@khoavu882/doflow 2.0.0-beta.4 → 2.0.0

package/core/harnesses/claude/hooks/session-end.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # session-end.sh — SessionEnd hook
 #
 # Runs when Claude Code closes a session. Responsibilities:
@@ -23,6 +24,27 @@ CWD=$(json_field "$INPUT" ".cwd")
 
 TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 
+# Start storage cleanup without changing the hook's output, status, or latency.
+start_storage_upkeep() {
+  (
+    SHARED_POLICY_LIB="$(dirname "$0")/../../.doflow/shared/hooks/policies/lib.sh"
+    if [[ ! -f "$SHARED_POLICY_LIB" ]]; then
+      SHARED_POLICY_LIB="$(dirname "$0")/../../shared/hooks/policies/lib.sh"
+    fi
+    if [[ -f "$SHARED_POLICY_LIB" ]]; then
+      source "$SHARED_POLICY_LIB"
+      storage_upkeep_async "$CWD"
+    fi
+  ) >/dev/null 2>&1 || true
+}
+
+# No config home (lib.sh leaves the state paths empty): no session store to write, but the
+# storage upkeep still starts (086 IC-010).
+if [[ -z "$STATE_DIR" ]]; then
+  start_storage_upkeep
+  exit 0
+fi
+
 # ── 1. Log session end ────────────────────────────────────────────────────────
 
 mkdir -p "$(dirname "$SESSIONS_LOG")"
@@ -59,16 +81,7 @@ if [[ -n "$SESSION_ID" ]]; then
   rm -rf "$SESSION_PATH" 2>/dev/null || true
 fi
 
-(
-  SHARED_POLICY_LIB="$(dirname "$0")/../../.doflow/shared/hooks/policies/lib.sh"
-  if [[ ! -f "$SHARED_POLICY_LIB" ]]; then
-    SHARED_POLICY_LIB="$(dirname "$0")/../../shared/hooks/policies/lib.sh"
-  fi
-  if [[ -f "$SHARED_POLICY_LIB" ]]; then
-    source "$SHARED_POLICY_LIB"
-    storage_upkeep_async "$CWD"
-  fi
-) >/dev/null 2>&1 || true
+start_storage_upkeep
 
 # ── 4. Trim sessions.log (lock-guarded) ───────────────────────────────────────
 

package/core/harnesses/claude/hooks/session-start.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
-# Claude adapter: reuse the shared session initializer with Claude attribution.
-set -euo pipefail
+# Claude front door: session-context through the shared lifecycle bridge.
+set -uo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-claude}"
-exec bash "$(dirname "$0")/../../.doflow/shared/hooks/policies/session-context.sh"
+if ! . "$(dirname "$0")/../../.doflow/shared/hooks/bridge/bridge.sh" 2>/dev/null; then exit 0; fi
+doflow_bridge claude SessionStart session-context
+exit $?

package/core/harnesses/claude/hooks/skill-config-audit.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # skill-config-audit.sh — ConfigChange(skills) hook (pure observability, no deny path)
 #
 # Logs skill-file mutations regardless of which tool made them (a subagent's Bash heredoc-to-file
@@ -26,6 +27,8 @@ SESSION_ID=$(json_field "$INPUT" ".session_id")
 
 # Guard: if we can't determine the session, nothing to do
 [[ -z "$SESSION_ID" ]] && exit 0
+# No config home (lib.sh leaves the state paths empty): no session store to write (086 IC-010).
+[[ -n "$SESSION_DIR" ]] || exit 0
 
 TIMESTAMP=$(date -u +%FT%TZ)
 SESSION_PATH=$(ensure_session_dir "$SESSION_ID")

package/core/harnesses/claude/hooks/stop-check.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
-# Claude adapter: reuse the shared stop-completion check with Claude attribution.
-set -euo pipefail
+# Claude front door: stop-check through the shared lifecycle bridge.
+set -uo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-claude}"
-exec bash "$(dirname "$0")/../../.doflow/shared/hooks/policies/stop-check.sh"
+if ! . "$(dirname "$0")/../../.doflow/shared/hooks/bridge/bridge.sh" 2>/dev/null; then exit 0; fi
+doflow_bridge claude Stop stop-check
+exit $?

package/core/harnesses/claude/hooks/subagent-audit.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
-# Claude front door: reuse the canonical subagent-audit policy with Claude attribution.
-# No JSON-shape translation needed — claude/codex's copies were byte-identical
-# (022-hooks-remaining-duplication).
-set -euo pipefail
+# Claude front door: subagent-audit through the shared lifecycle bridge.
+set -uo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-claude}"
-exec bash "$(dirname "$0")/../../.doflow/shared/hooks/policies/subagent-audit.sh"
+if ! . "$(dirname "$0")/../../.doflow/shared/hooks/bridge/bridge.sh" 2>/dev/null; then exit 0; fi
+doflow_bridge claude SubagentStart subagent-audit
+exit $?

package/core/harnesses/claude/hooks/user-prompt-submit.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
-# Claude front door: reuse the canonical context policy with Claude's output envelope.
-set -euo pipefail
+# Claude front door: user-prompt-submit through the shared lifecycle bridge.
+set -uo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-claude}"
-exec bash "$(dirname "$0")/../../.doflow/shared/hooks/policies/user-prompt-submit.sh"
+if ! . "$(dirname "$0")/../../.doflow/shared/hooks/bridge/bridge.sh" 2>/dev/null; then exit 0; fi
+doflow_bridge claude UserPromptSubmit user-prompt-submit
+exit $?

package/core/harnesses/claude/settings/settings.json

@@ -116,6 +116,15 @@
       }
     ],
     "PostToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "~/.claude/hooks/post-shell-observe.sh PostToolUse"
+          }
+        ]
+      },
       {
         "matcher": "Edit",
         "hooks": [
@@ -176,6 +185,15 @@
       }
     ],
     "PostToolUseFailure": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "~/.claude/hooks/post-shell-observe.sh PostToolUseFailure"
+          }
+        ]
+      },
       {
         "matcher": ".*",
         "hooks": [

package/core/harnesses/claude/statusline/doflow-statusline.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # doflow-statusline — Claude Code status line fed by DoFlow's neutral state.
 #
 # Claude Code pipes one session-state JSON document to stdin; whatever this script prints becomes

package/core/harnesses/codex/agents/core-implementer.toml

@@ -4,4 +4,5 @@ developer_instructions = """
 Implement features and refactor code strictly according to approved designs and task checklists.
 Optimize algorithms, reduce complexity, and maintain polyglot code quality across the codebase.
 Ensure changes pass all existing tests and conform to language-specific standards.
+End the report with one line `Status: <status>`, where the status is one of `done`, `done-with-concerns`, `needs-context`, `blocked`.
 """

package/core/harnesses/codex/agents/delivery-lead.toml

@@ -0,0 +1,10 @@
+name = "delivery-lead"
+description = "Delivery lead that plans a feature's tasks, briefs and dispatches workers, verifies their evidence, and commits."
+developer_instructions = """
+Plan the tasks of one feature or package, brief each worker with goal, context, write set, rules, acceptance command and report format, and dispatch in parallel only when write sets are disjoint.
+Accept a fix only with a test red on the base and green after, plus a negative control; never weaken an assertion.
+Commit one logical item at a time with explicit paths; stop and return options on an unrequested contract change or a permission denial.
+Write no product code and no tests yourself: workers do.
+Branch on each hand-back's status: `needs-context` resend with the missing context; `blocked` stop and surface it; `done-with-concerns` verify the concerns before accepting; `done` accept.
+End the report with one line `Status: <status>`, where the status is one of `done`, `done-with-concerns`, `needs-context`, `blocked`.
+"""

package/core/harnesses/codex/agents/quality-guardian.toml

@@ -1,8 +1,8 @@
 name = "quality-guardian"
 description = "Specialist quality and security engineer for automated testing, security audits, and root cause analysis."
-sandbox_mode = "read-only"
 developer_instructions = """
 Author and run comprehensive test suites, audit code for security vulnerabilities, and diagnose root causes.
 Verify adherence to SOLID principles, check error handling boundaries, and analyze reproduction traces.
 Stay in audit mode: do not modify business logic code directly without an approved fix plan.
+End the report with one line `Status: <status>`, where the status is one of `done`, `done-with-concerns`, `needs-context`, `blocked`.
 """

package/core/harnesses/codex/agents/research-writer.toml

@@ -1,8 +1,8 @@
 name = "research-writer"
 description = "Specialist research and technical writing agent for documentation, architecture indices, and web research."
-sandbox_mode = "read-only"
 developer_instructions = """
 Conduct deep web research with cited sources and write comprehensive technical documentation.
 Create project architecture indices and implementation flow summaries capturing architectural trade-offs.
 Stay in documentation mode: do not modify workspace source code.
+End the report with one line `Status: <status>`, where the status is one of `done`, `done-with-concerns`, `needs-context`, `blocked`.
 """

package/core/harnesses/codex/agents/reviewer.toml

@@ -0,0 +1,10 @@
+name = "reviewer"
+description = "Read-only reviewer of a change it did not write: evidenced defects, severity, and round-two replies."
+sandbox_mode = "read-only"
+developer_instructions = """
+Review a change written by another agent and model; decline work your own model or agent wrote.
+Back each defect with path:line plus a reproducer you ran or an exact input-to-wrong-output chain, else report it as a note; mark SOURCE or INFERENCE and severity blocker, should-fix or note.
+Run tests only in a scratch copy of the reviewed head and kill every process you start.
+Stay in review mode: do not modify repository files; write only your own report.
+End the report with one line `Status: <status>`, where the status is one of `done`, `done-with-concerns`, `needs-context`, `blocked`.
+"""

package/core/harnesses/codex/agents/spec-analyst.toml

@@ -1,8 +1,8 @@
 name = "spec-analyst"
 description = "Specialist agent for requirements discovery, user story breakdown, and estimation."
-sandbox_mode = "read-only"
 developer_instructions = """
 Elicit requirements through Socratic dialogue focusing on user value and business goals.
 Decompose initiatives into user stories with testable acceptance criteria and estimate effort.
 Stay in planning mode: do not implement code or modify workspace files.
+End the report with one line `Status: <status>`, where the status is one of `done`, `done-with-concerns`, `needs-context`, `blocked`.
 """

package/core/harnesses/codex/agents/system-architect.toml

@@ -1,9 +1,9 @@
 name = "system-architect"
 description = "Specialist architect agent for system design, API contracts, and infrastructure."
-sandbox_mode = "read-only"
 developer_instructions = """
 Design scalable systems with explicit component boundaries, interfaces, dependencies, and trade-offs.
 Evaluate architecture decisions for maintainability, resilience, operational impact, and future change.
 Document clear recommendations with alternatives and validation criteria.
 Stay in planning mode: do not implement code or modify workspace files.
+End the report with one line `Status: <status>`, where the status is one of `done`, `done-with-concerns`, `needs-context`, `blocked`.
 """

package/core/harnesses/codex/hooks/lib.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # lib.sh — shared constants and helpers for session lifecycle hooks
 #
 # Usage: source "$(dirname "$0")/lib.sh"
@@ -17,13 +18,30 @@ set -euo pipefail
 
 # ── State directories ────────────────────────────────────────────────────────
 
-# XDG-compliant, agent-agnostic store shared by Claude Code, Codex, Gemini, etc.
-DOFLOW_HOME="${XDG_CONFIG_HOME:-$HOME/.config}/doflow"
-STATE_DIR="$DOFLOW_HOME/session-env"
-SESSION_DIR="$STATE_DIR/sessions"
-PROJECTS_DIR="$STATE_DIR/projects"
+# XDG-compliant, agent-agnostic store shared by every harness DoFlow supports, under the config home
+# (doflow_config_home: an absolute XDG_CONFIG_HOME, else an absolute HOME + /.config, else none). With
+# no config home every state path below is empty, sourcing this file still never exits, and each state
+# function returns 0 at once: session work is skipped and a guard reaches its own decision (086 IC-010).
+# BEGIN doflow-config-home v1 (rule: src/runtime/config-home.js; checked by test/guards/settings.test.js)
+doflow_config_home() {
+  DOFLOW_HOME=""
+  case "${XDG_CONFIG_HOME:-}" in
+    /*) DOFLOW_HOME="${XDG_CONFIG_HOME}/doflow"; return 0 ;;
+    [A-Za-z]:[\\/]*) case "${OSTYPE:-}" in msys*|cygwin*|win32*) DOFLOW_HOME="${XDG_CONFIG_HOME}/doflow"; return 0 ;; esac ;;
+  esac
+  case "${HOME:-}" in
+    /*) DOFLOW_HOME="${HOME}/.config/doflow" ;;
+    [A-Za-z]:[\\/]*) case "${OSTYPE:-}" in msys*|cygwin*|win32*) DOFLOW_HOME="${HOME}/.config/doflow" ;; esac ;;
+  esac
+  return 0
+}
+# END doflow-config-home v1
+doflow_config_home
+STATE_DIR="${DOFLOW_HOME:+$DOFLOW_HOME/session-env}"
+SESSION_DIR="${STATE_DIR:+$STATE_DIR/sessions}"
+PROJECTS_DIR="${STATE_DIR:+$STATE_DIR/projects}"
 # shellcheck disable=SC2034  # used by session-start.sh and session-end.sh which source this file
-SESSIONS_LOG="$DOFLOW_HOME/sessions.log"
+SESSIONS_LOG="${DOFLOW_HOME:+$DOFLOW_HOME/sessions.log}"
 
 # Identifies which agent is running. Override via env var for non-Claude agents.
 export DOFLOW_AGENT="${DOFLOW_AGENT:-unknown}"
@@ -278,6 +296,7 @@ has_uncommitted_changes() {
 # Safe to call multiple times (mkdir -p is idempotent).
 ensure_session_dir() {
   local session_id="$1"
+  [ -n "$SESSION_DIR" ] || return 0
   mkdir -p "$SESSION_DIR/$session_id"
   echo "$SESSION_DIR/$session_id"
 }
@@ -287,6 +306,7 @@ ensure_session_dir() {
 ensure_project_dir() {
   local cwd="$1"
   local hash
+  [ -n "$PROJECTS_DIR" ] || return 0
   hash=$(cwd_hash "$cwd")
   mkdir -p "$PROJECTS_DIR/$hash"
   echo "$PROJECTS_DIR/$hash"
@@ -314,22 +334,21 @@ require_jq() {
   fi
 }
 
-# ── Session role ──────────────────────────────────────────────────────────────
-
-# Print `main` or `worker` for this session, read from DOFLOW_SESSION_ROLE (matched
-# case-insensitively). Unset or empty is `main`; a value that is neither `main` nor
-# `worker` is `worker` and writes one line to stderr. A worker never writes or claims the
-# project's compact summary or warning. Always returns 0. bash 3.2 safe (no ${var,,}).
-doflow_session_role() {
-  local role
-  role=$(printf '%s' "${DOFLOW_SESSION_ROLE:-}" | tr '[:upper:]' '[:lower:]') || role=""
-  case "$role" in
-    ""|main) printf 'main\n' ;;
-    worker) printf 'worker\n' ;;
-    *)
-      echo "[doflow] unknown DOFLOW_SESSION_ROLE; treating session as worker" >&2
-      printf 'worker\n'
-      ;;
-  esac
-  return 0
-}
+# ── Session role and identity ─────────────────────────────────────────────────
+
+# doflow_session_role comes from the shared identity.sh, its only definition (IC-009). When an
+# install lacks that file, the session is a worker and the broken install is captured as
+# identity-missing: a worker writes and claims nothing, so a broken install cannot leak context.
+if [ -f "${BASH_SOURCE[0]%/*}/../../.doflow/shared/hooks/policies/identity.sh" ]; then
+  . "${BASH_SOURCE[0]%/*}/../../.doflow/shared/hooks/policies/identity.sh"
+else
+  doflow_session_role() {
+    local policy="${0##*/}"
+    policy="${policy%.sh}"
+    policy="${policy%.impl}"
+    ( . "${BASH_SOURCE[0]%/*}/../../.doflow/shared/hooks/policies/capture-failure.sh" \
+      && doflow_capture_failure "$policy" identity-missing ) >/dev/null 2>&1 || true
+    printf 'worker\n'
+    return 0
+  }
+fi

package/core/harnesses/codex/hooks/mcp-tool-guard.sh

@@ -1,18 +1,10 @@
 #!/usr/bin/env bash
-# Codex front door: delegates the mcp-tool-guard decision to the Canonical Policy
-# Library, then translates it into the hookSpecificOutput.permissionDecision deny
-# contract this script's Codex/Claude originals both used — exit code alone is
-# not sufficient here, so this front door is a translator, not a bare exec
-# (unlike session-context/stop-check, which never need this translation).
+# Codex front door: mcp-tool-guard through the shared lifecycle bridge.
 set -uo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-codex}"
-
-command -v jq >/dev/null 2>&1 || exit 0
-source "$(dirname "$0")/../../.doflow/shared/hooks/policies/deny-json.sh"
-
-POLICY="$(dirname "$0")/../../.doflow/shared/hooks/policies/mcp-tool-guard.sh"
-REASON=$(bash "$POLICY" 2>&1 >/dev/null)
-CODE=$?
-
-[ "$CODE" -ne 0 ] && emit_pretooluse_deny_nested "${REASON:-MCP tool call blocked by mcp-tool-guard}"
-exit 0
+if ! . "$(dirname "$0")/../../.doflow/shared/hooks/bridge/bridge.sh" 2>/dev/null; then
+  printf '%s\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"[doflow] shared hooks lack the bridge; run: doflow update -t codex"}}'
+  exit 0
+fi
+doflow_bridge codex PreToolUse mcp-tool-guard
+exit $?

package/core/harnesses/codex/hooks/post-edit-lint.impl.sh

@@ -19,11 +19,13 @@ INPUT=$(cat)
 SESSION_ID=$(json_field "$INPUT" ".session_id")
 TOOL_NAME=$(json_field "$INPUT" ".tool_name")
 
-# Only handle Edit/Write (Claude, Gemini) and apply_patch (Codex's edit tool name)
+# Only handle Edit/Write (Claude) and apply_patch (Codex's edit tool name)
 [[ "$TOOL_NAME" != "Edit" && "$TOOL_NAME" != "Write" && "$TOOL_NAME" != "apply_patch" ]] && exit 0
 
 # Guard: if we can't determine the session, nothing to do
 [[ -z "$SESSION_ID" ]] && exit 0
+# No config home (lib.sh leaves the state paths empty): no session store to write (086 IC-010).
+[[ -n "$SESSION_DIR" ]] || exit 0
 
 SESSION_PATH=$(ensure_session_dir "$SESSION_ID")
 

package/core/harnesses/codex/hooks/pre-bash-guard.sh

@@ -1,18 +1,10 @@
 #!/usr/bin/env bash
-# Codex front door: delegates the pre-bash-guard decision to the Canonical Policy
-# Library, then translates it into the hookSpecificOutput.permissionDecision deny
-# contract this script's Codex/Claude originals both used — exit code alone is
-# not sufficient here, so this front door is a translator, not a bare exec
-# (unlike session-context/stop-check, which never need this translation).
+# Codex front door: pre-bash-guard through the shared lifecycle bridge.
 set -uo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-codex}"
-
-command -v jq >/dev/null 2>&1 || exit 0
-source "$(dirname "$0")/../../.doflow/shared/hooks/policies/deny-json.sh"
-
-POLICY="$(dirname "$0")/../../.doflow/shared/hooks/policies/pre-bash-guard.sh"
-REASON=$(bash "$POLICY" 2>&1 >/dev/null)
-CODE=$?
-
-[ "$CODE" -ne 0 ] && emit_pretooluse_deny_nested "${REASON:-Command blocked by pre-bash-guard}"
-exit 0
+if ! . "$(dirname "$0")/../../.doflow/shared/hooks/bridge/bridge.sh" 2>/dev/null; then
+  printf '%s\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"[doflow] shared hooks lack the bridge; run: doflow update -t codex"}}'
+  exit 0
+fi
+doflow_bridge codex PreToolUse pre-bash-guard
+exit $?

package/core/harnesses/codex/hooks/pre-compact.impl.sh

@@ -1,16 +1,20 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # pre-compact.impl.sh — PreCompact hook (Codex-specific output shape)
 #
 # Codex's PreCompact output schema (codex-rs/hooks/src/schema.rs::PreCompactCommandOutputWire)
 # flattens only HookUniversalOutputWire (continue/stopReason/suppressOutput/systemMessage) and
 # rejects unknown fields — there is no additionalContext-style field for PreCompact, and the
-# output MUST be valid JSON, unlike Claude's PreCompact hook, which reads a plain string as
-# custom_instructions. This script gathers the same git-state context Claude's pre-compact.sh
-# does, but emits it as a JSON systemMessage instead — the closest available field, though
-# systemMessage's exact downstream effect on compaction content is not confirmed (Claude's
-# custom_instructions is fed directly to the compaction LLM call; Codex's docs do not state that
-# systemMessage receives the same treatment). Treat this as best-effort context surfacing, not a
-# guaranteed compaction-summary injection, until verified against a live Codex session.
+# output MUST be valid JSON, unlike Claude's PreCompact hook, whose plain stdout was observed in
+# Claude Code 2.1.304 and 2.1.308 to be read as custom_instructions, undocumented (FU-w563w2). This script
+# gathers the same git-state context Claude's pre-compact.sh does, but emits it as a JSON
+# systemMessage instead — the closest available field, though systemMessage's exact downstream
+# effect on compaction content is not confirmed (that Claude's custom_instructions reach the
+# compaction LLM call is observed in Claude Code 2.1.304 and 2.1.308, undocumented (FU-w563w2); Codex's docs
+# do not state that systemMessage receives the same treatment). Treat this as best-effort context
+# surfacing, not a guaranteed compaction-summary injection, until verified against a live Codex
+# session.
+# The shared compaction text comes from compact-text.sh (IC-001/IC-002).
 #
 # Must never exit non-zero or block (PreCompact hooks do not support a block decision in Codex).
 
@@ -22,25 +26,24 @@ require_jq
 INPUT=$(cat)
 CWD=$(json_field "$INPUT" ".cwd")
 
-BRANCH=""
-SHA=""
-UNCOMMITTED=0
-
-if [[ -n "$CWD" ]] && is_git_worktree "$CWD"; then
-  BRANCH=$(git_branch_of "$CWD" || echo "")
-  SHA=$(git_short_sha_of "$CWD" || echo "")
-  UNCOMMITTED=$(git_uncommitted_count_of "$CWD" || echo "0")
-  RECENT=$(run_with_timeout 1 -- git -C "$CWD" log --format="%h %s" -2 2>/dev/null | paste -sd ' | ' - || echo "")
-
-  MSG=$(printf 'Include in compact summary:\n- git branch: %s sha: %s\n- recent commits: %s\n- uncommitted files: %s\n- cwd: %s\nPreserve: decisions made, files modified, open questions, planned next steps.' \
-    "${BRANCH:-unknown}" "${SHA:-unknown}" "${RECENT:-none}" "$UNCOMMITTED" "${CWD:-unknown}")
-else
-  MSG=$(printf 'Include in compact summary:\n- cwd: %s (not a git repository)\nPreserve: decisions made, files modified, open questions, planned next steps.' \
-    "${CWD:-unknown}")
+# Rule compact-instructions.instructions (DEC-023) decides whether this hook emits; it is
+# `include` for both roles, so the output below is unchanged. The role comes from the shared
+# identity.sh, read silently: this hook never wrote the role diagnostic and does not start now.
+POLICIES="$(dirname "$0")/../../.doflow/shared/hooks/policies"
+[[ -f "$POLICIES/emission-rules.sh" ]] || POLICIES="$(dirname "$0")/../../shared/hooks/policies"
+_DF_ROLE=worker
+if declare -F _doflow_role_resolve >/dev/null 2>&1; then _doflow_role_resolve 2>/dev/null; fi
+DF_ACTION=skip
+if [[ -f "$POLICIES/emission-rules.sh" ]]; then
+  # shellcheck source=/dev/null
+  . "$POLICIES/emission-rules.sh"
+  doflow_emission_rule compact-instructions.instructions "$_DF_ROLE"
 fi
+[[ "$DF_ACTION" == include ]] || exit 0
 
-# Hard-cap at 490 chars, matching Claude's script, before JSON-encoding.
-MSG="${MSG:0:490}"
-
-jq -n --arg systemMessage "$MSG" '{systemMessage: $systemMessage}'
+[[ -f "$POLICIES/compact-text.sh" ]] || exit 0
+# shellcheck source=/dev/null
+source "$POLICIES/compact-text.sh"
+doflow_compact_text "$CWD"
+jq -n --arg systemMessage "$DF_COMPACT_TEXT" '{systemMessage: $systemMessage}'
 exit 0

package/core/harnesses/codex/hooks/pre-implement-gate.sh

@@ -1,19 +1,10 @@
 #!/usr/bin/env bash
-# Codex front door: delegates the pre-implementation-gate decision to the
-# Canonical Policy Library, then translates it into the
-# hookSpecificOutput.permissionDecision deny contract this script's Codex/Claude
-# originals both used — exit code alone is not sufficient here, so this front
-# door is a translator, not a bare exec (unlike session-context/stop-check,
-# which never need this translation).
+# Codex front door: pre-implementation-gate through the shared lifecycle bridge.
 set -uo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-codex}"
-
-command -v jq >/dev/null 2>&1 || exit 0
-source "$(dirname "$0")/../../.doflow/shared/hooks/policies/deny-json.sh"
-
-POLICY="$(dirname "$0")/../../.doflow/shared/hooks/policies/pre-implementation-gate.sh"
-REASON=$(bash "$POLICY" 2>&1 >/dev/null)
-CODE=$?
-
-[ "$CODE" -ne 0 ] && emit_pretooluse_deny_nested "${REASON:-Implementation requires an approved plan.md}"
-exit 0
+if ! . "$(dirname "$0")/../../.doflow/shared/hooks/bridge/bridge.sh" 2>/dev/null; then
+  printf '%s\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"[doflow] shared hooks lack the bridge; run: doflow update -t codex"}}'
+  exit 0
+fi
+doflow_bridge codex PreToolUse pre-implementation-gate
+exit $?

package/core/harnesses/codex/hooks/session-end.impl.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # session-end.sh — SessionEnd hook
 #
 # Runs when Claude Code closes a session. Responsibilities:
@@ -24,6 +25,27 @@ CWD=$(json_field "$INPUT" ".cwd")
 
 TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 
+# Start storage cleanup without changing the hook's output, status, or latency.
+start_storage_upkeep() {
+  (
+    SHARED_POLICY_LIB="$(dirname "$0")/../../.doflow/shared/hooks/policies/lib.sh"
+    if [[ ! -f "$SHARED_POLICY_LIB" ]]; then
+      SHARED_POLICY_LIB="$(dirname "$0")/../../shared/hooks/policies/lib.sh"
+    fi
+    if [[ -f "$SHARED_POLICY_LIB" ]]; then
+      source "$SHARED_POLICY_LIB"
+      storage_upkeep_async "$CWD"
+    fi
+  ) >/dev/null 2>&1 || true
+}
+
+# No config home (lib.sh leaves the state paths empty): no session store to write, but the
+# storage upkeep still starts (086 IC-010).
+if [[ -z "$STATE_DIR" ]]; then
+  start_storage_upkeep
+  exit 0
+fi
+
 # ── 1. Log session end ────────────────────────────────────────────────────────
 
 mkdir -p "$(dirname "$SESSIONS_LOG")"
@@ -60,16 +82,7 @@ if [[ -n "$SESSION_ID" ]]; then
   rm -rf "$SESSION_PATH" 2>/dev/null || true
 fi
 
-(
-  SHARED_POLICY_LIB="$(dirname "$0")/../../.doflow/shared/hooks/policies/lib.sh"
-  if [[ ! -f "$SHARED_POLICY_LIB" ]]; then
-    SHARED_POLICY_LIB="$(dirname "$0")/../../shared/hooks/policies/lib.sh"
-  fi
-  if [[ -f "$SHARED_POLICY_LIB" ]]; then
-    source "$SHARED_POLICY_LIB"
-    storage_upkeep_async "$CWD"
-  fi
-) >/dev/null 2>&1 || true
+start_storage_upkeep
 
 # ── 4. Trim sessions.log (lock-guarded) ───────────────────────────────────────
 

package/core/harnesses/codex/hooks/session-start.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
-# Codex adapter: reuse the canonical session-context policy with Codex attribution.
-set -euo pipefail
+# Codex front door: session-context through the shared lifecycle bridge.
+set -uo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-codex}"
-exec bash "$(dirname "$0")/../../.doflow/shared/hooks/policies/session-context.sh"
+if ! . "$(dirname "$0")/../../.doflow/shared/hooks/bridge/bridge.sh" 2>/dev/null; then exit 0; fi
+doflow_bridge codex SessionStart session-context
+exit $?

package/core/harnesses/codex/hooks/stop-check.sh

@@ -1,8 +1,9 @@
 #!/usr/bin/env bash
-# Codex adapter: preserve a blocking exit while returning valid Stop JSON on success.
-set -euo pipefail
+# Codex front door: stop-check through the shared lifecycle bridge.
+set -uo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-codex}"
+if ! . "$(dirname "$0")/../../.doflow/shared/hooks/bridge/bridge.sh" 2>/dev/null; then printf '{}\n'; exit 0; fi
 rc=0
-bash "$(dirname "$0")/../../.doflow/shared/hooks/policies/stop-check.sh" || rc=$?
-[ "$rc" -eq 2 ] && exit 2
-printf '{}\n'
+output="$(doflow_bridge codex Stop stop-check)" || rc=$?
+if [ "$rc" -eq 0 ]; then printf '%s\n' "$output"; fi
+exit "$rc"

package/core/harnesses/codex/hooks/subagent-audit.sh

@@ -1,8 +1,20 @@
 #!/usr/bin/env bash
-# Codex front door: reuse the canonical subagent-audit policy with Codex attribution, then emit
-# the empty-JSON SubagentStop requires on success (022-hooks-remaining-duplication: claude/codex's
-# copies were byte-identical; only this trailing JSON requirement is Codex-specific).
-set -euo pipefail
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
+# Codex front door: subagent-audit through the shared lifecycle bridge.
+set -uo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-codex}"
-bash "$(dirname "$0")/../../.doflow/shared/hooks/policies/subagent-audit.sh"
-printf '{}\n'
+if ! . "$(dirname "$0")/../../.doflow/shared/hooks/bridge/bridge.sh" 2>/dev/null; then exit 0; fi
+payload=$(cat)
+event=$(printf '%s' "$payload" | jq -r '.hook_event_name // "SubagentStart"' 2>/dev/null || printf 'SubagentStart')
+has_jq=1
+command -v jq >/dev/null 2>&1 || has_jq=0
+rc=0
+doflow_bridge codex "$event" subagent-audit <<<"$payload" || rc=$?
+if [ "$has_jq" -eq 0 ]; then
+  printf '{}\n'
+  exit 0
+fi
+if [ "$rc" -eq 0 ]; then
+  case "$DF_BRIDGE_OUTCOME" in allow|advisory) printf '{}\n' ;; esac
+fi
+exit "$rc"