@ngockhoale/ukit 2.7.2 → 2.7.4

package/CHANGELOG.md

@@ -2,6 +2,85 @@
 
 All notable changes to UKit are documented here.
 
+## 2.7.4 - 2026-09-20
+
+Deferred hook findings + residual risks — cycle C39 (TASK-001..005).
+
+- `session-episode.sh` held-stdin stall fixed twice over: gate-first
+  ordering — a pre-staging node probe evaluates
+  `learning.episodes.autoWrite === true`; gate off / missing / corrupt
+  config or absent node exits 0 immediately without touching stdin
+  (~2084ms → ~14–40ms). The gate-on staged-read + `ukit memory episode`
+  flow is unchanged. The gate probe itself is armed with an unref'd
+  `UKIT_HOOK_DEADLINE_MS` deadline (default 2s → exit 0, gate-off safe
+  default) so a wedged probe can never re-create the stall it prevents.
+- SessionEnd residual spawn cost (`chain-sessionend-all`) resolved: the
+  background watchdog subshell in `session-episode.sh` inherited the
+  child's stdout/stderr pipes, blocking captured-stdio callers ~2s after
+  script exit. Watchdog now detaches stdio (`>/dev/null 2>&1 &`) —
+  residual 2050ms → ~40ms median; telemetry, per-script `:N` budgets,
+  and fail-open posture preserved.
+- Regression guard `chainTimeoutSuffixes`: every `"<path>.sh":N` budget
+  suffix in template + installed `settings.json` is pinned against the
+  script's original standalone timeout — drift in either direction
+  (wrong N or missing suffix) fails the suite.
+- `ukit doctor` gains a `Hook-chain checks` section
+  (`src/core/hookChainDoctor.js`): bounded scan of recent
+  `hook-latency/*.jsonl` rows reports fail-closed outcomes
+  (timeout/error) as an advisory warning with remedy — never blocks,
+  exit code untouched.
+
+## 2.7.3 - 2026-09-20
+
+AI freeze audit remediation — cycle C38 (TASK-001..007).
+
+- OpenCode residual sweep: `rg -i opencode` inventory classified into
+  keepers vs residuals; residual surfaces removed or steer-only, with a
+  zero-residual manifest test guarding regressions.
+- Unresolved-template-token repair: `mergeOmpConfig` + `diffPlan` detect
+  literal `{{token}}` left in rendered artifacts, repair known tokens,
+  report unknown ones via `unresolvedTokens` (never fabricate); install
+  prints a repair line like the C35 migration line.
+- `orchestration.allowUnsafeEval` (default `false`, optional-present):
+  only an explicit `true` renders `tools.approval.eval: allow` in
+  `.omp/config.yml` via the `omp.evalApproval` render variable; every
+  other state renders `deny` — fail-closed, never prompt. Migrations
+  never enable it; absence keeps the safe default.
+- `src/core/permissionPolicy.js` — pure semantic compiler
+  `compilePermissionPolicy({ permissionMode, allowUnsafeEval, host,
+  surfaces? })`: canonical deny set + precedence tiers
+  (hard-deny > protected-guard > host-deny > explicit-allow >
+  mode-fallback), models `interactive`/`safe-auto`/`unattended` across
+  claude/omp/codex, throws `UKIT_EPOLICY` on unknown mode. Render,
+  doctor, and the matrix share it as single source of truth.
+- `ukit doctor --permissions [--json]`: `src/core/permissionDoctor.js`
+  compiles the policy against live surfaces and reports FAIL classes
+  (unattended-prompt, deny-loss, unsafe-eval-mismatch,
+  unrendered-token) with exit 1; reachable prompts under
+  interactive/safe-auto report as INFO, absent host surfaces SKIP;
+  compact section in the default doctor run, full table under the flag.
+- No-freeze matrix (`tests/manifest/c38NoFreezeMatrix.test.js`):
+  safe→allow, destructive→deny+recovery, unknown-in-unattended never
+  asks, truncated payloads fail closed, merge idempotent, zero `{{`
+  residuals.
+- Canonical deny surfaces closed (R4.5 review): `templates/.claude/
+  settings.json` now denies the full canonical destructive set
+  (`git push -f`, `git clean -fd`, `git checkout .`, `git restore .`,
+  `rm -rf .`, `rm -rf`, `dd if=/dev/`, `*> /dev/sda`, `mkfs`,
+  fork-bomb) and the `gh pr create/comment` + `gh issue comment`
+  entries moved `ask`→`deny` — static surfaces can't express
+  ask-under-interactive-only, so deny is the only mode-safe posture
+  (unattended runs must never reach a prompt). `templates/.omp/
+  config.yml` gains `git push --force-with-lease*`. Report-only hosts
+  (codex) no longer count toward doctor `deny-loss`.
+- `ukit-bridge.js` (omp): `ask` verdicts now degrade to `block` with a
+  recorded cause + recovery route instead of surfacing an interactive
+  prompt under unattended mode (audit row 61).
+- Docs: `docs/UKIT_INTERNALS.md` gains a Permission Modes + Unsafe Eval
+  section — unattended ≠ all-destructive-allowed; a deny routes the
+  agent to the next safer alternative, and the host-internal-wait
+  guidance is unchanged.
+
 ## 2.7.2 - 2026-09-20
 
 OpenCode adapter removal — cycle C37 (TASK-001..004).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "2.7.2",
+  "version": "2.7.4",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/src/cli/commands/doctor.js

@@ -24,11 +24,13 @@ import {
 } from '../../core/projectImportant.js';
 import { runDocContractChecks } from '../../core/docContracts.js';
 import { inspectUnattendedMode } from '../../core/unattendedDoctor.js';
+import { inspectPermissions } from '../../core/permissionDoctor.js';
+import { inspectHookChainHealth } from '../../core/hookChainDoctor.js';
 import { findOpencodeArtifacts, opencodeSteerMessage } from '../../core/opencodeSteer.js';
 
 export const DOCTOR_HELP_FLAGS = new Set(['--help', '-h']);
-const KNOWN_FLAGS = new Set([...DOCTOR_HELP_FLAGS, '--skills', '--gateway', '--docs']);
-const SUPPORTED_FLAGS_LIST = '--help, -h, --skills, --gateway, --docs';
+const KNOWN_FLAGS = new Set([...DOCTOR_HELP_FLAGS, '--skills', '--gateway', '--docs', '--permissions', '--json']);
+const SUPPORTED_FLAGS_LIST = '--help, -h, --skills, --gateway, --docs, --permissions, --json';
 
 export function printDoctorHelp() {
   console.log('Usage: ukit doctor [options]');
@@ -40,6 +42,30 @@ export function printDoctorHelp() {
   console.log('  --skills        Also print a skill word-count/budget report');
   console.log('  --gateway       Live gateway probe (streaming + non-streaming); advisory only');
   console.log('  --docs          Run doc-contract checks (manifests/documentation.yaml projects only)');
+  console.log('  --permissions   Print the full per-host permission report table');
+  console.log('  --json          Emit the permission report as JSON ({permissions:{...}})');
+}
+
+function printPermissionSection(permissionReport, { verbose }) {
+  console.log('[UKit] Permission report:');
+  console.log(`[UKit]   declared: ${permissionReport.declared} → effective: ${permissionReport.effective} (allowUnsafeEval=${permissionReport.allowUnsafeEval})`);
+  for (const [host, info] of Object.entries(permissionReport.hosts)) {
+    if (!info.present) {
+      if (verbose) console.log(`[UKit]   ${host}: SKIP (no UKit-managed surface)`);
+      continue;
+    }
+    console.log(`[UKit]   ${host}: ${info.enforcement} | prompts=${info.promptCount} | deny=${info.denyCount} (missing ${info.denyMissing.length}) | eval=${info.evalSurface ?? info.evalPosture ?? 'n/a'}`);
+  }
+  for (const check of permissionReport.checks) {
+    if (check.applicable === false) {
+      if (verbose) console.log(`[UKit]   -  ${check.label} (skip: ${check.detail ?? 'not applicable'})`);
+      continue;
+    }
+    const sev = check.severity === 'warning' ? ' (warning)' : check.severity === 'info' ? ' (info)' : '';
+    console.log(`[UKit]   ${check.passed ? '✓' : '✗'}  ${check.label}${sev}`);
+    if (check.detail) console.log(`[UKit]      detail: ${check.detail}`);
+    if (!check.passed && check.remedy) console.log(`[UKit]      remedy: ${check.remedy}`);
+  }
 }
 
 export async function runDoctor({ packageRoot, projectRoot, argv = [], homeDir = os.homedir(), ompPath = 'omp' }) {
@@ -53,6 +79,15 @@ export async function runDoctor({ packageRoot, projectRoot, argv = [], homeDir =
     return;
   }
 
+  // TASK-006 / FR-006 — `--json` is a machine surface: emit ONLY the permission
+  // report object, exit 1 when any FAIL class fires.
+  if (argv.includes('--json')) {
+    const permissionReport = await inspectPermissions({ projectRoot, ompPath });
+    console.log(JSON.stringify({ permissions: permissionReport }, null, 2));
+    if (permissionReport.failures.length > 0) process.exitCode = 1;
+    return;
+  }
+
   const pathConfig = buildPathConfig({ packageRoot, projectRoot });
   const runtimePaths = buildRuntimePaths(projectRoot);
   const manifest = await loadManifest(pathConfig.manifestPath);
@@ -277,6 +312,24 @@ export async function runDoctor({ packageRoot, projectRoot, argv = [], homeDir =
     }
   }
 
+  // TASK-006 / FR-006 — unified permission report. Compact section by default,
+  // full per-host table under --permissions. FAIL classes block the exit code.
+  const permissionReport = await inspectPermissions({ projectRoot, ompPath });
+  printPermissionSection(permissionReport, { verbose: argv.includes('--permissions') });
+
+  // TASK-004 / FR-005 — hook-chain failure-taxonomy watch. Advisory only:
+  // warnings render as ✗ + (warning) but never enter the blocking set below.
+  const hookChainHealth = await inspectHookChainHealth({ projectRoot });
+  console.log('[UKit] Hook-chain checks:');
+  {
+    const sev = hookChainHealth.severity === 'warning' ? ' (warning)' : hookChainHealth.severity === 'info' ? ' (info)' : '';
+    console.log(`[UKit]   ${ok(hookChainHealth.passed)}  ${hookChainHealth.label}${sev}`);
+    if (hookChainHealth.detail) console.log(`[UKit]      detail: ${hookChainHealth.detail}`);
+    if (hookChainHealth.remedy && (!hookChainHealth.passed || hookChainHealth.severity === 'warning')) {
+      console.log(`[UKit]      remedy: ${hookChainHealth.remedy}`);
+    }
+  }
+
   if (runtimeConfigInspection.errors.length > 0) {
     console.log(`[UKit] Runtime config issues: ${runtimeConfigInspection.errors.join(' | ')}`);
   }
@@ -428,7 +481,10 @@ export async function runDoctor({ packageRoot, projectRoot, argv = [], homeDir =
   const failedUnattendedChecks = unattended.checks.filter(
     (check) => check.applicable !== false && !check.passed,
   );
-  const allFailedChecks = [...failedProjectChecks, ...failedUnattendedChecks];
+  const failedPermissionChecks = permissionReport.checks.filter(
+    (check) => check.applicable !== false && !check.passed && check.severity !== 'info' && check.severity !== 'warning',
+  );
+  const allFailedChecks = [...failedProjectChecks, ...failedUnattendedChecks, ...failedPermissionChecks];
   const blockingFailures = allFailedChecks.filter(
     (check) => check.remediationClass === 'install-repairable' || check.remediationClass === 'owner-action',
   );

package/src/core/hookChainDoctor.js

@@ -0,0 +1,149 @@
+import path from 'node:path';
+import fs from 'node:fs/promises';
+
+// TASK-004 / SPEC §FR-005 — production-facing watch over the chain-runner
+// failure taxonomy (report §7 residual risk). Scans recent
+// `.ukit/storage/cache/hook-latency/*.jsonl` rows for `hook-chain-runner`
+// entries and reports non-`ok` outcomes by failureKind.
+//
+// Posture: ADVISORY ONLY. A warning never enters doctor's blocking set —
+// missing/clean telemetry is a pass, non-ok outcomes surface as
+// severity:'warning' so doctor.js prints ✗ + (warning) without flipping the
+// exit code (same convention as permissionDoctor drift checks).
+
+const WINDOW_MS = 24 * 60 * 60 * 1000; // last 24h of telemetry files
+const MAX_FILES = 32; // newest session files by mtime
+const MAX_ROWS = 5000; // total rows parsed across all files
+const MAX_BYTES_PER_FILE = 512 * 1024; // tail-read bound per file
+const CHAIN_HOOK = 'hook-chain-runner';
+
+// Row outcomes that mean a fail-closed gate tripped or a child script died.
+const FAILURE_OUTCOMES = new Set([
+  'timeout',
+  'budget-exhausted',
+  'output-overflow',
+  'error',
+  'signal',
+]);
+
+function telemetryDirFor(projectRoot) {
+  return path.join(projectRoot, '.ukit', 'storage', 'cache', 'hook-latency');
+}
+
+async function recentTelemetryFiles(dir, now) {
+  let entries;
+  try {
+    entries = await fs.readdir(dir, { withFileTypes: true });
+  } catch {
+    return []; // dir absent — unknown, not failure
+  }
+  const candidates = [];
+  for (const entry of entries) {
+    if (!entry.isFile() || !entry.name.endsWith('.jsonl')) continue;
+    const filePath = path.join(dir, entry.name);
+    try {
+      const stat = await fs.stat(filePath);
+      candidates.push({ filePath, mtimeMs: stat.mtimeMs, size: stat.size });
+    } catch {
+      // vanished between readdir/stat — skip
+    }
+  }
+  // Bound: only files touched inside the window, newest first, capped.
+  return candidates
+    .filter((f) => now - f.mtimeMs <= WINDOW_MS)
+    .sort((a, b) => b.mtimeMs - a.mtimeMs)
+    .slice(0, MAX_FILES);
+}
+
+async function tailLines(filePath, size) {
+  const handle = await fs.open(filePath, 'r');
+  try {
+    const length = Math.min(size, MAX_BYTES_PER_FILE);
+    const start = Math.max(0, size - length);
+    const buffer = Buffer.alloc(length);
+    await handle.read(buffer, 0, length, start);
+    let text = buffer.toString('utf8');
+    if (start > 0) {
+      // Drop the first (probably partial) line of a tail-read.
+      const nl = text.indexOf('\n');
+      text = nl >= 0 ? text.slice(nl + 1) : '';
+    }
+    return text.split('\n').filter((line) => line.length > 0);
+  } finally {
+    await handle.close();
+  }
+}
+
+export async function inspectHookChainHealth({ projectRoot, now = Date.now() } = {}) {
+  const dir = telemetryDirFor(projectRoot);
+  const files = await recentTelemetryFiles(dir, now);
+
+  const counts = { rowsScanned: 0, filesScanned: files.length, ok: 0 };
+  let rowsLeft = MAX_ROWS;
+
+  for (const file of files) {
+    if (rowsLeft <= 0) break;
+    let lines;
+    try {
+      lines = await tailLines(file.filePath, file.size);
+    } catch {
+      continue; // unreadable file — skip, never fatal
+    }
+    for (const line of lines) {
+      if (rowsLeft <= 0) break;
+      let row;
+      try {
+        row = JSON.parse(line);
+      } catch {
+        continue; // corrupt line ignored — regression guard
+      }
+      if (row?.hook !== CHAIN_HOOK) continue;
+      rowsLeft -= 1;
+      counts.rowsScanned += 1;
+      const outcome = typeof row.outcome === 'string' && row.outcome.length > 0 ? row.outcome : 'ok';
+      counts[outcome] = (counts[outcome] ?? 0) + 1;
+    }
+  }
+
+  const label = 'hook-chain health';
+
+  if (counts.rowsScanned === 0) {
+    return {
+      label,
+      passed: true,
+      failed: false,
+      severity: 'info',
+      remediationClass: 'advisory',
+      detail: 'no telemetry — no hook-chain-runner rows in .ukit/storage/cache/hook-latency/ (unknown, not failure)',
+      counts,
+    };
+  }
+
+  const failureKinds = Object.keys(counts)
+    .filter((key) => FAILURE_OUTCOMES.has(key) && counts[key] > 0)
+    .sort();
+
+  if (failureKinds.length === 0) {
+    return {
+      label,
+      passed: true,
+      failed: false,
+      severity: 'info',
+      remediationClass: 'advisory',
+      detail: `${counts.rowsScanned} chain row(s) scanned across ${counts.filesScanned} file(s) — all outcome:ok`,
+      counts,
+    };
+  }
+
+  const breakdown = failureKinds.map((kind) => `${kind}=${counts[kind]}`).join(', ');
+  return {
+    label,
+    passed: false,
+    failed: true,
+    severity: 'warning',
+    remediationClass: 'advisory',
+    detail: `${counts.rowsScanned} chain row(s) scanned — fail-closed outcomes: ${breakdown}`,
+    remedy: 'Inspect recent rows in .ukit/storage/cache/hook-latency/ for the failing scriptName/failureKind and fix or widen the gate budget.',
+    counts,
+  };
+}

package/src/core/ompConfigMerge.js

@@ -23,10 +23,25 @@ function emptyReport() {
     addedModelRoleKeys: [],
     preservedTopLevelKeys: [],
     preservedPatterns: [],
+    // TASK-002 / FR-002 — every `{{token}}` left in the merged output. A token
+    // survives when renderTemplateString could not resolve it (unknown variable)
+    // or when it was spliced in verbatim from the existing file. The merge never
+    // fabricates a value; it reports the token so install can warn.
+    unresolvedTokens: [],
     parseError: null,
   };
 }
 
+const UNRESOLVED_TOKEN_PATTERN = /\{\{\s*([a-zA-Z0-9_.-]+)\s*\}\}/g;
+
+function recordUnresolvedTokens(text, report) {
+  for (const match of text.matchAll(UNRESOLVED_TOKEN_PATTERN)) {
+    if (!report.unresolvedTokens.includes(match[1])) {
+      report.unresolvedTokens.push(match[1]);
+    }
+  }
+}
+
 // Extract a top-level scalar map's value span: the `key:` line plus following
 // lines that are indented or blank. Stops before the next non-indented,
 // non-blank line — comments preceding the next top-level key stay with it.
@@ -72,10 +87,12 @@ export function mergeOmpConfig(existingText, renderedText) {
     existing = YAML.parse(existingText);
   } catch (error) {
     report.parseError = error?.message ?? String(error);
+    recordUnresolvedTokens(renderedText, report);
     return { text: renderedText, report };
   }
   if (!isPlainObject(existing)) {
     report.parseError = 'existing .omp/config.yml did not parse to a mapping';
+    recordUnresolvedTokens(renderedText, report);
     return { text: renderedText, report };
   }
 
@@ -86,6 +103,7 @@ export function mergeOmpConfig(existingText, renderedText) {
     // A broken template is not a migration problem — surface it as parseError so
     // the caller falls back to plain overwrite rather than crashing install.
     report.parseError = `rendered template failed to parse: ${error?.message ?? error}`;
+    recordUnresolvedTokens(renderedText, report);
     return { text: renderedText, report };
   }
 
@@ -242,6 +260,7 @@ export function mergeOmpConfig(existingText, renderedText) {
   }
 
   const text = lines.join('\n');
+  recordUnresolvedTokens(text, report);
   // "migrated" = the merge changed anything relative to what is on disk —
   // includes the approval-surface rewrite itself (legacy approvalMode, prompt
   // values) even when no user region needed splicing.

package/src/core/permissionDoctor.js

@@ -0,0 +1,319 @@
+import path from 'node:path';
+import fs from 'node:fs/promises';
+import { parse } from 'yaml';
+import { pathExists, readJsonIfExists } from './fileOps.js';
+import { VALID_PERMISSION_MODES } from './runtimeConfig.js';
+import {
+  compilePermissionPolicy,
+  PERMISSION_HOSTS,
+  CANONICAL_DENY,
+} from './permissionPolicy.js';
+import { findOpencodeArtifacts, opencodeSteerMessage } from './opencodeSteer.js';
+
+// TASK-006 / SPEC §5 FR-006 — unified permission report across claude/omp/codex
+// UKit-managed surfaces. Reads the live surfaces, compiles the semantic policy
+// (single source of truth — drift between render and doctor is impossible), and
+// emits { declared, effective, hosts, checks, failures } for both the human
+// doctor section and `--json`.
+//
+// FAIL classes (each → named failing check + report.failures entry + exit 1):
+//   unattended-prompt      prompt/ask reachable while permissionMode=unattended
+//   deny-loss              canonical deny entry missing from a host surface
+//   unsafe-eval-mismatch   surface eval approval ≠ compiled evalPosture
+//   unrendered-token       literal {{token}} left in a rendered artifact
+// INFO: reachable prompts under interactive/safe-auto. SKIP: absent host surface.
+
+const UNRESOLVED_TOKEN_PATTERN = /\{\{\s*([a-zA-Z0-9_.-]+)\s*\}\}/g;
+
+// Bounded scan list — UKit-managed rendered artifacts only (SPEC §6 perf).
+const RENDERED_ARTIFACTS = [
+  '.omp/config.yml',
+  '.claude/settings.json',
+  '.claude/settings.local.json',
+  '.codex/settings.json',
+  '.codex/settings.local.json',
+];
+
+async function readOmpConfig(projectRoot) {
+  const configPath = path.join(projectRoot, '.omp', 'config.yml');
+  try {
+    const text = await fs.readFile(configPath, 'utf8');
+    const parsed = parse(text);
+    return { exists: true, parsed: parsed && typeof parsed === 'object' ? parsed : {}, parseError: null };
+  } catch (error) {
+    if (error?.code === 'ENOENT') return { exists: false, parsed: null, parseError: null };
+    return { exists: true, parsed: null, parseError: error?.message ?? String(error) };
+  }
+}
+
+async function readClaudeSurface(projectRoot) {
+  const settingsPath = path.join(projectRoot, '.claude', 'settings.json');
+  const settings = await readJsonIfExists(settingsPath);
+  const permissions = settings?.permissions;
+  if (!permissions || typeof permissions !== 'object') {
+    return { present: false, deny: [], allow: [], ask: [] };
+  }
+  const list = (key) => (Array.isArray(permissions[key]) ? permissions[key].filter((e) => typeof e === 'string') : []);
+  return {
+    present: true,
+    deny: list('deny'),
+    allow: list('allow'),
+    ask: list('ask'),
+  };
+}
+
+async function scanUnresolvedTokens(projectRoot) {
+  const hits = [];
+  for (const relPath of RENDERED_ARTIFACTS) {
+    let text;
+    try {
+      text = await fs.readFile(path.join(projectRoot, relPath), 'utf8');
+    } catch {
+      continue; // absent artifact — not a token hit
+    }
+    for (const match of text.matchAll(UNRESOLVED_TOKEN_PATTERN)) {
+      hits.push({ file: relPath, token: match[1] });
+    }
+  }
+  return hits;
+}
+
+export async function inspectPermissions({ projectRoot, ompPath = 'omp' }) {
+  const runtimeConfig = await readJsonIfExists(
+    path.join(projectRoot, '.ukit', 'storage', 'config.json'),
+  );
+  const declaredRaw = runtimeConfig?.orchestration?.permissionMode;
+  const declared = declaredRaw === undefined ? 'unattended' : declaredRaw;
+  const modeValid = VALID_PERMISSION_MODES.has(declared);
+  const allowUnsafeEval = runtimeConfig?.orchestration?.allowUnsafeEval === true;
+
+  // --- Surface reads ---------------------------------------------------------
+  const omp = await readOmpConfig(projectRoot);
+  const ompTools = omp.parsed?.tools ?? {};
+  const approvalMap = ompTools.approval && typeof ompTools.approval === 'object' ? ompTools.approval : {};
+  const bashPatterns = Array.isArray(omp.parsed?.bash?.patterns) ? omp.parsed.bash.patterns : [];
+
+  const ompDeny = bashPatterns
+    .filter((e) => e && e.approval === 'deny' && typeof e.match === 'string')
+    .map((e) => e.match);
+  const ompAllow = bashPatterns
+    .filter((e) => e && e.approval === 'allow' && typeof e.match === 'string')
+    .map((e) => e.match);
+  // Reachable prompt/ask entries on the omp surface — named so the report can
+  // point at the offending key instead of a bare count.
+  const ompPromptEntries = [];
+  if (ompTools.approvalMode === 'prompt' || ompTools.approvalMode === 'ask') {
+    ompPromptEntries.push('tools.approvalMode');
+  }
+  for (const [key, value] of Object.entries(approvalMap)) {
+    if (value === 'prompt' || value === 'ask') ompPromptEntries.push(`tools.approval.${key}`);
+  }
+  for (const entry of bashPatterns) {
+    if (entry && (entry.approval === 'prompt' || entry.approval === 'ask')) {
+      ompPromptEntries.push(`bash.patterns:${entry.match ?? '?'}`);
+    }
+  }
+  const ompEvalSurface = approvalMap.eval;
+
+  const claude = await readClaudeSurface(projectRoot);
+  const codexPresent = await pathExists(path.join(projectRoot, '.codex'));
+
+  // --- Per-host compiled policy ---------------------------------------------
+  const hosts = {};
+  const policies = {};
+  const surfaceInput = {
+    omp: omp.exists
+      ? {
+          deny: ompDeny,
+          allow: ompAllow,
+          ask: ompPromptEntries,
+          // compile throws on non-allow/deny values — prompt/ask eval is already
+          // counted as a reachable prompt, so only feed the compiler a real
+          // posture value.
+          ...(ompEvalSurface === 'allow' || ompEvalSurface === 'deny'
+            ? { evalApproval: ompEvalSurface }
+            : {}),
+        }
+      : null,
+    claude: claude.present
+      ? { deny: claude.deny, allow: claude.allow, ask: claude.ask }
+      : null,
+    codex: codexPresent ? {} : null,
+  };
+
+  for (const host of PERMISSION_HOSTS) {
+    const present = surfaceInput[host] !== null;
+    if (!present) {
+      hosts[host] = { present: false, enforcement: host === 'codex' ? 'report-only' : 'enforced' };
+      continue;
+    }
+    let policy = null;
+    let compileError = null;
+    if (modeValid) {
+      try {
+        policy = compilePermissionPolicy({
+          permissionMode: declared,
+          allowUnsafeEval,
+          host,
+          surfaces: surfaceInput[host],
+        });
+      } catch (error) {
+        compileError = error?.message ?? String(error);
+      }
+    }
+    policies[host] = policy;
+
+    const surfaceDeny = surfaceInput[host]?.deny ?? [];
+    const denySet = new Set(surfaceDeny);
+    const denyMissing = CANONICAL_DENY
+      .map((c) => c[host])
+      .filter((entry) => typeof entry === 'string' && !denySet.has(entry));
+
+    const promptCount = host === 'omp'
+      ? ompPromptEntries.length
+      : (surfaceInput[host]?.ask ?? []).length;
+
+    hosts[host] = {
+      present: true,
+      enforcement: policy?.enforcement ?? (host === 'codex' ? 'report-only' : 'enforced'),
+      effectiveMode: policy?.effectiveMode ?? declared,
+      allowsPrompts: policy?.allowsPrompts ?? null,
+      promptCount,
+      promptEntries: surfaceInput[host]?.ask ?? [],
+      denyCount: surfaceDeny.length,
+      denyMissing,
+      evalPosture: policy?.evalPosture ?? null,
+      evalSurface: host === 'omp' ? (ompEvalSurface ?? null) : null,
+      warnings: policy?.warnings ?? [],
+      ...(compileError ? { compileError } : {}),
+    };
+  }
+
+  const unresolvedTokens = await scanUnresolvedTokens(projectRoot);
+  const legacyArtifacts = findOpencodeArtifacts(projectRoot);
+
+  // --- Checks ----------------------------------------------------------------
+  const failures = [];
+  const anySurface = PERMISSION_HOSTS.some((h) => hosts[h].present);
+  const totalPrompts = PERMISSION_HOSTS.reduce((n, h) => n + (hosts[h].promptCount ?? 0), 0);
+  const promptsFail = declared === 'unattended' && totalPrompts > 0;
+  // Report-only hosts (codex) have no permission surface by design — counting
+  // their canonical deny set as "missing" would make deny-loss FAIL permanent
+  // with an impossible remedy. Only enforced surfaces feed deny-loss.
+  const denyMissingAll = PERMISSION_HOSTS
+    .filter((h) => hosts[h].enforcement === 'enforced')
+    .flatMap((h) => (hosts[h].denyMissing ?? []).map((entry) => `${h}:${entry}`));
+  const evalMismatch = PERMISSION_HOSTS.some((h) =>
+    (hosts[h].warnings ?? []).includes('unsafe-eval-mismatch'));
+  const driftWarnings = PERMISSION_HOSTS.flatMap((h) =>
+    (hosts[h].warnings ?? [])
+      .filter((w) => w !== 'unsafe-eval-mismatch' && w !== 'prompt-reachable-under-unattended')
+      .map((w) => `${h}:${w}`));
+
+  if (promptsFail) failures.push('unattended-prompt');
+  if (denyMissingAll.length > 0) failures.push('deny-loss');
+  if (evalMismatch) failures.push('unsafe-eval-mismatch');
+  if (unresolvedTokens.length > 0) failures.push('unrendered-token');
+  if (!modeValid) failures.push('invalid-permission-mode');
+
+  const check = (label, passed, remediationClass, remedy, extra = {}) => ({
+    label,
+    passed,
+    failed: !passed,
+    remediationClass,
+    remedy,
+    ...extra,
+  });
+
+  const checks = [
+    check(
+      'permission mode declared and valid',
+      modeValid,
+      'owner-action',
+      `Set orchestration.permissionMode in .ukit/storage/config.json to one of: ${[...VALID_PERMISSION_MODES].join(', ')}.`,
+      { detail: `declared: ${declared}${declaredRaw === undefined ? ' (default)' : ''} → effective: ${modeValid ? declared : 'unknown'}` },
+    ),
+    check(
+      'no prompts reachable under unattended mode',
+      !promptsFail,
+      'owner-action',
+      'Run ukit install to strip prompt/ask approvals, or switch orchestration.permissionMode to interactive/safe-auto.',
+      {
+        ...(anySurface ? {} : { applicable: false, detail: 'no host permission surfaces installed' }),
+        ...(anySurface && !promptsFail && totalPrompts > 0
+          ? { severity: 'info' }
+          : {}),
+        detail: anySurface
+          ? `${totalPrompts} reachable prompt/ask entr(ies)${declared === 'unattended' ? '' : ` (mode ${declared} allows prompts)`}`
+          : 'no host permission surfaces installed',
+      },
+    ),
+    check(
+      'deny coverage vs canonical set',
+      denyMissingAll.length === 0,
+      'install-repairable',
+      'Run ukit install to restore the canonical deny entries on host surfaces.',
+      {
+        ...(anySurface ? {} : { applicable: false }),
+        detail: denyMissingAll.length === 0
+          ? 'all canonical deny entries present'
+          : `missing: ${denyMissingAll.join(', ')}`,
+      },
+    ),
+    check(
+      'eval posture matches allowUnsafeEval',
+      !evalMismatch,
+      'install-repairable',
+      `Run ukit install to re-render eval approval (compiled posture: ${allowUnsafeEval ? 'allow' : 'deny'}), or flip orchestration.allowUnsafeEval.`,
+      {
+        ...(hosts.omp.present ? {} : { applicable: false, detail: '.omp/config.yml absent' }),
+        detail: hosts.omp.present
+          ? `knob=${allowUnsafeEval} → expected ${allowUnsafeEval ? 'allow' : 'deny'}, surface eval=${ompEvalSurface ?? 'absent'}`
+          : '.omp/config.yml absent',
+      },
+    ),
+    check(
+      'no unresolved {{token}} in rendered artifacts',
+      unresolvedTokens.length === 0,
+      'install-repairable',
+      'Run ukit install to re-render and heal literal {{tokens}}; unknown tokens are reported, never fabricated.',
+      {
+        detail: unresolvedTokens.length === 0
+          ? 'no {{...}} literals in managed artifacts'
+          : unresolvedTokens.map((t) => `${t.file}:{{${t.token}}}`).join(', '),
+      },
+    ),
+    check(
+      'no drift vs compiled policy',
+      driftWarnings.length === 0,
+      'advisory',
+      'Review the flagged surface entries against compilePermissionPolicy output.',
+      {
+        ...(driftWarnings.length > 0 ? { severity: 'warning' } : {}),
+        detail: driftWarnings.length === 0 ? 'surfaces consistent with compiled policy' : driftWarnings.join(', '),
+      },
+    ),
+  ];
+
+  if (legacyArtifacts.length > 0) {
+    checks.push({
+      label: opencodeSteerMessage(legacyArtifacts),
+      passed: true,
+      failed: false,
+      severity: 'warning',
+      remediationClass: 'advisory',
+      remedy: 'Remove it manually: rm opencode.json',
+    });
+  }
+
+  return {
+    declared,
+    effective: modeValid ? declared : 'unknown',
+    allowUnsafeEval,
+    hosts,
+    checks,
+    failures,
+    unresolvedTokens,
+    legacyArtifacts,
+  };
+}

package/src/core/permissionPolicy.js

@@ -0,0 +1,179 @@
+// UKIT_EPOLICY — pure compiler: orchestration.permissionMode +
+// orchestration.allowUnsafeEval → deterministic per-host semantic policy for
+// claude/omp/codex. No I/O: callers pass parsed surfaces (doctor reads files,
+// tests pass fixtures). Consumed by doctor (FR-006) and the no-freeze matrix
+// (FR-007) as the single semantic source of truth so host surfaces cannot
+// drift. SPEC §5 FR-005 / §8 / §14.
+import { VALID_PERMISSION_MODES } from './runtimeConfig.js';
+
+export const PERMISSION_HOSTS = Object.freeze(['claude', 'omp', 'codex']);
+export const PERMISSION_MODES = VALID_PERMISSION_MODES;
+
+// Precedence — higher tier always wins over a lower one for the same entry.
+export const PERMISSION_PRECEDENCE = Object.freeze([
+  'hard-deny',        // catastrophic commands — deny regardless of any surface
+  'protected-guard',  // hook-guarded files/tools — outranks host-deny
+  'host-deny',        // surface deny rules (settings.json deny, bash.patterns deny)
+  'explicit-allow',   // surface allow rules
+  'mode-fallback',    // mode default action for unclassified entries
+]);
+
+// Canonical deny set — semantic ids + per-host surface strings. Templates,
+// doctor, and the matrix all assert against this so surfaces cannot lose an
+// entry without detection. `hardDeny: true` entries are catastrophic-class
+// (root/home/parent recursive deletes, dd/mkfs/fork-bomb) and are denied in
+// every mode on every host, even report-only codex.
+export const CANONICAL_DENY = Object.freeze([
+  { id: 'git-reset-hard', claude: 'Bash(git reset --hard:*)', omp: 'git reset --hard*', codex: 'git reset --hard' },
+  { id: 'git-push-force', claude: 'Bash(git push --force:*)', omp: 'git push --force*', codex: 'git push --force' },
+  { id: 'git-push-force-short', claude: 'Bash(git push -f:*)', omp: 'git push -f *', codex: 'git push -f' },
+  { id: 'git-push-force-with-lease', claude: 'Bash(git push --force-with-lease:*)', omp: 'git push --force-with-lease*', codex: 'git push --force-with-lease' },
+  { id: 'git-clean-fd', claude: 'Bash(git clean -fd:*)', omp: 'git clean -fd*', codex: 'git clean -fd' },
+  { id: 'git-checkout-dot', claude: 'Bash(git checkout .:*)', omp: 'git checkout .*', codex: 'git checkout .' },
+  { id: 'git-restore-dot', claude: 'Bash(git restore .:*)', omp: 'git restore .*', codex: 'git restore .' },
+  { id: 'rm-rf-root', claude: 'Bash(rm -rf /:*)', omp: 'rm -rf /*', codex: 'rm -rf /', hardDeny: true },
+  { id: 'rm-rf-home', claude: 'Bash(rm -rf ~:*)', omp: 'rm -rf ~*', codex: 'rm -rf ~', hardDeny: true },
+  { id: 'rm-rf-parent', claude: 'Bash(rm -rf ..:*)', omp: 'rm -rf ..', codex: 'rm -rf ..', hardDeny: true },
+  { id: 'rm-rf-dot', claude: 'Bash(rm -rf .:*)', omp: 'rm -rf .', codex: 'rm -rf .', hardDeny: true },
+  { id: 'rm-rf-any', claude: 'Bash(rm -rf:*)', omp: 'rm -rf *', codex: 'rm -rf' },
+  { id: 'dd-raw-device', claude: 'Bash(dd if=/dev/:*)', omp: 'dd if=/dev/*', codex: 'dd if=/dev/', hardDeny: true },
+  { id: 'write-raw-device', claude: 'Bash(*> /dev/sda:*)', omp: '*> /dev/sda*', codex: '> /dev/sda', hardDeny: true },
+  { id: 'mkfs', claude: 'Bash(mkfs:*)', omp: 'mkfs.*', codex: 'mkfs', hardDeny: true },
+  { id: 'fork-bomb', claude: 'Bash(:(){ :|:& };::*)', omp: ':(){ :|:& };:*', codex: ':(){ :|:& };:', hardDeny: true },
+]);
+
+// Canonical protected-guard set — hook-enforced paths/tools that outrank any
+// surface deny/allow. Semantic ids only; hook scripts remain the authority.
+export const CANONICAL_PROTECTED = Object.freeze([
+  'release-credentials',   // npm tokens, signing keys, .env secrets
+  'protected-files',       // protect-files.sh guarded paths
+  'stale-spec-guard',      // spec/source drift guard on edits
+]);
+
+const TIER_RANK = new Map(PERMISSION_PRECEDENCE.map((tier, i) => [tier, i]));
+
+// Mode fallback for unclassified entries. `prompt` fallback is what makes a
+// mode prompt-reachable; unattended never falls back to a prompt.
+const MODE_FALLBACK = Object.freeze({
+  interactive: 'prompt',
+  'safe-auto': 'prompt',
+  unattended: 'allow',
+});
+
+const MODE_PROMPT_CAPABLE = Object.freeze({
+  interactive: true,
+  'safe-auto': true,
+  unattended: false,
+});
+
+// codex carries no UKit-managed permission block today — the compiler still
+// returns a shaped policy so doctor/matrix can report it (SPEC §14).
+const HOST_ENFORCEMENT = Object.freeze({
+  claude: 'enforced',
+  omp: 'enforced',
+  codex: 'report-only',
+});
+
+function policyError(message) {
+  return new Error(`UKIT_EPOLICY ${message}`);
+}
+
+/**
+ * compilePermissionPolicy({ permissionMode, allowUnsafeEval, host, surfaces? })
+ * → { mode, effectiveMode, host, enforcement, allowsPrompts, promptReachable,
+ *     deny, allow, protections, evalPosture, rules, warnings }
+ *
+ * `surfaces` is an optional caller-parsed host surface:
+ *   { deny: [...], allow: [...], protect: [...], ask: [...], evalApproval }
+ * Entries appearing in several tiers resolve to the highest precedence tier.
+ */
+export function compilePermissionPolicy(input = {}) {
+  const { permissionMode, allowUnsafeEval = false, host, surfaces = {} } = input;
+
+  if (!VALID_PERMISSION_MODES.has(permissionMode)) {
+    throw policyError(`unknown permissionMode: ${JSON.stringify(permissionMode)} (expected one of: ${[...VALID_PERMISSION_MODES].join(', ')})`);
+  }
+  if (!PERMISSION_HOSTS.includes(host)) {
+    throw policyError(`unknown host: ${JSON.stringify(host)} (expected one of: ${PERMISSION_HOSTS.join(', ')})`);
+  }
+  if (allowUnsafeEval !== undefined && typeof allowUnsafeEval !== 'boolean') {
+    throw policyError(`allowUnsafeEval must be boolean, got: ${JSON.stringify(allowUnsafeEval)}`);
+  }
+  if (surfaces === null || typeof surfaces !== 'object' || Array.isArray(surfaces)) {
+    throw policyError('surfaces must be an object when provided');
+  }
+
+  const mode = permissionMode;
+  const effectiveMode = mode;
+  const enforcement = HOST_ENFORCEMENT[host];
+  const promptCapable = MODE_PROMPT_CAPABLE[mode];
+  const warnings = [];
+
+  // --- eval posture: allow iff the knob is explicitly true (fail closed). ---
+  const evalPosture = allowUnsafeEval === true ? 'allow' : 'deny';
+  if (surfaces.evalApproval !== undefined
+    && surfaces.evalApproval !== 'allow'
+    && surfaces.evalApproval !== 'deny') {
+    throw policyError(`surfaces.evalApproval must be 'allow' or 'deny', got: ${JSON.stringify(surfaces.evalApproval)}`);
+  }
+  if (surfaces.evalApproval !== undefined && surfaces.evalApproval !== evalPosture) {
+    warnings.push('unsafe-eval-mismatch');
+  }
+
+  // --- Tier collection. Each rule: { entry, tier, action, source }. ---
+  const byEntry = new Map();
+  const addRule = (entry, tier, action, source) => {
+    if (typeof entry !== 'string' || entry.length === 0) return;
+    const existing = byEntry.get(entry);
+    if (!existing || TIER_RANK.get(tier) < TIER_RANK.get(existing.tier)) {
+      byEntry.set(entry, { entry, tier, action, source });
+    }
+  };
+
+  for (const canonical of CANONICAL_DENY) {
+    const tier = canonical.hardDeny === true ? 'hard-deny' : 'host-deny';
+    addRule(canonical[host], tier, 'deny', `canonical:${canonical.id}`);
+  }
+  for (const guard of CANONICAL_PROTECTED) {
+    addRule(guard, 'protected-guard', 'deny', 'canonical-guard');
+  }
+
+  for (const entry of surfaces.protect ?? []) addRule(entry, 'protected-guard', 'deny', 'surface:protect');
+  for (const entry of surfaces.deny ?? []) addRule(entry, 'host-deny', 'deny', 'surface:deny');
+  for (const entry of surfaces.allow ?? []) addRule(entry, 'explicit-allow', 'allow', 'surface:allow');
+
+  // ask/prompt surface entries: reachable prompts only when the mode can prompt.
+  const askEntries = [...new Set(surfaces.ask ?? [])];
+  const promptReachable = [];
+  for (const entry of askEntries) {
+    if (promptCapable) {
+      addRule(entry, 'explicit-allow', 'prompt', 'surface:ask');
+      promptReachable.push(entry);
+    } else {
+      // Under unattended an ask entry is unreachable — flagged for doctor.
+      addRule(entry, 'host-deny', 'deny', 'surface:ask-unreachable');
+      warnings.push('prompt-reachable-under-unattended');
+    }
+  }
+
+  const rules = [...byEntry.values()];
+  const deny = rules.filter((r) => r.action === 'deny').map((r) => r.entry);
+  const allow = rules.filter((r) => r.action === 'allow').map((r) => r.entry);
+  const protections = rules.filter((r) => r.tier === 'protected-guard').map((r) => r.entry);
+
+  return {
+    mode,
+    effectiveMode,
+    host,
+    enforcement,
+    allowsPrompts: promptCapable,
+    promptReachable,
+    deny,
+    allow,
+    protections,
+    evalPosture,
+    rules,
+    warnings: [...new Set(warnings)],
+    fallback: MODE_FALLBACK[mode],
+  };
+}

package/src/core/runInstallPipeline.js

@@ -16,6 +16,7 @@ import { repairBrokenHooks } from './repairBrokenHooks.js';
 import { applyGatewayResilienceEnv } from './gatewayResilienceEnv.js';
 import { cleanupEmptyParents, readJsonIfExists, removeFileOrLinkOnly, resolveProjectRelativePath } from './fileOps.js';
 import { findOpencodeArtifacts, opencodeSteerMessage } from './opencodeSteer.js';
+import { loadRuntimeConfig } from './runtimeConfig.js';
 
 const AUTO_PRUNE_OBSOLETE_PREFIXES = [
   '.claude/skills/',
@@ -279,6 +280,10 @@ export async function runInstallPipeline({
   const stackContext = await detectStack(pathConfig.projectRoot);
   const projectContext = await detectProjectContext(pathConfig.projectRoot);
   const providerContext = await detectProviders(pathConfig.projectRoot);
+  // FR-004 — feeds the omp.evalApproval render variable. Missing/invalid config
+  // degrades to defaults (allowUnsafeEval: false) inside loadRuntimeConfig, so
+  // the rendered eval approval fails closed to `deny`.
+  const runtimeConfig = await loadRuntimeConfig(pathConfig.projectRoot);
 
   const variables = buildTemplateVariables({
     projectContext,
@@ -286,6 +291,7 @@ export async function runInstallPipeline({
     packageVersion,
     providerContext,
     withCodegraph,
+    runtimeConfig,
   });
 
   const plan = await buildInstallPlan({
@@ -331,6 +337,15 @@ export async function runInstallPipeline({
       console.log(`[UKit] .omp/config.yml: migrated approval surface (prompt→removed: ${removed}, preserved: ${preserved})`);
     }
 
+    // TASK-002 / FR-002: any `{{token}}` that survived into merged .omp/config.yml
+    // output means the render lane lacked the variable — warn instead of silently
+    // persisting the literal (the original autoCompactWindow bug mechanism).
+    for (const entry of diffResults) {
+      const tokens = entry?.migrationReport?.unresolvedTokens;
+      if (!tokens || tokens.length === 0) continue;
+      console.warn(`[UKit] Warning: .omp/config.yml contains unresolved template tokens: ${tokens.join(', ')} — report this to UKit maintainers; no value was fabricated.`);
+    }
+
     // BUG-C22-19: bound the .bak accumulation — every overwrite_with_backup write
     // adds one and nothing removed them. Advisory: a prune failure must never
     // fail the install.

package/src/core/runtimeConfig.js

@@ -143,6 +143,10 @@ export function buildDefaultRuntimeConfig(overrides = {}) {
       orchestratorModel: 'claude-sonnet-5',
       advisorEnabled: true,
       permissionMode: 'unattended',
+      // FR-003: eval-subprocess gate for rendered omp approval (tools.approval.eval).
+      // Fail-closed: only an explicit user `true` renders `eval: allow`; absent,
+      // false, or an unreadable config all render `deny`. Migration never sets it.
+      allowUnsafeEval: false,
       contracts: buildConfigContracts(),
       modelTiers: {
         // ompRole is the .omp/config.yml modelRoles key this tier binds to.
@@ -407,6 +411,9 @@ export function validateRuntimeConfig(config) {
       && !VALID_PERMISSION_MODES.has(config.orchestration.permissionMode)) {
       errors.push(`orchestration.permissionMode must be one of: ${[...VALID_PERMISSION_MODES].join(', ')}.`);
     }
+    if (config.orchestration.allowUnsafeEval !== undefined) {
+      pushBooleanError(errors, config.orchestration.allowUnsafeEval, 'orchestration.allowUnsafeEval');
+    }
     if (!isPlainObject(config.orchestration.contracts)) {
       errors.push('orchestration.contracts must be an object.');
     }

package/src/core/unattendedDoctor.js

@@ -70,6 +70,8 @@ export async function inspectUnattendedMode({ projectRoot, ompPath = 'omp' }) {
   const permissionModeValid = permissionModeRaw === undefined
     || VALID_PERMISSION_MODES.has(permissionModeRaw);
   const permissionMode = permissionModeRaw === undefined ? 'unattended' : permissionModeRaw;
+  const allowUnsafeEval = runtimeConfig?.orchestration?.allowUnsafeEval === true;
+  const expectedEval = allowUnsafeEval ? 'allow' : 'deny';
 
   const omp = await readOmpConfig(projectRoot);
   const tools = omp.parsed?.tools ?? {};
@@ -163,14 +165,16 @@ export async function inspectUnattendedMode({ projectRoot, ompPath = 'omp' }) {
         'Run ukit install to pin tools.approvalMode: yolo in .omp/config.yml.',
         { detail: `value: ${effectiveApprovalMode} (source: ${approvalSource})` },
       ),
-    // 3 — eval/bash policy allow
+    // 3 — eval/bash policy vs compiled posture (FR-004/FR-006): bash stays
+    // allow; eval matches the allowUnsafeEval knob (deny by default — fail
+    // closed), never prompt.
     check(
-      "eval/bash policy 'allow'",
-      omp.exists && approvalMap.eval === 'allow' && approvalMap.bash === 'allow',
+      'eval/bash policy matches compiled posture',
+      omp.exists && approvalMap.bash === 'allow' && approvalMap.eval === expectedEval,
       'install-repairable',
-      'Run ukit install to restore tools.approval.eval/bash: allow.',
+      `Run ukit install to restore tools.approval.bash: allow and tools.approval.eval: ${expectedEval}.`,
       omp.exists
-        ? {}
+        ? { detail: `eval expected ${expectedEval} (allowUnsafeEval=${allowUnsafeEval}), got ${approvalMap.eval ?? 'absent'}` }
         : { applicable: false, detail: '.omp/config.yml absent' },
     ),
     // 4 — zero prompt policies

package/src/render/buildVariables.js

@@ -13,12 +13,18 @@ UKit routing, memory, and skill activation remain primary. CodeGraph is the inde
 To disable: rerun \`ukit install\` without \`--with-codegraph\`.
 `;
 
-export function buildTemplateVariables({ projectContext, stackContext, packageVersion, providerContext, withCodegraph = false }) {
+export function buildTemplateVariables({ projectContext, stackContext, packageVersion, providerContext, withCodegraph = false, runtimeConfig }) {
   // Derived, never hand-written: .claude/settings.json is read by Claude Code itself and so
   // cannot consult .ukit/storage/config.json at runtime. Baking the window in here keeps
   // compact.hardCapTokens the single number that retunes both.
   const { autoCompactWindow } = loadShippedCompactBudget();
 
+  // FR-004 — fail closed: `allow` only on an explicit user opt-in
+  // (`orchestration.allowUnsafeEval === true`). Missing, unreadable, or
+  // non-boolean config all resolve `deny` — never `prompt`/`ask`, which would
+  // dead-end under unattended (SPEC §14).
+  const evalApproval = runtimeConfig?.orchestration?.allowUnsafeEval === true ? 'allow' : 'deny';
+
   return {
     compact: {
       autoCompactWindow: String(autoCompactWindow),
@@ -58,6 +64,9 @@ export function buildTemplateVariables({ projectContext, stackContext, packageVe
     user: {
       profile: 'default',
     },
+    omp: {
+      evalApproval,
+    },
     codegraphSection: withCodegraph ? CODEGRAPH_SECTION : '',
   };
 }

package/templates/.claude/hooks/session-episode.sh

@@ -15,6 +15,28 @@
 PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
 CONFIG_FILE="$PROJECT_ROOT/.ukit/storage/config.json"
 
+# Gate-first fast path (TASK-001): evaluate learning.episodes.autoWrite BEFORE
+# staging stdin. A producer that holds the pipe open would otherwise burn the
+# full stdin-staging watchdog (measured ~2020ms) even though a gate-off run
+# never inspects the payload — the same held-stdin stall TASK-235 fixed in
+# project-important.sh. Missing/corrupt config or missing node resolves to 0,
+# i.e. gate off → exit 0 without touching stdin.
+__ukit_ep_gate="$(node -e '
+const HOOK_DEADLINE_MS = Number.parseInt(process.env.UKIT_HOOK_DEADLINE_MS || "", 10) || 2000;
+setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
+const fs = require("fs");
+try {
+  const config = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+  process.stdout.write(config?.learning?.episodes?.autoWrite === true ? "1" : "0");
+} catch {
+  process.stdout.write("0");
+}
+' "$CONFIG_FILE" 2>/dev/null)" || __ukit_ep_gate="0"
+if [ "$__ukit_ep_gate" != "1" ]; then
+  exit 0
+fi
+unset __ukit_ep_gate
+
 # Bounded stdin read (existing hook style): cap +1 byte in background so a
 # producer that never closes the pipe cannot park the session teardown.
 UKIT_INPUT_FILE="$(mktemp "${TMPDIR:-/tmp}/ukit-episode-in.XXXXXX")" || exit 0
@@ -23,7 +45,10 @@ if [ -e /dev/fd/0 ]; then
   head -c 65537 <&8 > "$UKIT_INPUT_FILE" 2>/dev/null &
   UKIT_HEAD_PID=$!
   # UKIT_HOOK_STAGE_MS:-2000 — bounded wait for the staged payload.
-  ( sleep 2; kill "$UKIT_HEAD_PID" 2>/dev/null ) &
+  # TASK-002: detach the watchdog's inherited stdout/stderr — otherwise a
+  # captured-stdio caller (hook-chain-runner) sees the pipe held open ~2s
+  # after the script exits, inflating the SessionEnd residual to ~2000ms.
+  ( sleep 2; kill "$UKIT_HEAD_PID" 2>/dev/null ) >/dev/null 2>&1 &
   UKIT_WATCH_PID=$!
   wait "$UKIT_HEAD_PID" 2>/dev/null
   kill "$UKIT_WATCH_PID" 2>/dev/null

package/templates/.claude/settings.json

@@ -36,18 +36,26 @@
       "Bash(git worktree:*)",
       "Bash(jq:*)"
     ],
-    "ask": [
-      "Bash(gh pr create:*)",
-      "Bash(gh pr comment:*)",
-      "Bash(gh issue comment:*)"
-    ],
     "deny": [
       "Bash(git reset --hard:*)",
       "Bash(git push --force:*)",
+      "Bash(git push -f:*)",
       "Bash(git push --force-with-lease:*)",
+      "Bash(git clean -fd:*)",
+      "Bash(git checkout .:*)",
+      "Bash(git restore .:*)",
       "Bash(rm -rf /:*)",
       "Bash(rm -rf ~:*)",
-      "Bash(rm -rf ..:*)"
+      "Bash(rm -rf ..:*)",
+      "Bash(rm -rf .:*)",
+      "Bash(rm -rf:*)",
+      "Bash(dd if=/dev/:*)",
+      "Bash(*> /dev/sda:*)",
+      "Bash(mkfs:*)",
+      "Bash(:(){ :|:& };::*)",
+      "Bash(gh pr create:*)",
+      "Bash(gh pr comment:*)",
+      "Bash(gh issue comment:*)"
     ]
   },
   "hooks": {

package/templates/.claude/ukit/skill-router-state.json

@@ -0,0 +1 @@
+{"fingerprint":"routefp-v3:VKbWKdhO0GSCeYRnXINdC_39mkvjp8UX9-pC9T_y3yQ","ts":1789910232582,"source":"skill-router","activeSkills":[],"routingContext":{"lastExplicitUserPromptText":"","taskType":null,"intentMode":null,"executionMode":null}}

package/templates/.omp/config.yml

@@ -36,14 +36,17 @@ tools:
   # TASK-004 hook-bridge deny chain, and this approval map still gate dangerous
   # ops — `allow` removes interactive prompts, not the deny checks.
   # Residual risk: yolo + all-allow IS dangerously autonomous and is a
-  # deliberate, user-chosen posture (unattended mode). `eval` stays `allow`
-  # (was `prompt` pre-TASK-001): bash.patterns never covers the eval tool, but
-  # the TASK-004 bridge maps `eval` -> `Bash`, so every eval call is gated by
-  # the same block-dangerous chain as a bash command.
+  # deliberate, user-chosen posture (unattended mode). `eval` renders from the
+  # `orchestration.allowUnsafeEval` knob in .ukit/storage/config.json — `allow`
+  # only on explicit user opt-in, else `deny` (never `prompt`/`ask`: a prompt
+  # dead-ends under unattended). bash.patterns never covers the eval tool —
+  # eval payloads (os.remove, shutil.rmtree, subprocess) bypass the text deny —
+  # but the TASK-004 bridge maps `eval` -> `Bash`, so an opted-in `allow` is
+  # still gated by the same block-dangerous chain as a bash command.
   approvalMode: yolo
   approval:
     bash: allow
-    eval: allow
+    eval: "{{omp.evalApproval}}"
     task: allow
     read: allow
     grep: allow
@@ -61,8 +64,9 @@ bash:
   # allow is NOT a universal escape hatch: any compound command (`&&`, `;`, `|`) not itself caught
   # by a `deny`/`prompt` entry falls through to `tools.approvalMode` instead of being auto-allowed.
   # `bash.patterns` does not cover the `eval` tool at all — that is why TASK-004's bridge
-  # separately maps `eval` -> `Bash`, and why `tools.approval.eval: allow` above does NOT
-  # weaken eval safety: eval stays gated by the bridge's Bash chain (TASK-001).
+  # separately maps `eval` -> `Bash`, and why an opted-in `tools.approval.eval: allow`
+  # (orchestration.allowUnsafeEval) does NOT weaken eval safety: eval stays gated by
+  # the bridge's Bash chain (TASK-001). Default render is `deny` (fail-closed).
   patterns:
     - match: "rm -rf /*"
       approval: deny
@@ -74,6 +78,8 @@ bash:
       approval: deny
     - match: "git push --force*"
       approval: deny
+    - match: "git push --force-with-lease*"
+      approval: deny
     - match: "git push -f *"
       approval: deny
     - match: "git reset --hard*"

package/templates/.ukit/storage/cache/hook-latency/unknown.jsonl

@@ -0,0 +1,4 @@
+{"v":1,"ts":1789910222307,"hook":"hook-chain-runner","elapsedMs":2,"outcome":"error","hookEvent":"PreToolUse","toolName":"Edit","toolUseId":null,"budgetMs":28000,"budgetExhausted":false,"scripts":[{"scriptName":"protect-files.sh","code":1,"killed":false,"failureKind":"error","elapsedMs":2}]}
+{"v":1,"ts":1789910232531,"hookEvent":"PreToolUse","toolName":"Edit","toolUseId":null,"hook":"protect-files.sh","elapsedMs":29,"outcome":"ok"}
+{"v":1,"ts":1789910232602,"hookEvent":"PreToolUse","toolName":"Edit","toolUseId":null,"hook":"skill-router.sh","elapsedMs":44,"outcome":"ok"}
+{"v":1,"ts":1789910232609,"hook":"hook-chain-runner","elapsedMs":580,"outcome":"ok","hookEvent":"PreToolUse","toolName":"Edit","toolUseId":null,"budgetMs":28000,"budgetExhausted":false,"scripts":[{"scriptName":"protect-files.sh","code":0,"killed":false,"failureKind":"ok","elapsedMs":510},{"scriptName":"skill-router.sh","code":0,"killed":false,"failureKind":"ok","elapsedMs":70}]}

package/templates/ukit/storage/config.json

@@ -89,6 +89,7 @@
     "orchestratorModel": "claude-sonnet-5",
     "advisorEnabled": true,
     "permissionMode": "unattended",
+    "allowUnsafeEval": false,
     "contracts": {
       "tiny-fix": {
         "maxReadPasses": 0,
@@ -550,6 +551,7 @@
       "orchestratorModel": "Model điều phối chất lượng cao để chọn execution layer. Đây là model quan trọng cho chất lượng completion, không nên dùng model quá yếu.",
       "advisorEnabled": "Cho phép UKit dùng advisor-style reasoning khi chọn layer trong tình huống mơ hồ.",
       "permissionMode": "Chế độ quyền của orchestration. Ba giá trị dành riêng: interactive, safe-auto, unattended. Chu kỳ này chỉ triển khai unattended.",
+      "allowUnsafeEval": "Mặc định false. Chỉ khi user tự bật true, .omp/config.yml mới render tools.approval.eval: allow; mọi trường hợp khác render deny (fail-closed, không bao giờ prompt). Residual risk: eval chạy payload subprocess (os.remove, shutil.rmtree) mà bash.patterns text deny không chặn được — chỉ dựa vào bridge eval->Bash của TASK-004.",
       "contracts": "Bộ contract cho 7 tầng điều phối: tiny-fix, local-fix, local-build, find-cause, shared-edit, map-impact, review-release. Khi mơ hồ, UKit nên lệch lên tầng an toàn hơn dù tốn token hơn."
     },
     "memory": {