@getarbiter/cli 0.5.0

package/dist/templates/claude/hooks/pre-edit-ssot-guard.mjs

@@ -0,0 +1,204 @@
+#!/usr/bin/env node
+// Arbiter hook: hard-block edits to governance/SSOT documents
+// Fires on: PreToolUse → Edit|Write
+// Exit 2: block — stderr returned to Claude as error context; user is NOT prompted
+//
+// Bypass (#2045 — both now logged to .arbiter/evidence/bypass-log.jsonl):
+//   1. ARBITER_SSOT_BYPASS=1 (session-scoped — see CONTRIBUTING.md). Logged on every
+//      hook invocation while set, parity with pre-edit-plan-anchor's ARBITER_PLAN_BYPASS
+//      accounting (#1949) — no longer a silent exit.
+//   2. One-shot file at .arbiter/ssot-bypass, PATH-SCOPED since #2493: line 1 is the
+//      path the bypass authorizes (repo-relative or absolute), lines 2+ are the reason.
+//      It is honoured ONLY for that exact path and consumed only by an attempt on it, so
+//      a marker written to authorize X can no longer be spent authorizing an edit to Y.
+//      A marker naming no target authorizes nothing (and is consumed, so it cannot
+//      linger looking live).
+//
+// Anchoring (#2493): every repo-relative decision below — `rel`, the arbiter.json
+// pattern read, the marker location, the file-bypass evidence log — is anchored at the
+// worktree the EDITED FILE lives in (`git -C <the file's dir> rev-parse --show-toplevel`),
+// not at the hook process's cwd. Anchoring at the process cwd silently un-guarded every
+// sanctioned worktree: `arbiter worktree open` places those at
+// `<repoParent>/<repoName>.worktrees/<slug>` (src/worktree/paths.ts), a SIBLING of the
+// main root, so `relative(mainRoot, fileInWorktree)` began with '..' and the guard
+// exited 0 before matching a single pattern. Repo MEMBERSHIP is NOT re-derived here —
+// isPathInThisRepo() owns it (git identity, not a path prefix; see lib.mjs); this anchor
+// only decides WHICH worktree's state to read.
+//
+// Guarded paths: DEFAULT_SSOT_PATTERNS below, extended with arbiter.json
+// `governance.ssotGuardPatterns` (array of repo-relative substrings) when present.
+// Additive only — config cannot remove a default-guarded path.
+import { spawnSync } from 'node:child_process'
+import { resolve, relative, join, dirname } from 'node:path'
+import { readFileSync, existsSync, rmSync, mkdirSync, appendFileSync } from 'node:fs'
+import { resolveToolInputPath, isPathInThisRepo } from './lib.mjs'
+
+const DEFAULT_SSOT_PATTERNS = [
+  'AGENTS.md',
+  '.claude/CLAUDE.md',
+  '.agents/CODEX.md',
+  'docs/METHOD/',
+  'docs/SYSTEM/DECISIONS',
+  'docs/SYSTEM/CANON.md',
+  'docs/ADR/',
+]
+
+// Best-effort bypass accounting (#1949 handoff, extended #2045) — never blocks, never
+// changes user-facing behavior. Inlined (hooks cannot import scripts/lib) from the
+// defensive shape of appendJsonl in scripts/lib/loud-bypass.mjs.
+function logBypass(repoRoot, record) {
+  try {
+    const logPath = join(repoRoot, '.arbiter', 'evidence', 'bypass-log.jsonl')
+    mkdirSync(dirname(logPath), { recursive: true })
+    appendFileSync(
+      logPath,
+      JSON.stringify({ ts: new Date().toISOString(), ...record }) + '\n',
+      'utf-8',
+    )
+  } catch (err) {
+    try {
+      process.stderr.write(
+        `arbiter-bypass log-append-failed gate=pre-edit-ssot-guard err=${String(err?.message ?? err)}\n`,
+      )
+      // FAIL-OPEN-INTENT: stderr write itself is best-effort bypass accounting, never the gate — must not block or throw past the bypass exit below (mirrors pre-edit-plan-anchor.mjs.ejs).
+    } catch {
+      /* swallow */
+    }
+  }
+}
+
+/** Nearest existing ancestor directory of `abs` — a Write may target a not-yet-created tree. */
+function nearestExistingDir(abs) {
+  let dir = dirname(abs)
+  for (;;) {
+    if (existsSync(dir)) return dir
+    const parent = dirname(dir)
+    if (parent === dir) return null
+    dir = parent
+  }
+}
+
+/** Worktree root that owns `abs` (#2493), or null when git cannot name one. */
+function worktreeRootFor(abs) {
+  const dir = nearestExistingDir(abs)
+  if (dir === null) return null
+  const r = spawnSync('git', ['-C', dir, 'rev-parse', '--show-toplevel'], { encoding: 'utf-8' })
+  if (r.status !== 0) return null
+  return r.stdout.trim() || null
+}
+
+// The hook PROCESS's own checkout. Used only for the session-scoped env-var bypass
+// accounting below, which fires before repo membership is known — anchoring that log at
+// the edited file instead would write evidence into whatever foreign repo it belongs to.
+// Falls back to CWD when git is unavailable (e.g. an rsync temp dir).
+const selfResult = spawnSync('git', ['rev-parse', '--show-toplevel'], {
+  encoding: 'utf-8',
+})
+const selfRoot = selfResult.stdout.trim() || process.cwd()
+
+// fd 0 is consumable once, so this must be read before any branch that exits.
+const file = resolveToolInputPath()
+
+if (process.env.ARBITER_SSOT_BYPASS === '1') {
+  logBypass(selfRoot, {
+    env: 'ARBITER_SSOT_BYPASS',
+    value: '1',
+    bypassed: true,
+    gate: 'pre-edit-ssot-guard',
+  })
+  process.exit(0)
+}
+
+// #565: another repo's governance documents are not this repo's SSOT. The `rel` anchor
+// below is cwd-derived, so with the session cwd inside that repo its own AGENTS.md would
+// otherwise match — which is how a sibling repo's edit got blocked from here.
+if (!isPathInThisRepo(file)) process.exit(0)
+
+const absFile = resolve(file)
+// #2493: anchor at the EDITED FILE's worktree, not this process's cwd. Fail-closed
+// (INV-96) when git cannot name one: fall back to this process's root rather than
+// skipping the guard.
+const repoRoot = worktreeRootFor(absFile) ?? selfRoot
+const relRaw = relative(repoRoot, absFile)
+
+// Membership was already settled above by isPathInThisRepo (git identity). A '..' here
+// therefore means the ANCHOR is wrong, not that the file is foreign — and the pre-#2493
+// code exited 0 on exactly this condition, which is what left every sibling worktree
+// unguarded. Match on the absolute path instead so a mis-anchored in-repo file stays
+// guarded; foreign paths never reach this line.
+const rel = relRaw.startsWith('..') ? absFile : relRaw
+
+// Config-driven guarded-path list (#2045): read arbiter.json at runtime rather than
+// baking the pattern list into this file, so adding a guarded path never requires
+// touching (or regenerating) the hook. `governance.ssotGuardPatterns` ADDS to
+// DEFAULT_SSOT_PATTERNS — it cannot subtract from it, so a config typo or an empty
+// list can never silently drop coverage for AGENTS.md et al. Fail-open to just the
+// defaults on any read/parse error or an absent/malformed key.
+function loadSsotPatterns(root) {
+  try {
+    const cfg = JSON.parse(readFileSync(join(root, 'arbiter.json'), 'utf-8'))
+    const extra = cfg?.governance?.ssotGuardPatterns
+    if (Array.isArray(extra) && extra.every((p) => typeof p === 'string')) {
+      return [...DEFAULT_SSOT_PATTERNS, ...extra]
+    }
+    // FAIL-OPEN-INTENT: an absent/malformed ssotGuardPatterns falls through to DEFAULT_SSOT_PATTERNS below, never to "no guard".
+  } catch {
+    // FAIL-OPEN-INTENT: an unreadable/invalid arbiter.json falls through to DEFAULT_SSOT_PATTERNS below, never to "no guard".
+  }
+  return DEFAULT_SSOT_PATTERNS
+}
+
+const SSOT_PATTERNS = loadSsotPatterns(repoRoot)
+
+const matched = SSOT_PATTERNS.some((pattern) => rel.includes(pattern))
+if (!matched) process.exit(0)
+
+// One-shot file bypass (#2045), PATH-SCOPED since #2493: line 1 names the single path
+// the marker authorizes, lines 2+ carry the reason. Anchored at the edited file's own
+// worktree, so a marker written in one worktree cannot authorize an edit in another.
+const BYPASS_FILE = join(repoRoot, '.arbiter', 'ssot-bypass')
+if (existsSync(BYPASS_FILE)) {
+  let raw = ''
+  try {
+    raw = readFileSync(BYPASS_FILE, 'utf-8')
+    // FAIL-OPEN-INTENT: an unreadable bypass file is treated as an empty marker (falls through to blocked below), never throws past the guard decision.
+  } catch {
+    raw = ''
+  }
+  const lines = raw.split('\n')
+  const target = (lines[0] ?? '').trim()
+  const reason = lines.slice(1).join('\n').trim()
+  // An UNSCOPED marker (no target line) authorizes nothing — that shape is exactly the
+  // #2493 defect, where a marker meant for X was silently spent on Y. It is still
+  // consumed so a malformed file cannot sit around looking like a live authorization.
+  const authorizes = target.length > 0 && resolve(repoRoot, target) === absFile
+  if (target.length === 0 || authorizes) {
+    try {
+      rmSync(BYPASS_FILE, { force: true })
+      // FAIL-OPEN-INTENT: a deletion failure must not block the bypass/deny decision below — best-effort one-shot consumption.
+    } catch {
+      /* best-effort deletion; the bypass/deny decision below proceeds regardless */
+    }
+  }
+  // A marker for a DIFFERENT path is left in place: it is one-shot for ITS target, and
+  // an unrelated attempt must not be able to destroy a pending authorization either.
+  if (authorizes && reason.length > 0) {
+    logBypass(repoRoot, {
+      file: rel,
+      target,
+      reason,
+      bypassed: true,
+      gate: 'pre-edit-ssot-guard',
+      mechanism: 'file',
+    })
+    process.exit(0)
+  }
+}
+
+process.stderr.write(
+  `[arbiter] SSOT GUARD: ${file} is a high-authority governance document.\n` +
+    `Editing requires explicit ADR or amendment. Set ARBITER_SSOT_BYPASS=1 for a session-scoped\n` +
+    `bypass, or write "<path>\\n<reason>" (path on line 1, reason on line 2) to\n` +
+    `${join(relative(process.cwd(), repoRoot) || '.', '.arbiter', 'ssot-bypass')} for a one-shot bypass of THAT path on retry.\n`,
+)
+process.exit(2)

package/dist/templates/claude/hooks/pre-spawn-worktree-guard.mjs

@@ -0,0 +1,129 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// Arbiter hook: spawn-time worktree guard (E5, #1947, design doc §E5).
+// Fires on: PreToolUse → Task|Agent (sub-agent dispatch)
+// Exit 2 (hard grading only): block — stderr returned to Claude as error context
+// Exit 0: advisory (soft grading, default) — same stderr warning, does not block
+//
+// ACTIVATED advisory per OD-14 (2026-07-17): wired into .claude/settings.json's
+// PreToolUse matchers at soft/advisory grading by default. Set
+// ARBITER_SPAWN_GUARD_HARD=1 to promote to hard (exit 2) blocking, mirroring
+// stop-finding-loss.mjs's advisory/hard knob (see docs/design/anti-context-rot-enforcers.md §E5).
+//
+// Mechanically flags (advisory) or refuses (hard) spawning a second write-intent
+// sub-agent into the main working tree — the one failure mode with a confirmed
+// real incident (R3, 2026-03-01). Also carries the M2 one-task-per-dispatch check.
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs'
+import { join } from 'node:path'
+import { getRepoRoot, SIDECAR_PATH, readJsonOrNull, pruneStaleSidecarEntries } from './lib.mjs'
+
+const WRITE_CLASSES_PATH = join('.claude', 'agents', 'agent-write-classes.json')
+
+/** Loads the {agent: "read-only"|"write-intent"} classification map, root-relative. */
+function loadWriteClasses(root) {
+  const doc = readJsonOrNull(join(root, WRITE_CLASSES_PATH))
+  return doc && typeof doc.classes === 'object' && doc.classes !== null ? doc.classes : {}
+}
+
+/** True when cwd sits under a `<name>.worktrees/` sibling directory (any depth). */
+function isWorktreeCwd(cwd) {
+  if (typeof cwd !== 'string' || cwd.length === 0) return false
+  return /(^|[/\\])[^/\\]+\.worktrees([/\\]|$)/.test(cwd)
+}
+
+function countTaskIds(prompt) {
+  if (typeof prompt !== 'string') return 0
+  const matches = prompt.match(/#\d+/g)
+  return matches ? new Set(matches).size : 0
+}
+
+function main() {
+  let input = {}
+  try {
+    input = JSON.parse(readFileSync(0, 'utf-8')) ?? {}
+    // FAIL-OPEN-INTENT: unreadable/non-JSON stdin — a guard that cannot read the dispatch payload must not block an unrelated tool call.
+  } catch {
+    process.exit(0)
+  }
+
+  const toolInput = input.tool_input ?? {}
+  const subagentType = toolInput.subagent_type
+  const isolation = toolInput.isolation
+  const cwd = toolInput.cwd
+  const prompt = toolInput.prompt
+
+  const root = getRepoRoot()
+  const writeClasses = loadWriteClasses(root)
+
+  // 1. Classify write-intent. Unknown type => write-intent (fail-closed).
+  const classification =
+    typeof subagentType === 'string' && writeClasses[subagentType] === 'read-only'
+      ? 'read-only'
+      : 'write-intent'
+
+  if (classification === 'read-only') process.exit(0) // M7 firewall path stays frictionless
+
+  // 2. Write-intent path: allowed iff isolated in a worktree.
+  const inWorktree = isolation === 'worktree' || isWorktreeCwd(cwd)
+
+  const HARD_GRADING = process.env.ARBITER_SPAWN_GUARD_HARD === '1'
+
+  const sidecarPath = join(root, SIDECAR_PATH)
+  const now = Date.now()
+  const existing = readJsonOrNull(sidecarPath)
+  const entries = pruneStaleSidecarEntries(Array.isArray(existing) ? existing : [], now)
+
+  if (!inWorktree && entries.length > 0) {
+    const message =
+      `[arbiter] SPAWN GUARD: a write-intent agent is already active on the main working tree.\n` +
+      `Second write-agent on the main tree is blocked — open a worktree: \`/wt-open\` (ADR-103).\n`
+    if (HARD_GRADING) {
+      process.stderr.write(message)
+      process.exit(2)
+    }
+    process.stderr.write(message) // advisory: soft grading always exits 0
+    process.exit(0)
+  }
+
+  // 3. One-task-per-dispatch (M2): count distinct #NNN ids in the prompt. Checked
+  // BEFORE registering the sidecar entry — a rejected spawn must never occupy a slot
+  // (#2403: registering first let a rejected M2 spawn wedge the 2h TTL for nothing).
+  const taskIdCount = countTaskIds(prompt)
+  if (taskIdCount > 1) {
+    const message =
+      `[arbiter] SPAWN GUARD: dispatch prompt references ${taskIdCount} distinct task ids — ` +
+      `one-task-per-dispatch (M2) requires exactly one.\n`
+    if (HARD_GRADING) {
+      process.stderr.write(message)
+      process.exit(2)
+    }
+    process.stderr.write(message) // advisory: soft grading always exits 0
+    process.exit(0)
+  }
+
+  // No other writer on the main tree, no M2 violation — allow and register.
+  const updated = [
+    ...entries,
+    { agent: subagentType ?? 'unknown', ts: now, pid: process.pid, cwd: cwd ?? root },
+  ]
+  try {
+    mkdirSync(join(root, '.arbiter'), { recursive: true })
+    writeFileSync(sidecarPath, JSON.stringify(updated, null, 2) + '\n')
+    // FAIL-OPEN-INTENT: best-effort bookkeeping — a sidecar write failure must not block a legal spawn.
+  } catch {
+    void 0
+  }
+
+  process.exit(0)
+}
+
+// Top-level guard: an unexpected crash in main() must fail closed (exit 1), never fall
+// through to the shell's default success exit code, which a hook harness would read as allow.
+try {
+  main()
+} catch (err) {
+  process.stderr.write(
+    `[arbiter] SPAWN GUARD: unexpected error — ${err instanceof Error ? err.message : String(err)}\n`,
+  )
+  process.exit(1)
+}

package/dist/templates/claude/hooks/skill-forced-eval.mjs.ejs

@@ -0,0 +1,281 @@
+#!/usr/bin/env node
+// Arbiter hook: phase-aware TDD evidence gate (#2383)
+// Hook type: UserPromptSubmit — fires before every user prompt
+// UserPromptSubmit runs before the assistant can invoke a skill, so this gate is retrospective:
+// it blocks only after a successful implementation edit is already present in the transcript.
+import {
+  existsSync,
+  lstatSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+} from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, isAbsolute, join, resolve, sep } from 'node:path';
+import { getRepoRoot } from './lib.mjs';
+
+const IMPLEMENTATION_PHASES = new Set(['red', 'green', 'refactor']);
+const KNOWN_PHASES = new Set([
+  'preflight',
+  'plan',
+  'red-team-review',
+  'red-team-rework',
+  'red',
+  'green',
+  'refactor',
+  'verification',
+  'close',
+  'complete',
+]);
+const EDIT_TOOLS = new Set(['edit', 'write', 'notebookedit', 'multiedit']);
+const MAX_TRANSCRIPT_BYTES = 8 * 1024 * 1024;
+const MAX_TRANSCRIPT_LINES = 100000;
+const SESSION_ID = /^[A-Za-z0-9_-]{1,128}$/;
+
+const root = getRepoRoot();
+const input = readHookInput();
+if (input === null) process.exit(0);
+if (typeof input.session_id !== 'string' || !SESSION_ID.test(input.session_id)) {
+  block('parseable hook input has no valid session_id');
+}
+const state = readPhaseState(root);
+if (state.error) block(state.error);
+if (typeof input.prompt === 'string' && input.prompt.trim() === '/tdd') process.exit(0);
+if (!IMPLEMENTATION_PHASES.has(state.phase)) {
+  if (state.phase === 'plan') {
+    process.stdout.write('━━━ PLAN MODE — no file edits or code until human says GO ━━━\n');
+  } else if (state.phase === 'verification') {
+    process.stdout.write(
+      '━━━ VERIFICATION MODE ━━━\n' +
+        'Run the verification skill, then <%= testCommand %> before committing.\n',
+    );
+  }
+  process.exit(0);
+}
+const transcript = readTranscript(input, root);
+if (transcript === null) process.exit(0);
+const verdict = inspectTranscript(transcript, state.startedAt);
+if (verdict.error) block(verdict.error);
+if (!verdict.editObserved) process.exit(0);
+if (!verdict.skillBeforeFirstEdit) {
+  block(
+    `phase ${state.phase} contains an implementation edit without a successful Skill(tdd) result before it`,
+  );
+}
+process.exit(0);
+
+function readHookInput() {
+  let raw;
+  try {
+    raw = readFileSync(0, 'utf-8');
+  } catch {
+    // FAIL-OPEN-INTENT: the host did not provide stdin, so no current-turn evidence can be read.
+    return null;
+  }
+  if (!raw.trim()) return null;
+
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    // FAIL-OPEN-INTENT: non-JSON stdin is an unavailable Claude hook envelope.
+    return null;
+  }
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    block('parseable hook input is not an object');
+  }
+  return parsed;
+}
+
+function readPhaseState(repoRoot) {
+  const path = join(repoRoot, '.claude', '.task', 'status.json');
+  if (!existsSync(path)) return { phase: 'unknown' };
+
+  let state;
+  try {
+    state = JSON.parse(readFileSync(path, 'utf-8'));
+  } catch {
+    return { error: 'task state is unreadable; repair .claude/.task/status.json before editing' };
+  }
+  if (!state || typeof state !== 'object' || Array.isArray(state)) {
+    return { error: 'task state is not a JSON object; repair .claude/.task/status.json' };
+  }
+
+  const rawPhase = state.phase;
+  if (rawPhase === undefined || rawPhase === 'unknown') return { phase: 'unknown' };
+  if (typeof rawPhase !== 'string') {
+    return { error: 'task state phase is not a string; repair .claude/.task/status.json' };
+  }
+  const phase = rawPhase === 'implementation' ? 'red' : rawPhase;
+  // FAIL-OPEN-INTENT: a newer task phase is outside this hook's contract; the phase gate stands down
+  // until the hook learns it, while the task/gate lifecycle remains authoritative.
+  if (!KNOWN_PHASES.has(phase)) return { phase: 'unknown' };
+  if (!IMPLEMENTATION_PHASES.has(phase)) return { phase };
+
+  const timestamps = state.timestamps;
+  if (!timestamps || typeof timestamps !== 'object' || Array.isArray(timestamps)) {
+    return { error: `task state has no timestamp for active phase ${phase}` };
+  }
+  const timestamp = timestamps[rawPhase] ?? timestamps[phase];
+  const startedAt = typeof timestamp === 'string' ? Date.parse(timestamp) : Number.NaN;
+  if (Number.isNaN(startedAt)) return { error: `task state timestamp for phase ${phase} is invalid` };
+  return { phase, startedAt };
+}
+
+function readTranscript(event, repoRoot) {
+  const path = event.transcript_path;
+  if (typeof path !== 'string' || path.length === 0) {
+    // FAIL-OPEN-INTENT: Claude may omit transcript_path on hosts without local transcript access.
+    return null;
+  }
+  if (!isAbsolute(path)) block('transcript_path must be absolute');
+
+  const projectRoot = projectPath(event.cwd, repoRoot);
+  const expectedDir = join(homedir(), '.claude', 'projects', encodeProjectPath(projectRoot));
+  const expectedPath = join(expectedDir, `${event.session_id}.jsonl`);
+  if (resolve(path) !== resolve(expectedPath) || basename(path) !== `${event.session_id}.jsonl`) {
+    block('transcript_path is not the current session transcript for this project');
+  }
+
+  let raw;
+  try {
+    const linkStat = lstatSync(path);
+    if (!linkStat.isFile() || linkStat.isSymbolicLink()) block('transcript_path must be a regular file');
+    const canonical = realpathSync(path);
+    if (canonical !== resolve(path)) block('transcript_path must not resolve through a symlink');
+    const size = statSync(path).size;
+    if (size > MAX_TRANSCRIPT_BYTES) block(`transcript exceeds ${MAX_TRANSCRIPT_BYTES} bytes`);
+    raw = readFileSync(path, 'utf-8');
+  } catch (error) {
+    if (error?.code === 'ELOOP') block('transcript_path contains a symlink loop');
+    // FAIL-OPEN-INTENT: absent or unavailable host transcript cannot be correlated by this hook.
+    return null;
+  }
+  const lineCount = raw.split('\n').length;
+  if (lineCount > MAX_TRANSCRIPT_LINES) block(`transcript exceeds ${MAX_TRANSCRIPT_LINES} lines`);
+  return raw;
+}
+
+function projectPath(cwd, repoRoot) {
+  if (typeof cwd !== 'string' || !isAbsolute(cwd)) return repoRoot;
+  try {
+    const resolved = realpathSync(cwd);
+    if (resolved === repoRoot || resolved.startsWith(`${repoRoot}${sep}`)) return resolved;
+  } catch {
+    block('hook cwd is not a readable project directory');
+  }
+  block('hook cwd is outside the current repository');
+}
+
+function encodeProjectPath(path) {
+  return path.replace(/[^A-Za-z0-9]/g, '-');
+}
+
+function inspectTranscript(raw, startedAt) {
+  const lines = raw.split('\n');
+  const lastNonEmpty = lines.reduce((last, line, index) => (line.trim() ? index : last), -1);
+  const uses = new Map();
+  const results = new Map();
+  let sequence = 0;
+
+  for (let index = 0; index < lines.length; index += 1) {
+    const text = lines[index].trim();
+    if (!text) continue;
+
+    let record;
+    try {
+      record = JSON.parse(text);
+    } catch {
+      if (index === lastNonEmpty) continue;
+      return { error: `transcript record ${index + 1} is malformed` };
+    }
+    if (!record || typeof record !== 'object' || Array.isArray(record)) {
+      return { error: `transcript record ${index + 1} is not an object` };
+    }
+
+    const content = record.message?.content;
+    if (!Array.isArray(content)) continue;
+    for (const blockValue of content) {
+      if (!blockValue || typeof blockValue !== 'object' || Array.isArray(blockValue)) {
+        return { error: `transcript record ${index + 1} contains an invalid content block` };
+      }
+      if (blockValue.type === 'tool_use') {
+        if (record.message?.role !== 'assistant') {
+          return { error: `transcript record ${index + 1} has a tool call outside an assistant message` };
+        }
+        if (typeof blockValue.id !== 'string' || blockValue.id.trim() === '') {
+          return { error: `transcript record ${index + 1} has a tool call without an id` };
+        }
+        if (typeof blockValue.name !== 'string' || blockValue.name.trim() === '') {
+          return { error: `transcript record ${index + 1} has a tool call without a name` };
+        }
+        if (uses.has(blockValue.id)) return { error: `transcript repeats tool id ${blockValue.id}` };
+        const tool = blockValue.name.toLowerCase();
+        const timestamp = EDIT_TOOLS.has(tool) || tool === 'skill' ? parseTimestamp(record) : null;
+        if ((EDIT_TOOLS.has(tool) || tool === 'skill') && timestamp === null) {
+          return { error: `transcript record ${index + 1} has an invalid tool timestamp` };
+        }
+        uses.set(blockValue.id, {
+          tool,
+          input: blockValue.input,
+          timestamp,
+          sequence,
+        });
+      } else if (blockValue.type === 'tool_result') {
+        if (record.message?.role !== 'user') {
+          return { error: `transcript record ${index + 1} has a tool result outside a user message` };
+        }
+        if (
+          typeof blockValue.tool_use_id !== 'string' ||
+          blockValue.tool_use_id.trim() === ''
+        ) {
+          return { error: `transcript record ${index + 1} has a tool result without an id` };
+        }
+        if (results.has(blockValue.tool_use_id)) {
+          return { error: `transcript repeats result id ${blockValue.tool_use_id}` };
+        }
+        const use = uses.get(blockValue.tool_use_id);
+        if (!use) return { error: `transcript result precedes or has no matching tool call` };
+        if (blockValue.is_error !== undefined && typeof blockValue.is_error !== 'boolean') {
+          return { error: `transcript result for ${blockValue.tool_use_id} has invalid is_error` };
+        }
+        results.set(blockValue.tool_use_id, {
+          ok: blockValue.is_error !== true,
+          sequence,
+        });
+      }
+      sequence += 1;
+    }
+  }
+
+  const edits = [];
+  const skills = [];
+  for (const [id, use] of uses) {
+    const result = results.get(id);
+    if (!result || !result.ok || use.timestamp < startedAt) continue;
+    if (EDIT_TOOLS.has(use.tool)) edits.push(use);
+    if (use.tool === 'skill' && use.input?.skill?.toLowerCase?.() === 'tdd') {
+      skills.push(result);
+    }
+  }
+  if (edits.length === 0) return { editObserved: false, skillBeforeFirstEdit: false };
+  const firstEdit = edits.sort((a, b) => a.sequence - b.sequence)[0];
+  return {
+    editObserved: true,
+    skillBeforeFirstEdit: skills.some((skill) => skill.sequence < firstEdit.sequence),
+  };
+}
+
+function parseTimestamp(record) {
+  if (typeof record.timestamp !== 'string') return null;
+  const timestamp = Date.parse(record.timestamp);
+  return Number.isNaN(timestamp) ? null : timestamp;
+}
+
+function block(reason) {
+  process.stderr.write(
+    `[skill-forced-eval] blocked: ${reason}\n` +
+      'Run /tdd and wait for its successful result before editing implementation code.\n',
+  );
+  process.exit(2);
+}