@litfamily/lithermes 1.0.7 → 1.0.9

package/assets/lithermes-plugin/deliverable_hedge_guard.py

@@ -1,140 +1,52 @@
-"""Declaration-driven hedge findings for completed reader-facing writes.
+"""Changed-text LitHumanizer enforcement at Hermes' supported file hooks.
 
-Hermes discards ``post_tool_call`` return values. This module therefore records
-only bounded, trusted finding metadata at that event and renders it through the
-next ``pre_llm_call`` context. Artifact text and paths never enter model context.
+``pre_tool_call`` can deny ``write_file`` and ``patch`` before persistence. The
+``post_tool_call`` observer cannot undo a completed Office/PDF export, so those
+checks are advisory and ask for a source edit and rebuild.
 """
 
 from __future__ import annotations
 
+import difflib
+import json
 import os
 import re
 import stat
+import subprocess
+import sys
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Iterable
 
 
-SKILLS_ROOT = Path(__file__).resolve().parent / "skills"
+PLUGIN_ROOT = Path(__file__).resolve().parent
+DETECTOR = PLUGIN_ROOT / "skills" / "lit-humanizer" / "scripts" / "detect.py"
 MAX_SESSIONS = 64
 MAX_FILE_BYTES = 2 * 1024 * 1024
+MAX_DETECT_BYTES = 512 * 1024
+MAX_DETECT_OUTPUT = 2 * 1024 * 1024
 MAX_ARTIFACT_PATHS = 32
 MAX_AGGREGATE_FILE_BYTES = 4 * 1024 * 1024
-MAX_CONTEXT_FINDINGS = 100
-READER_FACING_SUFFIXES = frozenset(
-    {".adoc", ".csv", ".htm", ".html", ".md", ".mdx", ".rst", ".tex", ".txt"}
+MAX_CONTEXT_LINES = 6
+DETECT_TIMEOUT_SECONDS = 3
+TEXT_SUFFIXES = frozenset({".adoc", ".csv", ".htm", ".html", ".md", ".mdx", ".rst", ".svg", ".tex", ".txt"})
+OFFICE_SUFFIXES = frozenset({".docx", ".pptx", ".pdf"})
+READER_FACING_SUFFIXES = TEXT_SUFFIXES | OFFICE_SUFFIXES
+
+_QUOTED_SPAN = re.compile(
+    r'"([^"\n]{1,2000})"|“([^”\n]{1,2000})”|'
+    r"‘([^’\n]{1,2000})’|«([^»\n]{1,2000})»|"
+    r"(?<!\w)'([^'\n]{8,1000})'(?!\w)"
 )
-CHANNEL_BY_GENRE = {
-    "client_deliverable": "reply",
-    "internal_analysis": "designated_section",
-    "audit_report": "methodology_paragraph",
-    "working_note": "inline",
-    "no_artifact": "reply",
-}
-ROUTE_SKILL_ALIASES = {
-    "korean-prose-cleanup": "lit-korean",
-}
-REFERENCE_CONTRACT_SKILLS = frozenset({"frontend-ui-ux", "visual-qa"})
-
-_OUTPUT_BLOCK = re.compile(
-    r"(?ms)^## #contract\.output_channels\s*$\s*^```yaml\s*$\n(?P<body>.*?)^```\s*$"
-)
-_SCALAR = re.compile(
-    r"^\s*(artifact_genre|limitations_channel)\s*:\s*([a-z_]+)\s*$",
-    re.MULTILINE,
-)
-_FENCE = re.compile(r"^\s*(`{3,}|~{3,})")
-_YAML_OR_JSON_SCALAR = re.compile(
-    r'^\s*(?:[A-Za-z_][A-Za-z0-9_.-]*|"[^"]+"|\'[^\']+\')\s*:\s*.+?\s*,?\s*$'
-)
-_QUOTED = re.compile(r'(["\'`])([^"\'`]+)\1')
-_STATUS_VALUE = re.compile(
-    r"^(?:pending|blocked|in[_ -]?progress|done|complete|pass|fail|보류\s*중|진행\s*중|완료|차단)$",
-    re.IGNORECASE,
-)
-
-_EVIDENCE_NOUN_KO = (
-    r"(?:근거|자료|데이터|측정(?:값|치|자료)|관찰\s*기록|사용자\s*관찰|실험\s*결과|"
-    r"검증\s*결과|평가\s*자료|출처|문헌|증거|수치)"
-)
-_ABSENCE_KO = (
-    r"(?:없(?:다|습니다|음|어|어서|으므로|기\s*때문)?|부재|제공되지\s*않|주어지지\s*않|"
-    r"확인되지\s*않|검증되지\s*않)"
-)
-_ABILITY_KO = r"(?:(?:평가|판단|산정)할\s*수\s*없|알\s*수\s*없)"
-_ABSENT_EVIDENCE_KO = re.compile(
-    rf"(?:{_EVIDENCE_NOUN_KO}.{{0,48}}{_ABSENCE_KO}|{_ABSENCE_KO}.{{0,24}}{_EVIDENCE_NOUN_KO}|"
-    rf"{_EVIDENCE_NOUN_KO}.{{0,64}}{_ABILITY_KO})",
-    re.IGNORECASE,
-)
-_ABSENT_EVIDENCE_EN = re.compile(
-    r"(?:no\s+(?:supporting\s+)?evidence\s+yet|not\s+yet\s+substantiated|"
-    r"(?:evidence|data|measurements?|observations?|records?|sources?|citations?|test\s+results?)"
-    r".{0,48}(?:is|are|was|were)?\s*(?:absent|missing|unavailable|not\s+provided|not\s+verified)|"
-    r"(?:cannot|could\s+not)\s+(?:assess|determine|calculate).{0,48}"
-    r"(?:evidence|data|measurements?|observations?|records?|sources?|citations?))",
-    re.IGNORECASE,
-)
-
-_PATTERNS = (
-    (
-        "deferred",
-        re.compile(
-            r"보류\s*중|별도로\s*진행|추후\s*진행|to be determined separately",
-            re.IGNORECASE,
-        ),
-    ),
-    ("absent-evidence", _ABSENT_EVIDENCE_KO),
-    ("absent-evidence", _ABSENT_EVIDENCE_EN),
-    (
-        "scope-limit",
-        re.compile(
-            r"한정됩니다|국한됩니다|범위\s*내에서만|limited to the provided evidence",
-            re.IGNORECASE,
-        ),
-    ),
-    (
-        "negated-action",
-        re.compile(
-            r"하지\s*않았습니다|포함되지\s*않습니다|다루지\s*않습니다|was not performed|is not included",
-            re.IGNORECASE,
-        ),
-    ),
-    (
-        "self-protection",
-        re.compile(
-            r"참고용|추가\s*검증이\s*필요|완전하지\s*않을\s*수\s*있|for reference only|may be incomplete",
-            re.IGNORECASE,
-        ),
-    ),
-    ("process-meta", re.compile(r"as an AI|이\s*작업에서는|프롬프트가", re.IGNORECASE)),
-)
-
-
-@dataclass(frozen=True)
-class OutputChannel:
-    artifact_genre: str
-    limitations_channel: str
-
-
-@dataclass(frozen=True)
-class Finding:
-    pattern_class: str
-    line_number: int
-
-
-@dataclass(frozen=True)
-class PendingReceipt:
-    skill_id: str
-    contract: OutputChannel
-    finding_count: int
-    line_numbers: tuple[int, ...]
-    file_count: int
+_INTERNAL_FILE = re.compile(r"(?:^|/)(?:plans|evidence|ledgers?|\.hermes|\.lit[^/]*)(?:/|$)|(?:^|/)HANDOFF[^/]*$", re.I)
+_V4A_FILE = re.compile(r"^\*\*\* (Add|Update|Delete) File: (.+)$")
+_V4A_MOVE = re.compile(r"^\*\*\* Move to: (.+)$")
+_RULE_ID = re.compile(r"^[a-z0-9][a-z0-9-]{0,79}$")
 
 
 @dataclass(frozen=True)
-class _StableText:
-    text: str
+class _StableFile:
+    data: bytes
     byte_count: int
 
 
@@ -143,27 +55,23 @@ class _ReadBudgetExceeded:
 
 
 _READ_BUDGET_EXCEEDED = _ReadBudgetExceeded()
-
-
-_ACTIVE_SKILLS: dict[str, str] = {}
 _ROOT_TURNS: dict[str, str] = {}
-_PENDING_RECEIPTS: dict[str, list[PendingReceipt]] = {}
+_USER_QUOTES: dict[str, tuple[str, ...]] = {}
+_PENDING_ADVISORIES: dict[str, list[str]] = {}
 
 
 def reset_state() -> None:
-    """Clear in-memory hook state; used by host lifecycle and isolated drivers."""
-    _ACTIVE_SKILLS.clear()
     _ROOT_TURNS.clear()
-    _PENDING_RECEIPTS.clear()
+    _USER_QUOTES.clear()
+    _PENDING_ADVISORIES.clear()
 
 
 def release_session(session_id: object) -> None:
     key = str(session_id or "")
-    if not key:
-        return
-    _ACTIVE_SKILLS.pop(key, None)
-    _ROOT_TURNS.pop(key, None)
-    _PENDING_RECEIPTS.pop(key, None)
+    if key:
+        _ROOT_TURNS.pop(key, None)
+        _USER_QUOTES.pop(key, None)
+        _PENDING_ADVISORIES.pop(key, None)
 
 
 def _bounded_set(mapping: dict[str, object], key: str, value: object) -> None:
@@ -173,165 +81,60 @@ def _bounded_set(mapping: dict[str, object], key: str, value: object) -> None:
         mapping.pop(next(iter(mapping)), None)
 
 
-def _contract_path(skill_id: str) -> Path:
-    skill_root = SKILLS_ROOT / skill_id
-    entrypoint = skill_root / "SKILL.md"
-    if skill_id not in REFERENCE_CONTRACT_SKILLS:
-        return entrypoint
-    if entrypoint.is_file() and "## #contract.output_channels" in entrypoint.read_text(encoding="utf-8"):
-        raise ValueError(f"lazy-reference skill declares output channel in entrypoint: {skill_id}")
-    return skill_root / "references" / "complete-contract.md"
-
-
-def load_output_channel(skill_id: str) -> OutputChannel:
-    if not re.fullmatch(r"[a-z0-9-]+", str(skill_id or "")):
-        raise ValueError("invalid skill id")
-    path = _contract_path(skill_id)
-    text = path.read_text(encoding="utf-8")
-    match = _OUTPUT_BLOCK.search(text)
-    if match is None:
-        raise ValueError(f"output channel declaration missing for {skill_id}")
-    values = dict(_SCALAR.findall(match.group("body")))
-    genre = values.get("artifact_genre", "")
-    channel = values.get("limitations_channel", "")
-    if genre not in CHANNEL_BY_GENRE or CHANNEL_BY_GENRE[genre] != channel:
-        raise ValueError(f"invalid output channel declaration for {skill_id}")
-    return OutputChannel(genre, channel)
-
-
-def activate_skill(session_id: object, route_or_skill: object) -> bool:
-    key = str(session_id or "")
-    candidate = ROUTE_SKILL_ALIASES.get(str(route_or_skill or ""), str(route_or_skill or ""))
-    if not key:
-        return False
-    try:
-        load_output_channel(candidate)
-    except (OSError, UnicodeError, ValueError):
-        _ACTIVE_SKILLS.pop(key, None)
-        return False
-    _bounded_set(_ACTIVE_SKILLS, key, candidate)
-    return True
-
-
-def clear_active_skill(session_id: object) -> None:
-    """End the previous root turn without discarding a pending finding receipt."""
-    _ACTIVE_SKILLS.pop(str(session_id or ""), None)
-
-
 def begin_root_turn(session_id: object, turn_id: object) -> None:
-    """Rebind guard state only at a host-authored root-turn boundary.
-
-    Current Hermes passes a fresh ``turn_id`` into ``pre_llm_call`` once per
-    root turn. Repeated callbacks carrying that same identity belong to the
-    assistant/tool loop and must keep the active skill after an advisory is
-    consumed. Missing identities are not promoted into boundaries from raw user
-    text; session lifecycle hooks remain the fallback reset surface.
-    """
     key = str(session_id or "")
     identity = turn_id if isinstance(turn_id, str) else ""
     if not key or not identity or len(identity.encode("utf-8")) > 512:
         return
     if _ROOT_TURNS.get(key) != identity:
-        clear_active_skill(key)
+        _USER_QUOTES.pop(key, None)
         _bounded_set(_ROOT_TURNS, key, identity)
 
 
-def _quoted_status_contains(line: str, start: int, end: int) -> bool:
-    for match in _QUOTED.finditer(line):
-        if (
-            match.start(2) <= start
-            and end <= match.end(2)
-            and _STATUS_VALUE.fullmatch(match.group(2).strip())
-        ):
-            return True
-    return False
-
-
-def _status_table_line(line: str) -> bool:
-    if "|" not in line:
-        return False
-    cells = [cell.strip().strip("`\"'") for cell in line.strip().strip("|").split("|")]
-    return any(_STATUS_VALUE.fullmatch(cell) for cell in cells)
-
-
-def _methodology_lines(lines: list[str]) -> set[int]:
-    paragraphs: list[list[int]] = []
-    current: list[int] = []
-    for index, line in enumerate(lines):
-        if line.strip():
-            current.append(index)
-        elif current:
-            paragraphs.append(current)
-            current = []
-    if current:
-        paragraphs.append(current)
-    marker = re.compile(r"(?:methodology|method|방법론|검토\s*방법)", re.IGNORECASE)
-    for position, paragraph in enumerate(paragraphs):
-        if not marker.search(" ".join(lines[index] for index in paragraph)):
-            continue
-        allowed = set(paragraph)
-        if (
-            len(paragraph) == 1
-            and lines[paragraph[0]].lstrip().startswith("#")
-            and position + 1 < len(paragraphs)
-        ):
-            allowed.update(paragraphs[position + 1])
-        return allowed
-    return set()
-
-
-def _designated_section_lines(lines: list[str]) -> set[int]:
-    heading = re.compile(r"^\s*(#{1,6})\s+.*(?:limitations?|한계|제한)", re.IGNORECASE)
-    allowed: set[int] = set()
-    active_level: int | None = None
-    for index, line in enumerate(lines):
-        matched = heading.match(line)
-        if matched:
-            active_level = len(matched.group(1))
-            allowed.add(index)
-            continue
-        next_heading = re.match(r"^\s*(#{1,6})\s+", line)
-        if active_level is not None and next_heading and len(next_heading.group(1)) <= active_level:
-            active_level = None
-        if active_level is not None:
-            allowed.add(index)
-    return allowed
-
-
-def scan_text(text: str, contract: OutputChannel) -> list[Finding]:
-    if contract.artifact_genre in {"working_note", "no_artifact"}:
-        return []
-    lines = str(text or "").splitlines()
-    allowed = (
-        _methodology_lines(lines)
-        if contract.artifact_genre == "audit_report"
-        else _designated_section_lines(lines)
-        if contract.artifact_genre == "internal_analysis"
-        else set()
-    )
-    findings: list[Finding] = []
-    fence: str | None = None
-    for index, line in enumerate(lines):
-        fence_match = _FENCE.match(line)
-        if fence_match:
-            marker = fence_match.group(1)[0]
-            fence = None if fence == marker else marker if fence is None else fence
-            continue
-        if fence is not None or index in allowed:
-            continue
-        scalar = bool(_YAML_OR_JSON_SCALAR.fullmatch(line))
-        table = _status_table_line(line)
-        for pattern_class, pattern in _PATTERNS:
-            match = pattern.search(line)
-            if match is None:
-                continue
-            if pattern_class == "deferred" and (
-                scalar or table or _quoted_status_contains(line, match.start(), match.end())
-            ):
-                continue
-            findings.append(Finding(pattern_class, index + 1))
-            break
-    return findings
+def capture_user_text(session_id: object, user_message: object, turn_id: object = None) -> None:
+    """Keep only bounded exact quote spans, never the full user message."""
+    key = str(session_id or "")
+    message = user_message if isinstance(user_message, str) else ""
+    if not key or not message:
+        return
+    identity = turn_id if isinstance(turn_id, str) else _ROOT_TURNS.get(key, "")
+    if identity and _ROOT_TURNS.get(key) not in (None, identity):
+        _USER_QUOTES.pop(key, None)
+    quotes: list[str] = []
+    used = 0
+    for line in message.splitlines():
+        stripped = line.lstrip()
+        if stripped.startswith("> ") and len(stripped) > 2:
+            quote = stripped[2:].strip()
+            if quote:
+                quotes.append(quote[:2000])
+    for match in _QUOTED_SPAN.finditer(message[:16_384]):
+        quote = next((group for group in match.groups() if group), "")
+        if quote:
+            quotes.append(quote[:2000])
+    bounded: list[str] = []
+    for quote in quotes:
+        quote = quote.strip()
+        if quote and quote not in bounded and len(bounded) < 16 and used + len(quote) <= 8000:
+            bounded.append(quote)
+            used += len(quote)
+    _bounded_set(_USER_QUOTES, key, tuple(bounded))
+
+
+def _mask_exact_user_quotes(text: str, session_id: str) -> str:
+    masked = text
+    for quote in _USER_QUOTES.get(session_id, ()):
+        masked = masked.replace(quote, "".join("\n" if char == "\n" else " " for char in quote))
+    return masked
+
+
+def activate_skill(session_id: object, route_or_skill: object) -> bool:
+    """Compatibility no-op: reader-facing checks do not depend on skill genre."""
+    return bool(str(session_id or ""))
+
+
+def clear_active_skill(session_id: object) -> None:
+    """Compatibility no-op; guards are always active for supported paths."""
 
 
 def _directory_flags() -> int | None:
@@ -354,16 +157,17 @@ def _relative_artifact_path(path_text: str, workspace: Path) -> Path | None:
         not relative.parts
         or any(part in {"", ".", ".."} for part in relative.parts)
         or relative.suffix.lower() not in READER_FACING_SUFFIXES
+        or _INTERNAL_FILE.search(relative.as_posix())
     ):
         return None
     return relative
 
 
-def _read_stable_text_file_result(
+def _read_stable_file_result(
     path_text: str,
     workspace: Path,
     byte_limit: int,
-) -> _StableText | _ReadBudgetExceeded | None:
+) -> _StableFile | _ReadBudgetExceeded | None:
     relative = _relative_artifact_path(path_text, workspace)
     directory_flags = _directory_flags()
     if relative is None or directory_flags is None or byte_limit < 0:
@@ -411,10 +215,7 @@ def _read_stable_text_file_result(
             return None
         if initial.st_size > read_limit:
             return _READ_BUDGET_EXCEEDED
-        edges.append(
-            (parent_fd, relative.parts[-1], (initial.st_dev, initial.st_ino), False)
-        )
-
+        edges.append((parent_fd, relative.parts[-1], (initial.st_dev, initial.st_ino), False))
         chunks: list[bytes] = []
         total = 0
         while total <= read_limit:
@@ -423,10 +224,9 @@ def _read_stable_text_file_result(
                 break
             chunks.append(chunk)
             total += len(chunk)
-        raw = b"".join(chunks)
-        if len(raw) > read_limit:
+        data = b"".join(chunks)
+        if len(data) > read_limit:
             return _READ_BUDGET_EXCEEDED
-
         final = os.fstat(artifact_fd)
         if (
             not stat.S_ISREG(final.st_mode)
@@ -434,20 +234,16 @@ def _read_stable_text_file_result(
             or final.st_size != initial.st_size
             or final.st_mtime_ns != initial.st_mtime_ns
             or final.st_ctime_ns != initial.st_ctime_ns
-            or len(raw) != initial.st_size
+            or len(data) != initial.st_size
         ):
             return None
         for parent_fd, name, identity, is_directory in edges:
             current = os.stat(name, dir_fd=parent_fd, follow_symlinks=False)
-            correct_type = (
-                stat.S_ISDIR(current.st_mode)
-                if is_directory
-                else stat.S_ISREG(current.st_mode)
-            )
+            correct_type = stat.S_ISDIR(current.st_mode) if is_directory else stat.S_ISREG(current.st_mode)
             if (current.st_dev, current.st_ino) != identity or not correct_type:
                 return None
-        return _StableText(raw.decode("utf-8"), len(raw))
-    except (OSError, UnicodeError, ValueError):
+        return _StableFile(data, len(data))
+    except (OSError, ValueError):
         return None
     finally:
         if artifact_fd >= 0:
@@ -462,9 +258,25 @@ def _read_stable_text_file_result(
                 pass
 
 
+def _read_stable_text_file_result(
+    path_text: str,
+    workspace: Path,
+    byte_limit: int,
+) -> _StableFile | _ReadBudgetExceeded | None:
+    result = _read_stable_file_result(path_text, workspace, byte_limit)
+    if isinstance(result, _StableFile) and Path(path_text).suffix.lower() not in TEXT_SUFFIXES:
+        return None
+    return result
+
+
 def _read_stable_text_file(path_text: str, workspace: Path) -> str | None:
     result = _read_stable_text_file_result(path_text, workspace, MAX_FILE_BYTES)
-    return result.text if isinstance(result, _StableText) else None
+    if not isinstance(result, _StableFile):
+        return None
+    try:
+        return result.data.decode("utf-8")
+    except UnicodeError:
+        return None
 
 
 def _bounded_artifact_paths(paths: Iterable[object]) -> list[object] | None:
@@ -482,81 +294,290 @@ def _bounded_artifact_paths(paths: Iterable[object]) -> list[object] | None:
     return bounded
 
 
+def _queue_advisory(session_id: str, message: str) -> None:
+    if not session_id:
+        return
+    pending = list(_PENDING_ADVISORIES.get(session_id, ()))
+    if message not in pending:
+        pending.append(message)
+    _bounded_set(_PENDING_ADVISORIES, session_id, pending[-8:])
+
+
+def consume_context(session_id: object) -> str:
+    key = str(session_id or "")
+    messages = _PENDING_ADVISORIES.pop(key, ())
+    return "\n".join(messages)
+
+
+def _path_is_reader_copy(path_text: str, workspace: Path) -> bool:
+    return _relative_artifact_path(path_text, workspace) is not None
+
+
+def _changed_lines(previous: str, proposed: str) -> set[int]:
+    old_lines = previous.splitlines(keepends=True)
+    new_lines = proposed.splitlines(keepends=True)
+    changed: set[int] = set()
+    for tag, _old_start, _old_end, new_start, new_end in difflib.SequenceMatcher(
+        None, old_lines, new_lines, autojunk=True
+    ).get_opcodes():
+        if tag in {"replace", "insert"}:
+            changed.update(range(new_start + 1, new_end + 1))
+    return changed
+
+
+def _run_detector(text: str, path_text: str) -> list[dict] | None:
+    encoded = text.encode("utf-8")
+    if len(encoded) > MAX_DETECT_BYTES:
+        return None
+    payload = json.dumps({"text": text, "file": path_text}, ensure_ascii=False).encode("utf-8")
+    if len(payload) > MAX_DETECT_BYTES + 16_384:
+        return None
+    try:
+        result = subprocess.run(
+            [sys.executable, "-B", "-I", str(DETECTOR), "--stdin-json"],
+            input=payload,
+            capture_output=True,
+            timeout=DETECT_TIMEOUT_SECONDS,
+            check=False,
+        )
+    except (OSError, subprocess.TimeoutExpired):
+        return None
+    if result.returncode != 0 or len(result.stdout) > MAX_DETECT_OUTPUT:
+        return None
+    try:
+        findings = json.loads(result.stdout.decode("utf-8"))
+    except (UnicodeError, json.JSONDecodeError):
+        return None
+    if not isinstance(findings, list) or len(findings) > 4096:
+        return None
+    for finding in findings:
+        if (
+            not isinstance(finding, dict)
+            or not _RULE_ID.fullmatch(str(finding.get("rule") or ""))
+            or finding.get("severity") not in {"block", "warn"}
+            or not isinstance(finding.get("line"), int)
+            or not isinstance(finding.get("line_end"), int)
+            or finding["line"] < 1
+            or finding["line_end"] < finding["line"]
+            or not isinstance(finding.get("match"), str)
+        ):
+            return None
+    return findings
+
+
+def _changed_findings(text: str, path_text: str, changed: set[int], session_id: str) -> list[dict] | None:
+    findings = _run_detector(_mask_exact_user_quotes(text, session_id), path_text)
+    if findings is None:
+        return None
+    return [
+        finding
+        for finding in findings
+        if any(finding["line"] <= line <= finding["line_end"] for line in changed)
+    ]
+
+
+def _block_message(findings: list[dict]) -> dict[str, str] | None:
+    blocks = [finding for finding in findings if finding["severity"] == "block"]
+    if not blocks:
+        return None
+    refs = ", ".join(f"{item['rule']}:{item['line']}" for item in blocks[:5])
+    extra = f" (+{len(blocks) - 5})" if len(blocks) > 5 else ""
+    return {
+        "action": "block",
+        "message": f"LitHumanizer blocked {len(blocks)} block-tier finding(s) in added prose ({refs}{extra}). Revise the added wording; warnings remain contextual review signals.",
+    }
+
+
+def _warn_if_needed(session_id: str, findings: list[dict]) -> None:
+    warnings = [finding for finding in findings if finding["severity"] == "warn"]
+    if warnings:
+        refs = ", ".join(f"{item['rule']}:{item['line']}" for item in warnings[:5])
+        _queue_advisory(session_id, f"LitHumanizer warning-tier review signal(s) in added prose: {refs}. Consider them in context; they are not a ban or authorship judgment.")
+
+
+def _fail_open(session_id: str) -> None:
+    _queue_advisory(session_id, "LitHumanizer check unavailable; the write was allowed. Run the detector manually before delivery.")
+
+
+def _read_previous(path_text: str, workspace: Path) -> str | None:
+    result = _read_stable_text_file_result(path_text, workspace, MAX_FILE_BYTES)
+    if isinstance(result, _StableFile):
+        try:
+            return result.data.decode("utf-8")
+        except UnicodeError:
+            return None
+    target = Path(path_text).expanduser()
+    target = target if target.is_absolute() else workspace / target
+    if result is None and not target.exists() and not target.is_symlink():
+        return ""
+    return None
+
+
+def _check_text_change(session_id: str, path_text: str, proposed: str, workspace: Path) -> dict[str, str] | None:
+    if not _path_is_reader_copy(path_text, workspace):
+        return None
+    if len(proposed.encode("utf-8")) > MAX_DETECT_BYTES:
+        _fail_open(session_id)
+        return None
+    previous = _read_previous(path_text, workspace)
+    if previous is None:
+        _fail_open(session_id)
+        return None
+    if len(previous.encode("utf-8")) > MAX_DETECT_BYTES:
+        _fail_open(session_id)
+        return None
+    changed = _changed_lines(previous, proposed)
+    if not changed:
+        return None
+    findings = _changed_findings(proposed, path_text, changed, session_id)
+    if findings is None:
+        _fail_open(session_id)
+        return None
+    _warn_if_needed(session_id, findings)
+    return _block_message(findings)
+
+
+def _patch_added_chunks(patch_text: str) -> list[tuple[str, str]]:
+    chunks: list[tuple[str, str]] = []
+    path = ""
+    kind = ""
+    added: list[str] = []
+
+    def flush() -> None:
+        nonlocal added
+        if path and kind in {"Add", "Update"} and added:
+            chunks.append((path, "\n".join(added)))
+        added = []
+
+    for line in patch_text.splitlines():
+        header = _V4A_FILE.match(line)
+        if header:
+            flush()
+            kind, path = header.group(1), header.group(2).strip()
+        elif _V4A_MOVE.match(line):
+            flush()
+        elif line.startswith("+++") or line.startswith("---"):
+            flush()
+        elif line.startswith("+"):
+            added.append(line[1:])
+        else:
+            flush()
+    flush()
+    return chunks
+
+
+def pre_tool_call(
+    tool_name: object,
+    args: object,
+    session_id: object,
+    *,
+    workspace: object = None,
+) -> dict[str, str] | None:
+    """Block block-tier findings before Hermes persists a supported text edit."""
+    name = str(tool_name or "")
+    payload = args if isinstance(args, dict) else {}
+    key = str(session_id or "")
+    if not key or name not in {"write_file", "patch"}:
+        return None
+    try:
+        root = Path(workspace or Path.cwd()).expanduser().resolve(strict=True)
+    except (OSError, RuntimeError):
+        _fail_open(key)
+        return None
+    if name == "write_file":
+        path_text = str(payload.get("path") or "")
+        content = payload.get("content")
+        if isinstance(content, str):
+            return _check_text_change(key, path_text, content, root)
+        return None
+    mode = str(payload.get("mode") or "replace").lower()
+    if mode == "replace":
+        path_text = str(payload.get("path") or "")
+        old_string = payload.get("old_string")
+        new_string = payload.get("new_string")
+        if not isinstance(old_string, str) or not isinstance(new_string, str):
+            return None
+        previous = _read_previous(path_text, root)
+        if previous is None or old_string not in previous:
+            _fail_open(key)
+            return None
+        proposed = previous.replace(old_string, new_string) if payload.get("replace_all") else previous.replace(old_string, new_string, 1)
+        return _check_text_change(key, path_text, proposed, root)
+    if mode == "patch" and isinstance(payload.get("patch"), str):
+        for path_text, added_text in _patch_added_chunks(payload["patch"]):
+            if not _path_is_reader_copy(path_text, root):
+                continue
+            findings = _changed_findings(added_text, path_text, set(range(1, len(added_text.splitlines()) + 1)), key)
+            if findings is None:
+                _fail_open(key)
+                continue
+            _warn_if_needed(key, findings)
+            denial = _block_message(findings)
+            if denial:
+                return denial
+    return None
+
+
+def _extract_office(data: bytes, suffix: str) -> str:
+    try:
+        import humanizer_office
+    except ImportError:
+        from . import humanizer_office
+    if suffix == ".pdf":
+        return humanizer_office.extract_pdf_bytes(data)
+    return humanizer_office.extract_office_bytes(data, suffix)
+
+
 def observe_completed_paths(
     session_id: object,
     paths: Iterable[object],
     *,
     workspace: object = None,
 ) -> None:
+    """Advise after supported Office/PDF exports; this observer cannot deny."""
     key = str(session_id or "")
-    skill_id = _ACTIVE_SKILLS.get(key)
-    if not key or not skill_id:
-        return
-    try:
-        contract = load_output_channel(skill_id)
-    except (OSError, UnicodeError, ValueError):
-        return
-    if contract.artifact_genre in {"working_note", "no_artifact"}:
+    if not key:
         return
-    bounded_paths = _bounded_artifact_paths(paths)
-    if bounded_paths is None:
+    bounded = _bounded_artifact_paths(paths)
+    if bounded is None:
+        _fail_open(key)
         return
     try:
         root = Path(workspace or Path.cwd()).expanduser().resolve(strict=True)
     except (OSError, RuntimeError):
+        _fail_open(key)
         return
-    buffered_text: list[str] = []
-    remaining_bytes = MAX_AGGREGATE_FILE_BYTES
-    for raw_path in bounded_paths:
-        result = _read_stable_text_file_result(
-            str(raw_path or ""),
-            root,
-            remaining_bytes,
-        )
+    candidates: list[tuple[str, bytes]] = []
+    remaining = MAX_AGGREGATE_FILE_BYTES
+    for raw_path in bounded:
+        path_text = str(raw_path or "")
+        relative = _relative_artifact_path(path_text, root)
+        if relative is None or relative.suffix.lower() not in OFFICE_SUFFIXES:
+            continue
+        result = _read_stable_file_result(path_text, root, remaining)
         if result is _READ_BUDGET_EXCEEDED:
+            _fail_open(key)
             return
-        if not isinstance(result, _StableText):
+        if not isinstance(result, _StableFile):
+            _fail_open(key)
+            continue
+        candidates.append((relative.suffix.lower(), result.data))
+        remaining -= result.byte_count
+    for suffix, data in candidates:
+        try:
+            text = _extract_office(data, suffix)
+        except (OSError, RuntimeError, ValueError, subprocess.TimeoutExpired, ImportError):
+            _fail_open(key)
+            continue
+        findings = _run_detector(text, "post-write" + suffix)
+        if findings is None:
+            _fail_open(key)
             continue
-        buffered_text.append(result.text)
-        remaining_bytes -= result.byte_count
-
-    all_findings: list[Finding] = []
-    file_count = 0
-    for text in buffered_text:
-        findings = scan_text(text, contract)
         if findings:
-            file_count += 1
-            all_findings.extend(findings)
-    if not all_findings:
-        return
-    receipt = PendingReceipt(
-        skill_id=skill_id,
-        contract=contract,
-        finding_count=min(len(all_findings), MAX_CONTEXT_FINDINGS),
-        line_numbers=tuple(sorted({finding.line_number for finding in all_findings}))[
-            :MAX_CONTEXT_FINDINGS
-        ],
-        file_count=file_count,
-    )
-    pending = list(_PENDING_RECEIPTS.get(key, ()))
-    pending.append(receipt)
-    _bounded_set(_PENDING_RECEIPTS, key, pending[-8:])
-
-
-def consume_context(session_id: object) -> str:
-    key = str(session_id or "")
-    receipts = _PENDING_RECEIPTS.pop(key, None)
-    if not receipts:
-        return ""
-    lines = ['<lithermes-deliverable-hedge-guard event="completed-write">']
-    for receipt in receipts:
-        line_numbers = ",".join(str(number) for number in receipt.line_numbers)
-        lines.append(
-            "DELIVERABLE_HEDGE_VIOLATION "
-            f"skill={receipt.skill_id} genre={receipt.contract.artifact_genre} "
-            f"findings={receipt.finding_count} lines={line_numbers} files={receipt.file_count}. "
-            f"Revise the artifact and place limitations in {receipt.contract.limitations_channel}."
-        )
-    lines.append("Artifact text and paths were omitted because they are untrusted data.")
-    lines.append("</lithermes-deliverable-hedge-guard>")
-    return "\n".join(lines)
+            blocks = sum(item["severity"] == "block" for item in findings)
+            warnings = sum(item["severity"] == "warn" for item in findings)
+            _queue_advisory(
+                key,
+                "LIT_HUMANIZER_POSTWRITE_ADVISORY: the completed Office/PDF export has "
+                f"{blocks} block-tier and {warnings} warning-tier finding(s). Edit the source and rebuild; Hermes cannot undo a completed export.",
+            )