@ngockhoale/ukit 3.4.33 → 3.4.34

package/CHANGELOG.md

@@ -9,6 +9,15 @@ All notable changes to UKit are documented here.
 - New `/ukit:ci-check` command + `ci-check.mjs` helper (core pack): prechecks, fail-closed budget guard, local preflight, at most one dispatch per invocation, write-ahead run-id state, `status` (never dispatches), `--ref`, `--dry-run`, per-OS report. Never pushes, merges or publishes.
 - Default-branch bootstrap stub documented in `docs/design/CI-CROSS-PLATFORM-MATRIX.md` (requires separate approval).
 
+## 3.4.34 - 2026-10-12
+
+**Hook interference fixes (P1): task intent, operation evidence, heredoc data, containment reporting.**
+- **Task intent.** Forensic, negated or deferred wording ("fix", "implement") is no longer read as a mutation order; `mutationOrder` is kept across tool events and "continue". Read-only and forensic tasks release at Stop without Edit/Write.
+- **Operation evidence.** Git push/clean and service restart + probe complete on matching operation receipts (whole-tree git state after the mutation, matching target/probe path/status, session- and task-scoped); dry-run, stale, failed, masked-exit and cross-task receipts are ignored. Mixed implementation + deploy keeps write evidence.
+- **Dangerous Command Guard.** A quoted heredoc fed to a plain text tool behind `cd x;` / `cd x &&` is data; interpreters, unquoted delimiters, substitution and pipe-to-shell stay blocked.
+- **Safe Patch.** `post-edit-verify` reports an out-of-project target as a scope refusal (still non-zero, never read) instead of a hook crash.
+- Project `.omp/config.yml` now carries the per-agent `task.agentCompactionThresholdOverrides` block that `ukit install` already generates, so a clean worktree install no longer modifies a tracked file.
+
 ## 3.4.33 - 2026-10-11
 
 **OMP token optimization, adaptive task decomposition and Completion Gate reliability.** Verified with the full suite and `yarn release:verify`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "3.4.33",
+  "version": "3.4.34",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/src/core/executionContracts.js

@@ -167,6 +167,28 @@ export function buildConfigContracts() {
   );
 }
 
+// What exactly was ordered, so a receipt for a DIFFERENT verb/service/probe cannot discharge it.
+// Unnamed specifics stay empty (any proven receipt of the domain counts); named ones are required.
+const NOT_A_SERVICE = new Set(['it', 'this', 'that', 'them', 'the', 'all', 'everything', 'service', 'services', 'again', 'now', 'to', 'and', 'then']);
+function nativeOperationGoal(domain, actionable, text) {
+  const goal = { domain, target: null, desiredState: 'verified', completionSemantics: 'execute-and-verify', requiredTargets: [] };
+  const clauses = actionable.join(' . ');
+  if (domain === 'git-integrity') {
+    const verbs = [...clauses.matchAll(/\bgit\s+(push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)\b/g)].map((m) => m[1]);
+    if (/\bpush\s+(?:to\s+)?origin\b/.test(clauses)) verbs.push('push');
+    goal.requiredTargets = [...new Set(verbs)];
+    goal.check = /\bfsck\b/.test(text) ? 'fsck' : /\bdiff\s+--check\b/.test(text) ? 'diff-check' : null;
+    return goal;
+  }
+  const services = [...clauses.matchAll(/\b(?:restart|redeploy|deploy|khoi dong lai|trien khai)\s+(?:the\s+|lai\s+)?([a-z0-9][\w.-]*)/g)]
+    .map((m) => m[1]).filter((name) => !NOT_A_SERVICE.has(name));
+  goal.requiredTargets = [...new Set(services)];
+  const probePath = text.match(/(?:^|\s)(\/[a-z0-9_.-]+(?:\/[a-z0-9_.-]+)*)/)?.[1] || null;
+  const probeStatus = text.match(/\b(?:returns?|returning|responds?(?:\s+with)?|http|status(?:\s+code)?)\s+([1-5]\d\d)\b/)?.[1] || null;
+  if (probePath || probeStatus) goal.probe = { path: probePath, status: probeStatus };
+  return goal;
+}
+
 // Task semantics are independent of source execution strategy and observed progress.
 export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
   const text = String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/đ/g, 'd').toLowerCase();
@@ -175,9 +197,26 @@ export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {})
     && !/^\s*(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(clause));
   const sourceOrder = actionable.some((clause) => /\b(?:implement|fix|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause)
     && /\b(?:source|code|logic|scheduler|implementation|ma nguon)\b|\.[cm]?[jt]sx?\b/.test(clause));
-  const operation = actionable.some((clause) => /\b(?:delete|remove|cancel|xoa|huy|ensure|dam bao)\b/.test(clause)
-    && /\bcron\b|scheduled\s+(?:cron\s+)?(?:task|job)|tac vu\s+(?:cron|dinh ky)/.test(clause));
-  const config = actionable.some((clause) => /\b(?:configuration|config|toggle|cau hinh)\b/.test(clause));
+  const codeChangeVerb = actionable.some((clause) => /\b(?:implement|fix|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause));
+  const hasOperationId = /\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/.test(text);
+  // A cron/job MENTION is not an operation: with a code-change verb in the request, an
+  // operation needs a concrete target id; otherwise it is a coding task about scheduling.
+  const cronOperation = actionable.some((clause) => /\b(?:delete|remove|cancel|xoa|huy|ensure|dam bao)\b/.test(clause)
+    && /\bcron\b|scheduled\s+(?:cron\s+)?(?:task|job)|tac vu\s+(?:cron|dinh ky)/.test(clause))
+    && (!codeChangeVerb || hasOperationId);
+  // Non-source operations (git history/push, service restart/deploy): ordered only by an
+  // actionable clause (negated/deferred/audit clauses are already filtered out). Git and
+  // runtime are separate domains with separate proof; a prompt naming both stays a coding
+  // task rather than being half-verified. A code-change verb anywhere keeps write evidence.
+  const gitOperation = actionable.some((clause) => /\bgit\s+(?:push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)\b|\bpush\s+(?:to\s+)?origin\b/.test(clause));
+  const runtimeOperation = actionable.some((clause) => /\b(?:restart|redeploy|deploy|khoi dong lai|trien khai)\b/.test(clause)
+    && !/\.[cm]?[jt]sx?\b/.test(clause) && !/\bgit\b/.test(clause));
+  const nativeDomain = cronOperation ? 'scheduled-job' : gitOperation !== runtimeOperation ? (gitOperation ? 'git-integrity' : 'service-runtime') : null;
+  const operation = Boolean(nativeDomain);
+  // A config MENTION is not a config change: the same clause needs a mutation verb, and a
+  // request that also changes source/code is a coding task (config is part of its tests/fixtures).
+  const config = !sourceOrder && actionable.some((clause) => /\b(?:configuration|config|toggle|cau hinh)\b/.test(clause)
+    && /\b(?:set|change|toggle|enable|disable|switch|turn|configure|modify|update|edit|doi|bat|tat|chinh)\b/.test(clause));
   const repository = Boolean(targetFile) || /[\w.-]+\.(?:json|ya?ml|toml|ini)\b/.test(text);
   // A status/result lookup ("check the suite output and report") orders no change: it needs a
   // lookup verb AND no mutation vocabulary anywhere in the request (fail-closed otherwise).
@@ -185,12 +224,13 @@ export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {})
   const statusReport = !mutationWord && !operation && !config
     && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua)\b/.test(text);
   const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(text) || statusReport)
-    && !sourceOrder && !operation && !config;
-  const taskKind = operation ? (sourceOrder ? 'MIXED' : 'OPERATIONAL')
+    && !sourceOrder && !codeChangeVerb && !operation && !config;
+  const taskKind = operation ? (sourceOrder || (nativeDomain !== 'scheduled-job' && codeChangeVerb) ? 'MIXED' : 'OPERATIONAL')
     : config ? 'CONFIGURATION' : readOnly ? 'READ_ONLY' : 'CODE_IMPLEMENTATION';
   const id = text.match(/\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/)?.[0] || null;
   return { taskKind, ...(taskKind === 'READ_ONLY' && statusReport ? { statusReport: true } : {}), ...(config ? { configurationScope: repository ? 'repository' : 'external' } : {}),
-    ...(operation ? { operationGoal: { domain: 'scheduled-job', target: id, desiredState: /\b(?:delete|remove|cancel|xoa|huy|absent|removed|deleted|no longer|khong con)\b/.test(actionable.join(' ')) ? 'absent' : 'present',
+    ...(operation && nativeDomain !== 'scheduled-job' ? { operationGoal: nativeOperationGoal(nativeDomain, actionable, text) } : {}),
+    ...(operation && nativeDomain === 'scheduled-job' ? { operationGoal: { domain: 'scheduled-job', target: id, desiredState: /\b(?:delete|remove|cancel|xoa|huy|absent|removed|deleted|no longer|khong con)\b/.test(actionable.join(' ')) ? 'absent' : 'present',
       completionSemantics: /\b(?:ensure|dam bao)\b/.test(text) ? 'ensure-state' : 'execute-and-verify' } } : {}) };
 }
 

package/src/index/taskRouting.js

@@ -1235,6 +1235,15 @@ function hasMutationOrder({ promptText = '', commandText = '' } = {}) {
     // '…nhưng sửa phần này' order survives.
     .replace(new RegExp(`\\bchua\\s+(?:can|nen|phai)\\s+${WAIT_TAIL}`, 'g'), ' ')
     .replace(new RegExp(`\\b(?:neu|if)\\s+${TAIL}`, 'g'), ' ')
+    // 'đối chiếu' (cross-check) folds to 'doi chieu' and is not the verb 'đổi' (change).
+.replace(/\bdoi\s+chieu\b/g, ' ')
+// R2: a deferred/future clause ("chua sua", "how we would later implement", "R2 onward: ...",
+    // "fix strategy ...") describes work for a LATER round, not an order for this turn.
+    .replace(new RegExp(`\\bchua\\s+(?:sua|fix|implement|trien\\s+khai|viet|thay\\s+doi)\\b${WAIT_TAIL}`, 'g'), ' ')
+    .replace(/\bhow\s+(?:we|i|you|they)\s+(?:would|will|could|should|might)\b[^.,;\n?]*/g, ' ')
+    .replace(/\b(?:would|will|could|might)\s+later\b[^.,;\n?]*/g, ' ')
+    .replace(/\b(?:r\d+|round\s*\d+)\s+onward\b[^\n]*/g, ' ')
+    .replace(/\bfix\s+strategy\b[^\n]*/g, ' ')
     // C85-019b: a "khi <subject> <verb>" when-clause is temporal context —
     // "khi tôi cài hệ thống này" narrates WHEN something happens; the verb
     // inside it is never the order.

package/template_project/.claude/hooks/block-dangerous.mjs

@@ -206,6 +206,21 @@ async function evaluate({ command, projectRoot, env, deadlineMs, signal }) {
   const head = (command.trimStart().split(/\s+/)[0] || '');
   const cmdHead = normalizeExecWord(head);
   let scan = command;
+  // A quoted-delimiter heredoc body is inert literal text (no expansion, no execution) when the
+  // command that RECEIVES it is a pure text tool — wherever it sits in a compound command
+  // (`cd x && cat > f <<'EOF'`). An interpreter (`python3 - <<'EOF'`, `bash <<'EOF'`) executes its
+  // body, and a pipe on the heredoc line can forward it to one, so those stay scanned. Unquoted
+  // delimiters expand $(...) and stay scanned too. Only the body is dropped.
+  if (!PIPE_TO_SHELL_RE.test(command)) {
+    scan = scan.replace(/^([^\n]*?)(<<-?[ \t]*(['"])([A-Za-z_]\w*)\3([^\n]*)\n)[\s\S]*?\n[ \t]*\4[ \t]*(?=\n|$)/gm,
+      (whole, before, opener, _q, _d, after) => {
+        if (/[|`]|\$\(/.test(before) && !/[;&]/.test(before.split(/[|`]/).pop() || '')) return whole;
+        if (/[|`]|\$\(/.test(after)) return whole;
+        const last = before.split(/&&|\|\||[;&]/).pop().trim();
+        const word = normalizeExecWord(last.split(/\s+/)[0] || '');
+        return SAFE_TEXT_HEADS.has(word) ? `${before}${opener}Q` : whole;
+      });
+  }
   if (SAFE_TEXT_HEADS.has(cmdHead) && !PIPE_TO_SHELL_RE.test(command)) {
     // A quoted-delimiter heredoc body (<<'EOF') is inert literal text — no
     // expansion, no execution. Unquoted delimiters expand $(...) so they stay

package/template_project/.claude/hooks/skill-router.sh

@@ -1791,6 +1791,28 @@ setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
   }
 
 
+// What exactly was ordered, so a receipt for a DIFFERENT verb/service/probe cannot discharge it.
+// Unnamed specifics stay empty (any proven receipt of the domain counts); named ones are required.
+const NOT_A_SERVICE = new Set(['it', 'this', 'that', 'them', 'the', 'all', 'everything', 'service', 'services', 'again', 'now', 'to', 'and', 'then']);
+function nativeOperationGoal(domain, actionable, text) {
+  const goal = { domain, target: null, desiredState: 'verified', completionSemantics: 'execute-and-verify', requiredTargets: [] };
+  const clauses = actionable.join(' . ');
+  if (domain === 'git-integrity') {
+    const verbs = [...clauses.matchAll(/\bgit\s+(push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)\b/g)].map((m) => m[1]);
+    if (/\bpush\s+(?:to\s+)?origin\b/.test(clauses)) verbs.push('push');
+    goal.requiredTargets = [...new Set(verbs)];
+    goal.check = /\bfsck\b/.test(text) ? 'fsck' : /\bdiff\s+--check\b/.test(text) ? 'diff-check' : null;
+    return goal;
+  }
+  const services = [...clauses.matchAll(/\b(?:restart|redeploy|deploy|khoi dong lai|trien khai)\s+(?:the\s+|lai\s+)?([a-z0-9][\w.-]*)/g)]
+    .map((m) => m[1]).filter((name) => !NOT_A_SERVICE.has(name));
+  goal.requiredTargets = [...new Set(services)];
+  const probePath = text.match(/(?:^|\s)(\/[a-z0-9_.-]+(?:\/[a-z0-9_.-]+)*)/)?.[1] || null;
+  const probeStatus = text.match(/\b(?:returns?|returning|responds?(?:\s+with)?|http|status(?:\s+code)?)\s+([1-5]\d\d)\b/)?.[1] || null;
+  if (probePath || probeStatus) goal.probe = { path: probePath, status: probeStatus };
+  return goal;
+}
+
 // Task semantics are independent of source execution strategy and observed progress.
 function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
   const text = String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/đ/g, 'd').toLowerCase();
@@ -1803,9 +1825,20 @@ function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
   const hasOperationId = /\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/.test(text);
   // A cron/job MENTION is not an operation: with a code-change verb in the request, an
   // operation needs a concrete target id; otherwise it is a coding task about scheduling.
-  const operation = actionable.some((clause) => /\b(?:delete|remove|cancel|xoa|huy|ensure|dam bao)\b/.test(clause)
+  const cronOperation = actionable.some((clause) => /\b(?:delete|remove|cancel|xoa|huy|ensure|dam bao)\b/.test(clause)
     && /\bcron\b|scheduled\s+(?:cron\s+)?(?:task|job)|tac vu\s+(?:cron|dinh ky)/.test(clause))
     && (!codeChangeVerb || hasOperationId);
+  // Non-source operations (git history/push, service restart/deploy): ordered only by an
+  // actionable clause (negated/deferred/audit clauses are already filtered out). Git and
+  // runtime are separate domains with separate proof; a prompt naming both stays a coding
+  // task rather than being half-verified. A code-change verb anywhere keeps write evidence.
+  const gitOperation = actionable.some((clause) => /\bgit\s+(?:push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)\b|\bpush\s+(?:to\s+)?origin\b/.test(clause));
+  const runtimeOperation = actionable.some((clause) => /\b(?:restart|redeploy|deploy|khoi dong lai|trien khai)\b/.test(clause)
+    && !/\.[cm]?[jt]sx?\b/.test(clause) && !/\bgit\b/.test(clause));
+  const nativeDomain = cronOperation ? 'scheduled-job' : gitOperation !== runtimeOperation ? (gitOperation ? 'git-integrity' : 'service-runtime') : null;
+  const operation = Boolean(nativeDomain);
+  // A config MENTION is not a config change: the same clause needs a mutation verb, and a
+  // request that also changes source/code is a coding task (config is part of its tests/fixtures).
   const config = !sourceOrder && actionable.some((clause) => /\b(?:configuration|config|toggle|cau hinh)\b/.test(clause)
     && /\b(?:set|change|toggle|enable|disable|switch|turn|configure|modify|update|edit|doi|bat|tat|chinh)\b/.test(clause));
   const repository = Boolean(targetFile) || /[\w.-]+\.(?:json|ya?ml|toml|ini)\b/.test(text);
@@ -1816,11 +1849,12 @@ function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
     && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua)\b/.test(text);
   const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(text) || statusReport)
     && !sourceOrder && !codeChangeVerb && !operation && !config;
-  const taskKind = operation ? (sourceOrder ? 'MIXED' : 'OPERATIONAL')
+  const taskKind = operation ? (sourceOrder || (nativeDomain !== 'scheduled-job' && codeChangeVerb) ? 'MIXED' : 'OPERATIONAL')
     : config ? 'CONFIGURATION' : readOnly ? 'READ_ONLY' : 'CODE_IMPLEMENTATION';
   const id = text.match(/\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/)?.[0] || null;
   return { taskKind, ...(taskKind === 'READ_ONLY' && statusReport ? { statusReport: true } : {}), ...(config ? { configurationScope: repository ? 'repository' : 'external' } : {}),
-    ...(operation ? { operationGoal: { domain: 'scheduled-job', target: id, desiredState: /\b(?:delete|remove|cancel|xoa|huy|absent|removed|deleted|no longer|khong con)\b/.test(actionable.join(' ')) ? 'absent' : 'present',
+    ...(operation && nativeDomain !== 'scheduled-job' ? { operationGoal: nativeOperationGoal(nativeDomain, actionable, text) } : {}),
+    ...(operation && nativeDomain === 'scheduled-job' ? { operationGoal: { domain: 'scheduled-job', target: id, desiredState: /\b(?:delete|remove|cancel|xoa|huy|absent|removed|deleted|no longer|khong con)\b/.test(actionable.join(' ')) ? 'absent' : 'present',
       completionSemantics: /\b(?:ensure|dam bao)\b/.test(text) ? 'ensure-state' : 'execute-and-verify' } } : {}) };
 }
 
@@ -2254,6 +2288,15 @@ function applyTaskSemantics(contract, semantic) {
       // '…nhưng sửa phần này' order survives.
       .replace(new RegExp(`\\bchua\\s+(?:can|nen|phai)\\s+${WAIT_TAIL}`, 'g'), ' ')
       .replace(new RegExp(`\\b(?:neu|if)\\s+${TAIL}`, 'g'), ' ')
+      // 'đối chiếu' (cross-check) folds to 'doi chieu' and is not the verb 'đổi' (change).
+.replace(/\bdoi\s+chieu\b/g, ' ')
+// R2: a deferred/future clause ("chua sua", "how we would later implement", "R2 onward: ...",
+      // "fix strategy ...") describes work for a LATER round, not an order for this turn.
+      .replace(new RegExp(`\\bchua\\s+(?:sua|fix|implement|trien\\s+khai|viet|thay\\s+doi)\\b${WAIT_TAIL}`, 'g'), ' ')
+      .replace(/\bhow\s+(?:we|i|you|they)\s+(?:would|will|could|should|might)\b[^.,;\n?]*/g, ' ')
+      .replace(/\b(?:would|will|could|might)\s+later\b[^.,;\n?]*/g, ' ')
+      .replace(/\b(?:r\d+|round\s*\d+)\s+onward\b[^\n]*/g, ' ')
+      .replace(/\bfix\s+strategy\b[^\n]*/g, ' ')
       // C85-019b: a "khi <subject> <verb>" when-clause is temporal context —
       // "khi tôi cài hệ thống này" narrates WHEN something happens; the verb
       // inside it is never the order.
@@ -3637,6 +3680,12 @@ function applyTaskSemantics(contract, semantic) {
     if (continuingTask && previous.routingContext?.lastExplicitUserPromptText) {
       persisted.routingContext ||= {};
       persisted.routingContext.lastExplicitUserPromptText = previous.routingContext.lastExplicitUserPromptText;
+      // A tool event or a bare "continue" carries no order of its own: mutationOrder recomputed
+      // from a file path / the word "continue" says nothing about what the user ordered, so the
+      // original prompt's stamp stays authoritative.
+      if ((!extractPrompt(payload) || continuationPrompt) && typeof previous.routingContext.mutationOrder === 'boolean') {
+        persisted.routingContext.mutationOrder = previous.routingContext.mutationOrder;
+      }
     }
     if (continuingTask && !persisted.suspendedContract && previous.suspendedContract) {
       persisted.suspendedContract = previous.suspendedContract;

package/template_project/.claude/ukit/index/post-edit-verify.mjs

@@ -276,6 +276,15 @@ if (process.argv[1] && path.basename(fileURLToPath(import.meta.url)) === path.ba
     process.stderr.write(`[ukit-safe-patch] post-edit ERROR: ${error?.message || error}\n`);
     // BUG-C23-01: stderr-only crash announces nothing to the user — §8 requires
     // the paired stdout systemMessage before the non-zero exit.
+    // A containment refusal is the guard working, not a crash: the target is outside the
+    // project (and any listed linked worktree), so it is still refused and never read.
+    if (/^Path escapes project root:/.test(String(error?.message || ''))) {
+      emitSystemMessage(
+        `UKit Safe Patch refused an out-of-project edit target (${error.message}); `
+        + 'post-edit verification was NOT run for it. This is a scope refusal, not a hook crash.',
+      );
+      process.exit(1);
+    }
     emitSystemMessage(
       `UKit post-edit-verify crashed before it could verify the edit (${error?.message || error}); `
       + 'the Safe Patch check was skipped this pass. Run `ukit doctor` if this repeats.',

package/template_project/.claude/ukit/index/route-resolver.mjs

@@ -1063,6 +1063,28 @@ export function deriveRouteFields({
   };
 }
 
+// What exactly was ordered, so a receipt for a DIFFERENT verb/service/probe cannot discharge it.
+// Unnamed specifics stay empty (any proven receipt of the domain counts); named ones are required.
+const NOT_A_SERVICE = new Set(['it', 'this', 'that', 'them', 'the', 'all', 'everything', 'service', 'services', 'again', 'now', 'to', 'and', 'then']);
+function nativeOperationGoal(domain, actionable, text) {
+  const goal = { domain, target: null, desiredState: 'verified', completionSemantics: 'execute-and-verify', requiredTargets: [] };
+  const clauses = actionable.join(' . ');
+  if (domain === 'git-integrity') {
+    const verbs = [...clauses.matchAll(/\bgit\s+(push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)\b/g)].map((m) => m[1]);
+    if (/\bpush\s+(?:to\s+)?origin\b/.test(clauses)) verbs.push('push');
+    goal.requiredTargets = [...new Set(verbs)];
+    goal.check = /\bfsck\b/.test(text) ? 'fsck' : /\bdiff\s+--check\b/.test(text) ? 'diff-check' : null;
+    return goal;
+  }
+  const services = [...clauses.matchAll(/\b(?:restart|redeploy|deploy|khoi dong lai|trien khai)\s+(?:the\s+|lai\s+)?([a-z0-9][\w.-]*)/g)]
+    .map((m) => m[1]).filter((name) => !NOT_A_SERVICE.has(name));
+  goal.requiredTargets = [...new Set(services)];
+  const probePath = text.match(/(?:^|\s)(\/[a-z0-9_.-]+(?:\/[a-z0-9_.-]+)*)/)?.[1] || null;
+  const probeStatus = text.match(/\b(?:returns?|returning|responds?(?:\s+with)?|http|status(?:\s+code)?)\s+([1-5]\d\d)\b/)?.[1] || null;
+  if (probePath || probeStatus) goal.probe = { path: probePath, status: probeStatus };
+  return goal;
+}
+
 // Task semantics are independent of source execution strategy and observed progress.
 export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
   const text = String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/đ/g, 'd').toLowerCase();
@@ -1075,9 +1097,18 @@ export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {})
   const hasOperationId = /\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/.test(text);
   // A cron/job MENTION is not an operation: with a code-change verb in the request, an
   // operation needs a concrete target id; otherwise it is a coding task about scheduling.
-  const operation = actionable.some((clause) => /\b(?:delete|remove|cancel|xoa|huy|ensure|dam bao)\b/.test(clause)
+  const cronOperation = actionable.some((clause) => /\b(?:delete|remove|cancel|xoa|huy|ensure|dam bao)\b/.test(clause)
     && /\bcron\b|scheduled\s+(?:cron\s+)?(?:task|job)|tac vu\s+(?:cron|dinh ky)/.test(clause))
     && (!codeChangeVerb || hasOperationId);
+  // Non-source operations (git history/push, service restart/deploy): ordered only by an
+  // actionable clause (negated/deferred/audit clauses are already filtered out). Git and
+  // runtime are separate domains with separate proof; a prompt naming both stays a coding
+  // task rather than being half-verified. A code-change verb anywhere keeps write evidence.
+  const gitOperation = actionable.some((clause) => /\bgit\s+(?:push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)\b|\bpush\s+(?:to\s+)?origin\b/.test(clause));
+  const runtimeOperation = actionable.some((clause) => /\b(?:restart|redeploy|deploy|khoi dong lai|trien khai)\b/.test(clause)
+    && !/\.[cm]?[jt]sx?\b/.test(clause) && !/\bgit\b/.test(clause));
+  const nativeDomain = cronOperation ? 'scheduled-job' : gitOperation !== runtimeOperation ? (gitOperation ? 'git-integrity' : 'service-runtime') : null;
+  const operation = Boolean(nativeDomain);
   // A config MENTION is not a config change: the same clause needs a mutation verb, and a
   // request that also changes source/code is a coding task (config is part of its tests/fixtures).
   const config = !sourceOrder && actionable.some((clause) => /\b(?:configuration|config|toggle|cau hinh)\b/.test(clause)
@@ -1090,11 +1121,12 @@ export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {})
     && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua)\b/.test(text);
   const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(text) || statusReport)
     && !sourceOrder && !codeChangeVerb && !operation && !config;
-  const taskKind = operation ? (sourceOrder ? 'MIXED' : 'OPERATIONAL')
+  const taskKind = operation ? (sourceOrder || (nativeDomain !== 'scheduled-job' && codeChangeVerb) ? 'MIXED' : 'OPERATIONAL')
     : config ? 'CONFIGURATION' : readOnly ? 'READ_ONLY' : 'CODE_IMPLEMENTATION';
   const id = text.match(/\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/)?.[0] || null;
   return { taskKind, ...(taskKind === 'READ_ONLY' && statusReport ? { statusReport: true } : {}), ...(config ? { configurationScope: repository ? 'repository' : 'external' } : {}),
-    ...(operation ? { operationGoal: { domain: 'scheduled-job', target: id, desiredState: /\b(?:delete|remove|cancel|xoa|huy|absent|removed|deleted|no longer|khong con)\b/.test(actionable.join(' ')) ? 'absent' : 'present',
+    ...(operation && nativeDomain !== 'scheduled-job' ? { operationGoal: nativeOperationGoal(nativeDomain, actionable, text) } : {}),
+    ...(operation && nativeDomain === 'scheduled-job' ? { operationGoal: { domain: 'scheduled-job', target: id, desiredState: /\b(?:delete|remove|cancel|xoa|huy|absent|removed|deleted|no longer|khong con)\b/.test(actionable.join(' ')) ? 'absent' : 'present',
       completionSemantics: /\b(?:ensure|dam bao)\b/.test(text) ? 'ensure-state' : 'execute-and-verify' } } : {}) };
 }
 

package/template_project/.claude/ukit/index/route-task.mjs

@@ -4566,6 +4566,15 @@ function hasMutationOrder({ promptText = '', commandText = '' } = {}) {
     // '…nhưng sửa phần này' order survives.
     .replace(new RegExp(`\\bchua\\s+(?:can|nen|phai)\\s+${WAIT_TAIL}`, 'g'), ' ')
     .replace(new RegExp(`\\b(?:neu|if)\\s+${TAIL}`, 'g'), ' ')
+    // 'đối chiếu' (cross-check) folds to 'doi chieu' and is not the verb 'đổi' (change).
+.replace(/\bdoi\s+chieu\b/g, ' ')
+// R2: a deferred/future clause ("chua sua", "how we would later implement", "R2 onward: ...",
+    // "fix strategy ...") describes work for a LATER round, not an order for this turn.
+    .replace(new RegExp(`\\bchua\\s+(?:sua|fix|implement|trien\\s+khai|viet|thay\\s+doi)\\b${WAIT_TAIL}`, 'g'), ' ')
+    .replace(/\bhow\s+(?:we|i|you|they)\s+(?:would|will|could|should|might)\b[^.,;\n?]*/g, ' ')
+    .replace(/\b(?:would|will|could|might)\s+later\b[^.,;\n?]*/g, ' ')
+    .replace(/\b(?:r\d+|round\s*\d+)\s+onward\b[^\n]*/g, ' ')
+    .replace(/\bfix\s+strategy\b[^\n]*/g, ' ')
     // C85-019b: a "khi <subject> <verb>" when-clause is temporal context —
     // "khi tôi cài hệ thống này" narrates WHEN something happens; the verb
     // inside it is never the order.

package/template_project/.claude/ukit/runtime/cron-operation-adapter.mjs

@@ -41,3 +41,70 @@ export function cronOperationReceipt(toolName, input, response, transportSuccess
     transportSuccess: transportSuccess === true, harness,
     operation: { domain: capability.domain, role: capability.role, scope, ...state } };
 }
+
+// R2/R3: non-source operations (git integrity, service restart + HTTP check). A Bash command is
+// proof only when it IS the checked command (not text inside echo/quotes) and its exit status
+// is the command's own: no pipe without pipefail, no `;`/newline/`||` chain that can mask it.
+// The goal names WHAT was ordered (verbs, services, probe path/status): a receipt for another
+// verb, service, repo or endpoint never discharges it, and a dry run is not the operation.
+const GIT_MUTATION = /^git\s+(?:push|commit|clean|reset|merge|rebase|stash|tag|checkout|restore|pull|cherry-pick|branch)\b/;
+const GIT_VERB = /^git\s+(push|commit|clean|reset|merge|rebase|stash|tag|checkout|restore|pull|cherry-pick|branch)\b/;
+const GIT_STATE = /^git\s+(?:fsck\b|diff\s+(?:--check|--exit-code|--quiet)\b|status\s+(?:--porcelain|-s|--short)\b)/;
+const SERVICE_MUTATION = /^(?:docker(?:\s+compose)?|docker-compose)\s+(?:restart|up|down|stop|start|build)\b|^(?:sudo\s+)?systemctl\s+(?:restart|start|stop|reload)\b|^pm2\s+(?:restart|reload|start)\b|^kubectl\s+(?:rollout|apply)\b|^launchctl\s+kickstart\b|^(?:\.\/)?(?:scripts\/)?deploy[\w.-]*(?:\s|$)|^(?:npm|yarn|pnpm)\s+(?:run\s+)?deploy\b/;
+const DRY_RUN = /(?:^|\s)(?:--dry-run|--check|--no-act|-n)(?:\s|=|$)/;
+const CURL = /^curl\s/;
+function requiredTargetOf(segment, required) {
+  if (!required.length) return null;
+  const tokens = segment.split(/\s+/);
+  return required.find((name) => tokens.some((tok) => tok === name || tok.endsWith(`/${name}`))) || '(other)';
+}
+export function bashOperationReceipt(command, response, transportSuccess, goal, { sessionId, harness } = {}) {
+  const domain = goal?.domain;
+  const scope = typeof sessionId === 'string' && sessionId.trim() ? `session:${sessionId.trim()}` : null;
+  if (!['git-integrity', 'service-runtime'].includes(domain) || typeof command !== 'string') return null;
+  const required = Array.isArray(goal.requiredTargets) ? goal.requiredTargets : [];
+  const bare = command.replace(/'[^']*'|"[^"]*"/g, '""');
+  const masked = /;|\n|\|\|/.test(bare) || (/\|/.test(bare) && !/\bpipefail\b/.test(command));
+  const real = command.split('&&').map((seg) => seg.trim());
+  const text = responseText(response);
+  const hasOutputField = typeof response === 'string' || typeof response?.stdout === 'string' || typeof response?.output === 'string';
+  let role = null; let proven = false; let target = null;
+  for (const seg of real) {
+    if (!seg || /^cd\s+\S+$/.test(seg) || DRY_RUN.test(seg.replace(/'[^']*'|"[^"]*"/g, '""'))) continue;
+    if (domain === 'git-integrity') {
+      if (GIT_STATE.test(seg)) {
+        const wanted = goal.check;
+        const kind = /\bfsck\b/.test(seg) ? 'fsck' : /\bdiff\b/.test(seg) ? 'diff-check' : 'status';
+        // `-- <pathspec>` / extra paths narrow the check; only a whole-tree status proves a clean tree.
+        const wholeTree = kind !== 'status' || !/\s--\s|\s--porcelain=\S*\s+\S|(?:--porcelain|-s|--short)\s+[^\s-]/.test(seg);
+        if (!wholeTree || (wanted && kind !== wanted)) continue;
+        role = 'state';
+        proven = kind === 'status' ? hasOutputField && text === '' : true;
+      } else if (GIT_VERB.test(seg) && role !== 'state') {
+        role = 'mutation';
+        target = seg.match(GIT_VERB)[1];
+      }
+    } else if (SERVICE_MUTATION.test(seg) && role !== 'state') {
+      role = 'mutation';
+      target = requiredTargetOf(seg, required);
+    } else if (CURL.test(seg)) {
+      const url = seg.match(/https?:\/\/\S+/)?.[0];
+      if (!url) continue;
+      let pathname = null;
+      try { pathname = new URL(url.replace(/["']/g, '')).pathname; } catch { continue; }
+      const probe = goal.probe || {};
+      if (probe.path && pathname.replace(/\/$/, '') !== probe.path.replace(/\/$/, '')) continue;
+      const code = /%\{http_code\}/.test(seg) ? text.match(/(\d{3})\s*$/)?.[1] || null : null;
+      const failFlag = /(?:^|\s)(?:-[a-zA-Z]*f[a-zA-Z]*|--fail(?:-with-body)?)(?:\s|$)/.test(seg);
+      role = 'state';
+      if (code) proven = probe.status ? code === probe.status : /^2/.test(code);
+      else proven = failFlag && (!probe.status || probe.status.startsWith('2'));
+    }
+  }
+  if (!role) return null;
+  const ok = transportSuccess === true && !masked && Boolean(scope) && (role === 'mutation' || proven);
+  return { kind: 'operation', success: ok, transportSuccess: transportSuccess === true, harness,
+    ...(masked ? { exitStatusUnproven: true } : {}),
+    operation: { domain, role, scope, target: role === 'state' ? null : target,
+      ...(role === 'state' ? { state: 'verified', complete: ok } : {}) } };
+}

package/template_project/.claude/ukit/runtime/execution-ledger.mjs

@@ -7,7 +7,7 @@ import fsSync from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { withAsyncLock, LOCK_MAX_SLICE_MS } from './async-lock.mjs';
-import { cronOperationReceipt } from './cron-operation-adapter.mjs';
+import { cronOperationReceipt, bashOperationReceipt } from './cron-operation-adapter.mjs';
 import { operationCompletionPolicy, foldOperationEvidence, compactOperation } from './operation-evidence.mjs';
 
 // Hook-context self-deadline (2.4.1 orphan-leak class): armed ONLY on direct
@@ -693,6 +693,15 @@ function gitOutput(args, cwd) {
 // so the session root's fingerprint never moves for work done there. Only a LEADING `cd <dir>`
 // that lands in a checkout sharing this repo's git common dir redirects the fingerprint; an
 // unrelated repo, a missing dir or any git failure keeps the session root (fail-closed).
+// The router stamps CODE_IMPLEMENTATION on every mutating lane, so the read-only valves must
+// treat it like an absent kind; MIXED/OPERATIONAL/CONFIGURATION keep their own evidence.
+// A stamped CODE_IMPLEMENTATION only opens a valve when the prompt carried no mutation order.
+function plainCodeContract(contract, state) {
+  if (!contract?.taskKind) return true;
+  return contract.taskKind === 'CODE_IMPLEMENTATION'
+    && (state?.routingContext?.mutationOrder === false || state?.routingContext?.planOnly === true);
+}
+
 function bashWorkspaceScope(command, projectRoot, shellCwd) {
   const here = { root: projectRoot, foreign: false };
   const match = String(command || '').match(/^\s*cd\s+(?:"([^"]+)"|'([^']+)'|([^\s;&|<>$`~]+))\s*(?:&&|;)/);
@@ -2792,7 +2801,12 @@ export async function recordExecutionReceipt({
     exitCode,
   };
 
-  const operationReceipt = cronOperationReceipt(toolName, toolInput, payload.tool_response ?? payload.tool_output ?? payload.tool_result, success, { sessionId: explicitSessionId(payload), harness });
+  const toolResponse = payload.tool_response ?? payload.tool_output ?? payload.tool_result;
+  const nativeGoal = routeState?.routeSummary?.executionContract?.operationGoal;
+  const operationReceipt = cronOperationReceipt(toolName, toolInput, toolResponse, success, { sessionId: explicitSessionId(payload), harness })
+    || (toolName === 'Bash' && !bashScope.foreign
+      ? bashOperationReceipt(toolInput.command, toolResponse, success, nativeGoal, { sessionId: explicitSessionId(payload), harness })
+      : null);
   if (operationReceipt) {
     Object.assign(receipt, operationReceipt);
   } else if (toolName === 'Read' || toolName === 'Grep' || toolName === 'Glob') {
@@ -3377,7 +3391,7 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
       || routeSummary.executionContract.completionRule === 'never-claim-fixed-without-write-and-verification');
   if (
     findCauseNoMutationContract
-    && !routeSummary.executionContract?.taskKind
+    && plainCodeContract(routeSummary.executionContract, state)
     && playbookId !== BUGFIX_PLAYBOOK_ID
     && !effectiveLedger.writeAttempted
     && !effectiveLedger.verificationFailed
@@ -3400,7 +3414,7 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
   // satisfied), no mutation was attempted, and no verification failed; anything less has
   // concrete unfinished work and keeps recovering.
   if (
-    !routeSummary.executionContract?.taskKind
+    plainCodeContract(routeSummary.executionContract, state)
     && mode === 'map-impact'
     && !missingEvidence.includes('impact-evidence')
     && effectiveLedger.writeAttempted !== true
@@ -3428,7 +3442,7 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
   const readOnlyPrompt = state?.routingContext?.mutationOrder === false
     || state?.routingContext?.planOnly === true;
   if (
-    !routeSummary.executionContract?.taskKind
+    plainCodeContract(routeSummary.executionContract, state)
     && readOnlyPrompt
     && !effectiveLedger.writeAttempted
     && missingEvidence.some((item) => item === 'write-evidence' || item === 'verification-evidence')

package/template_project/.claude/ukit/runtime/operation-evidence.mjs

@@ -61,7 +61,11 @@ export function operationEvidenceStatus(goal, ledger = {}) {
   const matches = (r) => r?.taskInstanceId === ledger.taskInstanceId && r.sessionKey === ledger.sessionKey
     && r.operation?.domain === goal.domain && r.operation.scope === goal.scope;
   const attempts = entries.map((e) => e.mutation).filter(matches);
-  const attempt = attempts.filter((r) => r.operation.target === goal.target).sort((a, b) => b.sequence - a.sequence)[0];
+  // Named verbs/services are ALL required: a receipt for another target never stands in for one.
+  const requiredTargets = Array.isArray(goal.requiredTargets) && goal.requiredTargets.length > 0 ? goal.requiredTargets : [goal.target];
+  const latestFor = (target) => attempts.filter((r) => r.operation.target === target).sort((a, b) => b.sequence - a.sequence)[0];
+  const proofs = requiredTargets.map(latestFor);
+  const attempt = proofs[0];
   const observation = entries.map((e) => e.state).filter(matches).sort((a, b) => b.sequence - a.sequence)[0];
   const op = observation?.operation;
   const absent = goal.desiredState === 'absent' && Array.isArray(op?.presentTargets)
@@ -74,8 +78,8 @@ export function operationEvidenceStatus(goal, ledger = {}) {
   if (goal.completionSemantics === 'ensure-state' && attempts.length === 0) {
     return { complete: true, operationProof: 'desired-state-only' };
   }
-  if (!attempt?.success || !attempt.toolUseId || !observation.toolUseId
-    || !(observation.sequence > attempt.sequence)) return incomplete;
+  if (!proofs.every((proof) => proof?.success && proof.toolUseId && observation.toolUseId
+    && observation.sequence > proof.sequence)) return incomplete;
   return { complete: true, operationProof: 'executed-and-verified' };
 }