@ngockhoale/ukit 2.2.14 → 2.3.0

package/templates/.claude/ukit/index/route-task.mjs

@@ -579,6 +579,9 @@ function printRouteState(state) {
   if (state.routeSummary?.executionContract?.modelTier) {
     console.log(`modelTier: ${state.routeSummary.executionContract.modelTier}`);
   }
+  if (state.routeSummary?.tierLane?.instruction) {
+    console.log(`tierLane: ${state.routeSummary.tierLane.instruction}`);
+  }
   if (state.routeSummary?.escalatedTier) {
     console.log(`escalatedTier: ${state.routeSummary.escalatedTier}`);
     if (state.routeSummary.escalationReason) {
@@ -1475,6 +1478,15 @@ function buildRouteSummary({
   const primaryTargets = summarizeCompactList(preview.primaryTargets ?? [], 2);
   const relatedTests = summarizeCompactList(preview.relatedTests ?? [], 2);
   const styleFiles = summarizeCompactList(preview.styleFiles ?? [], 1);
+  // WS-C target-aware evidence: the completion ledger checks impact-evidence against these
+  // files, so carry the full resolver list (target + primaryTargets + relatedTests), bounded
+  // for compact route state. Absent when the route has no indexed context — the ledger then
+  // falls back to its legacy any-read behaviour.
+  const expectedSourceFiles = unique([
+    ...(routingContext.targetFile ? [routingContext.targetFile] : []),
+    ...(preview.primaryTargets ?? []),
+    ...(preview.relatedTests ?? []),
+  ].filter((filePath) => typeof filePath === 'string' && filePath.trim())).slice(0, 8);
   const primaryCommands = unique(verificationRecommendation?.commands ?? []);
   const fallbackCommands = unique(verificationRecommendation?.fallbackCommands ?? []);
   const preferredOrder = unique(
@@ -1497,6 +1509,7 @@ function buildRouteSummary({
     executionCandidates,
   });
   const executionContract = buildExecutionContract(executionMode);
+  const tierLane = buildTierLane({ modelTier: executionContract?.modelTier ?? null });
   const completionState = buildCompletionState({
     executionMode,
     verificationRecommendation,
@@ -1539,8 +1552,10 @@ function buildRouteSummary({
     executionCandidates,
     approachSelector,
     executionContract,
+    tierLane,
     completionState,
     continuationState,
+    ...(expectedSourceFiles.length > 0 ? { expectedSourceFiles } : {}),
     intentMode: routingContext.intentMode ?? null,
     handoffFile,
     delegateHint: delegationRecommendation?.hint ?? null,
@@ -1894,9 +1909,10 @@ function buildExecutionContract(executionMode = null) {
       maxReadPasses: 2,
       maxContextPulls: 1,
       verificationPolicy: 'targeted-if-covered',
-      completionRule: 'require-write',
+      completionRule: 'require-write-and-verification',
       delegationPolicy: 'disallow-by-default',
-      completionEvidence: ['write-evidence'],
+      completionEvidence: ['write-evidence', 'verification-evidence'],
+      postEditReviewPolicy: 'sidecar-non-blocking',
     },
     'find-cause': {
       modelTier: 'code',
@@ -1915,6 +1931,7 @@ function buildExecutionContract(executionMode = null) {
       delegationPolicy: 'allow-qualified-sidecar',
       completionEvidence: ['write-evidence', 'verification-evidence'],
       mirrorConsistencyRequired: true,
+      postEditReviewPolicy: 'sidecar-non-blocking',
     },
     'map-impact': {
       modelTier: 'code',
@@ -2182,10 +2199,36 @@ function applyEscalationToRouteSummary(routeSummary = null, { config = null, tar
     delete routeSummary.escalatedTier;
     delete routeSummary.escalationReason;
   }
+  // Recomputed here (not only in buildRouteSummary) so the lane always reflects the final
+  // tier after escalation, on every path that emits a route summary.
+  routeSummary.tierLane = buildTierLane({
+    modelTier: routeSummary.executionContract?.modelTier ?? null,
+    escalatedTier: escalation?.escalatedTier ?? null,
+  });
 
   return routeSummary;
 }
 
+// WS-E tier-role wiring: a contract tier only takes effect when the executing session hands
+// the work to an agent whose definition binds that tier — otherwise every session behaves as
+// if it only had one model. `code` is the DEFAULT implementation lane, so a code-tier contract
+// produces no instruction (inline execution on a code session is already correct, and silence
+// keeps the hook flow smooth). Labels are stable tier roles (lite/code/smart), never provider
+// or model identity. Vision never appears here — it is a capability lane, not a cost tier.
+function buildTierLane({ modelTier = null, escalatedTier = null } = {}) {
+  const tier = escalatedTier ?? modelTier;
+  if (!tier || tier === 'vision') {
+    return null;
+  }
+  return {
+    tier,
+    defaultLane: tier === 'code',
+    instruction: tier === 'code'
+      ? null
+      : `Hand this task to an agent bound to the ${tier} tier instead of doing it inline, unless this session already runs on the ${tier} tier.`,
+  };
+}
+
 function advanceContinuationState(continuationState = null, previousContinuationState = null, thresholds = null) {
   if (!continuationState || typeof continuationState !== 'object') {
     return continuationState;
@@ -2875,6 +2918,14 @@ function compactRouteSummary(routeSummary = null) {
     completionState: routeSummary.completionState ?? null,
     continuationState: routeSummary.continuationState ?? null,
     delegateHint: routeSummary.delegateHint ?? null,
+    // WS-E tier-role binding: consumers need the hand-off instruction, not just the raw tier.
+    ...(routeSummary.tierLane ? { tierLane: routeSummary.tierLane } : {}),
+    // WS-C target-aware evidence: the completion ledger reads these from the PERSISTED route
+    // state — without this spread the CLI path never delivers them and the gate falls back
+    // to legacy any-read behaviour.
+    ...(Array.isArray(routeSummary.expectedSourceFiles) && routeSummary.expectedSourceFiles.length > 0 ? {
+      expectedSourceFiles: routeSummary.expectedSourceFiles,
+    } : {}),
     nextActionType: routeSummary.nextActionType ?? null,
     nextActionCommand: routeSummary.nextActionCommand ?? null,
     helperHint: routeSummary.helperHint ?? null,

package/templates/.claude/ukit/index/unic-gateway.mjs

@@ -22,7 +22,7 @@
  * Every probe here is scoped to what changes the CALLING
  * runtime's OWN outbound endpoint — same rule that already governs probes 1-3. Cross-tool
  * configs are NOT probed. This module is only ever invoked from Claude Code / omp hooks
- * (vision-router.sh, vision-gate.sh, route-task.mjs, and the omp bridge) to gate what THIS
+ * (vision-router.sh, route-task.mjs, and the omp bridge) to gate what THIS
  * session does — a Codex `config.toml` `base_url`, a Kilo `secrets.json` endpoint, or an
  * `OPENAI_BASE_URL` env var describe a completely different tool's outbound endpoint and say
  * nothing about where Claude Code or omp itself is sending requests. Treating them as evidence

package/templates/.claude/ukit/runtime/execution-ledger.mjs

@@ -8,6 +8,7 @@ import { fileURLToPath } from 'node:url';
 
 const LEDGER_VERSION = 1;
 const MAX_RECEIPTS = 24;
+const MAX_SOURCE_FILES = 16;
 const MAX_CONTINUATIONS = 6;
 const IMPLEMENT_MODES = new Set([
   'tiny-fix',
@@ -130,7 +131,7 @@ function compactReceipt(receipt) {
     kind: receipt.kind,
     success: receipt.success,
   };
-  for (const key of ['toolName', 'toolUseId', 'file', 'command', 'exitCode', 'error']) {
+  for (const key of ['toolName', 'toolUseId', 'file', 'command', 'exitCode', 'scope', 'error']) {
     if (receipt[key] !== undefined && receipt[key] !== null && receipt[key] !== '') {
       compact[key] = receipt[key];
     }
@@ -138,6 +139,38 @@ function compactReceipt(receipt) {
   return compact;
 }
 
+/**
+ * Target-aware matching between a receipt's file and a routed expected file. Both sides
+ * may disagree about absolute vs relative spelling (hook payloads carry absolute paths,
+ * the router carries repo-relative ones), so exact equality, path-suffix, and bare-name
+ * matches all count.
+ */
+function fileMatchesExpected(receiptFile, expectedFile) {
+  if (!receiptFile || !expectedFile) return false;
+  const receipt = String(receiptFile).replace(/\\/g, '/').replace(/^\.\//, '');
+  const expected = String(expectedFile).replace(/\\/g, '/').replace(/^\.\//, '');
+  if (receipt === expected) return true;
+  if (receipt.endsWith(`/${expected}`) || expected.endsWith(`/${receipt}`)) return true;
+  if (!expected.includes('/')) {
+    const base = receipt.split('/').pop();
+    return base === expected;
+  }
+  return false;
+}
+
+function matchesRoutedCommand(command, routedCommand) {
+  const receipt = String(command || '').trim();
+  const routed = String(routedCommand || '').trim();
+  if (!receipt || !routed) return false;
+  return receipt === routed || receipt.startsWith(routed) || routed.startsWith(receipt);
+}
+
+function routedVerificationCommands(routeSummary = {}) {
+  const preferred = Array.isArray(routeSummary?.preferredOrder) ? routeSummary.preferredOrder : [];
+  const primary = Array.isArray(routeSummary?.primaryCommands) ? routeSummary.primaryCommands : [];
+  return preferred.length > 0 ? preferred : primary;
+}
+
 function appendReceipt(receipts, receipt) {
   return [...(receipts || []), compactReceipt(receipt)].slice(-MAX_RECEIPTS);
 }
@@ -152,6 +185,7 @@ function freshLedger(payload, routeState, harness) {
     requestKey: routeState?.requestKey || null,
     routeFingerprint: routeState?.fingerprint || null,
     sourceSucceeded: false,
+    sourceFiles: [],
     writeAttempted: false,
     writeSucceeded: false,
     verificationAttempted: false,
@@ -194,6 +228,9 @@ export async function recordExecutionReceipt({
     receipt.kind = 'source';
     receipt.file = toolInput.file_path || toolInput.path || null;
     ledger.sourceSucceeded ||= success;
+    if (success && receipt.file) {
+      ledger.sourceFiles = [...new Set([...(ledger.sourceFiles || []), receipt.file])].slice(-MAX_SOURCE_FILES);
+    }
   } else if (toolName === 'Edit' || toolName === 'Write') {
     receipt.kind = 'write';
     receipt.file = toolInput.file_path || toolInput.path || toolInput.paths?.[0] || null;
@@ -202,6 +239,17 @@ export async function recordExecutionReceipt({
   } else if (toolName === 'Bash' && isVerificationCommand(toolInput.command)) {
     receipt.kind = 'verification';
     receipt.command = String(toolInput.command || '').trim();
+    // WS-C routed-verification receipt: a command counts as "targeted" when it matches the
+    // routed plan (preferredOrder / primaryCommands). Off-plan verification still records
+    // as broad — counted only when the route carried no commands at all.
+    const routedCommands = routedVerificationCommands(routeState?.routeSummary);
+    if (routedCommands.length > 0) {
+      const matched = routedCommands.find((cmd) => matchesRoutedCommand(receipt.command, cmd));
+      receipt.scope = matched ? 'targeted' : 'broad';
+      if (receipt.scope === 'targeted') {
+        ledger.targetedVerificationSucceeded ||= success;
+      }
+    }
     ledger.verificationAttempted = true;
     ledger.verificationSucceeded ||= success;
     ledger.verificationFailed ||= !success;
@@ -224,30 +272,66 @@ function requiredEvidence(state = {}) {
   return [...new Set(routeSummary.completionState?.missingEvidence || [])];
 }
 
-function evidenceSatisfied(evidence, ledger = {}) {
+function evidenceSatisfied(evidence, ledger = {}, routeSummary = {}) {
   if (evidence === 'write-evidence') return ledger.writeSucceeded === true;
-  if (evidence === 'verification-evidence') return ledger.verificationSucceeded === true;
-  if (evidence === 'impact-evidence') return ledger.sourceSucceeded === true;
+  if (evidence === 'verification-evidence') {
+    // WS-C: when the route names concrete verification commands, only a receipt that ran
+    // one of them counts — an unrelated `yarn test` no longer satisfies the gate.
+    const routedCommands = routedVerificationCommands(routeSummary);
+    if (routedCommands.length > 0) {
+      return ledger.targetedVerificationSucceeded === true;
+    }
+    return ledger.verificationSucceeded === true;
+  }
+  if (evidence === 'impact-evidence') {
+    // WS-C: when the route names expected source files, a read must cover one of them —
+    // ANY read (e.g. docs) no longer satisfies the impact-evidence gate.
+    const expectedFiles = Array.isArray(routeSummary?.expectedSourceFiles)
+      ? routeSummary.expectedSourceFiles
+      : [];
+    if (expectedFiles.length > 0) {
+      const readFiles = Array.isArray(ledger.sourceFiles) ? ledger.sourceFiles : [];
+      return readFiles.some((file) => expectedFiles.some((expected) => fileMatchesExpected(file, expected)));
+    }
+    return ledger.sourceSucceeded === true;
+  }
   return false;
 }
 
-function recoveryInstruction(missingEvidence, ledger = {}) {
+function recoveryInstruction(missingEvidence, ledger = {}, routeSummary = {}) {
+  let instruction = null;
   if (missingEvidence.includes('write-evidence')) {
     if (!ledger.sourceSucceeded) {
-      return 'Pull one bounded indexed source slice, then make the requested Edit/Write in this continuation.';
+      instruction = 'Pull one bounded indexed source slice, then make the requested Edit/Write in this continuation.';
+    } else if (ledger.writeAttempted && !ledger.writeSucceeded) {
+      instruction = 'Recover from the failed mutation using the current error, then retry the smallest correct Edit/Write.';
+    } else {
+      instruction = 'Make the smallest correct Edit/Write now; do not end after more read-only analysis.';
     }
-    if (ledger.writeAttempted && !ledger.writeSucceeded) {
-      return 'Recover from the failed mutation using the current error, then retry the smallest correct Edit/Write.';
+  } else if (missingEvidence.includes('verification-evidence')) {
+    if (ledger.verificationFailed) {
+      instruction = 'Use the latest failed verification output, fix the failure, and rerun targeted verification.';
+    } else {
+      const routedCommands = routedVerificationCommands(routeSummary);
+      if (routedCommands.length > 0 && ledger.verificationSucceeded && !ledger.targetedVerificationSucceeded) {
+        instruction = `Verification ran but did not match the routed plan (${routedCommands.slice(0, 3).join('; ')}). Run one of those and inspect its result before stopping.`;
+      } else {
+        instruction = 'Run the routed targeted verification now and inspect its result before stopping.';
+      }
     }
-    return 'Make the smallest correct Edit/Write now; do not end after more read-only analysis.';
   }
-  if (missingEvidence.includes('verification-evidence')) {
-    if (ledger.verificationFailed) {
-      return 'Use the latest failed verification output, fix the failure, and rerun targeted verification.';
+  // WS-C: the target hint travels with the reason whenever impact evidence is missing and
+  // the route names expected files — it must survive branch precedence above.
+  if (missingEvidence.includes('impact-evidence')) {
+    const expectedFiles = Array.isArray(routeSummary?.expectedSourceFiles) ? routeSummary.expectedSourceFiles : [];
+    if (expectedFiles.length > 0 && !expectedFiles.some(
+      (expected) => (ledger.sourceFiles || []).some((file) => fileMatchesExpected(file, expected))
+    )) {
+      const hint = `Read the routed target files (${expectedFiles.slice(0, 3).join(', ')}) — reads of unrelated files do not count as impact evidence.`;
+      instruction = instruction ? `${instruction} ${hint}` : hint;
     }
-    return 'Run the routed targeted verification now and inspect its result before stopping.';
   }
-  return 'Complete the current routed milestone before stopping.';
+  return instruction ?? 'Complete the current routed milestone before stopping.';
 }
 
 export function evaluateCompletion({ state = {}, ledger = {} } = {}) {
@@ -263,7 +347,7 @@ export function evaluateCompletion({ state = {}, ledger = {} } = {}) {
 
   const sameRequest = !ledger?.requestKey || !state?.requestKey || ledger.requestKey === state.requestKey;
   const effectiveLedger = sameRequest ? ledger : {};
-  const missingEvidence = evidence.filter((item) => !evidenceSatisfied(item, effectiveLedger));
+  const missingEvidence = evidence.filter((item) => !evidenceSatisfied(item, effectiveLedger, routeSummary));
   if (missingEvidence.length === 0) {
     return { continue: false, notify: false, missingEvidence: [] };
   }
@@ -278,7 +362,15 @@ export function evaluateCompletion({ state = {}, ledger = {} } = {}) {
     };
   }
 
-  const continuationCount = Number(effectiveLedger?.continuationCount || 0);
+  // Continuation attempts only make sense within the request that minted them: a new
+  // routed request in the same session must start with a fresh budget, otherwise a cap
+  // exhausted on task A suppresses recovery for task B.
+  const staleContinuations = effectiveLedger?.continuationRequestKey
+    && state?.requestKey
+    && effectiveLedger.continuationRequestKey !== state.requestKey;
+  const continuationCount = staleContinuations
+    ? 0
+    : Number(effectiveLedger?.continuationCount || 0);
   if (continuationCount >= MAX_CONTINUATIONS) {
     if (effectiveLedger?.notified === true) {
       return {
@@ -300,7 +392,7 @@ export function evaluateCompletion({ state = {}, ledger = {} } = {}) {
   }
 
   const finalAttempt = continuationCount === MAX_CONTINUATIONS - 1;
-  const instruction = recoveryInstruction(missingEvidence, effectiveLedger);
+  const instruction = recoveryInstruction(missingEvidence, effectiveLedger, routeSummary);
   return {
     continue: true,
     missingEvidence,
@@ -312,11 +404,18 @@ export function evaluateCompletion({ state = {}, ledger = {} } = {}) {
   };
 }
 
-export async function incrementContinuation(projectRoot, payload = {}, ledger = null) {
+export async function incrementContinuation(projectRoot, payload = {}, ledger = null, requestKey = null) {
   const current = ledger || await readExecutionLedger(projectRoot, payload) || freshLedger(payload, null, 'unknown');
+  // Mirror evaluateCompletion's staleness rule: a count minted by an earlier request must
+  // not be carried into the new request's budget, or the cap fires early (evaluate says 0,
+  // persist says 7) and the next request inherits a nearly exhausted budget.
+  const stale = requestKey
+    && current?.continuationRequestKey
+    && current.continuationRequestKey !== requestKey;
   const next = {
     ...current,
-    continuationCount: Number(current.continuationCount || 0) + 1,
+    continuationCount: (stale ? 0 : Number(current.continuationCount || 0)) + 1,
+    ...(requestKey ? { continuationRequestKey: requestKey } : {}),
     lastContinuationAt: Date.now(),
     updatedAt: Date.now(),
   };
@@ -356,9 +455,9 @@ async function main() {
     const result = evaluateCompletion({ state, ledger });
     if (result.continue) {
       if (result.finalNotice) await markNotified(projectRoot, payload, ledger);
-      else await incrementContinuation(projectRoot, payload, ledger);
+      else await incrementContinuation(projectRoot, payload, ledger, state?.requestKey || null);
       process.stdout.write(`${JSON.stringify({ decision: 'block', reason: result.reason })}\n`);
-    } else if (result.capped) {
+    } else if (result.capped || result.notify) {
       process.stderr.write(`[ukit-completion] ${result.reason}\n`);
     }
   }

package/templates/.claude/ukit/runtime/hook-chain-runner.mjs

@@ -8,7 +8,6 @@ const FAIL_CLOSED_SCRIPTS = new Set([
   'protect-files.sh',
   'stale-spec-guard.sh',
   'handoff-model-guard.sh',
-  'vision-gate.sh',
   'context-hardcap-gate.sh',
   'block-dangerous.sh',
 ]);
@@ -39,7 +38,11 @@ function run(payloadText, scriptPaths) {
     ? path.resolve(path.dirname(firstScript), '../..')
     : (payload.cwd || process.cwd());
   const startedAt = Date.now();
-  const deadline = startedAt + TOTAL_BUDGET_MS;
+  // The chain budget must always be able to run EVERY child at its full per-child
+  // budget — a fixed total silently starves later scripts once a chain grows
+  // (UserPromptSubmit now carries 4 hooks). The floor keeps short chains at 10s.
+  const totalBudgetMs = Math.max(TOTAL_BUDGET_MS, scriptPaths.length * CHILD_BUDGET_MS);
+  const deadline = startedAt + totalBudgetMs;
   const results = [];
 
   for (const scriptPath of scriptPaths) {
@@ -50,7 +53,7 @@ function run(payloadText, scriptPaths) {
         scriptName,
         code: 1,
         stdout: '',
-        stderr: `hook chain exceeded its ${TOTAL_BUDGET_MS}ms total budget`,
+        stderr: `hook chain exceeded its ${totalBudgetMs}ms total budget`,
         killed: true,
         elapsedMs: 0,
       });
@@ -90,7 +93,7 @@ function run(payloadText, scriptPaths) {
     toolName: payload?.tool_name || null,
     toolUseId: payload?.tool_use_id || null,
     elapsedMs,
-    budgetMs: TOTAL_BUDGET_MS,
+    budgetMs: totalBudgetMs,
     scripts: results.map(({ scriptName, code, killed, elapsedMs: scriptElapsedMs }) => ({
       scriptName,
       code,
@@ -99,7 +102,7 @@ function run(payloadText, scriptPaths) {
     })),
   });
 
-  return { results, elapsedMs, budgetMs: TOTAL_BUDGET_MS };
+  return { results, elapsedMs, budgetMs: totalBudgetMs };
 }
 
 try {

package/templates/.omp/README.md

@@ -62,14 +62,14 @@ One source of truth, two runtimes — fix a hook once and both runtimes get the
 Two things worth knowing:
 
 **Tool names are mapped explicitly, never guessed.** omp's write surface is `edit`, `write` *and*
-`ast_edit`; all three map to the `Edit` group, or `ast_edit` would slip past `protect-files.sh` and
-`vision-gate.sh`. `eval` maps to `Bash` so it still hits `block-dangerous.sh`. Anything not in the
+`ast_edit`; all three map to the `Edit` group, or `ast_edit` would slip past `protect-files.sh`.
+`eval` maps to `Bash` so it still hits `block-dangerous.sh`. Anything not in the
 table maps to nothing and runs zero scripts — it never falls back to `Bash` or `Edit`.
 
 **Failure direction is per-script, transcribed from each script's own header — not a blanket rule.**
 
 - *Fail closed* (a crash or non-zero exit blocks the action): `protect-files.sh`,
-  `stale-spec-guard.sh`, `handoff-model-guard.sh`, `vision-gate.sh`, `context-hardcap-gate.sh`,
+  `stale-spec-guard.sh`, `handoff-model-guard.sh`, `context-hardcap-gate.sh`,
   `block-dangerous.sh`, `verification-guard.sh`. These are gates; a broken gate must not open.
 - *Fail open* (a crash logs a warning and the action proceeds): the advisory scripts —
   routing, backups, output compression, context reinjection, pressure reset, handoff resume.

package/templates/.omp/hooks/pre/ukit-bridge.js

@@ -20,19 +20,19 @@ import {
 
 export const HOOK_EVENT_MAP = {
   tool_call: {
-    'Read|Grep|Glob': [],
+    'Read|Grep|Glob': ['sensitive-data-guard.sh'],
     'Edit|Write': [
       'protect-files.sh',
       'stale-spec-guard.sh',
       'pre-edit-backup.sh',
       'skill-router.sh',
       'handoff-model-guard.sh',
-      'vision-gate.sh',
       'context-hardcap-gate.sh',
     ],
     Bash: [
       'auto-allow-bash.sh',
       'block-dangerous.sh',
+      'sensitive-data-guard.sh',
       'handoff-model-guard.sh',
       'context-hardcap-gate.sh',
     ],
@@ -42,7 +42,7 @@ export const HOOK_EVENT_MAP = {
     'Edit|Write': ['post-edit-verify.sh', 'record-execution.sh'],
     Bash: ['compress-output.sh', 'record-execution.sh'],
   },
-  before_agent_start: ['skill-router.sh', 'vision-router.sh', 'context-window-guard.sh'],
+  before_agent_start: ['sensitive-data-guard.sh', 'skill-router.sh', 'vision-router.sh', 'context-window-guard.sh'],
   'session.compacting': ['reinject-context.sh'],
   session_start: ['auto-prune-bash.sh', 'reset-compact-pressure.sh', 'handoff-resume.sh'],
 };
@@ -83,9 +83,9 @@ export const FAIL_CLOSED_SCRIPTS = new Set([
   'protect-files.sh',
   'stale-spec-guard.sh',
   'handoff-model-guard.sh',
-  'vision-gate.sh',
   'context-hardcap-gate.sh',
   'block-dangerous.sh',
+  'sensitive-data-guard.sh',
 ]);
 
 export const ADVISORY_SCRIPTS = new Set([
@@ -170,7 +170,15 @@ function translateExecResult(scriptName, execResult) {
 
 export { translateExecResult };
 
-const HOOK_CHAIN_TIMEOUT_MS = 12000;
+// Mirrors hook-chain-runner.mjs's TOTAL/CHILD budget constants: the exec timeout must
+// exceed the runner's own chain budget (max(10s, scripts×4s)) plus parse margin, or the
+// bridge orphans the runner mid-chain once a chain grows past 2 scripts.
+const HOOK_CHAIN_BASE_BUDGET_MS = 10000;
+const HOOK_CHAIN_CHILD_BUDGET_MS = 4000;
+function chainExecTimeoutMs(scriptCount) {
+  const budget = Math.max(HOOK_CHAIN_BASE_BUDGET_MS, scriptCount * HOOK_CHAIN_CHILD_BUDGET_MS);
+  return Math.min(30000, budget + 2000);
+}
 
 function recordHookErrorDiagnostic(projectRoot, sessionId, diagnostic) {
   try {
@@ -228,7 +236,7 @@ export async function runScriptChain(
     execResult = await pi.exec(
       nodeExecutable,
       [runnerPath, JSON.stringify(payload), ...scriptPaths],
-      { cwd: projectRoot, timeout: HOOK_CHAIN_TIMEOUT_MS },
+      { cwd: projectRoot, timeout: chainExecTimeoutMs(scripts.length) },
     );
   } catch (error) {
     execResult = { code: 1, stdout: '', stderr: error?.message ?? String(error), killed: false };
@@ -517,7 +525,7 @@ export async function runSessionStop(
   if (suppliedLedger === undefined) {
     try {
       if (evaluation.finalNotice) await markNotified(projectRoot, payload, ledger);
-      else await incrementContinuation(projectRoot, payload, ledger);
+      else await incrementContinuation(projectRoot, payload, ledger, state?.requestKey || null);
     } catch (error) {
       pi.logger?.warn?.(`[UKit] continuation bookkeeping failed open: ${error?.message || error}`);
     }

package/templates/AGENTS.md

@@ -206,10 +206,10 @@ This is internal orchestration — end users do not need to know about tiers, th
 
 ### Vision lane (capability, not a cost tier)
 
-`unic-vision` is a **capability lane**, not a fourth cost tier — it is orthogonal to lite/code/smart above and never appears as a row in the tier table. `unic-code` and `unic-smart` cannot read images on the UNIC gateway; they must never guess at image contents.
+`unic-vision` is a **capability lane**, not a fourth cost tier — it is orthogonal to lite/code/smart above and never appears as a row in the tier table. Whether a mapping can read images is a capability fact, not a provider fact: a mapping that has not **verified** native vision must never guess at image contents — choose native-first when verified, otherwise route to the specialist.
 
 - **Gateway detection**: UNIC routing for a Claude Code session is decided ONLY by what changes Claude Code's own outbound endpoint — `ANTHROPIC_BASE_URL` (env var, or the `env.ANTHROPIC_BASE_URL` key in project/home `.claude/settings.json`) containing `unicjsc.com`. Other tools' configs — Codex `config.toml`, Kilo `secrets.json`, or an `OPENAI_BASE_URL` env var — describe a different tool's endpoint entirely and never decide this session's routing.
-- **Enforcement**: every image (pasted, local file path, or URL) must be analysed by the `ukit-vision-analyst` agent running on the vision lane before any related edit happens. `Edit`/`Write` are **hard-blocked** until an analysis receipt exists for every pending image; `Read`/`Grep`/`Glob`/`Bash` stay unblocked so the analyst itself can see the image and write its receipt.
+- **Advisory routing (no hard block)**: when an image reaches the prompt, the vision router reminds the session to have `ukit-vision-analyst` analyse it before relying on its contents. Edits are **never blocked** — correctness relies on the model routing images to the analyst instead of guessing.
 - This is internal orchestration — end users never invoke a vision command directly; `ukit install` plus natural language remains the whole surface. No new commands.
 
 ## Session Start — OpenCode

package/templates/CLAUDE.md

@@ -206,10 +206,10 @@ This is internal orchestration — end users do not need to know about tiers, th
 
 ### Vision lane (capability, not a cost tier)
 
-`unic-vision` is a **capability lane**, not a fourth cost tier — it is orthogonal to lite/code/smart above and never appears as a row in the tier table. `unic-code` and `unic-smart` cannot read images on the UNIC gateway; they must never guess at image contents.
+`unic-vision` is a **capability lane**, not a fourth cost tier — it is orthogonal to lite/code/smart above and never appears as a row in the tier table. Whether a mapping can read images is a capability fact, not a provider fact: a mapping that has not **verified** native vision must never guess at image contents — choose native-first when verified, otherwise route to the specialist.
 
 - **Gateway detection**: UNIC routing for a Claude Code session is decided ONLY by what changes Claude Code's own outbound endpoint — `ANTHROPIC_BASE_URL` (env var, or the `env.ANTHROPIC_BASE_URL` key in project/home `.claude/settings.json`) containing `unicjsc.com`. Other tools' configs — Codex `config.toml`, Kilo `secrets.json`, or an `OPENAI_BASE_URL` env var — describe a different tool's endpoint entirely and never decide this session's routing.
-- **Enforcement**: every image (pasted, local file path, or URL) must be analysed by the `ukit-vision-analyst` agent running on the vision lane before any related edit happens. `Edit`/`Write` are **hard-blocked** until an analysis receipt exists for every pending image; `Read`/`Grep`/`Glob`/`Bash` stay unblocked so the analyst itself can see the image and write its receipt.
+- **Advisory routing (no hard block)**: when an image reaches the prompt, the vision router reminds the session to have `ukit-vision-analyst` analyse it before relying on its contents. Edits are **never blocked** — correctness relies on the model routing images to the analyst instead of guessing.
 - This is internal orchestration — end users never invoke a vision command directly; `ukit install` plus natural language remains the whole surface. No new commands.
 
 ## Skills

package/templates/ukit/storage/config.json

@@ -6,6 +6,10 @@
     "affectVerification": true,
     "affectDelegation": true
   },
+  "security": {
+    "sensitiveDataGate": true,
+    "allowlistPath": ".ukit/storage/security/allowlist.json"
+  },
   "compact": {
     "enabled": true,
     "tokenThreshold": 150000,
@@ -91,7 +95,6 @@
     "advisorEnabled": true,
     "contracts": {
       "tiny-fix": {
-        "modelTier": "lite",
         "maxReadPasses": 0,
         "maxContextPulls": 0,
         "verificationPolicy": "minimal-or-targeted",
@@ -99,7 +102,6 @@
         "delegationPolicy": "disallow"
       },
       "local-fix": {
-        "modelTier": "code",
         "maxReadPasses": 1,
         "maxContextPulls": 1,
         "verificationPolicy": "targeted-if-covered",
@@ -107,7 +109,6 @@
         "delegationPolicy": "disallow"
       },
       "local-build": {
-        "modelTier": "code",
         "maxReadPasses": 2,
         "maxContextPulls": 1,
         "verificationPolicy": "targeted-if-covered",
@@ -116,14 +117,12 @@
         "postEditReviewPolicy": "sidecar-non-blocking"
       },
       "find-cause": {
-        "modelTier": "code",
         "maxReadPassesBeforeReassess": 3,
         "verificationPolicy": "root-cause-then-targeted",
         "completionRule": "never-claim-fixed-without-write-and-verification",
         "delegationPolicy": "allow-specialized-debug-lane"
       },
       "shared-edit": {
-        "modelTier": "code",
         "maxReadPasses": 2,
         "maxContextPulls": 2,
         "verificationPolicy": "targeted-then-widen-on-risk",
@@ -132,7 +131,6 @@
         "postEditReviewPolicy": "sidecar-non-blocking"
       },
       "map-impact": {
-        "modelTier": "code",
         "maxReadPasses": 3,
         "maxContextPulls": 3,
         "verificationPolicy": "impact-first-then-targeted-then-widen-on-risk",
@@ -140,7 +138,6 @@
         "delegationPolicy": "allow-impact-sidecar"
       },
       "review-release": {
-        "modelTier": "smart",
         "verificationPolicy": "evidence-first",
         "completionRule": "report-findings-not-implementation",
         "delegationPolicy": "allow-review-sidecar"
@@ -392,6 +389,10 @@
       "affectVerification": "Nếu true, autonomy.level ảnh hưởng hành vi verification plan.",
       "affectDelegation": "Nếu true, autonomy.level ảnh hưởng ngưỡng delegation."
     },
+    "security": {
+      "sensitiveDataGate": "Bật sensitive-data gate: chặn key/private data/secret (đọc file .env, *.pem, id_rsa; lệnh bash dump secret; prompt chứa token) trước khi chúng tới AI. Chặn cực gắt theo yêu cầu: chỉ cần nghi ngờ là chặn và hỏi user. Tắt chỉ khi debug gate này.",
+      "allowlistPath": "File allowlist JSON do USER tự tạo để phê duyệt tường minh giá trị secret (sha256) hoặc đường dẫn file được phép gửi. File này được protect-files.sh chặn AI tự sửa."
+    },
     "compact": {
       "enabled": "Bật/tắt toàn bộ helper compact của UKit.",
       "tokenThreshold": "Ngưỡng token chung cho runtime compact dùng chung.",

package/src/core/router/advisor.js

@@ -1,42 +0,0 @@
-export function shouldEscalate(trigger) {
-  if (!trigger || typeof trigger !== 'object') {
-    return false;
-  }
-
-  if (trigger.type === 'user_requested') {
-    return true;
-  }
-
-  if (trigger.type === 'complexity_detected') {
-    return true;
-  }
-
-  if (trigger.type === 'retry_exceeded') {
-    return (trigger.attempts ?? 0) >= 2;
-  }
-
-  if (trigger.type === 'validation_failed') {
-    return (trigger.attempts ?? 0) >= 1;
-  }
-
-  return false;
-}
-
-export async function askAdvisor(request) {
-  const strategy = request?.question
-    ? `Break the task into verifiable steps, focusing on: ${request.question}`
-    : 'Break the task into smaller verifiable steps.';
-
-  return {
-    strategy,
-    steps: [
-      'Restate the goal in one short sentence.',
-      'List the smallest changes that can be verified locally.',
-      'Run focused checks before expanding the scope.',
-    ],
-    warnings: [
-      'Fallback advisor response used because no external advisor integration is wired in this local runtime.',
-    ],
-    confidence: 55,
-  };
-}