@ngockhoale/ukit 3.4.46 → 3.4.48

package/template_project/.claude/hooks/delegation-gate.mjs

@@ -0,0 +1,343 @@
+// delegation-gate.mjs — PreToolUse chain step (in-proc `runHook(ctx)`, Claude Code).
+//
+// Turns the feature-implementation Playbook's "delegate the coding to Tier 2" requirement from
+// advice into a host-native refusal. It fires ONLY when ALL of these hold:
+//   * the host is Claude Code (UKIT_HARNESS unset/'claude-code') — omp/codex worker identity is
+//     UNVERIFIED, so nothing is enforced there (the acceptance verdict stays UNVERIFIED);
+//   * the live route state is this task's `feature-implementation` run with
+//     `tierLane.delegationRequired === true` (Tier 3 main, Tier 2 executor);
+//   * the call is a source/test mutation (Edit/Write/MultiEdit/NotebookEdit, or a Bash command
+//     whose file write is reliably identifiable) from the MAIN thread — the host stamps
+//     `agent_id` on every subagent tool payload, so main vs worker is read from the host, never
+//     from model text.
+// A main-thread mutation is refused until this task's ledger holds an evidenced native worker
+// handback (the "valid delegation path"). Reads, test runs, docs/bookkeeping writes and every
+// unrelated operation pass untouched.
+//
+// Bounded, never a bypass: each refused attempt is a task-owned `delegation-violation` receipt;
+// the DELEGATION_VIOLATION_LIMIT-th one mints a visible sticky `delegation-required` blocker, so
+// the Stop gate ends the run as BLOCKED. Further attempts stay refused. There is no
+// "second attempt succeeds" path.
+//
+// Worker side: a worker's Bash heredoc/redirect/tee/sed -i/script write has no trustworthy file
+// attribution (the ledger would only see an anonymous workspace delta), so it is refused with a
+// pointer to the supported Edit/Write path.
+//
+// Boundary (documented, not hidden): Bash mutations are detected by a quote-aware scan of the
+// command text. Writes made by a script FILE (`node build.js`), by variables/command
+// substitution, or after a `cd` inside the command are not identifiable here. The Stop-time
+// acceptance backstop still counts any anonymous workspace delta as an inline write
+// (`delegation-required-not-performed`), so such work is never reported as PASS.
+//
+// Fail-open on any internal error (a broken advisory gate must not wedge the session). User
+// overrides: `UKIT_DELEGATION_GATE=off` or `.ukit/storage/config.json` orchestration.delegationGate=false.
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const hookFailClosed = false;
+
+const FEATURE_PLAYBOOK_ID = 'feature-implementation';
+const MUTATING_TOOLS = new Set(['Edit', 'Write', 'MultiEdit', 'NotebookEdit']);
+const PASS = { code: 0, stdout: '', stderr: '' };
+
+// First path segment under which a write is never "source/test" (tooling, build output, docs, scratch).
+const EXEMPT_ROOTS = new Set([
+  '.git', '.claude', '.ukit', '.omp', '.codex', '.cache', 'node_modules', 'dist', 'build', 'coverage',
+  '.next', '.nuxt', '.turbo', 'tmp', 'docs',
+]);
+const EXEMPT_EXT = /\.(md|mdx|txt|log|tmp|lock)$/i;
+
+const INTERPRETERS = /^(node|nodejs|deno|bun|python|python2|python3|ruby|perl|php)$/;
+const WRAPPERS = new Set(['sudo', 'env', 'command', 'time', 'nice', 'nohup', 'exec', 'builtin']);
+const SHELLS = new Set(['bash', 'sh', 'zsh', 'dash']);
+// File-writing APIs of the interpreters above. `process.stdout.write` / `sys.stdout.write` are not file writes.
+const WRITE_API = /\b(writeFile(?:Sync)?|appendFile(?:Sync)?|createWriteStream|copyFile(?:Sync)?|rename(?:Sync)?|writeFileSync|write_text|write_bytes|File\.write|file_put_contents)\b|\bopen\s*\([^)]*,\s*['"][wax][+b]*['"]/;
+
+// ─── Path classification ────────────────────────────────────────────────────
+
+/** True when `raw` names a project source/test file (i.e. a path this gate protects). */
+export function isSourceTarget(raw, { projectRoot, cwd } = {}) {
+  let text = String(raw ?? '').trim();
+  if (!text) return false;
+  if (/[$`]/.test(text) || text.startsWith('~')) return false; // not statically resolvable
+  if (text.startsWith('/dev/')) return false;
+  const root = path.resolve(projectRoot || '.');
+  const abs = path.isAbsolute(text) ? path.resolve(text) : path.resolve(cwd || root, text);
+  const rel = path.relative(root, abs);
+  if (!rel || rel.startsWith('..') || path.isAbsolute(rel)) return false; // outside the project
+  const parts = rel.split(path.sep);
+  if (EXEMPT_ROOTS.has(parts[0])) return false;
+  if (EXEMPT_EXT.test(parts[parts.length - 1])) return false;
+  return true;
+}
+
+// ─── Bash scan ──────────────────────────────────────────────────────────────
+
+// Splits `command` into heredoc-free text plus the heredoc bodies (bodies may contain `>` etc.).
+function extractHeredocs(command) {
+  const lines = String(command).split('\n');
+  const kept = [];
+  const bodies = [];
+  for (let i = 0; i < lines.length; i += 1) {
+    const line = lines[i];
+    kept.push(line);
+    const re = /<<(-?)\s*(['"]?)([A-Za-z_][\w-]*)\2/g;
+    const delimiters = [];
+    for (let m = re.exec(line); m; m = re.exec(line)) {
+      if (line[m.index - 1] === '<') continue; // here-string `<<<`
+      delimiters.push({ strip: m[1] === '-', tag: m[3] });
+    }
+    for (const { strip, tag } of delimiters) {
+      const body = [];
+      let closed = false;
+      while (i + 1 < lines.length) {
+        i += 1;
+        const candidate = strip ? lines[i].replace(/^\t+/, '') : lines[i];
+        if (candidate.trim() === tag) { closed = true; break; }
+        body.push(lines[i]);
+      }
+      bodies.push(body.join('\n'));
+      if (!closed) break;
+    }
+  }
+  return { text: kept.join('\n'), bodies };
+}
+
+// Quote-aware pass: returns segments (arrays of words) and file-redirect targets.
+function tokenize(text) {
+  const segments = [[]];
+  const redirects = [];
+  let word = null;
+  const pushWord = () => { if (word !== null) { segments[segments.length - 1].push(word); word = null; } };
+  const newSegment = () => { pushWord(); if (segments[segments.length - 1].length) segments.push([]); };
+  const n = text.length;
+  let i = 0;
+  const readQuoted = (quote) => {
+    let out = '';
+    i += 1;
+    while (i < n && text[i] !== quote) {
+      if (quote === '"' && text[i] === '\\' && i + 1 < n) { out += text[i + 1]; i += 2; continue; }
+      out += text[i]; i += 1;
+    }
+    i += 1;
+    return out;
+  };
+  while (i < n) {
+    const ch = text[i];
+    if (ch === "'" || ch === '"') { word = (word ?? '') + readQuoted(ch); continue; }
+    if (ch === '\\' && i + 1 < n) { word = (word ?? '') + text[i + 1]; i += 2; continue; }
+    if (ch === '#' && word === null) { while (i < n && text[i] !== '\n') i += 1; continue; }
+    if (/\s/.test(ch)) { if (ch === '\n') newSegment(); else pushWord(); i += 1; continue; }
+    if (ch === ';' || ch === '|' || ch === '(' || ch === ')' || ch === '`') { newSegment(); i += 1; if (ch === '|' && text[i] === '|') i += 1; continue; }
+    if (ch === '&' && text[i + 1] === '&') { newSegment(); i += 2; continue; }
+    if (ch === '&' && text[i + 1] !== '>') { newSegment(); i += 1; continue; }
+    if (ch === '&' && text[i + 1] === '>') {
+      pushWord(); i += 2; if (text[i] === '>') i += 1;
+      const target = readRedirectTarget();
+      if (target !== null) redirects.push(target);
+      continue;
+    }
+    if (ch === '>' ) {
+      // `2>file` : the fd digit already landed in `word`; drop it when it is a bare fd number.
+      if (word !== null && /^\d$/.test(word)) word = null; else pushWord();
+      i += 1;
+      if (text[i] === '(') continue; // process substitution
+      if (text[i] === '&') { i += 1; while (i < n && /[\d-]/.test(text[i])) i += 1; continue; } // fd dup
+      if (text[i] === '>' || text[i] === '|') i += 1;
+      const target = readRedirectTarget();
+      if (target !== null) redirects.push(target);
+      continue;
+    }
+    word = (word ?? '') + ch; i += 1;
+  }
+  pushWord();
+  function readRedirectTarget() {
+    while (i < n && (text[i] === ' ' || text[i] === '\t')) i += 1;
+    if (i >= n) return null;
+    if (text[i] === "'" || text[i] === '"') return readQuoted(text[i]);
+    let out = '';
+    while (i < n && !/[\s;|&<>()]/.test(text[i])) { out += text[i]; i += 1; }
+    return out || null;
+  }
+  return { segments: segments.filter((s) => s.length), redirects };
+}
+
+function isFlag(word) { return /^-/.test(word); }
+
+function stripLeading(words) {
+  const out = [...words];
+  while (out.length) {
+    if (/^[A-Za-z_]\w*=/.test(out[0]) || WRAPPERS.has(out[0])) out.shift(); else break;
+  }
+  return out;
+}
+
+function scriptWrites(script, ctx) {
+  if (!WRITE_API.test(script)) return null;
+  const literals = [...script.matchAll(/['"`]([^'"`\n]{1,200})['"`]/g)].map((m) => m[1])
+    .filter((value) => /[\\/]/.test(value) || /\.[A-Za-z0-9]{1,6}$/.test(value));
+  if (literals.length === 0) return { kind: 'script-write', target: null };
+  const hit = literals.find((value) => isSourceTarget(value, ctx));
+  return hit ? { kind: 'script-write', target: hit } : null;
+}
+
+/**
+ * Returns the reliably identifiable source/test file mutations in a Bash command:
+ * [{ kind: 'redirect'|'heredoc'|'tee'|'sed-inplace'|'copy'|'patch'|'script-write', target }].
+ * Reads, test runs and writes to exempt paths yield []. Script FILES are not identifiable (see header).
+ */
+export function scanBashMutations(command, ctx = {}, depth = 0) {
+  const raw = String(command ?? '');
+  if (!raw.trim()) return [];
+  const hits = [];
+  const { text, bodies } = extractHeredocs(raw);
+  const hasHeredoc = bodies.length > 0;
+  const { segments, redirects } = tokenize(text);
+  for (const target of redirects) {
+    if (isSourceTarget(target, ctx)) hits.push({ kind: hasHeredoc ? 'heredoc' : 'redirect', target });
+  }
+  for (const rawWords of segments) {
+    const words = stripLeading(rawWords);
+    if (!words.length) continue;
+    const cmd = path.basename(words[0]);
+    const args = words.slice(1);
+    const plain = args.filter((a) => !isFlag(a));
+    if (cmd === 'tee') {
+      for (const target of plain) if (isSourceTarget(target, ctx)) hits.push({ kind: 'tee', target });
+    } else if (cmd === 'sed' || cmd === 'perl' || cmd === 'ruby') {
+      const inPlace = args.some((a) => (cmd === 'sed' ? /^-[A-Za-z]*i|^--in-place/ : /^-[A-Za-z]*i/).test(a));
+      if (inPlace) {
+        const eIndex = args.findIndex((a) => a === '-e' || a === '-f');
+        const files = args.filter((a, idx) => !isFlag(a) && !(eIndex >= 0 && idx === eIndex + 1));
+        const candidates = cmd === 'sed' && eIndex < 0 ? files.slice(1) : files;
+        for (const target of candidates) if (isSourceTarget(target, ctx)) hits.push({ kind: 'sed-inplace', target });
+      }
+    } else if (cmd === 'cp' || cmd === 'mv' || cmd === 'install') {
+      if (plain.length >= 2 && isSourceTarget(plain[plain.length - 1], ctx)) hits.push({ kind: 'copy', target: plain[plain.length - 1] });
+    } else if (cmd === 'patch' || (cmd === 'git' && /^(apply|am)$/.test(plain[0] || '') && !args.includes('--check') && !args.includes('--stat'))) {
+      hits.push({ kind: 'patch', target: null });
+    } else if (cmd === 'dd') {
+      const of = args.find((a) => a.startsWith('of='));
+      if (of && isSourceTarget(of.slice(3), ctx)) hits.push({ kind: 'copy', target: of.slice(3) });
+    } else if (INTERPRETERS.test(cmd)) {
+      const inline = [];
+      args.forEach((a, idx) => { if (/^-(e|c|p)$/.test(a) && args[idx + 1] !== undefined) inline.push(args[idx + 1]); });
+      const scripts = [...inline, ...(hasHeredoc && (plain.length === 0 || args.includes('-') || args.some((a) => /^-[A-Za-z]*$/.test(a))) ? bodies : [])];
+      for (const script of scripts) {
+        const found = scriptWrites(script, ctx);
+        if (found) hits.push(found);
+      }
+    } else if (SHELLS.has(cmd) && depth < 2) {
+      const cIndex = args.indexOf('-c');
+      if (cIndex >= 0 && args[cIndex + 1] !== undefined) hits.push(...scanBashMutations(args[cIndex + 1], ctx, depth + 1));
+    } else if (cmd === 'eval' && depth < 2) {
+      hits.push(...scanBashMutations(args.join(' '), ctx, depth + 1));
+    }
+  }
+  return hits;
+}
+
+// ─── Gate ───────────────────────────────────────────────────────────────────
+
+function readJson(file) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; }
+}
+
+function userDisabled(projectRoot, env) {
+  if (/^(off|0|false)$/i.test(String(env.UKIT_DELEGATION_GATE || ''))) return true;
+  const config = readJson(path.join(projectRoot, '.ukit', 'storage', 'config.json'));
+  return config?.orchestration?.delegationGate === false;
+}
+
+function deny(reason, env) {
+  const inChain = Boolean(env.UKIT_HOOK_CHAIN_RUNNER);
+  return {
+    code: inChain ? 2 : 0,
+    stdout: `${JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } })}\n`,
+    stderr: `BLOCKED: ${reason}\n`,
+  };
+}
+
+function describeTarget(mutation, projectRoot) {
+  if (!mutation.target) return 'a source file';
+  const text = String(mutation.target);
+  const rel = path.isAbsolute(text) && projectRoot ? path.relative(projectRoot, text) : text;
+  return `"${(rel && !rel.startsWith('..') ? rel : text).slice(0, 120)}"`;
+}
+
+function mainMessage(attempt, limit, taskId, mutation, projectRoot) {
+  if (attempt >= limit) {
+    return `UKit delegation gate — BLOCKED: this task's feature-implementation Playbook requires the coding to be delegated to the Tier 2 worker, but the orchestrator tried ${attempt} times to write ${describeTarget(mutation, projectRoot)} itself. This run is now recorded as BLOCKED (delegation-required-not-performed). Do not retry the write; report the blocker to the user.`;
+  }
+  return `UKit delegation gate (attempt ${attempt} of ${limit}): this task's feature-implementation Playbook requires Tier 2 coding delegation, and you are the Tier 3 orchestrator — writing ${describeTarget(mutation, projectRoot)} yourself is refused. Dispatch a native worker now with the Agent tool (subagent_type "feature-implementer", the Tier 2 coding model) and start its prompt with "[ukit-task ${taskId}]", naming the files and behaviour to implement; the worker must edit with Edit/Write. When it returns, verify the integrated result yourself with the bare test runner (for example \`npm test\`) — no pipe, tail, grep or compound command — so the runner's own exit status is the evidence. Repeating this write will end the run as BLOCKED.`;
+}
+
+function workerMessage(mutation, projectRoot) {
+  return `UKit delegation gate: a Bash ${mutation.kind} write to ${describeTarget(mutation, projectRoot)} has no trustworthy file attribution, so it is not accepted as worker evidence. Redo this change with the Edit or Write tool (the supported worker edit path), then run the tests with the bare runner command.`;
+}
+
+function targetsOf(toolName, input) {
+  if (toolName === 'Bash') return null;
+  const file = input.file_path ?? input.notebook_path ?? input.path;
+  return typeof file === 'string' && file ? file : null;
+}
+
+async function evaluate(ctx) {
+  const env = ctx.env || {};
+  const payload = ctx.payload || {};
+  const toolName = payload.tool_name;
+  if (toolName !== 'Bash' && !MUTATING_TOOLS.has(toolName)) return PASS;
+  if (env.UKIT_HARNESS && env.UKIT_HARNESS !== 'claude-code') return PASS;
+  const projectRoot = env.CLAUDE_PROJECT_DIR || ctx.projectRoot || process.cwd();
+  if (userDisabled(projectRoot, env)) return PASS;
+
+  const ledgerMod = await import(new URL('../ukit/runtime/execution-ledger.mjs', import.meta.url).href);
+  const playbook = await import(new URL('../ukit/runtime/playbook-execution.mjs', import.meta.url).href);
+  const state = await ledgerMod.readRouteState(projectRoot, payload);
+  const summary = state?.routeSummary;
+  if (!state?.taskInstanceId || summary?.playbookId !== FEATURE_PLAYBOOK_ID || summary.tierLane?.delegationRequired !== true) return PASS;
+
+  const input = payload.tool_input && typeof payload.tool_input === 'object' ? payload.tool_input : {};
+  const scanCtx = { projectRoot, cwd: payload.cwd || projectRoot };
+  let mutation = null;
+  if (toolName === 'Bash') {
+    mutation = scanBashMutations(input.command, scanCtx)[0] || null;
+  } else {
+    const file = targetsOf(toolName, input);
+    if (file && isSourceTarget(file, scanCtx)) mutation = { kind: 'edit', target: file };
+  }
+  if (!mutation) return PASS;
+
+  if (payload.agent_id) {
+    // A worker: Edit/Write is the supported path; only anonymous Bash writes are refused.
+    return toolName === 'Bash' ? deny(workerMessage(mutation, projectRoot), env) : PASS;
+  }
+
+  const ledger = await ledgerMod.readExecutionLedger(projectRoot, payload);
+  const owned = ledger && ledger.taskInstanceId === state.taskInstanceId ? ledger : null;
+  const workers = playbook.assessWorkers(owned?.playbookRun || null);
+  if (workers.workers.some((worker) => worker.state === 'evidenced')) return PASS; // valid delegation path exists
+
+  const limit = playbook.DELEGATION_VIOLATION_LIMIT;
+  const prior = Number(owned?.delegationViolations?.count) || 0;
+  const attempt = Math.min(prior + 1, limit);
+  if (prior < limit) {
+    await ledgerMod.recordLedgerEvent({
+      type: 'receipt',
+      receipt: {
+        ts: Date.now(), kind: 'delegation-violation', toolName, toolUseId: payload.tool_use_id || null,
+        success: false, mutation: mutation.kind, target: mutation.target ? String(mutation.target).slice(0, 160) : null,
+      },
+    }, { projectRoot, payload, harness: 'claude-code', routeState: state, deadlineMs: ctx.deadlineMs });
+  }
+  return deny(mainMessage(attempt, limit, state.taskInstanceId, mutation, projectRoot), env);
+}
+
+export async function runHook(ctx) {
+  try {
+    return await evaluate(ctx || {});
+  } catch {
+    return PASS; // advisory gate: an internal fault never wedges the session
+  }
+}

package/template_project/.claude/hooks/skill-router.sh

@@ -407,6 +407,45 @@ setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
     return tierSelectionModule;
   }
 
+  // Tier lane: who performs the edit for the routed task (worker hand-off vs inline) for the MAIN
+  // session's tier. Same lazy pattern; a missing module degrades to no tier lane (legacy behavior).
+  let tierLaneModule = null;
+  let tierLaneLoadAttempted = false;
+  async function loadTierLane() {
+    if (!tierLaneLoadAttempted) {
+      tierLaneLoadAttempted = true;
+      try {
+        const modulePath = path.join(projectRoot, '.claude', 'ukit', 'index', 'tier-lane.mjs');
+        if (await pathExists(modulePath)) {
+          tierLaneModule = await import(pathToFileURL(modulePath).href);
+        }
+      } catch {
+        tierLaneModule = null;
+      }
+    }
+    return tierLaneModule;
+  }
+  // The persisted `tierLane` is what the Stop-side playbook acceptance reads (delegationRequired);
+  // the printed lines are what tell the model to dispatch the worker and tag its prompt.
+  function writeTierLaneLines(summary, taskId) {
+    const lane = summary?.tierLane;
+    if (!lane?.instruction) {
+      return;
+    }
+    process.stdout.write(`[ukit-skill-router] Tier lane: ${lane.instruction}\n`);
+    if (lane.delegationRequired === true && taskId) {
+      process.stdout.write(`[ukit-skill-router] Handback: start each worker prompt with "[ukit-task ${taskId}]" so its result binds to this task\n`);
+      const hostHarness = process.env.UKIT_HARNESS || 'claude-code';
+      if (summary.playbookId === 'feature-implementation' && hostHarness !== 'claude-code') {
+        // omp/codex expose no agent identity to hooks: the gate cannot refuse orchestrator writes there,
+        // so say what is actually enforced instead of promising a refusal.
+        process.stdout.write('[ukit-skill-router] Delegation required: dispatch the worker; do not implement inline. This host gives hooks no worker identity, so orchestrator writes are NOT refused and worker attribution is reported UNVERIFIED (never a full PASS). Verify with a bare runner command (no pipe/tail/grep) and read its exit status.\n');
+      } else if (summary.playbookId === 'feature-implementation') {
+        process.stdout.write('[ukit-skill-router] Delegation gate: source/test writes from this orchestrator (Edit/Write/Bash heredoc) are refused until a native Tier 2 worker has handed back; repeated attempts end the run BLOCKED. Verify with a bare runner command (no pipe/tail/grep) and read its exit status.\n');
+      }
+    }
+  }
+
   // BL-013: session-history extractor — same lazy pathToFileURL pattern as the
   // shared resolver. Async extraction (fsp tail read ≤16KiB) so a stalled mount
   // never parks the event loop under the armed deadline (BUG-C21-04 posture);
@@ -620,6 +659,27 @@ setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
     }
   }
 
+  // A PreToolUse/continuation pass routes from the tool call alone (no prompt text), so the playbook
+  // the originating prompt selected resolves to null and would erase the task's playbook + delegation
+  // requirement from state — leaving the acceptance NOT_APPLICABLE. Within the SAME task instance the
+  // playbook is task-owned: carry it (and its tier lane) forward; never across task instances.
+  function inheritTaskPlaybook(routeSummary, previousState, taskId) {
+    const prev = previousState?.routeSummary;
+    if (!routeSummary || !prev?.playbookId) return;
+    if (!taskId || previousState.taskInstanceId !== taskId) return;
+    if (!routeSummary.playbookId) {
+      for (const key of ['playbookId', 'workGroup', 'playbookReason', 'playbookLoad', 'path', 'fastPathKind']) {
+        if (prev[key] !== undefined && prev[key] !== null) routeSummary[key] = prev[key];
+      }
+    }
+    // The delegation demand is task-owned too: a later per-tool route (e.g. a docs Edit) derives its own
+    // lane from its own contract, and must not erase the demand the feature prompt established.
+    if (routeSummary.playbookId === prev.playbookId && prev.tierLane?.delegationRequired === true
+        && routeSummary.tierLane?.delegationRequired !== true) {
+      routeSummary.tierLane = prev.tierLane;
+    }
+  }
+
   async function existsSkill(projectRoot, relativePath) {
     return pathExists(path.join(projectRoot, relativePath));
   }
@@ -750,7 +810,7 @@ setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
     }
 
     if (concreteTask) {
-      if (/\b(bug|debug|error|crash|broken|failing|stack trace|triage|fix|timeout)\b/.test(lower)) {
+      if (/\b(bug|debug|error|crash|broken|failing|stack trace|triage|fix|timeout)\b/.test(lower.replace(/\b(?:throw|raise|emit|reject|return|log|show|surface)(?:s|es|ing)?\s+(?:an?\s+|the\s+)?(?:[a-z-]+\s+){0,2}[a-z]*(?:error|exception)s?\b/g, ' '))) {
         return 'debug-specific';
       }
       if (/\b(review|audit|diff|pr feedback|code review|kiem tra|soat)\b/.test(raw)) {
@@ -1828,12 +1888,34 @@ function neutralizeNonOrders(text) {
     .replace(/"[^"\n]*\s[^"\n]*"|`[^`\n]*\s[^`\n]*`|\u201c[^\u201d\n]*\u201d/g, ' ')
     .replace(/\b(?:neu\s+(?:phai|can|thieu|khong du|bang chung chua du)|if\s+(?:needed|necessary|required|evidence is insufficient))\b[^.;\n]*/g, ' ')
     .replace(/[^.;\n]*\b(?:nao|gi|sao|the nao|bao nhieu)\b[^.;\n]*\?/g, ' ')
-    .replace(/\bchinh\s+xac\b|\b(?:phuong an|cach|de xuat|ban)\s+(?:sua|fix)\b/g, ' ')
+    .replace(/\bchinh\s+(?:xac|sach)\b|\b(?:phuong an|cach|de xuat|ban)\s+(?:sua|fix)\b|\b(?:diem|cho|muc|phan)\s+(?:phai|can|nen)\s+(?:sua|fix)\b/g, ' ')
     .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
     .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
     .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ');
 }
 
+const ORDER_VERBS = 'implement|fix|apply|refactor|modify|edit|write|update|add|create|build|install|deploy|redeploy|restart|push|commit|rename|remove|delete|replace|change|sua|viet|chinh|them|tao|xoa|enable|disable|set|toggle|configure|migrate|upgrade|publish|release|trien khai|khoi dong lai|(?:run|execute)\\s+(?:git\\s+(?:push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)|(?:npm|yarn)\\s+publish)|git\\s+(?:push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)';
+const IMPERATIVE_ORDER = new RegExp(`^(?:[-*+\\u2022>\\d.)\\s]*)(?:(?:please|hay|vui long|now|also|first|then)\\s+)*(?:${ORDER_VERBS})\\b\\s+\\S`);
+const MODAL_ORDER = new RegExp(`\\b(?:please|hay|vui long|need to|needs to|must|should|want(?:\\s+you)? to|toi muon|can phai|yeu cau)\\s+(?:[\\w-]+\\s+){0,2}(?:${ORDER_VERBS})\\b`);
+function hasExplicitOrder(clauses) {
+  return clauses.some((clause) => IMPERATIVE_ORDER.test(clause) || MODAL_ORDER.test(clause));
+}
+// Verification-only request. Root cause of a false `write-evidence` block on a "verify / re-run /
+// confirm" prompt: the vocabulary scans counted nouns and compounds ("coordinator fix", "re-run",
+// "template/install", "source change") as mutation orders. Order is structural: a request whose
+// command-position verbs are verification verbs, with no explicit order (hasExplicitOrder) and no
+// change-leading clause, orders no change - it owes verification evidence, not a write.
+const VERIFY_LEAD = /^(?:[-*+•>\d.)\s]*)(?:(?:please|hay|vui long|now|also|first|then)\s+)*(?:verify|re-?run|confirm|validate|double-?check)\b/;
+const CHANGE_LEAD = /^(?:[-*+•>\d.)\s]*)(?:(?:please|hay|vui long|now|also|first|then)\s+)*(?:make|rebuild|redo|rewrite|restore|revert|correct|clean|patch|resolve|ensure|run(?!(?=[^.]*\b(?:tests?|suite|gate|checks?|lint|typecheck|pilot|smoke|e2e|verif\w*|vitest|jest|audit)\b)))\b/;
+function isVerificationOnlyRequest(promptText) {
+  const plain = String(promptText ?? '').normalize('NFD').replace(/[̀-ͯ]/g, '').replace(/[đĐ]/g, 'd').toLowerCase()
+    .replace(/```[\s\S]*?```/g, ' ').replace(/^[ \t]*>.*$/gm, ' ');
+  const clauses = neutralizeNonOrders(plain).split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/)
+    .map((clause) => clause.split(/\bwithout\b/)[0]);
+  return clauses.some((clause) => VERIFY_LEAD.test(clause)) && !hasExplicitOrder(clauses)
+    && !clauses.some((clause) => CHANGE_LEAD.test(clause));
+}
+
 function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
   // A named preflight and both explicit branches are required; a failed arbitrary test is not a release policy.
   const releaseText = String(promptText).normalize('NFD').replace(/[̀-ͯ]/g, '').replace(/[đĐ]/g, 'd').toLowerCase();
@@ -1862,10 +1944,15 @@ function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
   // runtime are separate domains with separate proof; a prompt naming both stays a coding
   // task rather than being half-verified. A code-change verb anywhere keeps write evidence.
   const gitOperation = actionable.some((clause) => /\bgit\s+(?:push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)\b|\bpush\s+(?:to\s+)?origin\b/.test(clause));
-  const runtimeOperation = actionable.some((clause) => /\b(?:restart|redeploy|deploy|khoi dong lai|trien khai)\b/.test(clause)
+  // 'trien khai' is Vietnamese for both "deploy" and "implement": it orders a runtime operation only
+  // when it names a runtime target; bare it describes work ("Tier 3 truc tiep trien khai thay Tier 2").
+  // "restart"/"deploy" after a noun modifier ("process restart", "after redeploy") is a scenario, not an order.
+  const runtimeOperation = actionable.some((clause) => /(?<!\b(?:process|crash|hard|soft|graceful|after|upon|during|across|following)\s)\b(?:restart|redeploy|deploy|khoi dong lai|trien khai\s+(?:len\s+)?(?:service|server|production|prod|staging|dich vu|may chu|moi truong))\b/.test(clause)
     && !/\.[cm]?[jt]sx?\b/.test(clause) && !/\bgit\b/.test(clause));
   const nativeDomain = cronOperation ? 'scheduled-job' : gitOperation !== runtimeOperation ? (gitOperation ? 'git-integrity' : 'service-runtime') : null;
   const operation = Boolean(nativeDomain);
+  // A verification-only request orders no change; a concrete operation order (cancel/restart/push) stays operational.
+  if (!releasePolicy && !operation && isVerificationOnlyRequest(promptText)) return { taskKind: 'READ_ONLY', verificationOnly: true };
   // A config MENTION is not a config change: the same clause needs a mutation verb, and a
   // request that also changes source/code is a coding task (config is part of its tests/fixtures).
   const config = !sourceOrder && actionable.some((clause) => /\b(?:configuration|config|toggle|cau hinh)\b/.test(clause)
@@ -1895,7 +1982,7 @@ function applyTaskSemantics(contract, semantic) {
     completionEvidence: semantic.taskKind === 'DOCUMENTATION_OUTPUT' ? ['report-artifact'] : operationOnly ? ['operation-verification']
       : semantic.taskKind === 'MIXED' ? [...new Set([...evidence, 'write-evidence', 'operation-verification'])]
         : semantic.taskKind === 'READ_ONLY' && semantic.statusReport ? []
-        : semantic.taskKind === 'READ_ONLY' ? (evidence.length === 1 && evidence[0] === 'verification-evidence' ? evidence : ['impact-evidence']) : evidence };
+        : semantic.taskKind === 'READ_ONLY' ? (semantic.verificationOnly || (evidence.length === 1 && evidence[0] === 'verification-evidence') ? ['verification-evidence'] : ['impact-evidence']) : evidence };
 }
 
   function buildRouteSummary({
@@ -2002,7 +2089,7 @@ function applyTaskSemantics(contract, semantic) {
     const buildSignal = /\b(build|create|add|implement|feature)\b/.test(raw);
     const debugSignal = intentMode === 'debug-specific' || /\b(root cause|debug|triage|flaky|investigate|why)\b/.test(raw);
     const reviewSignal = intentMode === 'review-specific' || /\b(review|audit|verify|release readiness)\b/.test(raw);
-    const failureSignal = /\b(failing|failed|broken|error|crash|timeout|undefined|exception|eacces|trace)\b/.test(raw);
+    const failureSignal = /\b(failing|failed|broken|error|crash|timeout|undefined|exception|eacces|trace)\b/.test(raw.replace(/\b(?:throw|raise|emit|reject|return|log|show|surface)(?:s|es|ing)?\s+(?:an?\s+|the\s+)?(?:[a-z-]+\s+){0,2}[a-z]*(?:error|exception)s?\b/g, ' '));
     const impactSignal = /\b(map impact|impact|blast radius|all affected|across (?:runtime|templates|helpers|adapters|mirrors)|affected adapters|affected mirrors|inspect impact)\b/.test(raw);
     const boundedEditSignal = /\b(one[- ]line|small|tiny|single|local|guard|log line|loading message|label)\b/.test(raw);
     const implementSignal = /\b(implement|apply|update|modify|add|create|ship|deliver|fix)\b/.test(raw)
@@ -2294,6 +2381,7 @@ function applyTaskSemantics(contract, semantic) {
       .replace(/\u0111/g, 'd');
     const trimmed = folded.trim();
     if (!trimmed) return false;
+    if (!String(commandText ?? '').trim() && classifyTaskSemantics({ promptText }).verificationOnly === true) return false;
     // C85-019c: clause strips must stop BEFORE a conjunction-joined imperative
     // — "giữ nguyên header và sửa lỗi login" keeps 'và sửa lỗi' as a surviving
     // order; an unbounded [^.,;\n]* swallows it and the order escapes the gate.
@@ -3218,6 +3306,9 @@ function applyTaskSemantics(contract, semantic) {
       // no-map routes keep the pre-BL-019 compact shape (identical to
       // route-task.mjs compactRouteSummary).
       ...(routeSummary.measuredTier != null ? { measuredTier: routeSummary.measuredTier } : {}),
+      // The tier lane survives compaction: the Stop-side playbook acceptance reads
+      // tierLane.delegationRequired off the persisted state (identical to route-task.mjs).
+      ...(routeSummary.tierLane ? { tierLane: routeSummary.tierLane } : {}),
       ...(routeSummary.routeVersion !== undefined
         ? {
             routeVersion: routeSummary.routeVersion,
@@ -3296,6 +3387,22 @@ function applyTaskSemantics(contract, semantic) {
       // BL-013: bounded history counters on the audit row — identical to the
       // helper's buildRouteAuditEntry emission.
       historySignals: routeSummary.historySignals ?? null,
+      // Orchestration telemetry — identical to the helper's buildOrchestrationAudit: requested
+      // lane/effort next to host evidence; effective model is never inferred (UNKNOWN).
+      orchestration: routeSummary?.tierLane && typeof routeSummary.tierLane === 'object'
+        ? {
+            mainTier: routeSummary.tierLane.mainTier ?? null,
+            mainTierSource: routeSummary.tierLane.mainTierSource ?? null,
+            requestedTier: routeSummary.tierLane.tier ?? null,
+            lane: routeSummary.tierLane.instruction
+              ? (routeSummary.tierLane.mainTier === 'smart' ? 'dispatch-worker' : 'handoff')
+              : 'inline',
+            requestedEffort: routeSummary.tierLane.effort ?? null,
+            effortBinding: routeSummary.tierLane.effortBinding ?? null,
+            effectiveEffort: process.env.CLAUDE_EFFORT || 'UNKNOWN',
+            effectiveModel: 'UNKNOWN',
+          }
+        : null,
     };
   }
 
@@ -3849,6 +3956,7 @@ function applyTaskSemantics(contract, semantic) {
   // (a prompt that lists "git push / npm publish" became a new MIXED git-integrity operation that a
   // verification-only turn can never satisfy). Only transcript metadata set by the harness or the
   // fixed compaction preamble counts - never the prompt's claims about itself.
+  let coordinationTurn = false;
   const systemOriginTurn = (() => {
     const promptTrim = extractPrompt(payload).trim();
     if (!promptTrim) return false;
@@ -3865,13 +3973,29 @@ function applyTaskSemantics(contract, semantic) {
         const lines = buf.toString('utf8').split('\n');
         for (let i = lines.length - 1; i >= 0; i -= 1) {
           const line = lines[i];
-          if (!line || !line.includes('"type":"user"')) continue;
+          if (!line) continue;
           let entry; try { entry = JSON.parse(line); } catch { continue; }
+          // Cross-session delivery is queued, not a user order. Require the host's
+          // consumed delivery record, exact content and this session's owner. An
+          // enqueue, a foreign delivery or a human-pasted envelope is not proof.
+          if (entry.type === 'queue-operation' && entry.operation === 'remove'
+            && entry.reason === 'absorbed_mid_turn' && entry.deliveryId
+            && sessionId && entry.sessionId === sessionId
+            && typeof entry.content === 'string' && entry.content.trim() === promptTrim
+            && /^<cross-session-message\s/.test(promptTrim)) {
+            coordinationTurn = true;
+            return false;
+          }
           if (entry.type !== 'user' || entry.isSidechain === true) continue;
           const content = entry.message?.content;
           const text = (typeof content === 'string' ? content
             : Array.isArray(content) ? content.map((b) => (b?.type === 'tool_result' ? '\u0000' : b?.text || '')).join('\n') : '').trim();
           if (!text || text.includes('\u0000') || /^Stop hook feedback/i.test(text)) continue;
+          if (entry.isMeta === true && entry.promptSource === 'system' && entry.turnOrigin === 'system'
+            && text === promptTrim && /^\[Cross-session (?:idle|delivery) notice\]/.test(text)) {
+            coordinationTurn = true;
+            return false;
+          }
           return entry.isMeta === true && (entry.turnOrigin === 'scheduled' || entry.promptSource === 'system')
             && text === promptTrim;
         }
@@ -3879,6 +4003,9 @@ function applyTaskSemantics(contract, semantic) {
     } catch {}
     return false;
   })();
+  // A notification has no task boundary or routing authority. Leave even an
+  // incomplete contract untouched; peer prose cannot clear or create its debt.
+  if (coordinationTurn) process.exit(0);
   const continuingTask = Boolean(previous.taskInstanceId && (payload.tool_name || continuationPrompt || systemOriginTurn));
   const taskInstanceId = continuingTask
     ? previous.taskInstanceId
@@ -4168,6 +4295,7 @@ function applyTaskSemantics(contract, semantic) {
     activeSkills: selected,
     historySignals: routeHistorySignals,
   }));
+  inheritTaskPlaybook(provisionalRouteSummary, previous, taskInstanceId);
   const provisionalState = {
     ...(sessionId ? { sessionId } : {}),
     requestKey,
@@ -4237,6 +4365,7 @@ function applyTaskSemantics(contract, semantic) {
         historySignals: routeHistorySignals,
       });
       mergeResolverFields(rescuedRouteSummary, reusedSharedFields, { onlyMissing: true });
+      inheritTaskPlaybook(rescuedRouteSummary, previous, taskInstanceId);
     }
     const reusedState = {
       ...cachedRouteState,
@@ -4278,6 +4407,7 @@ function applyTaskSemantics(contract, semantic) {
     if (reusedState.routeSummary?.delegateHint) {
       process.stdout.write(`[ukit-skill-router] Delegate: ${reusedState.routeSummary.delegateHint}\n`);
     }
+    writeTierLaneLines(reusedState.routeSummary, reusedState.taskInstanceId || taskInstanceId);
     if (
       reusedState.routeSummary?.helperHint
       && !reusedState.routeSummary?.nextActionCommand
@@ -4335,6 +4465,7 @@ function applyTaskSemantics(contract, semantic) {
       historySignals: routeHistorySignals,
     });
     mergeResolverFields(routeSummary, finalSharedFields);
+    inheritTaskPlaybook(routeSummary, previous, taskInstanceId);
     // BL-019 (SPEC FR-001): fold the persisted measured map into the route —
     // identical semantics to route-task.mjs finalizeTaskRoute / taskRouting.js
     // deriveTaskRoute: measuredTier emitted additively; modelTier follows the
@@ -4348,6 +4479,15 @@ function applyTaskSemantics(contract, semantic) {
     } catch {
       // static map stays authoritative
     }
+    try {
+      const tierLane = await loadTierLane();
+      if (tierLane && typeof tierLane.applyTierLaneToRouteSummary === 'function') {
+        tierLane.applyTierLaneToRouteSummary(routeSummary, { rootDir: projectRoot, config: runtimeConfig, subagentSession: payload.ukit_subagent_session === true, sessionId: payload.session_id ?? null });
+      }
+    } catch {
+      // no tier lane: the legacy inline behavior applies
+    }
+    inheritTaskPlaybook(routeSummary, previous, taskInstanceId);
 
 
   const fingerprint = buildRouteStateFingerprint({
@@ -4416,6 +4556,7 @@ function applyTaskSemantics(contract, semantic) {
   if (routeSummary.delegateHint) {
     process.stdout.write(`[ukit-skill-router] Delegate: ${routeSummary.delegateHint}\n`);
   }
+  writeTierLaneLines(routeSummary, taskInstanceId);
     if (
       routeSummary.helperHint
       && !routeSummary.nextActionCommand