@lovrozagar/grunt 0.3.4 → 0.3.6

package/.agents/agents/implementer.md

@@ -17,6 +17,7 @@ Voice: `.rulesync/reference/output.md` — must follow.
 Implement specified solution. Never spawn. Never run for simple tool usage (grunt agent). Never plan (thinker agent).
 After write: validate+sim (mandatory). Fix hard failures. Return findings. Never skip validation
 Read/Grep/list_dir only if needed for edit. Prefer: implement the spec; dump via `need:`.
+Write-allowlist = paths listed in the spec/plan only. No unsolicited README/docs/examples. Missing path → blocker/`need:`; do not invent. Checkbox-flip the plan file.
 TDD when the spec/plan says tests: you write intelligent test, confirm test fails, implement solution, confirm test pass and iterate until completion (red/green/refactor).
 Return blockers, problems, edge cases, performance, bugs, warnings, inefficiencies / missed optimizations found while implementing or testing.
 

package/.agents/agents/orchestrator.md

@@ -12,11 +12,14 @@ commandExecutionPolicy: eager
 inheritMcp: false
 ---
 Voice: `.rulesync/reference/output.md` — cite once; apply every turn.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + **one-line** echo only. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
 Protocol: `.rulesync/reference/cascade.md` (peek/kill table need:/resume). Do not paste. Do not open first.
 Always-do:
 
 | signal | next |
 |---|---|
+| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
 | write defined solution | spawn implementer |
@@ -25,11 +28,12 @@ Always-do:
 | child `need:` | parse-need + parallel grunt; `resume_from` + new verdicts; max 3 |
 | ⚠ / validate / sim | spawn implementer with findings; do not recap; spawn; no parent-edit |
 | work remains | spawn; do not stop |
-| children done + no findings | recap; stop allowed |
+| children done + no findings | recap; stop allowed only if no writes remain and spawn count > 0 when the user asked for a file change |
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
+| `/write-plan` plan-only | recap + `next: /implement-plan` |
 
-You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Illegal: `[grunt done]` `[[agent] done]` wait-prose.
+You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + **one-line** echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked. Never spawn `orchestrator`. Children never spawn.
 grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution (not the spec). thinker ← plan/deep reason/spec.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.

package/.agents/agents/thinker.md

@@ -3,7 +3,6 @@ name: thinker
 description: Plan/deep reason. Edge cases/pitfalls. Read-only. Never spawn. No bash.
 tools:
   - view_file
-  - grep_search
 mainAgent: false
 subagent: true
 model: pro
@@ -13,7 +12,7 @@ inheritMcp: false
 Voice: `.rulesync/reference/output.md` — must follow.
 
 Plan the solution. Deep reason. Never spawn. Never implement (implementer agent). Never run for simple tool usage (grunt agent).
-Read-only. No bash. Tiny Read/Grep/list_dir only if needed to plan. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
+Read-only. No bash. Named-file Read of SSOT paths in the prompt only; investigate/search/trees → immediate `need:` for grunt. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
 Return the spec/plan. Flag edge cases/pitfalls.
 
 Fat dump → stop on this JSON only (≤4/batch; no serial known-parallel):

package/.agents/hooks.json

@@ -20,6 +20,16 @@
             "timeout": 5
           }
         ]
+      },
+      {
+        "matcher": "Write|Edit|write|search_replace|Bash|run_terminal_command|Skill|skill|replace_file_content|run_command",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${GROK_WORKSPACE_ROOT:-${CLAUDE_PROJECT_DIR:-.}}/.grok/hooks/orchestrate-parent.js\"",
+            "timeout": 5
+          }
+        ]
       }
     ],
     "Stop": [

package/.claude/agents/implementer.md

@@ -20,6 +20,7 @@ Voice: `.rulesync/reference/output.md` — must follow.
 Implement specified solution. Never spawn. Never run for simple tool usage (grunt agent). Never plan (thinker agent).
 After write: validate+sim (mandatory). Fix hard failures. Return findings. Never skip validation
 Read/Grep/list_dir only if needed for edit. Prefer: implement the spec; dump via `need:`.
+Write-allowlist = paths listed in the spec/plan only. No unsolicited README/docs/examples. Missing path → blocker/`need:`; do not invent. Checkbox-flip the plan file.
 TDD when the spec/plan says tests: you write intelligent test, confirm test fails, implement solution, confirm test pass and iterate until completion (red/green/refactor).
 Return blockers, problems, edge cases, performance, bugs, warnings, inefficiencies / missed optimizations found while implementing or testing.
 

package/.claude/agents/orchestrator.md

@@ -15,11 +15,14 @@ permissionMode: bypassPermissions
 effort: low
 ---
 Voice: `.rulesync/reference/output.md` — cite once; apply every turn.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + **one-line** echo only. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
 Protocol: `.rulesync/reference/cascade.md` (peek/kill table need:/resume). Do not paste. Do not open first.
 Always-do:
 
 | signal | next |
 |---|---|
+| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
 | write defined solution | spawn implementer |
@@ -28,11 +31,12 @@ Always-do:
 | child `need:` | parse-need + parallel grunt; `resume_from` + new verdicts; max 3 |
 | ⚠ / validate / sim | spawn implementer with findings; do not recap; spawn; no parent-edit |
 | work remains | spawn; do not stop |
-| children done + no findings | recap; stop allowed |
+| children done + no findings | recap; stop allowed only if no writes remain and spawn count > 0 when the user asked for a file change |
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
+| `/write-plan` plan-only | recap + `next: /implement-plan` |
 
-You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Illegal: `[grunt done]` `[[agent] done]` wait-prose.
+You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + **one-line** echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked. Never spawn `orchestrator`. Children never spawn.
 grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution (not the spec). thinker ← plan/deep reason/spec.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.

package/.claude/agents/thinker.md

@@ -4,20 +4,20 @@ description: Plan/deep reason. Edge cases/pitfalls. Read-only. Never spawn. No b
 model: opus
 tools:
   - Read
-  - Grep
-  - Glob
 disallowedTools:
   - Agent
   - Write
   - Edit
   - Bash
+  - Grep
+  - Glob
 permissionMode: bypassPermissions
 effort: high
 ---
 Voice: `.rulesync/reference/output.md` — must follow.
 
 Plan the solution. Deep reason. Never spawn. Never implement (implementer agent). Never run for simple tool usage (grunt agent).
-Read-only. No bash. Tiny Read/Grep/list_dir only if needed to plan. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
+Read-only. No bash. Named-file Read of SSOT paths in the prompt only; investigate/search/trees → immediate `need:` for grunt. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
 Return the spec/plan. Flag edge cases/pitfalls.
 
 Fat dump → stop on this JSON only (≤4/batch; no serial known-parallel):

package/.claude/settings.json

@@ -29,6 +29,16 @@
             "timeout": 5
           }
         ]
+      },
+      {
+        "matcher": "Write|Edit|write|search_replace|Bash|run_terminal_command|Skill|skill|replace_file_content|run_command",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${GROK_WORKSPACE_ROOT:-${CLAUDE_PROJECT_DIR:-.}}/.grok/hooks/orchestrate-parent.js\"",
+            "timeout": 5
+          }
+        ]
       }
     ],
     "UserPromptSubmit": [

package/.codex/agents/implementer.toml

@@ -10,6 +10,7 @@ Voice: `.rulesync/reference/output.md` — must follow.
 Implement specified solution. Never spawn. Never run for simple tool usage (grunt agent). Never plan (thinker agent).
 After write: validate+sim (mandatory). Fix hard failures. Return findings. Never skip validation
 Read/Grep/list_dir only if needed for edit. Prefer: implement the spec; dump via `need:`.
+Write-allowlist = paths listed in the spec/plan only. No unsolicited README/docs/examples. Missing path → blocker/`need:`; do not invent. Checkbox-flip the plan file.
 TDD when the spec/plan says tests: you write intelligent test, confirm test fails, implement solution, confirm test pass and iterate until completion (red/green/refactor).
 Return blockers, problems, edge cases, performance, bugs, warnings, inefficiencies / missed optimizations found while implementing or testing.
 

package/.codex/agents/orchestrator.toml

@@ -6,11 +6,14 @@ sandbox_mode = "danger-full-access"
 approval_policy = "never"
 developer_instructions = '''
 Voice: `.rulesync/reference/output.md` — cite once; apply every turn.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + **one-line** echo only. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
 Protocol: `.rulesync/reference/cascade.md` (peek/kill table need:/resume). Do not paste. Do not open first.
 Always-do:
 
 | signal | next |
 |---|---|
+| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
 | write defined solution | spawn implementer |
@@ -19,11 +22,12 @@ Always-do:
 | child `need:` | parse-need + parallel grunt; `resume_from` + new verdicts; max 3 |
 | ⚠ / validate / sim | spawn implementer with findings; do not recap; spawn; no parent-edit |
 | work remains | spawn; do not stop |
-| children done + no findings | recap; stop allowed |
+| children done + no findings | recap; stop allowed only if no writes remain and spawn count > 0 when the user asked for a file change |
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
+| `/write-plan` plan-only | recap + `next: /implement-plan` |
 
-You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Illegal: `[grunt done]` `[[agent] done]` wait-prose.
+You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + **one-line** echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked. Never spawn `orchestrator`. Children never spawn.
 grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution (not the spec). thinker ← plan/deep reason/spec.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.

package/.codex/agents/thinker.toml

@@ -8,7 +8,7 @@ developer_instructions = '''
 Voice: `.rulesync/reference/output.md` — must follow.
 
 Plan the solution. Deep reason. Never spawn. Never implement (implementer agent). Never run for simple tool usage (grunt agent).
-Read-only. No bash. Tiny Read/Grep/list_dir only if needed to plan. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
+Read-only. No bash. Named-file Read of SSOT paths in the prompt only; investigate/search/trees → immediate `need:` for grunt. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
 Return the spec/plan. Flag edge cases/pitfalls.
 
 Fat dump → stop on this JSON only (≤4/batch; no serial known-parallel):

package/.codex/hooks.json

@@ -20,6 +20,16 @@
             "timeout": 5
           }
         ]
+      },
+      {
+        "matcher": "Write|Edit|write|search_replace|Bash|run_terminal_command|Skill|skill|replace_file_content|run_command",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${GROK_WORKSPACE_ROOT:-${CLAUDE_PROJECT_DIR:-.}}/.grok/hooks/orchestrate-parent.js\"",
+            "timeout": 5
+          }
+        ]
       }
     ],
     "UserPromptSubmit": [

package/.grok/agents/implementer.md

@@ -12,6 +12,7 @@ Voice: `.rulesync/reference/output.md` — must follow.
 Implement specified solution. Never spawn. Never run for simple tool usage (grunt agent). Never plan (thinker agent).
 After write: validate+sim (mandatory). Fix hard failures. Return findings. Never skip validation
 Read/Grep/list_dir only if needed for edit. Prefer: implement the spec; dump via `need:`.
+Write-allowlist = paths listed in the spec/plan only. No unsolicited README/docs/examples. Missing path → blocker/`need:`; do not invent. Checkbox-flip the plan file.
 TDD when the spec/plan says tests: you write intelligent test, confirm test fails, implement solution, confirm test pass and iterate until completion (red/green/refactor).
 Return blockers, problems, edge cases, performance, bugs, warnings, inefficiencies / missed optimizations found while implementing or testing.
 

package/.grok/agents/orchestrator.md

@@ -8,11 +8,14 @@ mcpInheritance: none
 tools: spawn_subagent, read_file, grep, list_dir, write, todo_write, get_command_or_subagent_output, kill_command_or_subagent, run_terminal_command
 ---
 Voice: `.rulesync/reference/output.md` — cite once; apply every turn.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + **one-line** echo only. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
 Protocol: `.rulesync/reference/cascade.md` (peek/kill table need:/resume). Do not paste. Do not open first.
 Always-do:
 
 | signal | next |
 |---|---|
+| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
 | write defined solution | spawn implementer |
@@ -21,11 +24,12 @@ Always-do:
 | child `need:` | parse-need + parallel grunt; `resume_from` + new verdicts; max 3 |
 | ⚠ / validate / sim | spawn implementer with findings; do not recap; spawn; no parent-edit |
 | work remains | spawn; do not stop |
-| children done + no findings | recap; stop allowed |
+| children done + no findings | recap; stop allowed only if no writes remain and spawn count > 0 when the user asked for a file change |
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
+| `/write-plan` plan-only | recap + `next: /implement-plan` |
 
-You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Illegal: `[grunt done]` `[[agent] done]` wait-prose.
+You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + **one-line** echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked. Never spawn `orchestrator`. Children never spawn.
 grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution (not the spec). thinker ← plan/deep reason/spec.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.

package/.grok/agents/thinker.md

@@ -5,12 +5,12 @@ model: grok-4.6
 agents_md: false
 mcpInheritance: none
 permission_mode: bypassPermissions
-tools: read_file, grep, list_dir
+tools: read_file
 ---
 Voice: `.rulesync/reference/output.md` — must follow.
 
 Plan the solution. Deep reason. Never spawn. Never implement (implementer agent). Never run for simple tool usage (grunt agent).
-Read-only. No bash. Tiny Read/Grep/list_dir only if needed to plan. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
+Read-only. No bash. Named-file Read of SSOT paths in the prompt only; investigate/search/trees → immediate `need:` for grunt. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
 Return the spec/plan. Flag edge cases/pitfalls.
 
 Fat dump → stop on this JSON only (≤4/batch; no serial known-parallel):

package/.grok/hooks/orchestrate-parent.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-/** Parent-orchestrator gate: spawn/peek/kill/todo + persistPlan/persistHandoff writes.
+/** PreToolUse parent-deny on Claude+Grok+Antigravity; Stop = first-non-empty-line recap; stop-block survives host banners; SubagentStop is single-registration intercept.
 Parent Read/Grep/Glob/Bash/Web denied unless parent-escape (fat-gate still).
 SubagentStop intercepts need: search|exec with grunt-job verdicts.
 Stop: first-non-empty-line [orchestrator]:/[grunt]:/[implementer]:/[thinker]:/[handoff]: recap
@@ -19,6 +19,7 @@ import {
   fatHookOutput,
   fileSizeBytes,
   isWorkspaceGruntJob,
+  isParentOrchestrator,
   processFatTools,
   resolveReadPath,
   rewriteGruntScratchPath,
@@ -30,23 +31,11 @@ import { parseNeed } from "../../scripts/parse-need.mjs";
 import { resolveJobCwd, runJob } from "../../scripts/grunt-job.mjs";
 import { logTelemetry, ORCHESTRATOR_LOGS_DIR } from "../../scripts/telemetry.mjs";
 
-const DENY_REASON = "parent is orchestrator; spawn grunt|implementer|thinker";
+export const DENY_REASON = "spawn implementer|grunt|thinker";
 export const STOP_REASONS = [
-  "Violation: Stop is not a recap-only wall. XOR one action now. DO NOT stop.\n" +
-    "⚠/validate/sim findings → spawn implementer with them; do not recap; spawn; no parent-edit.\n" +
-    "Else work remains → spawn grunt|implementer|thinker; do not glue done into the tag.\n" +
-    "Else all children returned and no findings → recap `[orchestrator]:` echo.\n" +
-    "Illegal: `[grunt done]` `[[agent] done]`.",
-  "Second violation: still no exclusive next action. XOR one. DO NOT stop.\n" +
-    "⚠/validate/sim findings → spawn implementer with them; do not recap; spawn; no parent-edit.\n" +
-    "Else work remains → spawn grunt|implementer|thinker; do not glue done into the tag.\n" +
-    "Else all children returned and no findings → recap `[orchestrator]:` echo.\n" +
-    "Illegal: `[grunt done]` `[[agent] done]`.",
-  "Third violation: last check before fail-open. XOR one action. DO NOT stop.\n" +
-    "⚠/validate/sim findings → spawn implementer with them; do not recap; spawn; no parent-edit.\n" +
-    "Else work remains → spawn grunt|implementer|thinker; do not glue done into the tag.\n" +
-    "Else all children returned and no findings → recap `[orchestrator]:` echo.\n" +
-    "Illegal: `[grunt done]` `[[agent] done]`.",
+  "Spawn: ⚠/validate/sim findings or writes remain or parent just tried to Write → spawn implementer. Else facts → grunt. Else no spec → thinker. Else recap `[orchestrator]:` one-line.",
+  "Still spawn: ⚠/validate/sim findings or writes remain or parent just tried to Write → spawn implementer. Else facts → grunt. Else no spec → thinker. Else recap `[orchestrator]:` one-line.",
+  "Last spawn: ⚠/validate/sim findings or writes remain or parent just tried to Write → spawn implementer. Else facts → grunt. Else no spec → thinker. Else recap `[orchestrator]:` one-line.",
 ];
 const TRANSCRIPT_TAIL_BYTES = 512 * 1024;
 const PARENT_TOOLS = new Set([
@@ -62,7 +51,23 @@ const SPAWN_TOOLS = new Set([
   "agent",
   "spawnagent",
 ]);
-const WRITE_TOOLS = new Set(["write"]);
+const WRITE_TOOLS = new Set([
+  "write",
+  "edit",
+  "searchreplace",
+  "replacefilecontent",
+]);
+const BASH_TOOLS = new Set(["bash", "runterminalcommand", "runcommand"]);
+const SKILL_TOOLS = new Set(["skill"]);
+const PARENT_SKILLS = new Set([
+  "parent",
+  "explain",
+  "solo",
+  "cascade",
+  "handoff",
+  "write-plan",
+  "implement-plan",
+]);
 const READ_TOOLS = new Set(["readfile", "read"]);
 const INTERCEPT_JOBS = new Set(["search", "exec"]);
 const MAX_STOP = 3;
@@ -100,7 +105,7 @@ function preToolUse(data) {
   logPreTool(data, toolKey, toolInput);
 
   const sub = subagentTypeOf(data);
-  if (sub) {
+  if (sub || !isParentOrchestrator(data)) {
     const code = emitFat(data);
     return code == null ? 0 : code;
   }
@@ -133,6 +138,14 @@ function preToolUse(data) {
     emit({ decision: "allow" });
     return 0;
   }
+  if (BASH_TOOLS.has(toolKey) && isAllowedParentGruntJob(bashCommandOf(toolInput), workspaceRootOf(data))) {
+    emit({ decision: "allow" });
+    return 0;
+  }
+  if (SKILL_TOOLS.has(toolKey) && isAllowedParentSkill(toolInput)) {
+    emit({ decision: "allow" });
+    return 0;
+  }
   if (hasParentEscape(data)) {
     const fatCode = emitFat(data);
     if (fatCode !== null) return fatCode;
@@ -222,6 +235,40 @@ export function isAllowedParentGruntJob(command, workspaceRoot) {
   return isWorkspaceGruntJob(command, workspaceRoot, ["search", "exec"]);
 }
 
+function bashCommandOf(toolInput) {
+  if (!toolInput || typeof toolInput !== "object" || Array.isArray(toolInput)) {
+    return "";
+  }
+  return String(toolInput.command ?? toolInput.cmd ?? "");
+}
+
+function skillNameOf(toolInput) {
+  if (!toolInput || typeof toolInput !== "object" || Array.isArray(toolInput)) {
+    return "";
+  }
+  const raw =
+    toolInput.skill ??
+    toolInput.skill_name ??
+    toolInput.skillName ??
+    toolInput.name ??
+    "";
+  const s = String(raw).trim().toLowerCase().replace(/\\/g, "/");
+  const base = s.split("/").pop() || "";
+  return base.replace(/\.md$/, "").replace(/_/g, "-");
+}
+
+export function isAllowedParentSkill(toolInput) {
+  return PARENT_SKILLS.has(skillNameOf(toolInput));
+}
+
+function isHostStopBanner(prompt) {
+  const p = String(prompt || "");
+  if (/^\s*Stop hook feedback:/.test(p)) return true;
+  if (/Blocked by stop hook/.test(p)) return true;
+  if (/task[-_ ]?notification/i.test(p)) return true;
+  return false;
+}
+
 function parentWrite(data, toolInput) {
   if (!toolInput || typeof toolInput !== "object" || Array.isArray(toolInput)) {
     emit({ decision: "deny", reason: DENY_REASON });
@@ -238,6 +285,10 @@ function parentWrite(data, toolInput) {
   if (rewritten) rawPath = rewritten;
   const handoff = isUnderHandoffs(rawPath, ws);
   if (!handoff && !isUnderPlans(rawPath, ws)) {
+    if (hasParentEscape(data)) {
+      emit({ decision: "allow" });
+      return 0;
+    }
     emit({ decision: "deny", reason: DENY_REASON });
     return 0;
   }
@@ -301,7 +352,7 @@ function isParentEscapePrompt(prompt) {
 function userPromptSubmit(data) {
   unlinkQuiet(stampPath(data, "tools-used"));
   const prompt = userPromptOf(data);
-  if (!/^\s*Stop hook feedback:/.test(prompt)) {
+  if (!isHostStopBanner(prompt)) {
     unlinkQuiet(stampPath(data, "stop-block"));
   }
   // Sticky: only /solo and /cascade move it. Every other prompt leaves it alone.

package/.grok/hooks/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/.grok/skills/implement-plan/SKILL.md

@@ -55,6 +55,7 @@ You are implementer subagent. Do not spawn.
 Read {abs}/.grok/skills/shared/plan-format.md and the plan at {abs_plan_path}.
 
 Implement remaining `[ ]` leaves in numeric order. Skip `[x]`.
+Write-allowlist = paths listed in this plan only. Do not add README/docs/examples unless listed in the plan. Missing path → blocker/`need:`; do not invent.
 After each leaf: flip that line to `[x]` in the plan file (only the box).
 When a phase's children are all `[x]`, mark the phase `[x]`.
 Frontmatter status: in-progress at start; done when all boxes `[x]`; blocked if you cannot finish.

package/.grok/skills/write-plan/SKILL.md

@@ -39,6 +39,8 @@ Prompt:
 ```
 You are thinker subagent. Read-only. Do not write files. Do not spawn.
 
+Named-file Read of listed abs paths only; investigate/search/trees → `need:` (parent prefetch still allowed).
+
 Read {abs}/.grok/skills/shared/plan-format.md. Produce a plan that matches it.
 
 Task:

package/.rulesync/hooks.jsonc

@@ -12,15 +12,18 @@
       },
       {
         // Fat Read/Grep/Glob/Bash + Write/Edit scratch rewrite (never deny writes).
-        // Parent-deny stays Grok-only (orchestrate-parent.js).
         "matcher": "Read|read_file|Grep|grep|Glob|list_dir|Bash|run_terminal_command|Write|Edit|write|search_replace",
         "type": "command",
         "command": "node \"${GROK_WORKSPACE_ROOT:-${CLAUDE_PROJECT_DIR:-.}}/scripts/gate-fat-tools.mjs\"",
         "timeout": 5
+      },
+      {
+        "matcher": "Write|Edit|write|search_replace|Bash|run_terminal_command|Skill|skill|replace_file_content|run_command",
+        "type": "command",
+        "command": "node \"${GROK_WORKSPACE_ROOT:-${CLAUDE_PROJECT_DIR:-.}}/.grok/hooks/orchestrate-parent.js\"",
+        "timeout": 5
       }
     ],
-    // Parent Stop + /parent stamp. PreToolUse parent-deny stays Grok-only
-    // (child subagentType/agent_type unverified on these hosts).
     "beforeSubmitPrompt": [
       {
         "type": "command",

package/.rulesync/reference/cascade.md

@@ -13,15 +13,16 @@ Always-do lives in orchestrator/overview (do not open this file first). Peek/kil
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.
 
 Always spawn + prompt. First token = spawn. No try-then-spawn. No parent probe. No tiny-read/grep/list_dir/bash/grunt-job for the user. No skip-spawn. `/parent` is the only parent-tool escape.
+Create/change product files → first token spawn implementer (thinker then implementer if no spec). Never parent Write/Edit/Bash/Skill-that-writes. Child returned is not terminal if writes remain or spawn count is 0 on a file-change turn. plan/spec ready + writes remain → persist plan if needed; spawn implementer; do not recap-stop. plan-only `/write-plan` → recap + `next: /implement-plan`.
 
-1. Tools (facts / search / exec / git / web / test / low-reason mechanical write) → grunt.
+1. Tools (facts / search / exec / git / web / test / low-reason mechanical write) → grunt. Facts/search → grunt, never thinker.
 2. Write defined solution → implementer.
 3. Plan / deep reason (edge cases / pitfalls) → thinker.
 4. Fresh/world facts → grunt `job: web`. Never answer from memory.
 
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked.
 
-Implementer/thinker may tiny-Read/Grep/list_dir themselves. Fat dumps via `need:` JSON.
+Implementer may tiny-Read/Grep/list_dir. Thinker named-file Read of prompt SSOT only; investigate/search/trees → `need:` grunt. Fat dumps via `need:` JSON.
 
 Long parent sessions rely on two-pass compaction; prefer a new parent session per task rather than unbounded resume chains. `[features] two_pass_compaction = true` must live in `~/.grok/config.toml` (from `.grok/global-settings.toml` via `npm run sync:globals` dry-run / `npm run sync:globals:apply`). Project `.grok/config.toml` cannot set `[features]`. Do not add a SessionStart hook.
 
@@ -34,7 +35,7 @@ Classify `done` | `alive` | `stuck` vs prior peek: **done** (completed/failed),
 Loop until done. No auto-kill. Kill only if the user asks and the host has a kill tool.
 Then print recap as `[orchestrator]: …` (or the child role tag) with real child output. Do not redo the child's work.
 
-Parent Stop (`MAX_STOP=3`): do not waive fenced/impl finals for `tools-used` stamp. First non-empty line must match legal `[orchestrator|grunt|implementer|thinker|handoff]:`. Illegal: `[grunt done]` `[[agent] done]` wait-prose. Siblings still run → role tag + echo, not `[grunt done]`. Or consume `parent-escape-{sid}` once. Else block. No `isCheap` / trivia / long definitions.
+Parent Stop (`MAX_STOP=3`): do not waive fenced/impl finals for `tools-used` stamp. Parent `end_turn` is tagged+one-line or `[orchestrator]: wait grunt`. First non-empty line must match legal `[orchestrator|grunt|implementer|thinker|handoff]:`. Siblings still run → role tag + one-line echo. In-flight wait recap is `[orchestrator]: wait grunt` only. Or consume `parent-escape-{sid}` once. Else block. No `isCheap` / trivia / long definitions.
 `/handoff` is the other in-parent turn: context large + work unfinished → parent writes one `.tmp/grunt/handoffs/` file from its own transcript (no child sees the session), recaps `[handoff]: serial=… path=…`, tells the user to continue in a new session. No spawn, one write, not a mode.
 `/solo` is the session mode (not one-turn): `beforeSubmitPrompt` writes `.tmp/orchestrator-logs/grunt-off-{sid}`, every gate short-circuits while it exists, `/cascade` unlinks it. Everything above resumes next turn. Antigravity: skill-only, no stamp create (see hooks.md). `/parent` is one-turn (not a mode): UserPromptSubmit writes `.tmp/orchestrator-logs/parent-escape-{sid}`; Stop consumes+unlinks once. Next Stop resumes spawn/recap rules. Skills point here; do not paste this file.
 
@@ -43,7 +44,7 @@ Host mapping (in-tree only; do not invent peek/kill APIs). GAP rows: no fake pee
 | Host | Spawn | Peek | Kill |
 | --- | --- | --- | --- |
 | Grok | `spawn_subagent` `background:true` → `task_id` | `get_command_or_subagent_output` + `timeout_ms=60000` | `kill_command_or_subagent` (user-ask only) |
-| Claude Code | `Agent` if the parent session exposes it | GAP unless an in-tree schema names a status/output tool on that id (do not invent `TaskOutput`); else block on Agent return and classify `done`. Agent launch ≠ child done; in-flight host Stop → only `[orchestrator]: wait grunt` (or role echo); no SendMessage | GAP unless in-tree; no auto-kill |
+| Claude Code | `Agent` if the parent session exposes it | GAP unless an in-tree schema names a status/output tool on that id (do not invent `TaskOutput`); else block on Agent return and classify `done`. Agent launch ≠ child done; in-flight host Stop → only `[orchestrator]: wait grunt`; no SendMessage | GAP unless in-tree; no auto-kill |
 | Codex | host agent/call | GAP; block on host agent/call return; classify `done` | GAP; no auto-kill |
 | Antigravity | main-session parent | GAP peek/kill; main-session parent | GAP; no auto-kill |
 | Gemini | not emitted; tracked gap | GAP; no fake peeks | GAP; no auto-kill |

package/.rulesync/reference/hooks.md

@@ -10,9 +10,11 @@ Grok PostToolUse / UserPromptSubmit / SessionStart are observe-only — do not a
 
 Claude / Codex / Antigravity PreToolUse still run `scripts/scrub-spawn-prompt.mjs` and `scripts/gate-fat-tools.mjs`. Grok does not — spawn/fat rewrite is `orchestrate-parent.js` only. RTK stays `rtk.json`.
 
+Parent Write|Edit|Bash|Skill-that-writes is deny on Claude+Grok+Antigravity unless `/parent`. `.tmp/plans/` and `.tmp/grunt/handoffs/` Write still persist. Parent Bash still allowed for workspace `grunt-job.mjs` `--job search|exec`. Children with a type skip parent-deny (fat-only). Skill allowlist without escape: `parent|explain|solo|cascade|handoff|write-plan|implement-plan`. Deny reason: `spawn implementer|grunt|thinker`. Parent `end_turn` is tagged+one-line or `[orchestrator]: wait grunt`.
+
 Parent `run_terminal_command` is deny-by-default except `node` (optional leading `rtk`) invoking `{workspace}/scripts/grunt-job.mjs` with `--job search|exec` and `--query`. Optional `--path` `--glob` (repeatable) `--cwd`. Not `web|test`, not other scripts. META strips `--query` value first so `|` inside query is allowed; pipes/`&&` outside query still deny. Never `cd &&`. Exec shell-meta in query is grunt-job FALLBACK (exit 2), not a parent-bash allow. Unknown flags → FALLBACK.
 
-SubagentStop (and child Stop with `subagentType`) intercepts a parseable `need:` whose jobs are all `search|exec` (cap 4): runs grunt-job in-hook and continues the child with concatenated `verdict:` blobs. Mixed/web/test, parse fail, FALLBACK, `stopHookActive`, or more than 3 intercepts per child session → empty stdout (allow stop; parent LLM path). Parent `write` is deny-by-default except `.tmp/plans/` (`persist-plan.mjs`) and `.tmp/grunt/handoffs/` (`persist-handoff.mjs`); both validate + rewrite path/content, invalid body denies. Parent Stop (`MAX_STOP=3`): do not waive impl finals for `tools-used`. First non-empty line must match legal `[orchestrator|grunt|implementer|thinker|handoff]:`. Illegal: `[grunt done]` `[[agent] done]` wait-prose. Claude Agent launch ≠ done; in-flight host Stop → wait recap only (`[orchestrator]: wait grunt` or role echo); no SendMessage. Or consume `parent-escape-{sid}` once (`/parent`). No `isCheap` / trivia. Stamps: `tools-used` / `stop-block` / `need-intercept` / `parent-escape`. Skills point to cascade; do not paste protocol here.
+SubagentStop (and child Stop with `subagentType`) intercepts a parseable `need:` whose jobs are all `search|exec` (cap 4): runs grunt-job in-hook and continues the child with concatenated `verdict:` blobs. Mixed/web/test, parse fail, FALLBACK, `stopHookActive`, or more than 3 intercepts per child session → empty stdout (allow stop; parent LLM path). Parent `write` is deny-by-default except `.tmp/plans/` (`persist-plan.mjs`) and `.tmp/grunt/handoffs/` (`persist-handoff.mjs`); both validate + rewrite path/content, invalid body denies. Parent Stop (`MAX_STOP=3`): do not waive impl finals for `tools-used`. Parent `end_turn` is tagged+one-line or `[orchestrator]: wait grunt`. First non-empty line must match legal `[orchestrator|grunt|implementer|thinker|handoff]:`. Claude Agent launch ≠ done; in-flight host Stop → wait recap `[orchestrator]: wait grunt` only; no SendMessage. Or consume `parent-escape-{sid}` once (`/parent`). No `isCheap` / trivia. Stamps: `tools-used` / `stop-block` / `need-intercept` / `parent-escape`. Skills point to cascade; do not paste protocol here.
 
 `/solo` writes `grunt-off-{sid}`; `/cascade` unlinks it (`beforeSubmitPrompt`, exact-match only). While set: PreToolUse allows parent tools (fat gate still runs) and skips the `defaultGrunt` spawn rewrite; Stop returns 0 **before** the `parent-escape` consume, so solo never burns the one-turn stamp. Session-scoped, fail-closed.
 

package/.rulesync/reference/output.md

@@ -4,4 +4,4 @@ tags: [output]
 
 # Output
 
-en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + one-line echo only

package/.rulesync/rules/CLAUDE.md

@@ -4,12 +4,15 @@ targets:
   - claudecode
 ---
 Voice: `.rulesync/reference/output.md` — cite once; apply every turn.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + one-line echo only. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
 All output exclude AI attribution, Co-Authored-By, trailers, generated markers.
 Protocol: `.rulesync/reference/cascade.md`. Do not paste. Do not open first.
 Always-do:
 
 | signal | next |
 |---|---|
+| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
 | write defined solution | spawn implementer |
@@ -18,13 +21,14 @@ Always-do:
 | child `need:` | parse-need + parallel grunt; `resume_from` + new verdicts; max 3 |
 | ⚠ / validate / sim | spawn implementer with findings; do not recap; spawn; no parent-edit |
 | work remains | spawn; do not stop |
-| children done + no findings | recap; stop allowed |
+| children done + no findings | recap; stop allowed only if no writes remain and spawn count > 0 when the user asked for a file change |
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
+| `/write-plan` plan-only | recap + `next: /implement-plan` |
 
 Parent = this file not `.claude/agents/orchestrator.md`. You do not talk. Spawn wait echo.
 Spawn only grunt|implementer|thinker. Never spawn orchestrator. Children never spawn.
-First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + echo only. Siblings still run: `[grunt]:` echo. Illegal: `[grunt done]` `[[agent] done]` wait-prose. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
+First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + one-line echo only. Siblings still run: `[grunt]:` echo. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
 grunt ← tools (facts/search/exec/git/web/test/low-reason mechanical write; world fact: `job: web` never memory). implementer ← write defined solution. thinker ← plan/deep reason.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.
 Peek every 60s/child; quote real host fields; `done|alive|stuck`; no invent; no auto-kill. `timeout_ms=60000` every peek. GAP: block on spawn return = `done`. Stuck/blocked: quote host fields only.

package/.rulesync/rules/overview.md

@@ -9,12 +9,15 @@ globs:
   - "**/*"
 ---
 Voice: `.rulesync/reference/output.md` — cite once; apply every turn.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + one-line echo only. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
 All output exclude AI attribution, Co-Authored-By, trailers, generated markers.
 Protocol: `.rulesync/reference/cascade.md`. Do not paste. Do not open first.
 Always-do:
 
 | signal | next |
 |---|---|
+| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
 | write defined solution | spawn implementer |
@@ -23,13 +26,14 @@ Always-do:
 | child `need:` | parse-need + parallel grunt; `resume_from` + new verdicts; max 3 |
 | ⚠ / validate / sim | spawn implementer with findings; do not recap; spawn; no parent-edit |
 | work remains | spawn; do not stop |
-| children done + no findings | recap; stop allowed |
+| children done + no findings | recap; stop allowed only if no writes remain and spawn count > 0 when the user asked for a file change |
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
+| `/write-plan` plan-only | recap + `next: /implement-plan` |
 
 Parent = orchestrator. You do not talk. Spawn wait echo.
 Spawn only grunt|implementer|thinker. Never spawn orchestrator. Children never spawn.
-First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + echo only. Siblings still run: `[grunt]:` echo. Illegal: `[grunt done]` `[[agent] done]` wait-prose. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
+First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + one-line echo only. Siblings still run: `[grunt]:` echo. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
 grunt ← tools (facts/search/exec/git/web/test/low-reason mechanical write; world fact: `job: web` never memory). implementer ← write defined solution. thinker ← plan/deep reason.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.
 Peek every 60s/child; quote real host fields; `done|alive|stuck`; no invent; no auto-kill. `timeout_ms=60000` every peek. GAP: block on spawn return = `done`. Stuck/blocked: quote host fields only.

package/.rulesync/subagents/implementer.md

@@ -34,6 +34,7 @@ Voice: `.rulesync/reference/output.md` — must follow.
 Implement specified solution. Never spawn. Never run for simple tool usage (grunt agent). Never plan (thinker agent).
 After write: validate+sim (mandatory). Fix hard failures. Return findings. Never skip validation
 Read/Grep/list_dir only if needed for edit. Prefer: implement the spec; dump via `need:`.
+Write-allowlist = paths listed in the spec/plan only. No unsolicited README/docs/examples. Missing path → blocker/`need:`; do not invent. Checkbox-flip the plan file.
 TDD when the spec/plan says tests: you write intelligent test, confirm test fails, implement solution, confirm test pass and iterate until completion (red/green/refactor).
 Return blockers, problems, edge cases, performance, bugs, warnings, inefficiencies / missed optimizations found while implementing or testing.
 

package/.rulesync/subagents/orchestrator.md

@@ -34,11 +34,14 @@ geminicli:
   model: gemini-2.5-flash
 ---
 Voice: `.rulesync/reference/output.md` — cite once; apply every turn.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + **one-line** echo only. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
 Protocol: `.rulesync/reference/cascade.md` (peek/kill table need:/resume). Do not paste. Do not open first.
 Always-do:
 
 | signal | next |
 |---|---|
+| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
 | write defined solution | spawn implementer |
@@ -47,11 +50,12 @@ Always-do:
 | child `need:` | parse-need + parallel grunt; `resume_from` + new verdicts; max 3 |
 | ⚠ / validate / sim | spawn implementer with findings; do not recap; spawn; no parent-edit |
 | work remains | spawn; do not stop |
-| children done + no findings | recap; stop allowed |
+| children done + no findings | recap; stop allowed only if no writes remain and spawn count > 0 when the user asked for a file change |
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
+| `/write-plan` plan-only | recap + `next: /implement-plan` |
 
-You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + echo only. Siblings still run: `[grunt]:` echo. Illegal: `[grunt done]` `[[agent] done]` wait-prose.
+You do not talk. First token = spawn. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + **one-line** echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked. Never spawn `orchestrator`. Children never spawn.
 grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution (not the spec). thinker ← plan/deep reason/spec.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.

package/.rulesync/subagents/thinker.md

@@ -6,14 +6,14 @@ claudecode:
   model: opus
   effort: high
   permissionMode: bypassPermissions
-  tools: [Read, Grep, Glob]
-  disallowedTools: [Agent, Write, Edit, Bash]
+  tools: [Read]
+  disallowedTools: [Agent, Write, Edit, Bash, Grep, Glob]
 grokcli:
   model: grok-4.6
   agents_md: false
   mcpInheritance: none
   permission_mode: bypassPermissions
-  tools: read_file, grep, list_dir
+  tools: read_file
 codexcli:
   model: gpt-5.4
   model_reasoning_effort: high
@@ -25,14 +25,14 @@ antigravity-cli:
   mainAgent: false
   inheritMcp: false
   commandExecutionPolicy: eager
-  tools: [view_file, grep_search]
+  tools: [view_file]
 geminicli:
   model: gemini-2.5-pro
 ---
 Voice: `.rulesync/reference/output.md` — must follow.
 
 Plan the solution. Deep reason. Never spawn. Never implement (implementer agent). Never run for simple tool usage (grunt agent).
-Read-only. No bash. Tiny Read/Grep/list_dir only if needed to plan. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
+Read-only. No bash. Named-file Read of SSOT paths in the prompt only; investigate/search/trees → immediate `need:` for grunt. Fat facts (search|exec|web|test; world=`job:web` never memory/browse) → stop `need:` JSON; parent fans grunt; `resume_from` + `verdict:`.
 Return the spec/plan. Flag edge cases/pitfalls.
 
 Fat dump → stop on this JSON only (≤4/batch; no serial known-parallel):

package/AGENTS.md

@@ -1,10 +1,13 @@
 Voice: `.rulesync/reference/output.md` — cite once; apply every turn.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + one-line echo only. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
 All output exclude AI attribution, Co-Authored-By, trailers, generated markers.
 Protocol: `.rulesync/reference/cascade.md`. Do not paste. Do not open first.
 Always-do:
 
 | signal | next |
 |---|---|
+| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
 | write defined solution | spawn implementer |
@@ -13,13 +16,14 @@ Always-do:
 | child `need:` | parse-need + parallel grunt; `resume_from` + new verdicts; max 3 |
 | ⚠ / validate / sim | spawn implementer with findings; do not recap; spawn; no parent-edit |
 | work remains | spawn; do not stop |
-| children done + no findings | recap; stop allowed |
+| children done + no findings | recap; stop allowed only if no writes remain and spawn count > 0 when the user asked for a file change |
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
+| `/write-plan` plan-only | recap + `next: /implement-plan` |
 
 Parent = orchestrator. You do not talk. Spawn wait echo.
 Spawn only grunt|implementer|thinker. Never spawn orchestrator. Children never spawn.
-First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + echo only. Siblings still run: `[grunt]:` echo. Illegal: `[grunt done]` `[[agent] done]` wait-prose. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
+First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + one-line echo only. Siblings still run: `[grunt]:` echo. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
 grunt ← tools (facts/search/exec/git/web/test/low-reason mechanical write; world fact: `job: web` never memory). implementer ← write defined solution. thinker ← plan/deep reason.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.
 Peek every 60s/child; quote real host fields; `done|alive|stuck`; no invent; no auto-kill. `timeout_ms=60000` every peek. GAP: block on spawn return = `done`. Stuck/blocked: quote host fields only.

package/CLAUDE.md

@@ -1,10 +1,13 @@
 Voice: `.rulesync/reference/output.md` — cite once; apply every turn.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + one-line echo only. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
 All output exclude AI attribution, Co-Authored-By, trailers, generated markers.
 Protocol: `.rulesync/reference/cascade.md`. Do not paste. Do not open first.
 Always-do:
 
 | signal | next |
 |---|---|
+| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
 | write defined solution | spawn implementer |
@@ -13,13 +16,14 @@ Always-do:
 | child `need:` | parse-need + parallel grunt; `resume_from` + new verdicts; max 3 |
 | ⚠ / validate / sim | spawn implementer with findings; do not recap; spawn; no parent-edit |
 | work remains | spawn; do not stop |
-| children done + no findings | recap; stop allowed |
+| children done + no findings | recap; stop allowed only if no writes remain and spawn count > 0 when the user asked for a file change |
 | `/parent` | one-turn parent tools |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
+| `/write-plan` plan-only | recap + `next: /implement-plan` |
 
 Parent = this file not `.claude/agents/orchestrator.md`. You do not talk. Spawn wait echo.
 Spawn only grunt|implementer|thinker. Never spawn orchestrator. Children never spawn.
-First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + echo only. Siblings still run: `[grunt]:` echo. Illegal: `[grunt done]` `[[agent] done]` wait-prose. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
+First token = spawn. No try-then-spawn. No parent probe. After child: legal tag + one-line echo only. Siblings still run: `[grunt]:` echo. No skip-spawn. /parent = one-turn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`.
 grunt ← tools (facts/search/exec/git/web/test/low-reason mechanical write; world fact: `job: web` never memory). implementer ← write defined solution. thinker ← plan/deep reason.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.
 Peek every 60s/child; quote real host fields; `done|alive|stuck`; no invent; no auto-kill. `timeout_ms=60000` every peek. GAP: block on spawn return = `done`. Stuck/blocked: quote host fields only.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovrozagar/grunt",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "Multi-agent orchestrator SoT — deep-merge rulesync trees, product scripts, and generate pipeline into a consumer repo",
   "keywords": [
     "agents",

package/scripts/gate-fat-tools.mjs

@@ -8,7 +8,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 export const DEFAULT_GREP_HEAD_LIMIT = 50;
 /** Parent Read line limit when the model omits one. */
 export const DEFAULT_READ_LIMIT = 200;
-/** Implementer/thinker (and unknown non-grunt) Grep head_limit when omitted. */
+/** Implementer (and unknown non-grunt) Grep head_limit when omitted. */
 export const CHILD_GREP_HEAD_LIMIT = 150;
 /** Implementer/thinker (and unknown non-grunt) Read line limit when omitted. */
 export const CHILD_READ_LIMIT = 400;
@@ -37,6 +37,8 @@ export const REASON_HEAD_LIMIT =
 export const REASON_FILE_SIZE = "spawn grunt job:search; file >200KB";
 export const REASON_IMPLEMENTER_BASH =
   "need: grunt job:exec|test query:…";
+export const REASON_THINKER_TOOLS = "need: grunt job:search query:…";
+export const REASON_IMPLEMENTER_WRITE = "need: path not in spec/plan";
 
 const READ_TOOLS = new Set(["read", "readfile"]);
 const GREP_TOOLS = new Set(["grep", "grepsearch"]);
@@ -77,19 +79,69 @@ export function eventKey(s) {
     .replace(/[^a-z0-9]/g, "");
 }
 
+const CHILD_TYPE_KEYS = [
+  "subagentType",
+  "subagent_type",
+  "agentType",
+  "agent_type",
+  "agentName",
+  "agent_name",
+];
+const CHILD_ID_KEYS = ["agentId", "agent_id", "spawnedBy", "spawned_by"];
+
+function nonEmptyChildId(raw) {
+  if (raw == null) return false;
+  return String(raw).trim() !== "";
+}
+
+/** True when PreToolUse names a child session (UUID ok). Not a fat-gate type. */
+export function hasChildAgentMarker(data) {
+  if (!data || typeof data !== "object") return false;
+  for (const k of CHILD_ID_KEYS) {
+    if (nonEmptyChildId(data[k])) return true;
+  }
+  if (data.agent && typeof data.agent === "object" && !Array.isArray(data.agent)) {
+    for (const k of [...CHILD_ID_KEYS, "id"]) {
+      if (nonEmptyChildId(data.agent[k])) return true;
+    }
+  }
+  return false;
+}
+
+function coerceChildType(raw) {
+  if (raw == null) return "";
+  const s = String(raw).trim().toLowerCase();
+  if (!s) return "";
+  if (
+    /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s)
+  ) {
+    return "";
+  }
+  if (/^[0-9]+$/.test(s)) return "";
+  if (s.length > 64 || /[\/\\]/.test(s)) return "";
+  return s;
+}
+
 export function subagentTypeOf(data) {
   if (!data || typeof data !== "object") return "";
-  const raw =
-    data.subagentType ??
-    data.subagent_type ??
-    data.agentType ??
-    data.agent_type ??
-    "";
-  return String(raw).trim().toLowerCase();
+  for (const k of [...CHILD_TYPE_KEYS, ...CHILD_ID_KEYS]) {
+    const t = coerceChildType(data[k]);
+    if (t) return t;
+  }
+  if (data.agent && typeof data.agent === "object" && !Array.isArray(data.agent)) {
+    for (const k of ["subagentType", "subagent_type", "type", "name", "agentType"]) {
+      const t = coerceChildType(data.agent[k]);
+      if (t) return t;
+    }
+  } else if (typeof data.agent === "string") {
+    const t = coerceChildType(data.agent);
+    if (t) return t;
+  }
+  return "";
 }
 
 export function isParentOrchestrator(data) {
-  return !subagentTypeOf(data);
+  return !subagentTypeOf(data) && !hasChildAgentMarker(data);
 }
 
 export function toolInputOf(data) {
@@ -175,8 +227,8 @@ export function rewriteGruntScratchPath(filePath, workspaceRoot) {
 
 export function workspaceRootOf(data) {
   return (
-    process.env.GROK_WORKSPACE_ROOT ||
     (data && (data.workspaceRoot || data.workspace_root || data.cwd)) ||
+    process.env.GROK_WORKSPACE_ROOT ||
     process.cwd()
   );
 }
@@ -378,6 +430,110 @@ export function implementerBashReason(command, workspaceRoot) {
   return null;
 }
 
+function resolveWriteAbs(filePath, workspaceRoot) {
+  if (!filePath || typeof filePath !== "string") return null;
+  return path.isAbsolute(filePath)
+    ? path.resolve(filePath)
+    : path.resolve(workspaceRoot, filePath);
+}
+
+function isUnderPlansDir(abs, workspaceRoot) {
+  if (!abs || !workspaceRoot) return false;
+  const dir = path.resolve(workspaceRoot, ".tmp", "plans");
+  if (abs === dir) return true;
+  const rel = path.relative(dir, abs);
+  return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+
+function isUnsolicitedDocPath(abs) {
+  if (!abs) return false;
+  if (path.basename(abs) === "README.md") return true;
+  const segs = abs.replace(/\\/g, "/").split("/");
+  return segs.includes("docs") || segs.includes("examples");
+}
+
+function addPlanPath(set, raw, workspaceRoot) {
+  let s = String(raw || "").trim();
+  if (!s) return;
+  if (/^https?:\/\//i.test(s)) return;
+  s = s.replace(/[.,;:]+$/, "");
+  if (!s || /^https?:\/\//i.test(s)) return;
+  if (/^\/[A-Za-z][\w-]*$/.test(s)) return;
+  if (!s.includes("/") && !s.includes("\\") && !s.includes(".")) return;
+  const abs = resolveWriteAbs(s, workspaceRoot);
+  if (abs) set.add(abs);
+}
+
+function extractPlanPaths(text, workspaceRoot) {
+  const set = new Set();
+  const body = String(text || "");
+  for (const m of body.matchAll(/`([^`\n]+)`/g)) {
+    addPlanPath(set, m[1], workspaceRoot);
+  }
+  for (const m of body.matchAll(
+    /(^|[\s("'[=])(\/(?:[A-Za-z0-9._@+-]+\/)+[A-Za-z0-9._@+-]+)/g,
+  )) {
+    addPlanPath(set, m[2], workspaceRoot);
+  }
+  return set;
+}
+
+function inProgressStatus(text) {
+  const s = String(text || "");
+  if (!s.startsWith("---\n")) return false;
+  const end = s.indexOf("\n---\n", 4);
+  if (end === -1) return false;
+  return /^status:\s*in-progress\s*$/m.test(s.slice(4, end));
+}
+
+function loadInProgressPlans(workspaceRoot) {
+  const dir = path.resolve(workspaceRoot, ".tmp", "plans");
+  let names;
+  try {
+    names = fs.readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const name of names) {
+    if (!name.endsWith(".md")) continue;
+    const abs = path.resolve(dir, name);
+    let text;
+    try {
+      text = fs.readFileSync(abs, "utf8");
+    } catch {
+      continue;
+    }
+    if (!inProgressStatus(text)) continue;
+    out.push({ abs, text });
+  }
+  return out;
+}
+
+function implementerWriteDeny(input, workspaceRoot) {
+  const ws = path.resolve(workspaceRoot);
+  const plans = loadInProgressPlans(ws);
+  const allow = new Set();
+  for (const p of plans) {
+    allow.add(p.abs);
+    for (const extracted of extractPlanPaths(p.text, ws)) {
+      allow.add(extracted);
+    }
+  }
+  const hasInProgress = plans.length > 0;
+  for (const key of WRITE_PATH_FIELDS) {
+    if (typeof input[key] !== "string" || !input[key]) continue;
+    const abs = resolveWriteAbs(input[key], ws);
+    if (!abs) continue;
+    if (isUnderPlansDir(abs, ws)) continue;
+    if (allow.has(abs)) continue;
+    if (isUnsolicitedDocPath(abs) || hasInProgress) {
+      return { type: "deny", reason: REASON_IMPLEMENTER_WRITE };
+    }
+  }
+  return null;
+}
+
 /**
  * @returns {null | { type: "deny", reason: string } | { type: "rewrite", updatedInput: object }}
  */
@@ -399,6 +555,10 @@ export function processFatTools(data) {
         changed = true;
       }
     }
+    if (subagentTypeOf(data) === "implementer") {
+      const denied = implementerWriteDeny(next, ws);
+      if (denied) return denied;
+    }
     return changed ? { type: "rewrite", updatedInput: next } : null;
   }
   const sub = subagentTypeOf(data);
@@ -410,6 +570,10 @@ export function processFatTools(data) {
   const isGlob = GLOB_TOOLS.has(toolKey);
   const isBash = BASH_TOOLS.has(toolKey);
 
+  if (sub === "thinker" && (isGrep || isGlob || isBash)) {
+    return { type: "deny", reason: REASON_THINKER_TOOLS };
+  }
+
   if (isRead || isGrep || isGlob) {
     for (const v of collectPathValues(input)) {
       if (pathIsDenied(v)) return { type: "deny", reason: REASON_DENYLIST };

package/scripts/scrub-spawn-prompt.mjs

@@ -123,6 +123,28 @@ export function capSpawnPrompt(prompt) {
   return (again.body + verdictPart).trim();
 }
 
+const SPAWN_TYPE_KEYS = ["subagent_type", "subagentType", "name", "type", "agent"];
+const FORBIDDEN_SPAWN_TYPES = new Set([
+  "explore",
+  "plan",
+  "general-purpose",
+  "orchestrator",
+]);
+
+function spawnTypeCandidate(toolInput) {
+  for (const k of SPAWN_TYPE_KEYS) {
+    if (!Object.prototype.hasOwnProperty.call(toolInput, k)) continue;
+    if (toolInput[k] == null) continue;
+    const v = String(toolInput[k]).trim();
+    if (!v) continue;
+    const key = v.toLowerCase();
+    if (ALLOWED_TYPES.has(key)) return key;
+    if (FORBIDDEN_SPAWN_TYPES.has(key)) return "";
+    return "";
+  }
+  return "";
+}
+
 export function rewriteSpawnToolInput(toolInput, { defaultGrunt = false } = {}) {
   if (!toolInput || typeof toolInput !== "object" || Array.isArray(toolInput)) {
     return defaultGrunt ? { subagent_type: "grunt" } : null;
@@ -132,13 +154,13 @@ export function rewriteSpawnToolInput(toolInput, { defaultGrunt = false } = {})
   let changed = false;
 
   if (defaultGrunt) {
-    const cur =
-      toolInput.subagent_type != null
-        ? String(toolInput.subagent_type).trim()
-        : toolInput.subagentType != null
-          ? String(toolInput.subagentType).trim()
-          : "";
-    if (!ALLOWED_TYPES.has(cur)) {
+    const cur = spawnTypeCandidate(toolInput);
+    if (ALLOWED_TYPES.has(cur)) {
+      if (String(next.subagent_type || "") !== cur) {
+        next.subagent_type = cur;
+        changed = true;
+      }
+    } else {
       next.subagent_type = "grunt";
       if (Object.prototype.hasOwnProperty.call(toolInput, "subagentType")) {
         next.subagentType = "grunt";