@ngockhoale/ukit 3.4.45 → 3.4.46

package/CHANGELOG.md

@@ -9,6 +9,15 @@ All notable changes to UKit are documented here.
 - New `/ukit:ci-check` command + `ci-check.mjs` helper (core pack): prechecks, fail-closed budget guard, local preflight, at most one dispatch per invocation, write-ahead run-id state, `status` (never dispatches), `--ref`, `--dry-run`, per-OS report. Never pushes, merges or publishes.
 - Default-branch bootstrap stub documented in `docs/design/CI-CROSS-PLATFORM-MATRIX.md` (requires separate approval).
 
+## 3.4.46 - 2026-10-18
+
+**Completion contract P0: forensic intent, attributable release evidence and conditional NO-GO.**
+- Correct negated/quoted forensic requests and Vietnamese status questions; explicit report artifacts require owned writes and nonempty output. External scratch writes do not count as product changes.
+- Conditional release contracts with a named `release:verify` preflight accept only current-task attributable native failure as terminal `RELEASE_NO_GO`, never publication success. Missing implementation writes still block; passing preflight retains publication obligations. Masked commands and stale receipts remain unproven.
+- Accept standalone `npm view <package> version --prefer-online` evidence without republishing; improve task/obligation diagnostics. OMP artifact checks use the installed project cwd.
+- Exclude only repository coverage/transcript audit scripts from npm; retain runtime and customer assets and the strict artifact budget.
+- Verified locally on macOS/Node 22 with real isolated OMP child-hook chains; no provider calls or GitHub Actions dispatch. Historical release ledger replay remains partial; OMP mid-task freeze remains open. UNIC Decision stays unchanged/off.
+
 ## 3.4.45 - 2026-10-17
 
 **P1 correctness repair: implementation prompts, release identity, large-transcript intent, continuation ownership.**

package/manifests/documentation.yaml

@@ -955,6 +955,18 @@ entries:
     archive_policy: never
     notes: C69 G7 operator doc — timeline render, support bundle contents/exclusions, replay limits
 
+  - id: docs-completion-decision-assessment
+    path: docs/COMPLETION_DECISION_ASSESSMENT.md
+    class: canonical
+    audience: [maintainer]
+    owner: runtime
+    source_of_truth: docs/COMPLETION_DECISION_ASSESSMENT.md
+    merge_strategy: none
+    load_policy: on-demand
+    validation: [manual]
+    archive_policy: never
+    notes: P0 completion contract corrections and offline semantic decision architecture assessment
+
   - id: docs-unic-decision-integration-p1-fix
     path: docs/UNIC-DECISION-INTEGRATION-P1-FIX.md
     class: canonical

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "3.4.45",
+  "version": "3.4.46",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",
@@ -34,6 +34,8 @@
     "!scripts/audit/c100/implementer-attribution.mjs",
     "!scripts/audit/c100/trees-lifetimes.mjs",
     "!scripts/audit/c100/usage-provenance.mjs",
+    "!scripts/audit/decision-coverage.mjs",
+    "!scripts/audit/subagent-cost/**",
     "template_project/",
     "template_user/",
     "!template_project/**/.smbdelete*",

package/src/core/executionContracts.js

@@ -194,25 +194,39 @@ function nativeOperationGoal(domain, actionable, text) {
 // FIRST item of an enumeration ("Do not implement fixes, modify source code, restart services, ...") and
 // the later items became actionable orders (MIXED + service-runtime). English negators now scope to the
 // sentence end (', and'/', or' continue the list; a bare 'and <verb>' or but/then starts a new clause);
-// Vietnamese negators stay clause-local. Noun uses of verbs ("write/verification advisory", "each proposed
+// Vietnamese negators scope to the sentence end as well. Noun uses of verbs ("write/verification advisory", "each proposed
 // fix", "state change") name things, not orders. Neutralised spans become blanks, never new orders.
 const NON_ORDER_VERBS = 'implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|restart|sua|viet|chinh|them|tao|xoa';
 function neutralizeNonOrders(text) {
   return String(text)
     .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|shall\\s+not)\\s+[^.;\\n]*?(?=(?<!,)\\s+(?:and|va)\\s+(?:${NON_ORDER_VERBS})\\b|\\s+(?:but|nhung|then|however)\\b|[.;\\n]|$)`, 'g'), ' ')
+    .replace(new RegExp(`\\b(?:khong|chua)\\s+[^.;\\n]*?(?=\\s+(?:nhung|tuy nhien)\\b|[.;\\n]|$)`, 'g'), ' ')
+    .replace(/"[^"\n]*\s[^"\n]*"|`[^`\n]*\s[^`\n]*`|\u201c[^\u201d\n]*\u201d/g, ' ')
+    .replace(/\b(?:neu\s+(?:phai|can|thieu|khong du|bang chung chua du)|if\s+(?:needed|necessary|required|evidence is insufficient))\b[^.;\n]*/g, ' ')
+    .replace(/[^.;\n]*\b(?:nao|gi|sao|the nao|bao nhieu)\b[^.;\n]*\?/g, ' ')
+    .replace(/\bchinh\s+xac\b|\b(?:phuong an|cach|de xuat|ban)\s+(?:sua|fix)\b/g, ' ')
     .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
     .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
     .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ');
 }
 
 export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
-  const text = neutralizeNonOrders(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/đ/g, 'd').toLowerCase());
+  // A named preflight and both explicit branches are required; a failed arbitrary test is not a release policy.
+  const releaseText = String(promptText).normalize('NFD').replace(/[̀-ͯ]/g, '').replace(/[đĐ]/g, 'd').toLowerCase();
+  const preflight = releaseText.match(/\b(?:yarn\s+release:verify|npm\s+run\s+release:verify)\b/)?.[0];
+  const releasePolicy = preflight && /\b(?:if|neu|only when|only if)\b[^\n.;]*(?:pass|go)\b[^\n.;]*(?:release|publish)\b/.test(releaseText)
+    && /\b(?:fail|no-go)\b[^\n.;]*(?:do not publish|don't publish|no publish|khong publish|khong npm publish)\b/.test(releaseText)
+    ? { kind: 'conditional-release', preflight } : null;
+  const text = neutralizeNonOrders(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[đĐ]/g, 'd').toLowerCase());
   const clauses = text.split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/);
   const actionable = clauses.map((clause) => clause.split(/\bwithout\b/)[0]).filter((clause) => !/\b(?:do not|don't|never|khong|dung)\b/.test(clause)
     && !/^\s*(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(clause));
   const sourceOrder = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause)
     && /\b(?:source|code|logic|scheduler|implementation|ma nguon)\b|\.[cm]?[jt]sx?\b/.test(clause));
   const codeChangeVerb = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause));
+  const reportArtifact = String(promptText).match(/(?:^|\s)((?:docs\/|reports\/)[A-Za-z0-9_./-]+\.(?:md|txt))(?=\s|[.,;:]|$)/)?.[1];
+  const documentation = !sourceOrder && !/\b(?:implement|fix|refactor|modify|edit|update|sua|chinh)\b/.test(actionable.join(' ')) && reportArtifact && actionable.some((clause) => /\b(?:write|create|save|viet|tao|luu)\b/.test(clause))
+    && /\b(?:report|bao cao|analysis|phan tich|document)\b/.test(text);
   const hasOperationId = /\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/.test(text);
   // A cron/job MENTION is not an operation: with a code-change verb in the request, an
   // operation needs a concrete target id; otherwise it is a coding task about scheduling.
@@ -237,13 +251,13 @@ export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {})
   // lookup verb AND no mutation vocabulary anywhere in the request (fail-closed otherwise).
   const mutationWord = /\b(?:implement|fix|refactor|modify|edit|write|update|add|create|build|make|install|deploy|remove|delete|rename|replace|change|sua|viet|chinh|them|tao|xoa|doi|cai|cap nhat)\b/.test(text);
   const statusReport = !mutationWord && !operation && !config
-    && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua)\b/.test(text);
-  const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(text) || statusReport)
+    && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua|da len chua)\b/.test(text);
+  const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|investigate|debug|forensic|root cause|kiem tra|phan tich|dieu tra|doc log|tim hieu)\b/.test(text) || statusReport)
     && !sourceOrder && !codeChangeVerb && !operation && !config;
   const taskKind = operation ? (sourceOrder || (nativeDomain !== 'scheduled-job' && codeChangeVerb) ? 'MIXED' : 'OPERATIONAL')
-    : config ? 'CONFIGURATION' : readOnly ? 'READ_ONLY' : 'CODE_IMPLEMENTATION';
+    : config ? 'CONFIGURATION' : documentation ? 'DOCUMENTATION_OUTPUT' : readOnly ? 'READ_ONLY' : 'CODE_IMPLEMENTATION';
   const id = text.match(/\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/)?.[0] || null;
-  return { taskKind, ...(taskKind === 'READ_ONLY' && statusReport ? { statusReport: true } : {}), ...(config ? { configurationScope: repository ? 'repository' : 'external' } : {}),
+  return { taskKind, ...(releasePolicy ? { releasePolicy } : {}), ...(documentation ? { reportArtifact } : {}), ...(taskKind === 'READ_ONLY' && statusReport ? { statusReport: true } : {}), ...(config ? { configurationScope: repository ? 'repository' : 'external' } : {}),
     ...(operation && nativeDomain !== 'scheduled-job' ? { operationGoal: nativeOperationGoal(nativeDomain, actionable, text) } : {}),
     ...(operation && nativeDomain === 'scheduled-job' ? { operationGoal: { domain: 'scheduled-job', target: id, desiredState: /\b(?:delete|remove|cancel|xoa|huy|absent|removed|deleted|no longer|khong con)\b/.test(actionable.join(' ')) ? 'absent' : 'present',
       completionSemantics: /\b(?:ensure|dam bao)\b/.test(text) ? 'ensure-state' : 'execute-and-verify' } } : {}) };
@@ -254,7 +268,7 @@ export function applyTaskSemantics(contract, semantic) {
   const operationOnly = semantic.taskKind === 'OPERATIONAL'
     || (semantic.taskKind === 'CONFIGURATION' && semantic.configurationScope === 'external');
   return { ...(contract || {}), ...semantic,
-    completionEvidence: operationOnly ? ['operation-verification']
+    completionEvidence: semantic.taskKind === 'DOCUMENTATION_OUTPUT' ? ['report-artifact'] : operationOnly ? ['operation-verification']
       : semantic.taskKind === 'MIXED' ? [...new Set([...evidence, 'write-evidence', 'operation-verification'])]
         : semantic.taskKind === 'READ_ONLY' && semantic.statusReport ? []
         : semantic.taskKind === 'READ_ONLY' ? (evidence.length === 1 && evidence[0] === 'verification-evidence' ? evidence : ['impact-evidence']) : evidence };

package/template_project/.claude/hooks/skill-router.sh

@@ -1818,25 +1818,39 @@ function nativeOperationGoal(domain, actionable, text) {
 // FIRST item of an enumeration ("Do not implement fixes, modify source code, restart services, ...") and
 // the later items became actionable orders (MIXED + service-runtime). English negators now scope to the
 // sentence end (', and'/', or' continue the list; a bare 'and <verb>' or but/then starts a new clause);
-// Vietnamese negators stay clause-local. Noun uses of verbs ("write/verification advisory", "each proposed
+// Vietnamese negators scope to the sentence end as well. Noun uses of verbs ("write/verification advisory", "each proposed
 // fix", "state change") name things, not orders. Neutralised spans become blanks, never new orders.
 const NON_ORDER_VERBS = 'implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|restart|sua|viet|chinh|them|tao|xoa';
 function neutralizeNonOrders(text) {
   return String(text)
     .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|shall\\s+not)\\s+[^.;\\n]*?(?=(?<!,)\\s+(?:and|va)\\s+(?:${NON_ORDER_VERBS})\\b|\\s+(?:but|nhung|then|however)\\b|[.;\\n]|$)`, 'g'), ' ')
+    .replace(new RegExp(`\\b(?:khong|chua)\\s+[^.;\\n]*?(?=\\s+(?:nhung|tuy nhien)\\b|[.;\\n]|$)`, 'g'), ' ')
+    .replace(/"[^"\n]*\s[^"\n]*"|`[^`\n]*\s[^`\n]*`|\u201c[^\u201d\n]*\u201d/g, ' ')
+    .replace(/\b(?:neu\s+(?:phai|can|thieu|khong du|bang chung chua du)|if\s+(?:needed|necessary|required|evidence is insufficient))\b[^.;\n]*/g, ' ')
+    .replace(/[^.;\n]*\b(?:nao|gi|sao|the nao|bao nhieu)\b[^.;\n]*\?/g, ' ')
+    .replace(/\bchinh\s+xac\b|\b(?:phuong an|cach|de xuat|ban)\s+(?:sua|fix)\b/g, ' ')
     .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
     .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
     .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ');
 }
 
 function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
-  const text = neutralizeNonOrders(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/đ/g, 'd').toLowerCase());
+  // A named preflight and both explicit branches are required; a failed arbitrary test is not a release policy.
+  const releaseText = String(promptText).normalize('NFD').replace(/[̀-ͯ]/g, '').replace(/[đĐ]/g, 'd').toLowerCase();
+  const preflight = releaseText.match(/\b(?:yarn\s+release:verify|npm\s+run\s+release:verify)\b/)?.[0];
+  const releasePolicy = preflight && /\b(?:if|neu|only when|only if)\b[^\n.;]*(?:pass|go)\b[^\n.;]*(?:release|publish)\b/.test(releaseText)
+    && /\b(?:fail|no-go)\b[^\n.;]*(?:do not publish|don't publish|no publish|khong publish|khong npm publish)\b/.test(releaseText)
+    ? { kind: 'conditional-release', preflight } : null;
+  const text = neutralizeNonOrders(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[đĐ]/g, 'd').toLowerCase());
   const clauses = text.split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/);
   const actionable = clauses.map((clause) => clause.split(/\bwithout\b/)[0]).filter((clause) => !/\b(?:do not|don't|never|khong|dung)\b/.test(clause)
     && !/^\s*(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(clause));
   const sourceOrder = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause)
     && /\b(?:source|code|logic|scheduler|implementation|ma nguon)\b|\.[cm]?[jt]sx?\b/.test(clause));
   const codeChangeVerb = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause));
+  const reportArtifact = String(promptText).match(/(?:^|\s)((?:docs\/|reports\/)[A-Za-z0-9_./-]+\.(?:md|txt))(?=\s|[.,;:]|$)/)?.[1];
+  const documentation = !sourceOrder && !/\b(?:implement|fix|refactor|modify|edit|update|sua|chinh)\b/.test(actionable.join(' ')) && reportArtifact && actionable.some((clause) => /\b(?:write|create|save|viet|tao|luu)\b/.test(clause))
+    && /\b(?:report|bao cao|analysis|phan tich|document)\b/.test(text);
   const hasOperationId = /\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/.test(text);
   // A cron/job MENTION is not an operation: with a code-change verb in the request, an
   // operation needs a concrete target id; otherwise it is a coding task about scheduling.
@@ -1861,13 +1875,13 @@ function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
   // lookup verb AND no mutation vocabulary anywhere in the request (fail-closed otherwise).
   const mutationWord = /\b(?:implement|fix|refactor|modify|edit|write|update|add|create|build|make|install|deploy|remove|delete|rename|replace|change|sua|viet|chinh|them|tao|xoa|doi|cai|cap nhat)\b/.test(text);
   const statusReport = !mutationWord && !operation && !config
-    && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua)\b/.test(text);
-  const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(text) || statusReport)
+    && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua|da len chua)\b/.test(text);
+  const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|investigate|debug|forensic|root cause|kiem tra|phan tich|dieu tra|doc log|tim hieu)\b/.test(text) || statusReport)
     && !sourceOrder && !codeChangeVerb && !operation && !config;
   const taskKind = operation ? (sourceOrder || (nativeDomain !== 'scheduled-job' && codeChangeVerb) ? 'MIXED' : 'OPERATIONAL')
-    : config ? 'CONFIGURATION' : readOnly ? 'READ_ONLY' : 'CODE_IMPLEMENTATION';
+    : config ? 'CONFIGURATION' : documentation ? 'DOCUMENTATION_OUTPUT' : readOnly ? 'READ_ONLY' : 'CODE_IMPLEMENTATION';
   const id = text.match(/\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/)?.[0] || null;
-  return { taskKind, ...(taskKind === 'READ_ONLY' && statusReport ? { statusReport: true } : {}), ...(config ? { configurationScope: repository ? 'repository' : 'external' } : {}),
+  return { taskKind, ...(releasePolicy ? { releasePolicy } : {}), ...(documentation ? { reportArtifact } : {}), ...(taskKind === 'READ_ONLY' && statusReport ? { statusReport: true } : {}), ...(config ? { configurationScope: repository ? 'repository' : 'external' } : {}),
     ...(operation && nativeDomain !== 'scheduled-job' ? { operationGoal: nativeOperationGoal(nativeDomain, actionable, text) } : {}),
     ...(operation && nativeDomain === 'scheduled-job' ? { operationGoal: { domain: 'scheduled-job', target: id, desiredState: /\b(?:delete|remove|cancel|xoa|huy|absent|removed|deleted|no longer|khong con)\b/.test(actionable.join(' ')) ? 'absent' : 'present',
       completionSemantics: /\b(?:ensure|dam bao)\b/.test(text) ? 'ensure-state' : 'execute-and-verify' } } : {}) };
@@ -1878,7 +1892,7 @@ function applyTaskSemantics(contract, semantic) {
   const operationOnly = semantic.taskKind === 'OPERATIONAL'
     || (semantic.taskKind === 'CONFIGURATION' && semantic.configurationScope === 'external');
   return { ...(contract || {}), ...semantic,
-    completionEvidence: operationOnly ? ['operation-verification']
+    completionEvidence: semantic.taskKind === 'DOCUMENTATION_OUTPUT' ? ['report-artifact'] : operationOnly ? ['operation-verification']
       : semantic.taskKind === 'MIXED' ? [...new Set([...evidence, 'write-evidence', 'operation-verification'])]
         : semantic.taskKind === 'READ_ONLY' && semantic.statusReport ? []
         : semantic.taskKind === 'READ_ONLY' ? (evidence.length === 1 && evidence[0] === 'verification-evidence' ? evidence : ['impact-evidence']) : evidence };
@@ -2238,7 +2252,7 @@ function applyTaskSemantics(contract, semantic) {
     .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|not|khong(?:\\s+duoc)?|tuyet\\s+doi\\s+khong)\\s+(?:${MUT_VERBS})(?![A-Za-z0-9_])(?:\\s*(?:,|,?\\s+(?:or|and|nor|hay|hoac|va))\\s*(?:(?:${MUT_VERBS})(?![A-Za-z0-9_])|(?:${MUT_VERBS})\\s))*[^.,;\\n\u2014]*?(?=\\s+(?:va|and|then|roi|nhung|but)\\s|[.,;\u2014\\n]|\\s*$)`, 'g'), ' ')
       .replace(new RegExp(`\\bgiu\\s+nguyen\\b${TAIL}`, 'g'), ' ')
       .replace(new RegExp(`\\bmuon\\s+giu\\b${TAIL}`, 'g'), ' ')
-      .replace(new RegExp(`\\bkhong\\s+(?!chi\\b)${TAIL}`, 'g'), ' ')
+      .replace(new RegExp(`\\b(?:khong|chua)\\s+(?!chi\\b)${TAIL}`, 'g'), ' ')
       .replace(new RegExp(`\\bdung\\s+${TAIL}`, 'g'), ' ')
       // C89-008: a waiting clause narrates what the TURN waits on, not what
       // the request orders — verbs inside it ("chờ sửa xong", "waiting for
@@ -2312,7 +2326,7 @@ function applyTaskSemantics(contract, semantic) {
     .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|not|khong(?:\\s+duoc)?|tuyet\\s+doi\\s+khong)\\s+(?:${MUT_VERBS})(?![A-Za-z0-9_])(?:\\s*(?:,|,?\\s+(?:or|and|nor|hay|hoac|va))\\s*(?:(?:${MUT_VERBS})(?![A-Za-z0-9_])|(?:${MUT_VERBS})\\s))*[^.,;\\n\u2014]*?(?=\\s+(?:va|and|then|roi|nhung|but)\\s|[.,;\u2014\\n]|\\s*$)`, 'g'), ' ')
       .replace(new RegExp(`\\bgiu\\s+nguyen\\b${TAIL}`, 'g'), ' ')
       .replace(new RegExp(`\\bmuon\\s+giu\\b${TAIL}`, 'g'), ' ')
-      .replace(new RegExp(`\\bkhong\\s+(?!chi\\b)${TAIL}`, 'g'), ' ')
+      .replace(new RegExp(`\\b(?:khong|chua)\\s+(?!chi\\b)${TAIL}`, 'g'), ' ')
       .replace(new RegExp(`\\bdung\\s+${TAIL}`, 'g'), ' ')
       // C89-008: a waiting clause narrates what the TURN waits on, not what
       // the request orders — verbs inside it belong to the wait.

package/template_project/.claude/ukit/index/route-resolver.mjs

@@ -1090,25 +1090,39 @@ function nativeOperationGoal(domain, actionable, text) {
 // FIRST item of an enumeration ("Do not implement fixes, modify source code, restart services, ...") and
 // the later items became actionable orders (MIXED + service-runtime). English negators now scope to the
 // sentence end (', and'/', or' continue the list; a bare 'and <verb>' or but/then starts a new clause);
-// Vietnamese negators stay clause-local. Noun uses of verbs ("write/verification advisory", "each proposed
+// Vietnamese negators scope to the sentence end as well. Noun uses of verbs ("write/verification advisory", "each proposed
 // fix", "state change") name things, not orders. Neutralised spans become blanks, never new orders.
 const NON_ORDER_VERBS = 'implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|restart|sua|viet|chinh|them|tao|xoa';
 function neutralizeNonOrders(text) {
   return String(text)
     .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|shall\\s+not)\\s+[^.;\\n]*?(?=(?<!,)\\s+(?:and|va)\\s+(?:${NON_ORDER_VERBS})\\b|\\s+(?:but|nhung|then|however)\\b|[.;\\n]|$)`, 'g'), ' ')
+    .replace(new RegExp(`\\b(?:khong|chua)\\s+[^.;\\n]*?(?=\\s+(?:nhung|tuy nhien)\\b|[.;\\n]|$)`, 'g'), ' ')
+    .replace(/"[^"\n]*\s[^"\n]*"|`[^`\n]*\s[^`\n]*`|\u201c[^\u201d\n]*\u201d/g, ' ')
+    .replace(/\b(?:neu\s+(?:phai|can|thieu|khong du|bang chung chua du)|if\s+(?:needed|necessary|required|evidence is insufficient))\b[^.;\n]*/g, ' ')
+    .replace(/[^.;\n]*\b(?:nao|gi|sao|the nao|bao nhieu)\b[^.;\n]*\?/g, ' ')
+    .replace(/\bchinh\s+xac\b|\b(?:phuong an|cach|de xuat|ban)\s+(?:sua|fix)\b/g, ' ')
     .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
     .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
     .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ');
 }
 
 export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
-  const text = neutralizeNonOrders(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/đ/g, 'd').toLowerCase());
+  // A named preflight and both explicit branches are required; a failed arbitrary test is not a release policy.
+  const releaseText = String(promptText).normalize('NFD').replace(/[̀-ͯ]/g, '').replace(/[đĐ]/g, 'd').toLowerCase();
+  const preflight = releaseText.match(/\b(?:yarn\s+release:verify|npm\s+run\s+release:verify)\b/)?.[0];
+  const releasePolicy = preflight && /\b(?:if|neu|only when|only if)\b[^\n.;]*(?:pass|go)\b[^\n.;]*(?:release|publish)\b/.test(releaseText)
+    && /\b(?:fail|no-go)\b[^\n.;]*(?:do not publish|don't publish|no publish|khong publish|khong npm publish)\b/.test(releaseText)
+    ? { kind: 'conditional-release', preflight } : null;
+  const text = neutralizeNonOrders(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[đĐ]/g, 'd').toLowerCase());
   const clauses = text.split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/);
   const actionable = clauses.map((clause) => clause.split(/\bwithout\b/)[0]).filter((clause) => !/\b(?:do not|don't|never|khong|dung)\b/.test(clause)
     && !/^\s*(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(clause));
   const sourceOrder = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause)
     && /\b(?:source|code|logic|scheduler|implementation|ma nguon)\b|\.[cm]?[jt]sx?\b/.test(clause));
   const codeChangeVerb = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause));
+  const reportArtifact = String(promptText).match(/(?:^|\s)((?:docs\/|reports\/)[A-Za-z0-9_./-]+\.(?:md|txt))(?=\s|[.,;:]|$)/)?.[1];
+  const documentation = !sourceOrder && !/\b(?:implement|fix|refactor|modify|edit|update|sua|chinh)\b/.test(actionable.join(' ')) && reportArtifact && actionable.some((clause) => /\b(?:write|create|save|viet|tao|luu)\b/.test(clause))
+    && /\b(?:report|bao cao|analysis|phan tich|document)\b/.test(text);
   const hasOperationId = /\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/.test(text);
   // A cron/job MENTION is not an operation: with a code-change verb in the request, an
   // operation needs a concrete target id; otherwise it is a coding task about scheduling.
@@ -1133,13 +1147,13 @@ export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {})
   // lookup verb AND no mutation vocabulary anywhere in the request (fail-closed otherwise).
   const mutationWord = /\b(?:implement|fix|refactor|modify|edit|write|update|add|create|build|make|install|deploy|remove|delete|rename|replace|change|sua|viet|chinh|them|tao|xoa|doi|cai|cap nhat)\b/.test(text);
   const statusReport = !mutationWord && !operation && !config
-    && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua)\b/.test(text);
-  const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(text) || statusReport)
+    && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua|da len chua)\b/.test(text);
+  const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|investigate|debug|forensic|root cause|kiem tra|phan tich|dieu tra|doc log|tim hieu)\b/.test(text) || statusReport)
     && !sourceOrder && !codeChangeVerb && !operation && !config;
   const taskKind = operation ? (sourceOrder || codeChangeVerb ? 'MIXED' : 'OPERATIONAL')
-    : config ? 'CONFIGURATION' : readOnly ? 'READ_ONLY' : 'CODE_IMPLEMENTATION';
+    : config ? 'CONFIGURATION' : documentation ? 'DOCUMENTATION_OUTPUT' : readOnly ? 'READ_ONLY' : 'CODE_IMPLEMENTATION';
   const id = text.match(/\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/)?.[0] || null;
-  return { taskKind, ...(taskKind === 'READ_ONLY' && statusReport ? { statusReport: true } : {}), ...(config ? { configurationScope: repository ? 'repository' : 'external' } : {}),
+  return { taskKind, ...(releasePolicy ? { releasePolicy } : {}), ...(documentation ? { reportArtifact } : {}), ...(taskKind === 'READ_ONLY' && statusReport ? { statusReport: true } : {}), ...(config ? { configurationScope: repository ? 'repository' : 'external' } : {}),
     ...(operation && nativeDomain !== 'scheduled-job' ? { operationGoal: nativeOperationGoal(nativeDomain, actionable, text) } : {}),
     ...(operation && nativeDomain === 'scheduled-job' ? { operationGoal: { domain: 'scheduled-job', target: id, desiredState: /\b(?:delete|remove|cancel|xoa|huy|absent|removed|deleted|no longer|khong con)\b/.test(actionable.join(' ')) ? 'absent' : 'present',
       completionSemantics: /\b(?:ensure|dam bao)\b/.test(text)
@@ -1153,7 +1167,7 @@ export function applyTaskSemantics(contract, semantic) {
   const operationOnly = semantic.taskKind === 'OPERATIONAL'
     || (semantic.taskKind === 'CONFIGURATION' && semantic.configurationScope === 'external');
   return { ...(contract || {}), ...semantic,
-    completionEvidence: operationOnly ? ['operation-verification']
+    completionEvidence: semantic.taskKind === 'DOCUMENTATION_OUTPUT' ? ['report-artifact'] : operationOnly ? ['operation-verification']
       : semantic.taskKind === 'MIXED' ? [...new Set([...evidence, 'write-evidence', 'operation-verification'])]
         : semantic.taskKind === 'READ_ONLY' && semantic.statusReport ? []
         : semantic.taskKind === 'READ_ONLY' ? (evidence.length === 1 && evidence[0] === 'verification-evidence' ? evidence : ['impact-evidence']) : evidence };

package/template_project/.claude/ukit/runtime/cron-operation-adapter.mjs

@@ -140,7 +140,7 @@ export function bashOperationReceipt(rawCommand, response, transportSuccess, goa
 // the registry actually printed a semver. Agent prose is never evidence; the completion gate compares the
 // recorded version with package.json and live Git state before it treats a release as published.
 const NPM_PUBLISH = /^npm\s+publish(?:\s|$)/;
-const NPM_VIEW = /^npm\s+view\s+(\S+?)(?:@\S+)?\s+version(?:\s+2>&1)?\s*$/;
+const NPM_VIEW = /^npm\s+view\s+(\S+?)(?:@\S+)?\s+version(?:\s+--prefer-online)?(?:\s+2>&1)?\s*$/;
 const SEMVER_LINE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 export function releaseReceipt(rawCommand, response, transportSuccess) {
   if (typeof rawCommand !== 'string') return null;

package/template_project/.claude/ukit/runtime/execution-ledger.mjs

@@ -2225,6 +2225,8 @@ function applyReceiptCore(ledger, receipt, { vibecode = false } = {}) {
   if (receipt.kind === 'operation') {
     next.operationBank = foldOperationEvidence(ledger.operationBank, receipt, ledger);
   }
+  if (receipt.releasePreflight) next.releasePreflight = { ...receipt.releasePreflight, sequence: next.receiptSequence };
+  if (receipt.kind === 'write' && receipt.success) next.releasePreflight = null;
   if (receipt.kind === 'source') {
     next.sourceSucceeded = next.sourceSucceeded || receipt.success;
     if (receipt.success && receipt.file) {
@@ -2848,6 +2850,12 @@ export async function recordExecutionReceipt({
     exitCode,
   };
 
+  const policy = routeState?.routeSummary?.executionContract?.releasePolicy;
+  if (toolName === 'Bash' && !bashScope.foreign && policy?.kind === 'conditional-release'
+    && String(toolInput.command || '').trim() === policy.preflight && Number.isInteger(exitCode)) {
+    receipt.releasePreflight = { command: policy.preflight, failed: exitCode !== 0, exitCode,
+      taskInstanceId: routeState.taskInstanceId, workspaceFp };
+  }
   const toolResponse = payload.tool_response ?? payload.tool_output ?? payload.tool_result;
   const nativeGoal = routeState?.routeSummary?.executionContract?.operationGoal;
   const operationReceipt = cronOperationReceipt(toolName, toolInput, toolResponse, success, { sessionId: explicitSessionId(payload), harness })
@@ -2863,6 +2871,14 @@ export async function recordExecutionReceipt({
   } else if (toolName === 'Edit' || toolName === 'Write') {
     receipt.kind = 'write';
     receipt.file = toolInput.file_path || toolInput.path || toolInput.paths?.[0] || null;
+    // External scratch artifacts are not product mutations. Keep them out of write debt/proof entirely;
+    // otherwise a /tmp report resurrects implementation obligations on a read-only investigation.
+    if (typeof receipt.file === 'string') {
+      const relative = path.relative(path.resolve(projectRoot), path.resolve(projectRoot, receipt.file));
+      if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+        return { rejected: true, eventId: null, reason: 'outside-product-workspace' };
+      }
+    }
   } else if (toolName === 'Bash' && !bashScope.foreign && (isVerificationCommand(toolInput.command) || evidence)) {
     // TASK-009 (BL-011): a Bash command carrying an evidence attestation
     // records as a verification receipt even when the command is not a known
@@ -3004,6 +3020,14 @@ function requiredEvidence(state = {}) {
 
 function evidenceSatisfied(evidence, ledger = {}, state = {}, { cwd } = {}) {
   const routeSummary = state?.routeSummary || {};
+  if (evidence === 'report-artifact') {
+    const artifact = routeSummary.executionContract?.reportArtifact;
+    if (!cwd || typeof artifact !== 'string') return false;
+    const target = path.resolve(cwd, artifact);
+    const bank = evidenceBank(ledger, 'bankedWrites');
+    if (bank[evidenceBankKey(artifact)] !== true && bank[evidenceBankKey(target)] !== true) return false;
+    try { return fsSync.statSync(target).isFile() && fsSync.statSync(target).size > 0; } catch { return false; }
+  }
   if (evidence === 'operation-verification') {
     return operationCompletionPolicy(scopedContract(state, ledger), null, withGitAuthority(ledger, cwd))?.complete === true;
   }
@@ -3513,6 +3537,23 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
     const at = missingEvidence.indexOf('impact-evidence');
     if (at !== -1) missingEvidence.splice(at, 1);
   }
+  const releasePolicy = routeSummary.executionContract?.releasePolicy;
+  const preflight = effectiveLedger?.releasePreflight;
+  if (['MIXED', 'OPERATIONAL'].includes(routeSummary.executionContract?.taskKind)
+    && releasePolicy?.kind === 'conditional-release' && preflight?.failed === true
+    && preflight.command === releasePolicy.preflight && preflight.taskInstanceId === state.taskInstanceId
+    && (!preflight.workspaceFp || preflight.workspaceFp === workspaceFingerprint(cwd))
+    && !missingEvidence.some((item) => item !== 'operation-verification' && item !== 'verification-evidence')) {
+    return { continue: false, notify: true, complete: false, outcome: 'blocked',
+      releaseOutcome: 'RELEASE_NO_GO', missingEvidence: [],
+      reason: `RELEASE_NO_GO: owned preflight ${preflight.command} failed (exit ${preflight.exitCode}); publication is prohibited by this task's conditional release policy. No release was completed.` };
+  }
+  if (releasePolicy?.kind === 'conditional-release'
+    && !(preflight?.failed === false && preflight.command === releasePolicy.preflight
+      && preflight.taskInstanceId === state.taskInstanceId
+      && (!preflight.workspaceFp || preflight.workspaceFp === workspaceFingerprint(cwd)))) {
+    missingEvidence.push('release-preflight');
+  }
   const releaseMissing = releasePublicationMissing(state, effectiveLedger, cwd);
   if (releaseMissing) missingEvidence.push(releaseMissing);
   // TASK-009 (BL-011): the bug-fix floor. On a `playbookId: bug-fix` route a
@@ -3731,7 +3772,7 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
 
   const finalAttempt = !vibecode && continuationCount === MAX_CONTINUATIONS - 1;
   const instruction = missingEvidence.includes('release-publication')
-    ? 'The release is not proven published: run `npm publish` once if the registry does not yet serve this version, then confirm with `npm view <package> version` (must equal package.json) and that the release tag dereferences to HEAD (or to an ancestor of HEAD with no shipped change since). Never move the tag. Do not republish a version the registry already serves.'
+    ? 'The release is not proven published: run `npm publish` once if the registry does not yet serve this version, then confirm with `npm view <package> version` (must equal package.json) and that the release tag dereferences to HEAD (or to an ancestor of HEAD with no shipped change since). Never move the tag. Do not republish a version the registry already serves. Accepted evidence: a Bash result of exactly `npm view <package> version` (optionally `2>&1`, optionally after `cd <dir> &&`) that exited 0 and printed a bare semver. Rejected as unproven: the same command behind `| tail/head/cat`, `;`, `||` or inside a compound (a pipeline hides the exit status), dry runs, prose claims. Re-run the bare command once; do not republish.'
     : operationalTask
     ? 'Inspect native mutation receipts and verify the requested operational state; do not fabricate source edits or source-test evidence.'
     : recoveryInstruction(missingEvidence, effectiveLedger, routeSummary, { cwd });
@@ -3770,6 +3811,20 @@ function playbookStopAdvisory({ state = {}, ledger = {} } = {}, result = {}) {
 
 export function evaluateCompletion(args = {}) {
   const result = evaluateCompletionContract(args);
+  // Explain the verdict from the SAME task-scoped snapshot used by the verifier. These are proof summaries,
+  // not an alternative evidence source; a diagnostic must never satisfy or relax an obligation.
+  const owned = effectiveRequestLedger(args.state, args.ledger) || {};
+  const diagnostics = {
+    taskInstanceId: args.state?.taskInstanceId || null,
+    contract: args.state?.routeSummary?.executionContract?.taskKind || args.state?.routeSummary?.taskKind || args.state?.routeSummary?.executionMode || null,
+    unmetObligations: result.missingEvidence || [],
+    acceptedEvidence: result.complete === true || result.missingEvidence?.length
+      ? requiredEvidence(args.state).filter((item) => !(result.missingEvidence || []).includes(item)) : [],
+    observedEvidence: [owned.sourceSucceeded && 'source-read', owned.writeSucceeded && 'write-receipt', owned.verificationSucceeded && 'verification-receipt'].filter(Boolean),
+    rejectedEvidence: args.ledger && owned !== args.ledger ? ['ledger-task-ownership-mismatch'] : [],
+  };
+  result.diagnostics = diagnostics;
+  if (result.reason) result.reason += ` [task=${diagnostics.taskInstanceId || 'unknown'} contract=${diagnostics.contract || 'unknown'} accepted-count=${diagnostics.acceptedEvidence.length} rejected=${diagnostics.rejectedEvidence.join(',') || 'none'}]`;
   try {
     const advisory = playbookStopAdvisory(args, result);
     if (advisory) return { ...result, playbookAdvisory: advisory };

package/template_project/.omp/hooks/pre/ukit-bridge.js

@@ -1176,7 +1176,7 @@ export async function runSessionStop(
     // Command authority (RC-A): same shared phase signal the Claude Stop path uses, so a
     // handoff-create/review session is never pushed toward Edit/Write on omp either.
     const phase = await resolveStopPhase(payload.transcript_path);
-    evaluation = evaluateCompletion({ state, ledger, phase });
+    evaluation = evaluateCompletion({ state, ledger, phase, cwd: projectRoot });
   } catch (error) {
     // BUG-C22-05: fail-closed like the shell gate (continue the turn), but only up
     // to the configured consecutive-crash cap — a persistently broken evaluator