@ngockhoale/ukit 3.4.0 → 3.4.2

package/template_project/.claude/ukit/index/reset-auto-permissions.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 
 function parseArgs(argv) {
   return {
@@ -9,17 +10,112 @@ function parseArgs(argv) {
   };
 }
 
+// W3-03 fail-closed read: a state file that exists but will not parse must
+// abort the reset — the previous `{}` fallback let a corrupt/JSONC
+// settings.local.json be rewritten as an empty object, wiping the whole allow
+// list. Missing files still map to `fallback` (a fresh project is fine).
 async function readJson(filePath, fallback) {
+  try {
+    await fs.access(filePath);
+  } catch {
+    return { value: fallback, corrupt: false };
+  }
   try {
     const raw = await fs.readFile(filePath, 'utf8');
-    return JSON.parse(raw);
+    return { value: JSON.parse(raw), corrupt: false };
   } catch {
-    return fallback;
+    return { value: null, corrupt: true };
+  }
+}
+
+// Same atomic shape as the auto-allow hook's writeJsonAtomic: tmp + rename so
+// readers (Claude Code re-parses settings.local.json to grant permissions)
+// see old-or-new, never a torn file.
+async function writeJsonAtomic(filePath, value) {
+  await fs.mkdir(path.dirname(filePath), { recursive: true });
+  const tempPath = `${filePath}.tmp-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  try {
+    await fs.writeFile(tempPath, JSON.stringify(value, null, 2) + '\n');
+    await fs.rename(tempPath, filePath);
+  } catch (error) {
+    try {
+      await fs.rm(tempPath, { force: true });
+    } catch {}
+    throw error;
   }
 }
 
-async function writeJson(filePath, value) {
-  await fs.writeFile(filePath, JSON.stringify(value, null, 2) + '\n', 'utf8');
+function runtimeDirForScript() {
+  return path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'runtime');
+}
+
+// The whole mutation runs inside the shared async lock — the same
+// `permission-usage.json` lock the auto-allow/auto-prune hooks take, so this
+// CLI serializes against them instead of racing their writes. Returns null on
+// a clean no-op, throws on fail-closed conditions.
+async function applyReset({ settingsLocalPath, usagePath, auditPath }) {
+  const lockModulePath = path.join(runtimeDirForScript(), 'async-lock.mjs');
+  let lockModule = null;
+  try {
+    lockModule = await import(pathToFileURL(lockModulePath).href);
+  } catch {
+    lockModule = null;
+  }
+  if (!lockModule || typeof lockModule.withAsyncLock !== 'function') {
+    throw new Error(
+      'async-lock.mjs is unavailable — refusing to write permission state unlocked (degraded install)',
+    );
+  }
+
+  // The lock dir lives beside the usage file; its parent must exist before
+  // mkdir can acquire (same preflight the hooks do).
+  await fs.mkdir(path.dirname(usagePath), { recursive: true });
+
+  const outcome = await lockModule.withAsyncLock(usagePath, {}, async () => {
+    // Re-read BOTH state files inside the critical section — a racing
+    // auto-allow write may have landed between the preflight read and lock
+    // acquisition, and deciding on the stale snapshot would drop its rule.
+    const settingsState = await readJson(settingsLocalPath, {});
+    if (settingsState.corrupt) {
+      throw new Error(`settings.local.json exists but is not valid JSON (${settingsLocalPath}) — refusing to overwrite it`);
+    }
+    const usageState = await readJson(usagePath, {});
+    if (usageState.corrupt) {
+      throw new Error(`permission-usage.json exists but is not valid JSON (${usagePath}) — refusing to guess managed rules`);
+    }
+    const settings = settingsState.value && typeof settingsState.value === 'object' ? settingsState.value : {};
+    const usage = usageState.value && typeof usageState.value === 'object' ? usageState.value : {};
+
+    const managedRules = Object.keys(usage.managedRules || {});
+    if (managedRules.length === 0) return null;
+
+    const allow = Array.isArray(settings?.permissions?.allow) ? settings.permissions.allow : [];
+    const removedRules = allow.filter((rule) => managedRules.includes(rule));
+
+    settings.permissions = settings.permissions && typeof settings.permissions === 'object' ? settings.permissions : {};
+    settings.permissions.allow = allow.filter((rule) => !managedRules.includes(rule));
+    await fs.mkdir(path.dirname(settingsLocalPath), { recursive: true });
+    await writeJsonAtomic(settingsLocalPath, settings);
+
+    usage.managedRules = {};
+    usage.lastResetAt = new Date().toISOString();
+    await writeJsonAtomic(usagePath, usage);
+
+    const lines = removedRules
+      .map((rule) => JSON.stringify({ ts: new Date().toISOString(), event: 'manual_reset', rule }))
+      .join('\n');
+    await fs.mkdir(path.dirname(auditPath), { recursive: true });
+    await fs.appendFile(auditPath, lines + '\n', 'utf8');
+
+    return { managedRules, removedRules };
+  });
+
+  if (!outcome.ok) {
+    // Fail closed (TASK-028 policy): a contended lock means a hook write is in
+    // flight — never write permission state unlocked. Nothing was mutated.
+    throw new Error(`could not acquire the permission-state lock (${outcome.reason}) — reset aborted, nothing was changed`);
+  }
+  return outcome.value;
 }
 
 async function main() {
@@ -29,12 +125,22 @@ async function main() {
   const usagePath = path.join(rootDir, '.claude', 'ukit', 'permission-usage.json');
   const auditPath = path.join(rootDir, '.claude', 'ukit', 'permission-audit.log');
 
-  const settings = await readJson(settingsLocalPath, {});
-  const usage = await readJson(usagePath, {});
+  // Preflight reads (reporting only): a corrupt state file aborts before the
+  // reset is even attempted — in --dry-run too, so the report never describes
+  // state that is not really there.
+  const settingsState = await readJson(settingsLocalPath, {});
+  if (settingsState.corrupt) {
+    throw new Error(`settings.local.json exists but is not valid JSON (${settingsLocalPath}) — refusing to overwrite it`);
+  }
+  const usageState = await readJson(usagePath, {});
+  if (usageState.corrupt) {
+    throw new Error(`permission-usage.json exists but is not valid JSON (${usagePath}) — refusing to guess managed rules`);
+  }
+  const settings = settingsState.value && typeof settingsState.value === 'object' ? settingsState.value : {};
+  const usage = usageState.value && typeof usageState.value === 'object' ? usageState.value : {};
 
-  const managedRules = Object.keys(usage?.managedRules || {});
+  const managedRules = Object.keys(usage.managedRules || {});
   const allow = Array.isArray(settings?.permissions?.allow) ? settings.permissions.allow : [];
-
   const removedRules = allow.filter((rule) => managedRules.includes(rule));
   if (managedRules.length === 0) {
     if (!quiet) {
@@ -43,28 +149,24 @@ async function main() {
     return;
   }
 
+  let resetResult = { managedRules, removedRules };
   if (!dryRun) {
-    settings.permissions = settings.permissions && typeof settings.permissions === 'object' ? settings.permissions : {};
-    settings.permissions.allow = allow.filter((rule) => !managedRules.includes(rule));
-    await fs.mkdir(path.dirname(settingsLocalPath), { recursive: true });
-    await writeJson(settingsLocalPath, settings);
-
-    usage.managedRules = {};
-    usage.lastResetAt = new Date().toISOString();
-    await fs.mkdir(path.dirname(usagePath), { recursive: true });
-    await writeJson(usagePath, usage);
-
-    const lines = removedRules
-      .map((rule) => JSON.stringify({ ts: new Date().toISOString(), event: 'manual_reset', rule }))
-      .join('\n');
-    await fs.mkdir(path.dirname(auditPath), { recursive: true });
-    await fs.appendFile(auditPath, lines + '\n', 'utf8');
+    const applied = await applyReset({ settingsLocalPath, usagePath, auditPath });
+    if (applied === null) {
+      // A serialized writer cleared managedRules between preflight and lock
+      // acquisition — nothing left to do, and that is a clean no-op.
+      if (!quiet) {
+        console.log('[UKit] No managed auto-permission rules to reset.');
+      }
+      return;
+    }
+    resetResult = applied;
   }
 
   if (!quiet) {
     const mode = dryRun ? 'Would remove' : 'Removed';
-    console.log(`[UKit] ${mode} ${managedRules.length} managed auto-permission rule(s).`);
-    for (const rule of removedRules) {
+    console.log(`[UKit] ${mode} ${resetResult.managedRules.length} managed auto-permission rule(s).`);
+    for (const rule of resetResult.removedRules) {
       console.log(`- ${rule}`);
     }
   }

package/template_project/.claude/ukit/index/review-panel-aggregate.mjs

@@ -11,7 +11,8 @@
 // Usage:
 //   node .claude/ukit/index/review-panel-aggregate.mjs <TASK-xxx.md> [TASK-xxx.md...]
 //
-// Reads every `## Reviewer Verdict` block from the given task files, then prints:
+// Reads the latest review round's `## Reviewer Verdict` blocks from the given
+// task files (re-review appends ` (round N)`; superseded rounds don't vote), then prints:
 //   AGREEMENT_MAP: finding → member, member   (one line per finding)
 //   HIGH_SIGNAL:   finding → member, member   (≥2 members or any critical)
 //   UNPARSED:      <file>#verdict[<i>]         (blocks with no VERDICT line)
@@ -41,17 +42,31 @@ export function parseVerdictBlock(text) {
     const rest = src.slice(findingsMatch.index + findingsMatch[0].length);
     let severity = null;
     for (const line of rest.split('\n')) {
-      if (/^\S/.test(line)) break; // next top-level field ends FINDINGS
-      const sev = line.match(/^\s{2}(critical|important|minor)\s*:/);
+      if (line.trim() === '') continue;
+      // Non-canonical layouts are tolerated: severity headers may carry any
+      // indentation or capitalization, and inline text after the colon
+      // (e.g. `Critical: auth bypass`) still counts as a finding.
+      const sev = line.match(/^\s*(critical|important|minor)\s*:\s*(.*)$/i);
       if (sev) {
-        severity = sev[1];
+        severity = sev[1].toLowerCase();
+        const inline = sev[2].trim();
+        // Placeholders — `none`, `(none)`, `-`, `(none — reason)` — are not
+        // findings; `critical: (none)` must not fabricate a critical.
+        const lc = inline.toLowerCase();
+        if (inline !== '' && lc !== '-' && lc !== 'none' && !lc.startsWith('(none')) {
+          findings[severity].push(inline);
+        }
         continue;
       }
-      const item = line.match(/^\s{4}-\s+(.+?)\s*$/);
+      const item = line.match(/^\s*[-*]\s+(.+?)\s*$/);
       if (item && severity) {
-        const text2 = item[1];
-        if (text2 !== 'none' && text2 !== '-') findings[severity].push(text2);
+        // Same placeholder set for bullets — `- (none)` under `critical:` must
+        // not fabricate a critical.
+        const text2 = item[1].toLowerCase();
+        if (text2 !== 'none' && text2 !== '-' && !text2.startsWith('(none')) findings[severity].push(item[1]);
+        continue;
       }
+      if (/^\S/.test(line)) break; // next top-level field ends FINDINGS
     }
   }
 
@@ -106,7 +121,7 @@ export function aggregatePanelVerdicts(verdicts) {
     parsed.some((p) => p.verdict === 'CRITICAL') || parsed.some((p) => p.findings.critical.length > 0);
 
   let verdict;
-  if (hasCritical || changeRequests >= 2) verdict = 'changes_requested';
+  if (hasCritical || changeRequests >= 1 || parsed.length === 0) verdict = 'changes_requested';
   else if (approvals >= 2) verdict = 'approved';
   else verdict = 'approved_minor';
 
@@ -115,19 +130,26 @@ export function aggregatePanelVerdicts(verdicts) {
 
 // CLI-only helpers below (not part of the canonical module).
 
-// Extract every `## Reviewer Verdict` block from a task file. A block runs from
-// its heading to the next `## ` heading or EOF.
+// Extract the latest review round's `## Reviewer Verdict` blocks from a task
+// file. A block runs from its heading to the next `## ` heading or EOF.
+// Re-reviews after a fix round append `## Reviewer Verdict (round N)`; a bare
+// heading is round 1, or inherits the highest explicit round seen so far — a
+// trailing bare heading is never silently dropped (fail closed). Verdicts from
+// superseded rounds do not vote.
 function extractVerdictBlocks(markdown) {
-  const blocks = [];
-  const re = /^##\s+Reviewer Verdict\s*$/gm;
+  const entries = [];
+  const re = /^##\s+Reviewer Verdict(?:\s*\(\s*[rR]ound\s+(\d+)\s*\))?\s*$/gm;
   let m;
+  let latest = 1;
   while ((m = re.exec(markdown)) !== null) {
     const start = m.index;
     const rest = markdown.slice(start + m[0].length);
     const next = rest.search(/^##\s+/m);
-    blocks.push(next === -1 ? rest : rest.slice(0, next));
+    const round = m[1] ? Number(m[1]) : latest;
+    if (round > latest) latest = round;
+    entries.push({ round, block: next === -1 ? rest : rest.slice(0, next) });
   }
-  return blocks;
+  return entries.filter((e) => e.round === latest).map((e) => e.block);
 }
 
 function main() {

package/template_project/.claude/ukit/index/review-verdict.mjs

@@ -148,16 +148,20 @@ function stableBatchId(findings) {
 
 export function buildReviewVerdictBatch({ findings = [], mode = 'solo' } = {}) {
   const usedIds = new Set();
+  // Sanitize the FULL finding set — MAX_FINDINGS is a display/transport bound
+  // for the batch, not a verdict bound. The deterministic verdict and the
+  // truncation clamp both run on `fullFindings` (W3-RV1).
   const sanitized = (Array.isArray(findings) ? findings : [])
-    .slice(0, MAX_FINDINGS)
     .map((raw, index) => sanitizeFinding(raw, index, usedIds));
+  const batchFindings = sanitized.slice(0, MAX_FINDINGS);
+  const truncated = sanitized.length > batchFindings.length;
 
   const verdictDecisionKey = mode === 'panel'
     ? REVIEW_VERDICT_KEYS.panel
     : REVIEW_VERDICT_KEYS.solo;
 
   const counts = { critical: 0, important: 0, minor: 0, unknown: 0 };
-  for (const f of sanitized) counts[f.severity] += 1;
+  for (const f of batchFindings) counts[f.severity] += 1;
 
   const verdictQuestion = {
     decisionKey: verdictDecisionKey,
@@ -173,7 +177,7 @@ export function buildReviewVerdictBatch({ findings = [], mode = 'solo' } = {}) {
     hardConstraintRefs: ['verdict-vocabulary'],
   };
 
-  const bucketQuestions = sanitized.map((f) => ({
+  const bucketQuestions = batchFindings.map((f) => ({
     decisionKey: `${REVIEW_VERDICT_KEYS.bucket}#${f.id}`,
     schemaVersion: 1,
     family: 'review',
@@ -189,20 +193,28 @@ export function buildReviewVerdictBatch({ findings = [], mode = 'solo' } = {}) {
   const statePacket = {
     kind: 'review-verdict',
     mode: mode === 'panel' ? 'panel' : 'solo',
-    findingCount: sanitized.length,
+    findingCount: batchFindings.length,
     severityCounts: counts,
-    findings: sanitized,
+    findings: batchFindings,
   };
 
   const batch = {
     batchVersion: 1,
-    batchId: stableBatchId(sanitized),
+    batchId: stableBatchId(batchFindings),
     boundary: 'review-verdict',
     questions,
     statePacket,
   };
 
-  return { questions, statePacket, batch, findings: sanitized, verdictDecisionKey };
+  return {
+    questions,
+    statePacket,
+    batch,
+    findings: batchFindings,
+    fullFindings: sanitized,
+    truncated,
+    verdictDecisionKey,
+  };
 }
 
 // Deterministic fallback — the documented off-stage rule and the
@@ -264,6 +276,10 @@ export function parseVerdictAnswer(result, { findings = [] } = {}) {
         verdict = answer.value;
         verdictStatus = 'valid';
       } else {
+        // The pair stays consistent: an invalid answer for the verdict key
+        // clears any earlier valid verdict — never leave a stale APPROVED
+        // standing behind verdictStatus 'invalid' (W3-RV2).
+        verdict = null;
         verdictStatus = 'invalid';
       }
       continue;
@@ -361,12 +377,15 @@ function emitVerdict({ mode, stage, outcomeClass, verdict, verdictStatus,
   };
 }
 
-function deterministicResult({ mode, stage, outcomeClass, findings, batchId, fallbackCode }) {
+function deterministicResult({ mode, stage, outcomeClass, findings, batchId, fallbackCode, verdictOverride }) {
   return emitVerdict({
     mode,
     stage,
     outcomeClass,
-    verdict: deriveDeterministicVerdict(findings),
+    // `verdictOverride` carries the verdict computed on the FULL finding set
+    // when `findings` is the display-truncated list (W3-RV1); absent it, the
+    // deterministic rule is derived from `findings` directly.
+    verdict: verdictOverride ?? deriveDeterministicVerdict(findings),
     verdictStatus: 'deterministic',
     verdictSource: 'deterministic',
     buckets: findings.map((f) => ({
@@ -379,9 +398,27 @@ function deterministicResult({ mode, stage, outcomeClass, findings, batchId, fal
   });
 }
 
+const VERDICT_SEVERITY_RANK = {
+  APPROVED: 0,
+  'APPROVED-WITH-MINOR': 1,
+  'CHANGES-REQUESTED': 2,
+  CRITICAL: 3,
+};
+
 function foldBatchResult(result, built, mode, stage) {
   const folded = parseVerdictAnswer(result, { findings: built.findings });
   const modelVerdict = folded.verdict;
+  // W3-RV1: the batch may be display-truncated at MAX_FINDINGS — the model
+  // verdict was computed on `built.findings` only, so when truncation
+  // occurred it must never be weaker than the deterministic verdict over the
+  // full finding set (a critical the model never saw still blocks approval).
+  const fullVerdict = deriveDeterministicVerdict(
+    built.fullFindings ?? built.findings,
+  );
+  const clamped = built.truncated
+    && modelVerdict !== null
+    && (VERDICT_SEVERITY_RANK[fullVerdict] ?? 0)
+       > (VERDICT_SEVERITY_RANK[modelVerdict] ?? 0);
   // Parse-level classes (accepted/partial/invalid/abstained) pass through;
   // every transport/gateway class surfaces as 'unavailable' — the fallback
   // code carries the finer-grained reason for receipts.
@@ -391,16 +428,18 @@ function foldBatchResult(result, built, mode, stage) {
     mode,
     stage,
     outcomeClass,
-    verdict: modelVerdict ?? deriveDeterministicVerdict(built.findings),
+    verdict: clamped ? fullVerdict : (modelVerdict ?? fullVerdict),
     verdictStatus: modelVerdict === null
       ? `fallback:${folded.verdictStatus}`
-      : folded.verdictStatus,
-    verdictSource: modelVerdict === null ? 'deterministic' : 'model',
+      : (clamped ? 'clamp:truncated-findings' : folded.verdictStatus),
+    verdictSource: modelVerdict === null || clamped ? 'deterministic' : 'model',
     buckets: folded.buckets,
     batchId: built.batch.batchId,
-    fallbackCode: modelVerdict === null
-      ? (result?.fallbackCode ?? folded.status)
-      : null,
+    fallbackCode: clamped
+      ? 'truncated-findings'
+      : (modelVerdict === null
+          ? (result?.fallbackCode ?? folded.status)
+          : null),
   });
 }
 
@@ -420,9 +459,12 @@ export async function runReviewVerdict({ findings, mode = 'solo', config,
       mode: normalizedMode,
       stage,
       outcomeClass: 'skipped',
+      // The authoritative verdict runs on the FULL sanitized finding set —
+      // MAX_FINDINGS truncates the emitted/batch surface only (W3-RV1).
       findings: built.findings,
       batchId: built.batch.batchId,
       fallbackCode: 'stage-off',
+      verdictOverride: deriveDeterministicVerdict(built.fullFindings),
     });
   }
 
@@ -464,13 +506,37 @@ function readFlagValue(argv, flag) {
   return value && !value.startsWith('--') ? value : null;
 }
 
+// stdin is bounded (W3-UD6): findings input is a review artifact, never
+// megabytes — unbounded reads let a poisoned/miswired pipe pin the process.
+const MAX_STDIN_BYTES = 8 * 1024 * 1024;
+
 function readStdin() {
   return new Promise((resolve, reject) => {
     let data = '';
+    let bytes = 0;
+    let done = false;
+    const fail = (error) => {
+      if (done) return;
+      done = true;
+      process.stdin.destroy();
+      reject(error);
+    };
     process.stdin.setEncoding('utf8');
-    process.stdin.on('data', (chunk) => { data += chunk; });
-    process.stdin.on('end', () => resolve(data));
-    process.stdin.on('error', reject);
+    process.stdin.on('data', (chunk) => {
+      if (done) return;
+      data += chunk;
+      bytes += Buffer.byteLength(chunk, 'utf8');
+      if (bytes > MAX_STDIN_BYTES) {
+        fail(new Error(`stdin exceeds ${MAX_STDIN_BYTES} bytes`));
+      }
+    });
+    process.stdin.on('end', () => {
+      if (!done) {
+        done = true;
+        resolve(data);
+      }
+    });
+    process.stdin.on('error', fail);
   });
 }
 
@@ -529,7 +595,15 @@ async function main() {
       return 1;
     }
   } else {
-    raw = await readStdin();
+    try {
+      raw = await readStdin();
+    } catch (error) {
+      // Bound/read failures degrade to the same conservative fallback as
+      // malformed JSON — never a crash, never APPROVED.
+      process.stderr.write(`review-verdict: ${error?.message ?? error}; emitting fallback verdict\n`);
+      printResult(invalidInputResult(mode, 'stdin-unusable'));
+      return 0;
+    }
   }
 
   let parsed;

package/template_project/.claude/ukit/index/route-resolver.mjs

@@ -456,7 +456,7 @@ export function deriveRiskFloor({
     codes.push('shared-impact');
   }
   if (
-    /(^|\/)(package\.json|manifests\/|.*\.d\.ts$|(^|\/)api\/|openapi|swagger)/i.test(target)
+    /(^|\/)(package\.json|manifests\/|.*\.d\.ts$|api\/|openapi|swagger)/i.test(target)
     || /\b(public api|breaking change|api contract|semver)\b/i.test(signalText)
   ) {
     codes.push('public-contract');
@@ -561,14 +561,19 @@ export function deriveFastPath({
     return null;
   }
   const reasons = (riskFloor.codes ?? []).filter((code) => FAST_PATH_REASON_CODES.has(code));
-  const hasLocalTarget = Boolean(targetFile) || contextPreview?.primaryTargets?.length === 1;
+  // C91-022 (W3-TR2): the shared-impact veto must consult the same target that
+  // granted locality — the explicit targetFile, else the single primaryTarget.
+  const localTarget = targetFile || (contextPreview?.primaryTargets?.length === 1
+    ? contextPreview.primaryTargets[0]
+    : null);
+  const hasLocalTarget = Boolean(localTarget);
   const hasBoundedVerification = (verificationRecommendation?.commands?.length ?? 0) > 0
     || buildExecutionContract(executionMode)?.verificationPolicy === 'minimal-or-targeted';
   const eligible = FAST_PATH_MODES.has(executionMode)
     && hasLocalTarget
     && riskFloor.floor === 'none'
     && hasBoundedVerification
-    && !isSharedImpactFile(targetFile);
+    && !isSharedImpactFile(localTarget);
   return {
     eligible,
     suppressed: eligible ? [...FAST_PATH_SUPPRESSED] : [],

package/template_project/.claude/ukit/index/route-task.mjs

@@ -5426,6 +5426,21 @@ export function compactRouteSummary(routeSummary = null) {
     nextActionType: routeSummary.nextActionType ?? null,
     nextActionCommand: routeSummary.nextActionCommand ?? null,
     helperHint: routeSummary.helperHint ?? null,
+    // TASK-004 (BL-006) shared-resolver fields — identical to what
+    // skill-router.sh persists (identical block documented there) and to what
+    // route-task.mjs / taskRouting.js routeSummary emits on the helper path.
+    // C92-A-01: riskFloor is the safety-critical one — without it a rescued
+    // high-risk route re-runs fix-loop escalation at 'runnable' depth with
+    // riskSignals: [] (fail-open on the verification gate). Unconditional
+    // null/[] defaults keep the persisted shape identical to the hook writer.
+    rigor: routeSummary.rigor ?? null,
+    fastPath: routeSummary.fastPath ?? null,
+    riskFloor: routeSummary.riskFloor ?? null,
+    resumable: routeSummary.resumable ?? null,
+    decisionShadow: routeSummary.decisionShadow ?? null,
+    escalationTriggers: Array.isArray(routeSummary.escalationTriggers)
+      ? routeSummary.escalationTriggers
+      : [],
     // TASK-007 (BL-009): playbook fields survive compaction so
     // skill-router-state.json and cached route states carry the identical
     // playbookId/workGroup the helper emitted. BL-010 adds the direct/handoff

package/template_project/.claude/ukit/index/safe-patch.mjs

@@ -54,7 +54,10 @@ export async function applySafePatch({ projectRoot = process.cwd(), filePath, an
     throw new Error('Patch old text is outside the bounded anchor window.');
   }
 
-  const nextText = beforeProfile.text.replace(oldForProfile, newForProfile);
+  // BUG-C90-01 (FR-003): the string form of .replace treats $-sequences in the
+  // replacement as patterns ($&, $', $`, $1, $<name>) — a function replacer
+  // returns the new text verbatim, so `${x}`/`$&` land literally in the file.
+  const nextText = beforeProfile.text.replace(oldForProfile, () => newForProfile);
   await writeTextWithProfile(resolved.absolute, nextText, beforeProfile);
   const afterProfile = await analyzeTextFile(resolved.absolute);
 

package/template_project/.claude/ukit/index/sidecar-decision.mjs

@@ -359,7 +359,11 @@ function validModelAnswer(result, decisionKey) {
  * deterministic rule again on any adapter failure (outcomeClass 'unavailable').
  */
 export async function runSidecarDecision({ decision, context = {}, rootDir, homeDir, config } = {}) {
-  const spec = SIDECAR_DECISIONS[decision];
+  // Own-property lookup (W3-SD1): `SIDECAR_DECISIONS[name]` would also resolve
+  // inherited Object.prototype members ('toString', 'constructor', ...), which
+  // are truthy and would bypass the allowlist into `spec.decide`/`spec.question`
+  // dereferences on a non-spec value — crashing inside the never-throws guard.
+  const spec = Object.hasOwn(SIDECAR_DECISIONS, decision) ? SIDECAR_DECISIONS[decision] : null;
   if (!spec) {
     return {
       decision: decision ?? null,
@@ -379,7 +383,7 @@ export async function runSidecarDecision({ decision, context = {}, rootDir, home
   try {
     deterministic = spec.decide(ctx);
   } catch {
-    deterministic = spec.question.candidates[0];
+    deterministic = spec.question?.candidates?.[0] ?? null;
   }
   const base = {
     decision,
@@ -461,12 +465,27 @@ function readFlagValue(argv, flag) {
   return value && !value.startsWith('--') ? value : null;
 }
 
+// W3-UD6: stdin must not accumulate unboundedly — a held pipe writing forever
+// would grow memory without limit. Bytes beyond the cap are still drained
+// (so the writer finishes and we exit promptly) but never appended; the CLI
+// then rejects with the byte-limit message. Mirrors unic-decision.mjs.
+const MAX_STDIN_BYTES = 1024 * 1024;
+
 function readStdin() {
   return new Promise((resolve, reject) => {
     let data = '';
+    let overLimit = false;
     process.stdin.setEncoding('utf8');
-    process.stdin.on('data', (chunk) => { data += chunk; });
-    process.stdin.on('end', () => resolve(data));
+    process.stdin.on('data', (chunk) => {
+      if (overLimit) return;
+      if (Buffer.byteLength(data, 'utf8') + Buffer.byteLength(chunk, 'utf8') > MAX_STDIN_BYTES) {
+        overLimit = true;
+        data = '';
+        return;
+      }
+      data += chunk;
+    });
+    process.stdin.on('end', () => resolve(overLimit ? null : data));
     process.stdin.on('error', reject);
   });
 }
@@ -518,6 +537,12 @@ async function main() {
   }
 
   const raw = await readStdin();
+  if (raw === null) {
+    process.stderr.write(
+      `sidecar-decision: stdin context exceeds the ${MAX_STDIN_BYTES}-byte limit\n`,
+    );
+    return 1;
+  }
   let input = {};
   if (raw.trim().length > 0) {
     try {
@@ -535,8 +560,12 @@ async function main() {
     }
   }
 
+  // Only absent keys are usage errors. Proto-polluted names ('toString',
+  // 'constructor', ...) resolve non-null here, but runSidecarDecision's
+  // own-property allowlist still rejects them into the typed invalid-decision
+  // fallback — exit 0, never throws.
   const decision = readFlagValue(args, '--decision') ?? input.decision;
-  if (typeof decision !== 'string' || !SIDECAR_DECISIONS[decision]) {
+  if (typeof decision !== 'string' || SIDECAR_DECISIONS[decision] == null) {
     process.stderr.write(
       `sidecar-decision: unknown or missing decision; expected one of: `
         + `${Object.keys(SIDECAR_DECISIONS).join(', ')}\n`,
@@ -548,15 +577,19 @@ async function main() {
   try {
     printResult(await runSidecarDecision({ decision, context, rootDir, homeDir }));
   } catch (error) {
-    // Last-resort never-throws guard: emit the deterministic rule answer.
-    const spec = SIDECAR_DECISIONS[decision];
-    let deterministic = spec.question.candidates[0];
+    // Last-resort never-throws guard: emit the deterministic rule answer. The
+    // optional chains keep this fallback non-throwing even if spec resolution
+    // yielded a non-spec value (proto-polluted names are already rejected
+    // upstream by the own-property check, so a null spec can't reach here —
+    // this is belt-and-braces for the never-throws contract).
+    const spec = Object.hasOwn(SIDECAR_DECISIONS, decision) ? SIDECAR_DECISIONS[decision] : null;
+    let deterministic = spec?.question?.candidates?.[0] ?? null;
     try {
-      deterministic = spec.decide(isPlainObject(context) ? context : {});
+      if (spec) deterministic = spec.decide(isPlainObject(context) ? context : {});
     } catch { /* keep first candidate */ }
     printResult({
       decision,
-      decisionKey: spec.decisionKey,
+      decisionKey: spec?.decisionKey ?? null,
       stage: 'unknown',
       answer: deterministic,
       deterministic,