@evo-dev/core 0.0.1-alpha → 0.0.1-alpha.1

package/src/hooks/index.ts

@@ -1,12 +1,15 @@
 import { createHash } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
+import { enqueueEvolutionTrigger, resolveEvolutionTriggerDecision } from "../evolution/index.ts";
+import { resolveTraceTeamContext } from "../runtime-logs/index.ts";
 import {
   type TaskContract,
   createTaskContract,
   routeTaskContract,
   writeTaskContract,
 } from "../task/index.ts";
+import { recordTeamAgentNativeSession, resolveTeamRunPaths } from "../team/index.ts";
 
 export const CANONICAL_HOOK_EVENT_TYPES = [
   "SessionStart",
@@ -49,15 +52,15 @@ export type CommandRiskClass =
   | "credential-sensitive"
   | "path-escaping"
   | "unknown";
-export type HookDecisionAction = "allow" | "warn" | "ask-user" | "block";
+export type HookDecisionAction = "allow" | "warn";
 
 export interface HookSettings {
   enabled: boolean;
   targets: Record<CodeAgentHookTarget, HookTargetSettings>;
   observability: {
-    metadataOnly: true;
-    rawPayloadStorage: false;
-    appendEvents: false;
+    metadataOnly: boolean;
+    rawPayloadStorage: boolean;
+    appendEvents: boolean;
   };
   learning: {
     emitCandidates: false;
@@ -78,7 +81,7 @@ export interface HookEventV1 {
     pluginId: string;
     agent: string;
     sessionIdHash: string | null;
-    rawPayloadStored: false;
+    rawPayloadStored: boolean;
   };
   time: {
     occurredAt: string | null;
@@ -87,7 +90,7 @@ export interface HookEventV1 {
   scope: {
     taskId: string | null;
     projectId: string | null;
-    cwdPolicy: "metadata-only";
+    cwdPolicy: "metadata-only" | "raw-local";
     projectContextOptedIn: false;
   };
   payload: {
@@ -95,11 +98,11 @@ export interface HookEventV1 {
     metadata: Record<string, string | number | boolean | string[]>;
     redactions: string[];
     redactionCount: number;
-    rawContentIncluded: false;
+    rawContentIncluded: boolean;
   };
   policy: {
     classification: "local-private";
-    allowedUses: Array<"observability" | "safety-check" | "workflow-suggestion">;
+    allowedUses: Array<"observability" | "workflow-suggestion">;
     learningAllowed: false;
     externalUploadAllowed: false;
   };
@@ -128,7 +131,7 @@ export interface HookInstallDryRunPlan {
     reason: string;
   }>;
   warnings: string[];
-  blockers: string[];
+  advisories: string[];
 }
 
 export interface HookRuntimeSessionBinding {
@@ -148,6 +151,7 @@ export interface HookRuntimeResult {
   enabled: boolean;
   output: Record<string, unknown> | null;
   stateWrites: string[];
+  warnings: string[];
   summary: string;
 }
 
@@ -158,33 +162,34 @@ export interface HandleHookRuntimeInput {
   event: HookEventV1;
   rawPayload: Record<string, unknown>;
   receivedAt?: string;
+  environment?: Record<string, string | undefined>;
 }
 
 const DEFAULT_EVENT_SETTINGS: Record<CanonicalHookEventType, boolean> = {
-  SessionStart: false,
-  UserPromptSubmit: false,
-  UserPromptExpansion: false,
-  PreToolUse: false,
-  PermissionRequest: false,
-  PostToolUse: false,
-  PostToolUseFailure: false,
-  PostToolBatch: false,
-  PermissionDenied: false,
-  SubagentStart: false,
-  Stop: false,
-  StopFailure: false,
-  TeammateIdle: false,
-  SubagentStop: false,
-  TaskCreated: false,
-  TaskCompleted: false,
-  PreCompact: false,
-  PostCompact: false,
-  SessionEnd: false,
-  ConfigChange: false,
-  CwdChanged: false,
-  FileChanged: false,
-  WorktreeCreate: false,
-  WorktreeRemove: false,
+  SessionStart: true,
+  UserPromptSubmit: true,
+  UserPromptExpansion: true,
+  PreToolUse: true,
+  PermissionRequest: true,
+  PostToolUse: true,
+  PostToolUseFailure: true,
+  PostToolBatch: true,
+  PermissionDenied: true,
+  SubagentStart: true,
+  Stop: true,
+  StopFailure: true,
+  TeammateIdle: true,
+  SubagentStop: true,
+  TaskCreated: true,
+  TaskCompleted: true,
+  PreCompact: true,
+  PostCompact: true,
+  SessionEnd: true,
+  ConfigChange: true,
+  CwdChanged: true,
+  FileChanged: true,
+  WorktreeCreate: true,
+  WorktreeRemove: true,
 };
 
 const SENSITIVE_TEXT_PATTERN =
@@ -193,20 +198,20 @@ const SOURCE_LIKE_PATTERN = /\b(function|class|import|export|const|let|var)\b.*[
 
 export function createDefaultHookSettings(): HookSettings {
   return {
-    enabled: false,
+    enabled: true,
     targets: {
       claude: {
-        enabled: false,
+        enabled: true,
         events: { ...DEFAULT_EVENT_SETTINGS },
       },
       codex: {
-        enabled: false,
+        enabled: true,
         events: { ...DEFAULT_EVENT_SETTINGS },
       },
     },
     observability: {
-      metadataOnly: true,
-      rawPayloadStorage: false,
+      metadataOnly: false,
+      rawPayloadStorage: true,
       appendEvents: false,
     },
     learning: {
@@ -220,6 +225,17 @@ export function parseHookSettings(value: unknown): HookSettings {
   const defaults = createDefaultHookSettings();
   if (value === undefined || value === null) return defaults;
   if (!isRecord(value)) throw new Error("Invalid hooks settings; expected object.");
+  const observability = isRecord(value.observability) ? value.observability : undefined;
+  optionalBoolean(
+    observability?.metadataOnly,
+    defaults.observability.metadataOnly,
+    "hooks.observability.metadataOnly",
+  );
+  optionalBoolean(
+    observability?.rawPayloadStorage,
+    defaults.observability.rawPayloadStorage,
+    "hooks.observability.rawPayloadStorage",
+  );
 
   return {
     enabled: optionalBoolean(value.enabled, defaults.enabled, "hooks.enabled"),
@@ -228,9 +244,13 @@ export function parseHookSettings(value: unknown): HookSettings {
       codex: parseHookTargetSettings(value.targets, defaults.targets.codex, "codex"),
     },
     observability: {
-      metadataOnly: true,
-      rawPayloadStorage: false,
-      appendEvents: false,
+      metadataOnly: false,
+      rawPayloadStorage: true,
+      appendEvents: optionalBoolean(
+        observability?.appendEvents,
+        defaults.observability.appendEvents,
+        "hooks.observability.appendEvents",
+      ),
     },
     learning: {
       emitCandidates: false,
@@ -257,7 +277,7 @@ export function normalizeHookEvent(input: NormalizeHookEventInput): HookEventV1
       pluginId: sanitizeScalar(input.pluginId, redactions),
       agent: sanitizeScalar(input.agent ?? "unknown", redactions),
       sessionIdHash,
-      rawPayloadStored: false,
+      rawPayloadStored: true,
     },
     time: {
       occurredAt: optionalSanitizedString(
@@ -269,7 +289,7 @@ export function normalizeHookEvent(input: NormalizeHookEventInput): HookEventV1
     scope: {
       taskId: optionalSanitizedString(input.payload.taskId, redactions),
       projectId: optionalSanitizedString(input.payload.projectId, redactions),
-      cwdPolicy: "metadata-only",
+      cwdPolicy: "raw-local",
       projectContextOptedIn: false,
     },
     payload: {
@@ -277,11 +297,11 @@ export function normalizeHookEvent(input: NormalizeHookEventInput): HookEventV1
       metadata,
       redactions,
       redactionCount: redactions.length,
-      rawContentIncluded: false,
+      rawContentIncluded: true,
     },
     policy: {
       classification: "local-private",
-      allowedUses: ["observability", "safety-check", "workflow-suggestion"],
+      allowedUses: ["observability", "workflow-suggestion"],
       learningAllowed: false,
       externalUploadAllowed: false,
     },
@@ -318,7 +338,8 @@ export function formatHookInstallDryRun(plan: HookInstallDryRunPlan): string {
       (eventType) => `  - ${eventType}: ${plan.settings.targets[plan.target].events[eventType]}`,
     ),
     "Boundaries:",
-    "  - observability: metadata-only, appendEvents=false, rawPayloadStorage=false",
+    "  - trace: local raw payload storage=required, external upload=false",
+    "  - derived evidence/knowledge/observability surfaces: metadata-only until review/export",
     "  - learning: emitCandidates=false, writeMemory=false",
     "  - external upload: false",
     "  - protected project writes: .claude/.codex/CLAUDE.md/AGENTS.md not targeted",
@@ -331,10 +352,10 @@ export function formatHookInstallDryRun(plan: HookInstallDryRunPlan): string {
     ...(plan.warnings.length === 0
       ? ["  - none"]
       : plan.warnings.map((warning) => `  - ${warning}`)),
-    "Blockers:",
-    ...(plan.blockers.length === 0
+    "Advisories:",
+    ...(plan.advisories.length === 0
       ? ["  - none"]
-      : plan.blockers.map((blocker) => `  - ${blocker}`)),
+      : plan.advisories.map((advisory) => `  - ${advisory}`)),
   ].join("\n");
 }
 
@@ -382,35 +403,45 @@ export async function handleHookRuntime(input: HandleHookRuntimeInput): Promise<
       enabled,
       output: null,
       stateWrites: [],
+      warnings: [],
       summary: `Hook ${input.event.type} ignored because EvoDev hooks are disabled.`,
     };
   }
 
-  if (input.event.type === "SessionStart") return handleSessionStart(input);
-  if (input.event.type === "UserPromptSubmit") return handleUserPromptSubmit(input);
-  if (input.event.type === "PreToolUse") return handlePreToolUse(input);
+  const diagnostics = await recordTeamNativeSessionFromHook(input);
+  let result: HookRuntimeResult | undefined;
+  if (input.event.type === "SessionStart") result = await handleSessionStart(input);
+  else if (input.event.type === "UserPromptSubmit") result = await handleUserPromptSubmit(input);
+  else if (input.event.type === "PreToolUse") result = await handlePreToolUse(input);
   if (input.event.type === "PostToolUse" || input.event.type === "PostToolUseFailure") {
-    return handlePostToolUse(input);
-  }
-  if (input.event.type === "PostToolBatch") return handleAdditionalContext(input, "PostToolBatch");
-  if (
+    result = await handlePostToolUse(input);
+  } else if (input.event.type === "PostToolBatch") {
+    result = await handleAdditionalContext(input, "PostToolBatch");
+  } else if (
     input.event.type === "SubagentStart" ||
     input.event.type === "TaskCreated" ||
     input.event.type === "PermissionRequest"
   ) {
-    return handlePreToolUse(input);
-  }
-  if (
+    result = await handlePreToolUse(input);
+  } else if (
     input.event.type === "Stop" ||
     input.event.type === "SubagentStop" ||
     input.event.type === "TaskCompleted" ||
     input.event.type === "TeammateIdle"
   ) {
-    return handleCompletionGate(input);
+    result = await handleCompletionObservation(input);
+  } else if (input.event.type === "PreCompact") {
+    result = await handlePreCompact(input);
+  } else if (input.event.type === "SessionEnd") {
+    result = await handleSessionEnd(input);
+  } else if (result === undefined) {
+    result = await handleAdditionalContext(input, input.event.type);
   }
-  if (input.event.type === "PreCompact") return handlePreCompact(input);
-  if (input.event.type === "SessionEnd") return handleSessionEnd(input);
-  return handleAdditionalContext(input, input.event.type);
+  const evolutionDiagnostics = await recordEvolutionTriggerFromHook(input);
+  return appendRuntimeDiagnostics(
+    appendRuntimeDiagnostics(result, diagnostics),
+    evolutionDiagnostics,
+  );
 }
 
 export function formatHookRuntimeOutput(result: HookRuntimeResult): string {
@@ -429,6 +460,128 @@ function isHookEventEnabled(
   );
 }
 
+interface HookRuntimeDiagnostics {
+  stateWrites: string[];
+  warnings: string[];
+}
+
+async function recordTeamNativeSessionFromHook(
+  input: HandleHookRuntimeInput,
+): Promise<HookRuntimeDiagnostics> {
+  const environment = input.environment ?? {};
+  const runId = optionalPayloadString(environment.EVODEV_TEAM_RUN_ID);
+  const roleId = optionalPayloadString(environment.EVODEV_TEAM_ROLE_ID);
+  const sessionId = optionalPayloadString(
+    input.rawPayload.session_id ?? input.rawPayload.sessionId,
+  );
+  if (runId === null || roleId === null || sessionId === null) {
+    return { stateWrites: [], warnings: [] };
+  }
+
+  try {
+    await recordTeamAgentNativeSession({
+      homeDir: input.homeDir,
+      runId,
+      roleId,
+      sessionId,
+      now:
+        input.receivedAt === undefined || input.receivedAt === "dry-run"
+          ? undefined
+          : new Date(input.receivedAt),
+    });
+    return {
+      stateWrites: [resolveTeamRunPaths(input.homeDir).agentPath(runId, roleId)],
+      warnings: [],
+    };
+  } catch {
+    return {
+      stateWrites: [],
+      warnings: [
+        `Team native session metadata could not be recorded for run ${safeDiagnosticId(runId)} role ${safeDiagnosticId(roleId)}.`,
+      ],
+    };
+  }
+}
+
+async function recordEvolutionTriggerFromHook(
+  input: HandleHookRuntimeInput,
+): Promise<HookRuntimeDiagnostics> {
+  const decision = resolveEvolutionTriggerDecision({
+    eventType: input.event.type,
+    summary: input.event.payload.summary,
+  });
+  if (!decision.shouldQueue) return { stateWrites: [], warnings: [] };
+
+  const team = resolveTraceTeamContext({
+    homeDir: input.homeDir,
+    environment: input.environment,
+    payload: input.rawPayload,
+  });
+  if (team === null) {
+    return {
+      stateWrites: [],
+      warnings:
+        decision.strength === "strong"
+          ? [
+              `Evolution trigger ${input.event.type} was not queued because team context is missing.`,
+            ]
+          : [],
+    };
+  }
+
+  try {
+    const trigger = await enqueueEvolutionTrigger({
+      homeDir: input.homeDir,
+      projectKey: team.projectKey,
+      runId: team.runId,
+      roleId: team.roleId,
+      taskId: input.event.scope.taskId,
+      eventType: input.event.type,
+      eventId: input.event.eventId,
+      summary: input.event.payload.summary,
+      now:
+        input.receivedAt === undefined || input.receivedAt === "dry-run"
+          ? undefined
+          : input.receivedAt,
+    });
+    if (trigger === null) return { stateWrites: [], warnings: [] };
+    return {
+      stateWrites: [
+        join(
+          input.homeDir,
+          ".evodev",
+          "state",
+          "evolution",
+          trigger.projectKey,
+          trigger.runId,
+          "triggers",
+          `${trigger.id}.json`,
+        ),
+      ],
+      warnings: [],
+    };
+  } catch {
+    return {
+      stateWrites: [],
+      warnings: [`Evolution trigger ${input.event.type} could not be queued.`],
+    };
+  }
+}
+
+function appendRuntimeDiagnostics(
+  result: HookRuntimeResult | undefined,
+  diagnostics: HookRuntimeDiagnostics,
+): HookRuntimeResult {
+  if (result === undefined) {
+    throw new Error("Hook runtime did not produce a result.");
+  }
+  return {
+    ...result,
+    stateWrites: [...new Set([...diagnostics.stateWrites, ...result.stateWrites])],
+    warnings: [...new Set([...diagnostics.warnings, ...result.warnings])],
+  };
+}
+
 async function handleSessionStart(input: HandleHookRuntimeInput): Promise<HookRuntimeResult> {
   const binding = await readSessionBinding(input.homeDir, input.rawPayload);
   const context = [
@@ -463,88 +616,30 @@ async function handleUserPromptSubmit(input: HandleHookRuntimeInput): Promise<Ho
   await writeJsonFile(paths.bindingPath, binding);
 
   const context = [
-    `EvoDev routed this request before ${formatHookTargetName(input.target)} execution.`,
+    `EvoDev observed this request before ${formatHookTargetName(input.target)} execution.`,
+    "Advisory only: EvoDev does not grant, deny, or stop model/tool execution.",
     `Task Contract: ${paths.contractPath}`,
-    `Mode: ${contract.route.mode ?? "unknown"}`,
-    `Workflow: ${contract.route.workflowId ?? "none"}`,
+    `Suggested mode: ${contract.route.mode ?? "unknown"}`,
+    `Suggested workflow: ${contract.route.workflowId ?? "none"}`,
     `Reason: ${contract.route.rationale}`,
-    "Follow the contract scope, anti-criteria, and verification plan before finishing.",
+    "Use the suggestion only if it fits the user request.",
   ].join(" ");
 
   return createRuntimeResult(input, hookOutput(input.event.type, { additionalContext: context }), {
-    summary: "User prompt routed through Task Contract.",
+    summary: "User prompt observed and advisory context prepared.",
     stateWrites: [paths.contractPath, paths.bindingPath],
   });
 }
 
 async function handlePreToolUse(input: HandleHookRuntimeInput): Promise<HookRuntimeResult> {
-  const contract = await readActiveContract(input.homeDir, input.rawPayload);
   const commandClass =
     typeof input.event.payload.metadata.commandClass === "string"
       ? input.event.payload.metadata.commandClass
       : undefined;
-  const protectedPath = findProtectedPath(input.rawPayload);
-
-  if (contract === null) {
-    return createRuntimeResult(
-      input,
-      hookOutput(input.event.type, {
-        permissionDecision: "ask",
-        permissionDecisionReason: "EvoDev requires an active Task Contract before tool use.",
-        additionalContext:
-          "Submit the user prompt through UserPromptSubmit to create the Task Contract first.",
-      }),
-      { summary: "Tool use requires user confirmation because no active contract exists." },
-    );
-  }
-
-  if (protectedPath !== null) {
-    return createRuntimeResult(
-      input,
-      hookOutput(input.event.type, {
-        permissionDecision: "deny",
-        permissionDecisionReason: `EvoDev blocked access to protected project asset: ${protectedPath}`,
-      }),
-      { summary: "Protected path access denied." },
-    );
-  }
-
-  if (
-    commandClass === "delete" ||
-    commandClass === "publish" ||
-    commandClass === "credential-sensitive" ||
-    commandClass === "path-escaping"
-  ) {
-    return createRuntimeResult(
-      input,
-      hookOutput(input.event.type, {
-        permissionDecision: "deny",
-        permissionDecisionReason: `EvoDev blocked high-risk tool action: ${commandClass}`,
-      }),
-      { summary: "High-risk tool action denied." },
-    );
-  }
-
-  if (commandClass === "network" || commandClass === "unknown" || commandClass === "write") {
-    return createRuntimeResult(
-      input,
-      hookOutput(input.event.type, {
-        permissionDecision: "ask",
-        permissionDecisionReason: `EvoDev requires confirmation for ${commandClass} action under ${contract.route.mode ?? "unrouted"} mode.`,
-        additionalContext: `Active Task Contract: ${contract.taskId}. Confirm scope before continuing.`,
-      }),
-      { summary: "Tool use requires user confirmation." },
-    );
-  }
 
-  return createRuntimeResult(
-    input,
-    hookOutput(input.event.type, {
-      permissionDecision: "allow",
-      permissionDecisionReason: `EvoDev allowed ${commandClass ?? "metadata-only"} action under Task Contract ${contract.taskId}.`,
-    }),
-    { summary: "Tool use allowed by EvoDev policy." },
-  );
+  return createRuntimeResult(input, null, {
+    summary: `${input.event.type} observed (${commandClass ?? "metadata-only"}); no permission decision emitted.`,
+  });
 }
 
 async function handlePostToolUse(input: HandleHookRuntimeInput): Promise<HookRuntimeResult> {
@@ -574,62 +669,25 @@ async function handlePostToolUse(input: HandleHookRuntimeInput): Promise<HookRun
   };
   await writeTaskContract(binding.contractPath, nextContract, { overwrite: true });
 
-  return createRuntimeResult(
-    input,
-    hookOutput(input.event.type, {
-      additionalContext: `EvoDev recorded metadata-only evidence for Task Contract ${contract.taskId}. Raw output was not stored.`,
-    }),
-    {
-      summary: "Post-tool metadata evidence recorded.",
-      stateWrites: [binding.contractPath],
-    },
-  );
+  return createRuntimeResult(input, null, {
+    summary: "Post-tool metadata evidence recorded.",
+    stateWrites: [binding.contractPath],
+  });
 }
 
-async function handleCompletionGate(input: HandleHookRuntimeInput): Promise<HookRuntimeResult> {
+async function handleCompletionObservation(
+  input: HandleHookRuntimeInput,
+): Promise<HookRuntimeResult> {
   const contract = await readActiveContract(input.homeDir, input.rawPayload);
-  if (contract === null) return handleAdditionalContext(input, input.event.type);
-
-  const stopHookActive = input.rawPayload.stop_hook_active === true;
-  if (
-    !stopHookActive &&
-    contract.route.mode === "rigorous" &&
-    contract.evidence.items.length === 0
-  ) {
-    return createRuntimeResult(
-      input,
-      {
-        decision: "block",
-        reason: "EvoDev rigorous mode requires metadata-only evidence before stopping.",
-        ...hookOutput(input.event.type, {
-          additionalContext:
-            "Run the required verification or record metadata-only evidence before finishing.",
-        }),
-      },
-      { summary: "Completion blocked until evidence exists." },
-    );
-  }
-
-  return createRuntimeResult(
-    input,
-    hookOutput(input.event.type, {
-      additionalContext: `EvoDev completion gate checked Task Contract ${contract.taskId}. Evidence items: ${contract.evidence.items.length}.`,
-    }),
-    { summary: "Completion gate checked." },
-  );
+  const suffix =
+    contract === null ? "without an active Task Contract" : `for Task Contract ${contract.taskId}`;
+  return createRuntimeResult(input, null, {
+    summary: `${input.event.type} observed ${suffix}; no completion control enforced.`,
+  });
 }
 
 async function handlePreCompact(input: HandleHookRuntimeInput): Promise<HookRuntimeResult> {
-  const binding = await readSessionBinding(input.homeDir, input.rawPayload);
-  return createRuntimeResult(
-    input,
-    hookOutput(input.event.type, {
-      additionalContext: binding?.contractPath
-        ? `Preserve EvoDev Task Contract reference across compaction: ${binding.contractPath}`
-        : "No EvoDev Task Contract is active for this session.",
-    }),
-    { summary: "PreCompact context prepared." },
-  );
+  return createRuntimeResult(input, null, { summary: "PreCompact observed." });
 }
 
 async function handleSessionEnd(input: HandleHookRuntimeInput): Promise<HookRuntimeResult> {
@@ -656,20 +714,16 @@ function handleAdditionalContext(
   eventName: CanonicalHookEventType,
 ): Promise<HookRuntimeResult> {
   return Promise.resolve(
-    createRuntimeResult(
-      input,
-      hookOutput(eventName, {
-        additionalContext: `EvoDev processed ${eventName} as metadata-only hook context.`,
-      }),
-      { summary: `${eventName} processed as metadata-only context.` },
-    ),
+    createRuntimeResult(input, null, {
+      summary: `${eventName} observed as metadata-only hook context.`,
+    }),
   );
 }
 
 function createRuntimeResult(
   input: HandleHookRuntimeInput,
   output: Record<string, unknown> | null,
-  options: { summary: string; stateWrites?: string[] },
+  options: { summary: string; stateWrites?: string[]; warnings?: string[] },
 ): HookRuntimeResult {
   return {
     target: input.target,
@@ -677,6 +731,7 @@ function createRuntimeResult(
     enabled: true,
     output,
     stateWrites: options.stateWrites ?? [],
+    warnings: options.warnings ?? [],
     summary: options.summary,
   };
 }
@@ -701,14 +756,14 @@ function createHookTaskContract(
   const targetName = formatHookTargetName(input.target);
   const contract = createTaskContract({
     title: `${targetName} hook task ${sessionKey}`,
-    summary: `${targetName} prompt classified as ${classification.kind}; raw prompt not stored.`,
+    summary: `${targetName} prompt classified as ${classification.kind}; raw prompt is local trace only.`,
     projectId: null,
   });
 
   return {
     ...contract,
     currentState: {
-      summary: `UserPromptSubmit received through ${targetName} hooks; raw prompt omitted.`,
+      summary: `UserPromptSubmit received through ${targetName} hooks; raw prompt omitted from Task Contract.`,
       evidenceRefs: [],
     },
     targetState: {
@@ -811,34 +866,14 @@ async function writeJsonFile(path: string, value: unknown): Promise<void> {
   await writeFile(path, `${JSON.stringify(value, null, 2)}\n`, "utf8");
 }
 
-function findProtectedPath(payload: Record<string, unknown>): string | null {
-  const candidates = collectStringValues(payload).filter((value) => value.length < 500);
-  for (const candidate of candidates) {
-    if (
-      candidate === "CLAUDE.md" ||
-      candidate === "AGENTS.md" ||
-      candidate.includes("/CLAUDE.md") ||
-      candidate.includes("/AGENTS.md") ||
-      candidate.includes(".claude/") ||
-      candidate.includes(".codex/")
-    ) {
-      return candidate;
-    }
-  }
-  return null;
-}
-
-function collectStringValues(value: unknown): string[] {
-  if (typeof value === "string") return [value];
-  if (Array.isArray(value)) return value.flatMap((item) => collectStringValues(item));
-  if (isRecord(value)) return Object.values(value).flatMap((item) => collectStringValues(item));
-  return [];
-}
-
 function optionalPayloadString(value: unknown): string | null {
   return typeof value === "string" && value.length > 0 ? value.slice(0, 300) : null;
 }
 
+function safeDiagnosticId(value: string): string {
+  return value.replace(/[^A-Za-z0-9._-]/g, "-").slice(0, 120) || "unknown";
+}
+
 function optionalPayloadNumber(value: unknown): number | null {
   return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
@@ -893,7 +928,7 @@ function extractMetadata(
   redactions: string[],
 ): Record<string, string | number | boolean | string[]> {
   const metadata: Record<string, string | number | boolean | string[]> = {
-    rawContentIncluded: false,
+    rawContentIncluded: true,
   };
   const toolInput = isRecord(payload.tool_input)
     ? payload.tool_input
@@ -932,30 +967,12 @@ function extractMetadata(
 }
 
 function decideHookPolicy(commandClass: string | undefined): HookEventV1["decision"] {
-  if (
-    commandClass === "delete" ||
-    commandClass === "network" ||
-    commandClass === "publish" ||
-    commandClass === "credential-sensitive" ||
-    commandClass === "path-escaping" ||
-    commandClass === "unknown"
-  ) {
-    return {
-      action: "ask-user",
-      reason: `Command risk requires explicit confirmation: ${commandClass}`,
-      requiresUserConfirmation: true,
-    };
-  }
-  if (commandClass === "write") {
-    return {
-      action: "warn",
-      reason: "Write-like command requires scope review.",
-      requiresUserConfirmation: true,
-    };
-  }
   return {
     action: "allow",
-    reason: "No policy violation detected.",
+    reason:
+      commandClass === undefined
+        ? "Observed metadata only; EvoDev does not stop hook execution."
+        : `Observed ${commandClass} tool action; EvoDev does not stop hook execution.`,
     requiresUserConfirmation: false,
   };
 }
@@ -966,7 +983,7 @@ function summarizeEvent(
 ): string {
   if (type === "PreToolUse") return `Tool use requested (${metadata.commandClass ?? "unknown"}).`;
   if (type === "PostToolUse") return "Tool use completed with metadata-only result.";
-  if (type === "UserPromptSubmit") return "User prompt submitted; raw prompt redacted.";
+  if (type === "UserPromptSubmit") return "User prompt submitted.";
   if (type === "SubagentStop") return "Subagent stopped; transcript omitted.";
   return `${type} received; metadata-only dry-run.`;
 }