@mindrian_os/cli 2.0.0-beta.3 → 2.0.0-beta.31

package/scripts/hooks/pre-commit

@@ -0,0 +1,533 @@
+#!/usr/bin/env bash
+# MindrianOS pre-commit guard: every Data Room directory must have ROOM.md + MINTO.md.
+#
+# BSL 1.1. Copyright (c) Mindrian 2026.
+#
+# CANONICAL SOURCE (Phase 235-01, CIRS-01):
+#   This file is the ONE canonical git pre-commit hook body. Its byte-identical
+#   twin scripts/hooks/pre-commit-room-minto-guard.sh is what BOTH installers
+#   (scripts/setup-hooks.sh and scripts/install-pre-commit.sh) copy verbatim.
+#   Before Phase 235 these were three independently hand-authored bodies that
+#   drifted, and session-start ran both installers every session, so the
+#   narrower body silently overwrote the richer one and the born-wired gates
+#   were never live in the installed hook. Never hand-edit only one of the two
+#   files: `cmp scripts/hooks/pre-commit scripts/hooks/pre-commit-room-minto-guard.sh`
+#   must report no difference (proved by tests/test-235-cirs-commit-gate-worktree.cjs).
+#
+# Consultation confirmation (Phase 235-01 Task 1, per CLAUDE.md "Consult ALL
+# Relevant Grounding Sources"): git pre-commit hooks and Claude Code's
+# hooks/hooks.json are separate systems; this change touches only the former.
+#   Evidence: hooks/hooks.json declares only Claude-Code-internal lifecycle
+#   events (SessionStart, PreCompact, PostCompact, Stop, SessionEnd, PreToolUse,
+#   PostToolUse, UserPromptSubmit, FileChanged, CwdChanged, SubagentStop,
+#   TaskCompleted) and contains zero references to `.git/hooks`, `pre-commit`,
+#   or `git commit`. This hook is invoked by the git binary itself from
+#   $(git rev-parse --git-path hooks/pre-commit), entirely outside Claude Code's
+#   hook loader and its matchers. Changing this file cannot affect hooks.json.
+#
+# Purpose (SEC-04 / Phase 87-01a):
+#   Enforce CLAUDE.md decision #15 + Phase 81 Feynman-MINTO invariant at git
+#   commit time. The invariant states: every directory inside a Data Room must
+#   hold both ROOM.md (ICM Layer 0 identity) and MINTO.md (Feynman-MINTO
+#   reasoning state). Violations produce misfiling and cross-room leaks
+#   (witnessed in Phase 83).
+#
+# Scoping (R-C4 regression fix):
+#   The invariant applies ONLY to Data Room subtrees. A Data Room subtree is
+#   marked by a `.room-root` sentinel file at its root. Plugin source dirs
+#   (lib/, scripts/, commands/, templates/, etc.) have NO `.room-root` ancestor
+#   and are NEVER blocked by this hook. This is the correct reading of
+#   decision #15 -- the invariant targets user-facing Data Rooms, not plugin
+#   source trees. If this scoping rule regresses, Test 5 in
+#   lib/memory/room-minto-hook.test.cjs fails immediately.
+#
+# Worktree safety (R-87-01a-WIN):
+#   The installer uses `git rev-parse --git-path hooks/pre-commit` to resolve
+#   the effective hooks directory. In a linked worktree, `.git` is a FILE
+#   containing `gitdir: <main-git-dir>/worktrees/<name>/`, and the real
+#   hooks dir is NOT `<repo>/.git/hooks`. See scripts/setup-hooks.sh.
+#
+# Symlink safety (R-87-01a-WIN):
+#   find_room_root walks ancestor dirs via `cd + pwd -P` (realpath) and
+#   records visited realpaths in a VISITED associative array. A symlink that
+#   points back into the walked tree is detected and the walk terminates
+#   without looping.
+#
+# Exit codes:
+#   0  -- all staged dirs either pass the invariant or are outside any Data
+#         Room subtree (plugin source). Commit proceeds.
+#   2  -- at least one Data Room dir is missing ROOM.md or MINTO.md. Commit
+#         rejected with a clear stderr message pointing to decision #15.
+
+set -u
+
+REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || echo "")
+if [ -z "$REPO_ROOT" ]; then
+  exit 0  # Not a git repo -- nothing to check
+fi
+
+# Resolve realpath of REPO_ROOT so we terminate the walk at the correct boundary
+# even when the working tree is reached via a symlink.
+REPO_ROOT_REAL=$(cd "$REPO_ROOT" 2>/dev/null && pwd -P)
+[ -z "$REPO_ROOT_REAL" ] && REPO_ROOT_REAL="$REPO_ROOT"
+
+VIOLATIONS=0
+MESSAGES=()
+
+# Directories that contain staged changes (added, modified, or renamed).
+# We deduplicate and exclude empty entries ("." from dirname of top-level files).
+STAGED_DIRS=$(git diff --cached --name-only --diff-filter=AMR 2>/dev/null \
+  | xargs -n1 -I{} dirname "{}" 2>/dev/null \
+  | sort -u)
+
+# Walk up from $1 (a staged dir path, repo-relative) looking for `.room-root`.
+# Realpath-normalize each step; dedupe via VISITED to prevent symlink loops.
+# Prints the absolute realpath of the directory containing .room-root, or
+# empty if none found.
+find_room_root() {
+  local dir="$1"
+  local abs="$REPO_ROOT/$dir"
+  local real
+  declare -A VISITED
+  while :; do
+    real=$(cd "$abs" 2>/dev/null && pwd -P) || return 1
+    # Termination: walked above the repo root
+    case "$real" in
+      "$REPO_ROOT_REAL"|"/") break ;;
+    esac
+    # Loop guard (symlink cycle detection)
+    if [ -n "${VISITED[$real]:-}" ]; then
+      break
+    fi
+    VISITED[$real]=1
+    if [ -f "$real/.room-root" ]; then
+      echo "$real"
+      return 0
+    fi
+    abs=$(dirname "$real")
+  done
+  # Also check repo root itself (a Data Room rooted at the repo root)
+  if [ -f "$REPO_ROOT_REAL/.room-root" ]; then
+    echo "$REPO_ROOT_REAL"
+    return 0
+  fi
+  echo ""
+  return 1
+}
+
+for dir in $STAGED_DIRS; do
+  [ -z "$dir" ] && continue
+  [ "$dir" = "." ] && continue
+
+  # Scoping gate: only enforce within a .room-root subtree.
+  # If no ancestor holds .room-root, this is plugin source -- SKIP.
+  ROOM_ROOT=$(find_room_root "$dir")
+  if [ -z "$ROOM_ROOT" ]; then
+    continue  # Plugin source dir -- not a Data Room -- skip silently
+  fi
+
+  # Inside a Data Room subtree -- enforce ROOM.md + MINTO.md
+  abs_dir="$REPO_ROOT/$dir"
+  if [ -d "$abs_dir" ]; then
+    if [ ! -f "$abs_dir/ROOM.md" ]; then
+      MESSAGES+=("MISSING ROOM.md: $dir")
+      VIOLATIONS=$((VIOLATIONS + 1))
+    fi
+    if [ ! -f "$abs_dir/MINTO.md" ]; then
+      MESSAGES+=("MISSING MINTO.md: $dir")
+      VIOLATIONS=$((VIOLATIONS + 1))
+    fi
+  fi
+done
+
+if [ "$VIOLATIONS" -gt 0 ]; then
+  echo "MindrianOS pre-commit guard: ROOM.md + MINTO.md invariant violated ($VIOLATIONS issue(s))." >&2
+  for m in "${MESSAGES[@]}"; do echo "  $m" >&2; done
+  echo "" >&2
+  echo "Per CLAUDE.md decision #15: every Data Room directory must have ROOM.md (identity) + MINTO.md (reasoning)." >&2
+  echo "This check fires only for dirs inside a subtree marked with a .room-root sentinel." >&2
+  echo "Generate with: node scripts/generate-section-intelligence.cjs <dir>" >&2
+  exit 2
+fi
+
+# ---------------------------------------------------------------------------
+# Phase 122-02 guardian: command-registry drift tripwire.
+#
+# When any commands/*.md or data/command-registry.json or data/framework-names
+# .json is staged, regenerate the registry in memory and reject the commit if
+# the on-disk registry is stale OR a command declares an unresolvable framework
+# name. Generated, never hand-written; drift impossible to commit (Reliability
+# rule 2, .planning/WORKFLOW-LAYER-SPEC.md). Canon Part 8: the check never
+# touches the Brain.
+# Recovery on drift: node scripts/build-command-registry.cjs
+# (the guard runs:  node scripts/build-command-registry.cjs --check )
+# ---------------------------------------------------------------------------
+if git diff --cached --name-only | grep -qE '^(commands/.*\.md|data/command-registry\.json|data/framework-names\.json)$'; then
+  if command -v node >/dev/null 2>&1 && [ -f "$REPO_ROOT/scripts/build-command-registry.cjs" ]; then
+    node "$REPO_ROOT/scripts/build-command-registry.cjs" --check || { echo "command-registry drift -- run: node scripts/build-command-registry.cjs" >&2; exit 2; }
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# Phase 143.3-02 guardian: connector-registry drift + four CONN-03 validations.
+#
+# When any commands/*.md, skills/*/SKILL.md, agents/*.md,
+# data/connector-registry.json, data/connector-coverage-ledger.json, or
+# data/framework-names.json is staged, regenerate the connector registry in
+# memory and reject the commit if the on-disk registry is stale OR any of the
+# four CONN-03 validations fail (reach_id not in frozen 6, posture not in frozen
+# 3, framework unresolvable via commandsForFramework, or a duplicate
+# (sensor,reach,sub_mode) tuple) OR any surface is a GAP (neither WIRED nor
+# EXCLUDED). The gap check is a HARD FAIL as of Phase 172-13 (Canon Part 11
+# R2/R9): a born-dark surface can no longer reach merge. Generated, never
+# hand-written; drift impossible to commit. Canon Part 8: the check never
+# touches the Brain.
+# Recovery on drift: node scripts/build-connector-registry.cjs
+# (the guard runs:  node scripts/build-connector-registry.cjs --check )
+# ---------------------------------------------------------------------------
+if git diff --cached --name-only | grep -qE '^(commands/.*\.md|skills/.*/SKILL\.md|agents/.*\.md|data/connector-registry\.json|data/connector-coverage-ledger\.json|data/framework-names\.json)$'; then
+  if command -v node >/dev/null 2>&1 && [ -f "$REPO_ROOT/scripts/build-connector-registry.cjs" ]; then
+    node "$REPO_ROOT/scripts/build-connector-registry.cjs" --check || { echo "connector-registry drift / dark surface -- run: node scripts/build-connector-registry.cjs" >&2; exit 2; }
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# Phase 157-04 guardian: orchestration-projection drift + the 3-mode taxonomy.
+#
+# When any commands/*.md, skills/*/SKILL.md, agents/*.md, data/connector-registry
+# .json, data/command-registry.json, data/cross-domain-analogues.json,
+# data/orchestration-unwired-allowlist.json, or data/brain-orchestration
+# -projection.json is staged, regenerate the projection in memory and reject the
+# commit on any of the three named failure modes (BOG-08, D-04): STALE (a surface
+# changed without regenerating), UN-WIRED (a framework not reachable to one of
+# the 6 frozen reaches and not allowlisted -- the generalization of the
+# /mos:futures un-wired gap, BOG-06), or UN-RANKED (a connector-derived node
+# missing reach_id/hierarchy_rank/posture). Generated, never hand-written; drift
+# impossible to commit. Canon Part 8: the check never touches the Brain.
+# Recovery on drift: node scripts/build-orchestration-projection.cjs
+# (the guard runs:  node scripts/build-orchestration-projection.cjs --check )
+# ---------------------------------------------------------------------------
+if git diff --cached --name-only | grep -qE '^(commands/.*\.md|skills/.*/SKILL\.md|agents/.*\.md|data/connector-registry\.json|data/connector-coverage-ledger\.json|data/command-registry\.json|data/cross-domain-analogues\.json|data/orchestration-unwired-allowlist\.json|data/brain-orchestration-projection\.json|data/orchestration-command-ledger\.json)$'; then
+  if command -v node >/dev/null 2>&1 && [ -f "$REPO_ROOT/scripts/build-orchestration-projection.cjs" ]; then
+    node "$REPO_ROOT/scripts/build-orchestration-projection.cjs" --check || { echo "orchestration-projection drift / command gap -- run: node scripts/build-orchestration-projection.cjs" >&2; exit 2; }
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# Phase 254 Plan 03 guardian: framework-vocabulary-drift (WIRE-04).
+#
+# When lib/core/framework-chain-composer.cjs, data/command-registry.json,
+# data/brain-orchestration-projection.json, lib/mcp/brain-router.cjs, or the
+# gate script itself is staged, run the WIRE-04 declared-drift-ledger gate.
+# It fails the commit on an UNDECLARED divergence between KNOWN_FRAMEWORKS,
+# the registry's declared frameworks, and the projection's framework nodes --
+# never on a declared entry with a stated reason. It also fails on a dangling
+# declaration (a ledger entry naming a composer name that no longer exists)
+# or a broken alias target (an alias_of pointing at a registry name that
+# disappeared), so the ledger itself cannot silently rot. Generated nothing;
+# reads three committed local sources in memory. Canon Part 8: the check
+# never touches the Brain.
+# Recovery on drift: node scripts/check-framework-vocabulary-drift.cjs --report
+# (the guard runs:  node scripts/check-framework-vocabulary-drift.cjs --check )
+# ---------------------------------------------------------------------------
+if git diff --cached --name-only | grep -qE '^(lib/core/framework-chain-composer\.cjs|data/command-registry\.json|data/brain-orchestration-projection\.json|lib/mcp/brain-router\.cjs|scripts/check-framework-vocabulary-drift\.cjs)$'; then
+  if command -v node >/dev/null 2>&1 && [ -f "$REPO_ROOT/scripts/check-framework-vocabulary-drift.cjs" ]; then
+    node "$REPO_ROOT/scripts/check-framework-vocabulary-drift.cjs" --check || { echo "framework-vocabulary drift -- run: node scripts/check-framework-vocabulary-drift.cjs --report" >&2; exit 2; }
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# Quick task 260705-sy9 guardian: skill-mirror staleness tripwire.
+#
+# Every commands/<name>.md is mirrored into skills/<name>/SKILL.md (the Windows
+# commands-registration workaround, 260705-ob7). When any commands/*.md or
+# skills/*/SKILL.md is staged, run the mirror --check and reject the commit if
+# any mirror is missing/stale OR a SKIP_LIST skill was deleted or reverted to a
+# plain copy of its command. Canon Part 8: local byte compares only, zero
+# Brain calls.
+# Recovery on drift: node scripts/build-skill-mirrors.cjs
+# (the guard runs:  node scripts/build-skill-mirrors.cjs --check )
+# ---------------------------------------------------------------------------
+if git diff --cached --name-only | grep -qE '^(commands/.*\.md|skills/.*/SKILL\.md)$'; then
+  if command -v node >/dev/null 2>&1 && [ -f "$REPO_ROOT/scripts/build-skill-mirrors.cjs" ]; then
+    node "$REPO_ROOT/scripts/build-skill-mirrors.cjs" --check || { echo "skill-mirror drift -- run: node scripts/build-skill-mirrors.cjs" >&2; exit 2; }
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# Phase 110 guardian: brain-packet-schema drift / malformed-schema tripwire.
+#
+# When data/brain-packet-schema.json or scripts/build-brain-packet-schema.cjs
+# is staged, regenerate the schema in memory and reject the commit if the
+# on-disk schema drifts from the generator output. Mirrors Phase 122 pattern
+# (Reliability rule 2, .planning/WORKFLOW-LAYER-SPEC.md). Canon Part 8: the
+# check never touches the Brain.
+# Recovery on drift: node scripts/build-brain-packet-schema.cjs
+# ---------------------------------------------------------------------------
+if git diff --cached --name-only | grep -qE '^(data/brain-packet-schema\.json|scripts/build-brain-packet-schema\.cjs)$'; then
+  if command -v node >/dev/null 2>&1 && [ -f "$REPO_ROOT/scripts/build-brain-packet-schema.cjs" ]; then
+    node "$REPO_ROOT/scripts/build-brain-packet-schema.cjs" --check || { echo "brain-packet-schema drift -- run: node scripts/build-brain-packet-schema.cjs --check" >&2; exit 2; }
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# Phase 110 guardian (D-08 layer 2): refuse a bare sendPacket( not preceded
+# by buildBrainPacket( in the same staged file. The origin string on a
+# Brain Context Packet is in-process-forgeable; this hook is the real teeth
+# that catches a packet built outside lib/core/navigation.cjs::buildBrainPacket.
+# Allow-list (always allowed): brain-client.cjs / navigation.cjs / navigation/
+# / tests/ / scripts/. Canon Part 8 (Graph Boundary) + Part 9 (Memory Locality).
+# Recovery: build the packet via navigation.buildBrainPacket(...) before
+# calling brain-client.sendPacket(...), or add the path to
+# ALLOWED_SENDPACKET_FILES in scripts/check-schema-aliases.cjs.
+# ---------------------------------------------------------------------------
+if command -v node >/dev/null 2>&1 && [ -f "$REPO_ROOT/scripts/check-schema-aliases.cjs" ]; then
+  node "$REPO_ROOT/scripts/check-schema-aliases.cjs" --check-sendpacket || { echo "bare sendPacket( introduced -- per D-08 it must be lexically preceded by buildBrainPacket(" >&2; exit 2; }
+fi
+
+# ---------------------------------------------------------------------------
+# Phase 118-06 guardian: reward-before-investment rule linter.
+#
+# When any commands/*.md is staged, run scripts/check-reward-before-investment
+# .cjs against THE STAGED FILES. The linter validates that every interactive
+# command declares an interactive_first_reward field in YAML frontmatter with a
+# value from the v1.13.0 REWARD_TYPES closed vocabulary (or `--none (scripting
+# only)` per rule doc line 81). Exits non-zero if any staged commands/*.md
+# change introduces a missing or invalid declaration.
+#
+# Phase 245-02 root-cause fix: this block used to pass "$REPO_ROOT/commands",
+# scanning the WHOLE directory, which contradicted the contract stated one
+# paragraph above. With 103 of 112 commands never having declared the field,
+# one pre-existing offender blocked every commit that touched any command file,
+# so the guardian had become a permanent forced-bypass rather than a gate. It
+# now passes --staged, which discovers the file set from `git diff --cached`.
+# The per-file verdict is UNCHANGED and still fails closed: stage a command
+# with a missing or invalid declaration and the commit is still blocked. The
+# repo-wide debt remains visible through the full-audit mode (run the CLI with
+# no --staged flag), which CI and manual sweeps still use.
+#
+# Bypass: COMMIT_NO_VERIFY=1 (wave-protocol invariant per Phase 125-08
+# SUMMARY; mirrors the Phase 108 social convention -- if you bypass, open a
+# canon-amendment PR within 24 hours).
+#
+# Source-of-truth: docs/reward-before-investment-rule.md.
+# Library: lib/core/mva-rule-linter.cjs (scanFiles for the staged path,
+# scanCommands for the full audit; one shared classifier).
+# Recovery on failure: declare interactive_first_reward in the offending
+# commands/*.md frontmatter. Allowed values: reframe_question, instant_brief,
+# schema_preview, calibration_distribution_preview, paragraph_preview,
+# --none (scripting only).
+# Canon Part 8: zero network, zero Brain calls; LOCAL-only fs + index read.
+# ---------------------------------------------------------------------------
+if [ -z "${COMMIT_NO_VERIFY:-}" ]; then
+  if git diff --cached --name-only --diff-filter=ACM | grep -qE '^commands/.+\.md$'; then
+    if command -v node >/dev/null 2>&1 && [ -f "$REPO_ROOT/scripts/check-reward-before-investment.cjs" ]; then
+      # Lint the STAGED commands/*.md only. The linter's exit code is the gate;
+      # its stdout/stderr are the diagnostic surface.
+      if ! node "$REPO_ROOT/scripts/check-reward-before-investment.cjs" --staged "$REPO_ROOT"; then
+        echo "" >&2
+        echo "MindrianOS pre-commit guard: reward-before-investment rule violated." >&2
+        echo "See docs/reward-before-investment-rule.md for the rule + remediation values." >&2
+        echo "Bypass for emergency commits: COMMIT_NO_VERIFY=1 git commit ..." >&2
+        exit 2
+      fi
+    fi
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# Phase 88-13 guardian: block commit on critical/error invariant violations.
+#
+# Iterates over each DISCOVERED room root from the find_room_root loop above
+# (NOT a nonexistent top-level $ROOM_DIR variable). For each unique Data Room
+# root that owns staged files, runs the Feynman-MINTO guardian in pre-commit
+# mode. The guardian runs every registered validator against each section
+# whose staged file lives under it and exits 2 on critical/error severity.
+#
+# Plugin source commits (no .room-root ancestor anywhere) never reach this
+# block because the find_room_root loop above has nothing to add to
+# DISCOVERED_ROOM_ROOTS for them. See 88-13-SUMMARY.md.
+# ---------------------------------------------------------------------------
+#
+# Re-walk staged dirs to collect unique Data Room roots (dedup). The 87-01a
+# loop above only needs the immediate dir; we need the ancestor root.
+declare -A _DISCOVERED_ROOTS
+for _dir in $STAGED_DIRS; do
+  [ -z "$_dir" ] && continue
+  [ "$_dir" = "." ] && continue
+  _root=$(find_room_root "$_dir" 2>/dev/null || echo "")
+  if [ -n "$_root" ]; then
+    _DISCOVERED_ROOTS["$_root"]=1
+  fi
+done
+
+# Locate the plugin root for the guardian script. Prefer $PLUGIN_ROOT if set
+# by the caller; otherwise walk up from this script's directory.
+_GUARDIAN_PLUGIN_ROOT="${PLUGIN_ROOT:-}"
+if [ -z "$_GUARDIAN_PLUGIN_ROOT" ]; then
+  _SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" 2>/dev/null && pwd -P)
+  # The installed hook lives at <repo>/.git/hooks/pre-commit (or worktree equiv);
+  # its siblings in this source file live at <repo>/scripts/hooks/. Walk up to
+  # find scripts/feynman-minto-guardian.cjs.
+  _candidate="$REPO_ROOT_REAL"
+  if [ -f "$_candidate/scripts/feynman-minto-guardian.cjs" ]; then
+    _GUARDIAN_PLUGIN_ROOT="$_candidate"
+  fi
+fi
+
+if [ -n "$_GUARDIAN_PLUGIN_ROOT" ] && [ -f "$_GUARDIAN_PLUGIN_ROOT/scripts/feynman-minto-guardian.cjs" ] && command -v node >/dev/null 2>&1; then
+  for _discovered_room in "${!_DISCOVERED_ROOTS[@]}"; do
+    [ -z "$_discovered_room" ] && continue
+    node "$_GUARDIAN_PLUGIN_ROOT/scripts/feynman-minto-guardian.cjs" pre-commit "$_discovered_room"
+    _GUARDIAN_EXIT=$?
+    if [ "$_GUARDIAN_EXIT" -ne 0 ]; then
+      echo "" >&2
+      echo "MindrianOS pre-commit guard: commit blocked by feynman-minto-guardian in room: $_discovered_room" >&2
+      echo "Fix violations or use --no-verify at your own risk." >&2
+      exit "$_GUARDIAN_EXIT"
+    fi
+  done
+fi
+
+# ===========================================================================
+# Phase 235-01 (CIRS-01): the 8 guard blocks below were previously authored
+# ONLY inside scripts/install-pre-commit.sh's HOOK_BODY heredoc, which is why
+# they were silently dropped every time setup-hooks.sh reinstalled the narrower
+# body. They are ported here verbatim (trigger regex, recovery echo, and doc
+# comment unchanged) so the union lives in ONE file. Exit code normalized to 2
+# to match this file's existing convention (git only requires nonzero).
+# ===========================================================================
+
+# ---------------------------------------------------------------------------
+# Phase 108-05 - schema alias drift guard.
+#
+# Phase 235-01 note: install-pre-commit.sh's retired heredoc expanded the
+# plugin's absolute $REPO_ROOT at INSTALL time, so it could invoke this
+# unconditionally. This canonical hook resolves $REPO_ROOT at RUN time and is
+# installed into whatever repo asks for it (a user's room repo, a test
+# fixture), so the invocation carries the same `command -v node` + `[ -f ... ]`
+# existence guard every other block in this file uses. Without it the hook
+# hard-fails every commit in any repo that is not the plugin checkout.
+# ---------------------------------------------------------------------------
+if command -v node >/dev/null 2>&1 && [ -f "$REPO_ROOT/scripts/check-schema-aliases.cjs" ]; then
+  node "$REPO_ROOT/scripts/check-schema-aliases.cjs" || exit 2
+fi
+
+# ---------------------------------------------------------------------------
+# Phase 128-03 - reject net-new chokepoint bypass on staged files.
+# Strict superset of the retired --check-chokepoint (CONTEXT finding H1).
+# Recovery: route room.db access through lib/core/navigation.cjs (Canon Part 9),
+# or add the path to ALLOWED_DIRECT_IMPORT in scripts/check-substrate.cjs.
+# Contract: docs/architecture/SUBSTRATE-CONTRACT.md
+# ---------------------------------------------------------------------------
+if command -v node >/dev/null 2>&1 && [ -f "$REPO_ROOT/scripts/check-substrate.cjs" ]; then
+  node "$REPO_ROOT/scripts/check-substrate.cjs" --diff || exit 2
+fi
+
+# ---------------------------------------------------------------------------
+# Phase 167 (D-167-03) - harness-manifest drift guard.
+# When the manifest, its generator, OR any of the three named source maps
+# (command-registry / connector-registry / brain-orchestration-projection) is
+# staged, regenerate the manifest in memory and reject the commit on drift
+# (STALE / UNRESOLVED / MALFORMED). A change to any source map can stale the
+# manifest digests, so the trigger is path-scoped on all five paths. STRONGER
+# than the connector/projection precedent (whose --checks run only in test
+# aggregators): the manifest --check is wired into BOTH pre-commit and
+# tests/run-all-167.sh. Canon Part 8: the check is a local byte-compare +
+# map-resolve; it never touches the Brain.
+# Phase 298 (Pitfall 6) - the trigger is widened with two prefix branches:
+# any JSON file under data/harness-policies/ and any path under
+# data/harness-fixtures/. The manifest digests the policy directory and the
+# fixture, so an edit to either without a regeneration leaves a stale digest -
+# the same drift class this phase exists to close.
+# Recovery on drift: node scripts/build-harness-manifest.cjs
+# ---------------------------------------------------------------------------
+if git diff --cached --name-only | grep -qE '^(scripts/build-harness-manifest\.cjs|data/harness-manifest\.json|data/command-registry\.json|data/connector-registry\.json|data/brain-orchestration-projection\.json|data/harness-policies/.*\.json|data/harness-fixtures/.*)$'; then
+  if command -v node >/dev/null 2>&1 && [ -f "$REPO_ROOT/scripts/build-harness-manifest.cjs" ]; then
+    node "$REPO_ROOT/scripts/build-harness-manifest.cjs" --check || { echo "harness-manifest drift -- run: node scripts/build-harness-manifest.cjs" >&2; exit 2; }
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# Phase 178-03 (Canon Part 11 render twin, C-3) - render-coverage gate (born-wired HARD-FAIL).
+# Recovery on drift / dark surface: node scripts/build-render-coverage.cjs
+# ---------------------------------------------------------------------------
+if git diff --cached --name-only | grep -qE '^(lib/hmi/.*\.cjs|lib/agents/.*\.cjs|lib/render/.*\.cjs|lib/core/.*\.cjs|scripts/intent-classifier\.cjs|data/render-coverage-registry\.json)$'; then
+  if command -v node >/dev/null 2>&1 && [ -f "$REPO_ROOT/scripts/check-render-coverage.cjs" ]; then
+    node "$REPO_ROOT/scripts/check-render-coverage.cjs" --check || { echo "render-coverage drift / dark surface -- run: node scripts/build-render-coverage.cjs" >&2; exit 2; }
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# Phase 186-02 (CORPUS-02) - corpus-stats coverage gate (Canon Part 8 / D5).
+# Recovery on drift / stale literal: node scripts/build-corpus-stats.cjs
+# ---------------------------------------------------------------------------
+if git diff --cached --name-only | grep -qE '^(CLAUDE\.md|\.claude/includes/moat\.md|docs/THE-BRAIN\.md|docs/brain-setup\.md|\.planning/PROJECT\.md|docs/MINDRIAN-CANON\.md|docs/CANON-PHASE-MAP\.md|data/corpus-stats-source\.json|docs/CORPUS-STATS\.generated\.md)$'; then
+  if command -v node >/dev/null 2>&1 && [ -f "$REPO_ROOT/scripts/build-corpus-stats.cjs" ]; then
+    node "$REPO_ROOT/scripts/build-corpus-stats.cjs" --check || { echo "corpus-stats drift / stale literal -- run: node scripts/build-corpus-stats.cjs" >&2; exit 2; }
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# Phase 190-04 (SFD-04/SFD-05, Canon Part 11 R16) - born-declared-shape gate (HARD-FAIL).
+# Recovery: node scripts/backfill-hitl-shape.cjs, or declare hitl_shape/hitl_stages per
+# docs/HITL-SHAPE-DECLARATION-CONTRACT.md, or add connector.excluded:true + reason.
+# ---------------------------------------------------------------------------
+if git diff --cached --name-only | grep -qE '^(commands/.*\.md|agents/.*\.md|pipelines/.*/CHAIN\.md|skills/.*/SKILL\.md)$'; then
+  if command -v node >/dev/null 2>&1 && [ -f "$REPO_ROOT/scripts/check-shape-declaration.cjs" ]; then
+    node "$REPO_ROOT/scripts/check-shape-declaration.cjs" --check || { echo "shape-declaration gap -- run: node scripts/backfill-hitl-shape.cjs, or declare hitl_shape/hitl_stages per docs/HITL-SHAPE-DECLARATION-CONTRACT.md, or add connector.excluded:true + reason" >&2; exit 2; }
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# Quick task 20260702-help-coverage-gate (Canon Part 11 born-listed exclusion) -
+# /mos:help coverage gate (HARD-FAIL). Rejects a commit where a user-facing
+# command is absent from data/help-groups.json, a grouped/excluded name has no
+# file (ghost), or a deprecated:true command is not born-listed in
+# deprecated_aliases. Canon Part 8: LOCAL frontmatter + manifest only.
+# Recovery: add the command to data/help-groups.json, or list a deprecation in
+# deprecated_aliases.
+# ---------------------------------------------------------------------------
+if git diff --cached --name-only | grep -qE '^(commands/.*\.md|data/help-groups\.json)$'; then
+  if command -v node >/dev/null 2>&1 && [ -f "$REPO_ROOT/scripts/check-help-coverage.cjs" ]; then
+    node "$REPO_ROOT/scripts/check-help-coverage.cjs" || { echo "help-coverage gap -- add the command to data/help-groups.json, or list a deprecation in deprecated_aliases" >&2; exit 2; }
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# Quick task 260705-jeq (Canon Part 7 / Part 11) - command-registration
+# precondition sweep (HARD-FAIL). Catches the static authoring mistakes that make
+# Claude Code SILENTLY skip a command file: a broken frontmatter fence, a tab in
+# the YAML block, an illegal command name, or a case-insensitive basename
+# collision. Canon Part 8: LOCAL file reads only.
+# Recovery: fix the flagged frontmatter fence / tab / name / collision.
+# ---------------------------------------------------------------------------
+if git diff --cached --name-only | grep -qE '^commands/.*\.md$'; then
+  if command -v node >/dev/null 2>&1 && [ -f "$REPO_ROOT/lib/core/command-registration-check.cjs" ]; then
+    node "$REPO_ROOT/lib/core/command-registration-check.cjs" || { echo "command-registration precondition FAIL - a command would silently not register" >&2; exit 2; }
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# Quick task 260903-ljj - MCP tool-honesty advisory gate (description-vs-
+# behavior mismatch scanner, RCA .planning/debug/meeting-file-meeting-false-
+# success.md's named follow-up sweep). ADVISORY, not HARD-FAIL: the surface
+# has never been swept this way and the findings need human triage first
+# (Phase 210 posture, same as the shape-declaration block above).
+#
+# Deliberately NO `|| { ...; exit 2; }` tail here, and that omission is
+# load-bearing, not an oversight: the script's own `--check` already exits 0
+# by design on findings (it WARNs and enumerates instead of failing), so
+# adding a failure tail would silently re-harden this gate the day someone
+# changes the script's default posture without anyone noticing the hook
+# quietly started blocking commits. Recovery: run `node scripts/
+# check-tool-honesty.cjs --report` to see the full per-branch table, or add a
+# triaged entry to ALLOWED_UNVERIFIED in scripts/check-tool-honesty.cjs.
+# ---------------------------------------------------------------------------
+if git diff --cached --name-only | grep -qE '^(lib/mcp/tool-router\.cjs|lib/mcp/tools/.*\.cjs|lib/mcp/contract-version\.cjs)$'; then
+  if command -v node >/dev/null 2>&1 && [ -f "$REPO_ROOT/scripts/check-tool-honesty.cjs" ]; then
+    node "$REPO_ROOT/scripts/check-tool-honesty.cjs" --check
+  fi
+fi
+
+exit 0

package/scripts/hooks/pre-commit-room-minto-guard.cmd

@@ -0,0 +1,43 @@
+@echo off
+rem MindrianOS pre-commit guard -- Windows cmd wrapper.
+rem
+rem BSL 1.1. Copyright (c) Mindrian 2026.
+rem
+rem Purpose (SEC-04 / Phase 87-01a / R-87-01a-WIN):
+rem   This companion file exists so Windows GUI git clients (VS Code, GitHub
+rem   Desktop, SourceTree) that invoke hooks via cmd.exe don't silently skip
+rem   the ROOM/MINTO invariant. If git-bash is installed, we invoke the .sh
+rem   guard on this file's sibling; otherwise we emit a clear stderr message
+rem   so the user knows why the guard isn't running and falls back to the
+rem   session-start re-install path + CI.
+rem
+rem Authoritative enforcement on Windows GUI-only installs comes from
+rem scripts/session-start (which re-installs the hook every session via
+rem Claude Code's bash-capable runner) and from CI. This wrapper is a
+rem fallback that keeps the commit path unblocked for users who don't have
+rem git-bash on PATH.
+
+setlocal
+set "GUARD=%~dp0pre-commit-room-minto-guard.sh"
+
+rem Try bash on PATH first (git-bash typical install adds it)
+where bash >nul 2>&1
+if %ERRORLEVEL%==0 (
+  bash "%GUARD%"
+  exit /b %ERRORLEVEL%
+)
+
+rem Fallback: common git-for-Windows install location
+set "GITBASH=%ProgramFiles%\Git\bin\bash.exe"
+if exist "%GITBASH%" (
+  "%GITBASH%" "%GUARD%"
+  exit /b %ERRORLEVEL%
+)
+
+rem No bash available -- emit clear skip message, exit 0 so commit proceeds.
+rem Authoritative enforcement on Windows GUI-only installs comes from
+rem scripts/session-start (which re-installs the hook via Claude Code's
+rem bash-capable session runner) and from CI.
+1>&2 echo [mindrian-os] skipping ROOM/MINTO guard on Windows without git-bash
+1>&2 echo [mindrian-os] install Git for Windows (https://git-scm.com) for local enforcement
+exit /b 0