@khoavu882/doflow 2.0.0 → 2.0.1

package/core/harnesses/shared/hooks/policies/pre-implementation-gate.sh

@@ -2,11 +2,11 @@
 case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 _DOFLOW_SRC=${0//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_POLDIR=${_DOFLOW_SRC%/*} ;; *) _DOFLOW_POLDIR=. ;; esac
 # pre-implementation-gate.sh — Canonical Policy Library: PreToolUse(Edit|Write|...)
-# backstop for the doflow implement gate. The HARD half of the one enforced
-# gate (the other half is the prompt-level do-prereqs.sh inside
-# /do-execute-plan — defense in depth).
+# advisory for the doflow implement gate (the other half is the prompt-level
+# do-prereqs.sh inside /do-execute-plan). It never denies: each finding below is
+# a doflow_decide advisory code plus one stderr line.
 #
-# Denies a SOURCE-file edit in two cases:
+# Advises on a SOURCE-file edit in two cases:
 #   1. a feature has been STARTED (its feature_dir exists, in this checkout or,
 #      from a linked worktree, in the main checkout) but requirement.md,
 #      design.md, or plan.md is still missing: "don't write code before you've
@@ -23,7 +23,7 @@ _DOFLOW_SRC=${0//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_POLDIR=${_DOFLOW_SRC%/
 #   - edit target is under agent-docs/ -> allow (editing the artifacts themselves)
 #   - edit target outside the repo     -> allow
 # It reads files with jq and lists checkouts with one git call; it never runs
-# the DoFlow runtime. Missing or malformed v1 input is denied as out of step; other faults follow IC-011.
+# the DoFlow runtime. Missing or malformed v1 input is allowed with an out-of-step line; other faults follow IC-011.
 #
 # Canonical Policy Script Contract (design.md §4):
 #   env    DOFLOW_PROJECT_DIR (repo root, if the front door sets it),
@@ -33,8 +33,8 @@ _DOFLOW_SRC=${0//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_POLDIR=${_DOFLOW_SRC%/
 #          replaces — kept so an unmodified front door still resolves its own
 #          harness's do-paths.sh resolver)
 #   stdin  a native payload encoded as envelope v1 by the lifecycle bridge.
-#   exit   exit 2 + doflow_decide deny = deny; other faults per IC-011. A front
-#          door translates this into its native response shape.
+#   exit   always 0: every finding is a doflow_decide advisory code plus one stderr
+#          line, which the lifecycle bridge renders per harness. This policy never denies.
 #
 # Reconciliation note (022-normalize-hooks, Phase A): claude/codex/kiro
 # each shipped a separately-adapted copy of this gate; antigravity's copy
@@ -65,8 +65,7 @@ else
   else
     printf '[pre-implementation-gate] DoFlow hooks out of step; run: doflow update\n' >&2
   fi
-  doflow_decide deny contract-missing
-  exit 2
+  exit 0
 fi
 doflow_decision_init pre-implementation-gate 1
 command -v jq >/dev/null 2>&1 || {
@@ -113,8 +112,8 @@ else
     ( . "$_DOFLOW_POLDIR/capture-failure.sh"; doflow_capture_failure pre-implementation-gate envelope-missing ) >/dev/null 2>&1 || true
   fi
   if [[ "${DOFLOW_AGENT:-}" =~ ^[a-z]+$ ]]; then printf '[pre-implementation-gate] DoFlow hooks out of step; run: doflow update -t %s\n' "$DOFLOW_AGENT" >&2; else printf '[pre-implementation-gate] DoFlow hooks out of step; run: doflow update\n' >&2; fi
-  doflow_decide deny "${DF_ENV_CODE:-envelope-missing}"
-  exit 2
+  doflow_decide unsupported "${DF_ENV_CODE:-envelope-missing}"
+  exit 0
 fi
 
 # ── Resolve repo root ───────────────────────────────────────────────────────
@@ -377,8 +376,8 @@ find_state() {
         copy="$repo_root${HIT#"$MAIN"}"
         if [ -f "$copy" ] && ! same_bytes "$copy" "$HIT"; then
           printf "doflow gate readiness-before-implementation: task '%s' has a readiness record in this worktree (%s) that differs from the main checkout's (%s). Next: keep one of the two and remove the other, then re-run. Nothing was changed.\n" "$task_id" "$copy" "$HIT" >&2
-          doflow_decide deny readiness-store-conflict
-          exit 2
+          doflow_decide advisory readiness-store-conflict
+          exit 0
         fi
         FOUND="$HIT"
         return 0
@@ -453,8 +452,8 @@ PLANNED=false
 # plan.md all exist. Classes that cannot be a feature skip this check.
 if [ "$exempt" = false ] && [ -n "$FEATURE_ROOT" ] && [ "$PLANNED" = false ]; then
   echo "[pre-implementation-gate] doflow gate: feature $feature_dir is missing requirement.md, design.md, or plan.md — run /do-brainstorm, /do-design, then /do-plan before editing source. (Edits under agent-docs/ are always allowed; skip the flow by removing the feature dir.)" >&2
-  doflow_decide deny missing-artifacts
-  exit 2
+  doflow_decide advisory missing-artifacts
+  exit 0
 fi
 
 # ── Readiness ────────────────────────────────────────────────────────────────
@@ -547,20 +546,20 @@ gate="doflow gate readiness-before-implementation: task '$task_id'"
 rest="Next: $next, then gather what it lists until it reports READY. Nothing was changed."
 if [ -z "$FOUND" ]; then
   printf "%s has no readiness record for the '%s' template. %s\n" "$gate" "$STAGE_TEMPLATE" "$rest" >&2
-  doflow_decide deny readiness-missing
-  exit 2
+  doflow_decide advisory readiness-missing
+  exit 0
 fi
 if [ "$record_state" != READY ]; then
   printf "%s was last evaluated %s at %s against the '%s' template, not READY. %s\n" \
     "$gate" "$record_state" "$record_at" "$STAGE_TEMPLATE" "$rest" >&2
-  doflow_decide deny readiness-not-ready
-  exit 2
+  doflow_decide advisory readiness-not-ready
+  exit 0
 fi
 if [ "$record_class" != "$STAGE_TEMPLATE" ]; then
   printf "%s has a READY record for the '%s' template, and this stage needs '%s'. %s\n" \
     "$gate" "$record_class" "$STAGE_TEMPLATE" "$rest" >&2
-  doflow_decide deny readiness-wrong-template
-  exit 2
+  doflow_decide advisory readiness-wrong-template
+  exit 0
 fi
 
 exit 0

package/core/harnesses/shared/hooks/policies/stop-check.sh

@@ -13,10 +13,11 @@ _DOFLOW_SRC=${0//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_POLDIR=${_DOFLOW_SRC%/
 #   2. Stub detection: takes the payload's last_assistant_message, or else the
 #      last assistant message in the JSONL transcript (Claude Code, Codex and
 #      flat {role,content} shapes), then checks for unfinished-work markers.
-#      Exits non-zero if stubs are found (blocks the session from stopping).
+#      Records an advisory and prints one warning line when stubs are found; it never
+#      blocks the session from stopping.
 #      Runs independently of (1) — it needs only the payload field or a
 #      transcript path, not a session_id, so it still fires for a harness that
-#      has no edited-files queue. A given message blocks once: harnesses without
+#      has no edited-files queue. A given message is warned about once: harnesses without
 #      stop_hook_active (Antigravity, Kiro) have no other loop guard.
 #   3. Process-leak scan: DoFlow's own identifiers (FR-###, agent-docs/, chain
 #      artifact names) reaching files that ship. Warns, never blocks.
@@ -27,7 +28,7 @@ _DOFLOW_SRC=${0//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_POLDIR=${_DOFLOW_SRC%/
 # Canonical Policy Script Contract (design.md §4):
 #   env    DOFLOW_PROJECT_DIR, DOFLOW_AGENT (both optional here)
 #   stdin  envelope v1 from a native front door via the shared lifecycle bridge.
-#   exit   exit 2 + doflow_decide deny = deny; other faults per IC-011.
+#   exit   always 0; a finding is a doflow_decide advisory code plus one stderr line.
 #
 # Depends on lib.sh (require_jq, json_field, ensure_session_dir,
 # run_with_timeout) being discoverable next to this script when it runs — see
@@ -277,7 +278,7 @@ BEGIN {
 STUB_PATTERN='(#|//)[[:space:]]*(TODO|FIXME)([^[:alnum:]_]|$)|raise NotImplementedError|throw new Error\(.*[Nn]ot [Ii]mplemented|(#|//)[[:space:]]*stub([^[:alnum:]_]|$)'
 
 if grep -qiE -- "$STUB_PATTERN" <<<"$STUB_TEXT" 2>/dev/null; then
-  # Block a given message once: the continuation that follows is judged on new text, and a
+  # Warn about a given message once: the continuation that follows is judged on new text, and a
   # harness with no stop_hook_active would otherwise be blocked on this one forever. State is
   # per session, or per transcript when the harness sends no session_id; any failure here
   # leaves the block in force only for this call. With no config home there is no state store, so
@@ -295,8 +296,8 @@ if grep -qiE -- "$STUB_PATTERN" <<<"$STUB_TEXT" 2>/dev/null; then
   fi
   [ -n "$MESSAGE_SUM" ] && [ -n "$GUARD_FILE" ] && { printf '%s\n' "$MESSAGE_SUM" > "$GUARD_FILE"; } 2>/dev/null || true
   echo "[stop-check] The last response contains an unfinished-work marker (TODO/FIXME/stub comment or a not-implemented raise/throw)." >&2
-  doflow_decide deny unfinished-work
-  exit 2
+  doflow_decide advisory unfinished-work
+  exit 0
 fi
 
 exit 0

package/core/harnesses/shared/hooks/policies/subagent-audit.sh

@@ -11,7 +11,7 @@ _DOFLOW_SRC=${0//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_POLDIR=${_DOFLOW_SRC%/
 # Today there is zero record of which of the installed agents/ specialists actually run, how often, or
 # whether one is invoked outside its intended use (e.g. everything routing through general-purpose
 # instead of do-code-review/security-engineer) — this hook is the evidence base a future policy
-# hook (e.g. an agent-aware pre-bash-guard extension) would need before writing rules on a guess.
+# hook (e.g. an agent-aware tool guard) would need before writing rules on a guess.
 # Per agent-docs/research/hook-governance-agent-tool-mcp-skill.md §3.1: pure logging, no deny path,
 # safe to ship immediately, and the recommended first step before any tighter agent governance.
 #

package/core/harnesses/shared/hooks/stream-hook-runner.js

@@ -21,11 +21,10 @@ const antigravityAdapter = require('./adapters/antigravity');
 
 // Tool-name classification for PreToolUse, generalized to the union every Phase A canonical
 // script's own case statement already recognizes (session-context.sh/pre-implementation-gate.sh/
-// mcp-tool-guard.sh/pre-bash-guard.sh headers) rather than only the two harnesses this runner
+// mcp-tool-guard.sh headers) rather than only the two harnesses this runner
 // drives — kept in sync with those scripts, not redefined independently of them.
 const MCP_TOOL_PATTERN = /^mcp_/i;
 const EDIT_TOOL_PATTERN = /^(replace_file_content|write_to_file|multi_replace_file_content|edit_file|write_file|create_file|replace_file|replace|Edit|Write|MultiEdit|apply_patch)$/i;
-const COMMAND_TOOL_PATTERN = /^(run_command|run_shell_command|Bash|bash)$/i;
 
 // ── Failure capture (feature 046: IC-010, IC-011, IC-014, IC-015, IC-018) ─────────────────────────
 //
@@ -363,21 +362,22 @@ function resolveProjectRoot(workspacePaths) {
  */
 function delegateToPolicy(projectRoot, agent, event, policyId, nativeRaw) {
   const bridgeSh = path.join(__dirname, 'bridge', 'bridge.sh');
+  const profile = process.env.DOFLOW_FAULT_PROFILE || 'compat-1';
+  const effectiveProfile = profile === 'compat-1' || profile === 'strict-1' ? profile : 'compat-1';
+  if (profile !== effectiveProfile) captureHookFailure({ command: policyId, kind: 'fault-profile-unknown' });
+  const blockingPolicy = ['pre-implementation-gate', 'mcp-tool-guard', 'stop-check'].includes(policyId);
+  const faultEffect = effectiveProfile === 'strict-1' && blockingPolicy ? 'block' : 'proceed';
   if (!fs.existsSync(bridgeSh)) {
     captureHookFailure({ command: policyId, kind: 'bridge-missing' });
-    if (policyId === 'stop-check') {
-      return { v: 1, harness: agent, event, policy: policyId, policyVersion: 0, outcome: 'unsupported', code: 'bridge-missing', effect: 'proceed' };
+    // D1: a missing bridge allows with a recorded warning; only strict-1, a person's opt-in, blocks a tool call.
+    if (policyId === 'stop-check' || faultEffect === 'proceed') {
+      return { v: 1, harness: agent, event, policy: policyId, policyVersion: 0, outcome: 'unsupported', code: 'bridge-missing', faultProfile: effectiveProfile, effect: 'proceed' };
     }
     return {
       v: 1, harness: agent, event, policy: policyId, policyVersion: 0,
-      outcome: 'deny', code: 'bridge-missing', reason: '[doflow] shared hooks lack the bridge; run: doflow update -t antigravity', effect: 'block',
+      outcome: 'deny', code: 'bridge-missing', reason: '[doflow] shared hooks lack the bridge; run: doflow update -t antigravity', faultProfile: effectiveProfile, effect: 'block',
     };
   }
-  const profile = process.env.DOFLOW_FAULT_PROFILE || 'compat-1';
-  const effectiveProfile = profile === 'compat-1' || profile === 'strict-1' ? profile : 'compat-1';
-  if (profile !== effectiveProfile) captureHookFailure({ command: policyId, kind: 'fault-profile-unknown' });
-  const blockingPolicy = ['pre-implementation-gate', 'pre-bash-guard', 'mcp-tool-guard', 'stop-check'].includes(policyId);
-  const faultEffect = effectiveProfile === 'strict-1' && blockingPolicy ? 'block' : 'proceed';
   const faultDecision = (code) => ({
     v: 1, harness: agent, event, policy: policyId, policyVersion: 0,
     outcome: 'error', code, reason: code, faultProfile: effectiveProfile, effect: faultEffect,
@@ -415,7 +415,6 @@ function delegateToPolicy(projectRoot, agent, event, policyId, nativeRaw) {
 function classifyPreToolUsePolicy(toolName) {
   if (MCP_TOOL_PATTERN.test(toolName)) return 'mcp-tool-guard.sh';
   if (EDIT_TOOL_PATTERN.test(toolName)) return 'pre-implementation-gate.sh';
-  if (COMMAND_TOOL_PATTERN.test(toolName)) return 'pre-bash-guard.sh';
   return null;
 }
 
@@ -431,7 +430,7 @@ function evaluatePreToolUsePolicy(payload, nativeRaw, projectRoot, agent) {
  * decision. Every event this runner drives maps to at most one Phase A script:
  *   SessionStart -> session-context.sh (side-effect only; the script's own contract says it never
  *                   denies, so its exit code is not propagated as a decision)
- *   PreToolUse   -> mcp-tool-guard.sh | pre-implementation-gate.sh | pre-bash-guard.sh, chosen by
+ *   PreToolUse   -> mcp-tool-guard.sh | pre-implementation-gate.sh, chosen by
  *                   the tool-name classification above
  *   Stop         -> stop-check.sh
  *   PostToolUse, PreInvocation -> no Phase A policy owns these yet (post-edit-lint.sh's collector

package/core/registry/contracts.json

@@ -179,7 +179,7 @@
     {
       "harness": "kiro",
       "completeness": "lower-bound",
-      "note": "hookEvents lists only the events DoFlow actually installs a doflow.json entry for (session-context on SessionStart, pre-implementation-gate, pre-bash-guard and mcp-tool-guard all on PreToolUse \u2014 hence PreToolUse appearing once, not twice \u2014 and stop-check on Stop), not the full set of trigger names Kiro's docs confirm (SessionStart, Stop, PreToolUse, PostToolUse, UserPromptSubmit, PreTaskExec, PostTaskExec, PostFileSave, PostFileCreate, PostFileDelete, plus SessionEnd on CLI V3 only \u2014 see kiro.dev/docs/hooks/types/). Widen this list only when DoFlow wires a hook to one of the unused confirmed events, alongside an added evidence URL.",
+      "note": "hookEvents lists only the events DoFlow actually installs a doflow.json entry for (session-context on SessionStart, pre-implementation-gate and mcp-tool-guard both on PreToolUse \u2014 hence PreToolUse appearing once, not twice \u2014 and stop-check on Stop), not the full set of trigger names Kiro's docs confirm (SessionStart, Stop, PreToolUse, PostToolUse, UserPromptSubmit, PreTaskExec, PostTaskExec, PostFileSave, PostFileCreate, PostFileDelete, plus SessionEnd on CLI V3 only \u2014 see kiro.dev/docs/hooks/types/). Widen this list only when DoFlow wires a hook to one of the unused confirmed events, alongside an added evidence URL.",
       "skillFields": ["name", "description", "license", "compatibility", "metadata"],
       "skillFieldsSource": "https://kiro.dev/docs/skills/",
       "skillFieldsVerifiedOn": "2026-10-27",

package/core/registry/contribution-points.json

@@ -24,9 +24,12 @@
       "referencedBy": ["workers.billing"], "slice": "D", "template": "package-templates/worker" },
     { "id": "capability-provider", "versions": [1], "tier": "executable", "status": "open", "entry": "file",
       "validator": "capability-provider-v1", "combine": "add-only", "consumer": "src/runtime/capability-router.js",
-      "referencedBy": [], "slice": "D", "template": "package-templates/capability-provider" }
+      "referencedBy": [], "slice": "D", "template": "package-templates/capability-provider" },
+    { "id": "intake-category", "versions": [1], "tier": "inert", "status": "open", "entry": "file",
+      "validator": "intake-category-v1", "combine": "add-only", "consumer": "src/runtime/intake/taxonomy.js",
+      "referencedBy": [], "slice": "136", "template": "package-templates/intake-category" }
   ],
   "bundled": [
-    { "id": "doflow", "dir": "core/registry/packages/doflow", "contentDigest": "492b10df12d1281743ee26a31a5acab8a90c39e2b7c9ed29fdca5cc0a94bf24a" }
+    { "id": "doflow", "dir": "core/registry/packages/doflow", "contentDigest": "4684bab1385564aef5e65100c789605895f3597c7fc23f340afa55333d11377b" }
   ]
 }

package/core/registry/gates.json

@@ -6,14 +6,14 @@
       "gate-a": { "autopilot": "approve", "predicates": ["protected-paths", "plan-verification-absent", "plan-parses", "markers-zero:design", "markers-zero:plan", "needs-merged", "requires-reachable", "plan-within-write-set"] },
       "gate-b": { "autopilot": "approve", "minSeats": 2, "predicates": ["protected-paths", "plan-verification-absent", "verify-pass-on-head", "findings-valid", "no-dropped-findings", "dispositions-backed", "blockers-zero"] }
     },
-    "bug": {},
-    "refactor": {},
+    "bug": { "gate-b": { "autopilot": "approve", "minSeats": 2, "predicates": ["protected-paths", "plan-verification-absent", "verify-pass-on-head", "findings-valid", "no-dropped-findings", "dispositions-backed", "blockers-zero"] } },
+    "refactor": { "gate-b": { "autopilot": "approve", "minSeats": 2, "predicates": ["protected-paths", "plan-verification-absent", "verify-pass-on-head", "findings-valid", "no-dropped-findings", "dispositions-backed", "blockers-zero"] } },
     "review": {},
     "research": {},
-    "documentation": {},
+    "documentation": { "gate-b": { "autopilot": "approve", "minSeats": 2, "predicates": ["protected-paths", "plan-verification-absent", "verify-pass-on-head", "findings-valid", "no-dropped-findings", "dispositions-backed", "blockers-zero"] } },
     "dependency-change": {},
     "operations": {},
-    "trivial-edit": {}
+    "trivial-edit": { "gate-b": { "autopilot": "approve", "minSeats": 2, "predicates": ["protected-paths", "plan-verification-absent", "verify-pass-on-head", "findings-valid", "no-dropped-findings", "dispositions-backed", "blockers-zero"] } }
   },
   "protected": {
     "paths": ["core/registry/gates.json", "src/runtime/roadmap/", "core/registry/verification.json", "src/runtime/workflow-orchestrator.js", "src/runtime/decision-register.js", "core/registry/settings.json", "core/harnesses/shared/hooks/policies/", ".github/workflows/"],
@@ -27,6 +27,6 @@
     "unresolved-clarifications", "markers-open", "protected-path", "plan-unparsable", "need-unmerged", "prerequisite-no-source", "capability-unreachable", "write-set-exceeded",
     "verify-missing", "verify-not-pass", "verify-flaky", "findings-missing", "findings-invalid", "review-stale-head", "seats-too-few", "finding-dropped", "refuted-without-evidence", "accepted-without-user-decision", "user-accepted-needs-person", "fixed-not-ancestor", "blockers-open",
     "lease-held", "lease-lost", "stage-not-performed", "plan-exit-refused", "report-changed", "pause-not-machine", "facts-unreadable", "autopilot-disabled",
-    "git-too-old", "merge-conflict", "develop-wrong-branch", "develop-dirty", "ff-running", "develop-moved", "head-moved", "no-develop-worktree", "plan-changed", "needs-person", "needs-person-tty"
+    "git-too-old", "merge-conflict", "develop-wrong-branch", "develop-dirty", "ff-running", "develop-moved", "head-moved", "no-develop-worktree", "plan-changed", "needs-person-tty", "needs-person-confirm"
   ]
 }

package/core/registry/harnesses.json

@@ -1611,7 +1611,7 @@
             },
             "PreToolUse": {
               "status": "different",
-              "note": "DoFlow's user- or project-scope extension evaluates tool_call before execution; tool_execution_start is observation-only."
+              "note": "DoFlow's user- or project-scope extension evaluates tool_call before execution; tool_execution_start is observation-only. The extension acts only on a `{block:true}` answer, so an advisory from the gate or MCP guard is recorded and never reaches the model."
             },
             "PostToolUse": {
               "status": "different",
@@ -2065,8 +2065,8 @@
             "https://docs.github.com/en/copilot/how-tos/copilot-cli/customize-copilot/use-hooks",
             "https://docs.github.com/en/copilot/reference/hooks-reference"
           ],
-          "note": "Surface chosen 2026-10-27 from a live capture (Copilot CLI 1.0.103, `copilot -p`, agent-docs/maintain/issue-21): camelCase events in .github/hooks/*.json (repo) and $COPILOT_HOME or ~/.copilot/hooks/ (user), shape {version:1,hooks:{<event>:[{type:command,bash,cwd,timeoutSec}]}}. camelCase fired sessionStart, sessionEnd, userPromptSubmitted, userPromptTransformed, preToolUse, postToolUse, permissionRequest, agentStop, subagentStart and subagentStop; the PascalCase aliases fired only PreToolUse, PostToolUse, SessionStart, SessionEnd, SubagentStart and SubagentStop (no UserPromptSubmit, Stop or permission event), so camelCase is the only surface that reaches agentStop. DoFlow writes .github/hooks/doflow.json plus doflow-*.sh front doors (project: <root>/.github/hooks; user: $COPILOT_HOME/hooks when COPILOT_HOME is set, else ~/.copilot/hooks) that normalise the camelCase payload to the canonical Claude-style payload (toolName bash/edit/create/apply_patch -> Bash/Edit/Write/apply_patch, toolArgs -> tool_input, sessionId/transcriptPath/agentId -> snake_case) and run the shared lifecycle bridge in ../.doflow/shared/hooks. Wired: sessionStart (session-context), preToolUse (pre-implementation-gate, pre-bash-guard, mcp-tool-guard), agentStop (stop-check; a subagent's own agentStop, which carries agentId, is skipped), subagentStart and subagentStop (subagent-audit). A guarded preToolUse policy that errors or cannot decide (jq or the policy script missing, an edit tool whose target path is not decodable) is denied under every fault profile, Copilot only. A preToolUse deny is the flat JSON {permissionDecision:\"deny\",permissionDecisionReason} on stdout with exit 0; the capture shows Copilot blocked `echo hi` with that output. Where the docs and the capture disagree the capture wins: the docs type camelCase toolArgs `unknown` (and describe tool_input as parsed from a JSON string); the capture shows toolArgs as a JSON object for bash, skill and task and as a raw string (the freeform patch) for apply_patch, and the normaliser accepts an object, a JSON string and a raw string. Copilot also sets CLAUDE_PROJECT_DIR and reads .claude/settings.json, so a project holding both a Claude and a Copilot DoFlow install runs the Claude-wired hooks on Copilot too. The guards are idempotent, but subagent-audit appends unconditionally, so one subagent completion writes two stop records (the capture holds both P:SubagentStop and subagentStop); the dedupe is not done here. Not live-verified: the agentStop block shape {decision:\"block\",reason} (documented, not exercised), MCP tool names on preToolUse, and the arguments of Copilot's `edit` and `create` tools (only apply_patch was captured; path, file_path, filePath, filename and target_file are decoded as the target, anything else is denied). The bash entry only runs under a POSIX shell; no powershell entry is written.",
-          "verification": "Run `copilot -p` in a project with `doflow install -t copilot`, confirm .github/hooks/doflow.json is loaded (hooks fire on a shell command), and that a force-push shell command is denied by pre-bash-guard. Docs read and capture taken 2026-10-27.",
+          "note": "Surface chosen 2026-10-27 from a live capture (Copilot CLI 1.0.103, `copilot -p`, agent-docs/maintain/issue-21): camelCase events in .github/hooks/*.json (repo) and $COPILOT_HOME or ~/.copilot/hooks/ (user), shape {version:1,hooks:{<event>:[{type:command,bash,cwd,timeoutSec}]}}. camelCase fired sessionStart, sessionEnd, userPromptSubmitted, userPromptTransformed, preToolUse, postToolUse, permissionRequest, agentStop, subagentStart and subagentStop; the PascalCase aliases fired only PreToolUse, PostToolUse, SessionStart, SessionEnd, SubagentStart and SubagentStop (no UserPromptSubmit, Stop or permission event), so camelCase is the only surface that reaches agentStop. DoFlow writes .github/hooks/doflow.json plus doflow-*.sh front doors (project: <root>/.github/hooks; user: $COPILOT_HOME/hooks when COPILOT_HOME is set, else ~/.copilot/hooks) that normalise the camelCase payload to the canonical Claude-style payload (toolName bash/edit/create/apply_patch -> Bash/Edit/Write/apply_patch, toolArgs -> tool_input, sessionId/transcriptPath/agentId -> snake_case) and run the shared lifecycle bridge in ../.doflow/shared/hooks. Wired: sessionStart (session-context), preToolUse (pre-implementation-gate, mcp-tool-guard), agentStop (stop-check; a subagent's own agentStop, which carries agentId, is skipped), subagentStart and subagentStop (subagent-audit). A guarded preToolUse policy that errors or cannot decide (jq or the policy script missing, an edit tool whose target path is not decodable) is denied under every fault profile, Copilot only. A preToolUse deny is the flat JSON {permissionDecision:\"deny\",permissionDecisionReason} on stdout with exit 0; the capture shows Copilot blocked `echo hi` with that output. Where the docs and the capture disagree the capture wins: the docs type camelCase toolArgs `unknown` (and describe tool_input as parsed from a JSON string); the capture shows toolArgs as a JSON object for bash, skill and task and as a raw string (the freeform patch) for apply_patch, and the normaliser accepts an object, a JSON string and a raw string. Copilot also sets CLAUDE_PROJECT_DIR and reads .claude/settings.json, so a project holding both a Claude and a Copilot DoFlow install runs the Claude-wired hooks on Copilot too. The guards are idempotent, but subagent-audit appends unconditionally, so one subagent completion writes two stop records (the capture holds both P:SubagentStop and subagentStop); the dedupe is not done here. Not live-verified: the agentStop block shape {decision:\"block\",reason} (documented, not exercised), MCP tool names on preToolUse, and the arguments of Copilot's `edit` and `create` tools (only apply_patch was captured; path, file_path, filePath, filename and target_file are decoded as the target, anything else is denied). The bash entry only runs under a POSIX shell; no powershell entry is written.",
+          "verification": "Run `copilot -p` in a project with `doflow install -t copilot`, confirm .github/hooks/doflow.json is loaded (hooks fire on a shell command). Docs read and capture taken 2026-10-27.",
           "events": {
             "SessionStart": {
               "status": "supported",
@@ -2078,7 +2078,7 @@
             },
             "PreToolUse": {
               "status": "supported",
-              "note": "Native preToolUse -> pre-implementation-gate, pre-bash-guard and mcp-tool-guard. Command hooks are fail-closed on a non-zero exit; a deny is the flat {permissionDecision,permissionDecisionReason} JSON (live-verified). Timeouts fail open."
+              "note": "Native preToolUse -> pre-implementation-gate and mcp-tool-guard. Command hooks are fail-closed on a non-zero exit; a deny is the flat {permissionDecision,permissionDecisionReason} JSON (live-verified). DoFlow's pre-implementation-gate no longer denies (advisory only, D1): the bridge records the advisory and Copilot has no documented way to show it to the model on allow. Only mcp-tool-guard's blocked-pattern denies. Timeouts fail open."
             },
             "PostToolUse": {
               "status": "different",
@@ -2090,7 +2090,7 @@
             },
             "Stop": {
               "status": "supported",
-              "note": "Native agentStop -> stop-check, rendered as stdout {decision:\"block\",reason} (documented; capped by Copilot at 8 consecutive blocks; the payload carries stop_hook_active, which stop-check honours). Not live-exercised."
+              "note": "Native agentStop -> stop-check, advisory only (D1): an unfinished-work finding is recorded and the stop proceeds; DoFlow no longer renders Copilot's documented stdout {decision:\"block\",reason} (capped by Copilot at 8 consecutive blocks). The payload carries stop_hook_active, which stop-check honours. Not live-exercised."
             },
             "UserPromptSubmit": {
               "status": "different",
@@ -2127,7 +2127,7 @@
             "https://docs.github.com/en/copilot/concepts/agents/about-plugins",
             "https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-plugin-reference"
           ],
-          "note": "Copilot CLI documents plugins (plugin.json manifest bundling agents, skills, hooks, .mcp.json and lsp.json; installed via 'copilot plugin install' or enabledPlugins in settings). Manifest discovery checks .plugin/plugin.json, plugin.json, .github/plugin/plugin.json, then .claude-plugin/plugin.json - there is no .copilot-plugin/ convention. DoFlow publishes a skills-only manifest at core/.plugin/plugin.json declaring only what activates there: agent specs are excluded (Copilot requires .agent.md; shared agent-specs are plain .md), hooks stay unprojected (Claude-payload-coupled), MCP registration stays installer-managed. Findings: docs/distribution-notes.md.",
+          "note": "Copilot CLI documents plugins (plugin.json manifest bundling agents, skills, hooks, .mcp.json and lsp.json; installed via 'copilot plugin install' or enabledPlugins in settings). Manifest discovery checks .plugin/plugin.json, plugin.json, .github/plugin/plugin.json, then .claude-plugin/plugin.json - there is no .copilot-plugin/ convention. DoFlow publishes a skills-only manifest at core/.plugin/plugin.json declaring only what activates there: agent specs are excluded (Copilot requires .agent.md; shared agent-specs are plain .md), hooks stay unprojected (Claude-payload-coupled), MCP registration stays installer-managed.",
           "verification": "Report that no Copilot plugin package is installed."
         }
       },
@@ -2517,7 +2517,7 @@
             "https://kiro.dev/docs/hooks/types/",
             "https://kiro.dev/docs/permissions/"
           ],
-          "note": "kiro-cli reads hooks from an agent config's `hooks` array (agentSpawn, userPromptSubmit, preToolUse, postToolUse, stop). In a CLI 2.x agent config a preToolUse hook that exits 2 blocks the tool call and any other non-zero exit warns and allows; kiro.dev/docs/hooks/actions/ says that for its hooks any non-zero exit blocks Pre Tool Use. DoFlow note: CLI 2.x agent-config exit semantics not re-fetched (2026-10-24). Stop is not blockable on 2.x. DoFlow writes three preToolUse hooks (pre-implementation-gate on `write`, pre-bash-guard on `shell`, mcp-tool-guard on `*`) into every rendered agent, plus agentSpawn (session context) and stop (stop-check) on the doflow agent only. The Kiro front doors translate Kiro tool names, KIRO_SESSION_ID and assistant_response to the canonical payload before running the shared policies. `.kiro/hooks/doflow.json` (flat `{version, hooks: [...]}`, PascalCase triggers) is read by the Kiro IDE and by CLI V3 (for every agent); CLI 2.x does not read it. Kiro CLI V3 also loads standalone `.kiro/hooks/*.json` (workspace) and `~/.kiro/hooks/*.json` (global) for every agent, alongside agent-profile hooks, so doflow.json runs for all agents there, and with `--agent doflow` on V3 the preToolUse checks run twice (accepted, idempotent). V3 payloads carry `session_id`, and V3 built-in tool IDs include `read_file`, `execute_bash`, `execute_pwsh`, `fs_write`, `fs_append`, `str_replace` and `delete_file`; the front doors map the write family to Write and `execute_pwsh` to Bash, and V3 MCP IDs (`mcp_<server>_<tool>`) reach mcp-tool-guard unchanged. doflow.json scopes the MCP guard with the V3 `@mcp` selector. V3 Stop: exit 0 finishes, exit 0 with stdout JSON `{\"decision\":\"block\",\"reason\":\"...\"}` starts another turn, exit 1 also starts another turn, and exit 2 does not block; the stop front door therefore turns the policy's deny into that JSON block when the payload has a session_id and keeps exit 2 with stderr for 2.x, where any non-zero exit only warns. It is not in Kiro v3's untrusted-workspace exclusion list; an untrusted workspace asks before every shell command, and whether that covers hook commands is undocumented. Observed on CLI V3 (kiro-cli 2.27.1 --v3, 2026-10-11): PreToolUse payloads carry session_id, tool_name execute_bash with tool_input.command, fs_write and str_replace with tool_input.path; the Stop payload carries only session_id, hook_event_name and cwd, with no response text or transcript path, so stop-check's unfinished-work scan has nothing to read on V3 and allows the stop.",
+          "note": "kiro-cli reads hooks from an agent config's `hooks` array (agentSpawn, userPromptSubmit, preToolUse, postToolUse, stop). In a CLI 2.x agent config a preToolUse hook that exits 2 blocks the tool call and any other non-zero exit warns and allows; kiro.dev/docs/hooks/actions/ says that for its hooks any non-zero exit blocks Pre Tool Use. DoFlow note: CLI 2.x agent-config exit semantics not re-fetched (2026-10-24). Stop is not blockable on 2.x. DoFlow writes two preToolUse hooks (pre-implementation-gate on `write`, mcp-tool-guard on `*`) into every rendered agent, plus agentSpawn (session context) and stop (stop-check) on the doflow agent only. The Kiro front doors translate Kiro tool names, KIRO_SESSION_ID and assistant_response to the canonical payload before running the shared policies. `.kiro/hooks/doflow.json` (flat `{version, hooks: [...]}`, PascalCase triggers) is read by the Kiro IDE and by CLI V3 (for every agent); CLI 2.x does not read it. Kiro CLI V3 also loads standalone `.kiro/hooks/*.json` (workspace) and `~/.kiro/hooks/*.json` (global) for every agent, alongside agent-profile hooks, so doflow.json runs for all agents there, and with `--agent doflow` on V3 the preToolUse checks run twice (accepted, idempotent). V3 payloads carry `session_id`, and V3 built-in tool IDs include `read_file`, `execute_bash`, `execute_pwsh`, `fs_write`, `fs_append`, `str_replace` and `delete_file`; the front doors map the write family to Write and `execute_pwsh` to Bash, and V3 MCP IDs (`mcp_<server>_<tool>`) reach mcp-tool-guard unchanged. doflow.json scopes the MCP guard with the V3 `@mcp` selector. V3 Stop: exit 0 finishes, exit 0 with stdout JSON `{\"decision\":\"block\",\"reason\":\"...\"}` starts another turn, exit 1 also starts another turn, and exit 2 does not block; stop-check is advisory only (D1), so the stop front door exits 0 on V3 and 2.x and never renders that JSON block. The door prints stderr only on exit 2, so on every Kiro profile the unfinished-work finding is record-only: the bridge trace shows advisory/unfinished-work, and neither the user nor the model sees a line. The gate's PreToolUse advisory is written to stderr by the front door, which Kiro documents no model-visible path for. It is not in Kiro v3's untrusted-workspace exclusion list; an untrusted workspace asks before every shell command, and whether that covers hook commands is undocumented. Observed on CLI V3 (kiro-cli 2.27.1 --v3, 2026-10-11): PreToolUse payloads carry session_id, tool_name execute_bash with tool_input.command, fs_write and str_replace with tool_input.path; the Stop payload carries only session_id, hook_event_name and cwd, with no response text or transcript path, so stop-check's unfinished-work scan has nothing to read on V3 and allows the stop.",
           "verification": "Confirm kiro-cli reads hooks from the agent config JSON `hooks` (installed .kiro/agents/doflow.json and the specialist agents) with the expected trigger names, and that, in an agent config on CLI 2.x, a preToolUse hook blocks only on exit 2 (any other non-zero exit warns and allows). .kiro/hooks/doflow.json is the Kiro IDE and CLI V3 surface, where any non-zero exit blocks Pre Tool Use.",
           "events": {
             "UserPromptSubmit": {
@@ -3011,7 +3011,7 @@
             },
             "PreToolUse": {
               "status": "supported",
-              "note": "DoFlow projects its pre-implementation gate as a native shim: matcher write_to_file|replace_file_content|multi_replace_file_content, deny decision until the branch-coupled feature's three specifications exist."
+              "note": "DoFlow projects its pre-implementation gate as a native shim: matcher write_to_file|replace_file_content|multi_replace_file_content, advisory only (D1): the native shim allows the edit and records an advisory while the branch-coupled feature's three specifications are missing. The allow response carries no advice, so the advisory is record-only and does not reach the model."
             },
             "PostToolUse": {
               "status": "different",
@@ -3027,7 +3027,7 @@
             },
             "Stop": {
               "status": "supported",
-              "note": "DoFlow projects its stop check as a native shim: emits the documented {decision:'continue', reason} when the last assistant response in transcriptPath carries unfinished-work markers (the same gate Claude's stop-check enforces via exit 2). transcriptPath is a documented required common field, but empty/garbage stdin, missing/unreadable/unrecognized transcripts all fail open, so a broken hook can never trap session end."
+              "note": "DoFlow projects its stop check as a native shim: records an advisory (D1) and lets the session end when the last assistant response in transcriptPath carries unfinished-work markers; it no longer emits the documented {decision:'continue', reason}. Silence is the whole response, so the advisory is record-only and reaches neither the model nor the user. transcriptPath is a documented required common field, but empty/garbage stdin, missing/unreadable/unrecognized transcripts all fail open, so a broken hook can never trap session end."
             },
             "UserPromptSubmit": {
               "status": "unavailable",

package/core/registry/intake.json

@@ -0,0 +1,53 @@
+{
+  "version": 1,
+  "description": "Categories for sorting the loose files a user drops into a feature's additional-context/ folder. A rule matches on file name and extension only, never on content. Categories are tried in order, rules in order, and the first match wins; a package adds categories through the intake-category contribution point.",
+  "recentWindowSeconds": 60,
+  "pointerMaxBytes": 262144,
+  "textExtensions": ["md", "txt", "mmd", "puml", "vtt", "srt", "json", "yaml", "yml", "csv", "html"],
+  "promptCategory": "prompt",
+  "categories": [
+    {
+      "id": "raw-prd",
+      "names": ["prd", "requirements"],
+      "summary": "Product requirement documents, briefs and stories as the user wrote them.",
+      "rules": [
+        { "extensions": ["md", "txt", "pdf", "docx"], "namePattern": "prd|requirement|brief|epic|(^|[^a-z0-9])(story|stories)([^a-z0-9]|$)" }
+      ]
+    },
+    {
+      "id": "hld",
+      "names": ["design", "architecture"],
+      "summary": "High-level design notes, diagram sources and their rendered images.",
+      "rules": [
+        { "extensions": ["mmd", "puml", "drawio", "excalidraw"], "into": "diagrams" },
+        { "extensions": ["png", "svg", "jpg", "jpeg"], "companionOf": ["mmd", "puml", "drawio", "excalidraw"] },
+        { "extensions": ["md"], "namePattern": "hld|high[-_ ]?level|design|architecture|decision|adr" }
+      ]
+    },
+    {
+      "id": "discuss-session",
+      "names": ["meetings"],
+      "summary": "Recordings, transcripts and notes of a discussion.",
+      "rules": [
+        { "extensions": ["mp3", "m4a", "wav", "ogg", "mp4", "mov", "webm"], "into": "records" },
+        { "extensions": ["vtt", "srt"], "into": "transcripts" },
+        { "extensions": ["txt", "md"], "namePattern": "transcript|meeting|minutes|discuss|session", "into": "transcripts" },
+        { "extensions": ["txt"], "namePattern": "^(\\d{1,2}-\\d{1,2}-\\d{4}|\\d{4}-\\d{2}-\\d{2})", "into": "transcripts" }
+      ]
+    },
+    {
+      "id": "references",
+      "names": ["docs", "vendor-docs"],
+      "summary": "Reference documents, spreadsheets and vendor material.",
+      "rules": [
+        { "extensions": ["pdf", "docx", "xlsx", "pptx", "html"] }
+      ]
+    },
+    {
+      "id": "prompt",
+      "names": [],
+      "summary": "Context pasted into the prompt, filed verbatim by the intake verb; no rule sorts a file here.",
+      "rules": []
+    }
+  ]
+}