@haposoft/cafekit 0.16.7 → 0.18.0

package/bin/__tests__/runtime-dir.test.js

@@ -143,9 +143,6 @@ test('advice names the directory the hook lives in', () => {
       const rt = installTreeAs(project, folder);
       fs.mkdirSync(path.join(project, 'specs', 'demo'), { recursive: true });
       fs.writeFileSync(path.join(rt, 'runtime.json'), '{}');
-      // task-scaffold-guard: a raw Write into a nested task path is refused with scaffold advice
-      const guard = runHook(rt, 'task-scaffold-guard.cjs', { tool_name: 'Write', tool_input: { file_path: path.join(project, 'specs', 'demo', 'tasks', 'task-R0-01-x.md'), content: '# x' }, cwd: project });
-      assert.match(guard.out, new RegExp(`node ${folder.replace('.', '\\.')}/scripts/spec-scaffold\\.cjs`), `scaffold advice must name ${folder}`);
       // inspect-block: header hint names the runtime file (static check on the installed copy)
       const src = fs.readFileSync(path.join(rt, 'hooks', 'inspect-block.cjs'), 'utf8');
       assert.match(src, /<runtime>\/runtime\.json/, 'the disable hint no longer hardcodes a platform');

package/bin/__tests__/runtime-schema.test.js

@@ -86,8 +86,9 @@ test('every documented property carries a description a reader can act on', () =
 test('keys the runtime does not honour are marked deprecated, not documented as working', () => {
   // develop.parallel and the hooks toggle map are still shipped for compatibility, but
   // nothing reads them. The schema must say so rather than imply they work.
-  for (const dead of ['hooks', 'develop']) {
-    const node = SCHEMA.properties[dead];
+  for (const dead of ['hooks', 'develop', 'usage', 'spec.scaffold_guard']) {
+    // A dotted path walks nested `properties`: `spec.scaffold_guard` is spec.properties.scaffold_guard.
+    const node = dead.split('.').reduce((schema, key) => schema && schema.properties && schema.properties[key], SCHEMA);
     assert.ok(node, `${dead} is shipped in runtime.json and must appear in the schema`);
     assert.equal(node.deprecated, true, `${dead} is not honoured and must be marked deprecated`);
     assert.match(node.description, /[Nn]ot honoured/, `${dead} must say plainly that it does nothing`);

package/bin/__tests__/skill-routing-source.test.js

@@ -58,7 +58,7 @@ test('skill routing consumes live catalog without fixed optional commands', () =
     installScanner(SCANNER, claudeScript);
     installScanner(SCANNER, codexScript, (content) => normalizeCodexBody(content, SCANNER));
 
-    writeSkill(path.join(root, '.claude/skills'), 'question', {
+    writeSkill(path.join(root, '.claude/skills'), 'ask', {
       name: 'cf:ask', description: 'Answer with evidence.', when: 'Use for factual questions.',
       category: 'utilities', keywords: ['answer', 'evidence'],
     });
@@ -66,7 +66,7 @@ test('skill routing consumes live catalog without fixed optional commands', () =
       name: 'cf:docs', description: 'Work with docs.', when: 'Use for documentation.',
       category: 'documents', keywords: ['docs'],
     });
-    writeSkill(path.join(root, '.agents/skills'), 'question', {
+    writeSkill(path.join(root, '.agents/skills'), 'ask', {
       name: 'cf-ask', description: 'Answer with evidence.', when: 'Use for factual questions.',
       category: 'utilities', keywords: ['answer', 'evidence'],
     });
@@ -84,8 +84,8 @@ test('skill routing consumes live catalog without fixed optional commands', () =
   const domain = fs.readFileSync(path.join(PACKAGE_ROOT, 'src/claude/rules/skill-domain-routing.md'), 'utf8');
   const codexEntry = fs.readFileSync(path.join(PACKAGE_ROOT, 'src/codex/AGENTS.md'), 'utf8');
   assert.match(workflow, /user names a valid installed skill[\s\S]*one obvious low-risk[\s\S]*direct factual conversation/);
-  assert.match(workflow, /do not invoke Route or agents for ceremony/);
-  assert.match(workflow.replace(/\s+/g, ' '), /numeric optimization capability remains explicit-only/);
+  assert.match(workflow, /do not spawn agents for ceremony/);
+  assert.doesNotMatch(`${workflow}\n${domain}`, /numeric optimization capability/);
   assert.match(domain, /examples below are intent hints, not a copied installed inventory/);
   assert.match(domain, /document\/artifact work \| use only a matching installed optional capability/);
   assert.doesNotMatch(domain, /\/cf:(?:docs|docx|pdf|pptx|xlsx|ai-multimodal)/);
@@ -96,17 +96,19 @@ test('skill routing consumes live catalog without fixed optional commands', () =
 test('skill catalog exposes discriminating routing metadata', () => {
   withTempRoot((root) => {
     const skills = path.join(root, 'skills');
-    writeSkill(skills, 'route', {
-      name: 'cf:route', description: 'Choose a bounded chain.',
+    writeSkill(skills, 'triage', {
+      name: 'cf:triage', description: 'Choose a bounded chain.',
       when: 'Use for ambiguous multi-step work.', category: 'utilities',
       keywords: ['routing', 'risk'],
     });
+    // An upgrade can leave a user-modified retired directory beside its replacement; both carry the
+    // same public name, and only the retired one may drop out.
     writeSkill(skills, 'question', {
-      name: 'cf:ask', description: 'First duplicate.', when: 'Use for questions.',
+      name: 'cf:ask', description: 'User-modified retired copy.', when: 'Use for questions.',
       category: 'utilities', keywords: ['answer'],
     });
     writeSkill(skills, 'ask', {
-      name: 'cf:ask', description: 'Second duplicate.', when: 'Use for questions.',
+      name: 'cf:ask', description: 'Answer with evidence.', when: 'Use for questions.',
       category: 'utilities', keywords: ['answer'],
     });
     writeSkill(skills, 'missing-description', { name: 'cf:missing-description' });
@@ -132,15 +134,16 @@ test('skill catalog exposes discriminating routing metadata', () => {
     });
 
     const catalog = runCatalog(SCANNER, root, ['--json', '--root', skills]);
-    assert.deepEqual(catalog.skills.map((skill) => skill.public_id), ['cf:route']);
-    assert.deepEqual(catalog.skills[0], {
-      name: 'cf:route', public_id: 'cf:route', directory: 'route',
+    assert.deepEqual(catalog.skills.map((skill) => skill.public_id), ['cf:ask', 'cf:triage']);
+    assert.deepEqual(catalog.skills.find((skill) => skill.public_id === 'cf:triage'), {
+      name: 'cf:triage', public_id: 'cf:triage', directory: 'triage',
       description: 'Choose a bounded chain.', when_to_use: 'Use for ambiguous multi-step work.',
       category: 'utilities', keywords: ['routing', 'risk'], user_invocable: true,
       has_references: false, has_scripts: false,
     });
     const codes = catalog.diagnostics.map((item) => item.code);
-    assert.equal(codes.filter((code) => code === 'duplicate_public_name').length, 2);
+    assert.equal(codes.filter((code) => code === 'duplicate_public_name').length, 0);
+    assert.ok(catalog.diagnostics.some((item) => item.directory === 'question' && item.code === 'retired_skill'));
     for (const required of [
       'folder_name_mismatch', 'malformed_frontmatter', 'missing_routing_metadata', 'retired_skill',
     ]) assert.ok(codes.includes(required), required);
@@ -157,10 +160,19 @@ test('skill catalog exposes discriminating routing metadata', () => {
   const sourceCatalog = runCatalog(SCANNER, PACKAGE_ROOT);
   const retiredDiagnostics = sourceCatalog.diagnostics
     .filter((item) => item.code === 'retired_skill').map((item) => item.directory).sort();
-  assert.deepEqual(retiredDiagnostics, [...MANIFEST.obsolete.skills].sort());
+  // Retired skills kept in the source tree must be flagged; renamed ones were moved, so they are
+  // absent from the source and only matter to an upgrade over an older install.
+  const sourceSkills = path.join(PACKAGE_ROOT, 'src/claude/skills');
+  const keptRetired = MANIFEST.obsolete.skills.filter((name) => fs.existsSync(path.join(sourceSkills, name)));
+  assert.deepEqual(retiredDiagnostics, [...keptRetired].sort());
+  for (const renamed of ['inspect', 'hotfix', 'question']) {
+    assert.ok(MANIFEST.obsolete.skills.includes(renamed), renamed);
+    assert.equal(fs.existsSync(path.join(sourceSkills, renamed)), false, renamed);
+  }
   assert.equal(sourceCatalog.skills.some((skill) => MANIFEST.obsolete.skills.includes(skill.directory)), false);
-  const route = sourceCatalog.skills.find((skill) => skill.public_id === 'cf:route');
-  assert.ok(route?.description && route.when_to_use && route.category && route.keywords.length > 0);
+  assert.equal(sourceCatalog.skills.some((skill) => skill.public_id === 'cf:route'), false);
+  const ask = sourceCatalog.skills.find((skill) => skill.public_id === 'cf:ask');
+  assert.ok(ask?.description && ask.when_to_use && ask.category && ask.keywords.length > 0);
 });
 
 test('skill catalog rejects a missing root value before path resolution', () => {

package/bin/__tests__/spec-narrowing.test.js

@@ -188,21 +188,6 @@ test('several packets claiming closeout stay ambiguous and name only those', ()
   });
 });
 
-test('codex resolveCandidate agrees with the shared resolver', () => {
-  // Codex kept its own candidate count, reachable because spec-utils did not export the
-  // shared function. A Claude-only change would leave every Codex turn blocked.
-  const codexCheck = require(path.join(PACKAGE_ROOT, 'src/codex/hooks/completion-authority-check.cjs'));
-  const utils = require(path.join(PACKAGE_ROOT, 'src/codex/hooks/lib/spec-utils.cjs'));
-  assert.equal(typeof utils.resolvePersistedSpec, 'function', 'the wrapper must be exported');
-  withProject((root) => {
-    legacyPacket(root, 'shipped', { status: 'in_progress', phase: 'execution', taskStatus: 'done' });
-    legacyPacket(root, 'closing', { status: 'done', phase: 'closeout' });
-    const shared = RESOLVER.resolvePersistedSpec({ projectRoot: root, runtime: {} });
-    const viaCodex = codexCheck.resolveCandidate({ projectRoot: root, runtime: {}, payload: {} });
-    assert.equal(viaCodex.featureName, shared.featureName);
-  });
-});
-
 // ── The recorded active feature: the escape the block told users to take ────────────
 
 test('a recorded active feature resolves two packets claiming closeout', () => {
@@ -281,18 +266,6 @@ test('an absent file leaves every project exactly as it was', () => {
   });
 });
 
-test('the approval prompt names its feature', () => {
-  // Without the name a user types a bare nonce and cannot tell which closeout they are
-  // approving, while the recorded file can influence which packet resolves.
-  for (const runtimeDir of ['claude', 'codex']) {
-    const hook = fs.readFileSync(
-      path.join(PACKAGE_ROOT, 'src', runtimeDir, 'hooks', 'completion-authority.cjs'), 'utf8'
-    );
-    assert.match(hook, /const feature = result\.candidate\?\.featureName;/, `${runtimeDir} must read the name`);
-    assert.match(hook, /closeout approval is required for \$\{feature \?/, `${runtimeDir} must print it`);
-  }
-});
-
 test('the shared workflow resolver ignores the recorded file', () => {
   // resolveWorkflowCandidate has five consumers, including spec-state.cjs and
   // precompact.cjs. Reading the file inside it would retarget hooks that never asked,

package/bin/__tests__/specs-v2-execution-closeout.test.js

@@ -18,8 +18,6 @@ const VALIDATOR = path.join(SCRIPTS, 'validate-spec-output.cjs');
 const AUTHORING_VALIDATION = path.join(SCRIPTS, 'spec-authoring-validation.cjs');
 const RUNTIME_CLOSURE = require('./test-runtime-dependency-closure.cjs');
 const SEMANTIC_MODEL = require(path.join(SCRIPTS, 'spec-semantic-model.cjs'));
-const CLAUDE_CHECK = require(path.join(ROOT, 'src/claude/hooks/completion-authority-check.cjs'));
-const CODEX_CHECK = require(path.join(ROOT, 'src/codex/hooks/completion-authority-check.cjs'));
 const FEATURE = 'closeout-demo';
 const TASK = 'tasks/task-R1-01-closeout.md';
 const TEMP_RUN_ID = String(process.env.CAFEKIT_CLOSEOUT_TEMP_RUN_ID || `${process.pid}-${Date.now()}`)
@@ -267,10 +265,7 @@ function installGate(root, kind) {
     'hooks/lib/hook-payload.cjs',
   ]);
   if (kind === 'claude') {
-    for (const name of [
-      'spec-gate.cjs', 'completion-authority-check.cjs', 'completion-authority-state.cjs',
-      'semantic-review-authority.cjs',
-    ]) fs.copyFileSync(path.join(ROOT, 'src/claude/hooks', name), path.join(runtimeDir, 'hooks', name));
+    fs.copyFileSync(path.join(ROOT, 'src/claude/hooks', 'spec-gate.cjs'), path.join(runtimeDir, 'hooks', 'spec-gate.cjs'));
   } else {
     fs.cpSync(path.join(ROOT, 'src/codex/hooks'), path.join(runtimeDir, 'hooks'), { recursive: true });
   }
@@ -339,11 +334,11 @@ test('Claude and Codex gates require task proof at every Stop and feature proof
       const invalidAliasSpec = JSON.parse(fs.readFileSync(invalidAliasFile, 'utf8'));
       invalidAliasSpec.status = 'completed';
       fs.writeFileSync(invalidAliasFile, `${JSON.stringify(invalidAliasSpec, null, 2)}\n`);
-      assert.match(gate(invalidAlias, kind), /spec status is invalid: completed/, `${kind} rejects legacy aliases in schema 2.1`);
+      assert.match(gate(invalidAlias, kind), /Legacy spec\.json closeout is no longer supported/, `${kind} blocks legacy 2.1 closeout with the migration message`);
       prepare(taskless, { taskless: true, specStatus: 'complete', featureReceipt: true });
-      assert.equal(gate(taskless, kind), '', `${kind} taskless closeout`);
+      assert.match(gate(taskless, kind), /Legacy spec\.json closeout is no longer supported/, `${kind} taskless 2.1 closeout is retired`);
       fs.appendFileSync(path.join(taskless, 'specs', FEATURE, 'requirements.md'), '\nSemantic mutation after review.\n');
-      assert.match(gate(taskless, kind), /validation failed|semantic digest|stale/i, `${kind} rejects stale semantics with unchanged execution provenance`);
+      assert.match(gate(taskless, kind), /Legacy spec\.json closeout is no longer supported/, `${kind} still blocks a changed 2.1 packet`);
       prepare(taskBearing, { taskReceipt: false, featureReceipt: false });
       assert.match(gate(taskBearing, kind), new RegExp(path.basename(TASK)), `${kind} unproven done task before closeout`);
       prepare(taskBearing, { taskReceipt: true, featureReceipt: false });
@@ -377,21 +372,6 @@ test('an unproven done dependency cannot advance a dependent task', () => {
   });
 });
 
-test('completion authority supports taskless v2 and binds task plan plus receipt bytes', () => {
-  for (const [kind, checker] of [['claude', CLAUDE_CHECK], ['codex', CODEX_CHECK]]) {
-    withTempResources((resources) => {
-      const root = gitRoot(resources);
-      resources.useHome(`${kind}-home`);
-      prepare(root, { taskless: true, specStatus: 'complete', featureReceipt: true });
-      const args = { policy: POLICY, projectRoot: root, runtime: {}, payload: { session_id: 'execution-session' } };
-      if (kind === 'claude') args.resolver = require(path.join(SCRIPTS, 'spec-resolver.cjs'));
-      const result = checker.evaluateCloseout(args);
-      assert.equal(result.ok, true, result.reason);
-      assert.match(result.binding.feature_receipt_digest, /^[a-f0-9]{64}$/);
-    });
-  }
-});
-
 test('shared taskless terminal predicate requires canonical 2.1 policy and physical tasklessness', () => {
   withTempResources((resources) => {
     const root = gitRoot(resources);
@@ -413,51 +393,6 @@ test('shared taskless terminal predicate requires canonical 2.1 policy and physi
   });
 });
 
-test('completion authority activates only at durable closeout and honors the Stop loop guard', () => {
-  for (const [kind, checker] of [['claude', CLAUDE_CHECK], ['codex', CODEX_CHECK]]) {
-    withTempResources((resources) => {
-      const root = gitRoot(resources);
-      resources.useHome(`${kind}-home`);
-      prepare(root, { featureReceipt: false });
-      const args = { policy: POLICY, projectRoot: root, runtime: {}, payload: { session_id: 'execution-session' } };
-      if (kind === 'claude') args.resolver = require(path.join(SCRIPTS, 'spec-resolver.cjs'));
-      const inactive = checker.evaluateCloseout(args);
-      assert.equal(inactive.ok, true, inactive.reason);
-      assert.equal(inactive.active, false);
-
-      args.payload.stop_hook_active = true;
-      const loop = checker.evaluateCloseout(args);
-      assert.equal(loop.ok, true, loop.reason);
-      assert.equal(loop.active, false);
-
-      prepare(root, { specStatus: 'complete', featureReceipt: false });
-      args.payload.stop_hook_active = false;
-      const blocked = checker.evaluateCloseout(args);
-      assert.equal(blocked.ok, false);
-      assert.match(blocked.reason, /feature-receipt\.md/);
-    });
-  }
-});
-
-test('v2 floor merge keeps axes independent, planning controls artifact profile, and risks raise assurance floor', () => {
-  const policy = {
-    PLANNING_DEPTHS: ['None', 'Compact', 'Full'], ASSURANCE_LEVELS: ['Routine', 'Elevated', 'Strict'],
-    compatibilityLane: POLICY.compatibilityLane, planningObligationsFor: POLICY.planningObligationsFor,
-    obligationsForAssurance: POLICY.obligationsForAssurance, actorNeedsFor: POLICY.actorNeedsFor,
-    classifyLane: POLICY.classifyLane,
-  };
-  const floor = { version: '2', planning_depth: 'Full', automatic_planning_depth: 'Full', assurance_level: 'Routine', automatic_assurance_level: 'Routine', lane: 'Standard', automatic_lane: 'Standard', risks: [], artifact_profile: 'strict', planning_obligations: [], proof_obligations: [], actor_needs: [] };
-  const current = { ...floor, planning_depth: 'Compact', automatic_planning_depth: 'Compact', risks: ['privacy'], artifact_profile: 'bounded' };
-  for (const checker of [CLAUDE_CHECK, CODEX_CHECK]) {
-    const merged = checker.mergePolicyFloor(policy, floor, current);
-    assert.equal(merged.planning_depth, 'Full');
-    assert.equal(merged.artifact_profile, 'strict');
-    assert.equal(merged.automatic_assurance_level, 'Elevated');
-    assert.equal(merged.assurance_level, 'Elevated');
-    assert.ok(merged.proof_obligations.includes('needsExecutionProof'));
-  }
-});
-
 test('scaffold creates planning artifacts but no task or feature receipts', () => {
   withTempResources((resources) => {
     const root = resources.directory('scaffold-root');

package/bin/__tests__/ui-ux-skill.test.js

@@ -0,0 +1,101 @@
+'use strict';
+
+// cf:ui-ux is evondevKit's ui-ux skill vendored byte-identical apart from its frontmatter
+// and one body line. A resync copies the upstream tree again, so each case here pins what
+// that copy must not lose, and states the failure it prevents.
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+
+const { loadClaudeMigrationManifest } = require('../lib/context');
+
+const PACKAGE_ROOT = path.join(__dirname, '..', '..');
+const INSTALLER = path.join(PACKAGE_ROOT, 'bin/install.js');
+const SKILL_DIR = path.join(PACKAGE_ROOT, 'src/claude/skills/ui-ux');
+const SKILL_SOURCE = path.join(SKILL_DIR, 'SKILL.md');
+const PRO_MAX_SOURCE = path.join(PACKAGE_ROOT, 'src/claude/skills/ui-ux-pro-max/SKILL.md');
+
+function inTempProject(run) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-ui-ux-skill-'));
+  try {
+    const init = spawnSync('git', ['-C', root, 'init', '-q'], { encoding: 'utf8' });
+    assert.equal(init.status, 0, init.stderr);
+    return run(root);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+function install(root, platforms, extra = []) {
+  return spawnSync(process.execPath, [INSTALLER, '--platform', platforms.join(','), '--yes', ...extra],
+    { cwd: root, encoding: 'utf8', env: { ...process.env, PATH: '/usr/bin:/bin' } });
+}
+
+function frontmatterLines(content) {
+  const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  assert.ok(match, 'SKILL.md must open with a frontmatter block');
+  return match[1].split(/\r?\n/);
+}
+
+function field(lines, key) {
+  const line = lines.find((entry) => entry.startsWith(`${key}:`));
+  return line === undefined ? undefined : line.slice(key.length + 1).trim();
+}
+
+test('manifest requires ui-ux', () => {
+  // Without the entry the installer never copies the skill, and nothing else fails.
+  const required = loadClaudeMigrationManifest().skills.required;
+  assert.equal(required.includes('ui-ux'), true);
+  assert.equal(required.includes('ui-ux-pro-max'), true, 'the lookup skill stays installed beside it');
+});
+
+test('cf:ui-ux frontmatter carries routing metadata and the MIT license', () => {
+  // A resync that copies upstream SKILL.md whole brings back `name: ui-ux` (no catalog
+  // identity), the Vietnamese description, and `grep -rlE "$1"`, which Claude Code fills
+  // with the invocation arguments and so corrupts the style audit.
+  const content = fs.readFileSync(SKILL_SOURCE, 'utf8');
+  const lines = frontmatterLines(content);
+  assert.equal(field(lines, 'name'), 'cf:ui-ux');
+  assert.equal(field(lines, 'license'), 'MIT');
+  assert.equal(field(lines, 'category'), 'frontend');
+  assert.ok(field(lines, 'when_to_use'), 'when_to_use must be set');
+  assert.match(field(lines, 'keywords') || '', /^\[.+\]$/, 'keywords must be a non-empty list');
+
+  const description = field(lines, 'description') || '';
+  assert.ok(description.length > 2 && description.length <= 1024, `description length ${description.length}`);
+
+  assert.doesNotMatch(content, /\$[0-9]/, 'no positional argument placeholder in the skill body');
+  assert.doesNotMatch(content, /\$ARGUMENTS/);
+
+  // MIT requires the copyright and permission notice to travel with the copy.
+  assert.equal(fs.existsSync(path.join(SKILL_DIR, 'LICENSE')), true);
+  const pkg = JSON.parse(fs.readFileSync(path.join(SKILL_DIR, 'scripts', 'package.json'), 'utf8'));
+  assert.ok(pkg.dependencies && pkg.dependencies.playwright, 'the installer provisions Playwright only when declared');
+});
+
+test('ui-ux-pro-max when_to_use no longer claims layout or design systems', () => {
+  // Both skills advertising layout and design systems leaves the host to pick at random.
+  const lines = frontmatterLines(fs.readFileSync(PRO_MAX_SOURCE, 'utf8'));
+  const whenToUse = field(lines, 'when_to_use') || '';
+  assert.doesNotMatch(whenToUse, /layout/i);
+  assert.doesNotMatch(whenToUse, /design system/i);
+  assert.match(whenToUse, /cf:ui-ux/);
+});
+
+test('fresh claude install copies ui-ux with its playwright package manifest', () => {
+  // The package manifest is what makes --with-skills-deps install Playwright for probe.mjs.
+  inTempProject((root) => {
+    const result = install(root, ['claude']);
+    assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+
+    const installedSkill = path.join(root, '.claude', 'skills', 'ui-ux', 'SKILL.md');
+    const installedPackage = path.join(root, '.claude', 'skills', 'ui-ux', 'scripts', 'package.json');
+    assert.equal(fs.existsSync(installedSkill), true, 'the skill directory must be installed');
+    assert.equal(fs.existsSync(installedPackage), true, 'scripts/package.json must be installed');
+    assert.match(fs.readFileSync(installedSkill, 'utf8'), /^name: cf:ui-ux$/m);
+  });
+});

package/bin/__tests__/usage-hook-retired.test.js

@@ -0,0 +1,114 @@
+'use strict';
+
+// usage.cjs read the Claude Code OAuth token from the macOS Keychain to call an undocumented
+// quota endpoint; the statusline now reads Claude Code's own rate_limits instead. Each case
+// pins one way the hook could survive the removal: a fresh install, an upgrade on Claude
+// (removeObsoleteClaudeRuntimeFiles deletes unconditionally; the settings prune matches by
+// substring, so it must not take a user's own hook), an upgrade on omp (whose tracker keys
+// are `.omp/…`), and the source lists themselves.
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+
+const PACKAGE_ROOT = path.join(__dirname, '..', '..');
+const INSTALLER = path.join(PACKAGE_ROOT, 'bin/install.js');
+const MANIFEST = JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, 'src/claude/migration-manifest.json'), 'utf8'));
+const SOURCE_SETTINGS = JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, 'src/claude/settings/settings.json'), 'utf8'));
+const BRIDGE = fs.readFileSync(path.join(PACKAGE_ROOT, 'src/omp/extensions/cafekit-bridge.mjs'), 'utf8');
+
+const CAFEKIT_USAGE_COMMAND = 'node "$CLAUDE_PROJECT_DIR/.claude/hooks/usage.cjs"';
+const FOREIGN_USAGE_COMMAND = 'node ~/my-hooks/usage.cjs';
+
+function inTempProject(run) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-usage-retired-'));
+  try {
+    const init = spawnSync('git', ['-C', root, 'init', '-q'], { encoding: 'utf8' });
+    assert.equal(init.status, 0, init.stderr);
+    return run(root);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+function install(root, platforms) {
+  const result = spawnSync(process.execPath, [INSTALLER, '--platform', platforms.join(','), '--yes'],
+    { cwd: root, encoding: 'utf8', env: { ...process.env, PATH: '/usr/bin:/bin' } });
+  assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+}
+
+function commands(settings) {
+  return Object.values(settings.hooks || {})
+    .flat()
+    .flatMap((group) => (group.hooks || []).map((hook) => hook.command));
+}
+
+test('fresh claude install ships no usage hook', () => {
+  inTempProject((root) => {
+    install(root, ['claude']);
+    assert.equal(fs.existsSync(path.join(root, '.claude', 'hooks', 'usage.cjs')), false);
+    const settings = JSON.parse(fs.readFileSync(path.join(root, '.claude', 'settings.json'), 'utf8'));
+    assert.equal(commands(settings).some((command) => command.includes('usage.cjs')), false);
+  });
+});
+
+test('upgrade removes an installed usage hook and its CafeKit entries but keeps a foreign one', () => {
+  inTempProject((root) => {
+    install(root, ['claude']);
+    const settingsPath = path.join(root, '.claude', 'settings.json');
+    const before = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+    const kept = commands(before);
+
+    // An older install, edited by the user: the file differs from anything CafeKit shipped.
+    fs.writeFileSync(path.join(root, '.claude', 'hooks', 'usage.cjs'), '// user edit\n');
+    before.hooks.UserPromptSubmit[0].hooks.push(
+      { type: 'command', command: CAFEKIT_USAGE_COMMAND, timeout: 30 },
+      { type: 'command', command: FOREIGN_USAGE_COMMAND },
+    );
+    before.hooks.PostToolUse.push({
+      matcher: 'Edit|Write|MultiEdit',
+      hooks: [{ type: 'command', command: CAFEKIT_USAGE_COMMAND, timeout: 30 }],
+    });
+    fs.writeFileSync(settingsPath, JSON.stringify(before, null, 2));
+
+    install(root, ['claude']);
+    assert.equal(fs.existsSync(path.join(root, '.claude', 'hooks', 'usage.cjs')), false, 'an edited copy is removed too');
+    const after = commands(JSON.parse(fs.readFileSync(settingsPath, 'utf8')));
+    assert.equal(after.includes(CAFEKIT_USAGE_COMMAND), false, 'both CafeKit entries are pruned');
+    assert.equal(after.includes(FOREIGN_USAGE_COMMAND), true, 'a hook outside .claude/hooks/ survives');
+    for (const command of kept) assert.ok(after.includes(command), `kept: ${command}`);
+  });
+});
+
+test('omp upgrade removes an installed usage hook and its manifest record', () => {
+  inTempProject((root) => {
+    install(root, ['omp']);
+    const hookPath = path.join(root, '.omp', 'hooks', 'usage.cjs');
+    const manifestPath = path.join(root, '.omp', 'cafekit-manifest.json');
+    fs.writeFileSync(hookPath, '// shipped by an older CafeKit\n');
+    const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    // omp records keys relative to the project root (recordRoot '.').
+    manifest.files['.omp/hooks/usage.cjs'] = { sha256: '0'.repeat(64) };
+    fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2));
+
+    install(root, ['omp']);
+    assert.equal(fs.existsSync(hookPath), false);
+    const afterManifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    assert.equal(Object.prototype.hasOwnProperty.call(afterManifest.files, '.omp/hooks/usage.cjs'), false);
+  });
+});
+
+test('no runtime ships or bridges usage.cjs', () => {
+  assert.equal(MANIFEST.runtime.files.includes('hooks/usage.cjs'), false);
+  assert.equal(BRIDGE.includes("'usage.cjs'"), false);
+  assert.equal(fs.existsSync(path.join(PACKAGE_ROOT, 'src/claude/hooks/usage.cjs')), false);
+  assert.ok(MANIFEST.obsolete.runtimeFiles.includes('hooks/usage.cjs'));
+  assert.ok(MANIFEST.obsolete.settingsHookCommandSubstrings.includes('.claude/hooks/usage.cjs'));
+  // The installer's merge drops an empty group, so only the source can show one.
+  for (const [event, groups] of Object.entries(SOURCE_SETTINGS.hooks)) {
+    for (const group of groups) assert.ok(group.hooks.length > 0, `${event} ${group.matcher} has no hooks`);
+  }
+});

package/bin/__tests__/validator-grounding.test.js

@@ -150,7 +150,7 @@ function semanticDigest(specDir) {
   return result.stdout.trim();
 }
 
-function completeSemanticReview(specDir, independence = 'same-session') {
+function completeSemanticReview(specDir) {
   const statePath = path.join(specDir, 'spec.json');
   const state = JSON.parse(fs.readFileSync(statePath, 'utf8'));
   state.validation = isPlainObjectForTest(state.validation) ? state.validation : {};
@@ -166,24 +166,6 @@ function completeSemanticReview(specDir, independence = 'same-session') {
     }],
   };
   write(statePath, JSON.stringify(state, null, 2));
-  if (independence === 'independent') {
-    const root = path.dirname(path.dirname(specDir));
-    const featureName = state.feature_name;
-    const claim = `CAFEKIT_SEMANTIC_REVIEW_ATTESTATION ${JSON.stringify({
-      feature_name: featureName,
-      spec_file: path.relative(root, statePath),
-      semantic_digest: state.validation.semantic_review.reviewed_artifact_digest,
-      verdict: 'PASS',
-    })}`;
-    const result = spawnSync(process.execPath, [path.join(ROOT, 'src/claude/hooks/semantic-review-authority.cjs')], {
-      cwd: root,
-      env: { ...process.env, HOME: path.join(root, '.home'), USERPROFILE: path.join(root, '.home'), PROJECT_ROOT: root },
-      input: JSON.stringify({ hook_event_name: 'SubagentStop', session_id: 'host-session', agent_id: 'review-agent', agent_type: 'code_auditor', last_assistant_message: claim, cwd: root }),
-      encoding: 'utf8',
-    });
-    assert.equal(result.status, 0, output(result));
-    assert.equal(result.stderr, '');
-  }
   return state;
 }
 
@@ -549,7 +531,7 @@ test('Codex installer transform preserves all owned spec assets with idempotent
   const review = fs.readFileSync(path.join(ROOT, 'src/claude/skills/specs/references/review.md'), 'utf8');
   const templates = fs.readFileSync(path.join(ROOT, 'src/claude/skills/specs/references/templates.md'), 'utf8');
   assert.match(skill, /specs\/<feature>\/[\s\S]{0,160}plan\.md[\s\S]{0,160}task-01-<slug>\.md/);
-  assert.match(skill, /C1 — Scope[\s\S]*C2 — Findings[\s\S]*C3 — Done/);
+  assert.match(skill, /GATE-SCOPE[\s\S]*GATE-REVIEW[\s\S]*GATE-DONE/);
   assert.doesNotMatch(skill, /--(?:status|validate|archive)\b/);
   assert.match(review, /path:line/);
   assert.match(review, /Cap the presented[\s\S]{0,40}list at 15/);
@@ -1496,10 +1478,7 @@ test('all ready non-Direct specs require semantic design and coherent authoring
     state.timestamps = lifecycleTimestamps();
     mutate(state, specDir);
     write(specPath, JSON.stringify(state, null, 2));
-    completeSemanticReview(
-      specDir,
-      state.workflow_policy.assurance_level === 'Strict' ? 'independent' : 'same-session',
-    );
+    completeSemanticReview(specDir);
     return specDir;
   }
 
@@ -1519,7 +1498,8 @@ test('all ready non-Direct specs require semantic design and coherent authoring
       write(path.join(specDir, 'design.md'), criticalNoObligationDesign());
     });
     result = run(VALIDATOR, [strictAuthoring], ROOT);
-    assert.equal(result.status, 0, output(result));
+    assert.notEqual(result.status, 0);
+    assert.match(output(result), /Strict assurance is no longer supported/);
 
     const invalidCases = [
       ['boolean-created-at', (state) => { state.created_at = true; }, /created_at: must be an ISO 8601 timestamp|created_at: ready handoff requires/],
@@ -1562,7 +1542,7 @@ test('all ready non-Direct specs require semantic design and coherent authoring
   }
 });
 
-test('spec-ready excludes execution receipts while preserving Strict review state', () => {
+test('spec-ready excludes execution receipts and refuses Strict as no longer supported', () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cafekit-validator-spec-ready-'));
   try {
     const standardDir = createSpec(root, {
@@ -1602,9 +1582,10 @@ test('spec-ready excludes execution receipts while preserving Strict review stat
         timestamps: lifecycleTimestamps({ research: true, review: true }),
       },
     });
-    completeSemanticReview(criticalDir, 'independent');
+    completeSemanticReview(criticalDir);
     const criticalResult = run(VALIDATOR, [criticalDir], ROOT);
-    assert.equal(criticalResult.status, 0, output(criticalResult));
+    assert.notEqual(criticalResult.status, 0);
+    assert.match(output(criticalResult), /Strict assurance is no longer supported/);
   } finally {
     fs.rmSync(root, { recursive: true, force: true });
   }

package/bin/phases/codex-runtime.js

@@ -23,6 +23,29 @@ const CODEX_OWN_RUNTIME = [
   ['runtime.json', 'runtime.json']
 ];
 
+/**
+ * Delete hooks the manifest marks obsolete. Codex tracker keys are project-relative
+ * (`.codex/hooks/…`), so the record is pruned through keyFor, and always: a record whose
+ * file is already gone must still leave the manifest.
+ */
+function removeObsoleteCodexHooks(ctx, platformKey) {
+  const platform = PLATFORMS[platformKey];
+  const tracker = ctx.trackers && ctx.trackers[platformKey];
+  const obsoleteHooks = (ctx.manifest?.obsolete?.runtimeFiles || []).filter((rel) => rel.startsWith('hooks/'));
+  for (const rel of obsoleteHooks) {
+    const target = path.join(platform.folder, rel);
+    const exists = fs.existsSync(target);
+    if (!ctx.dryRun) {
+      if (exists) fs.rmSync(target, { force: true, recursive: fs.statSync(target).isDirectory() });
+      if (tracker) tracker.prune(tracker.keyFor(target));
+    }
+    if (exists) {
+      ctx.ui.detail(`  ↻ ${ctx.dryRun ? '[dry-run] ' : ''}Removed obsolete Codex runtime: ${rel}`);
+      ctx.results.updated++;
+    }
+  }
+}
+
 function writeSourceFile(ctx, platformKey, src, dest, label) {
   const platform = PLATFORMS[platformKey];
   const { action } = writeManagedFile({
@@ -64,6 +87,7 @@ function installRuntimeFiles(ctx, platformKey) {
     tracker: ctx.trackers[platformKey]
   });
   report(ctx, treeAction(agg), 'Codex native hooks');
+  removeObsoleteCodexHooks(ctx, platformKey);
   // Keep one canonical command analyzer in the Claude source tree, then
   // materialize the same bytes into the installed Codex runtime.
   // One canonical runtime schema lives in the Claude source tree; both installed

package/bin/phases/omp-runtime.js

@@ -128,9 +128,31 @@ function installBridge(ctx, platformKey) {
   }
 }
 
+/**
+ * Delete hooks the manifest marks obsolete. Mirrors removeObsoleteClaudeRuntimeFiles, but the
+ * omp tracker records keys relative to the project root (`.omp/hooks/…`), so the record is
+ * pruned through keyFor rather than by the bare `hooks/…` path.
+ */
+function removeObsoleteOmpHooks(ctx, platformKey) {
+  const platform = PLATFORMS[platformKey];
+  const tracker = ctx.trackers && ctx.trackers[platformKey];
+  const obsoleteHooks = (ctx.manifest?.obsolete?.runtimeFiles || []).filter((rel) => rel.startsWith('hooks/'));
+  for (const rel of obsoleteHooks) {
+    const target = path.join(platform.folder, rel);
+    if (!fs.existsSync(target)) continue;
+    if (!ctx.dryRun) {
+      fs.rmSync(target, { force: true, recursive: fs.statSync(target).isDirectory() });
+      if (tracker) tracker.prune(tracker.keyFor(target));
+    }
+    ctx.ui.detail(`  ↻ ${ctx.dryRun ? '[dry-run] ' : ''}Removed obsolete omp runtime: ${rel}`);
+    ctx.results.updated++;
+  }
+}
+
 function installOmpRuntime(ctx, platformKey) {
   if (platformKey !== 'omp') return;
   installHooks(ctx, platformKey);
+  removeObsoleteOmpHooks(ctx, platformKey);
   installRuntimeFiles(ctx, platformKey);
   installBridge(ctx, platformKey);
   copyRulesDirectory(ctx, platformKey);