@khoavu882/doflow 2.0.0-beta.4 → 2.0.0

package/core/registry/lifecycle.json

@@ -20,21 +20,17 @@
             "hook-review"
           ]
         },
-        "gemini": {
-          "event": "BeforeTool",
-          "status": "different"
-        },
         "opencode": {
           "status": "unavailable",
           "fallback": "guidance"
         },
         "pi": {
-          "status": "unavailable",
-          "fallback": "guidance"
+          "event": "tool_call",
+          "status": "different"
         },
         "copilot": {
-          "status": "unavailable",
-          "fallback": "guidance"
+          "event": "PreToolUse",
+          "status": "supported"
         },
         "kiro": {
           "event": "PreToolUse",
@@ -65,21 +61,17 @@
             "hook-review"
           ]
         },
-        "gemini": {
-          "event": "BeforeTool",
-          "status": "different"
-        },
         "opencode": {
           "status": "unavailable",
           "fallback": "guidance"
         },
         "pi": {
-          "status": "unavailable",
-          "fallback": "guidance"
+          "event": "tool_call",
+          "status": "different"
         },
         "copilot": {
-          "status": "unavailable",
-          "fallback": "guidance"
+          "event": "PreToolUse",
+          "status": "supported"
         },
         "kiro": {
           "event": "PreToolUse",
@@ -110,10 +102,6 @@
             "hook-review"
           ]
         },
-        "gemini": {
-          "event": "SessionStart",
-          "status": "supported"
-        },
         "opencode": {
           "status": "unavailable",
           "fallback": "guidance"
@@ -123,8 +111,8 @@
           "fallback": "guidance"
         },
         "copilot": {
-          "status": "unavailable",
-          "fallback": "guidance"
+          "event": "SessionStart",
+          "status": "supported"
         },
         "kiro": {
           "event": "SessionStart",
@@ -156,21 +144,17 @@
             "hook-review"
           ]
         },
-        "gemini": {
-          "event": "BeforeTool",
-          "status": "different"
-        },
         "opencode": {
           "status": "unavailable",
           "fallback": "guidance"
         },
         "pi": {
-          "status": "unavailable",
-          "fallback": "guidance"
+          "event": "tool_call",
+          "status": "different"
         },
         "copilot": {
-          "status": "unavailable",
-          "fallback": "guidance"
+          "event": "PreToolUse",
+          "status": "supported"
         },
         "kiro": {
           "event": "PreToolUse",
@@ -201,10 +185,6 @@
             "hook-review"
           ]
         },
-        "gemini": {
-          "status": "unavailable",
-          "fallback": "guidance"
-        },
         "opencode": {
           "status": "unavailable",
           "fallback": "guidance"
@@ -214,8 +194,8 @@
           "fallback": "guidance"
         },
         "copilot": {
-          "status": "unavailable",
-          "fallback": "guidance"
+          "event": "Stop",
+          "status": "supported"
         },
         "kiro": {
           "event": "Stop",
@@ -227,5 +207,2825 @@
         }
       }
     }
-  ]
+  ],
+  "coverage": {
+    "schemaVersion": 1,
+    "revision": 3,
+    "refresh": {
+      "trigger": "a harness bridge, template or installed harness version changes",
+      "owner": "the feature that changes it"
+    },
+    "profiles": {
+      "any": "Applies across every installed profile; query evaluates all applicable rows.",
+      "user-interactive": "User-scope interactive harness session.",
+      "user-headless": "User-scope non-interactive harness session.",
+      "project-interactive": "Project-scope interactive harness session.",
+      "project-headless": "Project-scope non-interactive harness session.",
+      "cli-extension": "Harness launched with its CLI extension mechanism.",
+      "no-extensions": "Harness profile where extensions are unavailable.",
+      "ide": "Harness IDE integration.",
+      "cli-v3": "Kiro CLI V3.",
+      "cli-v3-agent": "Kiro CLI V3 agent mode.",
+      "cli-2x-agent": "Kiro CLI 2.x agent mode."
+    },
+    "rows": [
+      {
+        "policy": "pre-implementation-gate",
+        "harness": "claude",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "any",
+        "wired": true,
+        "configSource": "core/harnesses/claude/settings/settings.json:89",
+        "harnessVersion": {
+          "tested": "2.1.287 (Claude Code)"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [
+          "writes via shell commands"
+        ],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://code.claude.com/docs/en/hooks",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/claude/pre-implement-gate/deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-implementation-gate",
+        "harness": "codex",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "any",
+        "wired": true,
+        "configSource": "core/harnesses/codex/hooks/hooks.json:45",
+        "harnessVersion": {
+          "tested": "codex-cli 0.162.1"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [
+          "hook-review"
+        ],
+        "covers": [],
+        "doesNotCover": [
+          "writes via shell commands"
+        ],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://learn.chatgpt.com/docs/hooks",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/codex/pre-implement-gate/deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-implementation-gate",
+        "harness": "opencode",
+        "event": "*",
+        "timing": "pre-tool",
+        "profile": "any",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "1.18.30"
+        },
+        "class": "unsupported",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [
+          "writes via shell commands"
+        ],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "core/registry/harnesses.json: opencode harness; core/registry/contracts.json: unavailable hook mapping",
+            "date": "2026-10-12"
+          }
+        ]
+      },
+      {
+        "policy": "pre-implementation-gate",
+        "harness": "pi",
+        "event": "tool_call",
+        "timing": "pre-tool",
+        "profile": "cli-extension",
+        "wired": true,
+        "configSource": "core/harnesses/pi/extensions/doflow-guard.js:129",
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [
+          "writes via shell commands"
+        ],
+        "caveats": [
+          "live-verified only: print mode, `-e` load, project-scope install; interactive mode, project-trust auto-load and user scope not observed",
+          "a later tool_call handler may mutate input after DoFlow allows it"
+        ],
+        "provenance": [
+          {
+            "kind": "types",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 dist/core/extensions/types.d.ts:907-958",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "doc",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 docs/extensions.md:169",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/pi/tool_call/edit-deny.json",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "live",
+            "locator": "test/fixtures/hooks/pi/live/probe-2026-10-14.jsonl",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-implementation-gate",
+        "harness": "pi",
+        "event": "tool_execution_start",
+        "timing": "post-tool",
+        "profile": "cli-extension",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "observation",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [
+          "writes via shell commands"
+        ],
+        "caveats": [
+          "Pi user- and project-scope extensions have not been exercised in a live session; a later tool_call handler may mutate input after DoFlow allows it"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://pi.dev/docs/latest/extensions",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-implementation-gate",
+        "harness": "pi",
+        "event": "tool_call",
+        "timing": "pre-tool",
+        "profile": "user-headless",
+        "wired": true,
+        "configSource": "core/harnesses/pi/extensions/doflow-guard.js:129",
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [
+          "writes via shell commands"
+        ],
+        "caveats": [
+          "Pi extension has not been exercised in a live session; a later tool_call handler may mutate input after DoFlow allows it",
+          "live probe pending"
+        ],
+        "provenance": [
+          {
+            "kind": "types",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 dist/core/extensions/types.d.ts:907-958",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "doc",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 docs/extensions.md:169",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/pi/tool_call/edit-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-implementation-gate",
+        "harness": "pi",
+        "event": "tool_call",
+        "timing": "pre-tool",
+        "profile": "project-headless",
+        "wired": true,
+        "configSource": "core/harnesses/pi/extensions/doflow-guard.js:129",
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [
+          "project-trust"
+        ],
+        "covers": [],
+        "doesNotCover": [
+          "writes via shell commands"
+        ],
+        "caveats": [
+          "Pi extension has not been exercised in a live session; a later tool_call handler may mutate input after DoFlow allows it",
+          "live probe pending",
+          "project-trust is required for the project-scope extension"
+        ],
+        "provenance": [
+          {
+            "kind": "types",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 dist/core/extensions/types.d.ts:907-958",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "doc",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 docs/extensions.md:169",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/pi/tool_call/edit-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-implementation-gate",
+        "harness": "pi",
+        "event": "*",
+        "timing": "pre-tool",
+        "profile": "no-extensions",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "unsupported",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [
+          "writes via shell commands"
+        ],
+        "caveats": [
+          "Pi user- and project-scope extensions have not been exercised in a live session; a later tool_call handler may mutate input after DoFlow allows it",
+          "Pi extension unavailable in this profile"
+        ],
+        "provenance": [
+          {
+            "kind": "types",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 dist/core/extensions/types.d.ts:907-958",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "doc",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 docs/extensions.md:169",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/pi/tool_call/edit-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-bash-guard",
+        "harness": "pi",
+        "event": "tool_call",
+        "timing": "pre-tool",
+        "profile": "cli-extension",
+        "wired": true,
+        "configSource": "core/harnesses/pi/extensions/doflow-guard.js:129",
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "Pi extension has not been exercised in a live session; a later tool_call handler may mutate input after DoFlow allows it"
+        ],
+        "provenance": [
+          {
+            "kind": "types",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 dist/core/extensions/types.d.ts:907-958",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "doc",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 docs/extensions.md:169",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/pi/tool_call/bash-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-bash-guard",
+        "harness": "pi",
+        "event": "tool_execution_start",
+        "timing": "post-tool",
+        "profile": "cli-extension",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "observation",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "Pi user- and project-scope extensions have not been exercised in a live session; a later tool_call handler may mutate input after DoFlow allows it"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://pi.dev/docs/latest/extensions",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-bash-guard",
+        "harness": "pi",
+        "event": "tool_call",
+        "timing": "pre-tool",
+        "profile": "user-headless",
+        "wired": true,
+        "configSource": "core/harnesses/pi/extensions/doflow-guard.js:129",
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "Pi extension has not been exercised in a live session; a later tool_call handler may mutate input after DoFlow allows it",
+          "live probe pending"
+        ],
+        "provenance": [
+          {
+            "kind": "types",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 dist/core/extensions/types.d.ts:907-958",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "doc",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 docs/extensions.md:169",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/pi/tool_call/bash-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-bash-guard",
+        "harness": "pi",
+        "event": "tool_call",
+        "timing": "pre-tool",
+        "profile": "project-headless",
+        "wired": true,
+        "configSource": "core/harnesses/pi/extensions/doflow-guard.js:129",
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [
+          "project-trust"
+        ],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "Pi extension has not been exercised in a live session; a later tool_call handler may mutate input after DoFlow allows it",
+          "live probe pending",
+          "project-trust is required for the project-scope extension"
+        ],
+        "provenance": [
+          {
+            "kind": "types",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 dist/core/extensions/types.d.ts:907-958",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "doc",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 docs/extensions.md:169",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/pi/tool_call/bash-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-bash-guard",
+        "harness": "pi",
+        "event": "*",
+        "timing": "pre-tool",
+        "profile": "no-extensions",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "unsupported",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "Pi user- and project-scope extensions have not been exercised in a live session; a later tool_call handler may mutate input after DoFlow allows it",
+          "Pi extension unavailable in this profile"
+        ],
+        "provenance": [
+          {
+            "kind": "types",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 dist/core/extensions/types.d.ts:907-958",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "doc",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 docs/extensions.md:169",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/pi/tool_call/bash-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "session-context",
+        "harness": "pi",
+        "event": "*",
+        "timing": "session",
+        "profile": "any",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "unsupported",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "not wired for this harness mapping",
+          "Pi user- and project-scope extensions have not been exercised in a live session; a later tool_call handler may mutate input after DoFlow allows it"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "core/registry/lifecycle.json: policy session-context mapping for pi",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "mcp-tool-guard",
+        "harness": "pi",
+        "event": "tool_call",
+        "timing": "pre-tool",
+        "profile": "cli-extension",
+        "wired": true,
+        "configSource": "core/harnesses/pi/extensions/doflow-guard.js:129",
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "Pi extension has not been exercised in a live session; a later tool_call handler may mutate input after DoFlow allows it"
+        ],
+        "provenance": [
+          {
+            "kind": "types",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 dist/core/extensions/types.d.ts:907-958",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "doc",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 docs/extensions.md:169",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/pi/tool_call/nested-mcp-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "mcp-tool-guard",
+        "harness": "pi",
+        "event": "tool_execution_start",
+        "timing": "post-tool",
+        "profile": "cli-extension",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "observation",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "Pi user- and project-scope extensions have not been exercised in a live session; a later tool_call handler may mutate input after DoFlow allows it"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://pi.dev/docs/latest/extensions",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "mcp-tool-guard",
+        "harness": "pi",
+        "event": "tool_call",
+        "timing": "pre-tool",
+        "profile": "user-headless",
+        "wired": true,
+        "configSource": "core/harnesses/pi/extensions/doflow-guard.js:129",
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "Pi extension has not been exercised in a live session; a later tool_call handler may mutate input after DoFlow allows it",
+          "live probe pending"
+        ],
+        "provenance": [
+          {
+            "kind": "types",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 dist/core/extensions/types.d.ts:907-958",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "doc",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 docs/extensions.md:169",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/pi/tool_call/nested-mcp-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "mcp-tool-guard",
+        "harness": "pi",
+        "event": "tool_call",
+        "timing": "pre-tool",
+        "profile": "project-headless",
+        "wired": true,
+        "configSource": "core/harnesses/pi/extensions/doflow-guard.js:129",
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [
+          "project-trust"
+        ],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "Pi extension has not been exercised in a live session; a later tool_call handler may mutate input after DoFlow allows it",
+          "live probe pending",
+          "project-trust is required for the project-scope extension"
+        ],
+        "provenance": [
+          {
+            "kind": "types",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 dist/core/extensions/types.d.ts:907-958",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "doc",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 docs/extensions.md:169",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/pi/tool_call/nested-mcp-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "mcp-tool-guard",
+        "harness": "pi",
+        "event": "*",
+        "timing": "pre-tool",
+        "profile": "no-extensions",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "unsupported",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "Pi user- and project-scope extensions have not been exercised in a live session; a later tool_call handler may mutate input after DoFlow allows it",
+          "Pi extension unavailable in this profile"
+        ],
+        "provenance": [
+          {
+            "kind": "types",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 dist/core/extensions/types.d.ts:907-958",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "doc",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 docs/extensions.md:169",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/pi/tool_call/nested-mcp-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "stop-check",
+        "harness": "pi",
+        "event": "*",
+        "timing": "stop",
+        "profile": "any",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "unsupported",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "not wired for this harness mapping",
+          "Pi user- and project-scope extensions have not been exercised in a live session; a later tool_call handler may mutate input after DoFlow allows it"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "core/registry/lifecycle.json: policy stop-check mapping for pi",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-implementation-gate",
+        "harness": "copilot",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "any",
+        "wired": true,
+        "configSource": "core/harnesses/copilot/hooks/doflow.json:12",
+        "harnessVersion": {
+          "tested": "GitHub Copilot CLI 1.0.103"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [
+          "writes via shell commands"
+        ],
+        "caveats": [
+          "live-verified: the preToolUse deny shape (a shell command was blocked) and the apply_patch payload; the edit and create tool arguments are not captured, so their path field is assumed to be `path` or `file_path`",
+          "version-drift:GitHub Copilot CLI 1.0.104."
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://docs.github.com/en/copilot/reference/hooks-reference",
+            "date": "2026-10-27"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/copilot/pre-implement-gate/apply_patch-deny.json",
+            "date": "2026-10-27"
+          },
+          {
+            "kind": "live",
+            "locator": "test/fixtures/hooks/copilot/live/deny-proof-2026-10-27.json",
+            "date": "2026-10-27"
+          },
+          {
+            "kind": "live",
+            "locator": "test/fixtures/hooks/copilot/live/capture-2026-10-27.jsonl",
+            "date": "2026-10-27"
+          }
+        ]
+      },
+      {
+        "policy": "pre-implementation-gate",
+        "harness": "kiro",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "ide",
+        "wired": true,
+        "configSource": "core/harnesses/kiro/hooks/doflow.json:15",
+        "harnessVersion": {
+          "tested": "kiro-cli 2.29.1"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [
+          "writes via shell commands"
+        ],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/kiro/pre-implement-gate/deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-implementation-gate",
+        "harness": "kiro",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "cli-v3",
+        "wired": true,
+        "configSource": "core/harnesses/kiro/hooks/doflow.json:15",
+        "harnessVersion": {
+          "tested": "kiro-cli 2.29.1"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [
+          "writes via shell commands"
+        ],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/kiro/pre-implement-gate/deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-implementation-gate",
+        "harness": "kiro",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "cli-v3-agent",
+        "wired": true,
+        "configSource": "core/harnesses/kiro/agents/doflow.json:11",
+        "harnessVersion": {
+          "tested": "kiro-cli 2.29.1"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [
+          "writes via shell commands"
+        ],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/kiro/pre-implement-gate/agent-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-implementation-gate",
+        "harness": "kiro",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "cli-2x-agent",
+        "wired": true,
+        "configSource": "core/harnesses/kiro/hooks/doflow.json:15",
+        "harnessVersion": {
+          "tested": "kiro-cli 2.29.1"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [
+          "writes via shell commands"
+        ],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/kiro/pre-implement-gate/agent-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-implementation-gate",
+        "harness": "antigravity",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "any",
+        "wired": true,
+        "configSource": "src/adapters/antigravity/index.js:60",
+        "harnessVersion": {
+          "tested": "1.3.3"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [
+          "writes via shell commands"
+        ],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://antigravity.google/docs/hooks/",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/antigravity/pre-implement-gate/deny-missing-design.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-bash-guard",
+        "harness": "claude",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "any",
+        "wired": true,
+        "configSource": "core/harnesses/claude/settings/settings.json:89",
+        "harnessVersion": {
+          "tested": "2.1.287 (Claude Code)"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://code.claude.com/docs/en/hooks",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/claude/pre-bash-guard/deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-bash-guard",
+        "harness": "codex",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "any",
+        "wired": true,
+        "configSource": "core/harnesses/codex/hooks/hooks.json:45",
+        "harnessVersion": {
+          "tested": "codex-cli 0.162.1"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [
+          "hook-review"
+        ],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://learn.chatgpt.com/docs/hooks",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/codex/pre-bash-guard/deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-bash-guard",
+        "harness": "opencode",
+        "event": "*",
+        "timing": "pre-tool",
+        "profile": "any",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "1.18.30"
+        },
+        "class": "unsupported",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "core/registry/harnesses.json: opencode harness; core/registry/contracts.json: unavailable hook mapping",
+            "date": "2026-10-12"
+          }
+        ]
+      },
+      {
+        "policy": "pre-bash-guard",
+        "harness": "kiro",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "ide",
+        "wired": true,
+        "configSource": "core/harnesses/kiro/hooks/doflow.json:24",
+        "harnessVersion": {
+          "tested": "kiro-cli 2.29.1"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/kiro/pre-bash-guard/deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-bash-guard",
+        "harness": "kiro",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "cli-v3",
+        "wired": true,
+        "configSource": "core/harnesses/kiro/hooks/doflow.json:24",
+        "harnessVersion": {
+          "tested": "kiro-cli 2.29.1"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/kiro/pre-bash-guard/deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-bash-guard",
+        "harness": "kiro",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "cli-v3-agent",
+        "wired": true,
+        "configSource": "core/harnesses/kiro/agents/doflow.json:21",
+        "harnessVersion": {
+          "tested": "kiro-cli 2.29.1"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/kiro/pre-bash-guard/agent-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-bash-guard",
+        "harness": "kiro",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "cli-2x-agent",
+        "wired": true,
+        "configSource": "core/harnesses/kiro/agents/doflow.json:21",
+        "harnessVersion": {
+          "tested": "kiro-cli 2.29.1"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/kiro/pre-bash-guard/agent-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-bash-guard",
+        "harness": "antigravity",
+        "event": "*",
+        "timing": "pre-tool",
+        "profile": "any",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "1.3.3"
+        },
+        "class": "unsupported",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "not wired for this harness mapping"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "core/registry/lifecycle.json: policy pre-bash-guard mapping for antigravity",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "session-context",
+        "harness": "claude",
+        "event": "SessionStart",
+        "timing": "session",
+        "profile": "any",
+        "wired": true,
+        "configSource": "core/harnesses/claude/settings/settings.json:36",
+        "harnessVersion": {
+          "tested": "2.1.287 (Claude Code)"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "native event enforcement is not yet verified"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://code.claude.com/docs/en/hooks",
+            "date": "2026-10-12"
+          }
+        ]
+      },
+      {
+        "policy": "session-context",
+        "harness": "codex",
+        "event": "SessionStart",
+        "timing": "session",
+        "profile": "any",
+        "wired": true,
+        "configSource": "core/harnesses/codex/hooks/hooks.json:4",
+        "harnessVersion": {
+          "tested": "codex-cli 0.162.1"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [
+          "hook-review"
+        ],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "native event enforcement is not yet verified"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://learn.chatgpt.com/docs/hooks",
+            "date": "2026-10-12"
+          }
+        ]
+      },
+      {
+        "policy": "session-context",
+        "harness": "opencode",
+        "event": "*",
+        "timing": "session",
+        "profile": "any",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "1.18.30"
+        },
+        "class": "unsupported",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "core/registry/harnesses.json: opencode harness; core/registry/contracts.json: unavailable hook mapping",
+            "date": "2026-10-12"
+          }
+        ]
+      },
+      {
+        "policy": "session-context",
+        "harness": "copilot",
+        "event": "PreCompact",
+        "timing": "compact",
+        "profile": "any",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "GitHub Copilot CLI 1.0.78"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "fixture-pending",
+          "version-drift:GitHub Copilot CLI 1.0.78."
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "core/registry/contracts.json: Copilot documented event inventory",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "session-context",
+        "harness": "copilot",
+        "event": "SessionEnd",
+        "timing": "session",
+        "profile": "any",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "GitHub Copilot CLI 1.0.78"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "fixture-pending",
+          "version-drift:GitHub Copilot CLI 1.0.78."
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "core/registry/contracts.json: Copilot documented event inventory",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "session-context",
+        "harness": "copilot",
+        "event": "SessionStart",
+        "timing": "session",
+        "profile": "any",
+        "wired": true,
+        "configSource": "core/harnesses/copilot/hooks/doflow.json:4",
+        "harnessVersion": {
+          "tested": "GitHub Copilot CLI 1.0.103"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "native event enforcement is not yet verified; the policy writes session state and prints nothing",
+          "version-drift:GitHub Copilot CLI 1.0.104."
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://docs.github.com/en/copilot/reference/hooks-reference",
+            "date": "2026-10-27"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/copilot/session-start/start.json",
+            "date": "2026-10-27"
+          },
+          {
+            "kind": "live",
+            "locator": "test/fixtures/hooks/copilot/live/capture-2026-10-27.jsonl",
+            "date": "2026-10-27"
+          }
+        ]
+      },
+      {
+        "policy": "session-context",
+        "harness": "copilot",
+        "event": "SubagentStart",
+        "timing": "subagent",
+        "profile": "any",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "GitHub Copilot CLI 1.0.78"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "fixture-pending",
+          "version-drift:GitHub Copilot CLI 1.0.78."
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "core/registry/contracts.json: Copilot documented event inventory",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "session-context",
+        "harness": "copilot",
+        "event": "SubagentStop",
+        "timing": "subagent",
+        "profile": "any",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "GitHub Copilot CLI 1.0.78"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "fixture-pending",
+          "version-drift:GitHub Copilot CLI 1.0.78."
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "core/registry/contracts.json: Copilot documented event inventory",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "session-context",
+        "harness": "copilot",
+        "event": "UserPromptSubmit",
+        "timing": "prompt",
+        "profile": "any",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "GitHub Copilot CLI 1.0.78"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "fixture-pending",
+          "version-drift:GitHub Copilot CLI 1.0.78."
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "core/registry/contracts.json: Copilot documented event inventory",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "session-context",
+        "harness": "kiro",
+        "event": "SessionStart",
+        "timing": "session",
+        "profile": "any",
+        "wired": true,
+        "configSource": "core/harnesses/kiro/hooks/doflow.json:6",
+        "harnessVersion": {
+          "tested": "kiro-cli 2.29.1"
+        },
+        "class": "advisory",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "native event enforcement is not yet verified"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-12"
+          }
+        ]
+      },
+      {
+        "policy": "session-context",
+        "harness": "antigravity",
+        "event": "*",
+        "timing": "session",
+        "profile": "any",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "1.3.3"
+        },
+        "class": "unsupported",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "not wired for this harness mapping"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "core/registry/lifecycle.json: policy session-context mapping for antigravity",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "mcp-tool-guard",
+        "harness": "claude",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "any",
+        "wired": true,
+        "configSource": "core/harnesses/claude/settings/settings.json:89",
+        "harnessVersion": {
+          "tested": "2.1.287 (Claude Code)"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://code.claude.com/docs/en/hooks",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/claude/mcp-tool-guard/deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "mcp-tool-guard",
+        "harness": "codex",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "any",
+        "wired": true,
+        "configSource": "core/harnesses/codex/hooks/hooks.json:45",
+        "harnessVersion": {
+          "tested": "codex-cli 0.162.1"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [
+          "hook-review"
+        ],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://learn.chatgpt.com/docs/hooks",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/codex/mcp-tool-guard/deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "mcp-tool-guard",
+        "harness": "opencode",
+        "event": "*",
+        "timing": "pre-tool",
+        "profile": "any",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "1.18.30"
+        },
+        "class": "unsupported",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "core/registry/harnesses.json: opencode harness; core/registry/contracts.json: unavailable hook mapping",
+            "date": "2026-10-12"
+          }
+        ]
+      },
+      {
+        "policy": "mcp-tool-guard",
+        "harness": "copilot",
+        "event": "PermissionDenied",
+        "timing": "session",
+        "profile": "any",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "GitHub Copilot CLI 1.0.78"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "fixture-pending",
+          "version-drift:GitHub Copilot CLI 1.0.78."
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "core/registry/contracts.json: Copilot documented event inventory",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "mcp-tool-guard",
+        "harness": "copilot",
+        "event": "PostToolUse",
+        "timing": "post-tool",
+        "profile": "any",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "GitHub Copilot CLI 1.0.78"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "fixture-pending",
+          "version-drift:GitHub Copilot CLI 1.0.78."
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "core/registry/contracts.json: Copilot documented event inventory",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "mcp-tool-guard",
+        "harness": "copilot",
+        "event": "PostToolUseFailure",
+        "timing": "post-tool",
+        "profile": "any",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "GitHub Copilot CLI 1.0.78"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "fixture-pending",
+          "version-drift:GitHub Copilot CLI 1.0.78."
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "core/registry/contracts.json: Copilot documented event inventory",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "mcp-tool-guard",
+        "harness": "copilot",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "any",
+        "wired": true,
+        "configSource": "core/harnesses/copilot/hooks/doflow.json:12",
+        "harnessVersion": {
+          "tested": "GitHub Copilot CLI 1.0.103"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "the MCP tool-name form on preToolUse was not captured: the guard matches the mcp__<server>__<tool> and mcp_ prefixes, so an MCP call under another name is allowed",
+          "version-drift:GitHub Copilot CLI 1.0.104."
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://docs.github.com/en/copilot/reference/hooks-reference",
+            "date": "2026-10-27"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/copilot/mcp-tool-guard/deny.json",
+            "date": "2026-10-27"
+          }
+        ]
+      },
+      {
+        "policy": "mcp-tool-guard",
+        "harness": "kiro",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "ide",
+        "wired": true,
+        "configSource": "core/harnesses/kiro/hooks/doflow.json:34",
+        "harnessVersion": {
+          "tested": "kiro-cli 2.29.1"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/kiro/mcp-tool-guard/deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "mcp-tool-guard",
+        "harness": "kiro",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "cli-v3",
+        "wired": true,
+        "configSource": "core/harnesses/kiro/hooks/doflow.json:34",
+        "harnessVersion": {
+          "tested": "kiro-cli 2.29.1"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/kiro/mcp-tool-guard/deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "mcp-tool-guard",
+        "harness": "kiro",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "cli-v3-agent",
+        "wired": true,
+        "configSource": "core/harnesses/kiro/agents/doflow.json:31",
+        "harnessVersion": {
+          "tested": "kiro-cli 2.29.1"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/kiro/mcp-tool-guard/agent-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "mcp-tool-guard",
+        "harness": "kiro",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "cli-2x-agent",
+        "wired": true,
+        "configSource": "core/harnesses/kiro/agents/doflow.json:31",
+        "harnessVersion": {
+          "tested": "kiro-cli 2.29.1"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/kiro/mcp-tool-guard/agent-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "mcp-tool-guard",
+        "harness": "antigravity",
+        "event": "*",
+        "timing": "pre-tool",
+        "profile": "any",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "1.3.3"
+        },
+        "class": "unsupported",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "not wired for this harness mapping"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "core/registry/lifecycle.json: policy mcp-tool-guard mapping for antigravity",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "stop-check",
+        "harness": "claude",
+        "event": "Stop",
+        "timing": "stop",
+        "profile": "any",
+        "wired": true,
+        "configSource": "core/harnesses/claude/settings/settings.json:147",
+        "harnessVersion": {
+          "tested": "2.1.287 (Claude Code)"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://code.claude.com/docs/en/hooks",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/claude/stop-check/deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "stop-check",
+        "harness": "codex",
+        "event": "Stop",
+        "timing": "stop",
+        "profile": "any",
+        "wired": true,
+        "configSource": "core/harnesses/codex/hooks/hooks.json:99",
+        "harnessVersion": {
+          "tested": "codex-cli 0.162.1"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [
+          "hook-review"
+        ],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://learn.chatgpt.com/docs/hooks",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/codex/stop-check/deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "stop-check",
+        "harness": "opencode",
+        "event": "*",
+        "timing": "stop",
+        "profile": "any",
+        "wired": false,
+        "configSource": null,
+        "harnessVersion": {
+          "tested": "1.18.30"
+        },
+        "class": "unsupported",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "core/registry/harnesses.json: opencode harness; core/registry/contracts.json: unavailable hook mapping",
+            "date": "2026-10-12"
+          }
+        ]
+      },
+      {
+        "policy": "stop-check",
+        "harness": "copilot",
+        "event": "Stop",
+        "timing": "stop",
+        "profile": "any",
+        "wired": true,
+        "configSource": "core/harnesses/copilot/hooks/doflow.json:32",
+        "harnessVersion": {
+          "tested": "GitHub Copilot CLI 1.0.103"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "the {decision:\"block\"} output is documented but not exercised live",
+          "the last assistant message is read from the events.jsonl transcript, and whether agentStop fires after it is written is unverified; a subagent's own agentStop is skipped",
+          "version-drift:GitHub Copilot CLI 1.0.104."
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://docs.github.com/en/copilot/reference/hooks-reference",
+            "date": "2026-10-27"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/copilot/stop-check/deny.json",
+            "date": "2026-10-27"
+          },
+          {
+            "kind": "live",
+            "locator": "test/fixtures/hooks/copilot/live/capture-2026-10-27.jsonl",
+            "date": "2026-10-27"
+          }
+        ]
+      },
+      {
+        "policy": "pre-bash-guard",
+        "harness": "copilot",
+        "event": "PreToolUse",
+        "timing": "pre-tool",
+        "profile": "any",
+        "wired": true,
+        "configSource": "core/harnesses/copilot/hooks/doflow.json:12",
+        "harnessVersion": {
+          "tested": "GitHub Copilot CLI 1.0.103"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "live-verified: the deny output blocked a shell command; Copilot command hooks are fail-closed on a non-zero exit and fail open on a timeout",
+          "version-drift:GitHub Copilot CLI 1.0.104."
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://docs.github.com/en/copilot/reference/hooks-reference",
+            "date": "2026-10-27"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/copilot/pre-bash-guard/deny.json",
+            "date": "2026-10-27"
+          },
+          {
+            "kind": "live",
+            "locator": "test/fixtures/hooks/copilot/live/deny-proof-2026-10-27.json",
+            "date": "2026-10-27"
+          },
+          {
+            "kind": "live",
+            "locator": "test/fixtures/hooks/copilot/live/capture-2026-10-27.jsonl",
+            "date": "2026-10-27"
+          }
+        ]
+      },
+      {
+        "policy": "stop-check",
+        "harness": "kiro",
+        "event": "Stop",
+        "timing": "stop",
+        "profile": "ide",
+        "wired": true,
+        "configSource": "core/harnesses/kiro/hooks/doflow.json:44",
+        "harnessVersion": {
+          "tested": "kiro-cli 2.29.1"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "Kiro documents AgentStop, not the configured Stop trigger; native trigger equivalence is unresolved",
+          "V3 payload carries no transcript"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "doc",
+            "locator": "core/registry/harnesses.json: Kiro V3 Stop observation; bench/inventory/coverage.json: AgentStop",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/kiro/stop-check/v3-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "stop-check",
+        "harness": "kiro",
+        "event": "Stop",
+        "timing": "stop",
+        "profile": "cli-v3",
+        "wired": true,
+        "configSource": "core/harnesses/kiro/hooks/doflow.json:44",
+        "harnessVersion": {
+          "tested": "kiro-cli 2.29.1"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "Kiro documents AgentStop, not the configured Stop trigger; native trigger equivalence is unresolved",
+          "V3 payload carries no transcript"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "doc",
+            "locator": "core/registry/harnesses.json: Kiro V3 Stop observation; bench/inventory/coverage.json: AgentStop",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/kiro/stop-check/v3-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "stop-check",
+        "harness": "antigravity",
+        "event": "Stop",
+        "timing": "stop",
+        "profile": "any",
+        "wired": true,
+        "configSource": "src/adapters/antigravity/index.js:60",
+        "harnessVersion": {
+          "tested": "1.3.3"
+        },
+        "class": "blocking",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://antigravity.google/docs/hooks/",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/antigravity/stop-check/continue.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-implementation-gate",
+        "harness": "pi",
+        "event": "tool_call",
+        "timing": "pre-tool",
+        "profile": "project-interactive",
+        "wired": true,
+        "configSource": "core/harnesses/pi/extensions/doflow-guard.js:129",
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [
+          "project-trust"
+        ],
+        "covers": [],
+        "doesNotCover": [
+          "writes via shell commands"
+        ],
+        "caveats": [
+          "project-trust is required for the project-scope extension",
+          "loading path not live-observed",
+          "project-trust is required for the project-scope extension"
+        ],
+        "provenance": [
+          {
+            "kind": "types",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 dist/core/extensions/types.d.ts:907-958",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "doc",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 docs/extensions.md:169",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/pi/tool_call/edit-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-bash-guard",
+        "harness": "pi",
+        "event": "tool_call",
+        "timing": "pre-tool",
+        "profile": "project-interactive",
+        "wired": true,
+        "configSource": "core/harnesses/pi/extensions/doflow-guard.js:129",
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [
+          "project-trust"
+        ],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "project-trust is required for the project-scope extension",
+          "loading path not live-observed",
+          "project-trust is required for the project-scope extension"
+        ],
+        "provenance": [
+          {
+            "kind": "types",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 dist/core/extensions/types.d.ts:907-958",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "doc",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 docs/extensions.md:169",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/pi/tool_call/bash-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "mcp-tool-guard",
+        "harness": "pi",
+        "event": "tool_call",
+        "timing": "pre-tool",
+        "profile": "project-interactive",
+        "wired": true,
+        "configSource": "core/harnesses/pi/extensions/doflow-guard.js:129",
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [
+          "project-trust"
+        ],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "project-trust is required for the project-scope extension",
+          "loading path not live-observed",
+          "project-trust is required for the project-scope extension"
+        ],
+        "provenance": [
+          {
+            "kind": "types",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 dist/core/extensions/types.d.ts:907-958",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "doc",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 docs/extensions.md:169",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/pi/tool_call/nested-mcp-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "stop-check",
+        "harness": "kiro",
+        "event": "stop",
+        "timing": "stop",
+        "profile": "cli-2x-agent",
+        "wired": true,
+        "configSource": "core/harnesses/kiro/agents/doflow.json:50",
+        "harnessVersion": {
+          "tested": "kiro-cli 2.29.1"
+        },
+        "class": "observation",
+        "verification": "verified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "Kiro CLI 2.x agent stop cannot block session completion"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/kiro/stop-check/agent-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "stop-check",
+        "harness": "kiro",
+        "event": "Stop",
+        "timing": "stop",
+        "profile": "cli-v3-agent",
+        "wired": true,
+        "configSource": "core/harnesses/kiro/agents/doflow.json:50",
+        "harnessVersion": {
+          "tested": "kiro-cli 2.29.1"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "Kiro documents AgentStop, not the configured Stop trigger; native trigger equivalence is unresolved",
+          "V3 payload carries no transcript"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "doc",
+            "locator": "core/registry/harnesses.json: Kiro V3 Stop observation; bench/inventory/coverage.json: AgentStop",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/kiro/stop-check/v3-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-implementation-gate",
+        "harness": "pi",
+        "event": "tool_call",
+        "timing": "pre-tool",
+        "profile": "user-interactive",
+        "wired": true,
+        "configSource": "core/harnesses/pi/extensions/doflow-guard.js:129",
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [
+          "writes via shell commands"
+        ],
+        "caveats": [
+          "Pi extension has not been exercised in a live session; a later tool_call handler may mutate input after DoFlow allows it",
+          "live probe pending"
+        ],
+        "provenance": [
+          {
+            "kind": "types",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 dist/core/extensions/types.d.ts:907-958",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "doc",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 docs/extensions.md:169",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/pi/tool_call/edit-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "pre-bash-guard",
+        "harness": "pi",
+        "event": "tool_call",
+        "timing": "pre-tool",
+        "profile": "user-interactive",
+        "wired": true,
+        "configSource": "core/harnesses/pi/extensions/doflow-guard.js:129",
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "Pi extension has not been exercised in a live session; a later tool_call handler may mutate input after DoFlow allows it",
+          "live probe pending"
+        ],
+        "provenance": [
+          {
+            "kind": "types",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 dist/core/extensions/types.d.ts:907-958",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "doc",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 docs/extensions.md:169",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/pi/tool_call/bash-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "mcp-tool-guard",
+        "harness": "pi",
+        "event": "tool_call",
+        "timing": "pre-tool",
+        "profile": "user-interactive",
+        "wired": true,
+        "configSource": "core/harnesses/pi/extensions/doflow-guard.js:129",
+        "harnessVersion": {
+          "tested": "1.1.0"
+        },
+        "class": "unknown",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "Pi extension has not been exercised in a live session; a later tool_call handler may mutate input after DoFlow allows it",
+          "live probe pending"
+        ],
+        "provenance": [
+          {
+            "kind": "types",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 dist/core/extensions/types.d.ts:907-958",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "doc",
+            "locator": "@earendil-works/pi-coding-agent@1.1.0 docs/extensions.md:169",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "fixture",
+            "locator": "test/fixtures/hooks/pi/tool_call/nested-mcp-deny.json",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "policy": "session-context",
+        "harness": "kiro",
+        "event": "SessionStart",
+        "timing": "session",
+        "profile": "cli-v3-agent",
+        "wired": true,
+        "configSource": "core/harnesses/kiro/agents/doflow.json:42",
+        "harnessVersion": {
+          "tested": "kiro-cli 2.29.1"
+        },
+        "class": "advisory",
+        "verification": "unverified",
+        "prerequisites": [],
+        "covers": [],
+        "doesNotCover": [],
+        "caveats": [
+          "native event enforcement is not yet verified"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-12"
+          }
+        ]
+      }
+    ],
+    "endOfTurn": [
+      {
+        "harness": "claude",
+        "events": [
+          "Stop"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://code.claude.com/docs/en/hooks",
+            "date": "2026-10-12"
+          }
+        ]
+      },
+      {
+        "harness": "codex",
+        "events": [
+          "Stop"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://learn.chatgpt.com/docs/hooks",
+            "date": "2026-10-12"
+          }
+        ]
+      },
+      {
+        "harness": "opencode",
+        "events": [],
+        "none": "no DoFlow hook bridge",
+        "provenance": []
+      },
+      {
+        "harness": "pi",
+        "events": [],
+        "none": "the extension handles tool_call only",
+        "provenance": []
+      },
+      {
+        "harness": "copilot",
+        "events": [
+          "Stop"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "core/registry/contracts.json: Copilot documented event inventory",
+            "date": "2026-10-14"
+          },
+          {
+            "kind": "doc",
+            "locator": "https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-hooks-reference",
+            "date": "2026-10-15"
+          }
+        ]
+      },
+      {
+        "harness": "kiro",
+        "events": [
+          "Stop",
+          "stop"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-12"
+          },
+          {
+            "kind": "doc",
+            "locator": "https://kiro.dev/docs/hooks/types/",
+            "date": "2026-10-14"
+          }
+        ]
+      },
+      {
+        "harness": "antigravity",
+        "events": [
+          "Stop"
+        ],
+        "provenance": [
+          {
+            "kind": "doc",
+            "locator": "https://antigravity.google/docs/hooks/",
+            "date": "2026-10-12"
+          }
+        ]
+      }
+    ],
+    "behaviours": [
+      {
+        "behaviour": "context-authority",
+        "harness": "claude",
+        "status": "enforced",
+        "tests": [
+          "test/hooks/context-authority.test.ts"
+        ]
+      },
+      {
+        "behaviour": "context-authority",
+        "harness": "codex",
+        "status": "enforced",
+        "tests": [
+          "test/hooks/context-authority.test.ts"
+        ]
+      },
+      {
+        "behaviour": "context-authority",
+        "harness": "opencode",
+        "status": "limitation",
+        "limitation": "no DoFlow hook bridge"
+      },
+      {
+        "behaviour": "context-authority",
+        "harness": "pi",
+        "status": "limitation",
+        "limitation": "extension handles tool_call only"
+      },
+      {
+        "behaviour": "context-authority",
+        "harness": "copilot",
+        "status": "limitation",
+        "limitation": "no prompt hook wired; SessionStart emits no context"
+      },
+      {
+        "behaviour": "context-authority",
+        "harness": "kiro",
+        "status": "limitation",
+        "limitation": "no prompt hook wired; SessionStart emits no context"
+      },
+      {
+        "behaviour": "context-authority",
+        "harness": "antigravity",
+        "status": "limitation",
+        "limitation": "only PreToolUse and Stop wired"
+      },
+      {
+        "behaviour": "default-silence",
+        "harness": "claude",
+        "status": "enforced",
+        "tests": [
+          "test/hooks/context-authority.test.ts",
+          "test/hooks/emission-adapter.test.ts"
+        ]
+      },
+      {
+        "behaviour": "default-silence",
+        "harness": "codex",
+        "status": "enforced",
+        "tests": [
+          "test/hooks/context-authority.test.ts",
+          "test/hooks/emission-adapter.test.ts"
+        ]
+      },
+      {
+        "behaviour": "default-silence",
+        "harness": "opencode",
+        "status": "limitation",
+        "limitation": "no DoFlow hook bridge"
+      },
+      {
+        "behaviour": "default-silence",
+        "harness": "pi",
+        "status": "limitation",
+        "limitation": "no prompt-time emission"
+      },
+      {
+        "behaviour": "default-silence",
+        "harness": "copilot",
+        "status": "limitation",
+        "limitation": "no prompt-time emission"
+      },
+      {
+        "behaviour": "default-silence",
+        "harness": "kiro",
+        "status": "limitation",
+        "limitation": "no prompt-time emission"
+      },
+      {
+        "behaviour": "default-silence",
+        "harness": "antigravity",
+        "status": "limitation",
+        "limitation": "no prompt-time emission"
+      },
+      {
+        "behaviour": "summary-scope",
+        "harness": "claude",
+        "status": "enforced",
+        "tests": [
+          "test/hooks/summary-scope.test.ts",
+          "test/hooks/cross-harness-parity.test.ts"
+        ]
+      },
+      {
+        "behaviour": "summary-scope",
+        "harness": "codex",
+        "status": "limitation",
+        "limitation": "PreCompact carries no summary text"
+      },
+      {
+        "behaviour": "summary-scope",
+        "harness": "opencode",
+        "status": "limitation",
+        "limitation": "no DoFlow hook bridge"
+      },
+      {
+        "behaviour": "summary-scope",
+        "harness": "pi",
+        "status": "limitation",
+        "limitation": "no compaction hook wired"
+      },
+      {
+        "behaviour": "summary-scope",
+        "harness": "copilot",
+        "status": "limitation",
+        "limitation": "no compaction hook wired"
+      },
+      {
+        "behaviour": "summary-scope",
+        "harness": "kiro",
+        "status": "limitation",
+        "limitation": "no compaction hook wired"
+      },
+      {
+        "behaviour": "summary-scope",
+        "harness": "antigravity",
+        "status": "limitation",
+        "limitation": "no compaction hook wired"
+      },
+      {
+        "behaviour": "summary-grant",
+        "harness": "claude",
+        "status": "enforced",
+        "tests": [
+          "test/hooks/summary-scope.test.ts",
+          "test/hooks/cross-harness-parity.test.ts"
+        ]
+      },
+      {
+        "behaviour": "summary-grant",
+        "harness": "codex",
+        "status": "enforced",
+        "tests": [
+          "test/hooks/cross-harness-parity.test.ts"
+        ]
+      },
+      {
+        "behaviour": "summary-grant",
+        "harness": "opencode",
+        "status": "limitation",
+        "limitation": "no DoFlow hook bridge"
+      },
+      {
+        "behaviour": "summary-grant",
+        "harness": "pi",
+        "status": "limitation",
+        "limitation": "no prompt hook to deliver"
+      },
+      {
+        "behaviour": "summary-grant",
+        "harness": "copilot",
+        "status": "limitation",
+        "limitation": "no prompt hook to deliver"
+      },
+      {
+        "behaviour": "summary-grant",
+        "harness": "kiro",
+        "status": "limitation",
+        "limitation": "no prompt hook to deliver"
+      },
+      {
+        "behaviour": "summary-grant",
+        "harness": "antigravity",
+        "status": "limitation",
+        "limitation": "no prompt hook to deliver"
+      },
+      {
+        "behaviour": "identity",
+        "harness": "claude",
+        "status": "limitation",
+        "limitation": "launcher environment forwarding into hook processes is unverified until 081 (DEC-004)"
+      },
+      {
+        "behaviour": "identity",
+        "harness": "codex",
+        "status": "limitation",
+        "limitation": "launcher environment forwarding into hook processes is unverified until 081 (DEC-004)"
+      },
+      {
+        "behaviour": "identity",
+        "harness": "opencode",
+        "status": "limitation",
+        "limitation": "no DoFlow hook bridge"
+      },
+      {
+        "behaviour": "identity",
+        "harness": "pi",
+        "status": "limitation",
+        "limitation": "launcher environment forwarding into hook processes is unverified until 081 (DEC-004)"
+      },
+      {
+        "behaviour": "identity",
+        "harness": "copilot",
+        "status": "limitation",
+        "limitation": "launcher environment forwarding into hook processes is unverified until 081 (DEC-004)"
+      },
+      {
+        "behaviour": "identity",
+        "harness": "kiro",
+        "status": "limitation",
+        "limitation": "launcher environment forwarding into hook processes is unverified until 081 (DEC-004)"
+      },
+      {
+        "behaviour": "identity",
+        "harness": "antigravity",
+        "status": "limitation",
+        "limitation": "launcher environment forwarding into hook processes is unverified until 081 (DEC-004)"
+      },
+      {
+        "behaviour": "check-freshness",
+        "harness": "claude",
+        "status": "enforced",
+        "tests": [
+          "test/hooks/check-freshness.test.ts"
+        ]
+      },
+      {
+        "behaviour": "check-freshness",
+        "harness": "codex",
+        "status": "enforced",
+        "tests": [
+          "test/hooks/check-freshness.test.ts"
+        ]
+      },
+      {
+        "behaviour": "check-freshness",
+        "harness": "opencode",
+        "status": "limitation",
+        "limitation": "no pre-edit or pre-command gate"
+      },
+      {
+        "behaviour": "check-freshness",
+        "harness": "pi",
+        "status": "enforced",
+        "tests": [
+          "test/hooks/check-freshness.test.ts"
+        ]
+      },
+      {
+        "behaviour": "check-freshness",
+        "harness": "copilot",
+        "status": "limitation",
+        "limitation": "pre-tool gate and shell guard are wired; check-freshness is not exercised against Copilot payloads"
+      },
+      {
+        "behaviour": "check-freshness",
+        "harness": "kiro",
+        "status": "enforced",
+        "tests": [
+          "test/hooks/check-freshness.test.ts"
+        ]
+      },
+      {
+        "behaviour": "check-freshness",
+        "harness": "antigravity",
+        "status": "enforced",
+        "tests": [
+          "test/hooks/check-freshness.test.ts"
+        ]
+      }
+    ],
+    "rowsDigest": "sha256:d8fdf93bb4a556f0ba91d5a8eb74e5857c29fe7ea87e2731a39afb955d50bb59"
+  }
 }