
-    return null;
-}
-
-/**
- * Read the three switches through the real settings cascade.
- *
- * The previous version hand-walked `<workspaceRoot>/.agent-settings.yml` for
- * speed, and R2 finding 6 found three defects in that trade: it ignored the
- * user-global layer entirely (so a maintainer who opts in globally got no gate
- * AND no diagnostic), its end-of-line-anchored regex read
- * `enabled: true  # soak opt-in` as FALSE, and it accepted a `turn_end_gate:`
- * block under ANY parent as ON because a text walker has no notion of a parent.
- *
- * The stated reason for skipping the cascade does not survive contact with the
- * sibling concerns: `delegation-nudge` calls `load_agent_settings` on
- * `user_prompt_submit`, i.e. every turn. Correctness on a gate that can refuse
- * a turn-end outranks one settings read per turn-end.
- */
-export function readGateSettings(workspaceRoot: string): GateSettings {
-    const off: GateSettings = {
-        enabled: false,
-        promissory: true,
-        language: true,
-        verification: true,
-    };
-    let settings: Record<string, unknown>;
-    try {
-        settings = load_agent_settings({ cwd: workspaceRoot }) as Record<string, unknown>;
-    } catch {
-        return off;
-    }
-    const hooks = settings['hooks'];
-    if (typeof hooks !== 'object' || hooks === null || Array.isArray(hooks)) return off;
-    const block = (hooks as Record<string, unknown>)['turn_end_gate'];
-    if (typeof block !== 'object' || block === null || Array.isArray(block)) return off;
-    const gate = block as Record<string, unknown>;
-    const flag = (name: string, dflt: boolean): boolean => {
-        const v = _isOn(gate[name]);
-        return v === null ? dflt : v;
-    };
-    return {
-        enabled: flag('enabled', false),
-        promissory: flag('promissory', true),
-        language: flag('language', true),
-        verification: flag('verification', true),
-    };
-}
-
 // ---------------------------------------------------------------------------
 // main
 // ---------------------------------------------------------------------------
@@ -782,9 +811,6 @@ export function main(): number {
 
     const workspaceRoot = str(envelope['workspace_root'] as JsonValue | undefined) || process.cwd();
 
-    const settings = readGateSettings(workspaceRoot);
-    if (!settings.enabled) return EXIT_ALLOW;
-
     const transcriptPath = str(
         (payload['transcript_path'] ?? payload['transcriptPath']) as JsonValue | undefined,
     );
@@ -818,17 +844,24 @@ export function main(): number {
     );
     if (alreadyRefusedTurn(workspaceRoot, sessionKey, turnOrdinal)) return EXIT_ALLOW;
 
+    // Every detector runs on every turn-end. The gating is INSIDE each one —
+    // no promise, no pin mismatch, no unverified edit ⇒ no finding ⇒ the turn
+    // ends. That is the whole of "fires when it is warranted"; there is no
+    // second, configurable notion of warranted layered on top of it.
     const findings: Finding[] = [];
-    if (settings.promissory) {
-        const f = detectPromissory(lastAssistant);
-        if (f) findings.push(f);
-    }
-    if (settings.language) {
-        const f = detectLanguage(lastAssistant, readLanguagePin(workspaceRoot));
-        if (f) findings.push(f);
-    }
-    if (settings.verification) {
-        const f = detectUnverifiedEdit(toolCalls);
+    for (const f of [
+        detectPromissory(lastAssistant),
+        detectLanguage(lastAssistant, readLanguagePin(workspaceRoot)),
+        detectUnverifiedEdit(toolCalls),
+        // Round 7 § Phase 1 — detector D, in the same unconditional list as the
+        // other three. It shipped with its own settings flag one commit earlier
+        // and that flag is gone: `hooks.turn_end_gate.*` was deleted on
+        // 2026-08-12 because a default-off safety gate is an absent one. Its
+        // gating is where the comment above says gating belongs — inside the
+        // detector: no CI observed, or a settled read, or no completion claim
+        // ⇒ no finding.
+        detectCompletionClaim(lastAssistant, readCiSettled(workspaceRoot)),
+    ]) {
         if (f) findings.push(f);
     }
     if (findings.length === 0) return EXIT_ALLOW;
@@ -840,10 +873,10 @@ export function main(): number {
     );
     process.stderr.write(
         `turn-end-gate: REFUSED — this turn is not finished.\n${lines.join('\n')}\n` +
-            '  Do the promised work now, correct the language, or run the ' +
-            'verification the edit needs, then end the turn.\n' +
-            '  This turn will not be refused a second time.\n' +
-            '  Disable: hooks.turn_end_gate.enabled: false in .agent-settings.yml\n',
+            '  Do the promised work now, correct the language, run the ' +
+            'verification the edit needs, or read the CI verdict before claiming ' +
+            'it — then end the turn.\n' +
+            '  This turn will not be refused a second time.\n',
     );
     return EXIT_BLOCK;
 }