@ngockhoale/ukit 3.4.45 → 3.4.47

package/src/diagnostics/ompStallSnapshot.js

@@ -0,0 +1,199 @@
+// Development-only incident capture: bounded metadata, no session control or payload persistence.
+import fs from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { spawn } from 'node:child_process';
+
+const ID_PATTERN = /^[\w.:/-]{1,120}$/;
+const id = (value) => typeof value === 'string' && ID_PATTERN.test(value) ? value : null;
+const time = (value) => Number.isFinite(Date.parse(value)) ? new Date(value).toISOString() : null;
+
+
+export async function runBoundedProcess(command, args = [], { timeoutMs = 650, maxBuffer = 65536 } = {}) {
+  return new Promise((resolve) => {
+    let settled = false;
+    let timedOut = false;
+    let oversized = false;
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    const stdout = [];
+    const stderr = [];
+    let timer;
+    const finish = (result) => { if (!settled) { settled = true; clearTimeout(timer); resolve(result); } };
+    let child;
+    try { child = spawn(command, args, { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true }); }
+    catch (error) { resolve({ ok: false, errorCode: error.code || 'UNKNOWN', stdout: '', stderr: '' }); return; }
+    timer = setTimeout(() => { timedOut = true; child.kill('SIGKILL'); }, Math.max(1, timeoutMs));
+    const collect = (chunks, field) => (chunk) => {
+      const next = field === 'stdout' ? stdoutBytes + chunk.length : stderrBytes + chunk.length;
+      if (next + (field === 'stdout' ? stderrBytes : stdoutBytes) > maxBuffer) { oversized = true; child.kill('SIGKILL'); return; }
+      chunks.push(chunk);
+      if (field === 'stdout') stdoutBytes = next; else stderrBytes = next;
+    };
+    child.stdout.on('data', collect(stdout, 'stdout'));
+    child.stderr.on('data', collect(stderr, 'stderr'));
+    child.on('error', (error) => finish({ ok: false, errorCode: error.code || 'UNKNOWN', stdout: '', stderr: '' }));
+    child.on('close', (code) => finish({ ok: !timedOut && !oversized && code === 0,
+      errorCode: timedOut ? 'ETIMEDOUT' : oversized ? 'MAXBUFFER' : code === 0 ? null : 'EXIT_NONZERO',
+      exitCode: code, stdout: Buffer.concat(stdout).toString('utf8'), stderr: Buffer.concat(stderr).toString('utf8') }));
+  });
+}
+
+export async function readBoundedTail(file, { maxBytes = 262144 } = {}) {
+  const cap = Math.max(1, Math.min(1048576, maxBytes));
+  const handle = await fs.open(file, constants.O_RDONLY | (constants.O_NONBLOCK || 0) | (constants.O_NOFOLLOW || 0));
+  try {
+    const stat = await handle.stat();
+    if (!stat.isFile()) throw new Error('capture requires a regular file');
+    const size = Math.min(cap, stat.size);
+    const buffer = Buffer.alloc(size);
+    const { bytesRead } = await handle.read(buffer, 0, size, Math.max(0, stat.size - size));
+    let text = buffer.subarray(0, bytesRead).toString('utf8');
+    const truncated = stat.size > size;
+    if (truncated) text = text.includes('\n') ? text.slice(text.indexOf('\n') + 1) : '';
+    return { text, bytesRead, truncated, size: stat.size, modifiedAt: stat.mtimeMs };
+  } finally { await handle.close(); }
+}
+
+const operationKinds = ['model', 'tool', 'hook', 'subagent'];
+const activeStates = new Set(['started', 'running', 'pending', 'waiting']);
+const terminalStates = new Set(['completed', 'finished', 'failed', 'stopped', 'cancelled']);
+export function processInventoryCommand(platform) {
+  return platform === 'win32' ? ['tasklist', ['/FO', 'CSV', '/NH']]
+    : ['ps', ['-A', '-o', 'pid=,ppid=,stat=,etime=,comm=']];
+}
+
+export function parseProcessInventory(platform, text) {
+  if (platform === 'win32') return text.split(/\r?\n/).flatMap((line) => {
+    const fields = line.match(/"(?:[^"]|"")*"|[^,]+/g) || [];
+    const name = fields[0]?.replace(/^"|"$/g, '').replace(/""/g, '"');
+    const pid = Number(fields[1]?.replaceAll('"', ''));
+    return Number.isSafeInteger(pid) && pid > 0 ? [{ pid, name: (name || '').split(/[\\/]/).at(-1) }] : [];
+  });
+  return text.split('\n').flatMap((line) => {
+    const match = line.match(/^\s*(\d+)\s+(\d+)\s+(\S+)\s+(\S+)\s+(.+)$/);
+    return match ? [{ pid: Number(match[1]), name: match[5].trim().split(/[\\/]/).at(-1) }] : [];
+  });
+}
+
+export function parseOwnerPids(command, text) {
+  const values = command === 'fuser' ? (text.match(/:\s*([^\r\n]+)/g) || []).flatMap((line) => line.slice(line.indexOf(':') + 1).trim().split(/\s+/).map((token) => token.match(/^(\d+)[A-Za-z]*$/)?.[1]).filter(Boolean))
+    : (text.match(/\b\d+\b/g) || []);
+  return [...new Set(values.map(Number).filter((pid) => Number.isSafeInteger(pid) && pid > 0))];
+}
+
+export function classifySessionActivity({ association = 'NOT_OBSERVABLE', summary = null, now = Date.now(), idleMs = 120000 } = {}) {
+  if (summary?.operatorBlock === 'OBSERVED_BLOCK') return 'OPERATOR_BLOCK';
+  if (summary?.sessionState === 'STOPPED') return 'STOPPED';
+  if (association !== 'ACTIVE_OWNER' || !summary) return 'NOT_OBSERVABLE';
+  const progressAge = Number.isFinite(summary.lastProgressAt) ? Math.max(0, now - summary.lastProgressAt) : null;
+  const outputAge = Number.isFinite(summary.lastOutputAt) ? Math.max(0, now - summary.lastOutputAt) : null;
+  const pending = summary.pendingOperations || {};
+  if (progressAge === null) return 'NOT_OBSERVABLE';
+  if (progressAge >= idleMs) return 'SUSPECTED_STALL';
+  if (Object.values(pending).some((items) => Array.isArray(items) && items.length > 0)
+    && Object.entries(pending).some(([kind, items]) => items.length > 0 && summary.operationObservability?.[kind] === 'OBSERVED')) return 'WAITING';
+  if (outputAge !== null && outputAge >= idleMs) return 'NO_OUTPUT';
+  return 'ACTIVE_PROGRESS';
+}
+
+
+export function summarizeSessionTail(text) {
+  const result = { sessionId: null, modelAlias: 'NOT_OBSERVABLE', resolvedRoute: 'NOT_OBSERVABLE', currentTurn: 'NOT_OBSERVABLE', lastCompletedTurn: 'NOT_OBSERVABLE',
+    pendingModelRequest: 'NOT_OBSERVABLE', lastChunk: 'NOT_OBSERVABLE', terminalEvent: 'NOT_OBSERVABLE', pendingTools: [], unmatchedToolCallCandidates: [], pendingSubagent: 'NOT_OBSERVABLE',
+    pendingOperations: { model: [], tool: [], hook: [], subagent: [] }, operationObservability: { model: 'NOT_OBSERVABLE', tool: 'NOT_OBSERVABLE', hook: 'NOT_OBSERVABLE', subagent: 'NOT_OBSERVABLE' },
+    operatorBlock: 'NOT_OBSERVABLE', turnState: 'NOT_OBSERVABLE', sessionState: 'NOT_OBSERVABLE', compaction: 'NOT_OBSERVABLE', stopContinuation: 'NOT_OBSERVABLE',
+    lastProgressAt: 'NOT_OBSERVABLE', lastOutputAt: 'NOT_OBSERVABLE', outputState: 'NOT_OBSERVABLE' };
+  const operations = Object.fromEntries(operationKinds.map((kind) => [kind, new Map()]));
+  const tools = new Map();
+  const observedOperations = new Set();
+  const operatorBlocks = new Map();
+  for (const line of text.split('\n')) {
+    let row;
+    try { row = JSON.parse(line); } catch { continue; }
+    const ts = time(row.timestamp);
+    if (ts) result.lastProgressAt = Date.parse(ts);
+    if (row.type === 'session' && id(row.id)) { result.sessionId = id(row.id); result.sessionIdentityObserved = true; }
+    if (row.type === 'compaction') result.compaction = { timestamp: ts, id: id(row.id), tokensBefore: Number.isFinite(row.tokensBefore) ? row.tokensBefore : null };
+    if (row.type === 'session_end' || row.type === 'session_stopped') result.sessionState = 'STOPPED';
+
+    if (row.type === 'operation' && operationKinds.includes(row.operation) && id(row.id)) {
+      observedOperations.add(row.operation);
+      const state = typeof row.state === 'string' ? row.state.toLowerCase() : '';
+      if (activeStates.has(state)) operations[row.operation].set(row.id, { id: row.id, ...(id(row.name) ? { name: id(row.name) } : {}) });
+      if (terminalStates.has(state)) operations[row.operation].delete(row.id);
+    }
+    const eventState = String(row.state || '').toLowerCase();
+    if (row.type === 'operator_block' || row.operation === 'operator') {
+      const key = id(row.id) || `block-${operatorBlocks.size}`;
+      if (['pending', 'blocked', 'waiting'].includes(eventState)) operatorBlocks.set(key, { id: id(row.id), state: 'BLOCKED' });
+      if (terminalStates.has(eventState) || ['unblocked', 'cleared'].includes(eventState)) operatorBlocks.delete(key);
+    }
+
+    const message = row.message;
+    if (!message) continue;
+    if (message.role === 'toolResult' && id(message.toolCallId)) tools.delete(message.toolCallId);
+    if (message.role !== 'assistant') continue;
+    result.modelAlias = { provider: id(message.provider), model: id(message.model) };
+    if (message.stopReason) {
+      const stopReason = ['stop', 'toolUse', 'error', 'aborted', 'length'].includes(message.stopReason) ? message.stopReason : 'other';
+      result.lastCompletedTurn = { id: id(row.id), timestamp: ts, stopReason };
+      result.terminalEvent = stopReason;
+      result.turnState = message.stopReason === 'aborted' ? 'TURN_ABORTED' : message.stopReason === 'error' ? 'TURN_ERROR' : 'TURN_COMPLETED';
+    }
+    if (Array.isArray(message.content)) {
+      for (const part of message.content) {
+        if (part.type === 'toolCall' && id(part.id)) tools.set(part.id, { id: id(part.id), name: id(part.name) });
+        if (part.type === 'text' && ts) {
+          result.lastOutputAt = Date.parse(ts);
+          result.outputState = 'OBSERVED_OUTPUT';
+        }
+      }
+    }
+  }
+  result.unmatchedToolCallCandidates = [...tools.values()].slice(-32);
+  result.pendingOperations = Object.fromEntries(operationKinds.map((kind) => [kind, [...operations[kind].values()].slice(-32)]));
+  result.pendingTools = result.pendingOperations.tool;
+  result.operationObservability = Object.fromEntries(operationKinds.map((kind) => [kind, observedOperations.has(kind) || (kind === 'tool' && tools.size > 0) ? 'OBSERVED' : 'NOT_OBSERVABLE']));
+  result.pendingModelRequest = result.operationObservability.model === 'OBSERVED' ? (result.pendingOperations.model.length ? 'OBSERVED_PENDING_EVENT' : 'NO_PENDING_EVENT_OBSERVED') : 'NOT_OBSERVABLE';
+  result.pendingSubagent = result.operationObservability.subagent === 'OBSERVED' ? (result.pendingOperations.subagent.length ? 'OBSERVED_PENDING_EVENT' : 'NO_PENDING_EVENT_OBSERVED') : 'NOT_OBSERVABLE';
+  result.operatorBlock = operatorBlocks.size ? 'OBSERVED_BLOCK' : 'NOT_OBSERVABLE';
+  return result;
+}
+
+export function associateSessionEvidence({ sessions = [], ownerLocks = {}, processInventory = { state: 'NOT_OBSERVABLE', processes: [] }, logs = [] } = {}) {
+  const sessionCounts = new Map();
+  for (const session of sessions) if (id(session.sessionId)) sessionCounts.set(session.sessionId, (sessionCounts.get(session.sessionId) || 0) + 1);
+  return sessions.map((session) => {
+    const sessionId = id(session.sessionId);
+    const lock = sessionId ? ownerLocks[sessionId] : null;
+    const lockState = lock?.state || 'NOT_OBSERVABLE';
+    const pids = lockState === 'OBSERVED' && Array.isArray(lock.pids) ? [...new Set(lock.pids.filter((pid) => Number.isSafeInteger(pid) && pid > 0))] : [];
+    const uniqueOwnerPid = pids.length === 1 ? pids[0] : null;
+    const duplicateSession = sessionId !== null && sessionCounts.get(sessionId) > 1;
+    const process = uniqueOwnerPid !== null && processInventory.state === 'OBSERVED'
+      ? processInventory.processes.find((entry) => entry.pid === uniqueOwnerPid && /^omp(?:\.exe)?$/i.test(entry.name)) || null : null;
+    const processAssociation = duplicateSession ? 'AMBIGUOUS_TRANSCRIPT' : pids.length > 1 ? 'AMBIGUOUS_OWNER_LOCK'
+      : uniqueOwnerPid === null ? (lockState === 'NOT_OBSERVABLE' ? 'NOT_OBSERVABLE' : 'UNHELD')
+        : processInventory.state !== 'OBSERVED' ? 'NOT_OBSERVABLE' : process ? 'VERIFIED' : 'PID_NOT_FOUND';
+    const ownerPid = duplicateSession ? null : uniqueOwnerPid;
+    const identityVerified = session?.sessionIdentityObserved === true || session?.sourceCoverage?.sessionIdentityObserved === true;
+    const ompLog = ownerPid === null ? null : logs.find((entry) => entry.pid === ownerPid) || null;
+    const logAssociation = ownerPid === null ? 'NOT_OBSERVABLE' : ompLog ? 'VERIFIED' : 'NOT_OBSERVABLE';
+    return { sessionId, transcript: typeof session.transcriptPath === 'string' ? session.transcriptPath.split(/[\\/]/).at(-1) : null,
+      sessionAssociation: identityVerified && processAssociation === 'VERIFIED' && logAssociation === 'VERIFIED' ? 'ACTIVE_OWNER' : 'NOT_OBSERVABLE',
+      ownerLockState: duplicateSession ? 'AMBIGUOUS_TRANSCRIPT' : lockState, ownerPid, processAssociation, logAssociation, identityVerified,
+      process: process ? { pid: process.pid, name: id(process.name) } : null, ompLog };
+  });
+}
+
+export function buildStallSnapshot({ now = Date.now(), lastProgressAt = null, lastOutputAt = null, idleMs = 120000, executionState = 'NOT_OBSERVABLE', ...evidence } = {}) {
+  const age = (ts) => Number.isFinite(ts) ? Math.max(0, now - ts) : null;
+  const progressAgeMs = age(lastProgressAt);
+  const outputAgeMs = age(lastOutputAt);
+  const activity = evidence.activity || (executionState === 'NO_EXECUTION' ? 'NO_EXECUTION'
+    : executionState !== 'EXECUTING' ? 'NOT_OBSERVABLE'
+      : progressAgeMs === null ? 'NOT_OBSERVABLE' : progressAgeMs >= idleMs ? 'NO_OBSERVED_PROGRESS'
+        : outputAgeMs !== null && outputAgeMs >= idleMs ? 'NO_OUTPUT' : 'RECENT_PROGRESS');
+  return { schemaVersion: 1, capturedAt: new Date(now).toISOString(), verdict: 'INSUFFICIENT_EVIDENCE', activity,
+    executionState, progressAgeMs, outputAgeMs, ...evidence };
+}

package/template_project/.claude/hooks/skill-router.sh

@@ -1818,25 +1818,39 @@ function nativeOperationGoal(domain, actionable, text) {
 // FIRST item of an enumeration ("Do not implement fixes, modify source code, restart services, ...") and
 // the later items became actionable orders (MIXED + service-runtime). English negators now scope to the
 // sentence end (', and'/', or' continue the list; a bare 'and <verb>' or but/then starts a new clause);
-// Vietnamese negators stay clause-local. Noun uses of verbs ("write/verification advisory", "each proposed
+// Vietnamese negators scope to the sentence end as well. Noun uses of verbs ("write/verification advisory", "each proposed
 // fix", "state change") name things, not orders. Neutralised spans become blanks, never new orders.
 const NON_ORDER_VERBS = 'implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|restart|sua|viet|chinh|them|tao|xoa';
 function neutralizeNonOrders(text) {
   return String(text)
     .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|shall\\s+not)\\s+[^.;\\n]*?(?=(?<!,)\\s+(?:and|va)\\s+(?:${NON_ORDER_VERBS})\\b|\\s+(?:but|nhung|then|however)\\b|[.;\\n]|$)`, 'g'), ' ')
+    .replace(new RegExp(`\\b(?:khong|chua)\\s+[^.;\\n]*?(?=\\s+(?:nhung|tuy nhien)\\b|[.;\\n]|$)`, 'g'), ' ')
+    .replace(/"[^"\n]*\s[^"\n]*"|`[^`\n]*\s[^`\n]*`|\u201c[^\u201d\n]*\u201d/g, ' ')
+    .replace(/\b(?:neu\s+(?:phai|can|thieu|khong du|bang chung chua du)|if\s+(?:needed|necessary|required|evidence is insufficient))\b[^.;\n]*/g, ' ')
+    .replace(/[^.;\n]*\b(?:nao|gi|sao|the nao|bao nhieu)\b[^.;\n]*\?/g, ' ')
+    .replace(/\bchinh\s+xac\b|\b(?:phuong an|cach|de xuat|ban)\s+(?:sua|fix)\b/g, ' ')
     .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
     .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
     .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ');
 }
 
 function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
-  const text = neutralizeNonOrders(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/đ/g, 'd').toLowerCase());
+  // A named preflight and both explicit branches are required; a failed arbitrary test is not a release policy.
+  const releaseText = String(promptText).normalize('NFD').replace(/[̀-ͯ]/g, '').replace(/[đĐ]/g, 'd').toLowerCase();
+  const preflight = releaseText.match(/\b(?:yarn\s+release:verify|npm\s+run\s+release:verify)\b/)?.[0];
+  const releasePolicy = preflight && /\b(?:if|neu|only when|only if)\b[^\n.;]*(?:pass|go)\b[^\n.;]*(?:release|publish)\b/.test(releaseText)
+    && /\b(?:fail|no-go)\b[^\n.;]*(?:do not publish|don't publish|no publish|khong publish|khong npm publish)\b/.test(releaseText)
+    ? { kind: 'conditional-release', preflight } : null;
+  const text = neutralizeNonOrders(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[đĐ]/g, 'd').toLowerCase());
   const clauses = text.split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/);
   const actionable = clauses.map((clause) => clause.split(/\bwithout\b/)[0]).filter((clause) => !/\b(?:do not|don't|never|khong|dung)\b/.test(clause)
     && !/^\s*(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(clause));
   const sourceOrder = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause)
     && /\b(?:source|code|logic|scheduler|implementation|ma nguon)\b|\.[cm]?[jt]sx?\b/.test(clause));
   const codeChangeVerb = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause));
+  const reportArtifact = String(promptText).match(/(?:^|\s)((?:docs\/|reports\/)[A-Za-z0-9_./-]+\.(?:md|txt))(?=\s|[.,;:]|$)/)?.[1];
+  const documentation = !sourceOrder && !/\b(?:implement|fix|refactor|modify|edit|update|sua|chinh)\b/.test(actionable.join(' ')) && reportArtifact && actionable.some((clause) => /\b(?:write|create|save|viet|tao|luu)\b/.test(clause))
+    && /\b(?:report|bao cao|analysis|phan tich|document)\b/.test(text);
   const hasOperationId = /\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/.test(text);
   // A cron/job MENTION is not an operation: with a code-change verb in the request, an
   // operation needs a concrete target id; otherwise it is a coding task about scheduling.
@@ -1861,13 +1875,13 @@ function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
   // lookup verb AND no mutation vocabulary anywhere in the request (fail-closed otherwise).
   const mutationWord = /\b(?:implement|fix|refactor|modify|edit|write|update|add|create|build|make|install|deploy|remove|delete|rename|replace|change|sua|viet|chinh|them|tao|xoa|doi|cai|cap nhat)\b/.test(text);
   const statusReport = !mutationWord && !operation && !config
-    && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua)\b/.test(text);
-  const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(text) || statusReport)
+    && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua|da len chua)\b/.test(text);
+  const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|investigate|debug|forensic|root cause|kiem tra|phan tich|dieu tra|doc log|tim hieu)\b/.test(text) || statusReport)
     && !sourceOrder && !codeChangeVerb && !operation && !config;
   const taskKind = operation ? (sourceOrder || (nativeDomain !== 'scheduled-job' && codeChangeVerb) ? 'MIXED' : 'OPERATIONAL')
-    : config ? 'CONFIGURATION' : readOnly ? 'READ_ONLY' : 'CODE_IMPLEMENTATION';
+    : config ? 'CONFIGURATION' : documentation ? 'DOCUMENTATION_OUTPUT' : readOnly ? 'READ_ONLY' : 'CODE_IMPLEMENTATION';
   const id = text.match(/\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/)?.[0] || null;
-  return { taskKind, ...(taskKind === 'READ_ONLY' && statusReport ? { statusReport: true } : {}), ...(config ? { configurationScope: repository ? 'repository' : 'external' } : {}),
+  return { taskKind, ...(releasePolicy ? { releasePolicy } : {}), ...(documentation ? { reportArtifact } : {}), ...(taskKind === 'READ_ONLY' && statusReport ? { statusReport: true } : {}), ...(config ? { configurationScope: repository ? 'repository' : 'external' } : {}),
     ...(operation && nativeDomain !== 'scheduled-job' ? { operationGoal: nativeOperationGoal(nativeDomain, actionable, text) } : {}),
     ...(operation && nativeDomain === 'scheduled-job' ? { operationGoal: { domain: 'scheduled-job', target: id, desiredState: /\b(?:delete|remove|cancel|xoa|huy|absent|removed|deleted|no longer|khong con)\b/.test(actionable.join(' ')) ? 'absent' : 'present',
       completionSemantics: /\b(?:ensure|dam bao)\b/.test(text) ? 'ensure-state' : 'execute-and-verify' } } : {}) };
@@ -1878,7 +1892,7 @@ function applyTaskSemantics(contract, semantic) {
   const operationOnly = semantic.taskKind === 'OPERATIONAL'
     || (semantic.taskKind === 'CONFIGURATION' && semantic.configurationScope === 'external');
   return { ...(contract || {}), ...semantic,
-    completionEvidence: operationOnly ? ['operation-verification']
+    completionEvidence: semantic.taskKind === 'DOCUMENTATION_OUTPUT' ? ['report-artifact'] : operationOnly ? ['operation-verification']
       : semantic.taskKind === 'MIXED' ? [...new Set([...evidence, 'write-evidence', 'operation-verification'])]
         : semantic.taskKind === 'READ_ONLY' && semantic.statusReport ? []
         : semantic.taskKind === 'READ_ONLY' ? (evidence.length === 1 && evidence[0] === 'verification-evidence' ? evidence : ['impact-evidence']) : evidence };
@@ -2238,7 +2252,7 @@ function applyTaskSemantics(contract, semantic) {
     .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|not|khong(?:\\s+duoc)?|tuyet\\s+doi\\s+khong)\\s+(?:${MUT_VERBS})(?![A-Za-z0-9_])(?:\\s*(?:,|,?\\s+(?:or|and|nor|hay|hoac|va))\\s*(?:(?:${MUT_VERBS})(?![A-Za-z0-9_])|(?:${MUT_VERBS})\\s))*[^.,;\\n\u2014]*?(?=\\s+(?:va|and|then|roi|nhung|but)\\s|[.,;\u2014\\n]|\\s*$)`, 'g'), ' ')
       .replace(new RegExp(`\\bgiu\\s+nguyen\\b${TAIL}`, 'g'), ' ')
       .replace(new RegExp(`\\bmuon\\s+giu\\b${TAIL}`, 'g'), ' ')
-      .replace(new RegExp(`\\bkhong\\s+(?!chi\\b)${TAIL}`, 'g'), ' ')
+      .replace(new RegExp(`\\b(?:khong|chua)\\s+(?!chi\\b)${TAIL}`, 'g'), ' ')
       .replace(new RegExp(`\\bdung\\s+${TAIL}`, 'g'), ' ')
       // C89-008: a waiting clause narrates what the TURN waits on, not what
       // the request orders — verbs inside it ("chờ sửa xong", "waiting for
@@ -2312,7 +2326,7 @@ function applyTaskSemantics(contract, semantic) {
     .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|not|khong(?:\\s+duoc)?|tuyet\\s+doi\\s+khong)\\s+(?:${MUT_VERBS})(?![A-Za-z0-9_])(?:\\s*(?:,|,?\\s+(?:or|and|nor|hay|hoac|va))\\s*(?:(?:${MUT_VERBS})(?![A-Za-z0-9_])|(?:${MUT_VERBS})\\s))*[^.,;\\n\u2014]*?(?=\\s+(?:va|and|then|roi|nhung|but)\\s|[.,;\u2014\\n]|\\s*$)`, 'g'), ' ')
       .replace(new RegExp(`\\bgiu\\s+nguyen\\b${TAIL}`, 'g'), ' ')
       .replace(new RegExp(`\\bmuon\\s+giu\\b${TAIL}`, 'g'), ' ')
-      .replace(new RegExp(`\\bkhong\\s+(?!chi\\b)${TAIL}`, 'g'), ' ')
+      .replace(new RegExp(`\\b(?:khong|chua)\\s+(?!chi\\b)${TAIL}`, 'g'), ' ')
       .replace(new RegExp(`\\bdung\\s+${TAIL}`, 'g'), ' ')
       // C89-008: a waiting clause narrates what the TURN waits on, not what
       // the request orders — verbs inside it belong to the wait.

package/template_project/.claude/ukit/index/route-resolver.mjs

@@ -1090,25 +1090,39 @@ function nativeOperationGoal(domain, actionable, text) {
 // FIRST item of an enumeration ("Do not implement fixes, modify source code, restart services, ...") and
 // the later items became actionable orders (MIXED + service-runtime). English negators now scope to the
 // sentence end (', and'/', or' continue the list; a bare 'and <verb>' or but/then starts a new clause);
-// Vietnamese negators stay clause-local. Noun uses of verbs ("write/verification advisory", "each proposed
+// Vietnamese negators scope to the sentence end as well. Noun uses of verbs ("write/verification advisory", "each proposed
 // fix", "state change") name things, not orders. Neutralised spans become blanks, never new orders.
 const NON_ORDER_VERBS = 'implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|restart|sua|viet|chinh|them|tao|xoa';
 function neutralizeNonOrders(text) {
   return String(text)
     .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|shall\\s+not)\\s+[^.;\\n]*?(?=(?<!,)\\s+(?:and|va)\\s+(?:${NON_ORDER_VERBS})\\b|\\s+(?:but|nhung|then|however)\\b|[.;\\n]|$)`, 'g'), ' ')
+    .replace(new RegExp(`\\b(?:khong|chua)\\s+[^.;\\n]*?(?=\\s+(?:nhung|tuy nhien)\\b|[.;\\n]|$)`, 'g'), ' ')
+    .replace(/"[^"\n]*\s[^"\n]*"|`[^`\n]*\s[^`\n]*`|\u201c[^\u201d\n]*\u201d/g, ' ')
+    .replace(/\b(?:neu\s+(?:phai|can|thieu|khong du|bang chung chua du)|if\s+(?:needed|necessary|required|evidence is insufficient))\b[^.;\n]*/g, ' ')
+    .replace(/[^.;\n]*\b(?:nao|gi|sao|the nao|bao nhieu)\b[^.;\n]*\?/g, ' ')
+    .replace(/\bchinh\s+xac\b|\b(?:phuong an|cach|de xuat|ban)\s+(?:sua|fix)\b/g, ' ')
     .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
     .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
     .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ');
 }
 
 export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
-  const text = neutralizeNonOrders(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/đ/g, 'd').toLowerCase());
+  // A named preflight and both explicit branches are required; a failed arbitrary test is not a release policy.
+  const releaseText = String(promptText).normalize('NFD').replace(/[̀-ͯ]/g, '').replace(/[đĐ]/g, 'd').toLowerCase();
+  const preflight = releaseText.match(/\b(?:yarn\s+release:verify|npm\s+run\s+release:verify)\b/)?.[0];
+  const releasePolicy = preflight && /\b(?:if|neu|only when|only if)\b[^\n.;]*(?:pass|go)\b[^\n.;]*(?:release|publish)\b/.test(releaseText)
+    && /\b(?:fail|no-go)\b[^\n.;]*(?:do not publish|don't publish|no publish|khong publish|khong npm publish)\b/.test(releaseText)
+    ? { kind: 'conditional-release', preflight } : null;
+  const text = neutralizeNonOrders(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[đĐ]/g, 'd').toLowerCase());
   const clauses = text.split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/);
   const actionable = clauses.map((clause) => clause.split(/\bwithout\b/)[0]).filter((clause) => !/\b(?:do not|don't|never|khong|dung)\b/.test(clause)
     && !/^\s*(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(clause));
   const sourceOrder = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause)
     && /\b(?:source|code|logic|scheduler|implementation|ma nguon)\b|\.[cm]?[jt]sx?\b/.test(clause));
   const codeChangeVerb = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause));
+  const reportArtifact = String(promptText).match(/(?:^|\s)((?:docs\/|reports\/)[A-Za-z0-9_./-]+\.(?:md|txt))(?=\s|[.,;:]|$)/)?.[1];
+  const documentation = !sourceOrder && !/\b(?:implement|fix|refactor|modify|edit|update|sua|chinh)\b/.test(actionable.join(' ')) && reportArtifact && actionable.some((clause) => /\b(?:write|create|save|viet|tao|luu)\b/.test(clause))
+    && /\b(?:report|bao cao|analysis|phan tich|document)\b/.test(text);
   const hasOperationId = /\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/.test(text);
   // A cron/job MENTION is not an operation: with a code-change verb in the request, an
   // operation needs a concrete target id; otherwise it is a coding task about scheduling.
@@ -1133,13 +1147,13 @@ export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {})
   // lookup verb AND no mutation vocabulary anywhere in the request (fail-closed otherwise).
   const mutationWord = /\b(?:implement|fix|refactor|modify|edit|write|update|add|create|build|make|install|deploy|remove|delete|rename|replace|change|sua|viet|chinh|them|tao|xoa|doi|cai|cap nhat)\b/.test(text);
   const statusReport = !mutationWord && !operation && !config
-    && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua)\b/.test(text);
-  const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(text) || statusReport)
+    && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua|da len chua)\b/.test(text);
+  const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|investigate|debug|forensic|root cause|kiem tra|phan tich|dieu tra|doc log|tim hieu)\b/.test(text) || statusReport)
     && !sourceOrder && !codeChangeVerb && !operation && !config;
   const taskKind = operation ? (sourceOrder || codeChangeVerb ? 'MIXED' : 'OPERATIONAL')
-    : config ? 'CONFIGURATION' : readOnly ? 'READ_ONLY' : 'CODE_IMPLEMENTATION';
+    : config ? 'CONFIGURATION' : documentation ? 'DOCUMENTATION_OUTPUT' : readOnly ? 'READ_ONLY' : 'CODE_IMPLEMENTATION';
   const id = text.match(/\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/)?.[0] || null;
-  return { taskKind, ...(taskKind === 'READ_ONLY' && statusReport ? { statusReport: true } : {}), ...(config ? { configurationScope: repository ? 'repository' : 'external' } : {}),
+  return { taskKind, ...(releasePolicy ? { releasePolicy } : {}), ...(documentation ? { reportArtifact } : {}), ...(taskKind === 'READ_ONLY' && statusReport ? { statusReport: true } : {}), ...(config ? { configurationScope: repository ? 'repository' : 'external' } : {}),
     ...(operation && nativeDomain !== 'scheduled-job' ? { operationGoal: nativeOperationGoal(nativeDomain, actionable, text) } : {}),
     ...(operation && nativeDomain === 'scheduled-job' ? { operationGoal: { domain: 'scheduled-job', target: id, desiredState: /\b(?:delete|remove|cancel|xoa|huy|absent|removed|deleted|no longer|khong con)\b/.test(actionable.join(' ')) ? 'absent' : 'present',
       completionSemantics: /\b(?:ensure|dam bao)\b/.test(text)
@@ -1153,7 +1167,7 @@ export function applyTaskSemantics(contract, semantic) {
   const operationOnly = semantic.taskKind === 'OPERATIONAL'
     || (semantic.taskKind === 'CONFIGURATION' && semantic.configurationScope === 'external');
   return { ...(contract || {}), ...semantic,
-    completionEvidence: operationOnly ? ['operation-verification']
+    completionEvidence: semantic.taskKind === 'DOCUMENTATION_OUTPUT' ? ['report-artifact'] : operationOnly ? ['operation-verification']
       : semantic.taskKind === 'MIXED' ? [...new Set([...evidence, 'write-evidence', 'operation-verification'])]
         : semantic.taskKind === 'READ_ONLY' && semantic.statusReport ? []
         : semantic.taskKind === 'READ_ONLY' ? (evidence.length === 1 && evidence[0] === 'verification-evidence' ? evidence : ['impact-evidence']) : evidence };

package/template_project/.claude/ukit/runtime/cron-operation-adapter.mjs

@@ -140,7 +140,7 @@ export function bashOperationReceipt(rawCommand, response, transportSuccess, goa
 // the registry actually printed a semver. Agent prose is never evidence; the completion gate compares the
 // recorded version with package.json and live Git state before it treats a release as published.
 const NPM_PUBLISH = /^npm\s+publish(?:\s|$)/;
-const NPM_VIEW = /^npm\s+view\s+(\S+?)(?:@\S+)?\s+version(?:\s+2>&1)?\s*$/;
+const NPM_VIEW = /^npm\s+view\s+(\S+?)(?:@\S+)?\s+version(?:\s+--prefer-online)?(?:\s+2>&1)?\s*$/;
 const SEMVER_LINE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 export function releaseReceipt(rawCommand, response, transportSuccess) {
   if (typeof rawCommand !== 'string') return null;

package/template_project/.claude/ukit/runtime/execution-ledger.mjs

@@ -2225,6 +2225,8 @@ function applyReceiptCore(ledger, receipt, { vibecode = false } = {}) {
   if (receipt.kind === 'operation') {
     next.operationBank = foldOperationEvidence(ledger.operationBank, receipt, ledger);
   }
+  if (receipt.releasePreflight) next.releasePreflight = { ...receipt.releasePreflight, sequence: next.receiptSequence };
+  if (receipt.kind === 'write' && receipt.success) next.releasePreflight = null;
   if (receipt.kind === 'source') {
     next.sourceSucceeded = next.sourceSucceeded || receipt.success;
     if (receipt.success && receipt.file) {
@@ -2848,6 +2850,12 @@ export async function recordExecutionReceipt({
     exitCode,
   };
 
+  const policy = routeState?.routeSummary?.executionContract?.releasePolicy;
+  if (toolName === 'Bash' && !bashScope.foreign && policy?.kind === 'conditional-release'
+    && String(toolInput.command || '').trim() === policy.preflight && Number.isInteger(exitCode)) {
+    receipt.releasePreflight = { command: policy.preflight, failed: exitCode !== 0, exitCode,
+      taskInstanceId: routeState.taskInstanceId, workspaceFp };
+  }
   const toolResponse = payload.tool_response ?? payload.tool_output ?? payload.tool_result;
   const nativeGoal = routeState?.routeSummary?.executionContract?.operationGoal;
   const operationReceipt = cronOperationReceipt(toolName, toolInput, toolResponse, success, { sessionId: explicitSessionId(payload), harness })
@@ -2863,6 +2871,14 @@ export async function recordExecutionReceipt({
   } else if (toolName === 'Edit' || toolName === 'Write') {
     receipt.kind = 'write';
     receipt.file = toolInput.file_path || toolInput.path || toolInput.paths?.[0] || null;
+    // External scratch artifacts are not product mutations. Keep them out of write debt/proof entirely;
+    // otherwise a /tmp report resurrects implementation obligations on a read-only investigation.
+    if (typeof receipt.file === 'string') {
+      const relative = path.relative(path.resolve(projectRoot), path.resolve(projectRoot, receipt.file));
+      if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+        return { rejected: true, eventId: null, reason: 'outside-product-workspace' };
+      }
+    }
   } else if (toolName === 'Bash' && !bashScope.foreign && (isVerificationCommand(toolInput.command) || evidence)) {
     // TASK-009 (BL-011): a Bash command carrying an evidence attestation
     // records as a verification receipt even when the command is not a known
@@ -3004,6 +3020,14 @@ function requiredEvidence(state = {}) {
 
 function evidenceSatisfied(evidence, ledger = {}, state = {}, { cwd } = {}) {
   const routeSummary = state?.routeSummary || {};
+  if (evidence === 'report-artifact') {
+    const artifact = routeSummary.executionContract?.reportArtifact;
+    if (!cwd || typeof artifact !== 'string') return false;
+    const target = path.resolve(cwd, artifact);
+    const bank = evidenceBank(ledger, 'bankedWrites');
+    if (bank[evidenceBankKey(artifact)] !== true && bank[evidenceBankKey(target)] !== true) return false;
+    try { return fsSync.statSync(target).isFile() && fsSync.statSync(target).size > 0; } catch { return false; }
+  }
   if (evidence === 'operation-verification') {
     return operationCompletionPolicy(scopedContract(state, ledger), null, withGitAuthority(ledger, cwd))?.complete === true;
   }
@@ -3513,6 +3537,23 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
     const at = missingEvidence.indexOf('impact-evidence');
     if (at !== -1) missingEvidence.splice(at, 1);
   }
+  const releasePolicy = routeSummary.executionContract?.releasePolicy;
+  const preflight = effectiveLedger?.releasePreflight;
+  if (['MIXED', 'OPERATIONAL'].includes(routeSummary.executionContract?.taskKind)
+    && releasePolicy?.kind === 'conditional-release' && preflight?.failed === true
+    && preflight.command === releasePolicy.preflight && preflight.taskInstanceId === state.taskInstanceId
+    && (!preflight.workspaceFp || preflight.workspaceFp === workspaceFingerprint(cwd))
+    && !missingEvidence.some((item) => item !== 'operation-verification' && item !== 'verification-evidence')) {
+    return { continue: false, notify: true, complete: false, outcome: 'blocked',
+      releaseOutcome: 'RELEASE_NO_GO', missingEvidence: [],
+      reason: `RELEASE_NO_GO: owned preflight ${preflight.command} failed (exit ${preflight.exitCode}); publication is prohibited by this task's conditional release policy. No release was completed.` };
+  }
+  if (releasePolicy?.kind === 'conditional-release'
+    && !(preflight?.failed === false && preflight.command === releasePolicy.preflight
+      && preflight.taskInstanceId === state.taskInstanceId
+      && (!preflight.workspaceFp || preflight.workspaceFp === workspaceFingerprint(cwd)))) {
+    missingEvidence.push('release-preflight');
+  }
   const releaseMissing = releasePublicationMissing(state, effectiveLedger, cwd);
   if (releaseMissing) missingEvidence.push(releaseMissing);
   // TASK-009 (BL-011): the bug-fix floor. On a `playbookId: bug-fix` route a
@@ -3731,7 +3772,7 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
 
   const finalAttempt = !vibecode && continuationCount === MAX_CONTINUATIONS - 1;
   const instruction = missingEvidence.includes('release-publication')
-    ? 'The release is not proven published: run `npm publish` once if the registry does not yet serve this version, then confirm with `npm view <package> version` (must equal package.json) and that the release tag dereferences to HEAD (or to an ancestor of HEAD with no shipped change since). Never move the tag. Do not republish a version the registry already serves.'
+    ? 'The release is not proven published: run `npm publish` once if the registry does not yet serve this version, then confirm with `npm view <package> version` (must equal package.json) and that the release tag dereferences to HEAD (or to an ancestor of HEAD with no shipped change since). Never move the tag. Do not republish a version the registry already serves. Accepted evidence: a Bash result of exactly `npm view <package> version` (optionally `2>&1`, optionally after `cd <dir> &&`) that exited 0 and printed a bare semver. Rejected as unproven: the same command behind `| tail/head/cat`, `;`, `||` or inside a compound (a pipeline hides the exit status), dry runs, prose claims. Re-run the bare command once; do not republish.'
     : operationalTask
     ? 'Inspect native mutation receipts and verify the requested operational state; do not fabricate source edits or source-test evidence.'
     : recoveryInstruction(missingEvidence, effectiveLedger, routeSummary, { cwd });
@@ -3770,6 +3811,20 @@ function playbookStopAdvisory({ state = {}, ledger = {} } = {}, result = {}) {
 
 export function evaluateCompletion(args = {}) {
   const result = evaluateCompletionContract(args);
+  // Explain the verdict from the SAME task-scoped snapshot used by the verifier. These are proof summaries,
+  // not an alternative evidence source; a diagnostic must never satisfy or relax an obligation.
+  const owned = effectiveRequestLedger(args.state, args.ledger) || {};
+  const diagnostics = {
+    taskInstanceId: args.state?.taskInstanceId || null,
+    contract: args.state?.routeSummary?.executionContract?.taskKind || args.state?.routeSummary?.taskKind || args.state?.routeSummary?.executionMode || null,
+    unmetObligations: result.missingEvidence || [],
+    acceptedEvidence: result.complete === true || result.missingEvidence?.length
+      ? requiredEvidence(args.state).filter((item) => !(result.missingEvidence || []).includes(item)) : [],
+    observedEvidence: [owned.sourceSucceeded && 'source-read', owned.writeSucceeded && 'write-receipt', owned.verificationSucceeded && 'verification-receipt'].filter(Boolean),
+    rejectedEvidence: args.ledger && owned !== args.ledger ? ['ledger-task-ownership-mismatch'] : [],
+  };
+  result.diagnostics = diagnostics;
+  if (result.reason) result.reason += ` [task=${diagnostics.taskInstanceId || 'unknown'} contract=${diagnostics.contract || 'unknown'} accepted-count=${diagnostics.acceptedEvidence.length} rejected=${diagnostics.rejectedEvidence.join(',') || 'none'}]`;
   try {
     const advisory = playbookStopAdvisory(args, result);
     if (advisory) return { ...result, playbookAdvisory: advisory };

package/template_project/.claude/ukit/runtime/stop-coordinator.mjs

@@ -1966,6 +1966,7 @@ export async function runStopCoordinator({
     await captureUsageShadow({ projectRoot, payload });
   } catch { /* advisory */ }
 
+
   // TASK-005 (FR-005): the coordinator's terminal verdict lands ONE
   // `outcome.observed` record per coordinated stop — the merged evaluator
   // decision is the session's honest outcome at this stop. Fire-and-forget:

package/template_project/.omp/hooks/pre/ukit-bridge.js

@@ -1176,7 +1176,7 @@ export async function runSessionStop(
     // Command authority (RC-A): same shared phase signal the Claude Stop path uses, so a
     // handoff-create/review session is never pushed toward Edit/Write on omp either.
     const phase = await resolveStopPhase(payload.transcript_path);
-    evaluation = evaluateCompletion({ state, ledger, phase });
+    evaluation = evaluateCompletion({ state, ledger, phase, cwd: projectRoot });
   } catch (error) {
     // BUG-C22-05: fail-closed like the shell gate (continue the turn), but only up
     // to the configured consecutive-crash cap — a persistently broken evaluator