@event4u/agent-config 9.36.0 → 10.1.0

package/src/scripts/conformance_scan.ts

@@ -41,6 +41,9 @@ import { isSyntheticPrompt } from "./_lib/prompt_shape.js";
 import { classifyAuthorization, type GitOp } from "./git_authorization_hook.js";
 import { BLOCK_OPS, commandOp } from "./hooks/block_unauthorized_git.js";
 import { isVacuousOutput, isCiPoll, pendingCount } from "./before_complete_hook.js";
+// Round 7 § 1.5 — the SAME predicate `turn-end-gate` refuses on, imported rather
+// than reimplemented, so the measured rate and the gate cannot disagree.
+import { detectCompletionClaim } from "./hooks/turn_end_gate_hook.js";
 import { isEvaluationPrompt, isSelfScoped, preloadedVerdict } from "./hooks/evidence_independence.js";
 
 /**
@@ -57,7 +60,12 @@ import { isEvaluationPrompt, isSelfScoped, preloadedVerdict } from "./hooks/evid
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
 
 export interface Violation {
-  check: "language-pin" | "git-authorization" | "vacuous-evidence" | "evidence-steering";
+  check:
+    | "language-pin"
+    | "git-authorization"
+    | "vacuous-evidence"
+    | "evidence-steering"
+    | "completion-claim";
   session: string;
   at: string;
   detail: string;
@@ -78,6 +86,17 @@ export interface SessionReport {
   user_turns: number;
   assistant_turns: number;
   violations: Violation[];
+  /**
+   * Round 7 § 6.2 — assistant turns that stood under a GERMAN pin, i.e. the only
+   * turns on which `language-pin` can fire at all. The rate was published over
+   * ALL assistant turns, which understates it by whatever fraction of a corpus is
+   * English-pinned: measured on round 7's own corpus, 1 655 of 2 354 (70 %), and
+   * the same 152 violations read 6.5 % on the old denominator and 9.2 % on this
+   * one — enough to move the band verdict from OUTSIDE to INSIDE.
+   */
+  de_pin_turns: number;
+  /** First entry timestamp, so a reader can era-split without a second pass. */
+  first_at: string;
 }
 
 /**
@@ -134,7 +153,7 @@ export const OBSERVED_BAND = { low: 9.1, high: 39.2 } as const;
  */
 export const BAND_MIN_TURNS = 1978;
 
-export type BandVerdict = "inside" | "outside" | "corpus-too-small";
+export type BandVerdict = "inside" | "outside" | "corpus-too-small" | "era-spanning";
 
 /** Round-6 Phase 4.5 — the forward-capture record for one scan run. */
 export interface RateRecord {
@@ -144,7 +163,29 @@ export interface RateRecord {
   assistant_turns: number;
   language_pin: number;
   rate_pct: number;
-  /** `outside` is the falsifier firing; `corpus-too-small` is not a reading. */
+  /**
+   * Round 7 § 6.2 / 6.1 — OPTIONAL, and not for convenience.
+   *
+   * `--record` appends one line per run to a series whose whole purpose is
+   * comparability over time, and every line written before round 7 carries none
+   * of these four. Declaring them required would make the type say something
+   * false about the records on disk, and the renderer already reads them
+   * defensively for exactly that reason. `analyse()` always populates them, so a
+   * fresh run is never partial — the optionality describes the archive, not the
+   * producer.
+   */
+  de_pin_turns?: number;
+  /** The same numerator over `de_pin_turns`. Reported beside `rate_pct`, never instead. */
+  rate_pct_de_pin?: number;
+  /** The corpus straddles a carrier landing, so no band verdict. */
+  era_spanning?: boolean;
+  /** Which carrier, when `era_spanning` — empty otherwise. */
+  era_reason?: string;
+  /**
+   * `outside` is the falsifier firing; `corpus-too-small` and `era-spanning` are
+   * not readings — the first is about corpus size, the second about the corpus
+   * containing two different systems.
+   */
   band: BandVerdict;
   /**
    * `null` when the scanned store is NOT this repo's own — `measureDelivered` is
@@ -157,7 +198,49 @@ export interface RateRecord {
   delivered_global_tokens: number | null;
 }
 
-export function bandVerdict(rate_pct: number, assistant_turns: number): BandVerdict {
+/**
+ * Round 7 § 6.1 — dates on which a carrier for a mechanised check LANDED.
+ *
+ * A rate pooled across one of these is not a reading about behaviour; it is a
+ * weighted average of two different systems. The band's falsifier is "a fourth
+ * PROJECT outside the band", and on round 7's first run it fired on the project
+ * that helped DEFINE the band — because the corpus straddled the language-pin
+ * carrier. 23.1 % before it, 0.0 % after, 6.5 % pooled, and the pooled figure was
+ * announced as the falsifier.
+ *
+ * Declared as data with provenance rather than inferred: nothing in a transcript
+ * records which carriers were bound while it was written.
+ */
+export const CARRIER_CHANGES: readonly { at: string; what: string }[] = [
+  { at: "2026-08-07T00:00:00Z", what: "language-pin bound on user_prompt_submit (round 5)" },
+];
+
+/** True when the corpus spans a carrier change, i.e. two systems in one average. */
+export function spansCarrierChange(firstAts: readonly string[]): { spans: boolean; what: string } {
+  const stamps = firstAts.filter((s) => s !== "").sort();
+  if (stamps.length === 0) {
+    return { spans: false, what: "" };
+  }
+  const lo = stamps[0] as string;
+  const hi = stamps[stamps.length - 1] as string;
+  for (const c of CARRIER_CHANGES) {
+    if (lo < c.at && hi >= c.at) {
+      return { spans: true, what: c.what };
+    }
+  }
+  return { spans: false, what: "" };
+}
+
+export function bandVerdict(
+  rate_pct: number,
+  assistant_turns: number,
+  opts: { spansCarrier?: boolean } = {},
+): BandVerdict {
+  // The era guard is checked FIRST and for the same reason the turn floor is: a
+  // verdict about corpus shape must not be reported as a verdict about behaviour.
+  if (opts.spansCarrier === true) {
+    return "era-spanning";
+  }
   if (assistant_turns < BAND_MIN_TURNS) {
     return "corpus-too-small";
   }
@@ -181,6 +264,7 @@ export const CHECK_IDS: readonly CheckId[] = [
   "git-authorization",
   "vacuous-evidence",
   "evidence-steering",
+  "completion-claim",
 ];
 
 /**
@@ -207,6 +291,12 @@ export const CHECK_MEANINGS: Record<CheckId, string> = {
   "evidence-steering":
     "A self-commissioned evaluation whose prompt pre-loaded its own verdict, " +
     "or a second self-scoped evaluation of the same subject within one turn.",
+  "completion-claim":
+    "An assistant turn claiming the work is complete while the last CI read in " +
+    "that session was NOT settled. Round 7 measured 14 instances by reading, " +
+    "each followed by the user handing the work back; this is the same " +
+    "predicate `turn-end-gate`'s completion detector refuses on, so the rate " +
+    "and the gate cannot disagree. A session that never polled CI can never hit.",
 };
 
 /**
@@ -317,7 +407,11 @@ export function isInjectedBody(text: string): boolean {
  * `API Error: 529 Overloaded` retry banners. Counting the harness as the model
  * inflates the very number this scan exists to report honestly.
  */
-const HARNESS_TEXT =
+// Exported since round 7 § 6.3: `probe_session_canary` needs the SAME predicate,
+// and its first version had its own copy that omitted `You've hit your` — which
+// turned a spend-limit banner into a missed greeting and reported 24/28 for a
+// corpus that is 25/28.
+export const HARNESS_TEXT =
   /^(API Error:|Request (timed out|was aborted)|\[Request interrupted|Error: |Credit balance is too low|You've hit your|Prompt is too long)/i;
 
 /** Rough English-opener test for the language check (first prose line only). */
@@ -330,6 +424,8 @@ export function scanSession(sessionId: string, lines: string[]): SessionReport {
     user_turns: 0,
     assistant_turns: 0,
     violations: [],
+    de_pin_turns: 0,
+    first_at: "",
   };
 
   let pinned: "de" | "en" | null = null;
@@ -343,6 +439,10 @@ export function scanSession(sessionId: string, lines: string[]): SessionReport {
   // that split reproducible against a future corpus instead of re-argued.
   let turnsSincePrompt = 0;
   let compactionSincePrompt = false;
+  // Round 7 § 1.5 — session-scoped, deliberately NOT reset per prompt: the
+  // measured failure is a completion claim in a LATER turn than the poll.
+  let ciSeen = false;
+  let ciSettled = false;
 
   for (const line of lines) {
     if (!line.trim()) {
@@ -354,6 +454,12 @@ export function scanSession(sessionId: string, lines: string[]): SessionReport {
     } catch {
       continue;
     }
+    // Round 7 § 6.1 — captured for the era guard. The FIRST timestamp in the
+    // file, not the file mtime: mtime moves when a session is resumed, which
+    // would put a July session in the August era.
+    if (report.first_at === "" && typeof entry["timestamp"] === "string") {
+      report.first_at = entry["timestamp"];
+    }
 
     // Tool results arrive as `user` entries carrying `toolUseResult`.
     if (entry["type"] === "user" && entry["toolUseResult"] !== undefined && pendingPoll !== null) {
@@ -370,6 +476,14 @@ export function scanSession(sessionId: string, lines: string[]): SessionReport {
           detail: `CI poll read as settled without an in-flight observation: ${out.slice(0, 90)}`,
         });
       }
+      // Round 7 § 1.5 — the session-scoped CI-settle state the completion-claim
+      // check reads. R2 finding 3: this copied `pending === 0` AND the wrong
+      // comment claiming it matched the producer's discrimination. It did not —
+      // a stale all-pass table read as a settle and silenced the check. The
+      // in-flight witness is required here too, so the measurement and the gate
+      // agree on what a settle is.
+      ciSeen = true;
+      ciSettled = pending === 0 && sawPending && !isVacuousOutput(out);
       pendingPoll = null;
       continue;
     }
@@ -424,6 +538,26 @@ export function scanSession(sessionId: string, lines: string[]): SessionReport {
     if (prose !== null) {
       report.assistant_turns += 1;
       turnsSincePrompt += 1;
+      // Round 7 § 6.2 — the denominator the language check can actually fire on.
+      // Counted here, beside the numerator, so the two cannot be derived from
+      // different populations later.
+      if (pinned === "de") {
+        report.de_pin_turns += 1;
+      }
+      // Round 7 § 1.5 — placed BEFORE the language block on purpose: that block
+      // `continue`s on a harness banner, and a check placed after it would be
+      // skipped for every such turn without saying so.
+      if (!HARNESS_TEXT.test((prose.split("\n").find((l) => l.trim()) ?? "").trim())) {
+        const cc = detectCompletionClaim(prose, { seen: ciSeen, settled: ciSettled });
+        if (cc !== null) {
+          report.violations.push({
+            check: "completion-claim",
+            session: sessionId,
+            at,
+            detail: `completion claimed over an unsettled CI read: "${cc.evidence.slice(0, 110)}"`,
+          });
+        }
+      }
       if (pinned === "de") {
         const first = prose.split("\n").find((l) => l.trim()) ?? "";
         if (HARNESS_TEXT.test(first.trim())) {
@@ -585,6 +719,7 @@ export function scanStore(store: string, limit: number): ScanReport {
     "git-authorization": 0,
     "vacuous-evidence": 0,
     "evidence-steering": 0,
+    "completion-claim": 0,
   };
   for (const s of per_session) {
     for (const v of s.violations) {
@@ -600,6 +735,14 @@ export function scanStore(store: string, limit: number): ScanReport {
   // band" — a rounding artefact announcing the declared falsifier.
   const rate_pct =
     assistant_turns === 0 ? 0 : Number(((100 * language_pin) / assistant_turns).toFixed(1));
+  // Round 7 § 6.2 — the second denominator, reported beside the first rather than
+  // instead of it: replacing the figure silently would break comparability with
+  // every recorded run, and the band's own three reference values were computed
+  // on the all-turns denominator.
+  const de_pin_turns = per_session.reduce((n, s) => n + s.de_pin_turns, 0);
+  const rate_pct_de_pin =
+    de_pin_turns === 0 ? 0 : Number(((100 * language_pin) / de_pin_turns).toFixed(1));
+  const era = spansCarrierChange(per_session.map((s) => s.first_at));
   const delivered = measureDelivered(
     path.join(REPO_ROOT, ".claude", "rules"),
     path.join(process.env["HOME"] ?? os.homedir(), ".claude", "rules"),
@@ -619,7 +762,11 @@ export function scanStore(store: string, limit: number): ScanReport {
       assistant_turns,
       language_pin,
       rate_pct,
-      band: bandVerdict(rate_pct, assistant_turns),
+      de_pin_turns,
+      rate_pct_de_pin,
+      era_spanning: era.spans,
+      era_reason: era.what,
+      band: bandVerdict(rate_pct, assistant_turns, { spansCarrier: era.spans }),
       // Only attach the carrier figures when the rate and the carriers describe
       // the same project.
       delivered_project_tokens: ownStore ? delivered.project.tokens : null,
@@ -680,7 +827,36 @@ export function render(report: ScanReport): string {
     `  language-pin rate  ${report.rate.rate_pct.toFixed(1)}%  ` +
       `(${report.rate.language_pin} of ${report.rate.assistant_turns} assistant turns)`,
   );
-  if (report.rate.band === "corpus-too-small") {
+  // Round 7 § 6.2 — both denominators, always. The band's three reference values
+  // were computed on the all-turns one, so that stays the headline; the second is
+  // the only one the check can actually fire on, and on round 7's own corpus the
+  // two differ by enough to move the verdict (6.5 % vs 9.2 %, band low 9.1 %).
+  // Optional-read, not `report.rate.x.toFixed(...)`: a `rate` block RECORDED
+  // before round 7 carries neither field, and `--record` exists to be read back
+  // over time. A renderer that throws on last month's line makes the series
+  // unreadable to prove a point about denominators.
+  const dePinTurns = report.rate.de_pin_turns;
+  const dePinRate = report.rate.rate_pct_de_pin;
+  if (typeof dePinTurns === 'number' && typeof dePinRate === 'number') {
+    lines.push(
+      `                     ${dePinRate.toFixed(1)}%  ` +
+        `(${report.rate.language_pin} of ${dePinTurns} turns under a GERMAN pin — the only` +
+        ' turns this check can fire on)',
+    );
+    lines.push(
+      '    The band (M5, n=3) was computed on the ALL-turns denominator, so the first figure',
+    );
+    lines.push('    is the comparable one and the second is the honest one. Both are printed.');
+  }
+  if (report.rate.band === "era-spanning") {
+    lines.push(
+      `    Not compared: the corpus SPANS a carrier landing — ${report.rate.era_reason || 'see CARRIER_CHANGES'}.`,
+    );
+    lines.push('    A rate pooled across it is a weighted average of two different systems, not');
+    lines.push('    a reading about behaviour. Round 7 measured 23.1% before and 0.0% after that');
+    lines.push('    exact carrier; the pooled 6.5% was announced as the falsifier firing.');
+    lines.push('    Split the window at the carrier date and read each era on its own.');
+  } else if (report.rate.band === "corpus-too-small") {
     lines.push(
       `    Not compared: ${report.rate.assistant_turns} turns is below the ${BAND_MIN_TURNS} of the`,
     );
@@ -702,8 +878,23 @@ export function render(report: ScanReport): string {
     lines.push("    as new. Store novelty is not project novelty.");
   }
   lines.push("");
-  lines.push("  Scanned checks are exactly the mechanised ones. Ask-shape, session-canary,");
-  lines.push("  promissory closings and checkbox batching are left as prose and NOT measured.");
+  // Round 7 § 6.4 — this footer used to lump four classes together as "NOT
+  // measured", and two of the four were wrong. Stated per class instead, because
+  // "not measured here" and "not measured anywhere" are different facts and only
+  // one of them is a gap.
+  lines.push("  Scanned checks are exactly the mechanised ones. What is NOT in the counts above:");
+  lines.push("    ask-shape (trailing free-text offer)  — measured NOWHERE. ~11 findings in round 7's");
+  lines.push("      reading half; the discriminator needs judgement, so it stays advisory on purpose.");
+  lines.push("    session-canary (opening greeting)     — not here, but PROBEABLE:");
+  lines.push("      `./scripts-run src/scripts/probe_session_canary`. Round 7: 25/28 sessions,");
+  lines.push("      24/25 post-carrier. The per-TASK instance is undecidable — no task boundary");
+  lines.push("      is recorded in a transcript.");
+  lines.push("    promissory closings                   — not here, but ALREADY GATED: `turn-end-gate`");
+  lines.push("      ships a blocking `detectPromissory`. Round 7 probe: 1 of 120 hand-back turns");
+  lines.push("      (the 163 this line first printed was the retracted denominator — it counted");
+  lines.push("      synthetic user turns as hand-back closers).");
+  lines.push("      `./scripts-run src/scripts/probe_promissory_closing`.");
+  lines.push("    checkbox batching                     — measured NOWHERE. ~5 low-severity findings.");
   return lines.join("\n");
 }
 

package/src/scripts/council_cli.ts

@@ -749,11 +749,18 @@ function _postRunQuorum(
     for (let i = 0; i < members.length; i++) {
         const m = members[i] as ExternalAIClient;
         const r = responses[i];
-        if (r !== undefined && !r.error) {
+        // Round 7 § 5.2 — attendance is a NON-EMPTY answer, not the absence of an
+        // error. `!r.error` alone counted a member that returned zero bytes, and
+        // that is not hypothetical: a 290 s curl timeout returned an empty body
+        // with no error set in two sessions (`9fc9ba3e`, `4ac2f7ac`) and the
+        // banner printed `2/2 present` — a single-voice verdict presented as
+        // convergence, on a paid run. An empty answer contributes nothing to a
+        // quorum by definition, whatever the transport thought of it.
+        if (r !== undefined && !r.error && r.text.trim() !== '') {
             present += 1;
             continue;
         }
-        const raw = r?.error ?? 'no response';
+        const raw = r?.error ?? (r !== undefined && r.text.trim() === '' ? 'empty response body' : 'no response');
         const failure = classifyCliFailure(raw);
         absent.push({
             member: m.name,
@@ -772,7 +779,14 @@ function _postRunQuorum(
  */
 function _format_quorum_line(q: QuorumResult): string {
     const verdict = q.status === 'concluded' ? 'concluded' : 'INCONCLUSIVE — release gate holds';
-    return `council:quorum · ${q.present}/${q.total} present, needed ${q.threshold} — ${verdict}.`;
+    // Round 7 § 5.3 — a degraded pass says so. `1/2 present, needed 1 —
+    // concluded` is literally true and reads as agreement; with a threshold of 1
+    // a solo answer concludes, and nothing in the line distinguishes "both
+    // members agreed" from "one member answered". The counts were always there;
+    // what was missing is the word that stops a reader inferring convergence.
+    const degraded =
+        q.present < q.total ? `  ⚠️  DEGRADED — ${String(q.total - q.present)} member(s) did not answer; this is not convergence.` : '';
+    return `council:quorum · ${q.present}/${q.total} present, needed ${q.threshold} — ${verdict}.${degraded}`;
 }
 
 function build_members(settings: Dict, opts: BuildMembersOptions = {}): ExternalAIClient[] {
@@ -2328,6 +2342,31 @@ function _emit_shadow_slo_banner(): void {
  * leaves nothing to infer. Exit is always 0 — this reports a state, it does not
  * gate — and the verdict line is machine-greppable in both directions.
  */
+/**
+ * Resolve the concrete transport a member would use on THIS machine right now.
+ *
+ * `cmd_status` exists to answer "is the council reachable, and will it bill me".
+ * Since the transport-mode setting was removed, the second half is not a value
+ * anyone can look up in the config — it is a per-machine resolution. Printing a
+ * configured mode would be the same class of stale answer the removed setting
+ * produced. `mode` is pinned to `auto` because the loader no longer emits
+ * anything else.
+ */
+function _resolvedTransportFor(
+    name: string,
+    member: { readonly binary: string | null; readonly api_key_ref: string | null },
+    report?: EnvironmentReport,
+): ReturnType<typeof resolveMemberTransport> {
+    return resolveMemberTransport({
+        provider: name,
+        report: report ?? detectEnvironment(),
+        invocationMode: null,
+        memberSettings: null,
+        globalMode: 'auto',
+        binaryOverride: member.binary,
+    });
+}
+
 export function cmd_status(args: Args, opts: { env?: Record<string, string | undefined> } = {}): number {
     const env = opts.env ?? process.env;
     const override = env[COUNCIL_CONFIG_ENV];
@@ -2363,6 +2402,21 @@ export function cmd_status(args: Args, opts: { env?: Record<string, string | und
                 members_total: cfg === null ? null : cfg.members.size,
                 members_enabled: cfg === null ? null : enabledMembers.length,
                 member_names: enabledMembers.map(([n]) => n),
+                transports: Object.fromEntries(
+                    enabledMembers.map(([n, m]) => {
+                        const t = _resolvedTransportFor(n, m);
+                        return [
+                            n,
+                            {
+                                available: t.available,
+                                transport: t.available ? t.transport : null,
+                                billing: t.available ? t.billing : null,
+                                reason: t.reason,
+                            },
+                        ];
+                    }),
+                ),
+                ignored_transport_keys: cfg?.ignored_transport_keys ?? [],
                 parse_error,
                 project_tree_consulted: false,
             })}\n`,
@@ -2383,6 +2437,25 @@ export function cmd_status(args: Args, opts: { env?: Record<string, string | und
         if (enabledMembers.length > 0) {
             _stdout(`                   ${enabledMembers.map(([n]) => n).join(', ')}\n`);
         }
+        // Transport is resolved per machine, so the only honest way to answer
+        // "will this cost money" is to resolve it here rather than print a
+        // configured value. The billing class comes from the detected auth
+        // source, never from the transport name — a community CLI wrapper
+        // shells out to the same paid API and stays metered.
+        for (const [name, member] of enabledMembers) {
+            const t = _resolvedTransportFor(name, member);
+            const billing = t.available ? ` · ${t.billing}` : '';
+            const detail = t.available ? t.transport : `unavailable — ${t.reason ?? 'no usable transport'}`;
+            _stdout(`  transport        ${name}: ${detail}${billing}\n`);
+        }
+        if (cfg.ignored_transport_keys.length > 0) {
+            _stdout('\n');
+            _stdout('  Ignored transport keys — transport is resolved, not configured:\n');
+            for (const key of cfg.ignored_transport_keys) {
+                _stdout(`    ${key}\n`);
+            }
+            _stdout('  Safe to delete from the config file; they change nothing.\n');
+        }
     }
     _stdout('\n');
     _stdout('  The project tree is NEVER consulted (ADR-104). No project file —\n');
@@ -2593,6 +2666,25 @@ function cmd_run(
         return 0;
     }
 
+    // Round 7 § 5.1 — VALIDATE THE OUTPUT PATH BEFORE THE FIRST BILLABLE CALL.
+    //
+    // The only validation used to sit immediately before the WRITE, i.e. after
+    // every member had been paid, so a wrong directory discarded a completed run.
+    // Measured across round 7's corpus: ~$1.30 in three sessions (`291f827b`
+    // ~$0.42, `9502795e` $0.44, plus a discarded run each in `d6154522` and
+    // `3d50d0df`). The trap sat in the operator's notes for weeks and was still
+    // paid twice, because the defect is the ORDERING, not the caller.
+    //
+    // Placed HERE, after the `--confirm` gate, and not at function entry: the
+    // estimate-only path neither writes nor bills, and the first attempt at this
+    // fix validated at entry and broke it — caught by
+    // `council_cli.test.ts`'s no-confirm case. Nothing above this line spends.
+    //
+    // The validator is pure, so the pre-write call stays: it returns the string
+    // the write uses, and removing it to avoid "duplicate work" would put the
+    // guarantee back in a single place that runs late.
+    _validate_council_output_path(args.output as string, { kind: 'responses', subcommand: 'run' });
+
     const cost_cfg = (ai_cfg['cost_budget'] as Dict) || {};
     const budget = new CostBudget({
         max_input_tokens: _pyInt(cost_cfg['max_input_tokens'] ?? 50_000, 50_000),

package/src/scripts/hook_manifest.yaml

@@ -60,8 +60,12 @@ concerns:
     severity: advisory
   # Phase 5 — Tier-1 hook for the verify-before-complete rule. Records
   # observable evidence of verification commands (tests, quality tools,
-  # builds) into agents/runtime/state/verify-before-complete.json. The rule body
-  # cites that file as the source of truth for "verified this turn?".
+  # builds) into agents/state/verify-before-complete.json — the path the code
+  # actually writes (`before_complete_hook.STATE_FILE`); this comment said
+  # `agents/runtime/state/` until round 7, which is a directory it never used.
+  # The rule body cites that file as the source of truth for "verified this
+  # turn?". Since round 7 it also carries `ci_last`, the session-scoped CI-settle
+  # negative that `turn-end-gate` reads to refuse a premature completion claim.
   verify-before-complete:
     script: src/scripts/before_complete_hook.ts
     args: []
@@ -447,10 +451,12 @@ concerns:
   # mismatch (19 measured) — because building the unsafe part twice is how a
   # second detector becomes a second outage.
   #
-  # DEFAULT OFF (`hooks.turn_end_gate.enabled`), per the council
-  # recorded in round 6: the mechanism exists and soaks before it binds. Both
-  # detectors are default ON *within* the master switch, which is round 5
-  # § 3.6's ask read so that both hold at once.
+  # ALWAYS ARMED — no settings surface (2026-08-12). It shipped default-OFF on
+  # the round-6 council's "soak before it binds", and the maintainer removed the
+  # switch on the ground that a concern which is off cannot soak: the flag made
+  # the soak it protected unreachable. Whether the gate fires is decided by each
+  # detector's own trigger conditions, which is the same shape `delegation-nudge`
+  # uses — no signal, no output. `hooks.turn_end_gate.*` is in REMOVED_KEYS.
   #
   # fail_closed: FALSE, deliberately and unlike every other blocking concern
   # here: a crash in a turn-end gate must let the turn END. Failing closed on

package/src/scripts/hooks/block_no_verify.ts

@@ -409,31 +409,104 @@ export function _looks_like_git_invocation(cmd: string, depth = 0): boolean {
  * Heredoc bodies are removed before extraction: a backtick or `$(` inside a
  * commit message being written to a file is data, and feeding it back through
  * this function is exactly the false positive the round-5 repair closed.
+ *
+ * ROUND 7 — THREAT MODEL for extending that removal to the shlex path (§ 2.1).
+ * Until round 7 the stripped string fed only `substitutionPayloads`; `shlexSplit`
+ * still received the RAW command. Both halves of that were measured, on this
+ * branch, before anything changed:
+ *
+ *   `git commit -F - <<'EOF' … maintainer's … EOF`   → BLOCKED   (false positive)
+ *   `bash <<EOF … git commit --no-verify … EOF`       → ALLOWED   (real bypass)
+ *
+ * So this is not the round-6 trade of one false positive for two false negatives.
+ * The bypass PRE-EXISTS: with the body inline, `shlexSplit` succeeds, the tokens
+ * are `bash <<EOF git commit --no-verify EOF`, command position is `bash`, and
+ * `_git_base` never sees git. Stripping before shlex fixes the false positive;
+ * scanning the bodies fixes the bypass. Both directions verified by probe.
+ *
+ * What an attacker can hide in a heredoc body, and how each is handled:
+ *
+ *   - a body consumed by a SHELL (`sh`/`bash`/`zsh`/`ksh`, with or without a path
+ *     prefix or an `env` prefix) IS a command list → scanned recursively.
+ *   - a body consumed by anything else (`git commit -F -`, `cat > f`, `tee`) is
+ *     DATA. Scanning it would re-open the exact false positive above, since a
+ *     commit message may legitimately contain the words `--no-verify`.
+ *   - an UNTERMINATED heredoc never matches the delimiter, so nothing is stripped
+ *     and the raw string still reaches shlex — the fail-closed branch keeps it.
+ */
+
+/** One heredoc: its body, and whether a shell is the thing consuming it. */
+interface Heredoc {
+    body: string;
+    shellConsumed: boolean;
+}
+
+/**
+ * Command position on the line that opens the heredoc is a shell interpreter, so
+ * the body is a command list rather than data. Anchored to the segment start or a
+ * shell separator, exactly like `_looks_like_git_invocation` does one level up —
+ * a bare mention of `bash` in an argument must not promote a message to code.
  */
+const _SHELL_CONSUMER_RE =
+    /(?:^|[|&;]|\$\(|`)\s*(?:env\s+(?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)*)?(?:\S*\/)?(?:ba|z|k)?sh\b/;
+
+export function _heredocs(cmd: string): { stripped: string; docs: Heredoc[] } {
+    const re = /<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1([\s\S]*?)^\s*\2\s*$/gm;
+    const docs: Heredoc[] = [];
+    let stripped = '';
+    let last = 0;
+    let m: RegExpExecArray | null;
+    while ((m = re.exec(cmd)) !== null) {
+        const lineStart = cmd.lastIndexOf('\n', m.index) + 1;
+        const prefix = cmd.slice(lineStart, m.index);
+        docs.push({ body: m[3] ?? '', shellConsumed: _SHELL_CONSUMER_RE.test(prefix) });
+        stripped += cmd.slice(last, m.index) + '<<HEREDOC';
+        last = m.index + m[0].length;
+    }
+    stripped += cmd.slice(last);
+    return { stripped, docs };
+}
+
 function _check_command(cmd: string, depth = 0): [boolean, string] {
+    // Round 7 § 2.2 — the stripped string now feeds shlex as well, not only the
+    // substitution scan. `<<HEREDOC` is a plain token, so an apostrophe in a
+    // commit message can no longer abort the parse of the command carrying it.
+    const { stripped, docs } = depth <= 3 ? _heredocs(cmd) : { stripped: cmd, docs: [] };
     if (depth <= 3) {
-        const withoutHeredocs = cmd.replace(
-            /<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1[\s\S]*?^\s*\2\s*$/gm,
-            '<<HEREDOC',
-        );
-        for (const payload of substitutionPayloads(withoutHeredocs)) {
+        for (const payload of substitutionPayloads(stripped)) {
             const [blocked, reason] = _check_command(payload, depth + 1);
             if (blocked) {
                 return [true, reason];
             }
         }
+        // A shell-consumed body is a command list, so it is checked like one.
+        for (const doc of docs) {
+            if (!doc.shellConsumed) {
+                continue;
+            }
+            const [blocked, reason] = _check_command(doc.body, depth + 1);
+            if (blocked) {
+                return [true, reason];
+            }
+        }
     }
     let tokens: string[];
     try {
-        tokens = shlexSplit(cmd);
+        tokens = shlexSplit(stripped);
     } catch (e) {
         if (e instanceof ShlexError) {
-            if (_looks_like_git_invocation(cmd)) {
+            // Tested against the string that actually failed to parse. Round 7
+            // § 2.4: the message no longer prescribes the message-in-a-file
+            // workaround, because a TERMINATED heredoc is now stripped before
+            // this point and can no longer be the cause. What reaches here is
+            // genuinely unbalanced quoting — an unterminated heredoc, or an odd
+            // quote outside one — which bash itself refuses to run.
+            if (_looks_like_git_invocation(stripped)) {
                 return [
                     true,
                     'command parse failed (shlex) on a git-containing command — fail-closed (git-history-discipline). \n'
-                    + 'Most common cause: an apostrophe or backtick inside a heredoc commit message in the SAME compound command as `git`. \n'
-                    + 'Fix: write the message to a file and use `git commit -F <file>` — do not retry the heredoc.',
+                    + 'The quoting is unbalanced OUTSIDE any terminated heredoc — an unterminated heredoc, or an odd quote. \n'
+                    + 'bash refuses this command too; fix the quoting rather than working around the guard.',
                 ];
             }
             return [false, ''];