@khoavu882/doflow 2.0.0-beta.5 → 2.0.0

package/README.md

@@ -1,14 +1,13 @@
 # DoFlow
 
-DoFlow is a configuration layer for AI coding tools. It gives Claude Code, Codex, Gemini /
-Antigravity, OpenCode, Pi, GitHub Copilot CLI, and Kiro a shared set of engineering rules, reusable
-workflows, and safer defaults — projected from one source, so the eight never drift apart.
+DoFlow is a configuration layer for AI coding tools. It gives Claude Code, Codex, Antigravity,
+OpenCode, Pi, GitHub Copilot CLI, and Kiro a shared set of engineering rules, reusable
+workflows, and safer defaults — projected from one source, so the seven never drift apart.
 
 ```mermaid
 flowchart LR
     R[One DoFlow source] --> C[Claude Code]
     R --> X[Codex]
-    R --> G[Gemini CLI]
     R --> O[OpenCode]
     R --> P[Pi]
     R --> CP[Copilot CLI]
@@ -16,7 +15,6 @@ flowchart LR
     R --> A[Antigravity CLI]
     C --> H[Hooks + MCP + skills]
     X --> S[AGENTS.md + skills]
-    G --> GM[GEMINI.md + skills]
     A --> AG[AGENTS.md + .agents tree]
     O --> S
     P --> S
@@ -29,7 +27,7 @@ flowchart LR
 | Need | DoFlow component |
 |---|---|
 | Repeatable delivery work | 13 skills, including `/do-brainstorm`, `/do-plan`, `/do-test`, and `/do-code-review` |
-| Specialist review | 5 agents — `spec-analyst`, `system-architect`, `core-implementer`, `quality-guardian`, `research-writer` |
+| Specialist review | 7 agents — `spec-analyst`, `system-architect`, `delivery-lead`, `core-implementer`, `quality-guardian`, `reviewer`, `research-writer` |
 | Safer automation | Claude hooks block destructive commands and unfinished implementation stubs |
 | Shared standards | Rules for safety, workflow, quality, and clarification across supported tools |
 | Session continuity | Claude and Codex hooks capture lightweight Git context and compact-session summaries and deliver them on a session's first prompt |
@@ -38,7 +36,7 @@ flowchart LR
 
 1. **New to DoFlow?** Follow the [Quickstart](docs/quickstart.md).
 2. **Need installation, updates, or rollback?** Use the [Setup guide](docs/setup.md).
-3. **Want to understand the moving parts?** Read the visual [Overview](docs/overview.md).
+3. **Want to understand the moving parts?** Read the visual [Overview](docs/index.md#the-component-model).
 4. **Ready to work?** Pick a task pattern from the [Guide](docs/guide.md).
 5. **Looking up a command or capability?** Open the [Reference](docs/reference.md).
 
@@ -111,16 +109,19 @@ Use `/do-flow "add a customer export"` to run the same sequence with its approva
 |---|---|
 | Claude Code | Full integration: skills, agents, hooks, MCP registration, session context, and rules |
 | Codex | `AGENTS.md`, skills at `.agents/skills/`, scripts, templates, rules, agents, hooks, and references |
-| Gemini CLI | `GEMINI.md`, rules, agents, modes, skills, hooks, and references |
-| Antigravity CLI (`agy`) | Managed `AGENTS.md` section (project), skills at `.agents/skills/`, shared agents, workspace rules at `.agents/rules/`, the spec-driven chain workflow shim, the pre-implementation-gate hook (`.agents/hooks.json`), and MCP in `.agents/mcp_config.json` / `~/.gemini/config/mcp_config.json` |
+| Antigravity CLI (`agy`) | Managed `AGENTS.md` section (project), skills at `.agents/skills/`, shared agents, workspace rules at `.agents/rules/`, the spec-driven chain workflow shim, the pre-implementation-gate hook (`.agents/hooks.json`), and MCP in `.agents/mcp_config.json` / `~/.gemini/config/mcp_config.json`, and a managed guidance section in the global `~/.gemini/GEMINI.md` |
 | OpenCode | `AGENTS.md`, skills discovered at `.opencode/skills/` (project) or `~/.config/opencode/skills/` (global), and `opencode.json` configuration |
 | Pi Coding Agent | `AGENTS.md`, skills discovered at `.pi/skills/` (project) or `~/.pi/agent/skills/` (global), and MCP servers in `.pi/mcp.json` (project) or `~/.pi/agent/mcp.json` (global) |
 | GitHub Copilot CLI | `.github/copilot-instructions.md` (project scope only), skills at `.agents/skills/`, agents at `.github/agents/`, and MCP registered in `.mcp.json` |
 | Kiro | Steering files under `.kiro/steering/`, skills at `.kiro/skills/`, agents at `.kiro/agents/`, hooks at `.kiro/hooks/`, and MCP registered in `.kiro/settings/mcp.json` |
 
+Content (guidance, skills, agents, MCP) goes to every harness; DoFlow's hooks, gates and bridge go
+only to the harnesses the user-layer setting `hooks.harnesses` names (default `claude`, `codex`,
+`antigravity`, `pi`). A harness outside the list gets content only, and the next install or update
+removes the DoFlow hooks an earlier run wrote for it; an install or update warns when Claude or a
+worker named in `workers.enabled` is left out. Add `kiro` to that list for its hooks.
 Codex hooks are installed as `hooks.json` but require review/trust in Codex before they run.
-Gemini hooks merge into a `hooks` key inside `settings.json` (never a full-file replace) and are
-similarly subject to Gemini's own hook trust/review gating. Kiro's hooks are not in Kiro v3's
+Kiro's hooks are not in Kiro v3's
 untrusted-workspace exclusion list; an untrusted workspace asks before every shell command, and
 whether that covers hook commands is undocumented. Copilot CLI documents hooks, settings, and a
 plugin marketplace upstream; DoFlow still installs none of those there. OpenCode and Pi

package/bin/doflow.js

@@ -5,24 +5,34 @@
 // so the `doflow` binary path and the doflow-run dispatcher seam
 // (core/shared/scripts/doflow/bin/doflow-run, which execs `node <repoRoot>/bin/doflow.js`)
 // keep resolving to this exact location.
-// Refuse clearly on a Node that cannot strip types: src/ is TypeScript, and without stripping
-// loading a .ts module dies with a SyntaxError on the first annotation. Stripping is on by
-// default from Node 22.18.0 / 23.6.0 and off under --no-experimental-strip-types; the range stops at
-// 24.3.0 because 23.6 to 24.2 print an ExperimentalWarning on every .ts load. This file stays
-// plain JavaScript so it can say so. Exit 2 is the doflow-run usage/resolution-error code.
+// Refuse clearly on a Node below the floor, or one that cannot strip types: src/ is TypeScript, and
+// without stripping loading a .ts module dies with a SyntaxError on the first annotation. The floor
+// is 24.22.1, the 2026-10-21 security release of the Node 24 line (engines.node in package.json is
+// the same value); stripping is on by default from there and off only under
+// --no-experimental-strip-types. This file stays plain JavaScript so it can say so. Exit 2 is the
+// doflow-run usage/resolution-error code.
+const NODE_FLOOR_VERSION = '24.22.1';
+const NODE_FLOOR = `>=${NODE_FLOOR_VERSION}`;
+// A prerelease of the floor version (24.22.1-rc.1) sorts below it, as in semver; any other
+// prerelease suffix is ignored, so 24.22.2-rc.1 and 24.23.0-rc.1 both pass.
+const running = /^(\d+)\.(\d+)\.(\d+)(-.*)?$/.exec(String(process.versions.node)) || [];
+const order = NODE_FLOOR_VERSION.split('.').reduce((result, part, i) => result || Math.sign(Number(running[i + 1] || 0) - Number(part)), 0);
+const belowFloor = order < 0 || (order === 0 && Boolean(running[4]));
+if (belowFloor) {
+  process.stderr.write(`doflow: Node ${process.versions.node} is not supported; doflow needs Node ${NODE_FLOOR} (Node 22 and Node 24 before ${NODE_FLOOR_VERSION} are no longer supported).\n`);
+  process.exit(2);
+}
 if (!process.features || !process.features.typescript) {
-  process.stderr.write(`doflow: Node ${process.versions.node} cannot strip TypeScript types; doflow needs Node ^22.18.0 || >=24.3.0 with type-stripping enabled (it is off under --no-experimental-strip-types, including via NODE_OPTIONS).\n`);
+  process.stderr.write(`doflow: Node ${process.versions.node} cannot strip TypeScript types; doflow needs Node ${NODE_FLOOR} with type-stripping enabled (it is off under --no-experimental-strip-types, including via NODE_OPTIONS).\n`);
   process.exit(2);
 }
 // Enable Node's module compile cache before any ../src require. Type stripping makes the first load
 // of each .ts module cost a transform; the cache turns that into a one-time cost per Node version
 // and file content. Called without options so an explicit NODE_COMPILE_CACHE directory is honoured
-// and NODE_DISABLE_COMPILE_CACHE still disables it. Best-effort: where the API is missing (older
-// Node) or throws, the CLI runs at today's speed.
+// and NODE_DISABLE_COMPILE_CACHE still disables it. Best-effort: if it throws, the CLI runs at
+// today's speed.
 const nodeModule = require('node:module');
-if (typeof nodeModule.enableCompileCache === 'function') {
-  try { nodeModule.enableCompileCache(); } catch { /* best-effort */ }
-}
+try { nodeModule.enableCompileCache(); } catch { /* best-effort */ }
 // Record an error that escapes everything, including one thrown while the CLI loads (a half-updated
 // install), before it is loaded (IC-016). The monitor only observes: Node's own crash output and
 // exit status are unchanged, and a monitor that threw would change that status to 7, hence the

package/core/.antigravity-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "doflow",
   "version": "1.0.0",
-  "description": "Spec-driven engineering workflow engine, quality gates, and specialist agent personas for Google Antigravity and Gemini.",
+  "description": "Spec-driven engineering workflow engine, quality gates, and specialist agent personas for Google Antigravity.",
   "author": {
     "name": "DoFlow",
     "url": "https://github.com/khoavu882/do-flow"
@@ -11,7 +11,6 @@
   "license": "MIT",
   "keywords": [
     "antigravity",
-    "gemini",
     "engineering",
     "workflows",
     "quality-gates",

package/core/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "doflow",
-  "version": "2.0.0-beta.5",
+  "version": "2.0.0",
   "description": "Reusable engineering workflows, quality gates, and specialist guidance for Claude Code.",
   "author": {
     "name": "DoFlow"

package/core/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "doflow",
-  "version": "2.0.0-beta.5",
+  "version": "2.0.0",
   "description": "Reusable engineering workflows, quality gates, and specialist guidance for Codex.",
   "author": {
     "name": "DoFlow",

package/core/.plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "doflow",
-  "version": "2.0.0-beta.5",
+  "version": "2.0.0",
   "description": "Reusable engineering workflows, quality gates, and specialist guidance for GitHub Copilot CLI.",
   "author": {
     "name": "DoFlow",

package/core/harnesses/claude/hooks/lib.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # lib.sh — shared constants and helpers for session lifecycle hooks
 #
 # Usage: source "$(dirname "$0")/lib.sh"
@@ -17,13 +18,30 @@ set -euo pipefail
 
 # ── State directories ────────────────────────────────────────────────────────
 
-# XDG-compliant, agent-agnostic store shared by Claude Code, Codex, Gemini, etc.
-DOFLOW_HOME="${XDG_CONFIG_HOME:-$HOME/.config}/doflow"
-STATE_DIR="$DOFLOW_HOME/session-env"
-SESSION_DIR="$STATE_DIR/sessions"
-PROJECTS_DIR="$STATE_DIR/projects"
+# XDG-compliant, agent-agnostic store shared by every harness DoFlow supports, under the config home
+# (doflow_config_home: an absolute XDG_CONFIG_HOME, else an absolute HOME + /.config, else none). With
+# no config home every state path below is empty, sourcing this file still never exits, and each state
+# function returns 0 at once: session work is skipped and a guard reaches its own decision (086 IC-010).
+# BEGIN doflow-config-home v1 (rule: src/runtime/config-home.js; checked by test/guards/settings.test.js)
+doflow_config_home() {
+  DOFLOW_HOME=""
+  case "${XDG_CONFIG_HOME:-}" in
+    /*) DOFLOW_HOME="${XDG_CONFIG_HOME}/doflow"; return 0 ;;
+    [A-Za-z]:[\\/]*) case "${OSTYPE:-}" in msys*|cygwin*|win32*) DOFLOW_HOME="${XDG_CONFIG_HOME}/doflow"; return 0 ;; esac ;;
+  esac
+  case "${HOME:-}" in
+    /*) DOFLOW_HOME="${HOME}/.config/doflow" ;;
+    [A-Za-z]:[\\/]*) case "${OSTYPE:-}" in msys*|cygwin*|win32*) DOFLOW_HOME="${HOME}/.config/doflow" ;; esac ;;
+  esac
+  return 0
+}
+# END doflow-config-home v1
+doflow_config_home
+STATE_DIR="${DOFLOW_HOME:+$DOFLOW_HOME/session-env}"
+SESSION_DIR="${STATE_DIR:+$STATE_DIR/sessions}"
+PROJECTS_DIR="${STATE_DIR:+$STATE_DIR/projects}"
 # shellcheck disable=SC2034  # used by session-start.sh and session-end.sh which source this file
-SESSIONS_LOG="$DOFLOW_HOME/sessions.log"
+SESSIONS_LOG="${DOFLOW_HOME:+$DOFLOW_HOME/sessions.log}"
 
 # Identifies which agent is running. Override via env var for non-Claude agents.
 export DOFLOW_AGENT="${DOFLOW_AGENT:-claude-code}"
@@ -247,6 +265,7 @@ has_uncommitted_changes() {
 # Safe to call multiple times (mkdir -p is idempotent).
 ensure_session_dir() {
   local session_id="$1"
+  [ -n "$SESSION_DIR" ] || return 0
   mkdir -p "$SESSION_DIR/$session_id"
   echo "$SESSION_DIR/$session_id"
 }
@@ -256,6 +275,7 @@ ensure_session_dir() {
 ensure_project_dir() {
   local cwd="$1"
   local hash
+  [ -n "$PROJECTS_DIR" ] || return 0
   hash=$(cwd_hash "$cwd")
   mkdir -p "$PROJECTS_DIR/$hash"
   echo "$PROJECTS_DIR/$hash"
@@ -283,22 +303,21 @@ require_jq() {
   fi
 }
 
-# ── Session role ──────────────────────────────────────────────────────────────
+# ── Session role and identity ─────────────────────────────────────────────────
 
-# Print `main` or `worker` for this session, read from DOFLOW_SESSION_ROLE (matched
-# case-insensitively). Unset or empty is `main`; a value that is neither `main` nor
-# `worker` is `worker` and writes one line to stderr. A worker never writes or claims the
-# project's compact summary or warning. Always returns 0. bash 3.2 safe (no ${var,,}).
-doflow_session_role() {
-  local role
-  role=$(printf '%s' "${DOFLOW_SESSION_ROLE:-}" | tr '[:upper:]' '[:lower:]') || role=""
-  case "$role" in
-    ""|main) printf 'main\n' ;;
-    worker) printf 'worker\n' ;;
-    *)
-      echo "[doflow] unknown DOFLOW_SESSION_ROLE; treating session as worker" >&2
-      printf 'worker\n'
-      ;;
-  esac
-  return 0
-}
+# doflow_session_role comes from the shared identity.sh, its only definition (IC-009). When an
+# install lacks that file, the session is a worker and the broken install is captured as
+# identity-missing: a worker writes and claims nothing, so a broken install cannot leak context.
+if [ -f "${BASH_SOURCE[0]%/*}/../../.doflow/shared/hooks/policies/identity.sh" ]; then
+  . "${BASH_SOURCE[0]%/*}/../../.doflow/shared/hooks/policies/identity.sh"
+else
+  doflow_session_role() {
+    local policy="${0##*/}"
+    policy="${policy%.sh}"
+    policy="${policy%.impl}"
+    ( . "${BASH_SOURCE[0]%/*}/../../.doflow/shared/hooks/policies/capture-failure.sh" \
+      && doflow_capture_failure "$policy" identity-missing ) >/dev/null 2>&1 || true
+    printf 'worker\n'
+    return 0
+  }
+fi

package/core/harnesses/claude/hooks/permission-audit.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # permission-audit.sh — PermissionDenied hook (pure observability, no deny path)
 #
 # The decision has already been made by the time this fires; there is nothing to
@@ -27,6 +28,8 @@ SESSION_ID=$(json_field "$INPUT" ".session_id")
 
 # Guard: if we can't determine the session, nothing to do
 [[ -z "$SESSION_ID" ]] && exit 0
+# No config home (lib.sh leaves the state paths empty): no session store to write (086 IC-010).
+[[ -n "$SESSION_DIR" ]] || exit 0
 
 EVENT=$(json_field "$INPUT" ".hook_event_name")
 TOOL_NAME=$(json_field "$INPUT" ".tool_name")

package/core/harnesses/claude/hooks/post-compact.sh

@@ -1,12 +1,15 @@
 #!/usr/bin/env bash
-# post-compact.sh — PostCompact hook
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
+# post-compact.sh — PostCompact hook (IC-011)
 #
-# Saves the AI-generated compact_summary (from stdin JSON) to a project-scoped
-# file. user-prompt-submit.sh reads and injects it directly on the next session's
-# first prompt — no manual restore command required.
+# Records the AI-generated compact_summary (from stdin JSON) in the summary scope of the session
+# that produced it: summaries/<worktreeKey>/<run>/<lineage>/summary.md, through
+# doflow_summary_write. Rule compact-store.summary decides whether this session records at all (a
+# `solo` lineage records nothing, DEC-013); rule compact-meta.meta decides whether meta.json's
+# compacted_at is updated (the default main lineage only). The retired project-level summary file
+# is never written.
 #
-# Atomic write: mktemp → populate → mv ensures readers never see partial content.
-# Multi-session safe: project directory is keyed by cwd hash, not session_id.
+# Atomic write: the store writes a .summary.XXXXXX temp file in the scope, then renames it.
 # Must complete in <200ms. Must never exit non-zero or block.
 
 set -euo pipefail
@@ -16,11 +19,6 @@ require_jq
 
 INPUT=$(cat)
 
-# A worker session never writes the project's summary or metadata: they belong to the main session.
-if [[ "$(doflow_session_role || echo main)" == "worker" ]]; then
-  exit 0
-fi
-
 SESSION_ID=$(json_field "$INPUT" ".session_id")
 CWD=$(json_field "$INPUT" ".cwd")
 TRIGGER=$(json_field "$INPUT" ".trigger")
@@ -33,34 +31,39 @@ COMPACT_SUMMARY=$(json_field "$INPUT" ".compact_summary")
 # injected as empty context on the next session's first prompt — useless noise, skip it.
 [[ -z "$COMPACT_SUMMARY" ]] && exit 0
 
-PROJECT_DIR=$(ensure_project_dir "$CWD")
+# The identity, the rule table and the store come from the Canonical Policy Library. An install
+# missing any of them records nothing: a broken install cannot write a summary to the wrong scope.
+POLICIES="$(dirname "$0")/../../.doflow/shared/hooks/policies"
+declare -F doflow_identity >/dev/null 2>&1 || exit 0
+[[ -f "$POLICIES/emission-rules.sh" && -f "$POLICIES/summary-store.sh" ]] || exit 0
+# shellcheck source=/dev/null
+. "$POLICIES/emission-rules.sh"
+# shellcheck source=/dev/null
+. "$POLICIES/summary-store.sh"
+
+doflow_identity "$SESSION_ID" "$CWD"
+
+DF_ACTION=skip
+doflow_emission_rule compact-store.summary "$DF_ID_ROLE:$DF_ID_KIND"
+[[ "$DF_ACTION" == write ]] || exit 0
 
 # Read current branch for frontmatter metadata (best-effort, empty is fine)
 BRANCH=$(run_with_timeout 5 -- git -C "$CWD" branch --show-current 2>/dev/null || echo "")
 TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 
-# Single cleanup function covers both temp files — a second trap() call would
-# silently replace the first, leaving the earlier temp file unguarded on failure.
-TMP=""
-META_TMP=""
-_cleanup() { rm -f "$TMP" "$META_TMP" 2>/dev/null || true; }
-trap _cleanup EXIT
+doflow_summary_write "$DF_ID_WORKTREE" "$DF_ID_RUN" "$DF_ID_LINEAGE" "${DF_ID_ATTEMPT:-}" \
+  "$TIMESTAMP" "$SESSION_ID" "$TRIGGER" "$BRANCH" "$DF_ID_ROLE" "$COMPACT_SUMMARY" || exit 0
 
-# Atomic write: write to a temp file then rename.
-TMP=$(mktemp "$PROJECT_DIR/.last-compact-summary.XXXXXX")
-cat > "$TMP" <<EOF
----
-compacted_at: ${TIMESTAMP}
-session_id: ${SESSION_ID:-unknown}
-trigger: ${TRIGGER:-unknown}
-branch: ${BRANCH:-unknown}
-role: main
----
+DF_ACTION=skip
+doflow_emission_rule compact-meta.meta "$DF_ID_ROLE:$DF_ID_KIND"
+[[ "$DF_ACTION" == write ]] || exit 0
 
-${COMPACT_SUMMARY}
-EOF
-mv "$TMP" "$PROJECT_DIR/last-compact-summary.md"
-TMP=""  # already moved; _cleanup should not attempt to rm it
+# No config home (lib.sh leaves the state paths empty): no session store to write (086 IC-010).
+[[ -n "$PROJECTS_DIR" ]] || exit 0
+PROJECT_DIR=$(ensure_project_dir "$CWD")
+META_TMP=""
+_cleanup() { rm -f "$META_TMP" 2>/dev/null || true; }
+trap _cleanup EXIT
 
 # Update meta.json compacted_at (field-merge — do not overwrite other fields)
 if [[ -f "$PROJECT_DIR/meta.json" ]]; then

package/core/harnesses/claude/hooks/post-edit-lint.sh

@@ -22,6 +22,8 @@ TOOL_NAME=$(json_field "$INPUT" ".tool_name")
 
 # Guard: if we can't determine the session, nothing to do
 [[ -z "$SESSION_ID" ]] && exit 0
+# No config home (lib.sh leaves the state paths empty): no session store to write (086 IC-010).
+[[ -n "$SESSION_DIR" ]] || exit 0
 
 FILE_PATH=$(json_field "$INPUT" ".tool_input.file_path")
 

package/core/harnesses/claude/hooks/post-shell-observe.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
+# IC-005, E.1 (Claude Code 2.1.292): event gives status; duration_ms is numeric on both
+# post events. Neither has a numeric exit code. Never inspect or record output/error text.
+[ "${DOFLOW_TELEMETRY:-}" != off ] || exit 0
+exec >/dev/null 2>&1
+event=${1:-}
+case "$event" in PostToolUse|PostToolUseFailure) ;; *) exit 0 ;; esac
+IFS= read -r -d '' payload || true
+case "$payload" in *test*|*jest*|*mocha*) ;; *) exit 0 ;; esac
+
+# Source definitions only; no lifecycle policy, failure capture or native response runs here.
+_DOFLOW_SRC=${BASH_SOURCE[0]//\\//}; case $_DOFLOW_SRC in */*) hook_dir=${_DOFLOW_SRC%/*} ;; *) hook_dir=. ;; esac
+. "$hook_dir/../../.doflow/shared/hooks/bridge/bridge.sh" || exit 0
+
+# Same project-store resolution as bridge.sh, including nested dispatch delivery directories.
+# The bridge currently has no separately exported doflow_telemetry_dir helper.
+if [ -n "${DOFLOW_CONFIG_DIR:-}" ]; then
+  d=$DOFLOW_CONFIG_DIR
+else
+  d=${PWD:-}
+  case "$d" in /*) ;; *) exit 0 ;; esac
+  while :; do
+    if [ -d "$d/.doflow" ]; then
+      case "$d/" in */.doflow/*) ;; *) d=${d%/}/.doflow; break ;; esac
+    fi
+    [ -n "$d" ] && [ "$d" != / ] || exit 0
+    d=${d%/*}
+  done
+fi
+[ -d "$d/state" ] || exit 0
+
+tuple=$(printf '%s' "$payload" | jq -c --arg harness claude --arg event "$event" \
+  --arg policy post-shell-observe --arg mode observe -f "$_DOFLOW_BRIDGE_DIR/envelope.jq") || exit 0
+case "$tuple" in *$'\n'*|''|'{}'|'{"dft":1}') exit 0 ;; esac
+class=${tuple##*\"test_class\":\"}; class=${class%%\"*}
+case "$class" in test.full|test.scoped|test.other) ;; *) exit 0 ;; esac
+day=${tuple:17:10}
+case "$day" in [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]) ;; *) exit 0 ;; esac
+rest=${tuple#\{\"dft\":1,\"date\":\"??????????\",}
+case "$rest" in \"timestamp\":*\}) ;; *) exit 0 ;; esac
+# test_class is last in the tuple; print it explicitly so the contract guard sees the key.
+rest=${rest%,\"test_class\":*}\}
+[ -d "$d/state/runs/telemetry" ] || mkdir "$d/state/runs/telemetry" || exit 0
+f=$d/state/runs/telemetry/$day.jsonl
+[ ! -e "$f" ] || [ -f "$f" ] || exit 0
+printf '{"kind":"hook","harness":"claude","event":"%s","policy":"post-shell-observe","verdict":"observe","test_class":"%s",%s\n' "$event" "$class" "$rest" >>"$f" || true
+exit 0

package/core/harnesses/claude/hooks/post-tool-failure.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # post-tool-failure.sh — PostToolUse*Failure* hook (pure observability, no deny path)
 #
 # A failed tool call is the one outcome no other hook records. post-edit-lint.sh
@@ -25,6 +26,8 @@ SESSION_ID=$(json_field "$INPUT" ".session_id")
 
 # Guard: if we can't determine the session, nothing to do
 [[ -z "$SESSION_ID" ]] && exit 0
+# No config home (lib.sh leaves the state paths empty): no session store to write (086 IC-010).
+[[ -n "$SESSION_DIR" ]] || exit 0
 
 EVENT=$(json_field "$INPUT" ".hook_event_name")
 TOOL_NAME=$(json_field "$INPUT" ".tool_name")

package/core/harnesses/claude/hooks/pre-compact.sh

@@ -1,12 +1,10 @@
 #!/usr/bin/env bash
 # pre-compact.sh — PreCompact hook
 #
-# Outputs a plain string to stdout that Claude Code passes as custom_instructions
-# to the compaction LLM call. This enriches the compact summary with git state
-# so the summary preserves branch/commit context for the next session.
-#
-# Output is a plain string — NOT JSON.
-# Must be under ~500 chars (Claude Code may truncate longer strings).
+# Outputs plain stdout, not JSON. In Claude Code 2.1.304 and 2.1.308, this reached the
+# compaction summary model as custom instructions; vendor docs are silent on
+# PreCompact stdout (FU-w563w2).
+# Text comes from the shared compact-text.sh (IC-001/IC-002), capped at 490 bytes.
 # Must never exit non-zero or block.
 
 set -euo pipefail
@@ -17,27 +15,25 @@ require_jq
 INPUT=$(cat)
 CWD=$(json_field "$INPUT" ".cwd")
 
-BRANCH=""
-SHA=""
-UNCOMMITTED=0
-
-if [[ -n "$CWD" ]] && is_git_worktree "$CWD"; then
-  BRANCH=$(git_branch_of "$CWD" || echo "")
-  SHA=$(git_short_sha_of "$CWD" || echo "")
-  UNCOMMITTED=$(git_uncommitted_count_of "$CWD" || echo "0")
-
-  # Last 2 commits (short SHA only for brevity) — keeps output under 500 chars
-  RECENT=$(run_with_timeout 1 -- git -C "$CWD" log --format="%h %s" -2 2>/dev/null \
-    | paste -sd ' | ' - || echo "")
-
-  # Build output and hard-cap at 490 chars to stay within Claude Code's limit
-  OUT=$(printf 'Include in compact summary:\n- git branch: %s sha: %s\n- recent commits: %s\n- uncommitted files: %s\n- cwd: %s\nPreserve: decisions made, files modified, open questions, planned next steps.' \
-    "${BRANCH:-unknown}" "${SHA:-unknown}" "${RECENT:-none}" "$UNCOMMITTED" "${CWD:-unknown}")
-  printf '%s' "${OUT:0:490}"
-else
-  OUT=$(printf 'Include in compact summary:\n- cwd: %s (not a git repository)\nPreserve: decisions made, files modified, open questions, planned next steps.' \
-    "${CWD:-unknown}")
-  printf '%s' "${OUT:0:490}"
+# Rule compact-instructions.instructions (DEC-023) decides whether this hook emits; it is
+# `include` for both roles, so the output below is unchanged. The role comes from the shared
+# identity.sh, read silently: this hook never wrote the role diagnostic and does not start now.
+POLICIES="$(dirname "$0")/../../.doflow/shared/hooks/policies"
+[[ -f "$POLICIES/emission-rules.sh" ]] || POLICIES="$(dirname "$0")/../../shared/hooks/policies"
+_DF_ROLE=worker
+if declare -F _doflow_role_resolve >/dev/null 2>&1; then _doflow_role_resolve 2>/dev/null; fi
+DF_ACTION=skip
+if [[ -f "$POLICIES/emission-rules.sh" ]]; then
+  # shellcheck source=/dev/null
+  . "$POLICIES/emission-rules.sh"
+  doflow_emission_rule compact-instructions.instructions "$_DF_ROLE"
 fi
+[[ "$DF_ACTION" == include ]] || exit 0
+
+[[ -f "$POLICIES/compact-text.sh" ]] || exit 0
+# shellcheck source=/dev/null
+source "$POLICIES/compact-text.sh"
+doflow_compact_text "$CWD"
+printf '%s' "$DF_COMPACT_TEXT"
 
 exit 0

package/core/harnesses/claude/hooks/session-end.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # session-end.sh — SessionEnd hook
 #
 # Runs when Claude Code closes a session. Responsibilities:
@@ -23,6 +24,27 @@ CWD=$(json_field "$INPUT" ".cwd")
 
 TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 
+# Start storage cleanup without changing the hook's output, status, or latency.
+start_storage_upkeep() {
+  (
+    SHARED_POLICY_LIB="$(dirname "$0")/../../.doflow/shared/hooks/policies/lib.sh"
+    if [[ ! -f "$SHARED_POLICY_LIB" ]]; then
+      SHARED_POLICY_LIB="$(dirname "$0")/../../shared/hooks/policies/lib.sh"
+    fi
+    if [[ -f "$SHARED_POLICY_LIB" ]]; then
+      source "$SHARED_POLICY_LIB"
+      storage_upkeep_async "$CWD"
+    fi
+  ) >/dev/null 2>&1 || true
+}
+
+# No config home (lib.sh leaves the state paths empty): no session store to write, but the
+# storage upkeep still starts (086 IC-010).
+if [[ -z "$STATE_DIR" ]]; then
+  start_storage_upkeep
+  exit 0
+fi
+
 # ── 1. Log session end ────────────────────────────────────────────────────────
 
 mkdir -p "$(dirname "$SESSIONS_LOG")"
@@ -59,16 +81,7 @@ if [[ -n "$SESSION_ID" ]]; then
   rm -rf "$SESSION_PATH" 2>/dev/null || true
 fi
 
-(
-  SHARED_POLICY_LIB="$(dirname "$0")/../../.doflow/shared/hooks/policies/lib.sh"
-  if [[ ! -f "$SHARED_POLICY_LIB" ]]; then
-    SHARED_POLICY_LIB="$(dirname "$0")/../../shared/hooks/policies/lib.sh"
-  fi
-  if [[ -f "$SHARED_POLICY_LIB" ]]; then
-    source "$SHARED_POLICY_LIB"
-    storage_upkeep_async "$CWD"
-  fi
-) >/dev/null 2>&1 || true
+start_storage_upkeep
 
 # ── 4. Trim sessions.log (lock-guarded) ───────────────────────────────────────
 

package/core/harnesses/claude/hooks/skill-config-audit.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # skill-config-audit.sh — ConfigChange(skills) hook (pure observability, no deny path)
 #
 # Logs skill-file mutations regardless of which tool made them (a subagent's Bash heredoc-to-file
@@ -26,6 +27,8 @@ SESSION_ID=$(json_field "$INPUT" ".session_id")
 
 # Guard: if we can't determine the session, nothing to do
 [[ -z "$SESSION_ID" ]] && exit 0
+# No config home (lib.sh leaves the state paths empty): no session store to write (086 IC-010).
+[[ -n "$SESSION_DIR" ]] || exit 0
 
 TIMESTAMP=$(date -u +%FT%TZ)
 SESSION_PATH=$(ensure_session_dir "$SESSION_ID")

package/core/harnesses/claude/settings/settings.json

@@ -116,6 +116,15 @@
       }
     ],
     "PostToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "~/.claude/hooks/post-shell-observe.sh PostToolUse"
+          }
+        ]
+      },
       {
         "matcher": "Edit",
         "hooks": [
@@ -176,6 +185,15 @@
       }
     ],
     "PostToolUseFailure": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "~/.claude/hooks/post-shell-observe.sh PostToolUseFailure"
+          }
+        ]
+      },
       {
         "matcher": ".*",
         "hooks": [

package/core/harnesses/claude/statusline/doflow-statusline.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # doflow-statusline — Claude Code status line fed by DoFlow's neutral state.
 #
 # Claude Code pipes one session-state JSON document to stdin; whatever this script prints becomes

package/core/harnesses/codex/agents/core-implementer.toml

@@ -4,4 +4,5 @@ developer_instructions = """
 Implement features and refactor code strictly according to approved designs and task checklists.
 Optimize algorithms, reduce complexity, and maintain polyglot code quality across the codebase.
 Ensure changes pass all existing tests and conform to language-specific standards.
+End the report with one line `Status: <status>`, where the status is one of `done`, `done-with-concerns`, `needs-context`, `blocked`.
 """