@haposoft/cafekit 0.16.0-rc.2 → 0.16.0-rc.4

package/src/codex/hooks.json

@@ -43,6 +43,11 @@
             "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/privacy-approval.cjs\"",
             "commandWindows": "node \".codex/hooks/privacy-approval.cjs\""
           },
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/completion-authority.cjs\"",
+            "commandWindows": "node \".codex/hooks/completion-authority.cjs\""
+          },
           {
             "type": "command",
             "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/rules.cjs\"",
@@ -58,7 +63,7 @@
     ],
     "PreToolUse": [
       {
-        "matcher": "Bash|apply_patch|Edit|Write|Read|Glob|Grep|mcp__.*",
+        "matcher": "Bash|exec_command|apply_patch|Edit|Write|Read|Glob|Grep|mcp__.*|shell",
         "hooks": [
           {
             "type": "command",
@@ -98,6 +103,11 @@
             "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/spec-gate.cjs\"",
             "commandWindows": "node \".codex/hooks/spec-gate.cjs\""
           },
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/completion-authority.cjs\"",
+            "commandWindows": "node \".codex/hooks/completion-authority.cjs\""
+          },
           {
             "type": "command",
             "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/state.cjs\"",
@@ -110,6 +120,11 @@
       {
         "matcher": "*",
         "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/semantic-review-authority.cjs\"",
+            "commandWindows": "node \".codex/hooks/semantic-review-authority.cjs\""
+          },
           {
             "type": "command",
             "command": "node \"$(git rev-parse --show-toplevel)/.codex/hooks/state.cjs\"",

package/src/codex/rules/state-sync.md

@@ -1,41 +1,61 @@
-# Tollgate Protocol (State Sync)
+# Specs v2.1 state synchronization
 
-## Sources Of Truth
+## Authority layers
 
-Spec-driven work persists state in two synchronized layers:
+`spec.json` is machine semantic authority. Requirements, design, conditional
+research, and conditional task Markdown are human projections. Host state may
+record authority or integrity, but it never supplies product semantics.
 
-1. `spec.json` tracks phase, overall status, and `task_registry`.
-2. `tasks/task-*.md` tracks the human-readable checklist and verification receipt.
+Planning depth and assurance level remain independent. Route artifacts before
+discovery: None persists no spec; Compact and Full persist the bounded core;
+research and tasks remain absent unless their semantic triggers exist.
 
-## Sync-back Rule
+## Canonical lifecycle
 
-Before reporting a task completed or blocked:
+The feature lifecycle is exactly `in_progress`, `paused`, `blocked`, or `done`.
+Authoring state is independently `draft`, `validated`, or `absent`. New 2.1
+artifacts never emit legacy lifecycle aliases.
 
-### On success
+Technical readiness is not lifecycle completion. `ready_for_implementation`
+may change only through the installed machine finalization path after every
+routed artifact, projection, semantic review, grounding check, and deterministic
+gate passes. The author cannot directly declare readiness, authority, approval,
+review capability, execution proof, or closeout.
 
-1. Update `spec.json` only after verification. Keep `current_phase`,
-   `task_files`, status, timestamps, and the matching `task_registry` entry accurate.
-2. Update the matching task Markdown status, checkboxes, completion criteria,
-   and `## Evidence` receipt from the current verification run.
-3. Update native plan or task state when the active Codex session provides it,
-   but never use chat-only state as a substitute for the files above.
+## Projection sync
 
-### On block after repeated attempts
+After a semantic Markdown edit:
 
-1. Set the spec and matching registry entry to `blocked`, with the root cause and timestamp.
-2. Mark the task Markdown `blocked` and record the evidence.
-3. Tell the user or orchestrator exactly what external input or state change is required.
+1. invoke the explicit installed machine semantic-sync step to promote `semantic_model`;
+2. regenerate or reconcile every affected Markdown projection;
+3. verify requirements, decisions, anchors, task registry, typed boundaries,
+   and verification refs round-trip without loss; and
+4. rerun applicable deterministic validation and grounding checks.
 
-New specs use `in_progress`; legacy `in-progress` may be read but not emitted.
-Never let `task_registry` disagree with its task Markdown file.
+For Codex, the isolated promotion is
+`node .codex/scripts/spec-scaffold.cjs <feature> --sync-semantic-model`.
 
-## Completion Gate
+Task Markdown exists only for typed ownership, dependency, transition, proof,
+or parallel topology. Its status and dependencies project the matching
+`task_registry` entry. Its Verification Plan is prospective, never execution
+proof. Typed `coordination.boundaries` alone define topology; legacy trigger
+fields, priority markers, related-file lists, and prose do not.
 
-The Stop hook checks newly completed tasks. Each requires:
+## Lifecycle updates
 
-- `Status: done`;
-- a non-placeholder `## Evidence` section with a command block or PASS/FAIL result;
-- a non-empty `task_registry[path].completed_at`.
+- Active work uses `in_progress`.
+- A deliberate resumable stop uses `paused` with the exact remaining decision.
+- An external or semantic blocker uses `blocked` with a concrete cause.
+- Task state changes update the registry and matching projection together only
+  from observed work and verification.
+- Feature `done` is reserved for final-state authority after implementation
+  closeout; authoring or readiness cannot produce it.
 
-The first run seeds completion history without blocking. Humans can disable the
-gate with `"spec": { "completion_gate": false }` in `.codex/runtime.json`.
+State synchronization never fabricates commands, PASS results, timestamps,
+receipts, completed work, reviewer identity, or user approval. When execution
+evidence is absent, preserve unfinished state and report the missing proof.
+Never hand-author the `semantic_model` shape or treat an unsynchronized Markdown
+edit as machine authority.
+
+Codex-native plan or task state may mirror physical state when available, but
+it is never a substitute for `spec.json` or authority to advance lifecycle.

package/src/common/AGENTS.md

@@ -3,7 +3,7 @@
 ## Shared CafeKit instructions
 
 - Deliver exactly what was asked. Do not expand, polish, or add optional work beyond the request. Match existing code style and structure.
-- For spec work, `Completion Criteria` and `## Evidence` in `specs/<feature>/tasks/*.md` are the source of truth for task state.
+- For Specs v2.1, treat `spec.json` as machine authority and Markdown as human projections. Keep task status and plan synchronized with `task_registry`; derive ownership, dependencies, transitions, proof, and parallelism only from typed `coordination.boundaries`. Never invent proof, readiness, approval, or audit state.
 - `NO_TESTS` and `0 tests + exit 0` do not pass when the task requires automated tests.
 - When a hook blocks an action, that is an instruction boundary — do not work around it.
 - Use conventional commits. Do not add AI attribution unless requested.

package/src/opencode/AGENTS.md

@@ -28,9 +28,11 @@ The underlying CafeKit skills are still named `hapo:*` in their documentation.
 
 ## OpenCode limits
 
-Claude Code hooks, statusline, and settings do not run in OpenCode. Map Claude-only tools to OpenCode built-ins: `TodoWrite` → `todowrite`, `AskUserQuestion` → `question`, `Task` → the agent/subtask flow. The installed plugins under `.opencode/plugins/` provide the privacy, inspect-scope, spec-state, scaffold-guard, session-state, and docs-sync gates; other Claude runtime behavior has no OpenCode equivalent. The completion gate (`spec-gate`: `Verification: PASS` + `## Evidence` + `task_registry.completed_at`) is **advisory in OpenCode** — OpenCode has no Stop-hook equivalent and the `spec-gate` plugin (if present) runs as a best-effort `tool.execute.after` check, not a hard turn block like Claude/Codex.
+Claude Code hooks, statusline, and settings do not run in OpenCode. Map Claude-only tools to OpenCode built-ins: `TodoWrite` → `todowrite`, `AskUserQuestion` → `question`, `Task` → the agent/subtask flow. The installed plugins under `.opencode/plugins/` provide the privacy, inspect-scope, spec-state, scaffold-guard, session-state, and docs-sync gates; other Claude runtime behavior has no OpenCode equivalent.
 
-Runtime tier: OpenCode is **tier-2** for completion enforcement. Do not claim parity with Claude/Codex on `completion_gate`; `done` without a receipt emits an advisory warning/banner but does not hard-block the turn — rely on `spec-state` tollgate + manual `/hapo:test` verification.
+The installed `spec-gate` plugin uses the cancellable `tool.execute.before` hook to hard-block supported completion/state tools (`task`, `taskupdate`, and `todowrite`) with a controlled `CAFEKIT_SPEC_GATE_BLOCKED` result when shared policy/resolver or receipt evidence is invalid or unavailable. Receipt-repair tools remain available where the host boundary permits correction.
+
+OpenCode does not expose a cancellable `session.idle`/Stop hook or final assistant-turn cancellation boundary. Those event and prompt-injection paths are observational only; do not claim full-turn parity with Claude/Codex.
 
 ## Combined-install boundary