@haposoft/cafekit 0.16.0-rc.6 → 0.16.0-rc.8

package/README.md

@@ -1,6 +1,6 @@
 # @haposoft/cafekit
 
-> Native spec-driven workflow and runtime bundle for Claude Code, Codex CLI, and OpenCode.
+> Native spec-driven workflow and runtime bundle for Claude Code and Codex CLI.
 
 [![Version](https://img.shields.io/badge/version-0.16.0-blue.svg)](https://github.com/haposoft/cafekit)
 [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
@@ -28,14 +28,6 @@ Codex CLI install support:
 - merges a CafeKit-owned block into root `AGENTS.md`
 - requires no generated `.codex/config.toml` and never changes global trust config
 
-OpenCode install support:
-- installs command wrappers under `.opencode/commands/`
-- installs converted OpenCode agents under `.opencode/agents/`
-- installs CafeKit skills under `.opencode/skills/`
-- installs OpenCode plugin runtime files under `.opencode/plugins/`
-- merges `opencode.json` and root `AGENTS.md`
-- omits the Claude `hapo:` command prefix
-
 ## Install
 
 Run in your project root:
@@ -59,7 +51,7 @@ npx @haposoft/cafekit --platform codex --force-overwrite
 
 Requirements:
 - Node.js 18+
-- Claude Code, Codex CLI, or OpenCode; choose a runtime when prompted or use `--platform`
+- Claude Code or Codex CLI; choose a runtime when prompted or use `--platform`
 
 ## Git ignore policy
 
@@ -75,15 +67,13 @@ plans/*
 .cafekit-backup/
 .cafekit.lock
 .claude/
-.opencode/
 .codex/
 .agents/
 ```
 
 Runtime folders are local — reinstall with `npx @haposoft/cafekit` rather than
-committing them. Inside the runtime, CafeKit also installs `.claude/.gitignore`,
-`.opencode/.gitignore`, or the Codex pair `.codex/.gitignore` +
-`.agents/.gitignore`. These keep secrets, skill dependencies, session state,
+committing them. Inside the runtime, CafeKit also installs `.claude/.gitignore` or the
+Codex pair `.codex/.gitignore` + `.agents/.gitignore`. These keep secrets, skill dependencies, session state,
 and hook logs out of git even if someone partially un-ignores a runtime.
 Teams may deliberately commit runtime files, but should also commit the
 ownership manifest so selective updates share the same baseline.
@@ -141,37 +131,11 @@ without requiring Git and remain stable when a session starts in a subdirectory.
 CafeKit uses Codex's native status and usage UI instead of installing the
 Claude statusline.
 
-OpenCode targets:
-
-```text
-.opencode/
-├── .gitignore
-├── commands/
-├── agents/
-├── skills/
-├── rules/
-├── scripts/
-├── references/
-├── plugins/
-├── cafekit.json
-├── runtime.json
-└── package.json
-
-AGENTS.md
-opencode.json
-```
-
-OpenCode setup also:
-- binds generated commands to matching CafeKit subagents with `agent` + `subtask`
-- configures `permission.skill` and `permission.task`
-- optionally writes `model` to `opencode.json` from `OPENCODE_MODEL`, `OPENCODE_DEFAULT_MODEL`, or installer input
-
 To check the installed CafeKit package version:
 
 ```bash
 cat .claude/cafekit.json
 cat .codex/cafekit.json
-cat .opencode/cafekit.json
 ```
 
 ## Core Skills
@@ -224,17 +188,6 @@ $hapo-test meet-transcript-mvp --full
 $hapo-code-review meet-transcript-mvp --pending
 ```
 
-OpenCode uses the generated command names without the Claude `hapo:` prefix:
-
-```bash
-/question "Which files define the current CafeKit install/runtime behavior?" --repo
-/brainstorm Explore approaches for a Google Meet transcript extension
-/specs Build a Google Meet transcript extension with AI summaries
-/develop meet-transcript-mvp
-/test --full
-/code-review --pending
-```
-
 Reconstruct as-is docs from a legacy codebase:
 
 ```bash
@@ -253,16 +206,26 @@ hosted or specialized tools may not enter the local hook path.
 
 ## Spec Output
 
-Specs are stored under:
+New process-first Specs packets are stored under:
 
 ```text
 specs/<feature-name>/
-├── spec.json
-├── requirements.md
-├── research.md
-├── design.md
-└── tasks/task-R*.md
-```
+├── plan.md
+├── task-01-<slug>.md
+└── task-NN-<slug>.md
+```
+
+The process-first workflow has three human decision gates. `hapo:specs` opens
+C1 to fix scope before authoring and C2 to resolve adversarial findings, then
+stops. A later explicit `hapo:develop` invocation executes the tasks and
+presents C3 for closeout only after real execution proof. Each task has one
+`Status:` field and keeps its canonical `## Receipt` inline, including the
+exact Verification Plan command, `Exit: 0`, `Verification: PASS`,
+runtime-derived Base and Head, and current command output.
+
+Existing packets with `spec.json`, nested `tasks/task-R*.md`, or separate
+receipts remain supported through the legacy compatibility adapter. New Specs
+work does not author those legacy artifacts.
 
 ## Development
 

package/bin/__tests__/change-firewall.semantic-firewall.test.js

@@ -66,7 +66,7 @@ function initRepo(root, { version = '0.0.1-fixture' } = {}) {
 }
 
 function writeLegacyBridge(root, { baseCommit, semanticDigest = cf.sha256Tag('bridge-digest') }) {
-  writeJson(path.join(root, 'specs/cafekit-semantic-eval-firewall/reports/bootstrap-legacy-bridge-review.json'), {
+  writeJson(path.join(root, 'specs/archive/cafekit-semantic-eval-firewall/reports/bootstrap-legacy-bridge-review.json'), {
     schema_version: '1',
     verdict: 'PASS',
     blocking_count: 0,
@@ -78,7 +78,7 @@ function writeLegacyBridge(root, { baseCommit, semanticDigest = cf.sha256Tag('br
 }
 
 function writeFeatureSeedPass(root, { reviewReceiptDigest = cf.sha256Tag('seed-review-receipt') } = {}) {
-  writeJson(path.join(root, 'specs/cafekit-semantic-eval-firewall/spec.json'), {
+  writeJson(path.join(root, 'specs/archive/cafekit-semantic-eval-firewall/spec.json'), {
     validation: {
       semantic_review_history: {
         entries: [{
@@ -201,7 +201,7 @@ test('R1.14 negative: an absent or malformed legacy-bridge artifact fails the pr
     const inst = cf.createChangeFirewall({ root });
     assert.throws(() => inst.assertLegacyBridgeArtifact(), (error) => error.code === 'legacy_bridge_missing');
 
-    writeJson(path.join(root, 'specs/cafekit-semantic-eval-firewall/reports/bootstrap-legacy-bridge-review.json'), {
+    writeJson(path.join(root, 'specs/archive/cafekit-semantic-eval-firewall/reports/bootstrap-legacy-bridge-review.json'), {
       schema_version: '1', verdict: 'FAIL', blocking_count: 0,
       reviewed_criteria: ['R1.1'], semantic_digest: cf.sha256Tag('x'),
       bootWindowBaseCommit: '0'.repeat(40), written_at: new Date().toISOString(),
@@ -379,7 +379,7 @@ test('C14/R1.8: bootstrapBaseline refuses before the seed PASS exists, and refus
     const inst = cf.createChangeFirewall({ root });
 
     // feature spec.json exists but carries no semantic_review_history yet (no seed PASS).
-    writeJson(path.join(root, 'specs/cafekit-semantic-eval-firewall/spec.json'), { validation: {} });
+    writeJson(path.join(root, 'specs/archive/cafekit-semantic-eval-firewall/spec.json'), { validation: {} });
     assert.throws(
       () => inst.bootstrapBaseline({ baseCommit, headCommit, bootstrapReviewDigest: cf.sha256Tag('x'), packageVersion: '0.0.1-fixture' }),
       (error) => error.code === 'seed_pass_missing',
@@ -2131,4 +2131,3 @@ test('REGRESSION round7 (critical): a committed C10 authority renamed away then
     assert.throws(() => inst.createFreezeManifest(null), (error) => error.code === 'out_of_band_edit');
   });
 });
-

package/bin/__tests__/codex-hooks.test.js

@@ -45,6 +45,16 @@ function bindReceipt(root, value, feature = 'auth', session = 'session-a') {
   return value.replaceAll(VALID_BASE, context.base).replaceAll(VALID_HEAD, context.head);
 }
 
+function workflowRuntimeContext(root, feature = 'auth', session = 'session-a') {
+  return PROVENANCE.deriveRuntimeContext({
+    projectRoot: root,
+    specsRoot: path.join(root, 'specs'),
+    specFile: path.join(root, 'specs', feature, 'plan.md'),
+    featureName: feature,
+    runtimeSession: session,
+  });
+}
+
 function installFeatureReceipts(root, session = 'session-a') {
   const specsRoot = path.join(root, 'specs');
   if (!fs.existsSync(specsRoot)) return;
@@ -128,6 +138,219 @@ function inHookFixture(run, options = {}) {
   }
 }
 
+function processTaskContent(title, status, dependency = 'none') {
+  return [
+    `# ${title}`, '', `Status: ${status}`, '',
+    '## Dependencies', '', `- ${dependency}`, '',
+    '## Verification Plan', '', '- Command: node --test', '',
+  ].join('\n');
+}
+
+function canonicalProcessTask(root, title, dependency = 'none') {
+  const context = workflowRuntimeContext(root, 'auth', 'session-auth-state');
+  return [
+    processTaskContent(title, 'done', dependency),
+    '## Receipt', '', 'Verification: PASS', 'Command: node --test', 'Exit: 0',
+    `Base: ${context.base}`, `Head: ${context.head}`,
+    '```text', 'node --test', '1 test passed', '```', '',
+  ].join('\n');
+}
+
+function inInstalledProcessSpecStateFixture(run) {
+  return inHookFixture((root, hooks) => {
+    const feature = path.join(root, 'specs', 'auth');
+    fs.mkdirSync(feature, { recursive: true });
+    fs.writeFileSync(path.join(feature, 'plan.md'), '# Auth plan\nSpecs-Contract: process-first-ready-v1\n');
+
+    const writeTask = (basename, title, status, dependency = 'none') => {
+      fs.writeFileSync(
+        path.join(feature, basename),
+        processTaskContent(title, status, dependency),
+      );
+    };
+    const runState = () => runHook(path.join(hooks, 'spec-state.cjs'), root, {
+      cwd: root,
+      featureName: 'auth',
+      session_id: 'session-auth-state',
+      hook_event_name: 'UserPromptSubmit',
+      prompt: 'Continue',
+    });
+    const findCacheFile = () => {
+      const cacheDir = path.join(hooks, '.logs');
+      const cacheNames = fs.existsSync(cacheDir)
+        ? fs.readdirSync(cacheDir).filter((file) => file.startsWith('tollgate-'))
+        : [];
+      assert.equal(cacheNames.length, 1, 'one installed session cache must exist');
+      return path.join(cacheDir, cacheNames[0]);
+    };
+    return run({
+      feature,
+      findCacheFile,
+      hooks,
+      root,
+      runState,
+      writePlan: (content) => fs.writeFileSync(path.join(feature, 'plan.md'), content),
+      writeTask,
+    });
+  });
+}
+
+test('Codex installed spec-state re-evaluates a standalone task when blocked becomes pending', () => {
+  inInstalledProcessSpecStateFixture(({ findCacheFile, hooks, runState, writeTask }) => {
+    writeTask('task-01-auth.md', 'Task 01: auth', 'blocked');
+
+    const blocked = runState();
+    assert.equal(blocked.status, 0, blocked.stderr);
+    assert.match(blocked.stdout, /Spec state changed: `auth`/);
+    assert.doesNotMatch(blocked.stdout, /Next unblocked/);
+    const cacheFile = findCacheFile();
+    assert.ok(cacheFile.startsWith(`${hooks}${path.sep}`), 'cache must stay inside temporary installed hooks');
+    const blockedCache = fs.readFileSync(cacheFile, 'utf8');
+
+    writeTask('task-01-auth.md', 'Task 01: auth', 'pending');
+    const pending = runState();
+    assert.equal(pending.status, 0, pending.stderr);
+    assert.match(pending.stdout, /Spec state changed: `auth`/);
+    assert.match(pending.stdout, /Next unblocked: `task-01-auth\.md`/);
+    assert.notEqual(fs.readFileSync(cacheFile, 'utf8'), blockedCache, 'state cache must change');
+  });
+});
+
+test('Codex installed spec-state requires current canonical dependency proof and keys receipt mutations', () => {
+  inInstalledProcessSpecStateFixture(({ feature, findCacheFile, hooks, root, runState, writeTask }) => {
+    const predecessor = 'task-01-semantic-review.md';
+    const dependent = 'task-02-implementation.md';
+    writeTask(predecessor, 'Task 01: semantic review', 'blocked');
+    writeTask(dependent, 'Task 02: implementation', 'pending', predecessor);
+    const dependentPath = path.join(feature, dependent);
+    const unchangedDependent = fs.readFileSync(dependentPath, 'utf8');
+
+    const blocked = runState();
+    assert.equal(blocked.status, 0, blocked.stderr);
+    assert.match(blocked.stdout, /Tasks: 0 done \/ 2 total/);
+    assert.doesNotMatch(blocked.stdout, /Next unblocked/);
+    const cacheFile = findCacheFile();
+    assert.ok(cacheFile.startsWith(`${hooks}${path.sep}`), 'cache must stay inside temporary installed hooks');
+    const blockedCache = fs.readFileSync(cacheFile, 'utf8');
+
+    writeTask(predecessor, 'Task 01: semantic review', 'done');
+    const missing = runState();
+    assert.equal(missing.status, 0, missing.stderr);
+    assert.doesNotMatch(missing.stdout, /Next unblocked/);
+    const missingCache = fs.readFileSync(cacheFile, 'utf8');
+    assert.notEqual(missingCache, blockedCache, 'done without proof must change cached proof state');
+
+    fs.appendFileSync(path.join(feature, predecessor), '\n## Receipt\n\nVerification: PASS\n');
+    const malformed = runState();
+    assert.equal(malformed.status, 0, malformed.stderr);
+    assert.doesNotMatch(malformed.stdout, /Next unblocked/);
+
+    fs.writeFileSync(path.join(feature, predecessor), canonicalProcessTask(root, 'Task 01: semantic review'));
+    const ready = runState();
+    assert.equal(ready.status, 0, ready.stderr);
+    assert.match(ready.stdout, /Next unblocked: `task-02-implementation\.md`/);
+    const readyCache = fs.readFileSync(cacheFile, 'utf8');
+    assert.notEqual(readyCache, missingCache, 'canonical proof must change cached proof state');
+
+    fs.writeFileSync(
+      path.join(feature, predecessor),
+      fs.readFileSync(path.join(feature, predecessor), 'utf8').replace('Verification: PASS', 'Verification: FAIL'),
+    );
+    const mutated = runState();
+    assert.equal(mutated.status, 0, mutated.stderr);
+    assert.doesNotMatch(mutated.stdout, /Next unblocked/);
+    assert.notEqual(fs.readFileSync(cacheFile, 'utf8'), readyCache, 'receipt-only mutation must change cache');
+    assert.equal(fs.readFileSync(dependentPath, 'utf8'), unchangedDependent, 'dependent must remain pending');
+  });
+});
+
+test('Codex installed spec-state keeps unversioned pending packets out of Next with migration guidance', () => {
+  inInstalledProcessSpecStateFixture(({ feature, runState, writePlan, writeTask }) => {
+    const fencedMarkerPlan = '# Auth plan\n\n```markdown\nSpecs-Contract: process-first-ready-v1\n```\n';
+    writePlan(fencedMarkerPlan);
+    writeTask('task-01-auth.md', 'Task 01: auth', 'pending');
+    const taskBytes = fs.readFileSync(path.join(feature, 'task-01-auth.md'));
+    const result = runState();
+    assert.equal(result.status, 0, result.stderr);
+    assert.doesNotMatch(result.stdout, /Next unblocked/);
+    assert.match(result.stdout, /Migration required: add `Specs-Contract: process-first-ready-v1`/);
+    const cached = runState();
+    assert.equal(cached.status, 0, cached.stderr);
+    assert.doesNotMatch(cached.stdout, /Next unblocked/);
+    assert.match(cached.stdout, /Add `Specs-Contract: process-first-ready-v1`/);
+
+    writePlan(fencedMarkerPlan.replace('# Auth plan\n', '# Auth plan\nSpecs-Contract: process-first-ready-v1\n'));
+    const marked = runState();
+    assert.equal(marked.status, 0, marked.stderr);
+    assert.match(marked.stdout, /Spec state changed: `auth`/);
+    assert.match(marked.stdout, /Next unblocked: `task-01-auth\.md`/);
+    assert.deepEqual(fs.readFileSync(path.join(feature, 'task-01-auth.md')), taskBytes, 'marker-only transition must not change task bytes');
+  });
+});
+
+test('Codex resolver ignores fenced workflow annotations and rejects fenced-only Status', () => {
+  inInstalledProcessSpecStateFixture(({ feature, root, runState, writePlan, writeTask }) => {
+    const resolver = require(path.join(root, '.codex', 'scripts', 'spec-resolver.cjs'));
+    const trailingFence = resolver.annotatedMarkdownLines([
+      '```markdown', '``` trailing', 'Specs-Contract: process-first-ready-v1',
+      'Status: done', '## Receipt', '```',
+    ].join('\n'));
+    assert.deepEqual(trailingFence.slice(2, 5).map(({ outsideFence }) => outsideFence), [false, false, false]);
+    const fourSpaceFence = resolver.annotatedMarkdownLines('    ```markdown\nStatus: pending');
+    assert.equal(fourSpaceFence[1].outsideFence, true);
+    writePlan('# Auth plan\nSpecs-Contract: process-first-ready-v1\n');
+    fs.writeFileSync(path.join(feature, 'task-01-fenced-only.md'), [
+      '# Task 01', '', '```markdown', 'Status: done', '```', '',
+      '## Dependencies', '', '- none', '', '## Verification Plan', '', '- Command: node --test', '',
+    ].join('\n'));
+    const malformed = resolver.resolveWorkflowCandidate({ projectRoot: root, runtime: {}, explicitFeature: 'auth' });
+    assert.equal(malformed.error, 'explicit_malformed');
+    assert.match(malformed.reason, /must contain exactly one supported Status field/);
+
+    fs.rmSync(path.join(feature, 'task-01-fenced-only.md'));
+    writeTask('task-01-dependent.md', 'Task 01: dependent', 'pending', 'task-02-predecessor.md');
+    fs.writeFileSync(path.join(feature, 'task-02-predecessor.md'), [
+      '# Task 02', '', 'Status: pending', '', '## Dependencies', '', '- none', '',
+      '## Verification Plan', '', '- Command: node --test', '',
+      '~~~~markdown', 'Status: done', '## Dependencies', '- task-01-dependent.md', '## Receipt',
+      'Verification: PASS', 'Command: node --test', 'Exit: 0', '```text', 'fake pass', '```', '~~~~', '',
+    ].join('\n'));
+    const result = runState();
+    assert.equal(result.status, 0, result.stderr);
+    assert.match(result.stdout, /Next unblocked: `task-02-predecessor\.md`/);
+    assert.doesNotMatch(result.stdout, /Next unblocked: `task-01-dependent\.md`/);
+  });
+});
+
+test('Codex resolver accepts unique legacy task numbers, rejects ambiguity, and rejects exact cycles', () => {
+  inInstalledProcessSpecStateFixture(({ feature, root, writePlan, writeTask }) => {
+    const resolver = require(path.join(root, '.codex', 'scripts', 'spec-resolver.cjs'));
+    writePlan('# Auth plan\n');
+    writeTask('task-01-a.md', 'Task 01: a', 'pending');
+    writeTask('task-02-b.md', 'Task 02: b', 'pending', '01');
+    fs.writeFileSync(path.join(feature, 'task-03-c.md'), '# Task 03: c\n\nStatus: pending\n');
+    const unique = resolver.resolveWorkflowCandidate({ projectRoot: root, runtime: {}, explicitFeature: 'auth' });
+    assert.deepEqual(unique.taskRegistry['task-02-b.md'].dependencies, ['task-01-a.md']);
+    assert.deepEqual(unique.taskRegistry['task-03-c.md'].dependencies, []);
+    assert.equal(unique.workflowContract, null);
+    assert.equal(unique.queueReady, false);
+
+    writeTask('task-01-second.md', 'Task 01: second', 'pending');
+    const ambiguous = resolver.resolveWorkflowCandidate({ projectRoot: root, runtime: {}, explicitFeature: 'auth' });
+    assert.equal(ambiguous.error, 'explicit_malformed');
+    assert.match(ambiguous.reason, /legacy dependency 01 maps to 2 task basenames/);
+
+    fs.rmSync(path.join(feature, 'task-01-second.md'));
+    fs.rmSync(path.join(feature, 'task-03-c.md'));
+    writePlan('# Auth plan\nSpecs-Contract: process-first-ready-v1\n');
+    writeTask('task-01-a.md', 'Task 01: a', 'pending', 'task-02-b.md');
+    writeTask('task-02-b.md', 'Task 02: b', 'pending', 'task-01-a.md');
+    const cycle = resolver.resolveWorkflowCandidate({ projectRoot: root, runtime: {}, explicitFeature: 'auth' });
+    assert.equal(cycle.error, 'explicit_malformed');
+    assert.match(cycle.reason, /dependency cycle detected: task-01-a\.md -> task-02-b\.md -> task-01-a\.md/);
+  });
+});
+
 test('Codex privacy approval is exact, session-bound, and reusable within its window', () => {
   inHookFixture((root, hooks) => {
     const nested = path.join(root, 'packages', 'app');
@@ -414,6 +637,165 @@ test('Codex completion gate cannot be bypassed from a nested cwd', () => {
   });
 });
 
+test('Codex completion gate validates explicit process-v3 inline Receipt', () => {
+  inHookFixture((root, hooks) => {
+    const nested = path.join(root, 'packages', 'app');
+    const feature = path.join(root, 'specs', 'auth');
+    const taskFile = path.join(feature, 'task-01-auth.md');
+    fs.mkdirSync(nested, { recursive: true });
+    fs.mkdirSync(feature, { recursive: true });
+    fs.writeFileSync(path.join(feature, 'plan.md'), '# Auth plan\n');
+    fs.writeFileSync(taskFile, [
+      '# Task 01: auth', '', 'Status: done', '',
+      '## Dependencies', '', '- none', '',
+      '## Verification Plan', '', '- Command: node --test', '',
+    ].join('\n'));
+
+    const gate = path.join(hooks, 'spec-gate.cjs');
+    const payload = {
+      cwd: nested,
+      featureName: 'auth',
+      session_id: 'session-a',
+      hook_event_name: 'Stop',
+      stop_hook_active: false,
+    };
+    const blocked = runHook(gate, nested, payload);
+    assert.equal(blocked.status, 0, blocked.stderr);
+    assert.match(JSON.parse(blocked.stdout).reason, /missing_receipt/);
+
+    const context = workflowRuntimeContext(root);
+    fs.writeFileSync(taskFile, [
+      '# Task 01: auth', '', 'Status: done', '',
+      '## Dependencies', '', '- none', '',
+      '## Verification Plan', '', '- Command: node --test', '',
+      '## Receipt', '', '```text', 'Verification: PASS', 'Command: node --test', 'Exit: 0',
+      `Base: ${context.base}`, `Head: ${context.head}`, 'pass: 1', '```', '',
+    ].join('\n'));
+    const fencedFields = runHook(gate, nested, payload);
+    assert.equal(fencedFields.status, 0, fencedFields.stderr);
+    assert.match(JSON.parse(fencedFields.stdout).reason, /verification_state/);
+    assert.match(JSON.parse(fencedFields.stdout).reason, /command/);
+    assert.match(JSON.parse(fencedFields.stdout).reason, /provenance/);
+
+    fs.writeFileSync(taskFile, [
+      '# Task 01: auth', '', 'Status: done', '',
+      '## Dependencies', '', '- none', '',
+      '## Verification Plan', '', '- Command: node --test', '',
+      '## Receipt', '',
+      'Verification: PASS', 'Command: node --test', 'Exit: 0',
+      `Base: ${context.base}`, `Head: ${context.head}`,
+      '````text', '$ node --test', 'pass: 1', '```', '',
+    ].join('\n'));
+    const malformedOutputFence = runHook(gate, nested, payload);
+    assert.equal(malformedOutputFence.status, 0, malformedOutputFence.stderr);
+    assert.match(JSON.parse(malformedOutputFence.stdout).reason, /command_output/);
+
+    fs.writeFileSync(taskFile, [
+      '# Task 01: auth', '', 'Status: done', '',
+      '## Dependencies', '', '- none', '',
+      '## Verification Plan', '', '- Command: node --test', '',
+      '## Receipt', '',
+      'Verification: PASS', 'Command: node --test', 'Exit: 0',
+      `Base: ${context.base}`, `Head: ${context.head}`,
+      '```text', '$ node --test', 'pass: 1', '```', '',
+    ].join('\n'));
+    const passed = runHook(gate, nested, payload);
+    assert.equal(passed.status, 0, passed.stderr);
+    assert.equal(passed.stdout, '');
+  });
+});
+
+test('Codex process-v3 Receipt command must match the exact Verification Plan command', () => {
+  inHookFixture((root, hooks) => {
+    const feature = path.join(root, 'specs', 'auth');
+    fs.mkdirSync(feature, { recursive: true });
+    fs.writeFileSync(path.join(feature, 'plan.md'), '# Auth plan\n');
+    const context = workflowRuntimeContext(root);
+    fs.writeFileSync(path.join(feature, 'task-01-auth.md'), [
+      '# Task 01: auth', '', 'Status: done', '',
+      '## Dependencies', '', '- none', '',
+      '## Verification Plan', '', '- Command: pnpm test', '',
+      '## Receipt', '', 'Verification: PASS', 'Command: true', 'Exit: 0',
+      `Base: ${context.base}`, `Head: ${context.head}`,
+      '```text', '$ true', 'pass: 1', '```', '',
+    ].join('\n'));
+
+    const result = runHook(path.join(hooks, 'spec-gate.cjs'), root, {
+      cwd: root,
+      session_id: 'session-a',
+      hook_event_name: 'Stop',
+      stop_hook_active: false,
+    });
+    assert.equal(result.status, 0, result.stderr);
+    assert.notEqual(result.stdout, '', 'a substituted receipt command must block');
+    assert.match(JSON.parse(result.stdout).reason, /command_identity/);
+  });
+});
+
+test('Codex process-v3 Stop ignores a completed packet when one packet remains active', () => {
+  inHookFixture((root, hooks) => {
+    const completed = path.join(root, 'specs', 'auth');
+    const active = path.join(root, 'specs', 'active');
+    fs.mkdirSync(completed, { recursive: true });
+    fs.mkdirSync(active, { recursive: true });
+    fs.writeFileSync(path.join(completed, 'plan.md'), '# Auth plan\n');
+    fs.writeFileSync(path.join(active, 'plan.md'), '# Active plan\n');
+    const context = workflowRuntimeContext(root);
+    fs.writeFileSync(path.join(completed, 'task-01-auth.md'), [
+      '# Task 01: auth', '', 'Status: done', '',
+      '## Dependencies', '', '- none', '',
+      '## Verification Plan', '', '- Command: node --test', '',
+      '## Receipt', '',
+      'Verification: PASS', 'Command: node --test', 'Exit: 0',
+      `Base: ${context.base}`, `Head: ${context.head}`,
+      '```text', '$ node --test', 'pass: 1', '```', '',
+    ].join('\n'));
+    fs.writeFileSync(path.join(active, 'task-01-active.md'), [
+      '# Task 01: active', '', 'Status: pending', '',
+      '## Dependencies', '', '- none', '',
+      '## Verification Plan', '', '- Command: node --test', '',
+    ].join('\n'));
+
+    const result = runHook(path.join(hooks, 'spec-gate.cjs'), root, {
+      cwd: root,
+      session_id: 'session-a',
+      hook_event_name: 'Stop',
+      stop_hook_active: false,
+    });
+    assert.equal(result.status, 0, result.stderr);
+    assert.equal(result.stdout, '');
+  });
+});
+
+test('Codex process-v3 Stop accepts two completed packets with valid Receipts', () => {
+  inHookFixture((root, hooks) => {
+    for (const featureName of ['auth', 'other']) {
+      const feature = path.join(root, 'specs', featureName);
+      fs.mkdirSync(feature, { recursive: true });
+      fs.writeFileSync(path.join(feature, 'plan.md'), `# ${featureName} plan\n`);
+      const context = workflowRuntimeContext(root, featureName);
+      fs.writeFileSync(path.join(feature, `task-01-${featureName}.md`), [
+        `# Task 01: ${featureName}`, '', 'Status: done', '',
+        '## Dependencies', '', '- none', '',
+        '## Verification Plan', '', '- Command: node --test', '',
+        '## Receipt', '',
+        'Verification: PASS', 'Command: node --test', 'Exit: 0',
+        `Base: ${context.base}`, `Head: ${context.head}`,
+        '```text', '$ node --test', 'pass: 1', '```', '',
+      ].join('\n'));
+    }
+
+    const result = runHook(path.join(hooks, 'spec-gate.cjs'), root, {
+      cwd: root,
+      session_id: 'session-a',
+      hook_event_name: 'Stop',
+      stop_hook_active: false,
+    });
+    assert.equal(result.status, 0, result.stderr);
+    assert.equal(result.stdout, '');
+  });
+});
+
 test('empty or forged Codex hook authority fails closed', () => {
   inHookFixture((root, hooks) => {
     const gate = path.join(hooks, 'spec-gate.cjs');