@khoavu882/doflow 2.0.0-beta.5 → 2.0.0

package/core/harnesses/shared/hooks/policies/summary-store.sh

@@ -0,0 +1,347 @@
+#!/usr/bin/env bash
+# summary-store.sh — Canonical Policy Library: scoped compact summaries, grants and the legacy
+# adopter (feature 078, IC-010, IC-011 store write, IC-012, IC-014; DEC-003, DEC-012, DEC-014).
+#
+# Layout under STATE_DIR (lib.sh: <config home>/doflow/session-env; empty with no config home, and
+# then there is no store: peeks find nothing, writes, claims and adopts return 1):
+#   summaries/<worktreeKey>/<run>/<lineage>/summary.md            one pending summary per scope
+#   summaries/<worktreeKey>/<run>/<lineage>/.summary.XXXXXX       write temporary
+#   summaries/<worktreeKey>/<run>/<lineage>/.claimed.<unitId>     claim temporary
+#   grants/<run>/<lineage>/<summaryId>.md                         grant addressed to a recipient
+#   grants/<run>/<lineage>/.claimed.<unitId>.<summaryId>          claim temporary
+# worktreeKey is cwd_hash of the identity worktree (DEC-027), so the caller must have sourced
+# lib.sh, which defines cwd_hash, STATE_DIR and PROJECTS_DIR.
+#
+# Sourcing this file defines functions only: no option, no variable, no trap, no output. bash 3.2
+# safe and safe under the caller's `set -euo pipefail`. Peek functions always return 0; write,
+# claim and adopt return 0 when they did their work and 1 otherwise, so call them from `if` or
+# with `||`. Results are DF_SUMMARY_* and DF_GRANT_* variables. A claimed file is left in place for
+# the caller to pass to emission.jq (--rawfile summary or grant) and to remove after rendering.
+
+# The id pattern of IC-007 (DEC-024) and the summary id pattern of IC-010.
+_doflow_ss_id_ok() { [[ ${1:-} =~ ^[A-Za-z0-9][A-Za-z0-9_-]{0,55}$ ]]; }
+_doflow_ss_summary_id_ok() { [[ ${1:-} =~ ^s-[0-9]{8}T[0-9]{6}Z-[A-Za-z0-9]{6}$ ]]; }
+# A unit id (L.<run>.<lineage>.<attempt> or a harness session id) is one path segment.
+_doflow_ss_unit_ok() { [[ ${1:-} =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$ ]]; }
+
+# _doflow_ss_root: _DF_SS_ROOT = lib.sh's STATE_DIR; returns 1 when it is empty (no config home).
+_doflow_ss_root() {
+  _DF_SS_ROOT="${STATE_DIR:-}"
+  [ -n "$_DF_SS_ROOT" ]
+}
+
+# _doflow_ss_key <dir>: _DF_SS_KEY = cwd_hash <dir>, remembered for the last directory asked.
+_doflow_ss_key() {
+  if [ -n "${_DF_SS_KEY_FOR:-}" ] && [ "$_DF_SS_KEY_FOR" = "$1" ] && [ -n "${_DF_SS_KEY:-}" ]; then
+    return 0
+  fi
+  _DF_SS_KEY=""
+  _DF_SS_KEY_FOR=""
+  [ -n "$1" ] || return 1
+  declare -F cwd_hash >/dev/null 2>&1 || return 1
+  _DF_SS_KEY=$(cwd_hash "$1" 2>/dev/null) || _DF_SS_KEY=""
+  [[ $_DF_SS_KEY =~ ^[0-9a-f]{16}$ ]] || { _DF_SS_KEY=""; return 1; }
+  _DF_SS_KEY_FOR=$1
+  return 0
+}
+
+# doflow_summary_scope <worktree> <run> <lineage>
+# DF_SUMMARY_SCOPE = summaries/<worktreeKey>/<run>/<lineage>, or empty (return 1) when run or
+# lineage is not an id, or the lineage is `solo`, which has no scope directory.
+doflow_summary_scope() {
+  DF_SUMMARY_SCOPE=""
+  _doflow_ss_id_ok "${2:-}" && _doflow_ss_id_ok "${3:-}" && [ "$3" != solo ] || return 1
+  _doflow_ss_key "${1:-}" || return 1
+  _doflow_ss_root || return 1
+  DF_SUMMARY_SCOPE="$_DF_SS_ROOT/summaries/$_DF_SS_KEY/$2/$3"
+  return 0
+}
+
+# _doflow_ss_head <file>: reads the frontmatter the way emission.jq's parse_record does (\r removed,
+# fields between the first two `---` lines, first match wins, leading spaces of a value dropped),
+# never more than 65536 bytes. Sets _DF_SS_SESSION, _DF_SS_SID, and for the grant header
+# _DF_SS_FROM (from_lineage), _DF_SS_AT (compacted_at) and _DF_SS_BRANCH (branch).
+_doflow_ss_head() {
+  local LC_ALL=C line="" left=65536 fences=0 key value seen=" "
+  _DF_SS_SESSION=""
+  _DF_SS_SID=""
+  _DF_SS_FROM=""
+  _DF_SS_AT=""
+  _DF_SS_BRANCH=""
+  {
+    while [ "$left" -gt 0 ] && [ "$fences" -lt 2 ]; do
+      IFS= read -r -n "$left" line || [ -n "$line" ] || break
+      left=$((left - ${#line} - 1))
+      line=${line//$'\r'/}
+      if [ "$line" = "---" ]; then
+        fences=$((fences + 1))
+      elif [ "$fences" = 1 ] && [[ $line == ?*:* ]]; then
+        key=${line%%:*}
+        value=${line#*:}
+        while [ "${value# }" != "$value" ]; do value=${value# }; done
+        # The first match of a key wins: a wanted key is recorded in $seen once it is read.
+        case "$key" in
+          session_id | summary_id | from_lineage | compacted_at | branch)
+            case "$seen" in *" $key "*) key="" ;; esac ;;
+          *) key="" ;;
+        esac
+        case "$key" in
+          session_id) _DF_SS_SESSION=$value ;;
+          summary_id) _DF_SS_SID=$value ;;
+          from_lineage) _DF_SS_FROM=$value ;;
+          compacted_at) _DF_SS_AT=$value ;;
+          branch) _DF_SS_BRANCH=$value ;;
+        esac
+        [ -z "$key" ] || seen="$seen$key "
+      fi
+      line=""
+    done
+  } 2>/dev/null <"$1" || true
+  return 0
+}
+
+# _doflow_ss_body_bytes <file>: _DF_SS_BODY = the UTF-8 byte length of the record body exactly as
+# parse_record yields it (\r removed, from the first non-empty line after the second `---`,
+# trailing newlines dropped). The caller has bounded the file's size.
+_doflow_ss_body_bytes() {
+  local LC_ALL=C line="" fences=0 started=0 gap=0
+  _DF_SS_BODY=0
+  {
+    while IFS= read -r line || [ -n "$line" ]; do
+      line=${line//$'\r'/}
+      if [ "$fences" -lt 2 ]; then
+        [ "$line" != "---" ] || fences=$((fences + 1))
+      elif [ -z "$line" ]; then
+        [ "$started" = 0 ] || gap=$((gap + 1))
+      elif [ "$started" = 0 ]; then
+        started=1
+        _DF_SS_BODY=${#line}
+      else
+        _DF_SS_BODY=$((_DF_SS_BODY + gap + 1 + ${#line}))
+        gap=0
+      fi
+      line=""
+    done
+  } 2>/dev/null <"$1" || true
+  return 0
+}
+
+# _doflow_ss_size <file>: _DF_SS_SIZE = the file's size in bytes, or empty.
+_doflow_ss_size() {
+  _DF_SS_SIZE=$(wc -c 2>/dev/null <"$1") || _DF_SS_SIZE=""
+  _DF_SS_SIZE=${_DF_SS_SIZE//[!0-9]/}
+  return 0
+}
+
+# doflow_summary_write <worktree> <run> <lineage> <attempt> <compacted_at> <session_id> <trigger>
+#                      <branch> <role> <body>
+# IC-011 step 3: mkdir -p the scope, mktemp .summary.XXXXXX in it, write the IC-010 record, mv it to
+# summary.md (a newer compaction replaces the pending one). compacted_at is UTC ISO-8601 to the
+# second (YYYY-MM-DDTHH:MM:SSZ). Sets DF_SUMMARY_ID and DF_SUMMARY_PATH. Returns 1 with nothing left
+# behind on an invalid argument, an empty body or a failed step.
+doflow_summary_write() {
+  local worktree="${1:-}" run="${2:-}" lineage="${3:-}" attempt="${4:-}" at="${5:-}"
+  local session="${6:-}" trigger="${7:-}" branch="${8:-}" role="${9:-}" body="${10:-}"
+  local tmp="" stamp suffix nl=$'\n' cr=$'\r'
+  DF_SUMMARY_ID=""
+  DF_SUMMARY_PATH=""
+  [ -n "$body" ] || return 1
+  [[ $at =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]] || return 1
+  [ -z "$attempt" ] || [[ $attempt =~ ^[1-9][0-9]{0,3}$ ]] || return 1
+  doflow_summary_scope "$worktree" "$run" "$lineage" || return 1
+  # A frontmatter value is one line: an embedded line break would forge a key.
+  session=${session//[$nl$cr]/ }; trigger=${trigger//[$nl$cr]/ }; branch=${branch//[$nl$cr]/ }
+  role=${role//[$nl$cr]/ }; worktree=${worktree//[$nl$cr]/ }
+  mkdir -p "$DF_SUMMARY_SCOPE" 2>/dev/null || return 1
+  tmp=$(mktemp "$DF_SUMMARY_SCOPE/.summary.XXXXXX" 2>/dev/null) || return 1
+  suffix=${tmp##*.summary.}
+  stamp=${at//[-:]/}
+  DF_SUMMARY_ID="s-$stamp-$suffix"
+  if ! _doflow_ss_summary_id_ok "$DF_SUMMARY_ID" \
+    || ! printf -- '---\ncompacted_at: %s\nsession_id: %s\ntrigger: %s\nbranch: %s\nrole: %s\nsummary_id: %s\nrun: %s\nlineage: %s\nattempt:%s\nworktree: %s\n---\n\n%s\n' \
+      "$at" "${session:-unknown}" "${trigger:-unknown}" "${branch:-unknown}" "${role:-main}" \
+      "$DF_SUMMARY_ID" "$run" "$lineage" "${attempt:+ $attempt}" "$worktree" "$body" >"$tmp" 2>/dev/null \
+    || ! mv -f "$tmp" "$DF_SUMMARY_SCOPE/summary.md" 2>/dev/null; then
+    rm -f "$tmp" 2>/dev/null || true
+    DF_SUMMARY_ID=""
+    return 1
+  fi
+  DF_SUMMARY_PATH="$DF_SUMMARY_SCOPE/summary.md"
+  return 0
+}
+
+# doflow_summary_peek <worktree> <run> <lineage> <session_id>
+# IC-012 owner steps 1 and 2, for the state vector: DF_SUMMARY_OWN is `none` (no regular,
+# non-symlink summary.md in the scope), `own-write` (its frontmatter session_id is this session's)
+# or `pending`; DF_SUMMARY_FILE is its path and DF_SUMMARY_SID its frontmatter summary_id (possibly
+# empty) when not `none`. Always returns 0.
+doflow_summary_peek() {
+  local f
+  DF_SUMMARY_OWN=none
+  DF_SUMMARY_FILE=""
+  DF_SUMMARY_SID=""
+  doflow_summary_scope "${1:-}" "${2:-}" "${3:-}" || return 0
+  f="$DF_SUMMARY_SCOPE/summary.md"
+  [ -f "$f" ] && [ ! -L "$f" ] || return 0
+  _doflow_ss_head "$f"
+  DF_SUMMARY_FILE=$f
+  DF_SUMMARY_SID=$_DF_SS_SID
+  if [ -n "${4:-}" ] && [ "$_DF_SS_SESSION" = "$4" ]; then DF_SUMMARY_OWN=own-write; else DF_SUMMARY_OWN=pending; fi
+  return 0
+}
+
+# doflow_summary_claim <worktree> <run> <lineage> <unit_id> <session_id>
+# IC-012 owner steps 1 to 3: peek, then rename summary.md to .claimed.<unitId>; a summary written
+# after the rename is a new summary.md and survives. The claimed copy is cut to its first 65536
+# bytes. Sets DF_SUMMARY_OWN (as peek, `none` after a lost rename), DF_SUMMARY_CLAIMED (the claimed
+# path, for --rawfile summary) and DF_SUMMARY_BYTES (its full size before the cut, for
+# plan.summaryBytes). Returns 0 when this caller claimed it; the caller removes the claimed file.
+doflow_summary_claim() {
+  local unit="${4:-}" claimed
+  DF_SUMMARY_CLAIMED=""
+  DF_SUMMARY_BYTES=0
+  doflow_summary_peek "${1:-}" "${2:-}" "${3:-}" "${5:-}"
+  [ "$DF_SUMMARY_OWN" = pending ] || return 1
+  _doflow_ss_unit_ok "$unit" || return 1
+  claimed="$DF_SUMMARY_SCOPE/.claimed.$unit"
+  if ! mv "$DF_SUMMARY_FILE" "$claimed" 2>/dev/null; then
+    DF_SUMMARY_OWN=none
+    return 1
+  fi
+  _doflow_ss_size "$claimed"
+  DF_SUMMARY_BYTES=${_DF_SS_SIZE:-0}
+  if [ "$DF_SUMMARY_BYTES" -gt 65536 ]; then
+    # The cut copy is private to this user, as the record it replaces (L1-11).
+    if ! { (umask 077; head -c 65536 "$claimed" >"$claimed.read") 2>/dev/null && mv -f "$claimed.read" "$claimed" 2>/dev/null; }; then
+      rm -f "$claimed" "$claimed.read" 2>/dev/null || true
+      return 1
+    fi
+  fi
+  DF_SUMMARY_CLAIMED=$claimed
+  return 0
+}
+
+# _doflow_ss_known <value>: _DF_SS_KNOWN = emission.jq's `known`: `]` removed, then empty when it
+# is "unknown".
+_doflow_ss_known() {
+  _DF_SS_KNOWN=${1//]/}
+  [ "$_DF_SS_KNOWN" != unknown ] || _DF_SS_KNOWN=""
+  return 0
+}
+
+# doflow_grant_peek <run> <lineage> <max_bytes>
+# IC-012 grant steps 1 and 2: the oldest grants/<run>/<lineage>/<summaryId>.md by name among regular,
+# non-symlink files whose name matches the summary id pattern. DF_GRANT is `none`, `fits` or `over`.
+# It fits exactly when emission.jq would render it whole: the UTF-8 bytes of render_grant's segment
+# "[Granted summary from lineage <from_lineage><header_tail>]\n<body>" are at most max_bytes, so a
+# body that fits under a header that does not is `over` and is never claimed. DF_GRANT_FILE,
+# DF_GRANT_ID and DF_GRANT_BYTES (the body's bytes, for the pointer; empty when the file is too large
+# to be worth reading) describe it. Always returns 0.
+doflow_grant_peek() {
+  local LC_ALL=C run="${1:-}" lineage="${2:-}" max="${3:-}" dir f name header tail=""
+  DF_GRANT=none
+  DF_GRANT_FILE=""
+  DF_GRANT_ID=""
+  DF_GRANT_BYTES=""
+  _doflow_ss_id_ok "$run" && _doflow_ss_id_ok "$lineage" || return 0
+  [[ $max =~ ^[1-9][0-9]{0,9}$ ]] || return 0
+  _doflow_ss_root || return 0
+  dir="$_DF_SS_ROOT/grants/$run/$lineage"
+  [ -d "$dir" ] && [ ! -L "$dir" ] || return 0
+  # Glob expansion is sorted (C collation here), and summary ids sort by time.
+  for f in "$dir"/s-*.md; do
+    name=${f##*/}
+    name=${name%.md}
+    _doflow_ss_summary_id_ok "$name" || continue
+    [ -f "$f" ] && [ ! -L "$f" ] || continue
+    DF_GRANT_FILE=$f
+    DF_GRANT_ID=$name
+    break
+  done
+  [ -n "$DF_GRANT_FILE" ] || return 0
+  _doflow_ss_size "$DF_GRANT_FILE"
+  # A frontmatter needs far less than 65536 bytes: anything larger than that plus the budget is over.
+  if [ -n "$_DF_SS_SIZE" ] && [ "$_DF_SS_SIZE" -le $((max + 65536)) ]; then
+    _doflow_ss_body_bytes "$DF_GRANT_FILE"
+    DF_GRANT_BYTES=$_DF_SS_BODY
+    # render_grant's header, from the same bounded head pass parse_record's fields come from.
+    _doflow_ss_head "$DF_GRANT_FILE"
+    _doflow_ss_known "$_DF_SS_AT"
+    [ -z "$_DF_SS_KNOWN" ] || tail=", compacted $_DF_SS_KNOWN"
+    _doflow_ss_known "$_DF_SS_BRANCH"
+    [ -z "$_DF_SS_KNOWN" ] || tail="$tail on branch $_DF_SS_KNOWN"
+    header="[Granted summary from lineage $_DF_SS_FROM$tail]"
+    if [ $((${#header} + 1 + DF_GRANT_BYTES)) -le "$max" ]; then DF_GRANT=fits; else DF_GRANT=over; fi
+  else
+    DF_GRANT=over
+  fi
+  return 0
+}
+
+# doflow_grant_claim <run> <lineage> <unit_id> <max_bytes>
+# IC-012 grant step 3: peek; when the oldest grant fits, rename it to
+# .claimed.<unitId>.<summaryId> and set DF_GRANT_CLAIMED (for --rawfile grant); the caller removes
+# it after rendering. An `over` grant stays in place (DF_GRANT_FILE renders the pointer). One grant
+# per event. Returns 0 only when this caller claimed a grant.
+doflow_grant_claim() {
+  local unit="${3:-}" claimed
+  DF_GRANT_CLAIMED=""
+  doflow_grant_peek "${1:-}" "${2:-}" "${4:-}"
+  [ "$DF_GRANT" = fits ] || return 1
+  _doflow_ss_unit_ok "$unit" || return 1
+  claimed="${DF_GRANT_FILE%/*}/.claimed.$unit.$DF_GRANT_ID"
+  if ! mv "$DF_GRANT_FILE" "$claimed" 2>/dev/null; then
+    DF_GRANT=none
+    return 1
+  fi
+  DF_GRANT_CLAIMED=$claimed
+  return 0
+}
+
+# doflow_summary_adopt_legacy <cwd> <worktree> [check]
+# IC-014, on action `adopt` only: the pre-078 project summary under projects/<cwd_hash cwd>/, a
+# regular file and not a symlink, moves once into summaries/<worktreeKey>/local/main/summary.md
+# with its frontmatter kept. When a summary is already pending there it is newer by construction
+# and the old file is removed instead. The legacy file is first renamed to <old>.adopting.<pid>, so
+# only one adopter proceeds (a lost rename means another adopter won and returns 0, DEC-043); then
+# a hard link that refuses to replace, and the .adopting file is unlinked last, so a summary written
+# meanwhile is never overwritten. Without hard links, `mv -n` is the fallback, taken only when the
+# target is absent and verified afterwards. Nothing writes the old path. Returns 0 when a legacy
+# file was adopted or retired, or another adopter took it. With a third argument `check` it only tests that the
+# legacy file exists and changes nothing (doflow_summary_legacy_present). This function is the one
+# place that names the legacy file (G38.4).
+doflow_summary_adopt_legacy() {
+  local cwd="${1:-}" worktree="${2:-}" projects old new taken
+  [ -n "$cwd" ] || return 1
+  [ -n "$worktree" ] || worktree=$cwd
+  _doflow_ss_key "$cwd" || return 1
+  _doflow_ss_root || return 1
+  projects="${PROJECTS_DIR:-$_DF_SS_ROOT/projects}"
+  old="$projects/$_DF_SS_KEY/last-compact-summary.md"
+  [ -f "$old" ] && [ ! -L "$old" ] || return 1
+  [ "${3:-}" != check ] || return 0
+  doflow_summary_scope "$worktree" local main || return 1
+  new="$DF_SUMMARY_SCOPE/summary.md"
+  mkdir -p "$DF_SUMMARY_SCOPE" 2>/dev/null || return 1
+  taken="$old.adopting.$$"
+  mv "$old" "$taken" 2>/dev/null || return 0
+  # A link that refuses to replace; it fails when a summary is pending, which retires the legacy one.
+  if ! ln "$taken" "$new" 2>/dev/null && [ ! -e "$new" ] && [ ! -L "$new" ]; then
+    # No hard links on this filesystem: a rename that refuses to replace, then a check that $new is
+    # the adopted file (mv -n leaves the source in place when the target appeared meanwhile).
+    # The old path is never written again, so a failed rename leaves the .adopting file in place.
+    mv -n "$taken" "$new" 2>/dev/null || true
+    if [ -e "$taken" ] && [ ! -e "$new" ] && [ ! -L "$new" ]; then return 1; fi
+  fi
+  rm -f "$taken" 2>/dev/null || true
+  return 0
+}
+
+# doflow_summary_legacy_present <cwd>
+# Returns 0 when the pre-078 project summary under projects/<cwd_hash cwd>/ exists as a regular file
+# and not a symlink, and 1 otherwise. Runs adopt_legacy's check mode in a subshell, so it sets no
+# variable, prints nothing and changes nothing.
+doflow_summary_legacy_present() {
+  [ -n "${1:-}" ] || return 1
+  (doflow_summary_adopt_legacy "$1" "" check)
+}

package/core/harnesses/shared/hooks/policies/user-prompt-submit.sh

@@ -1,18 +1,18 @@
 #!/usr/bin/env bash
-case $0 in */*) _DOFLOW_POLDIR=${0%/*} ;; *) _DOFLOW_POLDIR=. ;; esac
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
+_DOFLOW_SRC=${0//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_POLDIR=${_DOFLOW_SRC%/*} ;; *) _DOFLOW_POLDIR=. ;; esac
 # user-prompt-submit.sh — Canonical Policy Library: UserPromptSubmit hook
 #
 # 022-hooks-remaining-duplication: claude and codex's UserPromptSubmit policies share the same
-# context-gathering behavior. Gemini has no UserPromptSubmit-equivalent event in its native hook set.
+# context-gathering behavior.
 #
-# On the FIRST prompt of a session: injects lightweight git context into the harness's LLM
-# context. Claude and Codex receive one nested envelope,
+# Emission (078 IC-004): this policy reads the payload, records its decisions and runs the nudge
+# classifier; doflow_emit_prompt (emission.sh) decides and renders the response. On the first
+# prompt of a bootstrap unit that is git context, the scoped prior summary and the prior warning
+# in one nested envelope,
 #   {"hookSpecificOutput":{"hookEventName":"UserPromptSubmit","additionalContext":...}}
-# because Claude Code ignores a top-level additionalContext. Claude's object also carries
-# sessionTitle for window identification, unless the payload's session_title shows the user
-# already titled the session; Codex rejects unknown fields, so its object never does.
-#
-# On subsequent prompts: prints {} (clean, no token waste), unless the nudge below is earned.
+# with sessionTitle on every harness but Codex unless the payload already carries session_title
+# (DEC-030). Later prompts print {} unless the nudge below is earned.
 #
 # Once per session, the first prompt that reads as a plain code-change request (decided by
 # prompt-nudge.jq against the rules in the workflow registry's `promptNudge` key) also carries a
@@ -22,7 +22,7 @@ case $0 in */*) _DOFLOW_POLDIR=${0%/*} ;; *) _DOFLOW_POLDIR=. ;; esac
 # opt-out file, a subagent prompt, a /do-flow already in progress) resolves to silence; see the
 # once-per-session marker in lib.sh. The nudge starts no node or doflow-run process.
 #
-# Multi-session safe: uses session_id-scoped `injected` flag — no shared state.
+# Multi-session safe: the adapter's one-shot slot is per bootstrap unit (DEC-007).
 # Must complete in <100ms. Must NEVER output "decision: block".
 
 set -euo pipefail
@@ -46,6 +46,16 @@ if ! command -v jq >/dev/null 2>&1; then
   ( . "$POLICY_DIR/capture-failure.sh"; doflow_capture_failure user-prompt-submit dependency-missing:jq ) >/dev/null 2>&1 || true
 fi
 require_jq
+# The emission authority (feature 078): the scoped summary store, the compiled rule table and the
+# adapter. A missing file leaves its functions
+# undefined, which the adapter (or the check below) answers with the silent response and an
+# emission-deps capture.
+# shellcheck source=summary-store.sh
+[ ! -f "$_DOFLOW_POLDIR/summary-store.sh" ] || . "$_DOFLOW_POLDIR/summary-store.sh"
+# shellcheck source=emission-rules.sh
+[ ! -f "$_DOFLOW_POLDIR/emission-rules.sh" ] || . "$_DOFLOW_POLDIR/emission-rules.sh"
+# shellcheck source=emission.sh
+[ ! -f "$_DOFLOW_POLDIR/emission.sh" ] || . "$_DOFLOW_POLDIR/emission.sh"
 # One jq pass over the payload for every field this hook reads (each pass costs about 8 ms on a
 # 20 KB prompt, and the budget is 100 ms), NUL-separated: session_id, cwd and session_title, null
 # and false read as empty as json_field does, with any NUL inside a value dropped so no field can
@@ -77,7 +87,6 @@ fi
 [[ -z "$SESSION_ID" ]] && exit 0
 
 SESSION_PATH="$SESSION_DIR/$SESSION_ID"
-INJECTED_FLAG="$SESSION_PATH/injected"
 
 # ── Prompt nudge (IC-004 N1-N8) ───────────────────────────────────────────────
 
@@ -86,13 +95,22 @@ INJECTED_FLAG="$SESSION_PATH/injected"
 # here can change the exit status or the first-prompt output. The prompt only ever travels to jq
 # on stdin, with stderr discarded, and is never copied out of INPUT.
 nudge_message() {
-  local root policy_dir here registry decision message
+  local root policy_dir here registry decision message role
   [[ "${DOFLOW_AGENT:-}" == "claude" || "${DOFLOW_AGENT:-}" == "codex" ]] || return 0   # N1
-  [[ "$(doflow_session_role 2>/dev/null || echo main)" != "worker" ]] || return 0      # a worker is never nudged
+  # The role gate is the rule table's: a role whose prompt.nudge action is skip (a worker) is never
+  # nudged, and returning here keeps the classifier from running or marking it (L2-15).
+  role=$(doflow_session_role 2>/dev/null) || role=main
+  DF_ACTION=skip
+  declare -F doflow_emission_rule >/dev/null 2>&1 && doflow_emission_rule prompt.nudge "$role:nudge" 2>/dev/null || DF_ACTION=skip
+  [[ "$DF_ACTION" != "skip" ]] || return 0
   nudge_safe_id "$SESSION_ID" || return 0                                               # N2
   root=$(nudge_repo_root "$CWD") || return 0
   [[ "$(nudge_setting "$root")" == "on" ]] || return 0                                  # N3
   [[ ! -e "$STATE_DIR/nudge/$SESSION_ID" ]] || return 0                                 # N4 (IC-008's path, no process)
+  # The marker is written after the render (DEC-041), so a folder it cannot be written to would
+  # nudge every prompt: an unwritable marker folder (or state folder, before it exists) is silent.
+  if [[ -e "$STATE_DIR/nudge" ]]; then [[ -d "$STATE_DIR/nudge" && -w "$STATE_DIR/nudge" ]] || return 0
+  elif [[ -e "$STATE_DIR" ]]; then [[ -w "$STATE_DIR" ]] || return 0; fi
   # N5: a subagent prompt carries agent_id or agent_type (read with the other fields above).
   [[ -z "$SUBAGENT" ]] || return 0
   # N6: the policy script's physical directory, found with built-ins (a subshell costs about 4 ms).
@@ -112,157 +130,44 @@ nudge_message() {
     nudge_mark "$SESSION_ID" suppressed || true
     return 0
   fi
-  # N8: the message is read and checked before the marker is created, so a registry without a
-  # usable message leaves no marker; a failed create (unwritable folder, a racing prompt) is silent.
+  # N8: a registry without a usable message leaves no marker. The `nudged` marker is written by
+  # doflow_emit_prompt once the nudge rendered, so a nudge the budget dropped stays unmarked (DEC-041).
   message=$(jq -r '.promptNudge.message | strings' "$registry" 2>/dev/null) || return 0
   [[ -n "$message" ]] || return 0
-  nudge_mark "$SESSION_ID" nudged || return 0
   printf '%s' "$message"
   return 0
 }
 
-# One nested envelope for both harnesses (IC-002): $1 is the additionalContext; $2 the session
-# title, omitted when empty.
-emit_envelope() {
-  jq -n --arg ctx "$1" --arg title "$2" \
-    '{"hookSpecificOutput": ({"hookEventName": "UserPromptSubmit", "additionalContext": $ctx}
-      + (if $title != "" then {"sessionTitle": $title} else {} end))}'
+# ── Emission: every prompt, handed to the authority (IC-004) ──────────────────
+# The classifier runs first, where its gates allow, and returns the message unmarked.
+# doflow_emit_prompt decides everything else (the bootstrap slot, git context, the
+# scoped summary, the warning, a grant, the nudge's place in the budget), prints the response and
+# marks the session nudged and records `advisory prompt-nudge` itself when the nudge was rendered.
+
+# Rider R1 (091): the emission metadata for the bridge's hook line, as one record on the decision
+# fd after the decision records: the reason, the byte count and the digest, never a response byte. The
+# bridge validates each value before it writes it. Telemetry off or no fd writes nothing.
+doflow_emit_record() {
+  local fd="${DOFLOW_DECISION_FD:-}" digest=null
+  [ "${DOFLOW_TELEMETRY:-}" != off ] && [ -n "${DF_EMIT_REASON:-}" ] || return 0
+  [ -z "${DF_EMIT_DIGEST:-}" ] || digest="\"$DF_EMIT_DIGEST\""
+  case "$fd" in
+    3|4|5|6|7|8|9)
+      { printf '\036{"v":1,"emit":{"reason":"%s","bytes":%s,"digest":%s}}\n' "$DF_EMIT_REASON" "${DF_EMIT_BYTES:-0}" "$digest" >&"$fd"; } 2>/dev/null || :
+      ;;
+  esac
+  return 0
 }
 
-# ── Subsequent prompts: no injection, unless the nudge is earned ──────────────
-
-if [[ -f "$INJECTED_FLAG" ]]; then
-  NUDGE=$(nudge_message 2>/dev/null) || NUDGE=""
-  if [[ -n "$NUDGE" ]]; then
-    doflow_decide advisory prompt-nudge
-    emit_envelope "$NUDGE" ""
-  else
-    echo "{}"
-  fi
-  exit 0
-fi
-
-# ── Worker session: no bootstrap, nothing claimed ─────────────────────────────
-# A worker never receives the git context, the prior compact summary or the prior warning, and
-# leaves both files for the main session. It is marked injected so later prompts stay silent.
-
-if [[ "$(doflow_session_role || echo main)" == "worker" ]]; then
-  ensure_session_dir "$SESSION_ID" >/dev/null || true
-  touch "$INJECTED_FLAG" 2>/dev/null || true
-  echo "{}"
-  exit 0
-fi
-
-# ── First prompt: build context ───────────────────────────────────────────────
-
-GIT_CONTEXT_FILE="$SESSION_PATH/git-context.json"
-
-# Fallback if session-start.sh didn't run or failed
-if [[ ! -f "$GIT_CONTEXT_FILE" ]]; then
-  ensure_session_dir "$SESSION_ID" >/dev/null
-  touch "$INJECTED_FLAG"
-  CONTEXT="Git context unavailable for this session."
-  SESSION_TITLE=""
-else
-  GIT_JSON=$(cat "$GIT_CONTEXT_FILE")
-  IS_GIT=$(json_field "$GIT_JSON" ".is_git_repo")
-
-  if [[ "$IS_GIT" == "true" ]]; then
-    BRANCH=$(json_field "$GIT_JSON" ".branch")
-    SHA=$(json_field "$GIT_JSON" ".sha")
-    UNCOMMITTED=$(json_field "$GIT_JSON" ".uncommitted_count")
-    STASH=$(json_field "$GIT_JSON" ".stash_count")
-
-    # Build commit list as a single line (· separated)
-    COMMITS=$(echo "$GIT_JSON" | jq -r '.commits[]? // empty' | head -5 | paste -sd ' · ' -)
-
-    CONTEXT="Git context — branch: ${BRANCH:-unknown} | ${SHA:-unknown}"$'\n'
-    CONTEXT+="Last commits: ${COMMITS:-none}"$'\n'
-    CONTEXT+="Uncommitted files: ${UNCOMMITTED:-0}"
-    [[ "${STASH:-0}" -gt 0 ]] && CONTEXT+=" | Stashed: ${STASH}"
-
-    SESSION_TITLE="${BRANCH:-unknown} — ${SHA:-unknown}"
-  else
-    CONTEXT="Not a git repository."
-    SESSION_TITLE="no-git"
-  fi
-
-  # ── Prior compact summary: injected once into the next session, then consumed ─
-  # post-compact.sh writes this file for the session that follows a compaction. The session
-  # that compacted already holds the summary, so it skips the file and leaves it in place.
-  # Any other session claims the file with an atomic rename first (a summary written meanwhile
-  # is a new file and survives), reads a bounded prefix of the claimed copy and removes it. No
-  # step here may fail the hook: on any error the summary is simply not injected.
-
-  PROJECT_DIR=$(ensure_project_dir "$CWD")
-  COMPACT_FILE="$PROJECT_DIR/last-compact-summary.md"
-  COMPACT_CLAIM="$PROJECT_DIR/.last-compact-summary.claimed.$SESSION_ID"
-  COMPACT_CAP=4000
-  COMPACT_READ=65536   # bytes: enough for the cap even at four bytes per character
-  compact_field() {
-    printf '%s\n' "$COMPACT_HEAD" | awk -v k="$1:" '/^---$/{n++; if (n == 2) exit; next} n == 1 && index($0, k) == 1 {sub(/^[^:]*:[ ]*/, ""); print; exit}' || true
-  }
-  # A native subagent payload (agent_id or agent_type) never claims the summary or the warning.
-  if [[ -z "$SUBAGENT" && -f "$COMPACT_FILE" && ! -L "$COMPACT_FILE" ]]; then
-    COMPACT_HEAD=$(head -c "$COMPACT_READ" "$COMPACT_FILE" 2>/dev/null | tr -d '\r') || COMPACT_HEAD=''
-    if [[ "$(compact_field session_id)" != "$SESSION_ID" ]] && mv "$COMPACT_FILE" "$COMPACT_CLAIM" 2>/dev/null; then
-      COMPACT_SIZE=$(wc -c < "$COMPACT_CLAIM" 2>/dev/null) || COMPACT_SIZE=0
-      COMPACT_HEAD=$(head -c "$COMPACT_READ" "$COMPACT_CLAIM" 2>/dev/null | tr -d '\r') || COMPACT_HEAD=''
-      rm -f "$COMPACT_CLAIM"
-      # Strip the YAML frontmatter (between the first two `---` lines) and the blank line after it;
-      # keep the summary body only.
-      COMPACT_BODY=$(printf '%s\n' "$COMPACT_HEAD" | awk '/^---$/ && n < 2 {n++; next} n >= 2 && (started || $0 != "") {started = 1; print}') || COMPACT_BODY=''
-      COMPACT_LEN=''
-      if [[ -n "$COMPACT_BODY" ]]; then
-        # --rawfile, not stdin or --arg: jq 1.7's raw stdin reader miscounts multibyte text across
-        # buffer boundaries, and --arg would hit the per-argument size limit on a large summary.
-        COMPACT_LEN=$(jq -n --rawfile b <(printf '%s' "$COMPACT_BODY") '$b | length' 2>/dev/null) || COMPACT_BODY=''
-      fi
-      if [[ -n "$COMPACT_BODY" && "$COMPACT_LEN" -gt "$COMPACT_CAP" ]]; then
-        COMPACT_BODY=$(jq -nr --rawfile b <(printf '%s' "$COMPACT_BODY") "\$b[0:$COMPACT_CAP]" 2>/dev/null) || COMPACT_BODY=''
-        COMPACT_MORE=''
-        [[ "$COMPACT_SIZE" -gt "$COMPACT_READ" ]] && COMPACT_MORE='at least '
-        [[ -n "$COMPACT_BODY" ]] && COMPACT_BODY+=$'\n'"[summary truncated: first ${COMPACT_CAP} of ${COMPACT_MORE}${COMPACT_LEN} characters]"
-      fi
-      if [[ -n "$COMPACT_BODY" ]]; then
-        COMPACT_AT=$(compact_field compacted_at); COMPACT_AT=${COMPACT_AT//]/}
-        COMPACT_BRANCH=$(compact_field branch); COMPACT_BRANCH=${COMPACT_BRANCH//]/}
-        COMPACT_HEADER="Prior session summary"
-        [[ -n "$COMPACT_AT" && "$COMPACT_AT" != "unknown" ]] && COMPACT_HEADER+=", compacted ${COMPACT_AT}"
-        [[ -n "$COMPACT_BRANCH" && "$COMPACT_BRANCH" != "unknown" ]] && COMPACT_HEADER+=" on branch ${COMPACT_BRANCH}"
-        CONTEXT+=$'\n\n'"[${COMPACT_HEADER}]"$'\n'"$COMPACT_BODY"
-      fi
-    fi
-  fi
-
-  # Check for uncommitted warning from prior session (one-time: delete after read —
-  # nothing else in the framework reassigns this cleanup, so it happens here)
-  if [[ -z "$SUBAGENT" && -f "$PROJECT_DIR/uncommitted-warning.txt" ]]; then
-    WARNING=$(cat "$PROJECT_DIR/uncommitted-warning.txt")
-    CONTEXT+=$'\n'"[Prior session warning: ${WARNING}]"
-    rm -f "$PROJECT_DIR/uncommitted-warning.txt"
-  fi
-fi
-
-# ── Write injected flag ────────────────────────────────────────────────────────
-
-touch "$INJECTED_FLAG"
-
-# ── Output JSON ───────────────────────────────────────────────────────────────
-
-# The nudge, when earned, follows the context after a blank line.
 NUDGE=$(nudge_message 2>/dev/null) || NUDGE=""
-if [[ -n "$NUDGE" ]]; then
-  doflow_decide advisory prompt-nudge
-  CONTEXT+=$'\n\n'"$NUDGE"
-fi
-
-# sessionTitle: not on Codex, only when a title was built, and only when the user has not already
-# titled the session.
-TITLE_ARG=""
-if [[ "${DOFLOW_AGENT:-}" != "codex" && -n "${SESSION_TITLE:-}" && -z "$PAYLOAD_TITLE" ]]; then
-  TITLE_ARG="$SESSION_TITLE"
+if ! declare -F doflow_emit_prompt >/dev/null 2>&1; then
+  ( . "$POLICY_DIR/capture-failure.sh"; doflow_capture_failure user-prompt-submit emission-deps ) >/dev/null 2>&1 || true
+  printf '{}\n'
+  DF_EMIT_REASON=fault:deps DF_EMIT_BYTES=0 DF_EMIT_DIGEST=""
+  doflow_emit_record
+  exit 0
 fi
-emit_envelope "$CONTEXT" "$TITLE_ARG"
+doflow_emit_prompt "$SESSION_ID" "$CWD" "$PAYLOAD_TITLE" "$SUBAGENT" "$NUDGE"
+doflow_emit_record
 
 exit 0