@ngockhoale/ukit 3.4.47 → 3.4.49

package/template_project/.claude/hooks/skill-router.sh

@@ -407,6 +407,45 @@ setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
     return tierSelectionModule;
   }
 
+  // Tier lane: who performs the edit for the routed task (worker hand-off vs inline) for the MAIN
+  // session's tier. Same lazy pattern; a missing module degrades to no tier lane (legacy behavior).
+  let tierLaneModule = null;
+  let tierLaneLoadAttempted = false;
+  async function loadTierLane() {
+    if (!tierLaneLoadAttempted) {
+      tierLaneLoadAttempted = true;
+      try {
+        const modulePath = path.join(projectRoot, '.claude', 'ukit', 'index', 'tier-lane.mjs');
+        if (await pathExists(modulePath)) {
+          tierLaneModule = await import(pathToFileURL(modulePath).href);
+        }
+      } catch {
+        tierLaneModule = null;
+      }
+    }
+    return tierLaneModule;
+  }
+  // The persisted `tierLane` is what the Stop-side playbook acceptance reads (delegationRequired);
+  // the printed lines are what tell the model to dispatch the worker and tag its prompt.
+  function writeTierLaneLines(summary, taskId) {
+    const lane = summary?.tierLane;
+    if (!lane?.instruction) {
+      return;
+    }
+    process.stdout.write(`[ukit-skill-router] Tier lane: ${lane.instruction}\n`);
+    if (lane.delegationRequired === true && taskId) {
+      process.stdout.write(`[ukit-skill-router] Handback: start each worker prompt with "[ukit-task ${taskId}]" so its result binds to this task\n`);
+      const hostHarness = process.env.UKIT_HARNESS || 'claude-code';
+      if (summary.playbookId === 'feature-implementation' && hostHarness !== 'claude-code') {
+        // omp/codex expose no agent identity to hooks: the gate cannot refuse orchestrator writes there,
+        // so say what is actually enforced instead of promising a refusal.
+        process.stdout.write('[ukit-skill-router] Delegation required: dispatch the worker; do not implement inline. This host gives hooks no worker identity, so orchestrator writes are NOT refused and worker attribution is reported UNVERIFIED (never a full PASS). Verify with a bare runner command (no pipe/tail/grep) and read its exit status.\n');
+      } else if (summary.playbookId === 'feature-implementation') {
+        process.stdout.write('[ukit-skill-router] Delegation gate: source/test writes from this orchestrator (Edit/Write/Bash heredoc) are refused until a native Tier 2 worker has handed back; repeated attempts end the run BLOCKED. Verify with a bare runner command (no pipe/tail/grep) and read its exit status.\n');
+      }
+    }
+  }
+
   // BL-013: session-history extractor — same lazy pathToFileURL pattern as the
   // shared resolver. Async extraction (fsp tail read ≤16KiB) so a stalled mount
   // never parks the event loop under the armed deadline (BUG-C21-04 posture);
@@ -620,6 +659,27 @@ setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
     }
   }
 
+  // A PreToolUse/continuation pass routes from the tool call alone (no prompt text), so the playbook
+  // the originating prompt selected resolves to null and would erase the task's playbook + delegation
+  // requirement from state — leaving the acceptance NOT_APPLICABLE. Within the SAME task instance the
+  // playbook is task-owned: carry it (and its tier lane) forward; never across task instances.
+  function inheritTaskPlaybook(routeSummary, previousState, taskId) {
+    const prev = previousState?.routeSummary;
+    if (!routeSummary || !prev?.playbookId) return;
+    if (!taskId || previousState.taskInstanceId !== taskId) return;
+    if (!routeSummary.playbookId) {
+      for (const key of ['playbookId', 'workGroup', 'playbookReason', 'playbookLoad', 'path', 'fastPathKind']) {
+        if (prev[key] !== undefined && prev[key] !== null) routeSummary[key] = prev[key];
+      }
+    }
+    // The delegation demand is task-owned too: a later per-tool route (e.g. a docs Edit) derives its own
+    // lane from its own contract, and must not erase the demand the feature prompt established.
+    if (routeSummary.playbookId === prev.playbookId && prev.tierLane?.delegationRequired === true
+        && routeSummary.tierLane?.delegationRequired !== true) {
+      routeSummary.tierLane = prev.tierLane;
+    }
+  }
+
   async function existsSkill(projectRoot, relativePath) {
     return pathExists(path.join(projectRoot, relativePath));
   }
@@ -750,7 +810,7 @@ setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
     }
 
     if (concreteTask) {
-      if (/\b(bug|debug|error|crash|broken|failing|stack trace|triage|fix|timeout)\b/.test(lower)) {
+      if (/\b(bug|debug|error|crash|broken|failing|stack trace|triage|fix|timeout)\b/.test(lower.replace(/\b(?:throw|raise|emit|reject|return|log|show|surface)(?:s|es|ing)?\s+(?:an?\s+|the\s+)?(?:[a-z-]+\s+){0,2}[a-z]*(?:error|exception)s?\b/g, ' '))) {
         return 'debug-specific';
       }
       if (/\b(review|audit|diff|pr feedback|code review|kiem tra|soat)\b/.test(raw)) {
@@ -1821,19 +1881,51 @@ function nativeOperationGoal(domain, actionable, text) {
 // Vietnamese negators scope to the sentence end as well. Noun uses of verbs ("write/verification advisory", "each proposed
 // fix", "state change") name things, not orders. Neutralised spans become blanks, never new orders.
 const NON_ORDER_VERBS = 'implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|restart|sua|viet|chinh|them|tao|xoa';
+// Declared verification purpose ("Mục tiêu: xác nhận ...", "Goal: verify ..."). Under that declaration a
+// conditional repair/release branch ("Nếu phát hiện lỗi ... sửa ...", "Neu co source fix ... publish") is a
+// branch the check MAY take, not an unconditional order, and disposable test-project setup ("Tạo project thử
+// nghiệm độc lập") is scaffolding of the check. Unconditional orders in the same request keep blocking.
+const VERIFICATION_GOAL = /(?:^|\n)[ \t*#_-]*(?:muc tieu|goal|purpose|objective)\s*:[^\n]*\b(?:xac nhan|verify|confirm|kiem tra|validate|double-?check|re-?run)\b/;
+const CONDITIONAL_BRANCH = /(?:^|\n|\.\s+)[ \t]*(?:\d+[.)]\s*)?(?:neu\s+(?:phat hien\s+(?:false-block|loi|bug|defect)|co\s+(?:source fix|sua doi))|if\s+(?:(?:a\s+)?(?:bug|defect|failure)\s+is\s+found|(?:you\s+)?find\s+(?:a\s+)?(?:bug|defect)))\b[^\n]*?(?=\.\s+|$|\n)/g;
+const GOAL_LABEL = /\b(?:muc tieu|goal|purpose|objective)\s*:/g;
+const DISPOSABLE_SETUP = /\b(?:tao|create)\s+(?:mot\s+)?(?:project|du an)\s+(?:thu nghiem|test|disposable|doc lap)\b(?:\s+(?:doc lap|independent))?/g;
 function neutralizeNonOrders(text) {
-  return String(text)
+  let source = String(text).replace(/```[\s\S]*?```/g, ' ').replace(/^[ \t]*>.*$/gm, ' ');
+  if (VERIFICATION_GOAL.test(source)) source = source.replace(GOAL_LABEL, ' ').replace(CONDITIONAL_BRANCH, '\n').replace(DISPOSABLE_SETUP, ' ');
+  return source
     .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|shall\\s+not)\\s+[^.;\\n]*?(?=(?<!,)\\s+(?:and|va)\\s+(?:${NON_ORDER_VERBS})\\b|\\s+(?:but|nhung|then|however)\\b|[.;\\n]|$)`, 'g'), ' ')
     .replace(new RegExp(`\\b(?:khong|chua)\\s+[^.;\\n]*?(?=\\s+(?:nhung|tuy nhien)\\b|[.;\\n]|$)`, 'g'), ' ')
     .replace(/"[^"\n]*\s[^"\n]*"|`[^`\n]*\s[^`\n]*`|\u201c[^\u201d\n]*\u201d/g, ' ')
-    .replace(/\b(?:neu\s+(?:phai|can|thieu|khong du|bang chung chua du)|if\s+(?:needed|necessary|required|evidence is insufficient))\b[^.;\n]*/g, ' ')
+    .replace(/\b(?:neu\s+(?:phai|can|thieu|khong du|bang chung chua du)(?![^.;\n]*\b(?:restart|deploy|xoa|delete|remove|cancel)\b)|if\s+(?:needed|necessary|required|evidence is insufficient))\b[^.;\n]*/g, ' ')
     .replace(/[^.;\n]*\b(?:nao|gi|sao|the nao|bao nhieu)\b[^.;\n]*\?/g, ' ')
-    .replace(/\bchinh\s+xac\b|\b(?:phuong an|cach|de xuat|ban)\s+(?:sua|fix)\b/g, ' ')
+    .replace(/\bchinh\s+(?:xac|sach)\b|\b(?:phuong an|cach|de xuat|ban)\s+(?:sua|fix)\b|\b(?:diem|cho|muc|phan)\s+(?:phai|can|nen)\s+(?:sua|fix)\b/g, ' ')
     .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
     .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
     .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ');
 }
 
+const ORDER_VERBS = 'implement|fix|apply|refactor|modify|edit|write|update|add|create|build|install|deploy|redeploy|restart|push|commit|rename|remove|delete|replace|change|sua|viet|chinh|them|tao|xoa|enable|disable|set|toggle|configure|migrate|upgrade|publish|release|trien khai|khoi dong lai|(?:run|execute)\\s+(?:git\\s+(?:push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)|(?:npm|yarn)\\s+publish)|git\\s+(?:push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)';
+const IMPERATIVE_ORDER = new RegExp(`^(?:[-*+\\u2022>\\d.)\\s]*)(?:(?:please|hay|vui long|now|also|first|then)\\s+)*(?:${ORDER_VERBS})\\b\\s+\\S`);
+const MODAL_ORDER = new RegExp(`\\b(?:please|hay|vui long|need to|needs to|must|should|want(?:\\s+you)? to|toi muon|can phai|yeu cau)\\s+(?:[\\w-]+\\s+){0,2}(?:${ORDER_VERBS})\\b`);
+function hasExplicitOrder(clauses) {
+  return clauses.some((clause) => IMPERATIVE_ORDER.test(clause) || MODAL_ORDER.test(clause));
+}
+// Verification-only request. Root cause of a false `write-evidence` block on a "verify / re-run /
+// confirm" prompt: the vocabulary scans counted nouns and compounds ("coordinator fix", "re-run",
+// "template/install", "source change") as mutation orders. Order is structural: a request whose
+// command-position verbs are verification verbs, with no explicit order (hasExplicitOrder) and no
+// change-leading clause, orders no change - it owes verification evidence, not a write.
+const VERIFY_LEAD = /^(?:[-*+•>\d.)\s]*)(?:(?:please|hay|vui long|now|also|first|then)\s+)*(?:verify|re-?run|confirm|xac nhan|validate|double-?check)\b/;
+const CHANGE_LEAD = /^(?:[-*+•>\d.)\s]*)(?:(?:please|hay|vui long|now|also|first|then)\s+)*(?:make|rebuild|redo|rewrite|restore|revert|correct|clean|patch|resolve|ensure|run(?!(?=[^.]*\b(?:tests?|suite|gate|checks?|lint|typecheck|pilot|smoke|e2e|verif\w*|vitest|jest|audit)\b)))\b/;
+function isVerificationOnlyRequest(promptText) {
+  const plain = String(promptText ?? '').normalize('NFD').replace(/[̀-ͯ]/g, '').replace(/[đĐ]/g, 'd').toLowerCase()
+    .replace(/```[\s\S]*?```/g, ' ').replace(/^[ \t]*>.*$/gm, ' ');
+  const clauses = neutralizeNonOrders(plain).split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/)
+    .map((clause) => clause.split(/\bwithout\b/)[0]);
+  return clauses.some((clause) => VERIFY_LEAD.test(clause)) && !hasExplicitOrder(clauses)
+    && !clauses.some((clause) => CHANGE_LEAD.test(clause));
+}
+
 function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
   // A named preflight and both explicit branches are required; a failed arbitrary test is not a release policy.
   const releaseText = String(promptText).normalize('NFD').replace(/[̀-ͯ]/g, '').replace(/[đĐ]/g, 'd').toLowerCase();
@@ -1862,10 +1954,15 @@ function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
   // runtime are separate domains with separate proof; a prompt naming both stays a coding
   // task rather than being half-verified. A code-change verb anywhere keeps write evidence.
   const gitOperation = actionable.some((clause) => /\bgit\s+(?:push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)\b|\bpush\s+(?:to\s+)?origin\b/.test(clause));
-  const runtimeOperation = actionable.some((clause) => /\b(?:restart|redeploy|deploy|khoi dong lai|trien khai)\b/.test(clause)
+  // 'trien khai' is Vietnamese for both "deploy" and "implement": it orders a runtime operation only
+  // when it names a runtime target; bare it describes work ("Tier 3 truc tiep trien khai thay Tier 2").
+  // "restart"/"deploy" after a noun modifier ("process restart", "after redeploy") is a scenario, not an order.
+  const runtimeOperation = actionable.some((clause) => /(?<!\b(?:process|crash|hard|soft|graceful|after|upon|during|across|following)\s)\b(?:restart|redeploy|deploy|khoi dong lai|trien khai\s+(?:len\s+)?(?:service|server|production|prod|staging|dich vu|may chu|moi truong))\b/.test(clause)
     && !/\.[cm]?[jt]sx?\b/.test(clause) && !/\bgit\b/.test(clause));
   const nativeDomain = cronOperation ? 'scheduled-job' : gitOperation !== runtimeOperation ? (gitOperation ? 'git-integrity' : 'service-runtime') : null;
   const operation = Boolean(nativeDomain);
+  // A verification-only request orders no change; a concrete operation order (cancel/restart/push) stays operational.
+  if (!releasePolicy && !operation && isVerificationOnlyRequest(promptText)) return { taskKind: 'READ_ONLY', verificationOnly: true };
   // A config MENTION is not a config change: the same clause needs a mutation verb, and a
   // request that also changes source/code is a coding task (config is part of its tests/fixtures).
   const config = !sourceOrder && actionable.some((clause) => /\b(?:configuration|config|toggle|cau hinh)\b/.test(clause)
@@ -1895,7 +1992,7 @@ function applyTaskSemantics(contract, semantic) {
     completionEvidence: semantic.taskKind === 'DOCUMENTATION_OUTPUT' ? ['report-artifact'] : operationOnly ? ['operation-verification']
       : semantic.taskKind === 'MIXED' ? [...new Set([...evidence, 'write-evidence', 'operation-verification'])]
         : semantic.taskKind === 'READ_ONLY' && semantic.statusReport ? []
-        : semantic.taskKind === 'READ_ONLY' ? (evidence.length === 1 && evidence[0] === 'verification-evidence' ? evidence : ['impact-evidence']) : evidence };
+        : semantic.taskKind === 'READ_ONLY' ? (semantic.verificationOnly || (evidence.length === 1 && evidence[0] === 'verification-evidence') ? ['verification-evidence'] : ['impact-evidence']) : evidence };
 }
 
   function buildRouteSummary({
@@ -2002,7 +2099,7 @@ function applyTaskSemantics(contract, semantic) {
     const buildSignal = /\b(build|create|add|implement|feature)\b/.test(raw);
     const debugSignal = intentMode === 'debug-specific' || /\b(root cause|debug|triage|flaky|investigate|why)\b/.test(raw);
     const reviewSignal = intentMode === 'review-specific' || /\b(review|audit|verify|release readiness)\b/.test(raw);
-    const failureSignal = /\b(failing|failed|broken|error|crash|timeout|undefined|exception|eacces|trace)\b/.test(raw);
+    const failureSignal = /\b(failing|failed|broken|error|crash|timeout|undefined|exception|eacces|trace)\b/.test(raw.replace(/\b(?:throw|raise|emit|reject|return|log|show|surface)(?:s|es|ing)?\s+(?:an?\s+|the\s+)?(?:[a-z-]+\s+){0,2}[a-z]*(?:error|exception)s?\b/g, ' '));
     const impactSignal = /\b(map impact|impact|blast radius|all affected|across (?:runtime|templates|helpers|adapters|mirrors)|affected adapters|affected mirrors|inspect impact)\b/.test(raw);
     const boundedEditSignal = /\b(one[- ]line|small|tiny|single|local|guard|log line|loading message|label)\b/.test(raw);
     const implementSignal = /\b(implement|apply|update|modify|add|create|ship|deliver|fix)\b/.test(raw)
@@ -2294,6 +2391,7 @@ function applyTaskSemantics(contract, semantic) {
       .replace(/\u0111/g, 'd');
     const trimmed = folded.trim();
     if (!trimmed) return false;
+    if (!String(commandText ?? '').trim() && classifyTaskSemantics({ promptText }).verificationOnly === true) return false;
     // C85-019c: clause strips must stop BEFORE a conjunction-joined imperative
     // — "giữ nguyên header và sửa lỗi login" keeps 'và sửa lỗi' as a surviving
     // order; an unbounded [^.,;\n]* swallows it and the order escapes the gate.
@@ -3218,6 +3316,9 @@ function applyTaskSemantics(contract, semantic) {
       // no-map routes keep the pre-BL-019 compact shape (identical to
       // route-task.mjs compactRouteSummary).
       ...(routeSummary.measuredTier != null ? { measuredTier: routeSummary.measuredTier } : {}),
+      // The tier lane survives compaction: the Stop-side playbook acceptance reads
+      // tierLane.delegationRequired off the persisted state (identical to route-task.mjs).
+      ...(routeSummary.tierLane ? { tierLane: routeSummary.tierLane } : {}),
       ...(routeSummary.routeVersion !== undefined
         ? {
             routeVersion: routeSummary.routeVersion,
@@ -3296,6 +3397,22 @@ function applyTaskSemantics(contract, semantic) {
       // BL-013: bounded history counters on the audit row — identical to the
       // helper's buildRouteAuditEntry emission.
       historySignals: routeSummary.historySignals ?? null,
+      // Orchestration telemetry — identical to the helper's buildOrchestrationAudit: requested
+      // lane/effort next to host evidence; effective model is never inferred (UNKNOWN).
+      orchestration: routeSummary?.tierLane && typeof routeSummary.tierLane === 'object'
+        ? {
+            mainTier: routeSummary.tierLane.mainTier ?? null,
+            mainTierSource: routeSummary.tierLane.mainTierSource ?? null,
+            requestedTier: routeSummary.tierLane.tier ?? null,
+            lane: routeSummary.tierLane.instruction
+              ? (routeSummary.tierLane.mainTier === 'smart' ? 'dispatch-worker' : 'handoff')
+              : 'inline',
+            requestedEffort: routeSummary.tierLane.effort ?? null,
+            effortBinding: routeSummary.tierLane.effortBinding ?? null,
+            effectiveEffort: process.env.CLAUDE_EFFORT || 'UNKNOWN',
+            effectiveModel: 'UNKNOWN',
+          }
+        : null,
     };
   }
 
@@ -3849,6 +3966,7 @@ function applyTaskSemantics(contract, semantic) {
   // (a prompt that lists "git push / npm publish" became a new MIXED git-integrity operation that a
   // verification-only turn can never satisfy). Only transcript metadata set by the harness or the
   // fixed compaction preamble counts - never the prompt's claims about itself.
+  let coordinationTurn = false;
   const systemOriginTurn = (() => {
     const promptTrim = extractPrompt(payload).trim();
     if (!promptTrim) return false;
@@ -3865,13 +3983,29 @@ function applyTaskSemantics(contract, semantic) {
         const lines = buf.toString('utf8').split('\n');
         for (let i = lines.length - 1; i >= 0; i -= 1) {
           const line = lines[i];
-          if (!line || !line.includes('"type":"user"')) continue;
+          if (!line) continue;
           let entry; try { entry = JSON.parse(line); } catch { continue; }
+          // Cross-session delivery is queued, not a user order. Require the host's
+          // consumed delivery record, exact content and this session's owner. An
+          // enqueue, a foreign delivery or a human-pasted envelope is not proof.
+          if (entry.type === 'queue-operation' && entry.operation === 'remove'
+            && entry.reason === 'absorbed_mid_turn' && entry.deliveryId
+            && sessionId && entry.sessionId === sessionId
+            && typeof entry.content === 'string' && entry.content.trim() === promptTrim
+            && /^<cross-session-message\s/.test(promptTrim)) {
+            coordinationTurn = true;
+            return false;
+          }
           if (entry.type !== 'user' || entry.isSidechain === true) continue;
           const content = entry.message?.content;
           const text = (typeof content === 'string' ? content
             : Array.isArray(content) ? content.map((b) => (b?.type === 'tool_result' ? '\u0000' : b?.text || '')).join('\n') : '').trim();
           if (!text || text.includes('\u0000') || /^Stop hook feedback/i.test(text)) continue;
+          if (entry.isMeta === true && entry.promptSource === 'system' && entry.turnOrigin === 'system'
+            && text === promptTrim && /^\[Cross-session (?:idle|delivery) notice\]/.test(text)) {
+            coordinationTurn = true;
+            return false;
+          }
           return entry.isMeta === true && (entry.turnOrigin === 'scheduled' || entry.promptSource === 'system')
             && text === promptTrim;
         }
@@ -3879,6 +4013,9 @@ function applyTaskSemantics(contract, semantic) {
     } catch {}
     return false;
   })();
+  // A notification has no task boundary or routing authority. Leave even an
+  // incomplete contract untouched; peer prose cannot clear or create its debt.
+  if (coordinationTurn) process.exit(0);
   const continuingTask = Boolean(previous.taskInstanceId && (payload.tool_name || continuationPrompt || systemOriginTurn));
   const taskInstanceId = continuingTask
     ? previous.taskInstanceId
@@ -4168,6 +4305,7 @@ function applyTaskSemantics(contract, semantic) {
     activeSkills: selected,
     historySignals: routeHistorySignals,
   }));
+  inheritTaskPlaybook(provisionalRouteSummary, previous, taskInstanceId);
   const provisionalState = {
     ...(sessionId ? { sessionId } : {}),
     requestKey,
@@ -4237,6 +4375,7 @@ function applyTaskSemantics(contract, semantic) {
         historySignals: routeHistorySignals,
       });
       mergeResolverFields(rescuedRouteSummary, reusedSharedFields, { onlyMissing: true });
+      inheritTaskPlaybook(rescuedRouteSummary, previous, taskInstanceId);
     }
     const reusedState = {
       ...cachedRouteState,
@@ -4278,6 +4417,7 @@ function applyTaskSemantics(contract, semantic) {
     if (reusedState.routeSummary?.delegateHint) {
       process.stdout.write(`[ukit-skill-router] Delegate: ${reusedState.routeSummary.delegateHint}\n`);
     }
+    writeTierLaneLines(reusedState.routeSummary, reusedState.taskInstanceId || taskInstanceId);
     if (
       reusedState.routeSummary?.helperHint
       && !reusedState.routeSummary?.nextActionCommand
@@ -4335,6 +4475,7 @@ function applyTaskSemantics(contract, semantic) {
       historySignals: routeHistorySignals,
     });
     mergeResolverFields(routeSummary, finalSharedFields);
+    inheritTaskPlaybook(routeSummary, previous, taskInstanceId);
     // BL-019 (SPEC FR-001): fold the persisted measured map into the route —
     // identical semantics to route-task.mjs finalizeTaskRoute / taskRouting.js
     // deriveTaskRoute: measuredTier emitted additively; modelTier follows the
@@ -4348,6 +4489,15 @@ function applyTaskSemantics(contract, semantic) {
     } catch {
       // static map stays authoritative
     }
+    try {
+      const tierLane = await loadTierLane();
+      if (tierLane && typeof tierLane.applyTierLaneToRouteSummary === 'function') {
+        tierLane.applyTierLaneToRouteSummary(routeSummary, { rootDir: projectRoot, config: runtimeConfig, subagentSession: payload.ukit_subagent_session === true, sessionId: payload.session_id ?? null });
+      }
+    } catch {
+      // no tier lane: the legacy inline behavior applies
+    }
+    inheritTaskPlaybook(routeSummary, previous, taskInstanceId);
 
 
   const fingerprint = buildRouteStateFingerprint({
@@ -4416,6 +4566,7 @@ function applyTaskSemantics(contract, semantic) {
   if (routeSummary.delegateHint) {
     process.stdout.write(`[ukit-skill-router] Delegate: ${routeSummary.delegateHint}\n`);
   }
+  writeTierLaneLines(routeSummary, taskInstanceId);
     if (
       routeSummary.helperHint
       && !routeSummary.nextActionCommand

package/template_project/.claude/settings.json

@@ -1,9 +1,9 @@
 {
-  "model": "sonnet",
+  "model": "opus",
   "fastMode": false,
   "fastModePerSessionOptIn": false,
   "alwaysThinkingEnabled": true,
-  "effortLevel": "high",
+  "effortLevel": "medium",
   "includeGitInstructions": false,
   "promptSuggestionEnabled": false,
   "showThinkingSummaries": false,
@@ -74,8 +74,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/protect-files.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/stale-spec-guard.sh\":11 \"$CLAUDE_PROJECT_DIR/.claude/hooks/pre-edit-backup.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/skill-router.sh\":20 \"$CLAUDE_PROJECT_DIR/.claude/hooks/handoff-model-guard.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/context-hardcap-gate.sh\":8",
-            "timeout": 73
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/protect-files.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/stale-spec-guard.sh\":11 \"$CLAUDE_PROJECT_DIR/.claude/hooks/pre-edit-backup.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/skill-router.sh\":20 \"$CLAUDE_PROJECT_DIR/.claude/hooks/delegation-gate.mjs\":10 \"$CLAUDE_PROJECT_DIR/.claude/hooks/handoff-model-guard.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/context-hardcap-gate.sh\":8",
+            "timeout": 83
           }
         ]
       },
@@ -84,8 +84,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/handoff-model-guard.sh\":8",
-            "timeout": 18
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/delegation-gate.mjs\":10 \"$CLAUDE_PROJECT_DIR/.claude/hooks/handoff-model-guard.sh\":8",
+            "timeout": 28
           }
         ]
       },
@@ -94,8 +94,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/auto-allow-bash.sh\":15 \"$CLAUDE_PROJECT_DIR/.claude/hooks/block-dangerous.mjs\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/sensitive-data-guard.mjs\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/handoff-model-guard.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/context-hardcap-gate.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/verification-guard.sh\":8",
-            "timeout": 65
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/ukit/runtime/hook-chain-runner.mjs\" --emit-verdict - \"$CLAUDE_PROJECT_DIR/.claude/hooks/auto-allow-bash.sh\":15 \"$CLAUDE_PROJECT_DIR/.claude/hooks/block-dangerous.mjs\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/sensitive-data-guard.mjs\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/delegation-gate.mjs\":10 \"$CLAUDE_PROJECT_DIR/.claude/hooks/handoff-model-guard.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/context-hardcap-gate.sh\":8 \"$CLAUDE_PROJECT_DIR/.claude/hooks/verification-guard.sh\":8",
+            "timeout": 75
           }
         ]
       }

package/template_project/.claude/ukit/index/playbook-registry.mjs

@@ -113,6 +113,20 @@ function hasSqlIntent(text) {
 // The SQL ask touches shape/data rather than a read-only query — routes the
 // migration row instead of a feature build.
 const SQL_SCHEMA_RE = /(?<![A-Za-z0-9_])(?:ddl|alter|drop|(?:create|alter|drop|truncate)\s+table|(?:add|drop|rename|change|modify|update|thêm|xóa|xoá|sửa|sua|đổi|doi)\s+(?:a\s+|the\s+|new\s+|một\s+)*(?:column|cột|cot)(?!\s+of\b)|kiểu\s+dữ\s+liệu|kieu\s+du\s+lieu|data\s?type|not\s+null|constraint|migration|migrate)(?![A-Za-z0-9_])/i;
+// Explicit delegation order: the user themself asks for a worker/subagent to implement
+// ("Delegate the implementation to a worker agent", "have a subagent implement it"). That is an
+// opt-in to the orchestrated path (Tier 3 orchestrates, Tier 2 implements, integration verified by
+// the orchestrator), so it lifts the small-feature fast path into feature-implementation. Live omp
+// run: this exact order stayed on small-feature (explicit-local-target fast path, subagents
+// suppressed) and the Tier 3 main implemented nothing of the delegation. Bare mentions of the
+// words ("worker thread", "the delegate pattern") do not match; negated orders ("don't delegate")
+// veto.
+const DELEGATION_ORDER_RE = /\bdelegat(?:e|ing)\b[^.\n]{0,80}?\bto\s+(?:an?\s+|the\s+|your\s+)?(?:[\w-]+\s+){0,2}?(?:worker|sub-?agents?|agents?|implementer)\b|\b(?:use|spawn|dispatch|launch|assign|have|let)\s+(?:an?\s+|the\s+|your\s+)?(?:[\w-]+\s+)?(?:worker|sub-?agents?|implementer)(?:\s+agent)?\s+(?:to|for)\b|(?<![A-Za-z0-9_])giao\s+(?:việc\s+)?cho\s+(?:worker|sub-?agent|agent)/i;
+const DELEGATION_NEGATED_RE = /\b(?:don['’]?t|do\s+not|never|without|avoid|no\s+need\s+to)\s+(?:[\w-]+\s+){0,2}?(?:delegat\w*|(?:use|spawn|dispatch)\s+(?:an?\s+|any\s+)?(?:worker|sub-?agents?))|\bno\s+(?:worker|sub-?agents?|delegation)\b|\b(?:inline|yourself)\s+(?:only|not)\b/i;
+export function hasDelegationOrder(text) {
+  const t = String(text ?? '');
+  return DELEGATION_ORDER_RE.test(t) && !DELEGATION_NEGATED_RE.test(t);
+}
 // Reuse-first ask: "use the existing/core function", "dùng hàm có sẵn",
 // "tái sử dụng" — search for the function before writing a new one.
 const REUSE_FIRST_RE = /(?:\buse\s+(?:the\s+)?(?:existing|core|shared|same|current)\b)|(?:\buse\s+[\w.]+\s+from\s+(?:the\s+)?(?:core|shared|utils?|common|lib)\b)|\b(?:existing|core|shared)\s+(?:function|helper|util(?:ity|ities)?|service|component)\b|\breuse\b|(?<![A-Za-z0-9_])(?:tái\s+sử\s+dụng|tai\s+su\s+dung)|(?<![A-Za-z0-9_])(?:dùng|dung|dựa|dua)\s+(?:vào\s+|vao\s+)?(?:hàm|ham)(?:\s+(?:có\s+sẵn|co\s+san|sẵn\s+có|san\s+co|đã\s+có|da\s+co|cũ|cu))?(?![A-Za-z0-9_])/i;
@@ -173,7 +187,7 @@ export const PLAYBOOK_ROUTING_TABLE = Object.freeze([
     // contract signals) escalates to feature-implementation. Reference-driven,
     // clone, reuse-first and SQL-schema asks take the same escape: they name a
     // source of truth or a data contract the small path must not gloss over.
-    discriminator: (s) => !s.escalated && !s.contractSignal && !s.multiSurface && !s.sqlSchemaChange && !s.referenceTarget && !s.cloneIntent && !s.reuseFirst && s.changeVerbOrCreate,
+    discriminator: (s) => !s.escalated && !s.contractSignal && !s.multiSurface && !s.sqlSchemaChange && !s.referenceTarget && !s.cloneIntent && !s.reuseFirst && !s.delegationOrdered && s.changeVerbOrCreate,
     fastPath: 'small-feature',
   },
   {
@@ -194,7 +208,7 @@ export const PLAYBOOK_ROUTING_TABLE = Object.freeze([
     // migration row instead of capturing the build lane.
     discriminator: (s) => (
       (s.contractSignal || s.multiSurface || (s.escalated && !s.sqlSchemaChange) || s.wiredShipAsk)
-      || ((s.referenceTarget || s.cloneIntent || s.reuseFirst) && s.defectIdx === -1)
+      || ((s.referenceTarget || s.cloneIntent || s.reuseFirst || s.delegationOrdered) && s.defectIdx === -1)
     ) && !s.disposable && !s.releaseAsk,
   },
   {
@@ -290,7 +304,9 @@ export const PLAYBOOK_ROUTING_TABLE = Object.freeze([
     lanes: ['local-fix', 'review-release'],
     triggers: [/\bverify\b|\bcheck\b|\bconfirm\b|\bprove\b|\bvalidate\b|\bassert\b/i],
     // the ask IS a check — a check verb leads, or no defect verb exists at all.
-    discriminator: (s) => s.checkFirst || s.defectIdx === -1,
+    // A build/create verb that leads the ask makes the check its closing step ("implement X … then run the
+    // tests and confirm"), not the ask itself — the build row owns it instead of tying into ambiguity.
+    discriminator: (s) => (s.checkFirst || s.defectIdx === -1) && !s.buildLeadsCheck,
   },
   {
     workGroup: 'skill-evaluation',
@@ -408,6 +424,7 @@ async function buildRouteSignals({
   const explanationAsk = explainIdx !== -1 && (firstVerbIdx === -1 || explainIdx < firstVerbIdx);
   const changeRequested = !consultLead && firstVerbIdx !== -1 && (explainIdx === -1 || firstVerbIdx < explainIdx);
   const checkFirst = checkIdx !== -1 && (defectIdx === -1 || checkIdx < defectIdx);
+  const buildLeadsCheck = changeRequested && checkIdx !== -1 && firstVerbIdx !== -1 && firstVerbIdx < checkIdx;
   // C85-019: a QUESTION about a defect is not a defect order. The bug-fix floor
   // demands repro+root-cause receipts — demanding them on a "did it get fixed
   // yet?" turn forces edits nobody asked for (user-reported lock). Question
@@ -439,12 +456,14 @@ async function buildRouteSignals({
     changeRequested,
     questionAsk,
     checkFirst,
+    buildLeadsCheck,
     changeVerbOrCreate: changeIdx !== -1 || createIdx !== -1,
     referenceTarget,
     cloneIntent,
     sqlIntent,
     sqlSchemaChange: sqlIntent && SQL_SCHEMA_RE.test(signalText),
     reuseFirst,
+    delegationOrdered: hasDelegationOrder(signalText) && changeRequested,
     contractSignal: CONTRACT_SIGNAL_RE.test(signalText) || /\boauth\b/i.test(signalText),
     multiSurface: MULTI_SURFACE_RE.test(signalText),
     escalated: Array.isArray(escalationTriggers) && escalationTriggers.length > 0,

package/template_project/.claude/ukit/index/route-resolver.mjs

@@ -249,36 +249,39 @@ export function buildExecutionContract(executionMode = null) {
 // base row; resolveModelTier adds the (riskFloor, hostCapabilities) columns.
 // Deterministic — no registry, no leases, no outbound capability calls.
 // Literal mirror of src/core/executionContracts.js resolveModelTier.
-const MODEL_TIER_ORDER = ['lite', 'code', 'smart'];
+// Tier, effort and risk are independent decisions. Effort is Medium for every tier (Low for chores);
+// High needs complexity evidence (`complexityEvidence` below), never risk or tier alone.
 const MODEL_TIER_EFFORT = {
   lite: 'low',
   code: 'medium',
-  smart: 'high',
+  smart: 'medium',
 };
 
 /**
- * Resolves {tier, effort, advisoryOnly} for a route. A 'high-risk' floor escalates
- * the tier one band (lite→code→smart, capped at smart) and forces effort 'high'.
- * Unknown mode → {tier:null, effort:null, advisoryOnly:true}. Missing/unknown
- * riskFloor → 'none'. Missing hostCapabilities → advisoryOnly:true (the route text
- * is all the host gets when it cannot bind model and effort).
+ * Resolves {tier, effort, advisoryOnly} for a route. A 'high-risk' floor lifts a Tier 1 chore to the
+ * Tier 2 executor (lite→code) and goes no further: smart is the orchestrator / acceptance tier and is
+ * reached only through its own contract (review-release) or failure evidence, never through risk, so
+ * risk cannot turn the orchestrator into the implementation worker. Risk raises verification rigor
+ * (the route's riskFloor / rigor), not the tier ceiling or the effort. Effort is 'high' only with
+ * `complexityEvidence`. Unknown mode → {tier:null, effort:null, advisoryOnly:true}. Missing/unknown
+ * riskFloor → 'none'. Missing hostCapabilities → advisoryOnly:true (the route text is all the host
+ * gets when it cannot bind model and effort).
  */
 export function resolveModelTier({
   executionMode = null,
   riskFloor = null,
   hostCapabilities = null,
+  complexityEvidence = false,
 } = {}) {
   const baseTier = buildExecutionContract(executionMode)?.modelTier ?? null;
   if (!baseTier) {
     return { tier: null, effort: null, advisoryOnly: true };
   }
   const highRisk = riskFloor?.floor === 'high-risk';
-  const tier = highRisk
-    ? MODEL_TIER_ORDER[Math.min(MODEL_TIER_ORDER.indexOf(baseTier) + 1, MODEL_TIER_ORDER.length - 1)]
-    : baseTier;
+  const tier = highRisk && baseTier === 'lite' ? 'code' : baseTier;
   return {
     tier,
-    effort: highRisk ? 'high' : MODEL_TIER_EFFORT[tier],
+    effort: complexityEvidence === true ? 'high' : MODEL_TIER_EFFORT[tier],
     advisoryOnly: !(hostCapabilities?.canBindModel === true && hostCapabilities?.canBindEffort === true),
   };
 }
@@ -1093,19 +1096,72 @@ function nativeOperationGoal(domain, actionable, text) {
 // Vietnamese negators scope to the sentence end as well. Noun uses of verbs ("write/verification advisory", "each proposed
 // fix", "state change") name things, not orders. Neutralised spans become blanks, never new orders.
 const NON_ORDER_VERBS = 'implement|apply|update|modify|add|create|ship|deliver|fix|refactor|remove|delete|rename|change|write|build|make|install|run|deploy|execute|edit|restart|sua|viet|chinh|them|tao|xoa';
+// Declared verification purpose ("Mục tiêu: xác nhận ...", "Goal: verify ..."). Under that declaration a
+// conditional repair/release branch ("Nếu phát hiện lỗi ... sửa ...", "Neu co source fix ... publish") is a
+// branch the check MAY take, not an unconditional order, and disposable test-project setup ("Tạo project thử
+// nghiệm độc lập") is scaffolding of the check. Unconditional orders in the same request keep blocking.
+const VERIFICATION_GOAL = /(?:^|\n)[ \t*#_-]*(?:muc tieu|goal|purpose|objective)\s*:[^\n]*\b(?:xac nhan|verify|confirm|kiem tra|validate|double-?check|re-?run)\b/;
+const CONDITIONAL_BRANCH = /(?:^|\n|\.\s+)[ \t]*(?:\d+[.)]\s*)?(?:neu\s+(?:phat hien\s+(?:false-block|loi|bug|defect)|co\s+(?:source fix|sua doi))|if\s+(?:(?:a\s+)?(?:bug|defect|failure)\s+is\s+found|(?:you\s+)?find\s+(?:a\s+)?(?:bug|defect)))\b[^\n]*?(?=\.\s+|$|\n)/g;
+const GOAL_LABEL = /\b(?:muc tieu|goal|purpose|objective)\s*:/g;
+const DISPOSABLE_SETUP = /\b(?:tao|create)\s+(?:mot\s+)?(?:project|du an)\s+(?:thu nghiem|test|disposable|doc lap)\b(?:\s+(?:doc lap|independent))?/g;
 function neutralizeNonOrders(text) {
-  return String(text)
+  let source = String(text).replace(/```[\s\S]*?```/g, ' ').replace(/^[ \t]*>.*$/gm, ' ');
+  if (VERIFICATION_GOAL.test(source)) source = source.replace(GOAL_LABEL, ' ').replace(CONDITIONAL_BRANCH, '\n').replace(DISPOSABLE_SETUP, ' ');
+  return source
     .replace(new RegExp(`\\b(?:do\\s+not|don't|dont|must\\s+not|never|shall\\s+not)\\s+[^.;\\n]*?(?=(?<!,)\\s+(?:and|va)\\s+(?:${NON_ORDER_VERBS})\\b|\\s+(?:but|nhung|then|however)\\b|[.;\\n]|$)`, 'g'), ' ')
     .replace(new RegExp(`\\b(?:khong|chua)\\s+[^.;\\n]*?(?=\\s+(?:nhung|tuy nhien)\\b|[.;\\n]|$)`, 'g'), ' ')
     .replace(/"[^"\n]*\s[^"\n]*"|`[^`\n]*\s[^`\n]*`|\u201c[^\u201d\n]*\u201d/g, ' ')
-    .replace(/\b(?:neu\s+(?:phai|can|thieu|khong du|bang chung chua du)|if\s+(?:needed|necessary|required|evidence is insufficient))\b[^.;\n]*/g, ' ')
+    .replace(/\b(?:neu\s+(?:phai|can|thieu|khong du|bang chung chua du)(?![^.;\n]*\b(?:restart|deploy|xoa|delete|remove|cancel)\b)|if\s+(?:needed|necessary|required|evidence is insufficient))\b[^.;\n]*/g, ' ')
     .replace(/[^.;\n]*\b(?:nao|gi|sao|the nao|bao nhieu)\b[^.;\n]*\?/g, ' ')
-    .replace(/\bchinh\s+xac\b|\b(?:phuong an|cach|de xuat|ban)\s+(?:sua|fix)\b/g, ' ')
+    .replace(/\bchinh\s+(?:xac|sach)\b|\b(?:phuong an|cach|de xuat|ban)\s+(?:sua|fix)\b|\b(?:diem|cho|muc|phan)\s+(?:phai|can|nen)\s+(?:sua|fix)\b/g, ' ')
     .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
     .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
     .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ');
 }
 
+// Explicit scope declaration (intent ownership): when the request itself declares it is read-only
+// ("READ-ONLY audit", "chi doc", "make no source changes") and carries no explicit order to change
+// anything, verbs and operation names inside it are descriptions (a "git stash" that already ran, "a
+// worklog edit", "confirmed fixes"), not orders - so they must not demand write or operation proof.
+// An explicit order (imperative-initial or modal request) keeps the request MIXED/IMPLEMENTATION:
+// the declaration never overrides a real instruction, and fenced/quoted/blockquoted text is never one.
+// A bare verb with no object is the tail of a negated list ("no commit, release, publish"), not an order.
+const READ_ONLY_DECLARATION = /\bread[\s-]*only\s+(?:audit|investigation|review|analysis|inspection|task|request|session|pass|check|diagnos\w+|verification|forensics?)\b|(?:^|\n)[\s*#>_-]*read[\s-]*only\s*[.:!—-]|\b(?:audit|investigation|review|analysis)[\s-]*only\b|[(,]\s*read[\s-]*only\s*[).]|\bchi\s+(?:doc|audit|kiem tra|phan tich|dieu tra)\b|\b(?:make|with)\s+no\s+(?:source\s+|code\s+|file\s+)?(?:changes|edits|modifications)\b/;
+const ORDER_VERBS = 'implement|fix|apply|refactor|modify|edit|write|update|add|create|build|install|deploy|redeploy|restart|push|commit|rename|remove|delete|replace|change|sua|viet|chinh|them|tao|xoa|enable|disable|set|toggle|configure|migrate|upgrade|publish|release|trien khai|khoi dong lai|(?:run|execute)\\s+(?:git\\s+(?:push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)|(?:npm|yarn)\\s+publish)|git\\s+(?:push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)';
+const IMPERATIVE_ORDER = new RegExp(`^(?:[-*+\\u2022>\\d.)\\s]*)(?:(?:please|hay|vui long|now|also|first|then)\\s+)*(?:${ORDER_VERBS})\\b\\s+\\S`);
+const MODAL_ORDER = new RegExp(`\\b(?:please|hay|vui long|need to|needs to|must|should|want(?:\\s+you)? to|toi muon|can phai|yeu cau)\\s+(?:[\\w-]+\\s+){0,2}(?:${ORDER_VERBS})\\b`);
+function hasExplicitOrder(clauses) {
+  return clauses.some((clause) => IMPERATIVE_ORDER.test(clause) || MODAL_ORDER.test(clause));
+}
+function declaredReadOnly(promptText, releasePolicy) {
+  if (releasePolicy) return false;
+  const plain = String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[đĐ]/g, 'd').toLowerCase()
+    .replace(/```[\s\S]*?```/g, ' ').replace(/^[ \t]*>.*$/gm, ' ');
+  if (!READ_ONLY_DECLARATION.test(plain)) return false;
+  const text = neutralizeNonOrders(plain);
+  const clauses = text.split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/)
+    .map((clause) => clause.split(/\bwithout\b/)[0])
+    .filter((clause) => !/\b(?:do not|don't|never|khong|dung)\b/.test(clause));
+  return /\b(?:audit|inspect|review|analyze|analyse|explain|read|investigate|investigation|forensic|root cause|kiem tra|phan tich|dieu tra|doc log|tim hieu)\b/.test(text)
+    && !hasExplicitOrder(clauses);
+}
+
+// Verification-only request. Root cause of a false `write-evidence` block on a "verify / re-run /
+// confirm" prompt: the vocabulary scans counted nouns and compounds ("coordinator fix", "re-run",
+// "template/install", "source change") as mutation orders. Order is structural: a request whose
+// command-position verbs are verification verbs, with no explicit order (hasExplicitOrder) and no
+// change-leading clause, orders no change - it owes verification evidence, not a write.
+const VERIFY_LEAD = /^(?:[-*+•>\d.)\s]*)(?:(?:please|hay|vui long|now|also|first|then)\s+)*(?:verify|re-?run|confirm|xac nhan|validate|double-?check)\b/;
+const CHANGE_LEAD = /^(?:[-*+•>\d.)\s]*)(?:(?:please|hay|vui long|now|also|first|then)\s+)*(?:make|rebuild|redo|rewrite|restore|revert|correct|clean|patch|resolve|ensure|run(?!(?=[^.]*\b(?:tests?|suite|gate|checks?|lint|typecheck|pilot|smoke|e2e|verif\w*|vitest|jest|audit)\b)))\b/;
+export function isVerificationOnlyRequest(promptText) {
+  const plain = String(promptText ?? '').normalize('NFD').replace(/[̀-ͯ]/g, '').replace(/[đĐ]/g, 'd').toLowerCase()
+    .replace(/```[\s\S]*?```/g, ' ').replace(/^[ \t]*>.*$/gm, ' ');
+  const clauses = neutralizeNonOrders(plain).split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/)
+    .map((clause) => clause.split(/\bwithout\b/)[0]);
+  return clauses.some((clause) => VERIFY_LEAD.test(clause)) && !hasExplicitOrder(clauses)
+    && !clauses.some((clause) => CHANGE_LEAD.test(clause));
+}
+
 export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
   // A named preflight and both explicit branches are required; a failed arbitrary test is not a release policy.
   const releaseText = String(promptText).normalize('NFD').replace(/[̀-ͯ]/g, '').replace(/[đĐ]/g, 'd').toLowerCase();
@@ -1117,6 +1173,7 @@ export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {})
   const clauses = text.split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/);
   const actionable = clauses.map((clause) => clause.split(/\bwithout\b/)[0]).filter((clause) => !/\b(?:do not|don't|never|khong|dung)\b/.test(clause)
     && !/^\s*(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(clause));
+  if (declaredReadOnly(promptText, releasePolicy)) return { taskKind: 'READ_ONLY' };
   const sourceOrder = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause)
     && /\b(?:source|code|logic|scheduler|implementation|ma nguon)\b|\.[cm]?[jt]sx?\b/.test(clause));
   const codeChangeVerb = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause));
@@ -1134,10 +1191,15 @@ export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {})
   // runtime are separate domains with separate proof; a prompt naming both stays a coding
   // task rather than being half-verified. A code-change verb anywhere keeps write evidence.
   const gitOperation = actionable.some((clause) => /\bgit\s+(?:push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)\b|\bpush\s+(?:to\s+)?origin\b/.test(clause));
-  const runtimeOperation = actionable.some((clause) => /\b(?:restart|redeploy|deploy|khoi dong lai|trien khai)\b/.test(clause)
+  // 'trien khai' is Vietnamese for both "deploy" and "implement": it orders a runtime operation only
+  // when it names a runtime target; bare it describes work ("Tier 3 truc tiep trien khai thay Tier 2").
+  // "restart"/"deploy" after a noun modifier ("process restart", "after redeploy") is a scenario, not an order.
+  const runtimeOperation = actionable.some((clause) => /(?<!\b(?:process|crash|hard|soft|graceful|after|upon|during|across|following)\s)\b(?:restart|redeploy|deploy|khoi dong lai|trien khai\s+(?:len\s+)?(?:service|server|production|prod|staging|dich vu|may chu|moi truong))\b/.test(clause)
     && !/\.[cm]?[jt]sx?\b/.test(clause) && !/\bgit\b/.test(clause));
   const nativeDomain = cronOperation ? 'scheduled-job' : gitOperation !== runtimeOperation ? (gitOperation ? 'git-integrity' : 'service-runtime') : null;
   const operation = Boolean(nativeDomain);
+  // A verification-only request orders no change; a concrete operation order (cancel/restart/push) stays operational.
+  if (!releasePolicy && !operation && isVerificationOnlyRequest(promptText)) return { taskKind: 'READ_ONLY', verificationOnly: true };
   // A config MENTION is not a config change: the same clause needs a mutation verb, and a
   // request that also changes source/code is a coding task (config is part of its tests/fixtures).
   const config = !sourceOrder && actionable.some((clause) => /\b(?:configuration|config|toggle|cau hinh)\b/.test(clause)
@@ -1148,7 +1210,7 @@ export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {})
   const mutationWord = /\b(?:implement|fix|refactor|modify|edit|write|update|add|create|build|make|install|deploy|remove|delete|rename|replace|change|sua|viet|chinh|them|tao|xoa|doi|cai|cap nhat)\b/.test(text);
   const statusReport = !mutationWord && !operation && !config
     && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua|da len chua)\b/.test(text);
-  const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|investigate|debug|forensic|root cause|kiem tra|phan tich|dieu tra|doc log|tim hieu)\b/.test(text) || statusReport)
+  const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|investigate|debug|forensic|root cause|kiem tra|phan tich|dieu tra|doc log|tim hieu)\b/.test(text.replace(/\bread[\s-]*only\b/g, ' ')) || statusReport)
     && !sourceOrder && !codeChangeVerb && !operation && !config;
   const taskKind = operation ? (sourceOrder || codeChangeVerb ? 'MIXED' : 'OPERATIONAL')
     : config ? 'CONFIGURATION' : documentation ? 'DOCUMENTATION_OUTPUT' : readOnly ? 'READ_ONLY' : 'CODE_IMPLEMENTATION';
@@ -1170,5 +1232,5 @@ export function applyTaskSemantics(contract, semantic) {
     completionEvidence: semantic.taskKind === 'DOCUMENTATION_OUTPUT' ? ['report-artifact'] : operationOnly ? ['operation-verification']
       : semantic.taskKind === 'MIXED' ? [...new Set([...evidence, 'write-evidence', 'operation-verification'])]
         : semantic.taskKind === 'READ_ONLY' && semantic.statusReport ? []
-        : semantic.taskKind === 'READ_ONLY' ? (evidence.length === 1 && evidence[0] === 'verification-evidence' ? evidence : ['impact-evidence']) : evidence };
+        : semantic.taskKind === 'READ_ONLY' ? (semantic.verificationOnly || (evidence.length === 1 && evidence[0] === 'verification-evidence') ? ['verification-evidence'] : ['impact-evidence']) : evidence };
 }