@ngockhoale/ukit 2.4.2 → 2.5.0

package/templates/.claude/hooks/sensitive-data-guard.sh

@@ -11,7 +11,8 @@
 #   1. Read/Grep of secret files (.env*, *.pem, id_rsa, credentials.json, ...)
 #   2. Bash commands that dump secrets (cat .env, bare `env`, curl -u user:pass,
 #      URL-embedded credentials, any high-confidence token in the command text)
-#   3. UserPromptSubmit prompt text containing high-confidence secret patterns
+#   3. UserPromptSubmit prompt text containing high-confidence secret patterns;
+#      complete machine-generated envelopes are delivered with a redacted advisory
 #
 # FAIL-CLOSED on detection (exit 2). Never echoes the detected value — only a
 # redacted preview plus a truncated sha256 (12 hex chars: enough for the human
@@ -26,12 +27,18 @@
 # a broken gate must not brick every session, but every real detection blocks.
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HOOK_DIR="$SCRIPT_DIR"
+SCRIPT_PATH="$HOOK_DIR/../ukit/runtime/sensitive-value-scanner.mjs"
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
 # Bounded stdin (H01) — fail-closed overflow: an oversized payload is REFUSED
 # (silent exit 2, nothing staged, nothing echoed). The gate never truncates
 # unknown overflow and never materializes it in a shell variable.
 # shellcheck source=/dev/null
 if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+# TASK-019: arm advisory latency telemetry; the finish row is written by the
+# shared cleanup path before the staged payload is removed. A missing
+# runtime (pre-install tree) simply leaves telemetry off.
+source "$SCRIPT_DIR/../ukit/runtime/hook-telemetry.sh" 2>/dev/null || true
   trap ukit_cleanup_hook_input EXIT
   ukit_stage_hook_input 2097152 refuse
   STAGE_RC=$?
@@ -39,18 +46,41 @@ if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
     exit "$STAGE_RC"
   fi
 else
-  # Runtime helper missing (pre-install tree): same refuse posture, inline.
-  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")" || exit 2
-  head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null
-  cat >/dev/null 2>&1
-  if [ "$(wc -c < "$UKIT_INPUT_FILE" | tr -d '[:space:]')" -gt 2097152 ]; then
+  # Runtime helper missing (pre-install tree): the SAME bounded staging,
+  # inline - `cat >/dev/null` used to block forever on a producer that never
+  # closes the pipe (R4.5). Read cap+1 in the background, bound the wait.
+  UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
+  if [ -e /dev/fd/0 ]; then
+    exec 8<&0
+    head -c 2097153 <&8 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  else
+    head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  fi
+  __ukit_reader=$!
+  __ukit_stage_ms="${UKIT_HOOK_STAGE_MS:-2000}"
+  case "$__ukit_stage_ms" in
+    ''|*[!0-9]*) __ukit_stage_ms=2000 ;;
+  esac
+  [ "$__ukit_stage_ms" -gt 0 ] 2>/dev/null || __ukit_stage_ms=2000
+  printf -v __ukit_stage_s '%d.%03d' $((__ukit_stage_ms / 1000)) $((__ukit_stage_ms % 1000))
+  ( sleep "$__ukit_stage_s" 2>/dev/null; kill -9 "$__ukit_reader" 2>/dev/null ) <&- >/dev/null 2>&1 &
+  __ukit_waiter=$!
+  wait "$__ukit_reader" 2>/dev/null
+  __ukit_stage_rc=$?
+  kill "$__ukit_waiter" 2>/dev/null
+  wait "$__ukit_waiter" 2>/dev/null
+  exec 8<&-
+  __ukit_size="$(wc -c < "$UKIT_INPUT_FILE" 2>/dev/null | tr -d '[:space:]')"
+  if [ "$__ukit_stage_rc" -ne 0 ] || [ "$__ukit_size" -gt 2097152 ]; then
+    # Fail-closed: an unstaged/oversized payload was never inspected
+    # (exit 2 blocks; 1 would be a non-blocking hook error).
     rm -f "$UKIT_INPUT_FILE"
     exit 2
   fi
   trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
 fi
 
-INPUT_FILE="$UKIT_INPUT_FILE" PROJECT_ROOT="$PROJECT_ROOT" node <<'NODE'
+INPUT_FILE="$UKIT_INPUT_FILE" PROJECT_ROOT="$PROJECT_ROOT" SCRIPT_PATH="$SCRIPT_PATH" UKIT_HOOK_DEADLINE_MS="${UKIT_HOOK_DEADLINE_MS:-3000}" node <<'NODE'
 const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || '', 10) || 3000;
 setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
 const fs = require('fs');
@@ -104,37 +134,44 @@ function pathAllowed(filePath) {
   return allowedPaths.some((allowed) => allowed === normalized || allowed === relative);
 }
 
-// --- high-confidence secret value patterns (shared by prompt + bash scanning) ---
-// AKIA/ASIA/AIza prefixes are pure base64-compatible text, so an encoded blob
-// can contain a coincidental key-shaped substring (round-17 live case: ASIA…
-// inside a base64 payload). Those rules must stand alone — no base64/base64url
-// character on either side. Padding "=" is a boundary: it only ends a blob.
-const TOKEN_PATTERNS = [
-  { label: 'OpenAI/Anthropic-style API key', re: /\bsk-(?:proj-|ant-|svc-|acct-|admin-)?[A-Za-z0-9_-]{20,}/g },
-  { label: 'AWS access key id', re: /(?<![A-Za-z0-9+/_-])(?:AKIA|ASIA)[0-9A-Z]{16}(?![A-Za-z0-9+/_-])/g },
-  { label: 'GitHub token', re: /\bgh[pousr]_[A-Za-z0-9]{30,}\b/g },
-  { label: 'GitHub fine-grained token', re: /\bgithub_pat_[A-Za-z0-9_]{20,}/g },
-  { label: 'GitLab token', re: /\bglpat-[A-Za-z0-9_-]{20,}/g },
-  { label: 'Slack token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/g },
-  { label: 'Google API key', re: /(?<![A-Za-z0-9+/_-])AIza[0-9A-Za-z_-]{20,}(?![A-Za-z0-9+/_-])/g },
-  { label: 'Stripe live key', re: /\b[srp]k_live_[A-Za-z0-9]{20,}/g },
-  { label: 'JWT', re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
-  { label: 'private key block', re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY-----/g },
-];
-
-// No keyword-assignment lane ("password: …", "token = …") on purpose — it was
-// the source of every false positive: it guessed at whatever followed a
-// keyword, blocking code, prose and shell syntax that is never a secret.
-function scanSecretText(text) {
-  const found = [];
-  for (const { label, re } of TOKEN_PATTERNS) {
-    re.lastIndex = 0;
-    let match;
-    while ((match = re.exec(text)) !== null) {
-      found.push({ label, value: match[0] });
-    }
+// --- high-confidence secret value scan (TASK-039: shared runtime module) ---
+// The token-pattern definitions and matching live in the shared runtime
+// module ukit/runtime/sensitive-value-scanner.mjs (manifest requires:
+// ukit-runtime-scripts) — there is deliberately NO local pattern copy here, so
+// the hook and the PROJECT_IMPORTANT renderer can never drift apart. File/path
+// classification and Bash command shapes stay in this hook.
+// Leak-safety: the scanner returns labels only — never a value, excerpt, or
+// hash — so blocked-prompt previews can no longer print a value's truncated
+// sha256; the redacted block message says the value is withheld instead.
+const SCANNER_PATH = process.env.SCRIPT_PATH || '';
+let scannerModule = null;
+let scannerTried = false;
+async function loadScanner() {
+  if (scannerTried) return scannerModule;
+  scannerTried = true;
+  try {
+    const { pathToFileURL } = require('url');
+    scannerModule = await import(pathToFileURL(SCANNER_PATH).href);
+  } catch {
+    scannerModule = null;
   }
-  return found;
+  return scannerModule;
+}
+
+// The gate is fail-closed on detection AND on scanner availability: a missing
+// or crashing scanner must never silently bypass a channel that could carry a
+// secret (the module is shipped by ukit-runtime-scripts, which the manifest
+// declares this hook requires). Same redacted block shape as a detection.
+function blockScannerUnavailable() {
+  process.stderr.write(
+    'BLOCKED (sensitive data gate unavailable): the shared scanner module '
+    + 'ukit/runtime/sensitive-value-scanner.mjs is missing or failed to load, '
+    + 'so this payload cannot be proven clean. Run `ukit install` to restore it.\n',
+  );
+  process.stdout.write(`${JSON.stringify({
+    systemMessage: 'UKit blocked this call: the sensitive-data scanner module is unavailable (fail-closed). Run `ukit install`.',
+  })}\n`);
+  process.exit(2);
 }
 
 // --- secret file classification ---
@@ -238,7 +275,8 @@ if (event === 'UserPromptSubmit') {
   process.exit(0);
 }
 
-// --- collect findings ---
+// --- collect findings (async: the value scan delegates to the shared module) ---
+void (async () => {
 const findings = [];
 
 for (const filePath of filePathChannels) {
@@ -248,14 +286,36 @@ for (const filePath of filePathChannels) {
   }
 }
 
-const seenValues = new Set();
+// The value scan needs the shared scanner module only when a text/bash
+// channel exists to scan; a pure secret-file Read verdict never depends on it.
+const needsScanner = textChannels.length > 0 || bashCommand;
+let scanner = null;
+if (needsScanner) {
+  scanner = await loadScanner();
+  if (!scanner || typeof scanner.scanText !== 'function') {
+    blockScannerUnavailable();
+  }
+}
+const gateEnabled = scanner ? scanner.isSensitiveDataGateEnabled(config) !== false : true;
+const allowlistHashes = scanner ? scanner.loadSensitiveAllowlist({ security: { allowlist } }) : [];
+
+function scanTextLabels(text) {
+  let verdict;
+  try {
+    verdict = scanner.scanText(text, { allowlistHashes, gateEnabled });
+  } catch {
+    blockScannerUnavailable();
+  }
+  return verdict && Array.isArray(verdict.labels) ? verdict.labels : [];
+}
+
+const seenLabels = new Set();
 for (const { channel, text } of textChannels) {
-  for (const finding of scanSecretText(text)) {
-    if (allowedValueHashes.has(sha256(finding.value))) continue;
-    const key = `${channel}:${finding.label}:${finding.value}`;
-    if (seenValues.has(key)) continue;
-    seenValues.add(key);
-    findings.push({ label: `${finding.label} in ${channel}`, value: finding.value });
+  for (const label of scanTextLabels(text)) {
+    const key = `${channel}:${label}`;
+    if (seenLabels.has(key)) continue;
+    seenLabels.add(key);
+    findings.push({ label: `${label} in ${channel}` });
   }
 }
 
@@ -268,12 +328,11 @@ if (bashCommand) {
     if (allowedValueHashes.has(sha256(finding.value))) continue;
     findings.push({ label: `${finding.label} in bash command`, value: finding.value });
   }
-  for (const finding of scanSecretText(bashCommand)) {
-    if (allowedValueHashes.has(sha256(finding.value))) continue;
-    const key = `bash:${finding.label}:${finding.value}`;
-    if (seenValues.has(key)) continue;
-    seenValues.add(key);
-    findings.push({ label: `${finding.label} in bash command`, value: finding.value });
+  for (const label of scanTextLabels(bashCommand)) {
+    const key = `bash:${label}`;
+    if (seenLabels.has(key)) continue;
+    seenLabels.add(key);
+    findings.push({ label: `${label} in bash command` });
   }
 }
 
@@ -289,9 +348,17 @@ if (findings.length === 0) {
 // ("Waiting for N background agents"). These envelopes flow with a redacted
 // advisory: labels + counts only, never values. Everything a human types —
 // and every other event/channel — stays fail-closed below.
-const MACHINE_ENVELOPE_RE = /^\s*<(?:task-notification|system-reminder|cross-session-message)\b/i;
+const MACHINE_ENVELOPE_RE = /^(?:task-notification|system-reminder|cross-session-message)$/i;
+function isCompleteMachineEnvelope(text) {
+  const trimmed = String(text || '').trim();
+  const opening = /^<([a-z-]+)(?:\s[^>]*)?>/i.exec(trimmed);
+  if (!opening || !MACHINE_ENVELOPE_RE.test(opening[1])) return false;
+  const tag = opening[1];
+  const closing = new RegExp(`</${tag}>$`, 'i');
+  return closing.test(trimmed);
+}
 const promptText = textChannels.length > 0 ? textChannels[0].text : null;
-if (event === 'UserPromptSubmit' && promptText && MACHINE_ENVELOPE_RE.test(promptText)) {
+if (event === 'UserPromptSubmit' && promptText && isCompleteMachineEnvelope(promptText)) {
   const labels = [...new Set(findings.map((f) => f.label))];
   process.stdout.write(`${JSON.stringify({
     systemMessage: `UKit sensitive-data gate: ${findings.length} secret-shaped value(s) inside a machine-generated notification (${labels.slice(0, 3).join('; ')}${labels.length > 3 ? '; …' : ''}). Delivered without blocking — treat as fixture/log plumbing, not a typed secret. Never repeat the values in your reply.`,
@@ -300,10 +367,10 @@ if (event === 'UserPromptSubmit' && promptText && MACHINE_ENVELOPE_RE.test(promp
 }
 
 // --- block message: redacted previews only, never the secret itself ---
+// The shared scanner returns labels only, so value findings can no longer show
+// a truncated sha256 — the value stays withheld entirely (leak-safe contract).
 function describeFinding(finding) {
-  const where = finding.preview
-    ? `${finding.preview}`
-    : `${String(finding.value).slice(0, 3)}…(${String(finding.value).length} chars, sha256 ${sha256(String(finding.value)).slice(0, 12)}…)`;
+  const where = finding.preview ? `${finding.preview}` : '(value withheld)';
   return `  - ${finding.label}: ${where}`;
 }
 
@@ -327,6 +394,7 @@ process.stdout.write(`${JSON.stringify({
   systemMessage: `UKit blocked this call: ${findings.length} potential secret(s) detected (${findings.map((f) => f.label).slice(0, 3).join('; ')}${findings.length > 3 ? '; …' : ''}). Redact the value, allowlist its sha256, or ask the user to decide.`,
 })}\n`);
 process.exit(2);
+})();
 NODE
 
 exit $?

package/templates/.claude/hooks/skill-router.sh

@@ -5,17 +5,43 @@
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=/dev/null
 if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+# TASK-019: arm advisory latency telemetry; the finish row is written by the
+# shared cleanup path before the staged payload is removed. A missing
+# runtime (pre-install tree) simply leaves telemetry off.
+source "$SCRIPT_DIR/../ukit/runtime/hook-telemetry.sh" 2>/dev/null || true
   trap ukit_cleanup_hook_input EXIT
   # Bounded stdin (H01): stage before anything reads it; the shell var is capped,
   # env passes only the staged-file path — never the payload.
   ukit_stage_hook_input 2097152 truncate || exit 0
 else
-  # Runtime helper missing (pre-install tree): bounded inline staging keeps the
-  # wrapper's own fail-loud/advisory behavior below alive.
+  # Runtime helper missing (pre-install tree): the SAME bounded staging,
+  # inline - `cat >/dev/null` used to block forever on a producer that never
+  # closes the pipe (R4.5). Read cap+1 in the background, bound the wait.
   UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
-  head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null
-  cat >/dev/null 2>&1
-  if [ "$(wc -c < "$UKIT_INPUT_FILE" | tr -d '[:space:]')" -gt 2097152 ]; then
+  if [ -e /dev/fd/0 ]; then
+    exec 8<&0
+    head -c 2097153 <&8 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  else
+    head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  fi
+  __ukit_reader=$!
+  __ukit_stage_ms="${UKIT_HOOK_STAGE_MS:-2000}"
+  case "$__ukit_stage_ms" in
+    ''|*[!0-9]*) __ukit_stage_ms=2000 ;;
+  esac
+  [ "$__ukit_stage_ms" -gt 0 ] 2>/dev/null || __ukit_stage_ms=2000
+  printf -v __ukit_stage_s '%d.%03d' $((__ukit_stage_ms / 1000)) $((__ukit_stage_ms % 1000))
+  ( sleep "$__ukit_stage_s" 2>/dev/null; kill -9 "$__ukit_reader" 2>/dev/null ) <&- >/dev/null 2>&1 &
+  __ukit_waiter=$!
+  wait "$__ukit_reader" 2>/dev/null
+  __ukit_stage_rc=$?
+  kill "$__ukit_waiter" 2>/dev/null
+  wait "$__ukit_waiter" 2>/dev/null
+  exec 8<&-
+  __ukit_size="$(wc -c < "$UKIT_INPUT_FILE" 2>/dev/null | tr -d '[:space:]')"
+  # A bounded cut (rc != 0) leaves a short payload that the JSON consumer
+  # already degrades on - the shared helper's truncate posture (R4.5).
+  if [ "$__ukit_size" -gt 2097152 ]; then
     truncate -s 2097152 "$UKIT_INPUT_FILE" 2>/dev/null
   fi
   trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT

package/templates/.claude/hooks/stale-spec-guard.sh

@@ -5,16 +5,42 @@
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=/dev/null
 if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+# TASK-019: arm advisory latency telemetry; the finish row is written by the
+# shared cleanup path before the staged payload is removed. A missing
+# runtime (pre-install tree) simply leaves telemetry off.
+source "$SCRIPT_DIR/../ukit/runtime/hook-telemetry.sh" 2>/dev/null || true
   trap ukit_cleanup_hook_input EXIT
   # Bounded stdin (H01): stage before anything reads it; the shell var is capped.
   ukit_stage_hook_input 2097152 truncate || exit 0
 else
-  # Runtime helper missing (pre-install tree): bounded inline staging keeps the
-  # wrapper's own fail-loud/advisory behavior below alive.
+  # Runtime helper missing (pre-install tree): the SAME bounded staging,
+  # inline - `cat >/dev/null` used to block forever on a producer that never
+  # closes the pipe (R4.5). Read cap+1 in the background, bound the wait.
   UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
-  head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null
-  cat >/dev/null 2>&1
-  if [ "$(wc -c < "$UKIT_INPUT_FILE" | tr -d '[:space:]')" -gt 2097152 ]; then
+  if [ -e /dev/fd/0 ]; then
+    exec 8<&0
+    head -c 2097153 <&8 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  else
+    head -c 2097153 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  fi
+  __ukit_reader=$!
+  __ukit_stage_ms="${UKIT_HOOK_STAGE_MS:-2000}"
+  case "$__ukit_stage_ms" in
+    ''|*[!0-9]*) __ukit_stage_ms=2000 ;;
+  esac
+  [ "$__ukit_stage_ms" -gt 0 ] 2>/dev/null || __ukit_stage_ms=2000
+  printf -v __ukit_stage_s '%d.%03d' $((__ukit_stage_ms / 1000)) $((__ukit_stage_ms % 1000))
+  ( sleep "$__ukit_stage_s" 2>/dev/null; kill -9 "$__ukit_reader" 2>/dev/null ) <&- >/dev/null 2>&1 &
+  __ukit_waiter=$!
+  wait "$__ukit_reader" 2>/dev/null
+  __ukit_stage_rc=$?
+  kill "$__ukit_waiter" 2>/dev/null
+  wait "$__ukit_waiter" 2>/dev/null
+  exec 8<&-
+  __ukit_size="$(wc -c < "$UKIT_INPUT_FILE" 2>/dev/null | tr -d '[:space:]')"
+  # A bounded cut (rc != 0) leaves a short payload that the JSON consumer
+  # already degrades on - the shared helper's truncate posture (R4.5).
+  if [ "$__ukit_size" -gt 2097152 ]; then
     truncate -s 2097152 "$UKIT_INPUT_FILE" 2>/dev/null
   fi
   trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT

package/templates/.claude/hooks/task-watchdog.sh

@@ -5,33 +5,35 @@
 #   The Quality Gate lets handoff runs go on for a while, but a wedged task
 #   that never reports a blocker still burns the rest of the pipeline. This
 #   hook measures wall-clock per in_progress task against approved budgets
-#   (S 8/15, M 15/30, L 25/45 minutes by default) and either:
-#     - soft overrun: emits a VISIBLE "checkpoint milestone now + split remainder"
-#                     advisory on Stop (systemMessage), never blocks.
-#     - hard overrun (split policy, default): emits Stop decision=block with a
-#                     visible split instruction naming the follow-up
-#                     TASK-<id>-b; keeps the cycle running instead of letting
-#                     the agent stop silently mid-budget.
-#     - hard overrun (pause policy, selectable in config): emits a pause
-#                     advisory on Stop, never blocks.
+#   (S 8/15, M 15/30, L 25/45 minutes by default).
 #
-#   PostToolUse NEVER emits decision — that would block the in-flight Edit.
-#   Stop is the only path that can hard-trip; PostToolUse stays advisory only.
+# TASK-025 (PLAN §2 H17): the watchdog no longer owns any Stop decision. A single
+# coordinator (.claude/ukit/runtime/stop-coordinator.mjs, registered once on Stop
+# through completion-gate.sh) evaluates BOTH the completion policy and this
+# watchdog's budget policy and emits at most one continuation decision — two
+# independent blockers used to double-block the same Stop.
+#
+# Dispatch on hook_event_name:
+#   Stop         → thin delegate: hand the staged payload to the stop coordinator
+#                  and pass its single decision through. Kept for legacy settings
+#                  that still register this script on Stop; the coordinator's
+#                  once-per-stop dedupe keeps a double-registered Stop inert.
+#   PostToolUse  → advisory only (systemMessage); NEVER emits decision. Re-evaluates
+#                  so the runtime state stays warm for the next Stop.
+#   anything else → exit 0 silently.
 #
 #   Everything fails open and stays inside the 4s hook-chain budget:
 #     - HOOK_DEADLINE_MS=3000 self-kill via setTimeout(...).unref()
 #     - all I/O is async (sync reads on a stalled mount would block the timer)
 #     - process.exit(0) on every path; never throws.
-#
-# Dispatch on hook_event_name:
-#   Stop         → evaluate and may emit decision=block; never emits decision
-#                  unless the trip crosses hardMin AND hardPolicy='split'.
-#   PostToolUse  → advisory only (systemMessage); NEVER emits decision.
-#   anything else → exit 0 silently.
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=/dev/null
 if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
+# TASK-019: arm advisory latency telemetry; the finish row is written by the
+# shared cleanup path before the staged payload is removed. A missing
+# runtime (pre-install tree) simply leaves telemetry off.
+source "$SCRIPT_DIR/../ukit/runtime/hook-telemetry.sh" 2>/dev/null || true
   trap ukit_cleanup_hook_input EXIT
   # Bounded stdin (H01): the 64 KiB cap is preserved, but the payload now travels
   # as a staged file path — never through the exec environment, so an oversized
@@ -40,12 +42,35 @@ if source "$SCRIPT_DIR/../ukit/runtime/hook-input.sh" 2>/dev/null; then
   # degrade exit 0 (documented posture).
   ukit_stage_hook_input 65536 truncate || exit 0
 else
-  # Runtime helper missing (pre-install tree): bounded inline staging keeps the
   # 64 KiB cap and the advisory degrade path alive.
+  # Runtime helper missing (pre-install tree): the SAME bounded staging,
+  # inline - `cat >/dev/null` used to block forever on a producer that never
+  # closes the pipe (R4.5). Read cap+1 in the background, bound the wait.
   UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-hook-in.XXXXXX")"
-  head -c 65537 > "$UKIT_INPUT_FILE" 2>/dev/null
-  cat >/dev/null 2>&1
-  if [ "$(wc -c < "$UKIT_INPUT_FILE" | tr -d '[:space:]')" -gt 65536 ]; then
+  if [ -e /dev/fd/0 ]; then
+    exec 8<&0
+    head -c 65537 <&8 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  else
+    head -c 65537 > "$UKIT_INPUT_FILE" 2>/dev/null &
+  fi
+  __ukit_reader=$!
+  __ukit_stage_ms="${UKIT_HOOK_STAGE_MS:-2000}"
+  case "$__ukit_stage_ms" in
+    ''|*[!0-9]*) __ukit_stage_ms=2000 ;;
+  esac
+  [ "$__ukit_stage_ms" -gt 0 ] 2>/dev/null || __ukit_stage_ms=2000
+  printf -v __ukit_stage_s '%d.%03d' $((__ukit_stage_ms / 1000)) $((__ukit_stage_ms % 1000))
+  ( sleep "$__ukit_stage_s" 2>/dev/null; kill -9 "$__ukit_reader" 2>/dev/null ) <&- >/dev/null 2>&1 &
+  __ukit_waiter=$!
+  wait "$__ukit_reader" 2>/dev/null
+  __ukit_stage_rc=$?
+  kill "$__ukit_waiter" 2>/dev/null
+  wait "$__ukit_waiter" 2>/dev/null
+  exec 8<&-
+  __ukit_size="$(wc -c < "$UKIT_INPUT_FILE" 2>/dev/null | tr -d '[:space:]')"
+  # A bounded cut (rc != 0) leaves a short payload that the JSON consumer
+  # already degrades on - the shared helper's truncate posture (R4.5).
+  if [ "$__ukit_size" -gt 65536 ]; then
     truncate -s 65536 "$UKIT_INPUT_FILE" 2>/dev/null
   fi
   trap '[ -n "$UKIT_INPUT_FILE" ] && rm -f "$UKIT_INPUT_FILE"' EXIT
@@ -56,7 +81,13 @@ INPUT_FILE="$UKIT_INPUT_FILE" PROJECT_ROOT="$PROJECT_ROOT" node <<'NODE' || true
 'use strict';
 
 const fsp = require('fs/promises');
+// TASK-024 fix (regression from TASK-014's H01 bounded-staging refactor): the staged
+// payload is read with fs.readFileSync, but the `fs` require was dropped — every
+// payload read then threw ReferenceError, was swallowed by the try/catch, and the
+// hook silently became a no-op (empty payload → irrelevant event → exit 0).
+const fs = require('fs');
 const path = require('path');
+const { spawn } = require('child_process');
 const { pathToFileURL } = require('url');
 
 // Wall-clock watchdog. Anything that stalls here must end in clean exit 0 —
@@ -79,7 +110,6 @@ try { rawInput = fs.readFileSync(process.env.INPUT_FILE || '', 'utf8'); } catch
   })();
 
   const hookEvent = typeof payload.hook_event_name === 'string' ? payload.hook_event_name : '';
-  const toolName = typeof payload.tool_name === 'string' ? payload.tool_name : '';
   const projectRoot = process.env.PROJECT_ROOT || process.cwd();
 
   // Silent degrade for non-relevant events — same posture as every other
@@ -88,6 +118,43 @@ try { rawInput = fs.readFileSync(process.env.INPUT_FILE || '', 'utf8'); } catch
     process.exit(0);
   }
 
+  // TASK-025: Stop is a thin delegate — the stop coordinator owns every Stop
+  // decision (completion policy + this watchdog's budget policy, merged into at
+  // most one continuation decision). Fail-open: a missing coordinator (pre-install
+  // tree) just means no watchdog Stop evaluation, as before the delegate existed.
+  if (hookEvent === 'Stop') {
+    const coordinatorPath = path.join(projectRoot, '.claude', 'ukit', 'runtime', 'stop-coordinator.mjs');
+    try {
+      await fsp.access(coordinatorPath);
+    } catch {
+      process.exit(0);
+    }
+    const delegateInput = rawInput;
+    const child = spawn(process.execPath, [coordinatorPath, '--evaluate-stop'], {
+      cwd: projectRoot,
+      env: { ...process.env, CLAUDE_PROJECT_DIR: projectRoot },
+      stdio: ['pipe', 'pipe', 'inherit'],
+    });
+    let delegatedOutput = '';
+    const killTimer = setTimeout(() => {
+      try { child.kill('SIGKILL'); } catch {}
+    }, HOOK_DEADLINE_MS);
+    if (typeof killTimer.unref === 'function') killTimer.unref();
+    child.stdout.on('data', (chunk) => { delegatedOutput += chunk; });
+    child.stdin.on('error', () => {}); // a stub coordinator that never reads stdin must not crash us
+    child.on('error', () => {
+      try { process.exit(0); } catch {}
+    });
+    child.on('close', () => {
+      try {
+        if (delegatedOutput.trim()) process.stdout.write(delegatedOutput);
+      } catch {}
+      process.exit(0);
+    });
+    child.stdin.end(delegateInput);
+    return;
+  }
+
   const runtimePath = path.join(projectRoot, '.claude', 'ukit', 'runtime', 'task-watchdog.mjs');
   // Async existence check — sync fs here would violate the all-async invariant
   // (a stalled mount would block the loop and the 3s self-kill could not fire).
@@ -121,112 +188,30 @@ try { rawInput = fs.readFileSync(process.env.INPUT_FILE || '', 'utf8'); } catch
   // PostToolUse: advisory only. NEVER emit decision — that would block the
   // in-flight Edit and stall the run. We still re-evaluate so the runtime
   // state stays warm and the next Stop sees an up-to-date view.
-  if (hookEvent === 'PostToolUse') {
-    const now = Date.now();
-    const evals = runtime.evaluateBudgets({ tasks, state, now, config });
-    const advisories = evals
-      .filter((r) => r.phase !== 'ok')
-      .map((r) => {
-        const task = tasks.find((t) => t.id === r.id);
-        if (!task) return null;
-        if (r.phase === 'hard') {
-          const blocks = Number(state.hardBlocks[r.id] || 0);
-          if (blocks >= (runtime.HARD_BLOCK_CAP || 2)) {
-            return runtime.describeDegraded({ id: r.id, hardBlocks: blocks });
-          }
-          return runtime.describeHardAdvisory(r, r.id);
-        }
-        return runtime.describeSoft(r, r.id);
-      })
-      .filter(Boolean);
-
-    if (advisories.length > 0) {
-      const message = advisories.join('\n');
-      try {
-        process.stdout.write(`${JSON.stringify({ systemMessage: message })}\n`);
-      } catch {}
-    }
-    process.exit(0);
-  }
-
-  // Stop: full evaluation, may emit decision=block under split policy.
   const now = Date.now();
-  for (const task of tasks) {
-    try {
-      await runtime.ensureFirstSeen(state, task.id, now);
-    } catch {}
-  }
-
   const evals = runtime.evaluateBudgets({ tasks, state, now, config });
-
-  // First save firstSeen updates so the next Stop sees the same anchored clock.
-  await runtime.writeState(statePath, state);
-
-  const hardResults = evals.filter((r) => r.phase === 'hard');
-  const softResults = evals.filter((r) => r.phase === 'soft');
-
-  if (hardResults.length === 0) {
-    // No hard trips. Emit a soft advisory if anything is in the soft zone,
-    // then exit 0 cleanly. We deliberately do not emit decision here — the
-    // completion gate owns Stop's continuation logic and we never want to
-    // double-block for the same reason.
-    if (softResults.length > 0) {
-      const advisory = softResults
-        .map((r) => runtime.describeSoft(r, r.id))
-        .join('\n');
-      try {
-        process.stdout.write(`${JSON.stringify({ systemMessage: advisory })}\n`);
-      } catch {}
-    }
-    process.exit(0);
-  }
-
-  // At least one hard-trip. Apply policy.
-  const hardPolicy = String(config.taskBudgets?.hardPolicy || 'split');
-  const firstHard = hardResults[0];
-  const blocks = Number(state.hardBlocks[firstHard.id] || 0);
-
-  if (hardPolicy !== 'split') {
-    // pause (or anything non-split) → advisory only, never block.
-    const advisory = hardResults
-      .map((r) => runtime.describePause({ id: r.id, result: r }))
-      .join('\n');
-    try {
-      process.stdout.write(`${JSON.stringify({ systemMessage: advisory })}\n`);
-    } catch {}
-    process.exit(0);
-  }
-
-  // split policy + hard-trip — but the per-task block cap has already been
-  // hit. Degrade to advisory so the orchestrator can hand back to the user.
-  if (blocks >= (runtime.HARD_BLOCK_CAP || 2)) {
-    await runtime.bumpHardBlocks(state, firstHard.id);
-    await runtime.writeState(statePath, state);
-    const advisory = runtime.describeDegraded({ id: firstHard.id, hardBlocks: blocks + 1 });
+  const advisories = evals
+    .filter((r) => r.phase !== 'ok')
+    .map((r) => {
+      const task = tasks.find((t) => t.id === r.id);
+      if (!task) return null;
+      if (r.phase === 'hard') {
+        const blocks = Number(state.hardBlocks[r.id] || 0);
+        if (blocks >= (runtime.HARD_BLOCK_CAP || 2)) {
+          return runtime.describeDegraded({ id: r.id, hardBlocks: blocks });
+        }
+        return runtime.describeHardAdvisory(r, r.id);
+      }
+      return runtime.describeSoft(r, r.id);
+    })
+    .filter(Boolean);
+
+  if (advisories.length > 0) {
+    const message = advisories.join('\n');
     try {
-      process.stdout.write(`${JSON.stringify({ systemMessage: advisory })}\n`);
+      process.stdout.write(`${JSON.stringify({ systemMessage: message })}\n`);
     } catch {}
-    process.exit(0);
   }
-
-  // Hard trip + split policy + under the cap → emit Stop decision=block
-  // with the visible split instruction. This is the "auto-split and continue"
-  // path: blocking the stop IS the continue mechanism — the executor / orchestrator
-  // performs the actual TASK-<id>-b cut on the next turn following the reason.
-  const newBlocks = await runtime.bumpHardBlocks(state, firstHard.id);
-  await runtime.writeState(statePath, state);
-
-  const task = tasks.find((t) => t.id === firstHard.id) || { id: firstHard.id };
-  const lastGreen = runtime.pickLastGreen(task);
-  const reason = runtime.describeSplitReason({
-    id: firstHard.id,
-    result: firstHard,
-    hardBlocks: newBlocks,
-    lastGreen,
-  });
-  try {
-    process.stdout.write(`${JSON.stringify({ decision: 'block', reason })}\n`);
-  } catch {}
   process.exit(0);
 })().catch(() => {
   // Fail-open: never let an exception kill the hook.