@ngockhoale/ukit 3.4.47 → 3.4.49

package/template_project/.claude/ukit/runtime/execution-ledger.mjs

@@ -8,6 +8,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { withAsyncLock, LOCK_MAX_SLICE_MS } from './async-lock.mjs';
 import { cronOperationReceipt, bashOperationReceipt, releaseOperationReceipt } from './cron-operation-adapter.mjs';
+import * as playbookExecution from './playbook-execution.mjs';
 import { operationCompletionPolicy, foldOperationEvidence, compactOperation, conditionalAbsenceGoal } from './operation-evidence.mjs';
 
 // Hook-context self-deadline (2.4.1 orphan-leak class): armed ONLY on direct
@@ -659,7 +660,7 @@ function compactReceipt(receipt) {
     kind: receipt.kind,
     success: receipt.success,
   };
-  for (const key of ['toolName', 'toolUseId', 'file', 'command', 'exitCode', 'scope', 'error', 'verdict', 'evidence', 'evidenceSurface', 'class', 'status', 'detail', 'operation', 'transportSuccess', 'taskInstanceId', 'sessionKey', 'sequence', 'exitStatusUnproven']) {
+  for (const key of ['toolName', 'toolUseId', 'file', 'command', 'exitCode', 'scope', 'error', 'verdict', 'evidence', 'evidenceSurface', 'class', 'status', 'detail', 'operation', 'transportSuccess', 'taskInstanceId', 'sessionKey', 'sequence', 'exitStatusUnproven', 'agentId', 'agentType', 'contentSha']) {
     if (receipt[key] !== undefined && receipt[key] !== null && receipt[key] !== '') {
       compact[key] = key === 'operation' ? compactOperation(receipt[key]) : receipt[key];
     }
@@ -774,6 +775,31 @@ function fingerprintExcluded(file) {
     || ['docs/WORKLOG.md', 'docs/STATUS.md', 'docs/TASKS.md', 'docs/MEMORY.md'].includes(p);
 }
 
+// A write to UKit's own bookkeeping (living docs, runtime state) is housekeeping the project rules
+// REQUIRE after every task; it is never the implementation an implementation contract asks for.
+// `bash-workspace:` is the prefix of fingerprint-derived Bash write receipts.
+function isBookkeepingWrite(file) {
+  const p = String(file ?? '').replace(/^bash-workspace:/, '').replace(/\\/g, '/');
+  return /(^|\/)docs\/(WORKLOG|STATUS|TASKS|MEMORY)\.md$/.test(p)
+    || /(^|\/)\.ukit\/storage\//.test(p)
+    || /(^|\/)\.claude\/ukit\/skill-router-state\.json$/.test(p);
+}
+
+// A bookkeeping write counts as the requested write only when the user's own request names that file.
+function promptNamesBookkeeping(state) {
+  const prompt = String(state?.routingContext?.lastExplicitUserPromptText ?? state?.routingContext?.promptText ?? '');
+  return /\b(WORKLOG|STATUS|TASKS|MEMORY)\.md\b|\.ukit\/storage|skill-router-state/i.test(prompt);
+}
+
+// Per-file form: naming STATUS.md does not make a WORKLOG.md edit the requested write.
+function promptNamesBookkeepingFile(state, file) {
+  const p = String(file ?? '').replace(/^bash-workspace:/, '').replace(/\\/g, '/');
+  const prompt = String(state?.routingContext?.lastExplicitUserPromptText ?? state?.routingContext?.promptText ?? '');
+  const doc = p.match(/(?:^|\/)docs\/(WORKLOG|STATUS|TASKS|MEMORY)\.md$/);
+  if (doc) return new RegExp(`\\b${doc[1]}\\.md\\b`, 'i').test(prompt);
+  return promptNamesBookkeeping(state);
+}
+
 function contentFingerprint(cwd) {
   if (!cwd) return null;
   try {
@@ -1246,6 +1272,10 @@ function carriedEvidenceLedger(fresh, current) {
     directWrite: fresh.directWrite === true || current.directWrite === true,
     writeAttempted: fresh.writeAttempted || current.writeAttempted === true,
     writeSucceeded: fresh.writeSucceeded || current.writeSucceeded === true,
+    // undefined (a ledger written before this field existed) keeps the legacy any-write behavior.
+    substantiveWrite: fresh.substantiveWrite === true || current.substantiveWrite === true
+      ? true
+      : (current.substantiveWrite === undefined && current.writeSucceeded === true ? undefined : false),
     verificationAttempted: fresh.verificationAttempted || current.verificationAttempted === true,
     verificationSucceeded: fresh.verificationSucceeded || current.verificationSucceeded === true,
     verificationFailed: fresh.verificationFailed || current.verificationFailed === true,
@@ -1287,6 +1317,10 @@ function carriedEvidenceLedger(fresh, current) {
     // TASK-008: the playbook-finding bank is request-scoped like the floor —
     // a same-prompt re-key must keep the latest per-class statuses.
     playbookFindings: current.playbookFindings || fresh.playbookFindings || null,
+    // Round 5: the delegated-run state is request-scoped like the floor (this carry is
+    // reached only for the SAME taskInstanceId / promptKey — never across tasks).
+    playbookRun: current.playbookRun || fresh.playbookRun || null,
+    delegationViolations: current.delegationViolations || fresh.delegationViolations || null,
     verificationFailureCounts: current.verificationFailureCounts || {},
     blocker: current.blocker || null,
     // Journal bookkeeping belongs to the file, not the request: the dedupe memory must
@@ -1344,6 +1378,7 @@ function freshLedger(payload, routeState, harness) {
     sourceFiles: [],
     writeAttempted: false,
     writeSucceeded: false,
+    substantiveWrite: false,
     verificationAttempted: false,
     verificationSucceeded: false,
     verificationFailed: false,
@@ -1390,7 +1425,7 @@ const MAX_JOURNAL_SEEN = 64;
 const MAX_JOURNAL_RECORDS = 128;
 const MAX_JOURNAL_QUARANTINE_LINES = 32;
 const LEDGER_EVENT_TYPES = new Set(['receipt', 'continuation', 'notified', 'stop-progress', 'resumable-run']);
-const RECEIPT_KINDS = new Set(['source', 'write', 'verification', 'playbook-finding', 'workspace', 'operation']);
+const RECEIPT_KINDS = new Set(['source', 'write', 'verification', 'playbook-finding', 'workspace', 'operation', 'handback', 'review', 'delegation-violation']);
 
 function journalPathFor(target) {
   return `${target}.journal`;
@@ -1511,11 +1546,27 @@ async function bumpContinuationSidecar(target, event, { signal, deadlineMs } = {
   return outcome.ok === true ? outcome.value : { ok: false };
 }
 
+// Receipts that carry task-owned semantics: they must belong to the live task or be
+// rejected (operation proof; Round 5 worker handbacks and review decisions).
+const TASK_OWNED_RECEIPT_KINDS = new Set(['operation', 'handback', 'review', 'delegation-violation']);
+
+// Bounded content digest of a file a worker wrote (change fingerprint input). Null on any
+// read failure or a file over the cap — a missing digest only weakens, never fabricates.
+function fileContentSha(file) {
+  try {
+    const stat = fsSync.statSync(file);
+    if (!stat.isFile() || stat.size > 2 * 1024 * 1024) return null;
+    return crypto.createHash('sha256').update(fsSync.readFileSync(file)).digest('hex').slice(0, 16);
+  } catch {
+    return null;
+  }
+}
+
 function newEventId() {
   return `${Date.now().toString(36)}-${crypto.randomBytes(8).toString('hex')}`;
 }
 
-const JOURNAL_RECEIPT_FIELDS = ['ts', 'kind', 'toolName', 'toolUseId', 'success', 'exitCode', 'file', 'command', 'scope', 'workspaceFp', 'workspaceRoot', 'workspaceHeadTs', 'bashReadOnly', 'exitStatusUnproven', 'detail', 'operation', 'transportSuccess', 'taskInstanceId', 'sessionKey', 'sequence'];
+const JOURNAL_RECEIPT_FIELDS = ['ts', 'kind', 'toolName', 'toolUseId', 'success', 'exitCode', 'file', 'command', 'scope', 'workspaceFp', 'workspaceRoot', 'workspaceHeadTs', 'bashReadOnly', 'exitStatusUnproven', 'detail', 'operation', 'transportSuccess', 'taskInstanceId', 'sessionKey', 'sequence', 'agentId', 'agentType', 'contentSha', 'handback', 'review', 'verdict'];
 
 // TASK-009 (BL-011): evidence attestations are whitelisted verbatim — class /
 // surface / result / claim, the ARCH §Evidence Schema fields a receipt may
@@ -1535,11 +1586,29 @@ function sanitizeEvidenceForJournal(evidence) {
   return Object.keys(clean).length > 0 ? clean : null;
 }
 
+// The verification verdict is minted from LIVE git/workspace state at record time and cannot be
+// re-minted at replay (the state may have moved on), so it travels with the journaled receipt.
+// Fixed keys, bounded strings; an unknown kind is dropped (replay then stays pending, fail-safe).
+// Currency is still judged by verdictCurrent at assessment time, so a replayed stale verdict is
+// rejected exactly like a live one.
+const JOURNAL_VERDICT_FIELDS = ['workspaceRoot', 'evidence', 'verifier', 'headSha', 'baseSha', 'patchId', 'dirtyFp', 'contentFp', 'ts'];
+function sanitizeVerdictForJournal(verdict) {
+  if (!verdict || typeof verdict !== 'object' || Array.isArray(verdict) || !VERDICT_KINDS.has(verdict.kind)) return null;
+  const clean = { kind: verdict.kind };
+  for (const key of JOURNAL_VERDICT_FIELDS) {
+    if (typeof verdict[key] === 'string' && verdict[key]) clean[key] = verdict[key].slice(0, 400);
+    else if (verdict[key] === null && (key === 'headSha' || key === 'baseSha' || key === 'patchId')) clean[key] = null;
+  }
+  return clean;
+}
+
 function sanitizeReceiptForJournal(receipt) {
   const clean = {};
   for (const key of JOURNAL_RECEIPT_FIELDS) {
     if (receipt && receipt[key] !== undefined && receipt[key] !== null && receipt[key] !== '') {
-      clean[key] = key === 'operation' ? compactOperation(receipt[key]) : receipt[key];
+      clean[key] = key === 'operation' ? compactOperation(receipt[key])
+        : key === 'verdict' ? sanitizeVerdictForJournal(receipt[key]) : receipt[key];
+      if (clean[key] === null) delete clean[key];
     }
   }
   const evidence = sanitizeEvidenceForJournal(receipt && receipt.evidence);
@@ -1815,11 +1884,9 @@ const PLAYBOOK_STEP_MAPS = {
     { id: 'fix', derive: 'write', essential: true },
     { id: 'verify', derive: 'post-verify', essential: true },
   ],
-  'feature-implementation': [
-    { id: 'analog-search', derive: 'pre-source', essential: false },
-    { id: 'implement', derive: 'write', essential: true },
-    { id: 'verify', derive: 'post-verify', essential: true },
-  ],
+  // Round 5: the step contract lives once, in playbook-execution.mjs; conditional steps
+  // (integrate-verify / review) are filtered out of the unconditional trace below.
+  'feature-implementation': playbookExecution.FEATURE_IMPLEMENTATION_STEPS,
   migration: [
     { id: 'schema-inspect', derive: 'pre-source', essential: false },
     { id: 'write', derive: 'write', essential: true },
@@ -1829,7 +1896,7 @@ const PLAYBOOK_STEP_MAPS = {
 
 function playbookStepsFor(playbookId) {
   const steps = playbookId ? PLAYBOOK_STEP_MAPS[String(playbookId)] : null;
-  return Array.isArray(steps) ? steps : [];
+  return Array.isArray(steps) ? steps.filter((step) => !step.conditional) : [];
 }
 
 function boundedTraceText(value) {
@@ -1975,6 +2042,9 @@ export async function playbookStatus(projectRoot, payload = {}) {
     taskType: ledger?.taskType || state?.routeSummary?.taskType || null,
     trace,
     summary: formatPlaybookTrace(trace),
+    ...(playbookId === playbookExecution.FEATURE_PLAYBOOK_ID
+      ? { acceptance: evaluateFeatureAcceptance({ state: state || {}, ledger, cwd: projectRoot }) }
+      : {}),
   };
 }
 
@@ -2210,6 +2280,7 @@ function applyReceiptToLedger(ledger, receipt, options = {}) {
         exitCode: receipt.exitCode,
         file: `bash-workspace:${fp}`,
         detail: 'bash-workspace-delta',
+        ...(receipt.agentId ? { agentId: receipt.agentId, agentType: receipt.agentType } : {}),
       }, options);
       if (applied) base = applied.ledger;
     }
@@ -2221,6 +2292,25 @@ function applyReceiptToLedger(ledger, receipt, options = {}) {
 function applyReceiptCore(ledger, receipt, { vibecode = false } = {}) {
   if (!receipt || typeof receipt !== 'object' || !RECEIPT_KINDS.has(receipt.kind)) return null;
   const next = { ...ledger, receiptSequence: Number(ledger.receiptSequence || 0) + 1 };
+  if (receipt.kind === 'delegation-violation') {
+    // delegation-gate.mjs refused a main-thread source write while delegation is required and not
+    // performed. Counted per task ledger (a new task starts from a fresh ledger); the limit-th one
+    // mints the visible sticky blocker the Stop gate ends the run on. Never enters the receipt
+    // window and never clears or replaces an existing blocker.
+    const count = Number(ledger.delegationViolations?.count || 0) + 1;
+    const blocked = count >= playbookExecution.DELEGATION_VIOLATION_LIMIT;
+    next.delegationViolations = { count, blocked, lastTs: receipt.ts ?? Date.now(), lastTarget: receipt.target ?? null };
+    if (blocked && !next.blocker) {
+      next.blocker = {
+        kind: 'delegation-required',
+        visible: true,
+        detail: `the feature-implementation Playbook requires the coding to be delegated to the Tier 2 worker, but the orchestrator tried to write source ${count} times without dispatching one (delegation-required-not-performed) — dispatch the worker via the Agent tool or report this blocker.`,
+        ts: Date.now(),
+      };
+    }
+    next.updatedAt = Date.now();
+    return { ledger: next, value: null };
+  }
   if (receipt.kind === 'operation') receipt = { ...receipt, sequence: next.receiptSequence };
   if (receipt.kind === 'operation') {
     next.operationBank = foldOperationEvidence(ledger.operationBank, receipt, ledger);
@@ -2235,6 +2325,8 @@ function applyReceiptCore(ledger, receipt, { vibecode = false } = {}) {
   } else if (receipt.kind === 'write') {
     next.writeAttempted = true;
     next.writeSucceeded = next.writeSucceeded || receipt.success;
+    if (receipt.success && receipt.file && !isBookkeepingWrite(receipt.file)) next.substantiveWrite = true;
+    else if (next.substantiveWrite === undefined) next.substantiveWrite = false;
     // Evidence tier: a fingerprint-derived Bash delta is inferred (supporting) evidence; only a
     // tool-attributed Edit/Write is direct.
     if (receipt.detail === 'bash-workspace-delta') next.inferredWrite = true;
@@ -2361,6 +2453,22 @@ function applyReceiptCore(ledger, receipt, { vibecode = false } = {}) {
     next.updatedAt = Date.now();
     return { ledger: next, value: null };
   }
+  // Round 5: feature-implementation run state (worker attribution, change barrier,
+  // integration verification, handbacks, review decision). Banked outside the evictable
+  // receipt window; handback/review receipts live only here and never enter the window.
+  if (ledger?.playbookId === playbookExecution.FEATURE_PLAYBOOK_ID) {
+    next.playbookRun = playbookExecution.foldPlaybookRun(ledger.playbookRun, receipt, {
+      seq: next.receiptSequence,
+      bookkeeping: receipt.kind === 'write' && isBookkeepingWrite(receipt.file),
+    });
+    if (receipt.kind === 'handback' || receipt.kind === 'review') {
+      next.updatedAt = Date.now();
+      return { ledger: next, value: null };
+    }
+  } else if (receipt.kind === 'handback' || receipt.kind === 'review') {
+    // Not a feature-implementation run: these kinds mean nothing here.
+    return { ledger: next, value: null };
+  }
   // TASK-009 (BL-011): fold the receipt into the bug-fix floor bank before it
   // enters the (evictable) receipt window. The fold runs on the pre-update
   // verificationFailureCounts: a pass over a surface whose failure is still
@@ -2558,7 +2666,7 @@ export async function recordLedgerEvent(event, {
   // Hoisted so the post-commit outcome emitter sees the same state snapshot
   // the lock callback evaluated (a fresh read could observe a re-route).
   let lockedRouteState = routeState || await readRouteState(projectRoot, payload);
-  if (event.type === 'receipt' && event.receipt?.kind === 'operation') {
+  if (event.type === 'receipt' && TASK_OWNED_RECEIPT_KINDS.has(event.receipt?.kind)) {
     if (event.receipt.taskInstanceId && event.receipt.taskInstanceId !== lockedRouteState?.taskInstanceId) {
       return { rejected: true, eventId, reason: 'receipt-task-mismatch' };
     }
@@ -2606,7 +2714,7 @@ export async function recordLedgerEvent(event, {
       if (event.receipt.taskInstanceId && event.receipt.taskInstanceId !== state?.taskInstanceId) {
         return { committed: false, rejected: true, eventId, reason: 'receipt-task-mismatch' };
       }
-      const stampedReceipt = event.receipt.kind === 'operation'
+      const stampedReceipt = TASK_OWNED_RECEIPT_KINDS.has(event.receipt.kind)
         ? { ...event.receipt, taskInstanceId: state?.taskInstanceId || null, sessionKey: sessionIdentity(payload) }
         : event.receipt;
       const applied = applyReceiptToLedger(ledger, stampedReceipt, { vibecode: event.vibecode === true });
@@ -2849,6 +2957,7 @@ export async function recordExecutionReceipt({
     success,
     exitCode,
   };
+  const featureRun = routeState?.routeSummary?.playbookId === playbookExecution.FEATURE_PLAYBOOK_ID;
 
   const policy = routeState?.routeSummary?.executionContract?.releasePolicy;
   if (toolName === 'Bash' && !bashScope.foreign && policy?.kind === 'conditional-release'
@@ -2913,10 +3022,38 @@ export async function recordExecutionReceipt({
     // Any other Bash: no evidence of its own. The receipt only carries the workspace
     // fingerprint so a verifiable tracked-file change can be attributed at apply time.
     receipt.kind = 'workspace';
+  } else if ((toolName === 'Agent' || toolName === 'Task') && featureRun) {
+    // Round 5: a subagent dispatch result is a HANDBACK — a claim plus identity, never
+    // evidence by itself. Only a feature-implementation route records it; every other
+    // playbook keeps the old untracked rejection (their ledgers are unchanged).
+    const handback = playbookExecution.buildHandbackRecord({ toolInput, toolResponse, projectRoot, success });
+    if (!handback) return { rejected: true, eventId: null };
+    receipt.kind = 'handback';
+    // A prompt-carried task marker binds the result to ITS task: a mismatch with the live
+    // task is rejected by the task-ownership check in recordLedgerEvent (receipt-task-mismatch).
+    if (handback.markerTaskId) receipt.taskInstanceId = handback.markerTaskId;
+    delete handback.markerTaskId;
+    receipt.handback = handback;
+    if (handback.agentId) { receipt.agentId = handback.agentId; receipt.agentType = handback.agentType; }
   } else {
     // Untracked tool: no event, no lock, no write — same as the old unlocked early return.
     return { rejected: true, eventId: null };
   }
+  // Round 5: attribute subagent tool receipts to their native agent identity (Claude Code
+  // stamps agent_id/agent_type on a subagent's hook payloads). Hosts without it leave the
+  // receipt unattributed — the run then reports UNSUPPORTED instead of guessing.
+  if (featureRun && receipt.kind !== 'handback') {
+    const agentId = playbookExecution.sanitizeAgentId(payload.agent_id);
+    if (agentId) {
+      receipt.agentId = agentId;
+      const agentType = typeof payload.agent_type === 'string' ? payload.agent_type.slice(0, 64) : null;
+      if (agentType) receipt.agentType = agentType;
+      if (receipt.kind === 'write' && receipt.success && typeof receipt.file === 'string') {
+        const digest = fileContentSha(path.resolve(projectRoot, receipt.file));
+        if (digest) receipt.contentSha = digest;
+      }
+    }
+  }
   if (workspaceFp) {
     receipt.workspaceFp = workspaceFp;
     if (workspaceRoot !== projectRoot) {
@@ -3040,7 +3177,13 @@ function evidenceSatisfied(evidence, ledger = {}, state = {}, { cwd } = {}) {
         || (cwd && bank[evidenceBankKey(path.resolve(cwd, file))] === true)
       ));
     }
-    return ledger.writeSucceeded === true;
+    // A bookkeeping-only write (WORKLOG/STATUS/TASKS/MEMORY, runtime state) is not the implementation:
+    // it satisfies write-evidence only when the request itself names that file.
+    if (ledger.writeSucceeded !== true) return false;
+    if (ledger.substantiveWrite !== false) return true;
+    // Only bookkeeping was written: each written file must itself be named by the request.
+    const written = (ledger.receipts || []).filter((r) => r?.kind === 'write' && r.success && r.file).map((r) => r.file);
+    return written.length ? written.some((file) => promptNamesBookkeepingFile(state, file)) : promptNamesBookkeeping(state);
   }
   if (evidence === 'verification-evidence') {
     // SPEC-typed-verdicts §2.3: when a verdict record exists it governs — only a
@@ -3154,6 +3297,9 @@ function recoveryInstruction(missingEvidence, ledger = {}, routeSummary = {}, {
   } else if (missingEvidence.includes('root-cause')) {
     instruction = 'Record the root cause: attest the named mechanism (UKIT_EVIDENCE root-cause/instrumentation/behavioral-check with claim) — the rejected hypotheses and the surviving mechanism, one line each.';
   }
+  if (!instruction && missingEvidence.includes('integration-verification') && !missingEvidence.includes('write-evidence')) {
+    instruction = 'Worker changes are not yet verified together: in this session (not inside a worker), run the routed targeted verification once on the integrated state, after the last worker handback, and inspect its result. A worker\'s own pass does not count.';
+  }
   if (!instruction && missingEvidence.includes('write-evidence')) {
     if (!ledger.sourceSucceeded) {
       instruction = 'Pull one bounded indexed source slice, then make the requested Edit/Write in this continuation.';
@@ -3343,16 +3489,75 @@ function effectiveRequestLedger(state = {}, ledger = {}) {
 // since (publishedReleaseDrifted). A failed/missing publish with no registry proof
 // stays missing. A registry that already serves the version counts as published, so a finished release is
 // never re-published just to satisfy the gate.
-function promptOrdersNpmPublish(state = {}) {
+const PUBLISH_ORDER_NEGATOR = /\b(?:do not|don't|dont|never|without|not yet|no|not|avoid|skip|exclud\w*|forbid\w*|prohibit\w*|khong|dung|chua)\b|--dry-run/;
+const PUBLISH_ORDER_IMPERATIVE = /^(?:please\s+|just\s+|now\s+|also\s+)*(?:run|do|execute|perform|go|ship|publish|release|push|tag|commit|verify|make|cut|chay)\b/;
+const PUBLISH_ORDER_HEADER = /prohibit|forbidden|out of scope|non-goal|scope control/;
+// Release intent comes ONLY from the user's own affirmative order. A prohibition list ("No release, npm publish or CI.",
+// "Do not: ... npm publish") keeps its negation across comma/and/or list items and under a prohibition header; only a
+// explicit command can end a negated non-release clause, but bare list verbs cannot. Explicit publication
+// prohibitions win over positive references elsewhere. Only the task's authoritative prompt is consulted.
+export function promptOrdersNpmPublish(state = {}) {
   const text = String(state?.routingContext?.lastExplicitUserPromptText || '')
     .normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[đĐ]/g, 'd').toLowerCase();
-  if (!/\bnpm\s+publish\b/.test(text)) return false;
-  return text.split(/[\n;.,]|\bthen\b|\band\b/).some((clause) => /\bnpm\s+publish\b/.test(clause)
-    && !/\b(?:do not|don't|never|without|not yet|dry-run|khong|dung|chua)\b|--dry-run/.test(clause));
+  // Quoted commands and historical/example blocks describe orders; they do not issue them.
+  const active = text.replace(/```[^]*?```|~~~[^]*?~~~/g, '')
+    .replace(/^[ \t]*>.*$/gm, '').replace(/[“"][^”"\n]*[”"]|‘[^’\n]*’/g, '');
+  let prohibited = false;
+  let ordered = false;
+  let blockNegated = false;
+  for (const line of active.split('\n')) {
+    const bullet = /^\s*(?:[-*\u2022]|\d+[.)])\s+/.test(line);
+    if (!line.trim()) { blockNegated = false; continue; }
+    if (!bullet) blockNegated = line.trim().length <= 80 && (PUBLISH_ORDER_NEGATOR.test(line) || PUBLISH_ORDER_HEADER.test(line)) && /:\s*$|^[^.]{0,40}$/.test(line.trim()) && !/\bnpm\s+publish\b/.test(line);
+    for (const sentence of line.split(/\s*;\s*|\.\s+|\.$/)) {
+      for (const hard of sentence.split(/\bthen\b|\bbut\b|\binstead\b/)) {
+        let negated = bullet && blockNegated;
+        for (const raw of hard.split(/,|\band\b|\bor\b|\bnor\b/)) {
+          const item = raw.replace(/^[\s\-*\u2022]+|^\d+[.)]\s*/g, '').trim();
+          if (PUBLISH_ORDER_NEGATOR.test(item)) negated = true;
+          // Bare list nouns (push, tag, commit) must not revoke an earlier "No".
+          else if (/^(?:please\s+|now\s+|also\s+)*(?:run|execute|perform|chay)\s+\S/.test(item)) negated = false;
+          const publication = /\bnpm\s+publish\b/.test(item);
+          const releaseOrder = /^(?:please\s+|just\s+|now\s+|also\s+)*(?:release|ship|publish)\s+(?!readiness\b|verification\b|evidence\b|policy\b|intent\b|notes\b|terminology\b)\S/.test(item);
+          const releaseReference = /\b(?:release|publish|publication)\b/.test(item);
+          if (negated && releaseReference && !/--dry-run/.test(item)) prohibited = true;
+          if (!negated && (releaseOrder || (publication && (
+            /^npm\s+publish\b/.test(item) || PUBLISH_ORDER_IMPERATIVE.test(item)
+            || /\b(?:chay|run)\s+`?npm\s+publish\b/.test(item)
+            || /continue the release workflow:/.test(item))))) ordered = true;
+        }
+      }
+    }
+  }
+  return ordered && !prohibited;
+}
+
+// Conditional repair is not a publication order until owned project source actually changes.
+// Reuse the affirmative publication parser on the taken branch, including its negation rules.
+function conditionalRepairOrdersPublish(state, ledger, cwd) {
+  if (ledger?.substantiveWrite !== true || !cwd) return false;
+  const text = String(state?.routingContext?.lastExplicitUserPromptText || '')
+    .normalize('NFD').replace(/[̀-ͯ]/g, '').replace(/[đĐ]/g, 'd').toLowerCase()
+    .replace(/```[^]*?```|~~~[^]*?~~~/g, '').replace(/^[ \t]*>.*$/gm, '');
+  if (!/(?:^|\n)[ \t*#_-]*(?:muc tieu|goal|purpose|objective)\s*:[^\n]*\b(?:xac nhan|verify|confirm|validate)\b/.test(text)) return false;
+  const branch = text.match(/(?:^|\n|\.\s+)[ \t]*(?:\d+[.)]\s*)?(?:neu\s+co\s+source fix|if\s+(?:there is a\s+)?source fix)\s*:[^\n]*/)?.[0];
+  if (!branch) return false;
+  const writes = [...(ledger.receipts || []), ...Object.keys(ledger.bankedWrites || {}).map((file) => ({ kind: 'write', success: true, file }))];
+  const projectWrite = writes.some((receipt) => {
+    if (receipt.kind !== 'write' || receipt.success !== true || !receipt.file || isBookkeepingWrite(receipt.file)) return false;
+    if (receipt.detail === 'bash-workspace-delta' && /^bash-workspace:/.test(receipt.file)) return true;
+    const relative = path.relative(path.resolve(cwd), path.resolve(cwd, receipt.file));
+    return relative && !relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative)
+      && !/^(?:\.ukit|\.cache|node_modules|tests?|fixtures?|tmp)(?:[\\/]|$)/.test(relative);
+  });
+  if (!projectWrite) return false;
+  // Explicit task-wide publication prohibitions still dominate the conditional branch.
+  if (/(?:do not|never|khong|chua)\s+(?:npm\s+)?publish\b|\bno\s+(?:release|publication)\b/.test(text)) return false;
+  return promptOrdersNpmPublish({ routingContext: { lastExplicitUserPromptText: branch.replace(/^.*?:/, 'Run ') } });
 }
 
 function releasePublicationMissing(state, ledger, cwd) {
-  if (!promptOrdersNpmPublish(state)) return null;
+  if (!promptOrdersNpmPublish(state) && !conditionalRepairOrdersPublish(state, ledger, cwd)) return null;
   let pkg = null;
   try { pkg = JSON.parse(fsSync.readFileSync(path.join(cwd || process.cwd(), 'package.json'), 'utf8')); } catch { return null; }
   if (!pkg?.version) return null;
@@ -3595,6 +3800,18 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
       };
     }
   }
+  // Round 5: the ONE new hard demand. A delegated feature-implementation run whose workers
+  // produced attributed writes owes a passing verification of the INTEGRATED state after the
+  // last worker change. Conflicts / missing files / claim-only workers are not fixable by
+  // running a command, so they stay acceptance-level (advisory) findings, not Stop demands.
+  // Bounded by MAX_CONTINUATIONS like every other missing-evidence item.
+  if (playbookId === playbookExecution.FEATURE_PLAYBOOK_ID && !operationalTask) {
+    const run = effectiveLedger?.playbookRun;
+    if (run && playbookExecution.assessWorkers(run).workers.some((w) => w.state === 'evidenced')) {
+      const integration = playbookExecution.assessIntegration(run, { cwd, verdictCurrent });
+      if (['pending', 'stale', 'failed'].includes(integration.status)) missingEvidence.push('integration-verification');
+    }
+  }
   if (missingEvidence.length === 0) {
     // Silent success: the route is present and every required evidence is satisfied. Marked
     // `complete` so the CLI dispatch recognizes it BEFORE the loud final else — otherwise a
@@ -3790,6 +4007,92 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
   };
 }
 
+// ─── Round 5: feature-implementation lifecycle (acceptance / review inputs / telemetry) ──────
+// All derived from the task-owned ledger snapshot (effectiveRequestLedger), so another task's
+// handbacks, writes or verification can never satisfy this task. Pure reads — no I/O besides the
+// existence/currency checks the integration assessment needs.
+function featureRunContext({ state = {}, ledger = {}, cwd } = {}) {
+  const routeSummary = state?.routeSummary || {};
+  const playbookId = routeSummary.playbookId || null;
+  if (playbookId !== playbookExecution.FEATURE_PLAYBOOK_ID) return null;
+  const owned = effectiveRequestLedger(state, ledger) || {};
+  const trace = buildPlaybookTrace(owned, playbookId);
+  const run = owned.playbookRun || null;
+  return { routeSummary, playbookId, owned, trace, run, cwd, host: owned.harness || ledger?.harness || null };
+}
+
+/** Final Playbook acceptance (see playbook-execution.mjs). NOT_APPLICABLE outside feature-implementation. */
+export function evaluateFeatureAcceptance({ state = {}, ledger = {}, cwd, reviewDecision = null } = {}) {
+  const context = featureRunContext({ state, ledger, cwd });
+  if (!context) return playbookExecution.evaluatePlaybookAcceptance({ playbookId: state?.routeSummary?.playbookId || null });
+  return playbookExecution.evaluatePlaybookAcceptance({
+    playbookId: context.playbookId,
+    requiredSteps: context.trace.requiredSteps,
+    missingSteps: playbookTraceMissingSteps(context.trace),
+    run: context.run,
+    cwd,
+    verdictCurrent,
+    reviewDecision: reviewDecision ?? context.run?.reviewDecision ?? null,
+    delegationRequired: context.routeSummary.tierLane?.delegationRequired === true,
+    delegationBlocked: context.owned?.delegationViolations?.blocked === true,
+    host: context.host,
+    contractEvidence: contractEvidenceStatus(state, context.owned, cwd),
+  });
+}
+
+// Which contract evidence the route demanded and which of it is still unproven (existing predicates).
+function contractEvidenceStatus(state, owned, cwd) {
+  const required = requiredEvidence(state);
+  if (!required.length) return null;
+  return { required, missing: required.filter((item) => !evidenceSatisfied(item, owned, state, { cwd })) };
+}
+
+/** Everything the Stop coordinator needs for a delegated feature run: review inputs, acceptance, telemetry. */
+export function featureRunReport({ state = {}, ledger = {}, cwd, reviewDecision = null } = {}) {
+  const context = featureRunContext({ state, ledger, cwd });
+  if (!context) return { applicable: false };
+  const run = context.run || playbookExecution.emptyPlaybookRun();
+  const integration = playbookExecution.assessIntegration(run, { cwd, verdictCurrent });
+  const workers = playbookExecution.assessWorkers(run);
+  const rs = context.routeSummary;
+  const riskHigh = (rs.riskEscalation?.level === 'high' && rs.riskEscalation?.stage !== 'shadow') || rs.riskFloor?.floor === 'high-risk';
+  const acceptance = evaluateFeatureAcceptance({ state, ledger, cwd, reviewDecision });
+  return {
+    applicable: true,
+    delegated: integration.delegated,
+    riskHigh,
+    host: playbookExecution.normalizeHost(context.host),
+    integration,
+    workers,
+    acceptance,
+    reviewDispatch: reviewDecision
+      ? playbookExecution.reviewDispatchHint({ decision: reviewDecision, workers, integration, host: context.host, riskHigh })
+      : null,
+    reviewInputs: playbookExecution.playbookReviewInputs({
+      run, workers, integration, riskHigh,
+      routeFixLoopCount: Number(rs.historySignals?.fixLoopCount) || 0,
+    }),
+    telemetry: playbookExecution.summarizePlaybookRun({
+      playbookId: context.playbookId, taskInstanceId: state?.taskInstanceId, trace: context.trace,
+      run, acceptance, reviewDecision: reviewDecision ?? run.reviewDecision, host: context.host,
+    }),
+  };
+}
+
+/** Persist the review-policy decision on the ledger as a task-owned `review` receipt. */
+export async function recordReviewDecision({ projectRoot, payload = {}, decision, harness = 'unknown' } = {}) {
+  if (!projectRoot || !decision || typeof decision.action !== 'string') return { rejected: true, eventId: null };
+  const routeState = await readRouteState(projectRoot, payload);
+  if (routeState?.routeSummary?.playbookId !== playbookExecution.FEATURE_PLAYBOOK_ID) return { rejected: true, eventId: null };
+  return recordLedgerEvent({
+    type: 'receipt',
+    receipt: {
+      ts: Date.now(), kind: 'review', toolName: 'review-policy', success: true,
+      review: { action: decision.action, namedCheck: decision.namedCheck ?? null, signalsHit: decision.signalsHit || [], round: decision.reviewRounds ?? 0 },
+    },
+  }, { projectRoot, payload, harness, routeState });
+}
+
 // Playbook trace advisory (observability only). A routed playbook other than
 // bug-fix — whose floor stays the one hard gate — whose required steps are
 // neither receipt-done nor proportionately skipped, on a request that already
@@ -3797,7 +4100,7 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
 // changes the decision (continue/notify/missingEvidence untouched): no new
 // continuation loop, no hard block. A no-write release (answer/plan/review, or
 // a proportionate trivial route) stays advisory-free.
-function playbookStopAdvisory({ state = {}, ledger = {} } = {}, result = {}) {
+function playbookStopAdvisory({ state = {}, ledger = {}, cwd } = {}, result = {}) {
   if (!result || result.continue === true) return null;
   const routeSummary = state?.routeSummary || {};
   const playbookId = routeSummary.playbookId || null;
@@ -3805,8 +4108,11 @@ function playbookStopAdvisory({ state = {}, ledger = {} } = {}, result = {}) {
   const effectiveLedger = effectiveRequestLedger(state, ledger);
   if (effectiveLedger.writeAttempted !== true) return null;
   const trace = buildPlaybookTrace(effectiveLedger, playbookId);
-  if (playbookTraceMissingSteps(trace).length === 0) return null;
-  return `UKit playbook note: ${formatPlaybookTrace(trace)} (advisory).`;
+  const stepNote = playbookTraceMissingSteps(trace).length === 0 ? null
+    : `UKit playbook note: ${formatPlaybookTrace(trace)} (advisory).`;
+  // Round 5: a delegated feature run adds its acceptance verdict — advisory text only.
+  const acceptanceNote = playbookExecution.formatAcceptance(evaluateFeatureAcceptance({ state, ledger, cwd }));
+  return [stepNote, acceptanceNote && `UKit ${acceptanceNote} (advisory).`].filter(Boolean).join(' ') || null;
 }
 
 export function evaluateCompletion(args = {}) {
@@ -3825,6 +4131,10 @@ export function evaluateCompletion(args = {}) {
   };
   result.diagnostics = diagnostics;
   if (result.reason) result.reason += ` [task=${diagnostics.taskInstanceId || 'unknown'} contract=${diagnostics.contract || 'unknown'} accepted-count=${diagnostics.acceptedEvidence.length} rejected=${diagnostics.rejectedEvidence.join(',') || 'none'}]`;
+  try {
+    const acceptance = evaluateFeatureAcceptance({ state: args.state, ledger: args.ledger, cwd: args.cwd });
+    if (acceptance.applicable) result.playbookAcceptance = acceptance;
+  } catch { /* acceptance is advisory and never breaks the gate */ }
   try {
     const advisory = playbookStopAdvisory(args, result);
     if (advisory) return { ...result, playbookAdvisory: advisory };

package/template_project/.claude/ukit/runtime/hook-chain-runner.mjs

@@ -325,6 +325,14 @@ async function run(payloadText, scriptArgs, { chainMarker = true, decisionShortC
   const parsedArgs = scriptArgs.map(parseScriptArg);
   const scriptPaths = parsedArgs.map((a) => a.scriptPath);
   const payload = JSON.parse(payloadText || '{}');
+  // The omp bridge stamps `ukit_harness` on every payload it builds. pi.exec drops its environment
+  // option and the host's spawn inherits the launch-time snapshot, so a runtime process.env write in
+  // the bridge never reaches hook children (live: omp ledger harness 'claude-code', main tier read
+  // from .claude/settings.json). Setting it here covers this runner, its in-proc .mjs steps and the
+  // .sh children (stepEnv spreads process.env).
+  if (typeof payload?.ukit_harness === 'string' && /^[a-z][a-z0-9-]{0,31}$/.test(payload.ukit_harness)) {
+    process.env.UKIT_HARNESS = payload.ukit_harness;
+  }
   const firstScript = scriptPaths[0] || '';
   const projectRoot = firstScript
     ? path.resolve(path.dirname(firstScript), '../..')

package/template_project/.claude/ukit/runtime/loop-state.mjs

@@ -127,5 +127,7 @@ export async function applyLoopBreak({ merged, projectRoot, runRoot, payload, se
     'Stop released. This is NOT approval: completion evidence was not accepted by the blocking policy; this does not mean no verification ran; no safety/permission denial is lifted.',
     'Report it verbatim; do not retry, wake up, or resume any handoff.',
   ].join('\n');
-  return { ...merged, decision: null, reason: undefined, loopBreak: true, policyOwner: 'loop-breaker', systemMessage: merged.systemMessage ? `${note}\n${merged.systemMessage}` : note };
+  // The release is a terminal diagnostic, not another carrier for prior hook
+  // output. Re-appending that output can recursively amplify escalation text.
+  return { ...merged, decision: null, reason: undefined, loopBreak: true, policyOwner: 'loop-breaker', systemMessage: note };
 }

package/template_project/.claude/ukit/runtime/observability-emit.mjs

@@ -1110,6 +1110,43 @@ function linkageField(...candidates) {
  * derivation, the session-boot request_key join, and the envelope session_id.
  * `enforcement` derives per FR-006 unless the emitter overrode it.
  */
+// Round 5: minimal, non-sensitive Playbook-execution telemetry riding the existing
+// outcome.observed record. Closed field set, bounded strings/numbers; ids and counts only
+// (no prompts, paths or reply text). `observed.*` stays null unless the host really reported it.
+export function outcomePlaybook(value) {
+  if (!isPlainObject(value) || !isNonEmptyString(value.playbookId)) return null;
+  const text = (v, max = 64) => (isNonEmptyString(v) ? v.slice(0, max) : null);
+  const num = (v) => (Number.isFinite(v) && v >= 0 ? Math.trunc(v) : null);
+  const obj = (v) => (isPlainObject(v) ? v : {});
+  const tokens = isPlainObject(value.tokens) ? {
+    input: num(value.tokens.input), output: num(value.tokens.output), cacheRead: num(value.tokens.cacheRead),
+    cacheCreate: num(value.tokens.cacheCreate), total: num(value.tokens.total),
+    provenance: ['PROVIDER', 'ESTIMATED', 'UNKNOWN'].includes(value.tokens.provenance) ? value.tokens.provenance : 'UNKNOWN',
+  } : null;
+  const outcomes = obj(value.workerOutcomes);
+  return {
+    playbookId: text(value.playbookId),
+    taskInstanceId: text(value.taskInstanceId, 96),
+    host: text(value.host, 16),
+    stepsRequired: num(value.stepsRequired),
+    stepsDone: num(value.stepsDone),
+    workerCount: num(value.workerCount),
+    executionMode: ['none', 'single', 'sequential', 'concurrent', 'unknown'].includes(value.executionMode) ? value.executionMode : 'unknown',
+    requested: { tier: text(obj(value.requested).tier, 16), model: text(obj(value.requested).model), effort: text(obj(value.requested).effort, 16) },
+    observed: { model: text(obj(value.observed).model), effort: text(obj(value.observed).effort, 16) },
+    resolved: { tier: text(obj(value.resolved).tier, 16), effort: text(obj(value.resolved).effort, 16), effortBinding: text(obj(value.resolved).effortBinding, 24) },
+    effective: { model: text(obj(value.effective).model) || 'UNKNOWN', effort: text(obj(value.effective).effort, 16) || 'UNKNOWN' },
+    durationMs: num(value.durationMs),
+    retries: num(value.retries),
+    workerOutcomes: { evidenced: num(outcomes.evidenced), claimOnly: num(outcomes.claimOnly), unobservable: num(outcomes.unobservable), failed: num(outcomes.failed) },
+    tokens,
+    integration: text(value.integration, 24),
+    review: text(value.review, 32),
+    reviewState: text(value.reviewState, 32),
+    acceptance: ['PASS', 'NOT_PASS', 'UNVERIFIED'].includes(value.acceptance) ? value.acceptance : null,
+  };
+}
+
 export function buildOutcomeObservedRecord({
   outcome = null,
   projectRoot = null,
@@ -1156,6 +1193,7 @@ export function buildOutcomeObservedRecord({
     source: isNonEmptyString(safe.source) ? safe.source.slice(0, 96) : null,
     request_key: sessionBootRequestKey({ projectRoot, sessionId: resolvedSessionId }),
     ts: isNonEmptyString(safe.ts) ? safe.ts : new Date().toISOString(),
+    ...(outcomePlaybook(safe.playbook) ? { playbook: outcomePlaybook(safe.playbook) } : {}),
   };
   return {
     semantic_name: SEMANTIC_OUTCOME_OBSERVED,