@ngockhoale/ukit 2.3.1 → 2.3.3

package/CHANGELOG.md

@@ -2,6 +2,73 @@
 
 All notable changes to UKit are documented here.
 
+## 2.3.3 - 2026-09-10
+
+False-stop and long-context release. Four fixes that share one theme: UKit must run a prompt
+to a finished result, and any stop must say why.
+
+Session-bound completion gate. Project-scoped route state could outlive the session-scoped
+execution ledger, so a new session could inherit an older session's completion contract and
+stop with a false `missing write-evidence` message. `skill-router.sh` now binds fresh, cached,
+and route-less state to `sessionId`; `execution-ledger.mjs` accepts route state only when its
+session matches the hook payload and ignores unbound legacy state for session-aware payloads.
+Same-session gating and prompt-scoped evidence carry remain intact. Regression coverage now
+covers mismatched sessions, unbound legacy state, and prior-session route isolation.
+
+Orchestration envelopes no longer corrupt the active route. `<task-notification>`,
+`<tool-result>`, `<system-reminder>`, and `<local-command-caveat>…</local-command-stdout>`
+payloads delivered through the prompt boundary were treated as explicit user prompts,
+rewriting route/cache/audit state mid-run. `skill-router.sh` now ignores complete envelopes
+before routing (fail-open, opening-tag attributes accepted); router exceptions surface on
+stderr instead of disappearing. Related ownership fixes: Stop evaluation loads route state
+with the current session payload, execution-ledger/route-task reject incompatible explicit
+session ownership without inventing identity, subagent tool calls cannot rewrite the main
+route, and cache entries are not touched before ownership is established.
+
+Ordinary long-context tasks preserve and resume. A natural-language routed task with no
+`docs/AI_HANDOFF/RUN.md` previously hit the hard-cap gate with no landing window and no
+resume cursor after compaction. Ordinary ledger state now gets the existing finite
+`hardCapGraceCalls` landing budget (only with explicit session ownership, matching
+session/prompt/request identity, unfinished evidence, and no blocker); the first grace call
+writes a 30-minute hash-only resume intent that `handoff-resume.sh` consumes once and
+emits as a continuation instruction with no raw prompt/command data. The
+`context-window-guard.sh` fallback moved from 220k to the shipped 500k default.
+
+New `vibecode` autonomy level. One typed prompt must run to a finished result: with
+`autonomy.level: vibecode`, the completion gate opts out of the continuation cap entirely and
+keeps blocking (including the reentrant `stop_hook_active` Stop) until completion evidence
+arrives or a genuine blocker is recorded — every block carries its reason. `deriveTaskRoute`
+now propagates `autonomyLevel` and a `continuousExecution` policy
+(`{ enabled, stopOn, maxContinuations }`) into `routeSummary` for every level, and
+`validateRuntimeConfig` accepts the fourth level.
+
+Dangerous commands are a human decision, not a silent block. `block-dangerous.sh` now emits a
+structured `permissionDecision: "ask"` (PreToolUse JSON) with the raw command scrubbed from
+all output — arguments and comments can carry secrets — while exit 2 still refuses the call
+for harnesses that ignore structured output. The omp bridge chain layer translates the same
+structured decision into an `ask` verdict; because omp has no native ask, its host boundary
+surfaces it as a block carrying the decision reason.
+
+## 2.3.2 - 2026-09-09
+
+Docs-contract release. "Every stop says why — no silent idle" is now a shipping Execution
+Contract rule, born from a real incident: a turn ended waiting for the user's `npm login`,
+the request sat at the bottom of a long report, the user did their part (created
+`~/.npmrc`), and the idle session looked exactly like a stall for 79 minutes.
+
+The new contract (identical in `CLAUDE.md` and `AGENTS.md`, parity-test enforced): when a
+turn ends only because the user must act (login, approval, protected-file edit), the reply
+opens with one line naming the exact action — `WAITING ON YOU: <command/action>` — and a
+one-shot wakeup (~20-30 min) is scheduled when the harness provides one, so the session
+re-checks and auto-continues once the user has acted. An ended turn cannot observe
+external/auth changes by itself; without that line the idle session is indistinguishable
+from a stall. Companion rule: any error (failed command, hook, test, publish) is reported
+verbatim in the same turn, never silently retried past the user.
+
+Decision recorded in `docs/MEMORY.md` with the incident as the reason. Verified: all
+doc-referencing suites 298/298 (incl. the CLAUDE↔AGENTS parity test, which caught the
+first one-sided edit before it could ship), consistency 194/194.
+
 ## 2.3.1 - 2026-09-09
 
 "1 prompt mà đứng 10 lần" is fixed at the root. Four stall vectors in the completion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "2.3.1",
+  "version": "2.3.3",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex, OpenCode, and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/src/core/runtimeConfig.js

@@ -257,7 +257,7 @@ export function validateRuntimeConfig(config) {
     errors.push('version must be a non-empty string.');
   }
 
-  const VALID_AUTONOMY_LEVELS = new Set(['conservative', 'balanced', 'free-run']);
+  const VALID_AUTONOMY_LEVELS = new Set(['conservative', 'balanced', 'free-run', 'vibecode']);
   if (!isPlainObject(config.autonomy)) {
     errors.push('autonomy must be an object.');
   } else {

package/src/index/taskRouting.js

@@ -240,6 +240,7 @@ export function buildRouteSummary({
     executionCandidates,
   });
   const executionContract = buildExecutionContract(executionMode);
+  const continuousExecution = buildContinuousExecutionPolicy(autonomyLevel);
   const postEditReview = executionContract?.postEditReviewPolicy
     ? { policy: executionContract.postEditReviewPolicy, agent: 'code-reviewer', reviewTargetType: 'diff' }
     : null;
@@ -290,6 +291,8 @@ export function buildRouteSummary({
     completionState,
     postEditReview,
     continuationState,
+    autonomyLevel,
+    continuousExecution,
     intentMode: routingContext.intentMode ?? null,
     handoffFile,
     handoffBudget,
@@ -303,6 +306,19 @@ export function buildRouteSummary({
   };
 }
 
+// Execution-ledger.mjs mirrors this policy for its Stop gate; the two must stay aligned.
+// MAX_CONTINUATIONS (6) below is the same constant the ledger enforces for bounded modes.
+function buildContinuousExecutionPolicy(autonomyLevel) {
+  if (autonomyLevel === 'vibecode') {
+    return {
+      enabled: true,
+      stopOn: ['completion-evidence', 'genuine-blocker', 'dangerous-command-decision'],
+      maxContinuations: null,
+    };
+  }
+  return { enabled: false, maxContinuations: 6 };
+}
+
 function deriveContextMode(taskType) {
   if (taskType === 'trivial' || taskType === 'simple') return 'LITE';
   if (taskType === 'non-trivial' || taskType === 'shared-simple') return 'FULL';

package/templates/.claude/hooks/block-dangerous.sh

@@ -42,10 +42,20 @@ DANGEROUS_PATTERNS=(
   "dd if=/dev/"
 )
 
+# Dangerous detections surface as a structured `ask` decision (stdout JSON) so a human
+# decides; exit 2 still refuses the call for harnesses that ignore structured output.
+# The raw command and the matched pattern are NEVER echoed — arguments and comments can
+# carry secrets, and the pattern text itself restates the dangerous command.
+emit_dangerous_decision() {
+  REASON="$1"
+  printf '%s\n' "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"$REASON\"}}"
+  echo "BLOCKED: $REASON" >&2
+  exit 2
+}
+
 for pattern in "${DANGEROUS_PATTERNS[@]}"; do
   if echo "$SCAN_COMMAND" | grep -qE "$pattern"; then
-    echo "BLOCKED: Dangerous command detected matching pattern '$pattern'. This command could cause irreversible damage. Ask the user to run it manually if truly needed." >&2
-    exit 2
+    emit_dangerous_decision "Dangerous command pattern detected; it could cause irreversible damage. UKit defers this to a human decision."
   fi
 done
 
@@ -60,11 +70,9 @@ if echo "$SCAN_COMMAND" | grep -qE "(^|[;&|[:space:]])rm([[:space:]]|$)"; then
     if echo "$SCAN_COMMAND" | grep -qE "$SAFE_DELETE_REGEX"; then
       :
     elif echo "$SCAN_COMMAND" | grep -qE "$UNSAFE_TARGET_REGEX"; then
-      echo "BLOCKED: Unsafe delete target detected. Refusing recursive force-delete." >&2
-      exit 2
+      emit_dangerous_decision "Unsafe delete target detected; recursive force-delete could cause irreversible damage. UKit defers this to a human decision."
     else
-      echo "BLOCKED: 'rm -rf' is only auto-allowed for safe cleanup targets (dist/build/coverage/.next/.nuxt/.turbo/tmp/.cache/node_modules)." >&2
-      exit 2
+      emit_dangerous_decision "Recursive force-delete outside safe cleanup targets (dist/build/coverage/.next/.nuxt/.turbo/tmp/.cache/node_modules) is destructive. UKit defers this to a human decision."
     fi
   fi
 fi

package/templates/.claude/hooks/context-hardcap-gate.sh

@@ -1,9 +1,9 @@
 #!/bin/bash
 # PreToolUse hook: hard-enforce an absolute context token cap (compact.hardCapTokens,
-# default 220000, sized for a 256k window — must stay below the model's real context
-# window, so lower it on a 200k model), separate from the
+# default 500000, sized for a 1M window — must stay below the model's real context
+# window, so lower it on a 200k/256k model), separate from the
 # soft/hard advisory pressure phases in
-# compact-threshold.mjs (default soft=50000/hard=80000, which only print a suggestion).
+# compact-threshold.mjs (default soft=150000/hard=240000, which only print a suggestion).
 #
 # Those advisory phases are just injected text — nothing stops the agent from ignoring
 # them and letting a session run to hundreds of thousands of tokens with no compaction.
@@ -18,12 +18,13 @@
 # real compaction.
 #
 # Grace window (compact.hardCapGraceCalls, default 10): blocking the very first tool call
-# past the cap strands a handoff run mid-edit — files half-written, nothing committed, no
-# cursor — which is strictly worse than letting it land. When docs/AI_HANDOFF/RUN.md shows
-# an unfinished run, the gate therefore allows a BOUNDED number of further calls so the run
-# can commit, write its cursor and push; after that it blocks exactly as before. The budget
-# is per over-cap episode, not per wave: it only resets when the estimate actually drops
-# (i.e. a real compaction happened), so a run cannot mint itself fresh grace forever.
+# past the cap strands a handoff run or ordinary routed task mid-edit — files half-written,
+# no durable completion state — which is strictly worse than letting it land. When RUN.md
+# shows an unfinished handoff run, or the shared ledger proves an unfinished session-bound
+# ordinary task, the gate allows a BOUNDED number of further calls so it can land the current
+# edit/verification and persist resume state; after that it blocks exactly as before. The
+# budget is per over-cap episode, not per wave: it only resets when the estimate actually
+# drops (i.e. a real compaction happened), so a task cannot mint itself fresh grace forever.
 #
 # Config toggle: compact.hardCapBlock (default true). Set to false only to debug this
 # gate itself; it must not become a normal escape hatch.
@@ -98,6 +99,10 @@ function readRunCursor() {
   }
 
   const mod = await import(pathToFileURL(thresholdModulePath).href);
+  const ledgerModulePath = path.join(hookDir, '..', 'ukit', 'runtime', 'execution-ledger.mjs');
+  const ledgerMod = fs.existsSync(ledgerModulePath)
+    ? await import(pathToFileURL(ledgerModulePath).href)
+    : null;
   const pressurePath = path.join(projectRoot, '.ukit', 'storage', 'cache', 'compact-pressure.json');
   const rawState = readJsonSafe(pressurePath, null);
 
@@ -127,7 +132,16 @@ function readRunCursor() {
   }
 
   const run = readRunCursor();
-  if (run) {
+  let ordinaryTask = null;
+  if (!run && ledgerMod) {
+    try {
+      ordinaryTask = await ledgerMod.readResumableExecution(projectRoot, payload);
+    } catch {
+      ordinaryTask = null;
+    }
+  }
+  const resumable = run || ordinaryTask;
+  if (resumable) {
     const graceCalls = Number.isFinite(config?.compact?.hardCapGraceCalls)
       ? config.compact.hardCapGraceCalls
       : 10;
@@ -145,17 +159,25 @@ function readRunCursor() {
       try {
         fs.mkdirSync(path.dirname(gracePath), { recursive: true });
         fs.writeFileSync(gracePath, JSON.stringify({ ...carried, used }));
+        if (ordinaryTask && ledgerMod && used === 1) {
+          await ledgerMod.writeResumeIntent(projectRoot, payload);
+        }
       } catch {
-        // Losing the counter must not block the run; worst case grace restarts.
+        // Losing the counter or advisory resume intent must not block the run.
       }
+      const landing = run
+        ? `An unfinished handoff run is in flight (Phase: ${run.phase}${run.cursor ? `, Cursor: ${run.cursor}` : ''}), so this call is allowed instead of stranding it mid-edit.`
+        : 'An unfinished ordinary routed task is in flight, so this call is allowed instead of stranding it before compaction.';
       process.stderr.write(
         [
           `CONTEXT OVER CAP — grace ${used}/${graceCalls} (~${state.estimatedTotalTokens} tokens >= ${thresholds.hardCapTokens}).`,
-          `An unfinished run is in flight (Phase: ${run.phase}${run.cursor ? `, Cursor: ${run.cursor}` : ''}), so this call is allowed instead of stranding it mid-edit.`,
-          'Spend the remaining grace on LANDING, not on new work: finish the current edit, commit, update docs/AI_HANDOFF/RUN.md, push.',
+          landing,
+          run
+            ? 'Spend the remaining grace on LANDING, not on new work: finish the current edit, commit, update docs/AI_HANDOFF/RUN.md, push.'
+            : 'Spend the remaining grace on LANDING, not on new work: finish the current mutation or verification, then compact as soon as the host allows it.',
           'Do NOT start a new task, open new files, or spawn agents. When grace runs out the gate blocks hard.',
-          'Tell the user in your reply that context is over the cap and they should run /compact as soon as this run lands.',
-          'After the user runs /compact, the SessionStart resume hook replays the cursor and the run continues automatically.',
+          'Tell the user in your reply that context is over the cap and they should run /compact as soon as this landing step is complete.',
+          'After compaction, the SessionStart resume hook replays the safe cursor and the task continues automatically.',
         ].join('\n') + '\n',
       );
       process.exit(0);
@@ -169,9 +191,9 @@ function readRunCursor() {
     'Typing "continue" alone will hit this same block; only /compact (or a new session) resets the counter. After compacting, resume the interrupted task.',
     'This is an absolute ceiling (compact.hardCapTokens), separate from the soft/hard advisory phases — those were apparently not followed.',
     `Edit/Write/Bash refused (tool_name=${toolName}) until real compaction happens.`,
-    run
+    resumable
       ? 'The unfinished-run grace window (compact.hardCapGraceCalls) is already exhausted — progress should be committed and the cursor written by now.'
-      : 'No unfinished run in docs/AI_HANDOFF/RUN.md, so there is no grace window to spend.',
+      : 'No resumable unfinished routed task was found, so there is no grace window to spend.',
     'Do not work around this by summarizing inline and continuing, and do not reach for a non-gated write tool.',
   ];
   process.stderr.write(`${lines.join('\n')}\n`);

package/templates/.claude/hooks/context-window-guard.sh

@@ -75,7 +75,7 @@ function loadHardCap() {
     const value = JSON.parse(raw)?.compact?.hardCapTokens;
     if (Number.isFinite(value) && value > 0) return value;
   } catch { /* fall through to the default */ }
-  return 220_000;
+  return 500_000;
 }
 
 let text;

package/templates/.claude/hooks/handoff-resume.sh

@@ -25,6 +25,7 @@ PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
 INPUT="$INPUT" PROJECT_ROOT="$PROJECT_ROOT" node <<'NODE' || true
 const fs = require('fs');
 const path = require('path');
+const { pathToFileURL } = require('url');
 
 const payload = (() => {
   try {
@@ -37,54 +38,84 @@ const payload = (() => {
 
 const projectRoot = process.env.PROJECT_ROOT;
 const runPath = path.join(projectRoot, 'docs', 'AI_HANDOFF', 'RUN.md');
+const runtimePath = path.join(projectRoot, '.claude', 'ukit', 'runtime', 'execution-ledger.mjs');
+const source = typeof payload.source === 'string' ? payload.source : 'startup';
 
-let text;
-try {
-  text = fs.readFileSync(runPath, 'utf8');
-} catch {
-  // No cursor file: nothing was running, or the last cycle was cleared. Stay silent —
-  // a resume banner on every ordinary session start would be pure noise.
-  process.exit(0);
+async function emitOrdinaryResume() {
+  if (!fs.existsSync(runtimePath)) return false;
+  try {
+    const runtime = await import(pathToFileURL(runtimePath).href);
+    const intent = await runtime.readResumeIntent(projectRoot, payload, { consume: true });
+    if (!intent) return false;
+    const out = [
+      'UKIT ROUTED TASK RESUME — an unfinished ordinary routed task was preserved before context compaction.',
+      '',
+      'This is a CONTINUATION, not a new request. Do not re-plan or ask whether to continue.',
+      'Resume the current routed task from its existing route state and execution ledger.',
+      'Use one bounded source/context slice if needed, then execute the next missing edit or verification milestone.',
+    ];
+    if (source === 'compact') {
+      out.push('');
+      out.push('The session was just compacted, so the window is clean — resume immediately rather than reporting status and waiting.');
+    }
+    process.stdout.write(`${out.join('\n')}\n`);
+    return true;
+  } catch {
+    return false;
+  }
 }
 
-const field = (name) => (text.match(new RegExp(`^${name}:\\s*(.+)$`, 'm'))?.[1] || '').trim();
+(async () => {
+  let text;
+  try {
+    text = fs.readFileSync(runPath, 'utf8');
+  } catch {
+    // No handoff cursor: an ordinary routed-task intent may still be resumable.
+    await emitOrdinaryResume();
+    process.exit(0);
+  }
 
-const phase = field('Phase');
-// `done` means the last cycle finished cleanly. Anything else means a step was in flight.
-if (!phase || /^done$/i.test(phase)) process.exit(0);
+  const field = (name) => (text.match(new RegExp(`^${name}:\\s*(.+)$`, 'm'))?.[1] || '').trim();
 
-const goal = field('Goal');
-const base = field('Base');
-const cursor = field('Cursor');
-const next = field('Next');
-const source = typeof payload.source === 'string' ? payload.source : 'startup';
+  const phase = field('Phase');
+  // `done` means the last cycle finished cleanly. Anything else means a step was in flight.
+  if (!phase || /^done$/i.test(phase)) {
+    await emitOrdinaryResume();
+    process.exit(0);
+  }
 
-const out = [
-  'UKIT HANDOFF RESUME — an unfinished handoff-fullstack run was found on disk.',
-  `  Goal:   ${goal || '(not recorded)'}`,
-  `  Base:   ${base || '(not recorded)'}`,
-  `  Phase:  ${phase}`,
-  `  Cursor: ${cursor || '(not recorded)'}`,
-  `  Next:   ${next || '(not recorded)'}`,
-  '',
-  'This is a CONTINUATION, not a new cycle. Do not re-plan, do not overwrite PLAN.md or the',
-  'task files, and do not ask the user whether to continue — they already asked for a',
-  'one-shot run and the pipeline was interrupted, not cancelled.',
-  '',
-  'Read docs/AI_HANDOFF/RUN.md and docs/AI_HANDOFF/INDEX.md, then execute the `Next:` step',
-  'above using .claude/commands/ukit/handoff-fullstack.md as the procedure. Skip tasks',
-  'already `done` or `pending_review`; pick up `ready`, `in_progress`, `changes_requested`',
-  'and `blocked` ones. Keep writing the cursor after every step.',
-];
+  const goal = field('Goal');
+  const base = field('Base');
+  const cursor = field('Cursor');
+  const next = field('Next');
 
-if (source === 'compact') {
-  out.push('');
-  out.push('The session was just compacted, so the window is clean — this is the ideal moment');
-  out.push('to continue. Resume immediately rather than reporting status and waiting.');
-}
+  const out = [
+    'UKIT HANDOFF RESUME — an unfinished handoff-fullstack run was found on disk.',
+    `  Goal:   ${goal || '(not recorded)'}`,
+    `  Base:   ${base || '(not recorded)'}`,
+    `  Phase:  ${phase}`,
+    `  Cursor: ${cursor || '(not recorded)'}`,
+    `  Next:   ${next || '(not recorded)'}`,
+    '',
+    'This is a CONTINUATION, not a new cycle. Do not re-plan, do not overwrite PLAN.md or the',
+    'task files, and do not ask the user whether to continue — they already asked for a',
+    'one-shot run and the pipeline was interrupted, not cancelled.',
+    '',
+    'Read docs/AI_HANDOFF/RUN.md and docs/AI_HANDOFF/INDEX.md, then execute the `Next:` step',
+    'above using .claude/commands/ukit/handoff-fullstack.md as the procedure. Skip tasks',
+    'already `done` or `pending_review`; pick up `ready`, `in_progress`, `changes_requested`',
+    'and `blocked` ones. Keep writing the cursor after every step.',
+  ];
 
-process.stdout.write(`${out.join('\n')}\n`);
-process.exit(0);
+  if (source === 'compact') {
+    out.push('');
+    out.push('The session was just compacted, so the window is clean — this is the ideal moment');
+    out.push('to continue. Resume immediately rather than reporting status and waiting.');
+  }
+
+  process.stdout.write(`${out.join('\n')}\n`);
+  process.exit(0);
+})();
 NODE
 
 exit 0

package/templates/.claude/hooks/skill-router.sh

@@ -5,6 +5,34 @@
 INPUT=$(cat)
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
 
+# Internal orchestration envelopes are not user requests. Ignore them before routing or
+# compact-pressure bookkeeping so task results cannot replace the active completion contract.
+case "$INPUT" in
+  *"<task-notification"*|*"<tool-result"*|*"<system-reminder"*|*"<local-command-caveat"*)
+    INTERNAL_ORCHESTRATION=$(INPUT="$INPUT" node -e '
+try {
+  const payload = JSON.parse(process.env.INPUT || "{}");
+  const candidates = [payload?.prompt, payload?.user_prompt, payload?.text, payload?.message, payload?.input]
+    .filter((value) => typeof value === "string")
+    .map((value) => value.trim());
+  const block = (name) => new RegExp(`^<${name}(?:\\s[^>]*)?>[\\s\\S]*<\\/${name}>$`, "i");
+  const internal = candidates.some((value) => (
+    block("task-notification").test(value)
+    || block("tool-result").test(value)
+    || block("system-reminder").test(value)
+    || /^<local-command-caveat(?:\s[^>]*)?>[\s\S]*<\/local-command-stdout>$/i.test(value)
+  ));
+  process.stdout.write(internal ? "1" : "0");
+} catch {
+  process.stdout.write("0");
+}
+' 2>/dev/null)
+    if [ "$INTERNAL_ORCHESTRATION" = "1" ]; then
+      exit 0
+    fi
+    ;;
+esac
+
 # Worktree early-exit: when the tool call is scoped to a disposable .worktrees/task-*
 # tree, there is nothing to route — exit before spawning the router. Reads
 # tool_input.file_path / tool_input.path / tool_input.command (never tool_input.pattern).
@@ -2367,8 +2395,6 @@ const { pathToFileURL } = require('url');
   const routeCachePath = path.join(projectRoot, '.claude', 'ukit', 'route-cache.json');
   const routeAuditPath = path.join(projectRoot, '.ukit', 'storage', 'cache', 'route-audit.json');
   const cacheUtilsPath = path.join(projectRoot, '.claude', 'ukit', 'index', 'cache-utils.mjs');
-  const previous = readJson(statePath, {});
-  const runtimeConfig = loadRuntimeConfig(projectRoot);
 
   let payload = {};
   try {
@@ -2377,6 +2403,20 @@ const { pathToFileURL } = require('url');
     payload = {};
   }
 
+  const sessionCandidate = payload.session_id ?? payload.sessionId;
+  const sessionId = sessionCandidate === undefined || sessionCandidate === null
+    ? null
+    : String(sessionCandidate).trim() || null;
+  const storedPrevious = readJson(statePath, {});
+  // Route state is project-local, while hook ledgers are session-local. Do not let a
+  // differently-bound snapshot become the contract for a new session.
+  const previous = sessionId
+    ? (storedPrevious?.sessionId && String(storedPrevious.sessionId).trim() === sessionId
+      ? storedPrevious
+      : {})
+    : storedPrevious;
+  const runtimeConfig = loadRuntimeConfig(projectRoot);
+
   const promptText = extractPrompt(payload);
   const commandText = payload.tool_input?.command || payload.command || '';
   const filePath = normalizeRelativeFile(projectRoot, payload.tool_input?.file_path || payload.file_path || '');
@@ -2447,6 +2487,7 @@ const { pathToFileURL } = require('url');
     // whether a Stop is premature. Downgrading to a route-less state here silently disarms
     // the gate mid-task, so carry the previous route forward until a real route replaces it.
     fs.writeFileSync(statePath, JSON.stringify({
+      ...(sessionId ? { sessionId } : {}),
       fingerprint,
       ts: now,
       source: 'skill-router',
@@ -2562,8 +2603,12 @@ const { pathToFileURL } = require('url');
         touch: true,
       })
     : null;
+  const sessionCompatibleCachedRoute = !sessionId
+    || Boolean(cachedRouteState?.sessionId)
+      && String(cachedRouteState.sessionId).trim() === sessionId;
   if (
-    cachedRouteState?.requestKey === requestKey
+    sessionCompatibleCachedRoute
+    && cachedRouteState?.requestKey === requestKey
     && cachedRouteState?.routeSummary
     && Array.isArray(cachedRouteState?.activeSkills)
   ) {
@@ -2581,6 +2626,7 @@ const { pathToFileURL } = require('url');
     }
     const reusedState = {
       ...cachedRouteState,
+      ...(sessionId ? { sessionId } : {}),
       source: 'skill-router',
       ts: now,
       requestKey,
@@ -2671,6 +2717,7 @@ const { pathToFileURL } = require('url');
     routeSummary,
   });
   const sharedState = {
+    ...(sessionId ? { sessionId } : {}),
     requestKey,
     fingerprint,
     ts: now,
@@ -2709,7 +2756,9 @@ const { pathToFileURL } = require('url');
     ) {
       process.stdout.write(`[ukit-skill-router] Helper: ${routeSummary.helperHint}\n`);
     }
-})().catch(() => {
+})().catch((error) => {
+  const detail = error?.message || String(error);
+  process.stderr.write(`[ukit-skill-router] ${detail}\n`);
   process.exit(0);
 });
 NODE

package/templates/.claude/ukit/index/route-task.mjs

@@ -166,7 +166,11 @@ async function main() {
   const sharedStatePath = path.join(rootDir, '.claude', 'ukit', 'skill-router-state.json');
   const routeCachePath = path.join(rootDir, '.claude', 'ukit', 'route-cache.json');
   const routeAuditPath = path.join(rootDir, '.ukit', 'storage', 'cache', 'route-audit.json');
-  const previousState = await readJson(sharedStatePath, {});
+  const persistedPreviousState = await readJson(sharedStatePath, {});
+  const sessionId = normalizeSessionId(readFlagValue(args, '--session-id'));
+  const previousStateOwnershipBlocked = hasRouteStateOwner(persistedPreviousState)
+    && !isRouteStateCompatible(persistedPreviousState, sessionId);
+  const previousState = previousStateOwnershipBlocked ? {} : persistedPreviousState;
   const escalationConfig = await readJson(path.join(rootDir, '.ukit', 'storage', 'config.json'), null);
   const targetFile = readFlagValue(args, '--target');
   const taskType = readFlagValue(args, '--type');
@@ -185,7 +189,7 @@ async function main() {
     .trim();
 
   if (!promptText && !commandText && !targetFile) {
-    console.error('Usage: node .codex/ukit/index/route-task.mjs "<prompt>" [--tool-command <cmd>] [--target <file>] [--type trivial|simple|non-trivial] [--adapter codex|claude|antigravity|opencode]');
+    console.error('Usage: node .codex/ukit/index/route-task.mjs "<prompt>" [--tool-command <cmd>] [--target <file>] [--type trivial|simple|non-trivial] [--session-id <id>] [--adapter codex|claude|antigravity|opencode]');
     process.exitCode = 1;
     return;
   }
@@ -245,18 +249,33 @@ async function main() {
     previousState,
     requestKey,
   });
+  const routeCacheEntry = previousStateOwnershipBlocked
+    ? null
+    : await readRecentCacheEntry(routeCachePath, requestKey, {
+        maxEntries: DEFAULT_RECENT_CACHE_MAX_ENTRIES,
+        touch: false,
+      });
+  const cachedRouteState = reuseSharedRouteState({
+    previousState: routeCacheEntry,
+    requestKey,
+  });
+  const cachedRouteStateOwnershipBlocked = hasRouteStateOwner(routeCacheEntry)
+    && !isRouteStateCompatible(routeCacheEntry, sessionId);
+  const canPersistRouteState = !previousStateOwnershipBlocked;
+  const canPersistCachedRouteState = !cachedRouteStateOwnershipBlocked;
+
   if (reusableState) {
     printRouteState(reusableState);
     return;
   }
 
-  const cachedRouteState = reuseSharedRouteState({
-    previousState: await readRecentCacheEntry(routeCachePath, requestKey, {
+  if (cachedRouteState && canPersistCachedRouteState) {
+    await readRecentCacheEntry(routeCachePath, requestKey, {
       maxEntries: DEFAULT_RECENT_CACHE_MAX_ENTRIES,
       touch: true,
-    }),
-    requestKey,
-  });
+    });
+  }
+
   if (cachedRouteState) {
     const rescuedRouteSummary = cachedRouteState.routeSummary
       ? {
@@ -277,16 +296,19 @@ async function main() {
     }
     const sharedState = {
       ...cachedRouteState,
+      ...(sessionId ? { sessionId } : {}),
       source: 'task-route',
       ts: Date.now(),
       requestKey,
       routeSummary: rescuedRouteSummary,
     };
     sharedState.fingerprint = buildRouteStateFingerprint(sharedState);
-    await writeJson(sharedStatePath, sharedState);
-    await appendRouteAuditEntry(routeAuditPath, buildRouteAuditEntry({
-      state: sharedState,
-    }));
+    if (canPersistCachedRouteState) {
+      await writeJson(sharedStatePath, sharedState);
+      await appendRouteAuditEntry(routeAuditPath, buildRouteAuditEntry({
+        state: sharedState,
+      }));
+    }
     printRouteState(sharedState);
     return;
   }
@@ -324,15 +346,18 @@ async function main() {
     source: 'task-route',
     requestKey,
     indexGeneratedAtMs,
+    sessionId,
   });
-  await writeJson(sharedStatePath, sharedState);
-  await appendRouteAuditEntry(routeAuditPath, buildRouteAuditEntry({
-    route,
-    state: sharedState,
-  }));
-  await writeRecentCacheEntry(routeCachePath, compactRouteCacheState(sharedState), {
-    maxEntries: DEFAULT_RECENT_CACHE_MAX_ENTRIES,
-  });
+  if (canPersistRouteState) {
+    await writeJson(sharedStatePath, sharedState);
+    await appendRouteAuditEntry(routeAuditPath, buildRouteAuditEntry({
+      route,
+      state: sharedState,
+    }));
+    await writeRecentCacheEntry(routeCachePath, compactRouteCacheState(sharedState), {
+      maxEntries: DEFAULT_RECENT_CACHE_MAX_ENTRIES,
+    });
+  }
 
   printRouteState(sharedState);
 }
@@ -1509,6 +1534,7 @@ function buildRouteSummary({
     executionCandidates,
   });
   const executionContract = buildExecutionContract(executionMode);
+  const continuousExecution = buildContinuousExecutionPolicy(autonomyLevel);
   const tierLane = buildTierLane({ modelTier: executionContract?.modelTier ?? null });
   const completionState = buildCompletionState({
     executionMode,
@@ -1555,6 +1581,8 @@ function buildRouteSummary({
     tierLane,
     completionState,
     continuationState,
+    autonomyLevel,
+    continuousExecution,
     ...(expectedSourceFiles.length > 0 ? { expectedSourceFiles } : {}),
     intentMode: routingContext.intentMode ?? null,
     handoffFile,
@@ -1573,6 +1601,19 @@ function buildRouteSummary({
   };
 }
 
+// Execution-ledger.mjs mirrors this policy for its Stop gate; the two must stay aligned.
+// MAX_CONTINUATIONS (6) below is the same constant the ledger enforces for bounded modes.
+function buildContinuousExecutionPolicy(autonomyLevel) {
+  if (autonomyLevel === 'vibecode') {
+    return {
+      enabled: true,
+      stopOn: ['completion-evidence', 'genuine-blocker', 'dangerous-command-decision'],
+      maxContinuations: null,
+    };
+  }
+  return { enabled: false, maxContinuations: 6 };
+}
+
 function deriveContextMode(taskType) {
   if (taskType === 'trivial' || taskType === 'simple') return 'LITE';
   if (taskType === 'non-trivial' || taskType === 'shared-simple') return 'FULL';
@@ -2665,11 +2706,25 @@ function readFlagValue(argv, flag) {
   return withEquals ? withEquals.slice(flag.length + 1) : null;
 }
 
+function normalizeSessionId(value) {
+  const normalized = value === undefined || value === null ? '' : String(value).trim();
+  return normalized || null;
+}
+
+function hasRouteStateOwner(state) {
+  return Boolean(normalizeSessionId(state?.sessionId));
+}
+
+function isRouteStateCompatible(state, sessionId) {
+  const owner = normalizeSessionId(state?.sessionId);
+  return Boolean(owner && sessionId && owner === sessionId);
+}
+
 function isFlagOrValue(argv, index) {
   const arg = argv[index];
   if (!arg.startsWith('--')) {
     const prev = argv[index - 1];
-    return Boolean(prev && ['--root', '--target', '--type', '--tool-command', '--last-prompt', '--adapter'].includes(prev));
+    return Boolean(prev && ['--root', '--target', '--type', '--tool-command', '--last-prompt', '--session-id', '--adapter'].includes(prev));
   }
   return true;
 }
@@ -2805,6 +2860,7 @@ function createSharedRouteState({
   route,
   source = 'task-route',
   requestKey = null,
+  sessionId = null,
 }) {
   const helpers = compactHelpers({
     verificationRecommendation: route.verificationRecommendation ?? null,
@@ -2812,6 +2868,7 @@ function createSharedRouteState({
   });
 
   return {
+    ...(sessionId ? { sessionId } : {}),
     requestKey,
     fingerprint: buildRouteStateFingerprint(route),
     ts: Date.now(),

package/templates/.claude/ukit/runtime/execution-ledger.mjs

@@ -7,6 +7,8 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const LEDGER_VERSION = 1;
+const RESUME_INTENT_VERSION = 1;
+const RESUME_INTENT_TTL_MS = 30 * 60 * 1000;
 const MAX_RECEIPTS = 24;
 const MAX_SOURCE_FILES = 16;
 const MAX_CONTINUATIONS = 6;
@@ -30,11 +32,17 @@ function firstDefined(values) {
   return values.find((value) => value !== undefined && value !== null);
 }
 
-function sessionIdentity(payload = {}) {
-  const sessionId = firstDefined([
-    payload.session_id,
-    payload.sessionId,
+function explicitSessionId(value = {}) {
+  const candidate = firstDefined([
+    value.session_id,
+    value.sessionId,
   ]);
+  const normalized = candidate === undefined || candidate === null ? '' : String(candidate).trim();
+  return normalized || null;
+}
+
+function sessionIdentity(payload = {}) {
+  const sessionId = explicitSessionId(payload);
   if (sessionId) return safeSegment(sessionId);
 
   const transcriptPath = firstDefined([
@@ -58,6 +66,17 @@ function ledgerPath(projectRoot, payload = {}) {
   );
 }
 
+function resumeIntentPath(projectRoot, sessionId) {
+  return path.join(
+    projectRoot,
+    '.ukit',
+    'storage',
+    'cache',
+    'resume-intents',
+    `${safeSegment(sessionId)}.json`,
+  );
+}
+
 async function readJson(filePath, fallback = null) {
   try {
     return JSON.parse(await fs.readFile(filePath, 'utf8'));
@@ -73,14 +92,107 @@ async function writeJsonAtomic(filePath, value) {
   await fs.rename(tempPath, filePath);
 }
 
-export async function readRouteState(projectRoot) {
-  return readJson(path.join(projectRoot, '.claude', 'ukit', 'skill-router-state.json'), null);
+export async function readRouteState(projectRoot, payload = {}) {
+  const state = await readJson(path.join(projectRoot, '.claude', 'ukit', 'skill-router-state.json'), null);
+  const sessionId = explicitSessionId(payload);
+  const stateSessionId = explicitSessionId(state || {});
+  if (!state || !sessionId) return state;
+  if (!stateSessionId) return null;
+  return stateSessionId === sessionId ? state : null;
 }
 
 export async function readExecutionLedger(projectRoot, payload = {}) {
   return readJson(ledgerPath(projectRoot, payload), null);
 }
 
+function promptKeyFromText(promptText) {
+  const normalized = String(promptText || '').trim();
+  if (!normalized) return null;
+  return `prompt-${crypto.createHash('sha256').update(normalized).digest('hex').slice(0, 20)}`;
+}
+
+function explicitPromptKey(routeState = {}) {
+  return promptKeyFromText(routeState?.routingContext?.lastExplicitUserPromptText);
+}
+
+function hasUnfinishedCompletion(state = {}, ledger = {}) {
+  if (ledger?.blocker) return false;
+  const mode = state?.routeSummary?.executionMode || state?.routeSummary?.approachSelector?.executionMode;
+  if (!IMPLEMENT_MODES.has(mode)) return false;
+  const required = requiredEvidence(state);
+  if (required.length === 0) return false;
+  return required.some((item) => !evidenceSatisfied(item, ledger, state?.routeSummary || {}));
+}
+
+function resumeSessionHash(sessionId) {
+  return crypto.createHash('sha256').update(String(sessionId)).digest('hex').slice(0, 32);
+}
+
+export async function readResumableExecution(projectRoot, payload = {}) {
+  const sessionId = explicitSessionId(payload);
+  if (!sessionId) return null;
+  const state = await readRouteState(projectRoot, payload);
+  const ledger = await readExecutionLedger(projectRoot, payload);
+  const promptKey = explicitPromptKey(state || {});
+  if (!state || !ledger || !ledger.sessionId || ledger.sessionId !== sessionId
+    || ledger.sessionKey !== safeSegment(sessionId) || !ledger.requestKey
+    || !ledger.promptKey || !promptKey || ledger.promptKey !== promptKey
+    || !hasUnfinishedCompletion(state, ledger)) {
+    return null;
+  }
+  return { state, ledger, sessionId };
+}
+
+export async function readResumeIntent(projectRoot, payload = {}, { consume = false, now = Date.now() } = {}) {
+  const sessionId = explicitSessionId(payload);
+  if (!sessionId) return null;
+  const intent = await readJson(resumeIntentPath(projectRoot, sessionId), null);
+  if (!intent || intent.version !== RESUME_INTENT_VERSION) return null;
+  if (intent.sessionKey !== safeSegment(sessionId) || intent.sessionHash !== resumeSessionHash(sessionId)) return null;
+  if (!intent.promptKey || !intent.requestKey || !Number.isFinite(intent.expiresAt) || intent.expiresAt <= now) return null;
+
+  const state = await readRouteState(projectRoot, payload);
+  const ledger = await readExecutionLedger(projectRoot, payload);
+  const promptKey = explicitPromptKey(state || {});
+  if (!state || !ledger || ledger.sessionId !== sessionId
+    || ledger.sessionKey !== safeSegment(sessionId)
+    || state.requestKey !== intent.requestKey
+    || ledger.requestKey !== intent.requestKey
+    || promptKey !== intent.promptKey
+    || ledger.promptKey !== intent.promptKey
+    || !hasUnfinishedCompletion(state, ledger)) {
+    return null;
+  }
+  if (consume) {
+    await fs.rm(resumeIntentPath(projectRoot, sessionId), { force: true });
+  }
+  return intent;
+}
+
+export async function writeResumeIntent(projectRoot, payload = {}, { now = Date.now() } = {}) {
+  const sessionId = explicitSessionId(payload);
+  if (!sessionId) return null;
+  const state = await readRouteState(projectRoot, payload);
+  const ledger = await readExecutionLedger(projectRoot, payload);
+  const promptKey = explicitPromptKey(state || {});
+  if (!state || !ledger || ledger.sessionId !== sessionId || !promptKey
+    || ledger.promptKey !== promptKey || !ledger.requestKey || !hasUnfinishedCompletion(state, ledger)) {
+    return null;
+  }
+  const intent = {
+    version: RESUME_INTENT_VERSION,
+    sessionKey: safeSegment(sessionId),
+    sessionHash: resumeSessionHash(sessionId),
+    promptKey,
+    requestKey: ledger.requestKey,
+    routeFingerprint: state.fingerprint || null,
+    createdAt: now,
+    expiresAt: now + RESUME_INTENT_TTL_MS,
+  };
+  await writeJsonAtomic(resumeIntentPath(projectRoot, sessionId), intent);
+  return intent;
+}
+
 function explicitError(payload = {}) {
   return [
     payload.isError,
@@ -246,7 +358,7 @@ export async function recordExecutionReceipt({
   harness = 'unknown',
 } = {}) {
   if (!projectRoot || !toolName) return null;
-  const routeState = await readRouteState(projectRoot);
+  const routeState = await readRouteState(projectRoot, payload);
   const current = await readExecutionLedger(projectRoot, payload);
   const ledger = !current || current.requestKey !== (routeState?.requestKey || null)
     ? carriedEvidenceLedger(freshLedger(payload, routeState, harness), current)
@@ -376,6 +488,9 @@ function recoveryInstruction(missingEvidence, ledger = {}, routeSummary = {}) {
 
 export function evaluateCompletion({ state = {}, ledger = {} } = {}) {
   const routeSummary = state?.routeSummary || {};
+  // Explicit vibecode autonomy: the user asked UKit to run one prompt to a finished result,
+  // so the completion gate keeps pushing instead of releasing at the continuation cap.
+  const vibecode = routeSummary.autonomyLevel === 'vibecode';
   const mode = routeSummary.executionMode || routeSummary.approachSelector?.executionMode || null;
   const evidence = requiredEvidence(state);
   if (ledger?.blocker) {
@@ -411,7 +526,7 @@ export function evaluateCompletion({ state = {}, ledger = {} } = {}) {
   const continuationCount = staleContinuations
     ? 0
     : Number(effectiveLedger?.continuationCount || 0);
-  if (continuationCount >= MAX_CONTINUATIONS) {
+  if (!vibecode && continuationCount >= MAX_CONTINUATIONS) {
     if (effectiveLedger?.notified === true) {
       return {
         continue: false,
@@ -431,7 +546,7 @@ export function evaluateCompletion({ state = {}, ledger = {} } = {}) {
     };
   }
 
-  const finalAttempt = continuationCount === MAX_CONTINUATIONS - 1;
+  const finalAttempt = !vibecode && continuationCount === MAX_CONTINUATIONS - 1;
   const instruction = recoveryInstruction(missingEvidence, effectiveLedger, routeSummary);
   return {
     continue: true,
@@ -440,6 +555,7 @@ export function evaluateCompletion({ state = {}, ledger = {} } = {}) {
       `UKit completion gate: missing ${missingEvidence.join(', ')}.`,
       instruction,
       finalAttempt ? 'Final automatic recovery attempt: finish now or report a concrete blocker with its evidence.' : null,
+      vibecode ? 'Continuous (vibecode) execution is active: keep working until the requested result is complete; UKit stops only on completion evidence, a genuine blocker, or a dangerous-command decision.' : null,
     ].filter(Boolean).join(' '),
   };
 }
@@ -490,7 +606,7 @@ async function main() {
     return;
   }
   if (process.argv.includes('--evaluate-stop')) {
-    const state = await readRouteState(projectRoot);
+    const state = await readRouteState(projectRoot, payload);
     const ledger = await readExecutionLedger(projectRoot, payload) || {};
     const result = evaluateCompletion({ state, ledger });
 
@@ -498,7 +614,10 @@ async function main() {
     // that recovery turn creates a self-sustaining loop, so let it end normally instead.
     // If work still lacks evidence, surface the recovery reason to the user rather than
     // silently ending after the automatic continuation.
-    if (payload.stop_hook_active === true) {
+    // Vibecode autonomy keeps pushing through the reentrant Stop as well: the recovery turn
+    // after a block is another chance to finish the work, not a release valve. Block again
+    // with the reason; the loop still ends the moment evidence lands or a blocker appears.
+    if (payload.stop_hook_active === true && state?.routeSummary?.autonomyLevel !== 'vibecode') {
       if (result.continue || result.capped || result.notify) {
         const recoveryReason = result.reason
           || 'UKit completion gate reached its continuation limit; unfinished work was not retried again.';

package/templates/.omp/hooks/pre/ukit-bridge.js

@@ -138,6 +138,26 @@ function buildHookPayload(hookEventName, fields = {}) {
   return payload;
 }
 
+// A chain script may emit a Claude-Code-shaped structured decision on stdout. `ask` means
+// the human must decide — the chain layer passes it through as a non-block `ask` verdict and
+// the host boundary in hook() converts it to what the host supports. `deny` is a block that
+// carries the structured reason. Anything unparseable falls through to exit-code semantics.
+function parseStructuredDecision(stdout) {
+  if (typeof stdout !== 'string' || !stdout.trim()) return null;
+  try {
+    const decision = JSON.parse(stdout)?.hookSpecificOutput;
+    if (decision?.hookEventName !== 'PreToolUse') return null;
+    const permissionDecision = decision.permissionDecision;
+    if (permissionDecision !== 'ask' && permissionDecision !== 'deny') return null;
+    return {
+      permissionDecision,
+      reason: typeof decision.permissionDecisionReason === 'string' ? decision.permissionDecisionReason : '',
+    };
+  } catch {
+    return null;
+  }
+}
+
 function translateExecResult(scriptName, execResult) {
   const killed = Boolean(execResult?.killed);
   const code = killed ? 1 : (execResult?.code ?? 0);
@@ -150,6 +170,19 @@ function translateExecResult(scriptName, execResult) {
     return { block: false, stdout, stderr };
   }
   if (code === 2) {
+    const structured = parseStructuredDecision(stdout);
+    if (structured?.permissionDecision === 'ask') {
+      return {
+        block: false,
+        ask: true,
+        reason: structured.reason || stderr || `${scriptName} requires a human decision`,
+        stdout,
+        stderr,
+      };
+    }
+    if (structured?.permissionDecision === 'deny') {
+      return { block: true, reason: structured.reason || stderr || `${scriptName} denied the call`, stdout, stderr };
+    }
     return { block: true, reason: stderr || `${scriptName} exited 2 (blocked)`, stdout, stderr };
   }
   if (classifyFailure(scriptName) === 'closed') {
@@ -300,6 +333,9 @@ export async function runScriptChain(
     if (verdict.block) {
       return { block: true, reason: verdict.reason, context, invoked };
     }
+    if (verdict.ask) {
+      return { block: false, ask: true, reason: verdict.reason, context, invoked };
+    }
   }
 
   return { block: false, context, invoked };
@@ -501,7 +537,7 @@ export async function runSessionStop(
 ) {
   const metadata = runtimeMetadata(event, extensionContext);
   const payload = buildHookPayload('Stop', metadata);
-  const state = suppliedState ?? await readRouteState(projectRoot);
+  const state = suppliedState ?? await readRouteState(projectRoot, payload);
   const ledger = suppliedLedger ?? await readExecutionLedger(projectRoot, payload) ?? {};
   const evaluation = evaluateCompletion({ state, ledger });
   if (!evaluation.continue) {
@@ -545,9 +581,12 @@ export default function hook(pi) {
   const projectRoot = process.env.CLAUDE_PROJECT_DIR || installedProjectRoot();
 
   pi.on('tool_call', (event, context) => {
-    return runToolCall(pi, event, { projectRoot, context }).then((result) => (
-      result.block ? { block: true, reason: result.reason } : undefined
-    ));
+    return runToolCall(pi, event, { projectRoot, context }).then((result) => {
+      // omp's hook surface has no native `ask`; a human-decision verdict is surfaced by
+      // blocking with the decision reason, so a dangerous command never runs silently.
+      if (result.block || result.ask) return { block: true, reason: result.reason };
+      return undefined;
+    });
   });
   pi.on('tool_result', (event, context) => runToolResult(pi, event, { projectRoot, context }));
   pi.on('before_agent_start', (event, context) => runBeforeAgentStart(pi, event, { projectRoot, context }));

package/templates/AGENTS.md

@@ -24,6 +24,7 @@
 - If routed state says `pull-indexed-context`, treat it as internal continuation — after the bounded read, **continue to edit/verify in the same turn** when safe.
 - If routed state shows `continuation required` or a stuck-lane rescue mode, finish the named milestone before widening reads or repeating analysis.
 - **Do NOT say "done", "applied", or "fixed" after Read/Grep/analysis alone.** Completion wording requires concrete Edit/Write evidence in the current turn, and verification when the scope is risky.
+- **Every stop says why — no silent idle.** When a turn ends because only the user can act (login, approval, protected-file edit), open the reply with one line naming the exact action: `WAITING ON YOU: <command/action>`, and schedule a one-shot wakeup (~20-30 min) when the harness provides one so the session re-checks and auto-continues once the user has acted. An ended turn cannot observe external/auth changes by itself, so without that line (and the wakeup) the idle session looks identical to a stall. Any error — failed command, hook, test, publish — is reported verbatim in the same turn, never silently retried past the user.
 
 ## Index-First Loop
 
@@ -161,7 +162,7 @@ Khi Handoff mode: đọc `docs/AI_HANDOFF/RULES.md` để biết 4 phase (Idea+P
 
 ## Adaptive Autonomy
 
-- `autonomy.level` in `.ukit/storage/config.json` controls how much UKit acts without asking first: `conservative` (ask more), `balanced` (default), `free-run` (auto-run more).
+- `autonomy.level` in `.ukit/storage/config.json` controls how much UKit acts without asking first: `conservative` (ask more), `balanced` (default), `free-run` (auto-run more), `vibecode` (run one prompt to a finished result; the completion gate stops only on completion evidence, a genuine blocker, or a dangerous-command decision).
 - End users should not need to change this; maintainers may tune it per-project.
 
 ## 3-Tier Model Routing

package/templates/CLAUDE.md

@@ -24,6 +24,7 @@
 - If routed state says `pull-indexed-context`, treat it as internal continuation — after the bounded read, **continue to edit/verify in the same turn** when safe.
 - If routed state shows `continuation required` or a stuck-lane rescue mode, finish the named milestone before widening reads or repeating analysis.
 - **Do NOT say "done", "applied", or "fixed" after Read/Grep/analysis alone.** Completion wording requires concrete Edit/Write evidence in the current turn, and verification when the scope is risky.
+- **Every stop says why — no silent idle.** When a turn ends because only the user can act (login, approval, protected-file edit), open the reply with one line naming the exact action: `WAITING ON YOU: <command/action>`, and schedule a one-shot wakeup (~20-30 min) when the harness provides one so the session re-checks and auto-continues once the user has acted. An ended turn cannot observe external/auth changes by itself, so without that line (and the wakeup) the idle session looks identical to a stall. Any error — failed command, hook, test, publish — is reported verbatim in the same turn, never silently retried past the user.
 
 ## Index-First Loop
 
@@ -161,7 +162,7 @@ Khi Handoff mode: đọc `docs/AI_HANDOFF/RULES.md` để biết 4 phase (Idea+P
 
 ## Adaptive Autonomy
 
-- `autonomy.level` in `.ukit/storage/config.json` controls how much UKit acts without asking first: `conservative` (ask more), `balanced` (default), `free-run` (auto-run more).
+- `autonomy.level` in `.ukit/storage/config.json` controls how much UKit acts without asking first: `conservative` (ask more), `balanced` (default), `free-run` (auto-run more), `vibecode` (run one prompt to a finished result; the completion gate stops only on completion evidence, a genuine blocker, or a dangerous-command decision).
 - End users should not need to change this; maintainers may tune it per-project.
 
 ## 3-Tier Model Routing

package/templates/docs/AI_HANDOFF/RULES.md

@@ -79,8 +79,8 @@ Next: <bước kế tiếp chính xác>
 - Subagent ghi **full log vào task file trên đĩa**, chỉ trả về orchestrator ≤10 dòng (executor) / ≤6 dòng (reviewer). Paste log ngược lại orchestrator là nguyên nhân số 1 làm run chết vì hết context.
 - Hết mỗi wave: commit, ghi cursor, **collapse** wave đó còn 1 dòng/task trong bộ nhớ làm việc, rồi chạy tiếp.
 - Yêu cầu `/compact` **chỉ** được đặt ở cuối command, giữa 2 cycle. Giữa cycle thì tuyệt đối không — state đã nằm hết ở git + `INDEX.md` + `RUN.md` nên compact ở ranh giới cycle không mất gì.
-- Vượt `compact.hardCapTokens` (mặc định 500k = 50% của context window 1M) mà `RUN.md` còn run dở: `context-hardcap-gate` cho thêm `compact.hardCapGraceCalls` (mặc định 10) tool call rồi mới chặn cứng. **Grace đó chỉ để hạ cánh** — hoàn tất edit đang dở, commit, ghi cursor, push. Không mở task mới, không đọc thêm file, không spawn agent. Hết grace là chặn thật; budget chỉ reset khi ước lượng token thực sự giảm (có compact thật), không reset theo wave.
-- Không hook nào gọi được `/compact` — đó là lệnh client-only. Nhưng từ 2.1.3, settings mặc định đặt `env.CLAUDE_CODE_AUTO_COMPACT_WINDOW` = 70% của `hardCapTokens` (mặc định 350000 < 500k), render lúc install, nên **client tự auto-compact trước khi gate chặn**. Đường thường: auto-compact chạy → `handoff-resume.sh` replay cursor → chạy tiếp, không cần người gõ gì. Grace window ở trên chỉ còn là lưới an toàn.
+- Vượt `compact.hardCapTokens` (mặc định 500k = 50% của context window 1M) mà `RUN.md` còn run dở **hoặc ordinary routed task có session execution ledger còn thiếu completion evidence**: `context-hardcap-gate` cho thêm `compact.hardCapGraceCalls` (mặc định 10) tool call rồi mới chặn cứng. **Grace đó chỉ để hạ cánh** — hoàn tất edit/verification đang dở và ghi state resume; không mở task mới, không đọc thêm file, không spawn agent. Hết grace là chặn thật; budget chỉ reset khi ước lượng token thực sự giảm (có compact thật), không reset theo wave.
+- Không hook nào gọi được `/compact` — đó là lệnh client-only. Nhưng từ 2.1.3, settings mặc định đặt `env.CLAUDE_CODE_AUTO_COMPACT_WINDOW` = 70% của `hardCapTokens` (mặc định 350000 < 500k), render lúc install, nên **client tự auto-compact trước khi gate chặn**. Đường thường: auto-compact chạy → `handoff-resume.sh` replay cursor cho handoff run hoặc tiêu thụ resume intent cho ordinary task → chạy tiếp, không cần người gõ gì. Grace window ở trên chỉ còn là lưới an toàn.
 - Sửa một trong hai số đó thì phải giữ `autoCompactWindow < hardCapTokens`. Đảo thứ tự là deadlock: gate chặn tool trước → transcript ngừng lớn → ngưỡng auto-compact không bao giờ tới. `tests/core/autoCompactWindow.test.js` khóa bất biến này.
 
 ### Git

package/templates/ukit/storage/config.json

@@ -385,7 +385,7 @@
     "version": "Phiên bản config runtime đi kèm package UKit.",
     "agent": "Adapter mặc định của workspace. Thường giữ nguyên theo lúc install.",
     "autonomy": {
-      "level": "Mức tự chủ của UKit. conservative: hỏi trước khi fallback/escalate, không tự delegate. balanced: mặc định, hành vi hiện tại. free-run: tự chạy fallback, delegate tự nhiên hơn, bớt xác nhận.",
+      "level": "Mức tự chủ của UKit. conservative: hỏi trước khi fallback/escalate, không tự delegate. balanced: mặc định, hành vi hiện tại. free-run: tự chạy fallback, delegate tự nhiên hơn, bớt xác nhận. vibecode: chạy một prompt tới khi có kết quả — completion gate không nhả ở continuation cap, chỉ dừng khi đủ completion evidence, gặp blocker thật, hoặc quyết định lệnh nguy hiểm; mọi cú dừng đều nêu lý do.",
       "affectVerification": "Nếu true, autonomy.level ảnh hưởng hành vi verification plan.",
       "affectDelegation": "Nếu true, autonomy.level ảnh hưởng ngưỡng delegation."
     },
@@ -399,7 +399,7 @@
       "hardCapTokens": "Ngưỡng cứng tuyệt đối (mặc định 500000 token ước lượng = 50% của context window 1M). Chạm/vượt ngưỡng này thì context coi như quá dài — không phải gợi ý nữa, là bắt buộc. PHẢI thấp hơn context window thật của model, nếu không API sẽ báo lỗi vượt context trước khi gate kịp chặn — model 200k thì hạ xuống 100000, model 256k thì 128000. Cả env.CLAUDE_CODE_AUTO_COMPACT_WINDOW (.claude/settings.json) lẫn compaction.thresholdTokens (.omp/config.yml) đều được SUY RA từ số này khi chạy ukit install, nên chỉ cần sửa ở đây rồi cài lại là auto-compact của cả Claude Code và omp đổi theo.",
       "autoCompactWindowRatio": "Auto-compact chạy ở bao nhiêu phần của hardCapTokens (mặc định 0.7 → 350000). Phải < 1 để client tự compact TRƯỚC khi context-hardcap-gate chặn tool; số càng nhỏ thì compact càng sớm và càng nhiều đệm an toàn.",
       "hardCapBlock": "Nếu true, hook context-hardcap-gate chặn cứng Edit/Write/Bash (exit 2) khi vượt hardCapTokens, cho tới khi có compact thật (PreCompact) reset lại bộ đếm.",
-      "hardCapGraceCalls": "Số tool call được phép chạy tiếp sau khi vượt hardCapTokens KHI docs/AI_HANDOFF/RUN.md còn run dở (mặc định 10). Dùng để run kịp commit + ghi cursor + push rồi mới bị chặn, thay vì chết giữa lúc đang Edit. Hết grace là chặn cứng như cũ. Budget tính theo mỗi đợt vượt cap, chỉ reset khi ước lượng token thật sự giảm (có compact thật) — không reset theo wave.",
+      "hardCapGraceCalls": "Số tool call được phép chạy tiếp sau khi vượt hardCapTokens khi handoff run trong docs/AI_HANDOFF/RUN.md hoặc ordinary routed task có session execution ledger còn dang dở (mặc định 10). Đây chỉ là landing window: hoàn tất edit/verification đang dở và ghi state resume, không mở task mới. Hết grace là chặn cứng như cũ. Budget tính theo mỗi đợt vượt cap, chỉ reset khi ước lượng token thật sự giảm (có compact thật) — không reset theo wave.",
       "contextRotDetection": "Phát hiện context quá dài/dễ mục để giữ lại state quan trọng trước khi AI nhớ sai.",
       "askBeforeDrop": "Giữ thái độ thận trọng trước khi bỏ context quan trọng. Nếu rủi ro thì hand back cho main model.",
       "agentContext": {