@ngockhoale/ukit 3.0.0 → 3.0.2

package/{templates → template_project}/.claude/ukit/index/route-task.mjs

@@ -69,6 +69,29 @@ export const ROUTE_INTENT_KINDS = new Set(['informational', 'delivery', 'mutatio
 export const ROUTE_MUTABILITIES = new Set(['read-only', 'mutating', 'mixed']);
 export const ROUTE_RIGOR_LEVELS = new Set(['R0', 'R1', 'R2', 'R3', 'R4']);
 export const ROUTE_MODEL_TIERS = new Set(['lite', 'code', 'smart']);
+export const ROUTE_RISK_FLOORS = new Set(['none', 'high-risk']);
+export const ROUTE_EFFORTS = new Set(['low', 'medium', 'high']);
+// SPEC §5 FR-003: fixed table order — codes are emitted and printed in this order.
+// The first six raise the floor to 'high-risk'; the last two are informational only.
+export const ROUTE_RISK_REASON_CODES = Object.freeze([
+  'security-sensitive',
+  'shared-impact',
+  'public-contract',
+  'schema-change',
+  'destructive-action',
+  'cross-engine',
+  'established-precedent',
+  'explicit-local-target',
+]);
+const ROUTE_RISK_FLOOR_RAISING_CODES = new Set(ROUTE_RISK_REASON_CODES.slice(0, 6));
+const ROUTE_RISK_ENGINES = ['claude code', 'codex', 'omp'];
+
+// FR-004 (M01.3'): Fast Path eligibility vocabulary. The suppressed list is fixed
+// text per SPEC — deliberately not configurable. Reasons are the informational
+// risk codes (the last two ROUTE_RISK_REASON_CODES entries) present on the route.
+const FAST_PATH_MODES = new Set(['tiny-fix', 'local-fix']);
+const FAST_PATH_SUPPRESSED = Object.freeze(['design', 'smart', 'subagents', 'broad-verify']);
+const FAST_PATH_REASON_CODES = new Set(ROUTE_RISK_REASON_CODES.slice(6));
 // 'informational' is a real router emission (no completion contract) even though it is
 // not part of the seven-lane execution-mode ladder.
 export const ROUTE_EXECUTION_MODES = [
@@ -249,6 +272,162 @@ export function resolveRouteSchemaStage(config = null) {
   return ROUTE_SCHEMA_STAGES.has(stage) ? stage : 'off';
 }
 
+// FR-002: generic stage resolver — every routing.<key>.stage shares the same
+// absent/malformed → 'off' contract. resolveRouteSchemaStage stays as the
+// routeSchema-specific spelling of this helper.
+export function resolveRouteStage(config = null, key) {
+  const stage = config?.routing?.[key]?.stage;
+  return ROUTE_SCHEMA_STAGES.has(stage) ? stage : 'off';
+}
+
+// FR-003 (M01.2'): derive the additive riskFloor from hard signals. Codes are
+// collected in ROUTE_RISK_REASON_CODES table order; the floor is 'high-risk' iff
+// any of the first six (floor-raising) codes fired — informational codes never
+// raise it. Detectors read the normalized signal text (same source the mode
+// ladder uses) plus the raw target path and context preview.
+export function deriveRiskFloor({
+  promptText = '',
+  commandText = '',
+  targetFile = null,
+  executionMode = null,
+  activeSkillIds = [],
+  contextPreview = null,
+} = {}) {
+  const signalText = buildNormalizedRouteSignalText(promptText, commandText);
+  const target = String(targetFile || '');
+  const skillIds = Array.isArray(activeSkillIds) ? activeSkillIds : [];
+  const codes = [];
+  if (
+    /\b(auth|security|token|permission|secret|credential|password|vulnerab|exploit|xss|injection)\b/i.test(signalText)
+    || skillIds.includes('discover-security')
+  ) {
+    codes.push('security-sensitive');
+  }
+  if (isSharedImpactFile(targetFile) || executionMode === 'shared-edit' || executionMode === 'map-impact') {
+    codes.push('shared-impact');
+  }
+  if (
+    /(^|\/)(package\.json|manifests\/|.*\.d\.ts$|(^|\/)api\/|openapi|swagger)/i.test(target)
+    || /\b(public api|breaking change|api contract|semver)\b/i.test(signalText)
+  ) {
+    codes.push('public-contract');
+  }
+  if (
+    /(^|\/)(migrations?|db|database|prisma|schema)/i.test(target)
+    || /\b(migration|migrate|schema|alter table|add column|drop column)\b/i.test(signalText)
+  ) {
+    codes.push('schema-change');
+  }
+  if (/\b(delete|drop|truncate|destroy|wipe|uninstall|rm -rf|purge)\b/i.test(signalText)) {
+    codes.push('destructive-action');
+  }
+  const engineHits = ROUTE_RISK_ENGINES.filter(
+    (name) => new RegExp(`\\b${name}\\b`, 'i').test(signalText),
+  ).length;
+  if (
+    /\bcross[- ]engine\b|\ball engines\b/i.test(signalText)
+    || engineHits >= 2
+    || /^template_project\/\.(claude|codex|omp)\//i.test(target)
+  ) {
+    codes.push('cross-engine');
+  }
+  if ((contextPreview?.analogFiles?.length ?? 0) > 0 || (contextPreview?.styleFiles?.length ?? 0) > 0) {
+    codes.push('established-precedent');
+  }
+  if (target && !isSharedImpactFile(targetFile)) {
+    codes.push('explicit-local-target');
+  }
+  return {
+    floor: codes.some((code) => ROUTE_RISK_FLOOR_RAISING_CODES.has(code)) ? 'high-risk' : 'none',
+    codes,
+  };
+}
+
+// Route-line segment (FR-003): on 'high-risk' only the floor-raising codes print;
+// on 'none' the informational codes do. Empty list → no segment at all.
+function formatRiskFloorSegment(riskFloor = null) {
+  if (!riskFloor) {
+    return null;
+  }
+  const printed = riskFloor.floor === 'high-risk'
+    ? riskFloor.codes.filter((code) => ROUTE_RISK_FLOOR_RAISING_CODES.has(code))
+    : riskFloor.codes;
+  return printed.length > 0 ? `risk=${riskFloor.floor}(${printed.join(',')})` : null;
+}
+
+// FR-001 (M01.2' limits fragment): compile the contract's numeric budget keys
+// into an advisory map. Only finite numbers survive — a non-numeric or missing
+// key is simply absent. Zero is a real budget ("no read passes"), never
+// filtered. Same key set as the ceremonyBudget.limits builder below.
+export function deriveCeremonyLimits(executionContract = null) {
+  if (executionContract === null || typeof executionContract !== 'object') {
+    return {};
+  }
+  return Object.fromEntries(
+    ['maxReadPasses', 'maxContextPulls', 'maxReadPassesBeforeReassess']
+      .filter((key) => Number.isFinite(executionContract[key]))
+      .map((key) => [key, executionContract[key]]),
+  );
+}
+
+// Route-line segment (FR-002): fixed reads,ctx,reassess order; only present
+// keys print. Empty/absent map → null so the segment never appears.
+export function formatLimitsSegment(limits = null) {
+  if (limits === null || typeof limits !== 'object') {
+    return null;
+  }
+  const parts = [
+    ['reads', 'maxReadPasses'],
+    ['ctx', 'maxContextPulls'],
+    ['reassess', 'maxReadPassesBeforeReassess'],
+  ]
+    .filter(([, key]) => Number.isFinite(limits[key]))
+    .map(([label, key]) => `${label}:${limits[key]}`);
+  return parts.length > 0 ? `limits=${parts.join(',')}` : null;
+}
+
+// FR-004 (M01.3'): Fast Path eligibility predicate. Returns null when no riskFloor
+// was supplied — eligibility must never be derived without the floor check, so a
+// missing floor means "not computed", not "none". Eligible iff the lane is
+// tiny-fix/local-fix, exactly one local target is known, the floor is 'none',
+// a bounded verification path exists (targeted commands or the tiny-fix
+// 'minimal-or-targeted' contract policy), and the target is not shared-impact.
+export function deriveFastPath({
+  executionMode = null,
+  targetFile = null,
+  riskFloor = null,
+  verificationRecommendation = null,
+  contextPreview = null,
+} = {}) {
+  if (!riskFloor) {
+    return null;
+  }
+  const reasons = (riskFloor.codes ?? []).filter((code) => FAST_PATH_REASON_CODES.has(code));
+  const hasLocalTarget = Boolean(targetFile) || contextPreview?.primaryTargets?.length === 1;
+  const hasBoundedVerification = (verificationRecommendation?.commands?.length ?? 0) > 0
+    || buildExecutionContract(executionMode)?.verificationPolicy === 'minimal-or-targeted';
+  const eligible = FAST_PATH_MODES.has(executionMode)
+    && hasLocalTarget
+    && riskFloor.floor === 'none'
+    && hasBoundedVerification
+    && !isSharedImpactFile(targetFile);
+  return {
+    eligible,
+    suppressed: eligible ? [...FAST_PATH_SUPPRESSED] : [],
+    reasons,
+  };
+}
+
+// Route-line segment (FR-004): emitted only for eligible routes — ineligible
+// routes keep the routeSummary.fastPath field for telemetry but stay silent.
+function formatFastPathSegment(fastPath = null) {
+  if (!fastPath?.eligible) {
+    return null;
+  }
+  const reasons = fastPath.reasons?.length ? ` (${fastPath.reasons.join(',')})` : '';
+  return `fastPath=on | suppress: ${FAST_PATH_SUPPRESSED.join(',')}${reasons}`;
+}
+
 // A bare delivery command ("push this to git", "đẩy bộ này lên git") performs no
 // repository mutation the ledger could ever receipt. With no edit/review/debug/build
 // signal present, routing it to an investigation lane fabricates write debt and the
@@ -311,7 +490,12 @@ function buildResolvedRouteFields({
   executionMode = null,
   executionContract = null,
   completionState = null,
+  riskFloor = null,
 } = {}) {
+  // Decision table v2 (FR-001/FR-002): tier + effort resolve together from the
+  // contract lane and the additive riskFloor. The router cannot observe host
+  // binding capabilities, so the emitted pair is advisory text by definition.
+  const tierDecision = resolveModelTier({ executionMode, riskFloor });
   const signalText = buildNormalizedRouteSignalText(routingContext.promptText, routingContext.commandText);
   const deliveryOnly = isDeliveryOnlyRequest({
     signalText,
@@ -333,13 +517,15 @@ function buildResolvedRouteFields({
     execution: {
       mode: executionMode,
       rigor: null,
+      riskFloor: riskFloor?.floor ?? null,
       phase: null,
       contractVersion: ROUTE_CONTRACT_VERSION,
-      modelTier: executionContract?.modelTier ?? null,
+      modelTier: tierDecision.tier,
+      effort: tierDecision.effort,
     },
     evidence: {
       observations: [],
-      riskSignals: [],
+      riskSignals: riskFloor?.codes ?? [],
       activationReasons: [],
       suppressionReasons: [],
       completionRequirements: unique(completionState?.missingEvidence ?? []),
@@ -347,7 +533,13 @@ function buildResolvedRouteFields({
     ceremonyBudget: {
       policyVersion: ROUTE_CONTRACT_VERSION,
       rigor: null,
-      limits: {},
+      limits: riskFloor
+        ? Object.fromEntries(
+            ['maxReadPasses', 'maxContextPulls', 'maxReadPassesBeforeReassess']
+              .filter((key) => typeof executionContract?.[key] === 'number')
+              .map((key) => [key, executionContract[key]]),
+          )
+        : {},
       consumed: {},
       exceptions: [],
     },
@@ -403,12 +595,19 @@ export function validateResolvedRoute(route = null) {
     if (route.execution.rigor !== null && !ROUTE_RIGOR_LEVELS.has(route.execution.rigor)) {
       errors.push(`execution.rigor must be null or one of: ${[...ROUTE_RIGOR_LEVELS].join(', ')}.`);
     }
+    if (route.execution.riskFloor !== null && !ROUTE_RISK_FLOORS.has(route.execution.riskFloor)) {
+      errors.push(`execution.riskFloor must be null or one of: ${[...ROUTE_RISK_FLOORS].join(', ')}.`);
+    }
     if (route.execution.contractVersion !== ROUTE_CONTRACT_VERSION) {
       errors.push(`execution.contractVersion must be ${ROUTE_CONTRACT_VERSION}.`);
     }
     if (route.execution.modelTier !== null && !ROUTE_MODEL_TIERS.has(route.execution.modelTier)) {
       errors.push(`execution.modelTier must be null or one of: ${[...ROUTE_MODEL_TIERS].join(', ')}.`);
     }
+    if (route.execution.effort !== null && route.execution.effort !== undefined
+      && !ROUTE_EFFORTS.has(route.execution.effort)) {
+      errors.push(`execution.effort must be null or one of: ${[...ROUTE_EFFORTS].join(', ')}.`);
+    }
   }
   if (!isObject(route.evidence)) {
     errors.push('evidence must be an object.');
@@ -418,6 +617,12 @@ export function validateResolvedRoute(route = null) {
         errors.push(`evidence.${key} must be an array.`);
       }
     }
+    if (Array.isArray(route.evidence.riskSignals)
+      && route.evidence.riskSignals.some(
+        (code) => typeof code !== 'string' || !ROUTE_RISK_REASON_CODES.includes(code),
+      )) {
+      errors.push(`evidence.riskSignals entries must be one of: ${ROUTE_RISK_REASON_CODES.join(', ')}.`);
+    }
   }
   if (!isObject(route.ceremonyBudget)) {
     errors.push('ceremonyBudget must be an object.');
@@ -1379,11 +1584,24 @@ async function main() {
         }
       : null;
     if (rescuedRouteSummary) {
+      // FR-005: the rescued summary IS the previous route state — merge its
+      // persisted riskEscalation with current evidence (monotonic, idempotent).
+      const riskEscalation = computeRiskEscalation({
+        routeSummary: rescuedRouteSummary,
+        previousRouteSummary: cachedRouteState.routeSummary,
+        config: escalationConfig,
+      });
+      if (riskEscalation) {
+        rescuedRouteSummary.riskEscalation = riskEscalation;
+      } else {
+        delete rescuedRouteSummary.riskEscalation;
+      }
       applyRescueBiasToRouteSummary(rescuedRouteSummary);
       applyEscalationToRouteSummary(rescuedRouteSummary, {
         config: escalationConfig,
         targetFile: cachedRouteState.routingContext?.targetFile ?? null,
       });
+      appendRiskEscalationSegment(rescuedRouteSummary);
     }
     const sharedState = {
       ...cachedRouteState,
@@ -1673,11 +1891,25 @@ async function finalizeTaskRoute({
     previousRouteSummary?.continuationState ?? null,
     resolveEscalationSettings(escalationConfig),
   );
+  // FR-005: merge risk evidence with the persisted previous riskEscalation AFTER
+  // advanceContinuationState (stuckRisk is already advanced). Stage 'off'
+  // returns null → the field is dropped, not carried forward.
+  const riskEscalation = computeRiskEscalation({
+    routeSummary,
+    previousRouteSummary,
+    config: escalationConfig,
+  });
+  if (riskEscalation) {
+    routeSummary.riskEscalation = riskEscalation;
+  } else {
+    delete routeSummary.riskEscalation;
+  }
   applyRescueBiasToRouteSummary(routeSummary);
   applyEscalationToRouteSummary(routeSummary, {
     config: escalationConfig,
     targetFile: routingContext.targetFile ?? null,
   });
+  appendRiskEscalationSegment(routeSummary);
   const approachSelector = routeSummary?.approachSelector ?? null;
 
   return {
@@ -2672,6 +2904,48 @@ function buildRouteSummary({
     nextActionType: nextAction?.type ?? null,
     completionState,
   });
+  // FR-003 (M01.2'): riskFloor is a top-level additive field emitted whenever ANY
+  // of rigor/fastPath/escalation stages is on — fastPath/escalation consumers read
+  // it even when routeSchema is off. All three off → absent, byte-identical route.
+  const riskStageOn = ['rigor', 'fastPath', 'escalation']
+    .some((key) => resolveRouteStage(runtimeConfig, key) !== 'off');
+  const riskFloor = riskStageOn
+    ? deriveRiskFloor({
+        promptText: routingContext.promptText,
+        commandText: routingContext.commandText,
+        targetFile: routingContext.targetFile ?? null,
+        executionMode,
+        activeSkillIds: activeSkills.map((entry) => entry.id),
+        contextPreview: contextRecommendation?.preview ?? null,
+      })
+    : null;
+  const riskSegment = formatRiskFloorSegment(riskFloor);
+  // FR-003 (M01.2' limits fragment): the rigor advisory — emitted whenever
+  // rigor.stage is on, independent of fastPath/escalation. Stage off → no
+  // segment, byte-identical route.
+  const limitsSegment = resolveRouteStage(runtimeConfig, 'rigor') !== 'off'
+    ? formatLimitsSegment(deriveCeremonyLimits(executionContract))
+    : null;
+  // FR-004 (M01.3'): fastPath is emitted whenever its own stage is on — the field
+  // is always set then (eligible or not) so telemetry/harness can read it; the
+  // route-line segment prints only for eligible routes.
+  const fastPathStage = resolveRouteStage(runtimeConfig, 'fastPath');
+  const fastPath = fastPathStage !== 'off'
+    ? {
+        eligible: false,
+        suppressed: [],
+        reasons: [],
+        ...deriveFastPath({
+          executionMode,
+          targetFile: routingContext.targetFile ?? null,
+          riskFloor,
+          verificationRecommendation,
+          contextPreview: contextRecommendation?.preview ?? null,
+        }),
+        stage: fastPathStage,
+      }
+    : null;
+  const fastPathSegment = formatFastPathSegment(fastPath);
   const resolvedRouteFields = routeSchemaStage !== 'off'
     ? buildResolvedRouteFields({
         routingContext,
@@ -2679,6 +2953,7 @@ function buildRouteSummary({
         executionMode,
         executionContract,
         completionState,
+        riskFloor,
       })
     : null;
   const helperHint = compactHelperHint(
@@ -2722,6 +2997,9 @@ function buildRouteSummary({
     formatCompactSegment('tests', relatedTests),
     formatCompactSegment('styles', styleFiles),
     editGuardHint ? `editGuard=${editGuardHint}` : null,
+    riskSegment,
+    limitsSegment,
+    fastPathSegment,
     delegationRecommendation?.hint ? `delegate=${delegationRecommendation.hint}` : null,
     policyMode ? `policy=${policyMode}` : null,
     workflowPolicyName ? `workflow=${workflowPolicyName}` : null,
@@ -2742,6 +3020,10 @@ function buildRouteSummary({
     completionState,
     // M01.1 additive C01 groups — present only when routing.routeSchema.stage != "off".
     ...(resolvedRouteFields ?? {}),
+    // FR-003 additive top-level field — present only when a risk stage is on.
+    ...(riskFloor ? { riskFloor } : {}),
+    // FR-004 additive top-level field — present only when fastPath stage is on.
+    ...(fastPath ? { fastPath } : {}),
     continuationState,
     autonomyLevel,
     continuousExecution,
@@ -3208,6 +3490,45 @@ function buildExecutionContract(executionMode = null) {
   return contracts[executionMode] ? { ...contracts[executionMode] } : null;
 }
 
+// Decision table v2 (V3_RESHAPE §5): the contracts table's modelTier column is the
+// base row; resolveModelTier adds the (riskFloor, hostCapabilities) columns.
+// Deterministic — no registry, no leases, no outbound capability calls.
+// Literal mirror of src/core/executionContracts.js resolveModelTier; parity is
+// locked by tests/consistency/executionContractSync.test.js.
+const MODEL_TIER_ORDER = ['lite', 'code', 'smart'];
+const MODEL_TIER_EFFORT = {
+  lite: 'low',
+  code: 'medium',
+  smart: 'high',
+};
+
+/**
+ * Resolves {tier, effort, advisoryOnly} for a route. A 'high-risk' floor escalates
+ * the tier one band (lite→code→smart, capped at smart) and forces effort 'high'.
+ * Unknown mode → {tier:null, effort:null, advisoryOnly:true}. Missing/unknown
+ * riskFloor → 'none'. Missing hostCapabilities → advisoryOnly:true (the route text
+ * is all the host gets when it cannot bind model and effort).
+ */
+export function resolveModelTier({
+  executionMode = null,
+  riskFloor = null,
+  hostCapabilities = null,
+} = {}) {
+  const baseTier = buildExecutionContract(executionMode)?.modelTier ?? null;
+  if (!baseTier) {
+    return { tier: null, effort: null, advisoryOnly: true };
+  }
+  const highRisk = riskFloor?.floor === 'high-risk';
+  const tier = highRisk
+    ? MODEL_TIER_ORDER[Math.min(MODEL_TIER_ORDER.indexOf(baseTier) + 1, MODEL_TIER_ORDER.length - 1)]
+    : baseTier;
+  return {
+    tier,
+    effort: highRisk ? 'high' : MODEL_TIER_EFFORT[tier],
+    advisoryOnly: !(hostCapabilities?.canBindModel === true && hostCapabilities?.canBindEffort === true),
+  };
+}
+
 function buildApproachSelectorResult({
   executionMode = null,
   executionScores = null,
@@ -3403,18 +3724,24 @@ function resolveEscalationSettings(config = null) {
  * Escalates exactly one rung above `modelTier` on `tierOrder`, capped at `cap`. Returns null when
  * escalation is disabled, `repeatCount` hasn't reached `debugLoopThreshold`, or `modelTier` isn't
  * on the cost ladder (e.g. no contract selected). Never returns 'vision'.
+ * FR-005: when `riskEscalation.level === 'high'` the repeat-count threshold is treated as
+ * satisfied (immediate one-rung escalation) and the effective cap rises to 'smart', overriding
+ * the configured cap; the reason is prefixed `risk-floor:` so consumers can tell risk-driven
+ * escalation from repeat-count escalation.
  */
 function computeEscalation({
   modelTier = null,
   repeatCount = null,
   config = null,
   targetFile = null,
+  riskEscalation = null,
 } = {}) {
-  if (!modelTier || !Number.isFinite(repeatCount)) {
+  if (!modelTier) {
     return null;
   }
   const settings = resolveEscalationSettings(config);
-  if (!settings.enabled || repeatCount < settings.debugLoopThreshold) {
+  const riskDriven = riskEscalation?.level === 'high';
+  if (!settings.enabled || (!riskDriven && (!Number.isFinite(repeatCount) || repeatCount < settings.debugLoopThreshold))) {
     return null;
   }
   const currentIndex = settings.tierOrder.indexOf(modelTier);
@@ -3422,18 +3749,23 @@ function computeEscalation({
     return null;
   }
   const capIndex = settings.tierOrder.indexOf(settings.cap);
-  const effectiveCapIndex = capIndex === -1 ? settings.tierOrder.length - 1 : capIndex;
+  const smartIndex = settings.tierOrder.indexOf('smart');
+  const effectiveCapIndex = riskDriven
+    ? (smartIndex === -1 ? settings.tierOrder.length - 1 : smartIndex)
+    : (capIndex === -1 ? settings.tierOrder.length - 1 : capIndex);
   const escalatedIndex = Math.min(currentIndex + 1, effectiveCapIndex);
   const escalatedTier = settings.tierOrder[escalatedIndex];
 
   return {
     escalatedTier,
-    escalationReason: `repeat-count=${repeatCount} threshold=${settings.debugLoopThreshold} file=${targetFile ?? 'null'}`,
+    escalationReason: riskDriven
+      ? `risk-floor: level=${riskEscalation.level} sources=${(riskEscalation.sources ?? []).join(',')} file=${targetFile ?? 'null'}`
+      : `repeat-count=${repeatCount} threshold=${settings.debugLoopThreshold} file=${targetFile ?? 'null'}`,
   };
 }
 
 /** Attaches escalatedTier/escalationReason to routeSummary, additive alongside modelTier. */
-function applyEscalationToRouteSummary(routeSummary = null, { config = null, targetFile = null } = {}) {
+export function applyEscalationToRouteSummary(routeSummary = null, { config = null, targetFile = null } = {}) {
   if (!routeSummary || typeof routeSummary !== 'object') {
     return routeSummary;
   }
@@ -3443,6 +3775,7 @@ function applyEscalationToRouteSummary(routeSummary = null, { config = null, tar
     repeatCount: routeSummary.continuationState?.repeatCount ?? null,
     config,
     targetFile,
+    riskEscalation: routeSummary.riskEscalation ?? null,
   });
 
   if (escalation) {
@@ -3462,6 +3795,65 @@ function applyEscalationToRouteSummary(routeSummary = null, { config = null, tar
   return routeSummary;
 }
 
+// FR-005 (M01.4'): monotonic risk-evidence escalation. Sources are `risk-floor`
+// (routeSummary.riskFloor.floor === 'high-risk') and `stuck-risk`
+// (routeSummary.continuationState.stuckRisk === 'high' — read off the CURRENT
+// summary, which finalizeTaskRoute has already advanced). Sources merge as the
+// sorted union of current evidence and the persisted previous
+// riskEscalation.sources, so replaying the same evidence is a no-op and the
+// level can never decrease within a run (none < elevated < high). Stage 'off'
+// returns null unconditionally — a mid-run stage flip drops the field entirely
+// so the Stop gate sees nothing and the stage-off byte-identity contract holds.
+// Per-source flags: routing.escalation.sources.<source>: false disables that
+// source's current detection (absent = all sources on).
+const RISK_ESCALATION_LEVELS = { none: 0, elevated: 1, high: 2 };
+
+export function computeRiskEscalation({
+  routeSummary = null,
+  previousRouteSummary = null,
+  config = null,
+} = {}) {
+  const stage = resolveRouteStage(config, 'escalation');
+  if (stage === 'off') {
+    return null;
+  }
+  const sourceFlags = config?.routing?.escalation?.sources ?? {};
+  const isSourceEnabled = (source) => sourceFlags[source] !== false;
+  const currentSources = [];
+  if (isSourceEnabled('risk-floor') && routeSummary?.riskFloor?.floor === 'high-risk') {
+    currentSources.push('risk-floor');
+  }
+  if (isSourceEnabled('stuck-risk') && routeSummary?.continuationState?.stuckRisk === 'high') {
+    currentSources.push('stuck-risk');
+  }
+  const previous = previousRouteSummary?.riskEscalation ?? null;
+  const sources = unique([...(previous?.sources ?? []), ...currentSources]).sort();
+  const derivedLevel = sources.some((source) => source === 'risk-floor' || source === 'stuck-risk')
+    ? 'high'
+    : (sources.length > 0 ? 'elevated' : 'none');
+  const previousLevel = RISK_ESCALATION_LEVELS[previous?.level] ?? 0;
+  const level = RISK_ESCALATION_LEVELS[derivedLevel] >= previousLevel
+    ? derivedLevel
+    : previous.level;
+  return { level, sources, stage };
+}
+
+// FR-005: buildRouteSummary runs before riskEscalation exists, so the
+// `escalate=<level>(<sources>)` segment is appended here, where the merge
+// happens. Any previously emitted segment is stripped first — replay on a
+// rescued compacted summary must not double-append (idempotent).
+function appendRiskEscalationSegment(routeSummary = null) {
+  if (!routeSummary || typeof routeSummary.line !== 'string') {
+    return routeSummary;
+  }
+  const baseLine = routeSummary.line.replace(/(?: \| )?escalate=\S+$/, '');
+  const riskEscalation = routeSummary.riskEscalation;
+  routeSummary.line = riskEscalation && riskEscalation.level !== 'none'
+    ? `${baseLine} | escalate=${riskEscalation.level}(${(riskEscalation.sources ?? []).join(',')})`
+    : baseLine;
+  return routeSummary;
+}
+
 // WS-E tier-role wiring: a contract tier only takes effect when the executing session hands
 // the work to an agent whose definition binds that tier — otherwise every session behaves as
 // if it only had one model. `code` is the DEFAULT implementation lane, so a code-tier contract
@@ -3690,10 +4082,10 @@ const SHARED_IMPACT_PATTERNS = [
   /^src\/index\//,
   /^src\/core\/(runInstallPipeline|applyPlan|buildPlan|diffPlan|metadata|migrateLegacy|uninstall|runtimeConfig|runtimePaths)\.js$/,
   /^src\/core\/(output|token|compact)\//,
-  /^templates\/\.claude\/hooks\//,
-  /^templates\/\.claude\/ukit\//,
+  /^template_project\/\.claude\/hooks\//,
+  /^template_project\/\.claude\/ukit\//,
   /^manifests\/platform\.full\.yaml$/,
-  /^templates\//,
+  /^template_project\//,
 ];
 
 function isSharedImpactFile(filePath) {
@@ -4179,7 +4571,7 @@ function compactRecentOutput(recentOutput = null) {
   };
 }
 
-function compactRouteSummary(routeSummary = null) {
+export function compactRouteSummary(routeSummary = null) {
   if (!routeSummary) {
     return null;
   }
@@ -4221,6 +4613,10 @@ function compactRouteSummary(routeSummary = null) {
       escalatedTier: routeSummary.escalatedTier,
       escalationReason: routeSummary.escalationReason ?? null,
     } : {}),
+    // FR-005: riskEscalation is the Stop-gate carrier (FR-006) — it must survive
+    // skill-router-state.json compaction. Conditional spread keeps stage-off
+    // output byte-identical (no key emitted when the field is absent).
+    ...(routeSummary.riskEscalation ? { riskEscalation: routeSummary.riskEscalation } : {}),
     // M01.1 compact whitelist (C01): grouped fields survive compaction minus verbose
     // evidence; absent entirely when the route schema stage is off.
     ...(compactResolvedRoute(routeSummary) ?? {}),

package/{templates → template_project}/.claude/ukit/index/unic-gateway.mjs

@@ -35,7 +35,7 @@
  * Fail-safe direction (do not re-flip this): `unicMode` keeps BINARY semantics on every runtime
  * — `unicMode = sources.length > 0`, default `false`. Inconclusive detection never resolves to
  * `true`. The "assume UNIC when ambiguous" fail-safe some tools want belongs ONLY to the static
- * `modelRoles` values TASK-003 writes unconditionally into `templates/.omp/config.yml`
+ * `modelRoles` values TASK-003 writes unconditionally into `template_project/.omp/config.yml`
  * (`@vision: unic-vision`, no probe involved) — never to this module's boolean, because this
  * module is shared by every runtime and flipping its default would make Codex/Kilo/OPENAI_BASE_URL
  * sessions with zero omp/Claude signal start false-positively reporting UNIC mode.

package/{templates → template_project}/.claude/ukit/runtime/execution-ledger.mjs

@@ -1588,7 +1588,7 @@ export async function recordExecutionReceipt({
 }
 
 // F-15: mirror of isExplicitBroadVerificationRequest in
-// templates/.claude/hooks/verification-guard.sh — the guard uses this prompt signal to
+// template_project/.claude/hooks/verification-guard.sh — the guard uses this prompt signal to
 // let a broad suite run under a targeted policy, so the completion gate must honor the
 // same signal when it classifies the resulting broad receipt. Keep both lists in sync.
 function isExplicitBroadVerificationRequest(promptText) {
@@ -1628,10 +1628,19 @@ function explicitBroadVerificationRequested(state = {}) {
 function requiredEvidence(state = {}) {
   const routeSummary = state?.routeSummary || {};
   const contractEvidence = routeSummary.executionContract?.completionEvidence;
-  if (Array.isArray(contractEvidence) && contractEvidence.length > 0) {
-    return [...new Set(contractEvidence)];
-  }
-  return [...new Set(routeSummary.completionState?.missingEvidence || [])];
+  const required = Array.isArray(contractEvidence) && contractEvidence.length > 0
+    ? [...contractEvidence]
+    : [...(routeSummary.completionState?.missingEvidence || [])];
+  // FR-006 (M01.4' tail): a route persisted with a high riskEscalation must re-verify at
+  // Stop even when its own contract only demands write evidence. The route state is the
+  // carrier — no config read here; absent/malformed/non-high fields are a no-op.
+  // C48 FR-004: a record stamped `stage: 'shadow'` is advisory-only and does not demand
+  // verification-evidence; a missing or malformed stage fails closed (enforcing) so
+  // pre-C48 persisted records keep re-verifying until re-stamped.
+  if (routeSummary.riskEscalation?.level === 'high' && routeSummary.riskEscalation?.stage !== 'shadow') {
+    required.push('verification-evidence');
+  }
+  return [...new Set(required)];
 }
 
 function evidenceSatisfied(evidence, ledger = {}, state = {}, { cwd } = {}) {

package/{templates → template_project}/.claude/ukit/runtime/safe-patch-core.mjs

@@ -27,15 +27,15 @@ const SHARED_RISK_PATTERNS = [
   /^\.claude\/hooks\//,
   /^\.claude\/ukit\//,
   /^\.codex\//,
-  /^templates\/\.claude\/hooks\//,
-  /^templates\/\.claude\/ukit\//,
+  /^template_project\/\.claude\/hooks\//,
+  /^template_project\/\.claude\/ukit\//,
   /^src\/index\//,
   /^src\/core\/(runInstallPipeline|applyPlan|buildPlan|diffPlan|metadata|migrateLegacy|uninstall|runtimeConfig|runtimePaths)\.js$/,
   /^src\/core\/(output|token|compact)\//,
   /^manifests\/platform\.full\.yaml$/,
   // Intentional for UKit development: template edits become installed runtime behavior after `ukit install`,
   // so templates stay in the strict shared-risk lane rather than being treated as ordinary docs/assets.
-  /^templates\//,
+  /^template_project\//,
   /^scripts\//,
   /(^|\/)(AGENTS|CLAUDE)\.md$/,
 ];

package/{templates → template_project}/.claude/ukit/runtime/sensitive-value-scanner.mjs

@@ -3,7 +3,7 @@
  *
  * Installed-runtime mirror of src/core/sensitiveValueScanner.js — the
  * high-confidence secret *value* scanner shared with
- * templates/.claude/hooks/sensitive-data-guard.sh. Deliberate mirror: the
+ * template_project/.claude/hooks/sensitive-data-guard.sh. Deliberate mirror: the
  * installed runtime cannot import package source, so this file is kept
  * byte-semantic with the source module and locked by
  * tests/consistency/projectImportantRuntimeParity.test.js.