@haposoft/cafekit 0.18.0 → 0.18.2

package/bin/__tests__/privacy-paths.test.js

@@ -0,0 +1,317 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { test, after } = require('node:test');
+const SOURCE = path.resolve(__dirname, '../../src');
+const roots = [];
+
+function fixture(host) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ck-privacy-paths-'));
+  roots.push(root);
+  if (host === 'codex') {
+    assert.equal(spawnSync('git', ['init', '-q', root]).status, 0);
+    const install = spawnSync(process.execPath, [path.resolve(__dirname, '../install.js'), '--platform', 'codex', '-y'], {
+      cwd: root, encoding: 'utf8',
+    });
+    assert.equal(install.status, 0, install.stderr);
+  } else {
+    fs.cpSync(path.join(SOURCE, 'claude/hooks'), path.join(root, '.claude/hooks'), { recursive: true });
+  }
+  return { root, hooks: path.join(root, `.${host}/hooks`) };
+}
+
+function invoke(f, tool_name, tool_input, spawnOptions = {}) {
+  const env = { ...process.env };
+  delete env.CLAUDE_PROJECT_DIR;
+  const result = spawnSync(process.execPath, [path.join(f.hooks, 'privacy-block.cjs')], {
+    cwd: f.cwd || f.root, encoding: 'utf8', env,
+    input: JSON.stringify({ tool_name, tool_input, cwd: f.cwd || f.root, session_id: 'privacy-paths-probe' }),
+    ...spawnOptions,
+  });
+  assert.equal(result.status, 0, result.stderr);
+  assert.equal(result.stderr, '', 'hook must not emit a stack trace');
+  return result.stdout.trim() ? JSON.parse(result.stdout).hookSpecificOutput : null;
+}
+
+after(() => {
+  for (const root of roots) {
+    const locked = path.join(root, 'locked');
+    if (fs.existsSync(locked)) fs.chmodSync(locked, 0o700);
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+const cases = [
+  ['Read sensitive', 'Read', { file_path: '.env' }, true],
+  ['Grep sensitive glob', 'Grep', { pattern: 'x', glob: '.env*' }, true],
+  ['NotebookEdit sensitive notebook_path', 'NotebookEdit', { notebook_path: '.env' }, true],
+  ['MCP path', 'mcp__fs__read_file', { path: '.env' }, true],
+  ['MCP nested file_path', 'mcp__x__y', { args: { file_path: 'certs/a.pem' } }, true],
+  ['MCP file uri', 'mcp__fs__read', root => ({ uri: `file://${root}/.env` }), true],
+  ['MCP source destination', 'mcp__fs__move_file', { source: '.env', destination: 'x' }, true],
+  ['MCP relative_path', 'mcp__s__read', { relative_path: '.env' }, true],
+  ['Bash sensitive operand', 'Bash', { command: 'cat .env' }, true],
+  ['Bash env-file option', 'Bash', { command: 'docker compose --env-file .env up' }, true],
+  ['shell argv bash -lc', 'shell', { command: ['bash', '-lc', 'cat .env'] }, true],
+  ['patch Update File', 'apply_patch', { command: '*** Begin Patch\n*** Update File: .env\n*** End Patch' }, true],
+  ['patch Move to', 'apply_patch', { command: '*** Begin Patch\n*** Update File: a.txt\n*** Move to: .env\n*** End Patch' }, true],
+  ['Read ordinary file', 'Read', { file_path: 'app.ts' }, false],
+  ['Read exempt .env.example', 'Read', { file_path: '.env.example' }, false],
+  ['Grep ordinary glob', 'Grep', { pattern: 'API_KEY', glob: '*.ts' }, false],
+  ['Bash ls', 'Bash', { command: 'ls' }, false],
+];
+
+for (const host of ['claude', 'codex']) {
+  const f = fixture(host);
+  for (const [name, tool, input, sensitive] of cases) {
+    test(`privacy-paths ${host}: ${name}`, () => {
+      const output = invoke(f, tool, typeof input === 'function' ? input(f.root) : input);
+      if (!sensitive) return assert.equal(output, null);
+      assert.equal(output?.permissionDecision, host === 'claude' ? 'ask' : 'deny');
+      if (host === 'codex') {
+        assert.match(output.permissionDecisionReason, /APPROVE CAFEKIT PRIVACY /);
+        assert.match(output.permissionDecisionReason, /y \(or yes \/ có\)/);
+      }
+    });
+  }
+}
+
+test('privacy-paths codex: missing shared lib denies even Bash ls', () => {
+  const f = fixture('codex');
+  fs.rmSync(path.join(f.hooks, 'lib/privacy-paths.cjs'), { force: true });
+  const output = invoke(f, 'Bash', { command: 'ls' });
+  assert.equal(output?.permissionDecision, 'deny');
+  assert.match(output.permissionDecisionReason, /could not be evaluated safely/);
+});
+
+test('privacy-paths: unavailable glob matcher keeps sensitive children', () => {
+  const f = fixture('claude');
+  fs.writeFileSync(path.join(f.root, 'credentials.json'), '');
+  const { sensitivePaths } = require(path.join(SOURCE, 'claude/hooks/lib/privacy-paths.cjs'));
+  const original = path.matchesGlob;
+  try {
+    path.matchesGlob = undefined;
+    let paths;
+    assert.doesNotThrow(() => { paths = sensitivePaths('Grep', { glob: '*.ts' }, f.root); });
+    assert.ok(paths.includes(path.join(f.root, 'credentials.json')));
+  } finally {
+    path.matchesGlob = original;
+  }
+});
+
+const runtimeWrites = [
+  ['Write runtime', 'Write', { file_path: '.claude/runtime.json' }],
+  ['Edit runtime', 'Edit', { file_path: '.codex/runtime.json' }],
+  ['NotebookEdit runtime', 'NotebookEdit', { notebook_path: '.omp/runtime.json' }],
+  ['patch approval directory', 'apply_patch', { command: '*** Begin Patch\n*** Add File: .codex/hooks/.privacy/g.json\n*** End Patch' }],
+  ['MCP runtime', 'mcp__fs__write_file', { path: '.claude/runtime.json' }],
+  ['MultiEdit runtime', 'MultiEdit', { edits: [{ file_path: '.claude/runtime.json' }] }],
+  ['Write backslash runtime', 'Write', { file_path: '.CLAUDE\\RUNTIME.JSON' }],
+  ['symlink directory Write', 'Write', { file_path: 'c/runtime.json' }],
+  ['symlink directory shell', 'Bash', { command: "echo '{}' > c/runtime.json" }],
+  ['dangling approval symlink', 'Write', { file_path: 'links/lnk2' }],
+  ['dangling runtime symlink', 'Write', { file_path: 'links/lnk-runtime' }],
+  ['chained approval symlink', 'Bash', { command: 'echo x > links/t1' }],
+  ['chained runtime symlink', 'Bash', { command: 'echo x > links/r1' }],
+  ['looping write symlink', 'Bash', { command: 'echo x > links/loop1' }],
+  ...[
+    'cp -r evil/.claude .', 'mv evil/.codex .', 'cp -r evil/.omp .', 'mv evil/.privacy .',
+  ].map(command => [`runtime directory source ${command}`, 'Bash', { command }]),
+  ['clobber redirect', 'Bash', { command: 'echo x >| .claude/runtime.json' }],
+  ['quoted heredoc header tail', 'Bash', { command: "cat <<'EOF' > .claude/runtime.json\n{}\nEOF" }],
+  ...[
+    'cd "$PWD/.claude" && echo \'{}\' > runtime.json',
+    'cd $(pwd)/.claude && cp /tmp/r runtime.json',
+  ].map(command => [`dynamic directory ${command}`, 'Bash', { command }]),
+  ...[
+    'cp /tmp/r.json .claude/runtime.json > /dev/null',
+    'cp /tmp/r.json .claude/runtime.json 2>&1',
+    'mv r .codex/runtime.json 2>/dev/null',
+    'install r .omp/runtime.json > /dev/null',
+    'ln r .claude/runtime.json 2>&1',
+    'cp /tmp/r.json .claude/runtime.json < /dev/null',
+    'cp /tmp/r.json .claude/runtime.json <<< x',
+    'cp a .claude/runtime.json 0</dev/null',
+    'cp a .claude/runtime.json 0< /dev/null',
+    'cp a .claude/runtime.json 3</dev/null',
+  ].map(command => [`redirect operands ${command}`, 'Bash', { command }]),
+  ...[
+    "echo '{}' > .claude/runtime.json", "echo '{}' > .CLAUDE/RUNTIME.JSON",
+    'echo x >> .claude/./runtime.json', 'tee .codex//runtime.json',
+    'sed -i s/a/b/ .omp/runtime.json', 'cp r.json .claude/',
+    'mv r.json .codex/runtime.json', 'cp t .codex/hooks/./.privacy/',
+    'cd .claude && cp /tmp/r.json runtime.json', 'echo x > sub/.claude/runtime.json',
+    'install r.json .omp/', 'ln r.json .codex/runtime.json',
+    'pushd .codex && echo x > runtime.json',
+    "sed -ni 's/a/b/p' .claude/runtime.json", 'cp -t.claude r.json',
+    'cd .claude && echo "$(echo x > runtime.json)"',
+  ].map(command => [command, 'Bash', { command }]),
+];
+const runtimeAllowed = [
+  ['Read runtime', 'Read', { file_path: '.claude/runtime.json' }],
+  ['cat .codex/runtime.json', 'Bash', { command: 'cat .codex/runtime.json' }],
+  ['jq .paths .claude/runtime.json', 'Bash', { command: 'jq .paths .claude/runtime.json' }],
+  ['Write ordinary runtime', 'Write', { file_path: 'docs/runtime.json' }],
+  ['Write resolved ordinary runtime', 'Write', { file_path: '.claude/../docs/runtime.json' }],
+];
+
+for (const host of ['claude', 'codex']) {
+  const f = fixture(host);
+  fs.mkdirSync(path.join(f.root, '.claude'), { recursive: true });
+  fs.symlinkSync('.claude', path.join(f.root, 'c'), 'dir');
+  fs.mkdirSync(path.join(f.root, 'links'));
+  fs.symlinkSync('../.codex/hooks/.privacy/g.json', path.join(f.root, 'links/lnk2'));
+  fs.symlinkSync('../.claude/runtime.json', path.join(f.root, 'links/lnk-runtime'));
+  fs.symlinkSync('t2', path.join(f.root, 'links/t1'));
+  fs.symlinkSync('../.codex/hooks/.privacy/g.json', path.join(f.root, 'links/t2'));
+  fs.symlinkSync('r2', path.join(f.root, 'links/r1'));
+  fs.symlinkSync('../.claude/runtime.json', path.join(f.root, 'links/r2'));
+  fs.symlinkSync('loop2', path.join(f.root, 'links/loop1'));
+  fs.symlinkSync('loop1', path.join(f.root, 'links/loop2'));
+  for (const name of ['.claude', '.codex', '.omp', '.privacy']) {
+    const directory = path.join(f.root, 'evil', name);
+    fs.mkdirSync(directory, { recursive: true });
+    fs.writeFileSync(path.join(directory, 'runtime.json'), '{}');
+  }
+  for (const [name, tool, input] of runtimeWrites) {
+    test(`privacy-paths ${host}: runtime writes ${name}`, () => {
+      const output = invoke(f, tool, input);
+      assert.equal(output?.permissionDecision, host === 'claude' ? 'ask' : 'deny');
+      assert.doesNotMatch(output.permissionDecisionReason, /could not be evaluated safely/);
+      if (host === 'codex') {
+        assert.match(output.permissionDecisionReason, /APPROVE CAFEKIT PRIVACY /);
+        assert.match(output.permissionDecisionReason, /y \(or yes \/ có\)/);
+      }
+    });
+  }
+  for (const [name, tool, input] of runtimeAllowed) {
+    test(`privacy-paths ${host}: runtime allows ${name}`, () => assert.equal(invoke(f, tool, input), null));
+  }
+}
+
+test('privacy-paths claude: subdirectory switch cannot disable root privacy', () => {
+  const f = fixture('claude');
+  const cwd = path.join(f.root, 'sub');
+  fs.mkdirSync(path.join(cwd, '.claude'), { recursive: true });
+  fs.writeFileSync(path.join(cwd, '.claude/runtime.json'), JSON.stringify({ privacyBlock: false }));
+  fs.writeFileSync(path.join(f.root, '.env'), '');
+  assert.equal(invoke({ ...f, cwd }, 'Read', { file_path: '../.env' })?.permissionDecision, 'ask');
+});
+
+test('privacy-paths claude: root switch still allows a manual opt-out', () => {
+  const f = fixture('claude');
+  fs.writeFileSync(path.join(f.root, '.claude/runtime.json'), JSON.stringify({ privacyBlock: false }));
+  fs.writeFileSync(path.join(f.root, '.env'), '');
+  assert.equal(invoke(f, 'Read', { file_path: '.env' }), null);
+});
+
+const recursiveSensitive = [
+  'grep -r API_KEY .', 'grep -rn API_KEY .', 'grep -Rin key .', 'grep -rl KEY .',
+  'grep --recursive KEY .', 'grep -d recurse KEY .', 'grep -R KEY', 'grep -r KEY src .',
+  "bash -c 'grep -rn KEY .'", 'echo . | xargs grep -r KEY',
+  'rg KEY .', 'rg --hidden KEY .', 'rg -u -u KEY .',
+  "rg --hidden -g '!*.ts' KEY .", "grep -r --include='*' KEY .",
+  'grep -r --include .env KEY .', "grep -r --include='.e*' KEY .",
+  'grep -R KEY linked', 'ag KEY .', 'rg -uu KEY .', 'rg -. KEY .',
+  'grep --dereference-recursive KEY .', 'grep --directories=recurse KEY .',
+  "find src -exec grep -rn KEY . \\;",
+  "rg --iglob 'CREDENTIALS.JSON' KEY .", "rg --glob-case-insensitive -g 'CREDENTIALS.JSON' KEY .",
+  "rg -g '*.ts' --iglob 'CREDENTIALS.JSON' KEY .", "rg -uug '*' KEY hidden",
+];
+const recursiveAllowed = [
+  'grep -r KEY src', 'grep -r --include=*.ts KEY .', "rg -g '*.ts' KEY .",
+  'grep -r KEY app.ts', 'grep -r KEY nope/', 'grep KEY .', 'grep -r KEY examples',
+  'rg --files src', 'grep -reKEY src',
+];
+const recursiveGrep = [
+  { pattern: 'KEY' }, { pattern: 'KEY', path: '.' },
+  { pattern: 'KEY', glob: '*' }, { pattern: 'KEY', glob: '.*' },
+  { pattern: 'KEY', glob: '*.{env,json}' },
+];
+
+for (const host of ['claude', 'codex']) {
+  const f = fixture(host);
+  for (const name of ['.env', 'credentials.json', '.env.example', 'app.ts']) {
+    fs.writeFileSync(path.join(f.root, name), '');
+  }
+  for (const dir of ['src', 'linked', 'examples', 'locked', 'hidden', 'a']) fs.mkdirSync(path.join(f.root, dir));
+  fs.symlinkSync('../.env', path.join(f.root, 'linked/notes.txt'));
+  fs.writeFileSync(path.join(f.root, 'examples/.env.example'), '');
+  fs.writeFileSync(path.join(f.root, 'hidden/.env'), '');
+  fs.writeFileSync(path.join(f.root, 'a/.env'), '');
+  fs.writeFileSync(path.join(f.root, 'aws-production-service-account-credentials-backup-2026.json'), '');
+  const wildcardDirectory = path.join(f.root, 'wildcard-count');
+  fs.mkdirSync(wildcardDirectory);
+  fs.writeFileSync(path.join(wildcardDirectory, `credentials${'a'.repeat(200)}b.json`), '');
+  fs.writeFileSync(path.join(f.root, 'locked/credentials.json'), '');
+  const locked = path.join(f.root, 'locked');
+  fs.chmodSync(locked, 0);
+  const probe = (name, tool, input, sensitive, options = {}) => test(`privacy-paths ${host}: recursive ${name}`, options, () => {
+    const output = invoke(f, tool, input, options.timeout
+      ? { timeout: options.timeout - 1000, killSignal: 'SIGKILL' } : {});
+    if (!sensitive) return assert.equal(output, null);
+    assert.equal(output?.permissionDecision, host === 'claude' ? 'ask' : 'deny');
+    if (host === 'codex') {
+      assert.match(output.permissionDecisionReason, /APPROVE CAFEKIT PRIVACY /);
+      assert.match(output.permissionDecisionReason, /y \(or yes \/ có\)/);
+    }
+  });
+  for (const command of recursiveSensitive) probe(command, 'Bash', { command }, true);
+  for (const input of recursiveGrep) probe(`Grep ${JSON.stringify(input)}`, 'Grep', input, true);
+  for (const command of ["rg -g '/credentials.json' KEY", "rg -g '/*.json' KEY", "rg --hidden -g '/.e*' KEY"]) {
+    probe(`anchored ${command}`, 'Bash', { command }, true);
+  }
+  probe('anchored Grep glob', 'Grep', { pattern: 'KEY', glob: '/*.json' }, true);
+  probe('bounded glob shell range', 'Bash', { command: "rg -g '{1..100000}' -g '*' KEY ." }, true, { timeout: 10000 });
+  probe('bounded glob Grep range', 'Grep', { glob: '{1..100000}' }, true, { timeout: 10000 });
+  probe('bounded glob Grep length', 'Grep', { glob: 'x'.repeat(257) }, true, { timeout: 10000 });
+  probe('bounded combinations shell', 'Bash', {
+    command: `rg -g '${'{a,b}'.repeat(20)}' -g '*' KEY .`,
+  }, true, { timeout: 10000 });
+  probe('bounded combinations nested Grep', 'Grep', {
+    glob: '{a,{b,{c,{d,e}}}}'.repeat(12),
+  }, true, { timeout: 10000 });
+  probe('bounded combinations narrow Grep', 'Grep', {
+    path: '.', glob: '*.{ts,tsx}',
+  }, false, { timeout: 10000 });
+  probe('narrow grammar escaped braces shell', 'Bash', {
+    command: `rg -g '${'\\{a,b\\}'.repeat(20)}' -g '*' KEY .`,
+  }, true, { timeout: 10000 });
+  probe('narrow grammar repeated wildcards Grep', 'Grep', {
+    path: '.', globs: [`${'*?'.repeat(20)}z`, '*'],
+  }, true, { timeout: 10000 });
+  probe('narrow grammar extglob Grep', 'Grep', {
+    glob: '+(a|*)'.repeat(10),
+  }, true, { timeout: 10000 });
+  probe('total wildcard count in brace Grep', 'Grep', {
+    path: 'wildcard-count', globs: ['{*a*a*a*a*az,q}', '*'],
+  }, true, { timeout: 10000 });
+  for (const command of ['rg --unrestricted --unrestricted KEY a', 'rg -.n KEY a', 'ag -u KEY a', 'ag --unrestricted KEY a']) {
+    probe(`hidden flags ${command}`, 'Bash', { command }, true);
+  }
+  for (const input of [{ path: 1 }, { glob: ['*'] }, { globs: 5 }]) {
+    test(`privacy-paths ${host}: malformed Grep ${JSON.stringify(input)}`, () => {
+      const { sensitivePaths } = require(path.join(SOURCE, 'claude/hooks/lib/privacy-paths.cjs'));
+      let paths;
+      assert.doesNotThrow(() => { paths = sensitivePaths('Grep', input, f.root); });
+      assert.ok(paths.includes(path.join(f.root, 'credentials.json')));
+      const output = invoke(f, 'Grep', input);
+      assert.equal(output?.permissionDecision, host === 'claude' ? 'ask' : 'deny');
+      assert.doesNotMatch(output.permissionDecisionReason, /could not be evaluated safely/);
+      if (host === 'codex') {
+        assert.match(output.permissionDecisionReason, /APPROVE CAFEKIT PRIVACY /);
+        assert.match(output.permissionDecisionReason, /y \(or yes \/ có\)/);
+      }
+    });
+  }
+  for (const command of recursiveAllowed) probe(command, 'Bash', { command }, false);
+  probe('Grep narrow glob', 'Grep', { pattern: 'KEY', path: '.', glob: '*.ts' }, false);
+  probe('Grep narrow recursive glob', 'Grep', { pattern: 'KEY', path: '.', glob: '**/*.ts' }, false);
+  probe('grep -r KEY locked/', 'Bash', { command: 'grep -r KEY locked/' }, false, {
+    skip: typeof process.getuid === 'function' && process.getuid() === 0,
+  });
+}

package/bin/__tests__/spec-narrowing.test.js

@@ -1,11 +1,9 @@
 'use strict';
 
-// Two Stop hooks ask two different questions about the same repository, so they narrow an
-// ambiguous scan differently. The gate asks which packet still has unfinished work, so it
-// can validate that packet's receipts. Closeout approval asks which packet is claiming
-// closeout, so it can demand a one-time approval for it. Counting finished history as
-// ambiguity is what left a repository of accumulated features permanently blocked, with
-// the documented escape — an explicit feature target — unavailable.
+// The Stop gate narrows an ambiguous scan by asking which packet still has unfinished
+// work, so it can validate that packet's receipts. Counting finished history as ambiguity
+// is what left a repository of accumulated features permanently blocked, with the
+// documented escape — an explicit feature target — unavailable.
 
 const assert = require('node:assert/strict');
 const { spawnSync } = require('node:child_process');
@@ -38,7 +36,7 @@ function legacyPacket(root, name, { status, phase, taskStatus = 'done' } = {}) {
 }
 
 /** A process-first packet: plan.md plus one flat task file. */
-function workflowPacket(root, name, taskStatus) {
+function workflowPacket(root, name, taskStatus, nextStatus = null) {
   const dir = path.join(root, 'specs', name);
   fs.mkdirSync(dir, { recursive: true });
   fs.writeFileSync(path.join(dir, 'plan.md'), '# Plan\nSpecs-Contract: process-first-ready-v1\n');
@@ -46,6 +44,12 @@ function workflowPacket(root, name, taskStatus) {
     path.join(dir, 'task-01-x.md'),
     `# Task 01\n\nStatus: ${taskStatus}\n\n## Dependencies\n- none\n`
   );
+  if (nextStatus) {
+    fs.writeFileSync(
+      path.join(dir, 'task-02-y.md'),
+      `# Task 02\n\nStatus: ${nextStatus}\n\n## Dependencies\n- none\n`
+    );
+  }
 }
 
 function recordActiveFeature(root, contents) {
@@ -63,34 +67,19 @@ function gateResolution(root) {
 
 // ── The gate: which packet still has work ───────────────────────────────────────────
 
-test('a legacy repository resolves its one unfinished packet', () => {
+test('a leftover legacy packet creates no ambiguity for the gate', () => {
   withProject((root) => {
     for (let index = 1; index <= 3; index += 1) {
-      legacyPacket(root, `done-${index}`, { status: 'done', phase: 'closeout' });
+      legacyPacket(root, `history-${index}`, { status: 'in_progress', phase: 'execution', taskStatus: 'pending' });
     }
-    legacyPacket(root, 'active-now', { status: 'in_progress', phase: 'execution', taskStatus: 'pending' });
+    workflowPacket(root, 'active-now', 'pending');
     const resolved = gateResolution(root);
     assert.equal(resolved.error, undefined, `expected a resolution, got ${resolved.error}`);
     assert.equal(resolved.featureName, 'active-now');
+    assert.deepEqual(RESOLVER.findLegacyPackets(root, {}), ['history-1', 'history-2', 'history-3']);
   });
 });
 
-test('a legacy registry written with the older vocabulary counts as finished', () => {
-  // Issue #79's repository was upgraded from an older release whose task_registry used
-  // `completed`. Today's validator allows only pending/in_progress/blocked/done, so
-  // narrowing read those packets as unfinished and the block survived the fix that was
-  // supposed to clear it. Measured on the reported shape before this: 18 candidates.
-  for (const status of ['done', 'completed', 'complete']) {
-    withProject((root) => {
-      for (let index = 1; index <= 3; index += 1) {
-        legacyPacket(root, `history-${index}`, { taskStatus: status });
-      }
-      legacyPacket(root, 'active-now', { status: 'in_progress', phase: 'execution', taskStatus: 'pending' });
-      assert.equal(gateResolution(root).featureName, 'active-now', `task status ${status} must read as finished`);
-    });
-  }
-});
-
 test('a process-first packet keeps the strict task vocabulary', () => {
   // The widened set is legacy-only. A process-first task saying `completed` is malformed,
   // not finished, and must not be silently read as done.
@@ -102,20 +91,6 @@ test('a process-first packet keeps the strict task vocabulary', () => {
   });
 });
 
-test('a legacy candidate never reaches the bulk branch', () => {
-  // The bulk branch exits before the semantic-digest, FLASH_UNVERIFIED, feature-receipt
-  // and completion-policy layers, so a legacy packet reaching it would turn a block into
-  // a silent pass. With every legacy packet finished there is nothing to narrow to, and
-  // the existing ambiguity must stand rather than the set being audited.
-  withProject((root) => {
-    legacyPacket(root, 'done-1', { status: 'done', phase: 'closeout' });
-    legacyPacket(root, 'done-2', { status: 'done', phase: 'closeout' });
-    const resolved = gateResolution(root);
-    assert.notEqual(resolved.layoutKind, 'process-v3-completed-set');
-    assert.ok(resolved.error, 'an all-legacy finished set must stay ambiguous');
-  });
-});
-
 test('a process-first set still reaches the bulk branch', () => {
   withProject((root) => {
     workflowPacket(root, 'done-1', 'done');
@@ -132,101 +107,21 @@ test('one unfinished process-first packet still narrows', () => {
   });
 });
 
-// ── Closeout approval: which packet is claiming closeout ────────────────────────────
-
-test('one packet claiming closeout among finished ones resolves', () => {
-  withProject((root) => {
-    legacyPacket(root, 'shipped', { status: 'in_progress', phase: 'execution', taskStatus: 'done' });
-    legacyPacket(root, 'closing', { status: 'done', phase: 'closeout' });
-    const resolved = RESOLVER.resolvePersistedSpec({ projectRoot: root, runtime: {} });
-    assert.equal(resolved.error, undefined);
-    assert.equal(resolved.featureName, 'closing');
-  });
-});
-
-test('a lone finished packet still resolves', () => {
-  // Four existing cases depend on this: closeout approval is claimed against a finished
-  // spec, so a single packet must resolve whatever its status.
-  for (const status of ['done', 'completed']) {
-    withProject((root) => {
-      legacyPacket(root, 'only', { status });
-      const resolved = RESOLVER.resolvePersistedSpec({ projectRoot: root, runtime: {} });
-      assert.equal(resolved.featureName, 'only', `status ${status} must still resolve`);
-    });
-  }
-});
-
-test('a lone packet mid-execution still resolves', () => {
-  // The closeout filter would drop this one, so the single-candidate return above it is
-  // what keeps a repository holding exactly one in-flight packet resolvable. Without it
-  // the hook goes silent for that repository instead of checking the packet.
-  withProject((root) => {
-    legacyPacket(root, 'solo', { status: 'in_progress', phase: 'implementation', taskStatus: 'pending' });
-    const resolved = RESOLVER.resolvePersistedSpec({ projectRoot: root, runtime: {} });
-    assert.equal(resolved.featureName, 'solo');
-  });
-});
-
-test('no packet claiming closeout resolves to null', () => {
-  // null means nothing is in flight and the hook stays silent; an error would keep
-  // blocking a repository where no closeout is being claimed at all.
-  withProject((root) => {
-    legacyPacket(root, 'a', { status: 'in_progress', phase: 'execution' });
-    legacyPacket(root, 'b', { status: 'in_progress', phase: 'execution' });
-    assert.equal(RESOLVER.resolvePersistedSpec({ projectRoot: root, runtime: {} }), null);
-  });
-});
-
-test('several packets claiming closeout stay ambiguous and name only those', () => {
-  withProject((root) => {
-    legacyPacket(root, 'closing-a', { status: 'done', phase: 'closeout' });
-    legacyPacket(root, 'closing-b', { status: 'done', phase: 'closeout' });
-    legacyPacket(root, 'working', { status: 'in_progress', phase: 'execution' });
-    const resolved = RESOLVER.resolvePersistedSpec({ projectRoot: root, runtime: {} });
-    assert.equal(resolved.error, 'multiple_persisted');
-    assert.deepEqual(resolved.candidates, ['closing-a', 'closing-b']);
-  });
-});
-
 // ── The recorded active feature: the escape the block told users to take ────────────
 
-test('a recorded active feature resolves two packets claiming closeout', () => {
-  withProject((root) => {
-    legacyPacket(root, 'closing-a', { status: 'done', phase: 'closeout' });
-    legacyPacket(root, 'closing-b', { status: 'done', phase: 'closeout' });
-    assert.equal(RESOLVER.resolvePersistedSpec({ projectRoot: root, runtime: {} }).error, 'multiple_persisted');
-    recordActiveFeature(root, '{"featureName": "closing-b"}\n');
-    const resolved = RESOLVER.resolvePersistedSpec({ projectRoot: root, runtime: {} });
-    assert.equal(resolved.error, undefined, `expected a resolution, got ${resolved.error}`);
-    assert.equal(resolved.featureName, 'closing-b');
-  });
-});
-
-test('a payload target beats the recorded file', () => {
-  withProject((root) => {
-    legacyPacket(root, 'alpha', { status: 'done', phase: 'closeout' });
-    legacyPacket(root, 'beta', { status: 'done', phase: 'closeout' });
-    recordActiveFeature(root, '{"featureName": "alpha"}\n');
-    const resolved = RESOLVER.resolvePersistedSpec({
-      projectRoot: root, runtime: {}, target: { featureName: 'beta' },
-    });
-    assert.equal(resolved.featureName, 'beta', 'the caller must win');
-  });
-});
-
 test('a blank recorded feature is ignored rather than malformed', () => {
   // explicitTargetValue turns a blank into null, and a null target becomes an
   // explicit_malformed error that blocks. The reader must return null instead, or every
   // project holding a stray file would be blocked by the very escape hatch.
   for (const contents of ['{"featureName": "   "}', '{"featureName": 42}', '{}', 'not json', '[]']) {
     withProject((root) => {
-      legacyPacket(root, 'only', { status: 'done', phase: 'closeout' });
+      workflowPacket(root, 'only', 'pending');
       recordActiveFeature(root, contents);
       assert.equal(
         RESOLVER.readActiveFeatureTarget({ projectRoot: root, runtime: {} }), null,
         `${contents} must be invisible`
       );
-      assert.equal(RESOLVER.resolvePersistedSpec({ projectRoot: root, runtime: {} }).featureName, 'only');
+      assert.equal(RESOLVER.resolveWorkflowCandidate({ projectRoot: root, runtime: {} }).featureName, 'only');
     });
   }
 });
@@ -234,11 +129,12 @@ test('a blank recorded feature is ignored rather than malformed', () => {
 test('a recorded feature cannot escape the specs root', () => {
   // The reader adds no trust: the value goes through the resolver's existing checks.
   withProject((root) => {
-    legacyPacket(root, 'a', { status: 'done', phase: 'closeout' });
-    legacyPacket(root, 'b', { status: 'done', phase: 'closeout' });
+    workflowPacket(root, 'a', 'pending');
+    workflowPacket(root, 'b', 'pending');
     recordActiveFeature(root, '{"featureName": "../../etc"}');
-    const resolved = RESOLVER.resolvePersistedSpec({ projectRoot: root, runtime: {} });
-    assert.ok(resolved.error, 'an escaping name must produce the existing error, not a resolution');
+    const target = RESOLVER.readActiveFeatureTarget({ projectRoot: root, runtime: {} });
+    const resolved = RESOLVER.resolveWorkflowCandidate({ projectRoot: root, runtime: {}, target });
+    assert.equal(resolved.error, 'explicit_malformed', 'an escaping name must produce the existing error, not a resolution');
     assert.notEqual(resolved.featureName, '../../etc');
   });
 });
@@ -248,7 +144,7 @@ test('a symlinked recorded feature is refused', () => {
   // project does not contain. The repository already refuses symlinked runtime
   // dependencies elsewhere; this reader follows the same rule.
   withProject((root) => {
-    legacyPacket(root, 'only', { status: 'done', phase: 'closeout' });
+    workflowPacket(root, 'only', 'pending');
     const outside = path.join(root, 'outside.json');
     fs.writeFileSync(outside, '{"featureName": "only"}');
     const dir = path.join(root, 'specs', '_shared');
@@ -260,9 +156,9 @@ test('a symlinked recorded feature is refused', () => {
 
 test('an absent file leaves every project exactly as it was', () => {
   withProject((root) => {
-    legacyPacket(root, 'only', { status: 'in_progress', phase: 'execution' });
+    workflowPacket(root, 'only', 'pending');
     assert.equal(RESOLVER.readActiveFeatureTarget({ projectRoot: root, runtime: {} }), null);
-    assert.equal(RESOLVER.resolvePersistedSpec({ projectRoot: root, runtime: {} }).featureName, 'only');
+    assert.equal(RESOLVER.resolveWorkflowCandidate({ projectRoot: root, runtime: {} }).featureName, 'only');
   });
 });
 
@@ -272,8 +168,8 @@ test('the shared workflow resolver ignores the recorded file', () => {
   // so the two gates apply it at their own call sites instead. Neither of those suites
   // writes the file, so nothing else pins this containment.
   withProject((root) => {
-    legacyPacket(root, 'alpha', { status: 'done', phase: 'closeout' });
-    legacyPacket(root, 'beta', { status: 'done', phase: 'closeout' });
+    workflowPacket(root, 'alpha', 'done');
+    workflowPacket(root, 'beta', 'done');
     recordActiveFeature(root, '{"featureName": "beta"}');
     const resolved = RESOLVER.resolveWorkflowCandidate({
       projectRoot: root, runtime: {}, target: null, includeCompleted: true,
@@ -288,7 +184,7 @@ test('the codex gate consults the file only after its payload', () => {
   assert.equal(typeof utils.readActiveFeatureTarget, 'function', 'the wrapper must be exported');
   assert.equal(typeof utils.extractExplicitTarget, 'function', 'the gate needs the payload extractor');
   withProject((root) => {
-    legacyPacket(root, 'alpha', { status: 'done', phase: 'closeout' });
+    workflowPacket(root, 'alpha', 'done');
     recordActiveFeature(root, '{"featureName": "alpha"}');
     assert.deepEqual(
       utils.extractExplicitTarget({ featureName: 'beta' }) || utils.readActiveFeatureTarget({ projectRoot: root, runtime: {} }),
@@ -338,8 +234,8 @@ for (const [runtimeName, hook] of [['claude', 'src/claude/hooks/spec-gate.cjs']]
     // identity complaint whose stated remedy nothing could supply; naming the feature
     // makes the gate resolve it and report the violation that was there all along.
     gitProject((dir) => {
-      legacyPacket(dir, 'alpha', { status: 'done', phase: 'closeout' });
-      legacyPacket(dir, 'beta', { status: 'done', phase: 'closeout' });
+      workflowPacket(dir, 'alpha', 'done', 'pending');
+      workflowPacket(dir, 'beta', 'done', 'pending');
 
       const blocked = runGate(hook, dir);
       assert.match(blocked, /multiple active specs detected/, 'the reported block must reproduce');