@ngockhoale/ukit 3.4.50 → 3.4.52

package/template_project/.claude/hooks/skill-router.sh

@@ -1965,14 +1965,46 @@ function classifyTaskSemantics({ promptText = '', targetFile = '' } = {}) {
   if (!releasePolicy && !operation && isVerificationOnlyRequest(promptText)) return { taskKind: 'READ_ONLY', verificationOnly: true };
   // A config MENTION is not a config change: the same clause needs a mutation verb, and a
   // request that also changes source/code is a coding task (config is part of its tests/fixtures).
-  const config = !sourceOrder && actionable.some((clause) => /\b(?:configuration|config|toggle|cau hinh)\b/.test(clause)
-    && /\b(?:set|change|toggle|enable|disable|switch|turn|configure|modify|update|edit|doi|bat|tat|chinh)\b/.test(clause));
+  // A DIAGNOSTIC report of past changes ("which parameters/configuration has changed, if any" /
+  // "tham so/cau hinh nao da thay doi, neu co") is a question about history, never an authorization
+  // to mutate: only a forward order ("change X to Y") stays a config mutation.
+  const CONFIG_CHANGE_REPORT_CLAUSE = /\b(?:da|has|have|had|already)\s+(?:doi|thay doi|changed?|updated?)\b|\b(?:nao|gi|which|what|report|bao cao)\b[^.;]*?\b(?:doi|thay doi|changed?|updated?)\b/;
+  // A relative past-change clause inside a FORWARD imperative ("Set the config that
+  // has changed to dark mode") names WHICH config — it does not make the sentence a
+  // report. The override holds only when the clause's FIRST mutation word precedes
+  // the config noun AND no reporting/question frame opens the clause or precedes
+  // that word: in "Report what change was made to the config" the mutation word is
+  // a question's noun, never an order.
+  const CONFIG_MUTATION_VERB = /\b(?:set|change|toggle|enable|disable|switch|turn|configure|modify|update|edit|doi|bat|tat|chinh)\b/;
+  const CONFIG_NOUN = /\b(?:configuration|config|toggle|cau hinh)\b/;
+  const CONFIG_REPORT_FRAME = /^\s*(?:report|show|tell|list|describe|explain|summari[sz]e|bao cao|cho biet|liet ke|mo ta)\b/;
+  const CONFIG_QUESTION_FRAME_PREFIX = /\b(?:what|which|how|report|bao cao|nao|gi)\b/;
+  const config = !sourceOrder && actionable.some((clause) => {
+    if (!CONFIG_NOUN.test(clause) || !CONFIG_MUTATION_VERB.test(clause)) return false;
+    if (CONFIG_REPORT_FRAME.test(clause)) return false;
+    const verb = CONFIG_MUTATION_VERB.exec(clause);
+    if (CONFIG_QUESTION_FRAME_PREFIX.test(clause.slice(0, verb.index))) return false;
+    const noun = CONFIG_NOUN.exec(clause);
+    return !CONFIG_CHANGE_REPORT_CLAUSE.test(clause) || Boolean(noun && noun.index > verb.index);
+  });
   const repository = Boolean(targetFile) || /[\w.-]+\.(?:json|ya?ml|toml|ini)\b/.test(text);
   // A status/result lookup ("check the suite output and report") orders no change: it needs a
   // lookup verb AND no mutation vocabulary anywhere in the request (fail-closed otherwise).
   const mutationWord = /\b(?:implement|fix|refactor|modify|edit|write|update|add|create|build|make|install|deploy|remove|delete|rename|replace|change|sua|viet|chinh|them|tao|xoa|doi|cai|cap nhat)\b/.test(text);
-  const statusReport = !mutationWord && !operation && !config
-    && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua|da len chua)\b/.test(text);
+  // A bounded, recognizable reporting QUESTION about what changed ("Tham số/cấu hình
+  // nào đã thay đổi, nếu có." / "which configuration has changed, if any") is a
+  // status report even without a lookup verb — but ONLY when no actionable clause
+  // actually orders a mutation: a mixed request ("Add a dark-mode button; report
+  // which configuration changed") keeps its implementation contract and evidence.
+  // The two lookbehinds keep a question's noun ("what change was made") and the
+  // Vietnamese past-tense verb "thay đổi" from counting as mutation orders.
+  const ACTIONABLE_MUTATION_ORDER = /(?<!\b(?:what|which|how|nao|gi)\s)(?<!thay )\b(?:implement|fix(?:es)?|refactor|modify|edit|write|update|add|create|build|make|install|deploy|remove|delete|rename|replace|change|sua|viet|chinh|them|tao|xoa|doi|cai|cap nhat)\b/;
+  const configReportQuestion = !actionable.some((clause) => ACTIONABLE_MUTATION_ORDER.test(clause))
+    && actionable.some((clause) => /\b(?:configuration|config|toggle|cau hinh|tham so)\b/.test(clause)
+      && CONFIG_CHANGE_REPORT_CLAUSE.test(clause));
+  const statusReport = (configReportQuestion || (!mutationWord
+      && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua|da len chua)\b/.test(text)))
+    && !operation && !config;
   const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|investigate|debug|forensic|root cause|kiem tra|phan tich|dieu tra|doc log|tim hieu)\b/.test(text) || statusReport)
     && !sourceOrder && !codeChangeVerb && !operation && !config;
   const taskKind = operation ? (sourceOrder || (nativeDomain !== 'scheduled-job' && codeChangeVerb) ? 'MIXED' : 'OPERATIONAL')
@@ -3346,6 +3378,14 @@ function applyTaskSemantics(contract, semantic) {
       ts: Date.now(),
       source: state?.source || 'skill-router',
       requestKey: state?.requestKey || null,
+      // Continuation-identity audit join: which task this row served and where its
+      // id/contract came from (gate continuation vs fresh route). Telemetry only —
+      // deliberately excluded from the dedupe key. The hook passes the PERSISTED
+      // route state here, so these mirror the state's own audit stamps.
+      taskInstanceId: state?.taskInstanceId || null,
+      taskIdOrigin: state?.taskIdOrigin || null,
+      taskKind: routeSummary?.executionContract?.taskKind || null,
+      contractOrigin: state?.contractOrigin || null,
       adapter: routingContext.adapter || 'claude',
       promptFingerprint: stableMachineDigest({
         prompt: routingContext.lastExplicitUserPromptText || '',
@@ -3844,6 +3884,10 @@ function applyTaskSemantics(contract, semantic) {
   async function persistRouteState(text) {
     const persisted = JSON.parse(text);
     persisted.taskInstanceId = taskInstanceId;
+    // Bounded audit metadata (short strings, additive): where this turn's task id and
+    // contract came from — 'system' marks a synthetic continuation that resumed the
+    // previous task instead of minting a fresh one. No consumer branches on these yet.
+    persisted.taskIdOrigin = continuingTask ? (systemOriginTurn ? 'system' : 'continue') : 'fresh';
     if (continuingTask && previous.routingContext?.lastExplicitUserPromptText) {
       persisted.routingContext ||= {};
       persisted.routingContext.lastExplicitUserPromptText = previous.routingContext.lastExplicitUserPromptText;
@@ -3862,6 +3906,7 @@ function applyTaskSemantics(contract, semantic) {
       // original request's, never one re-derived from the injected prompt's wording.
       persisted.routeSummary ||= {};
       persisted.routeSummary.executionContract = previous.routeSummary.executionContract;
+      persisted.contractOrigin = 'carried-system';
       for (const key of ['expectedSourceFiles', 'completionState', 'continuationState', 'executionMode']) {
         if (previous.routeSummary[key] !== undefined) persisted.routeSummary[key] = previous.routeSummary[key];
         else delete persisted.routeSummary[key];
@@ -3896,6 +3941,7 @@ function applyTaskSemantics(contract, semantic) {
       persisted.routeSummary ||= { executionMode: 'local-build' };
       persisted.routeSummary.executionContract = applyTaskSemantics(
         persisted.routeSummary.executionContract || buildExecutionContract('local-build'), semantic);
+      if (persisted.contractOrigin !== 'carried-system') persisted.contractOrigin = 'classified';
       delete persisted.routeSummary.completionState;
       delete persisted.routeSummary.continuationState;
     } else if (semantic.taskKind !== 'CODE_IMPLEMENTATION' || persisted.routeSummary) {
@@ -3906,8 +3952,11 @@ function applyTaskSemantics(contract, semantic) {
       if (carriedStatus && persisted.routingContext?.mutationOrder === true) {
         delete persisted.routeSummary.executionContract;
       }
-      if (!carriedStatus || persisted.routingContext?.mutationOrder === true) persisted.routeSummary.executionContract = applyTaskSemantics(
-        persisted.routeSummary.executionContract || buildExecutionContract(persisted.routeSummary.executionMode === 'informational' ? 'local-build' : persisted.routeSummary.executionMode), semantic);
+      if (!carriedStatus || persisted.routingContext?.mutationOrder === true) {
+        persisted.routeSummary.executionContract = applyTaskSemantics(
+          persisted.routeSummary.executionContract || buildExecutionContract(persisted.routeSummary.executionMode === 'informational' ? 'local-build' : persisted.routeSummary.executionMode), semantic);
+        if (persisted.contractOrigin !== 'carried-system') persisted.contractOrigin = 'classified';
+      }
       if (semantic.taskKind === 'OPERATIONAL' || semantic.taskKind === 'READ_ONLY'
         || (semantic.taskKind === 'CONFIGURATION' && semantic.configurationScope === 'external')) {
         persisted.routeSummary.completionState = buildCompletionState({
@@ -3925,7 +3974,7 @@ function applyTaskSemantics(contract, semantic) {
     }
     text = JSON.stringify(persisted);
     await writeJsonFileAtomic(statePath, text);
-    if (!sessionId) return;
+    if (!sessionId) return persisted;
     try {
       const dir = path.join(projectRoot, '.ukit', 'storage', 'cache', 'route-state');
       await writeJsonFileAtomic(path.join(dir, `${String(sessionId).replace(/[^a-zA-Z0-9._-]/g, '_').slice(0, 96) || 'default'}.json`), text);
@@ -3938,6 +3987,7 @@ function applyTaskSemantics(contract, semantic) {
         }
       }
     } catch {}
+    return persisted;
   }
   const storedPrevious = await readJson(statePath, {});
   // The shared slot may belong to another session; recover only our owned sidecar.
@@ -3967,10 +4017,38 @@ function applyTaskSemantics(contract, semantic) {
   // verification-only turn can never satisfy). Only transcript metadata set by the harness or the
   // fixed compaction preamble counts - never the prompt's claims about itself.
   let coordinationTurn = false;
+  // Provenance: our OWN gate block re-injected as a prompt. Trust only the exact pending marker
+  // the gate recorded for this session + task + EXACT reason text (hash) within TTL (consumed on
+  // match), and only when the host did not declare the prompt user-originated: a user quoting the
+  // gate text is a genuine fresh request even while a marker is still fresh. Ledger module loads
+  // only for gate-shaped prompts, so ordinary turns pay nothing.
+  const promptOrigin = String(payload.ukit_prompt_origin ?? '').trim().toLowerCase();
+  let boundGateContinuation = false;
+  {
+    const gatePrompt = extractPrompt(payload).trim();
+    if (gatePrompt && sessionId && promptOrigin === 'system' && /^UKit completion gate:/.test(gatePrompt)) {
+      try {
+        const ledgerRuntime = await import(pathToFileURL(path.join(projectRoot, '.claude', 'ukit', 'runtime', 'execution-ledger.mjs')).href);
+        const gateTaskId = ledgerRuntime.completionContinuationTaskId(gatePrompt);
+        if (gateTaskId && previous.taskInstanceId === gateTaskId) {
+          const taken = await ledgerRuntime.takePendingCompletionContinuation(projectRoot, {
+            sessionId,
+            taskInstanceId: gateTaskId,
+            reasonHash: ledgerRuntime.completionContinuationReasonHash(gatePrompt),
+          });
+          boundGateContinuation = Boolean(taken);
+        }
+      } catch { boundGateContinuation = false; }
+    }
+  }
   const systemOriginTurn = (() => {
     const promptTrim = extractPrompt(payload).trim();
     if (!promptTrim) return false;
     if (/^This session is being continued from a previous conversation/i.test(promptTrim)) return true;
+    // Bridge-owned metadata only (ukit-bridge.js maps the host's session-stop-continuation
+    // attribution); an arbitrary prompt prefix proves nothing and is never trusted here.
+    if (payload.ukit_harness === 'omp' && promptOrigin === 'system') return true;
+    if (boundGateContinuation) return true;
     const tp = payload.transcript_path ?? payload.transcriptPath;
     if (!tp || typeof tp !== 'string') return false;
     try {
@@ -4392,11 +4470,11 @@ function applyTaskSemantics(contract, semantic) {
     }
 
     await ensureDir(statePath);
-    await persistRouteState(JSON.stringify(reusedState));
+    const persistedReused = await persistRouteState(JSON.stringify(reusedState));
     await appendRouteAuditEntry(routeAuditPath, buildRouteAuditEntry({
       routingContext: reusedState.routingContext || {},
       routeSummary: rescuedRouteSummary || {},
-      state: reusedState,
+      state: persistedReused || reusedState,
     }));
 
     // BL-017: detached decisions.tsv shadow emission for the reused route —
@@ -4533,11 +4611,11 @@ function applyTaskSemantics(contract, semantic) {
     ...(helpers ? { helpers } : {}),
     routeSummary: compactRouteSummary(routeSummary),
   };
-  await persistRouteState(JSON.stringify(sharedState));
+  const persistedRouteState = await persistRouteState(JSON.stringify(sharedState));
   await appendRouteAuditEntry(routeAuditPath, buildRouteAuditEntry({
     routingContext,
     routeSummary,
-    state: sharedState,
+    state: persistedRouteState || sharedState,
   }));
 
   // BL-017: detached decisions.tsv shadow emission — fire-and-forget child

package/template_project/.claude/ukit/index/review-panel-aggregate.mjs

@@ -30,12 +30,73 @@ const SEVERITIES = ['critical', 'important', 'minor'];
 // counted as absent and named in `unparsed`.
 export function parseVerdictBlock(text) {
   const src = String(text ?? '');
-  const verdictMatch = src.match(/^VERDICT\s*:\s*(APPROVED-WITH-MINOR|APPROVED|CHANGES-REQUESTED|CRITICAL)\s*$/im);
+  // `-` and `_` are one vocabulary: the handoff commands and some reviewers
+  // write `changes_requested` / `critical_block` while others write the hyphen
+  // forms — both spellings parse to the same canonical verdict so a blocking
+  // reviewer can never be dropped as unparsed while the panel approves.
+  // `[ \t]` (not `\s`) around the colon: `\s` would swallow the newline and
+  // let a stray word on the next line fabricate a verdict.
+  const verdictMatch = src.match(
+    /^VERDICT[ \t]*:[ \t]*(APPROVED[-_]WITH[-_]MINOR|APPROVED|CHANGES[-_]REQUESTED|CRITICAL[-_]BLOCK|CRITICAL)[ \t]*\r?$/im,
+  );
   if (!verdictMatch) return null;
+  const rawVerdict = verdictMatch[1].toUpperCase().replace(/_/g, '-');
+  const verdict = rawVerdict === 'CRITICAL-BLOCK' ? 'CRITICAL' : rawVerdict;
 
   const memberMatch = src.match(/^PANEL_MEMBER\s*:\s*(\S+)\s*$/im);
   const member = memberMatch && memberMatch[1] !== '-' ? memberMatch[1] : null;
 
+  // VERIFICATION_RERUN status (PASS | FAIL | NOT_RUN | N/A). The status may
+  // sit inline on the heading line AND/OR under the indented `result:` line —
+  // both positions are read, and an explicit FAIL or NOT_RUN in either wins
+  // over a PASS elsewhere (fail closed on contradiction). Bare prose
+  // (`N pass / M fail`) and a literal template echo (`VERIFICATION_RERUN:
+  // PASS | FAIL | …` — still carrying the `|` vocabulary) parse as no status,
+  // leaving the field null (= no required metadata → pre-existing behavior).
+  // FAIL = the re-run executed and failed; NOT_RUN = the required verification
+  // never executed — either blocks approval.
+  //
+  // Layout is read exhaustively and conservatively: `[ \t]` (not `\s`) after
+  // the heading colon so the match cannot swallow the newline before an
+  // indented child (a `result:` FIRST child used to be hidden this way), the
+  // global match reads REPEATED VERIFICATION_RERUN headers, and every
+  // `result:` child line of each header is collected so a contradictory
+  // second line cannot hide behind the first. FAIL/NOT_RUN dominate.
+  const STATUS_RANK = { FAIL: 3, NOT_RUN: 2, PASS: 1, 'N/A': 0 };
+  const statuses = [];
+  const commands = [];
+  const vrRe = /^VERIFICATION_RERUN[ \t]*:[ \t]*(.*)$/img;
+  let vr;
+  while ((vr = vrRe.exec(src)) !== null) {
+    const inline = vr[1].trim();
+    const inlineStatus = inline.includes('|') ? null : inline.match(/^(PASS|FAIL|NOT_RUN|N\/A)\b/i);
+    if (inlineStatus) statuses.push(inlineStatus[1].toUpperCase());
+    for (const line of src.slice(vr.index + vr[0].length).split('\n')) {
+      if (/^\S/.test(line)) break; // next top-level field ends this header's children
+      const result = line.match(/^[ \t]*result[ \t]*:[ \t]*(.*)$/i);
+      if (result) {
+        const status = result[1].trim().match(/^(PASS|FAIL|NOT_RUN|N\/A)\b/i);
+        if (status) statuses.push(status[1].toUpperCase());
+        continue; // keep reading — a contradictory later `result:` must still block
+      }
+      const command = line.match(/^[ \t]*command[ \t]*:[ \t]*(.*)$/i);
+      if (command) commands.push(command[1].trim());
+    }
+  }
+  const dominant = statuses.length > 0
+    ? [...statuses].sort((a, b) => STATUS_RANK[b] - STATUS_RANK[a])[0]
+    : null;
+  // Fail closed on applicability: an N/A claim beside a DECLARED executable
+  // command contradicts the block's own evidence — the required check exists,
+  // so the N/A counts as NOT_RUN (the check was not run). A placeholder
+  // command (`-`, `none`, `(none …)`, `n/a …`) or no command line keeps N/A
+  // legitimate for genuinely check-free reviews.
+  const hasExecutableCommand = commands.some((c) => {
+    const t = c.trim().toLowerCase();
+    return t !== '' && t !== '-' && t !== 'none' && !t.startsWith('(none') && !t.startsWith('n/a');
+  });
+  const verificationRerun = dominant === 'N/A' && hasExecutableCommand ? 'NOT_RUN' : dominant;
+
   const findings = { critical: [], important: [], minor: [] };
   const findingsMatch = src.match(/^FINDINGS:\s*$/im);
   if (findingsMatch) {
@@ -70,7 +131,7 @@ export function parseVerdictBlock(text) {
     }
   }
 
-  return { member, verdict: verdictMatch[1].toUpperCase(), findings };
+  return { member, verdict, findings, verificationRerun };
 }
 
 // Normalize a finding bullet for identity comparison: two members report the
@@ -120,8 +181,15 @@ export function aggregatePanelVerdicts(verdicts) {
   const hasCritical =
     parsed.some((p) => p.verdict === 'CRITICAL') || parsed.some((p) => p.findings.critical.length > 0);
 
+  // Fail closed on explicit verification evidence: a re-run that FAILED, or
+  // one never executed (NOT_RUN), cannot sit behind an approving prose
+  // verdict — the block stops counting toward approval entirely.
+  const hasBlockingVerification = parsed.some(
+    (p) => p.verificationRerun === 'FAIL' || p.verificationRerun === 'NOT_RUN',
+  );
+
   let verdict;
-  if (hasCritical || changeRequests >= 1 || parsed.length === 0) verdict = 'changes_requested';
+  if (hasCritical || changeRequests >= 1 || hasBlockingVerification || parsed.length === 0) verdict = 'changes_requested';
   else if (approvals >= 2) verdict = 'approved';
   else verdict = 'approved_minor';
 

package/template_project/.claude/ukit/index/route-resolver.mjs

@@ -1202,14 +1202,46 @@ export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {})
   if (!releasePolicy && !operation && isVerificationOnlyRequest(promptText)) return { taskKind: 'READ_ONLY', verificationOnly: true };
   // A config MENTION is not a config change: the same clause needs a mutation verb, and a
   // request that also changes source/code is a coding task (config is part of its tests/fixtures).
-  const config = !sourceOrder && actionable.some((clause) => /\b(?:configuration|config|toggle|cau hinh)\b/.test(clause)
-    && /\b(?:set|change|toggle|enable|disable|switch|turn|configure|modify|update|edit|doi|bat|tat|chinh)\b/.test(clause));
+  // A DIAGNOSTIC report of past changes ("which parameters/configuration has changed, if any" /
+  // "tham so/cau hinh nao da thay doi, neu co") is a question about history, never an authorization
+  // to mutate: only a forward order ("change X to Y") stays a config mutation.
+  const CONFIG_CHANGE_REPORT_CLAUSE = /\b(?:da|has|have|had|already)\s+(?:doi|thay doi|changed?|updated?)\b|\b(?:nao|gi|which|what|report|bao cao)\b[^.;]*?\b(?:doi|thay doi|changed?|updated?)\b/;
+  // A relative past-change clause inside a FORWARD imperative ("Set the config that
+  // has changed to dark mode") names WHICH config — it does not make the sentence a
+  // report. The override holds only when the clause's FIRST mutation word precedes
+  // the config noun AND no reporting/question frame opens the clause or precedes
+  // that word: in "Report what change was made to the config" the mutation word is
+  // a question's noun, never an order.
+  const CONFIG_MUTATION_VERB = /\b(?:set|change|toggle|enable|disable|switch|turn|configure|modify|update|edit|doi|bat|tat|chinh)\b/;
+  const CONFIG_NOUN = /\b(?:configuration|config|toggle|cau hinh)\b/;
+  const CONFIG_REPORT_FRAME = /^\s*(?:report|show|tell|list|describe|explain|summari[sz]e|bao cao|cho biet|liet ke|mo ta)\b/;
+  const CONFIG_QUESTION_FRAME_PREFIX = /\b(?:what|which|how|report|bao cao|nao|gi)\b/;
+  const config = !sourceOrder && actionable.some((clause) => {
+    if (!CONFIG_NOUN.test(clause) || !CONFIG_MUTATION_VERB.test(clause)) return false;
+    if (CONFIG_REPORT_FRAME.test(clause)) return false;
+    const verb = CONFIG_MUTATION_VERB.exec(clause);
+    if (CONFIG_QUESTION_FRAME_PREFIX.test(clause.slice(0, verb.index))) return false;
+    const noun = CONFIG_NOUN.exec(clause);
+    return !CONFIG_CHANGE_REPORT_CLAUSE.test(clause) || Boolean(noun && noun.index > verb.index);
+  });
   const repository = Boolean(targetFile) || /[\w.-]+\.(?:json|ya?ml|toml|ini)\b/.test(text);
   // A status/result lookup ("check the suite output and report") orders no change: it needs a
   // lookup verb AND no mutation vocabulary anywhere in the request (fail-closed otherwise).
   const mutationWord = /\b(?:implement|fix|refactor|modify|edit|write|update|add|create|build|make|install|deploy|remove|delete|rename|replace|change|sua|viet|chinh|them|tao|xoa|doi|cai|cap nhat)\b/.test(text);
-  const statusReport = !mutationWord && !operation && !config
-    && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua|da len chua)\b/.test(text);
+  // A bounded, recognizable reporting QUESTION about what changed ("Tham số/cấu hình
+  // nào đã thay đổi, nếu có." / "which configuration has changed, if any") is a
+  // status report even without a lookup verb — but ONLY when no actionable clause
+  // actually orders a mutation: a mixed request ("Add a dark-mode button; report
+  // which configuration changed") keeps its implementation contract and evidence.
+  // The two lookbehinds keep a question's noun ("what change was made") and the
+  // Vietnamese past-tense verb "thay đổi" from counting as mutation orders.
+  const ACTIONABLE_MUTATION_ORDER = /(?<!\b(?:what|which|how|nao|gi)\s)(?<!thay )\b(?:implement|fix(?:es)?|refactor|modify|edit|write|update|add|create|build|make|install|deploy|remove|delete|rename|replace|change|sua|viet|chinh|them|tao|xoa|doi|cai|cap nhat)\b/;
+  const configReportQuestion = !actionable.some((clause) => ACTIONABLE_MUTATION_ORDER.test(clause))
+    && actionable.some((clause) => /\b(?:configuration|config|toggle|cau hinh|tham so)\b/.test(clause)
+      && CONFIG_CHANGE_REPORT_CLAUSE.test(clause));
+  const statusReport = (configReportQuestion || (!mutationWord
+      && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua|da len chua)\b/.test(text)))
+    && !operation && !config;
   const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|investigate|debug|forensic|root cause|kiem tra|phan tich|dieu tra|doc log|tim hieu)\b/.test(text.replace(/\bread[\s-]*only\b/g, ' ')) || statusReport)
     && !sourceOrder && !codeChangeVerb && !operation && !config;
   const taskKind = operation ? (sourceOrder || codeChangeVerb ? 'MIXED' : 'OPERATIONAL')

package/template_project/.claude/ukit/index/route-task.mjs

@@ -1131,13 +1131,29 @@ const HOOK_STATE_SOURCES = ['skill-router', 'skill-router-provisional'];
  * or any state the hook did not own, so a repeated request still mints a new id and unrelated evidence
  * stays rejected. An explicit --task-instance-id is honored when well-formed.
  */
+// Mirror of execution-ledger.mjs isCompletionGateContinuationText (kept local so the CLI stays
+// import-free). Shape only: trust is decided by the caller's bound pending marker, never by this match.
+const GATE_CONTINUATION_PREFIX = /^UKit completion gate:/;
+const GATE_CONTINUATION_DIAGNOSTICS = /\s\[task=\S+ contract=\S+ accepted-count=\d+ rejected=[^\]\s]*\]\s*$/;
+export function isCompletionGateContinuationText(text) {
+  const value = String(text ?? '').trim();
+  if (!value || value.length > 2000) return false;
+  return GATE_CONTINUATION_PREFIX.test(value) && GATE_CONTINUATION_DIAGNOSTICS.test(value);
+}
+
 export function reuseOrMintTaskInstanceId({ previousState = {}, promptText = '', commandText = '', targetFile = null, explicitId = null, continuingTask = false } = {}) {
   const explicit = typeof explicitId === 'string' ? explicitId.trim() : '';
   if (explicit && TASK_INSTANCE_ID_SHAPE.test(explicit)) return { id: explicit, origin: null };
   const prevId = previousState?.taskInstanceId;
   if (prevId) {
+    // 'system' (a gate continuation the HOOK verified via positive provenance —
+    // marker or native origin metadata — and stamped into route state) keeps the
+    // same-prompt refresh rights as a hook-owned id: the task must persist across
+    // the synthetic continuation, resolve-context and tool receipts until a real
+    // new request. The CLI itself is not a provenance source: it only honors the
+    // origin the hook already established.
     const hookTurn = HOOK_STATE_SOURCES.includes(previousState.source)
-      || (previousState.source === 'task-route' && previousState.taskIdOrigin === 'hook');
+      || (previousState.source === 'task-route' && (previousState.taskIdOrigin === 'hook' || previousState.taskIdOrigin === 'system'));
     const stored = previousState.routingContext?.lastExplicitUserPromptText;
     const samePrompt = Boolean(stored) && stored === promptText;
     const promptlessRefresh = Boolean(stored) && !promptText && Boolean(commandText || targetFile);
@@ -6125,6 +6141,13 @@ function buildRouteAuditEntry({ route = null, state = null } = {}) {
     fastPathKind: routeSummary.fastPathKind ?? null,
     source: state?.source ?? 'task-route',
     requestKey: state?.requestKey ?? null,
+    // Continuation-identity audit join: which task this row served and where its
+    // id/contract came from (gate continuation vs fresh route). Telemetry only —
+    // deliberately excluded from dedupeKey/fingerprint inputs.
+    taskInstanceId: state?.taskInstanceId ?? null,
+    taskIdOrigin: state?.taskIdOrigin ?? null,
+    taskKind: routeSummary?.executionContract?.taskKind ?? null,
+    contractOrigin: state?.contractOrigin ?? null,
     adapter: routingContext.adapter ?? 'claude',
     promptFingerprint: stableMachineDigest({
       prompt: routingContext.lastExplicitUserPromptText ?? '',

package/template_project/.claude/ukit/runtime/execution-ledger.mjs

@@ -456,6 +456,110 @@ export async function writeResumeIntent(projectRoot, payload = {}, { now = Date.
   return intent;
 }
 
+// ─── Gate-continuation provenance ───────────────────────────────────────────
+// When the Stop gate blocks, the harness re-injects the block reason as the next
+// prompt (omp emits it as an agent-attributed `session-stop-continuation`). That
+// text is the gate's OWN voice, not a user order. Reproducible defect shape when
+// such a prompt is routed as a new task: a fresh taskInstanceId is minted, a
+// contract is re-derived from the gate's own wording, and the gate text is
+// stamped as the explicit user prompt — evidence recorded under the original
+// task then fails ownership and the gate can loop on its own feedback.
+//
+// Provenance is NOT content-based: the shape check below only recognizes our own
+// envelope. Trust comes from (a) the host declaring POSITIVE system provenance
+// (ukit_prompt_origin=system — a marker may then be consumed on an exact
+// session+task+reason-hash match within TTL) or (b) native adapter provenance
+// (ukit_harness=omp + origin=system), which resumes with or without a marker.
+// A marker is a CORRELATION binding, never proof of the speaker: without positive
+// provenance the prompt is conservatively treated as the user's own, so a real
+// user paste of the gate text stays a genuine fresh request even with a live
+// marker, and a user-declared origin never consumes a marker at all.
+export const GATE_CONTINUATION_TTL_MS = 30 * 60 * 1000;
+const GATE_CONTINUATION_PREFIX = /^UKit completion gate:/;
+// The exact diagnostics tail evaluateCompletion appends to every gate reason.
+const GATE_CONTINUATION_DIAGNOSTICS = /\s\[task=\S+ contract=\S+ accepted-count=\d+ rejected=[^\]\s]*\]\s*$/;
+const GATE_CONTINUATION_MAX_CHARS = 2000;
+
+export function isCompletionGateContinuationText(text) {
+  const value = String(text ?? '').trim();
+  if (!value || value.length > GATE_CONTINUATION_MAX_CHARS) return false;
+  return GATE_CONTINUATION_PREFIX.test(value) && GATE_CONTINUATION_DIAGNOSTICS.test(value);
+}
+
+export function completionContinuationTaskId(text) {
+  if (!isCompletionGateContinuationText(text)) return null;
+  return String(text).trim().match(/\[task=([^\]\s]+) contract=/)?.[1] || null;
+}
+
+// Binds a marker to the EXACT reason text the gate emitted (hash only — the
+// marker record never carries prompt text). Prevents a different gate-shaped
+// message about the same task from being mistaken for our own continuation.
+export function completionContinuationReasonHash(text) {
+  return crypto.createHash('sha256').update(String(text ?? '').trim(), 'utf8').digest('hex');
+}
+
+function completionContinuationPath(projectRoot) {
+  return path.join(projectRoot, '.ukit', 'storage', 'cache', 'completion-continuation.json');
+}
+
+// Bounded ring (newest first): session, task id, contract kind and reason hash
+// only — never prompt text. Fail-closed: no task id or no reason text, no
+// marker. Advisory: a failed write degrades to today's behavior (the envelope
+// is then just an unbound user turn), never breaks the gate. Read-modify-write
+// runs under the ledger lock so concurrent recorders/takers serialize —
+// unlocked, two takes could both "win" and parallel records could clobber the
+// ring down to a single entry. A lock failure is conservative on both sides:
+// record nothing, resume nothing.
+export async function recordPendingCompletionContinuation(projectRoot, { sessionId, taskInstanceId, contract, reason }, { now = Date.now() } = {}) {
+  if (!taskInstanceId || !String(reason ?? '').trim()) return null;
+  const file = completionContinuationPath(projectRoot);
+  try {
+    const outcome = await withLedgerLock(file, {}, async () => {
+      const store = await readJson(file, {}) || {};
+      const entries = Array.isArray(store.entries) ? store.entries : [];
+      const next = [
+        { sessionId: sessionId == null ? null : String(sessionId), taskInstanceId: String(taskInstanceId), contract: contract == null ? null : String(contract), reasonHash: completionContinuationReasonHash(reason), ts: now },
+        ...entries.filter((entry) => entry?.taskInstanceId !== taskInstanceId),
+      ].slice(0, 4);
+      await writeJsonAtomic(file, { entries: next });
+      return next[0];
+    });
+    return outcome?.ok === true ? outcome.value ?? null : null;
+  } catch {
+    return null;
+  }
+}
+
+// Exact-bound take: the envelope's own task id AND the consuming session AND
+// the reason hash must all match a fresh marker, otherwise nothing is returned
+// and nothing is consumed (an unbound or re-worded quote of the gate text stays
+// a genuine user turn). A call without the reason hash never consumes. The
+// matched entry is removed under the same lock that read it, so of N concurrent
+// takers exactly one wins.
+export async function takePendingCompletionContinuation(projectRoot, { sessionId, taskInstanceId, reasonHash }, { now = Date.now(), consume = true } = {}) {
+  if (!taskInstanceId || !reasonHash) return null;
+  const file = completionContinuationPath(projectRoot);
+  try {
+    const outcome = await withLedgerLock(file, {}, async () => {
+      const store = await readJson(file, {}) || {};
+      const entries = Array.isArray(store.entries) ? store.entries : [];
+      const index = entries.findIndex((entry) => entry?.taskInstanceId === String(taskInstanceId)
+        && (entry.sessionId ?? null) === (sessionId == null ? null : String(sessionId))
+        && typeof entry.reasonHash === 'string' && entry.reasonHash === String(reasonHash)
+        && Number.isFinite(entry.ts) && now - entry.ts <= GATE_CONTINUATION_TTL_MS);
+      if (index < 0) return null;
+      if (consume) {
+        const next = entries.filter((_, i) => i !== index);
+        await writeJsonAtomic(file, { entries: next });
+      }
+      return entries[index];
+    });
+    return outcome?.ok === true ? outcome.value ?? null : null;
+  } catch {
+    return null;
+  }
+}
+
 function explicitError(payload = {}) {
   return [
     payload.isError,
@@ -697,10 +801,13 @@ function compactReceipt(receipt) {
 
 // --- Typed verdicts (SPEC-typed-verdicts §2) -----------------------------------
 // One optional verdict record rides the ledger entry — additive, no new store.
-// kind: 'live-verified' | 'test-verified' | 'check-only' | 'blocked' | 'failed'.
-// Currency is proven by headSha + baseSha + patch-id, not by commit messages or a
-// green check from an older SHA.
-const VERDICT_KINDS = new Set(['live-verified', 'test-verified', 'check-only', 'blocked', 'failed']);
+// kind: 'live-verified' | 'test-verified' | 'check-only' | 'blocked' | 'failed'
+//     | 'unproven'.
+// 'unproven' is a masked wrapper exit 0 (pipe/`sh -c` consumer): the runner may have
+// passed or failed — the receipt proves NEITHER, so it is never a satisfying kind
+// (fail-closed) and never a definite 'failed'. Currency is proven by headSha + baseSha
+// + patch-id, not by commit messages or a green check from an older SHA.
+const VERDICT_KINDS = new Set(['live-verified', 'test-verified', 'check-only', 'blocked', 'failed', 'unproven']);
 const VERDICT_SATISFYING_KINDS = new Set(['test-verified', 'live-verified']);
 const MAX_VERDICT_HISTORY = 8;
 
@@ -1029,7 +1136,10 @@ function mintVerificationVerdict(receipt, payload, projectRoot, sessionRoot = pr
   }
   let kind = supplied.kind;
   if (!VERDICT_KINDS.has(kind)) {
-    if (receipt.success !== true) kind = 'failed';
+    // A masked wrapper exit 0 proves the runner's status neither way: its own kind,
+    // never 'failed' (the runner may have passed) and never a satisfying kind.
+    if (receipt.exitStatusUnproven === true) kind = 'unproven';
+    else if (receipt.success !== true) kind = 'failed';
     else kind = isTestGateCommand(receipt.command) ? 'test-verified' : 'check-only';
   }
   return {
@@ -1116,6 +1226,18 @@ function terminalShellCommandUnit(command) {
     ) next += 1;
     return next;
   };
+  // A redirection's leading IO number (`2>&1`, `2> err.log`, `3< in`) belongs to the stream
+  // operator, not to the command: drop a trailing digit run ONLY when it is the whole
+  // current shell word (preceded by whitespace or the start of the buffer). The scanner
+  // only reaches redirections outside quotes, so a quoted literal (`-t "2" > out`) ends in
+  // a quote character and is never stripped; an ordinary numeric argument separated from
+  // the operator by whitespace (`--testTimeout 2 > out`, `-n 2 > out`) keeps its digits.
+  const stripIoNumber = () => {
+    let end = pipeBuffer.length;
+    while (end > 0 && /\d/.test(pipeBuffer[end - 1])) end -= 1;
+    if (end === pipeBuffer.length || (end > 0 && !/\s/.test(pipeBuffer[end - 1]))) return;
+    pipeBuffer = pipeBuffer.slice(0, end);
+  };
 
   for (let index = 0; index < text.length; index += 1) {
     const char = text[index];
@@ -1148,6 +1270,7 @@ function terminalShellCommandUnit(command) {
     }
     if (char === '$' && text[index + 1] === '(') return null;
     if (char === '>' || char === '<') {
+      stripIoNumber();
       let next = index + 1;
       if (text[next] === '>' && char === '>') next += 1;
       if (text[next] === '&') next += 1;
@@ -2375,7 +2498,13 @@ function applyReceiptCore(ledger, receipt, { vibecode = false } = {}) {
     }
     next.verificationAttempted = true;
     next.verificationSucceeded = next.verificationSucceeded || receipt.success;
-    next.verificationFailed = next.verificationFailed || !receipt.success;
+    // SPEC-typed-verdicts §2: an UNPROVEN run (masked wrapper exit 0) is neither a pass
+    // nor a definite failure — it must not grow failure counts, the loop streak or a
+    // blocker, and it never moves `verificationFailed`. Only a PROVEN non-zero exit is a
+    // definite failure; fail-closed acceptance is unchanged (only a current
+    // test-verified/live-verified verdict ever satisfies the gate).
+    const unproven = receipt.exitStatusUnproven === true;
+    next.verificationFailed = next.verificationFailed || (!receipt.success && !unproven);
     // TASK-026 fix round 1: bank the FIRST successful run of this command (same
     // terminal-shell identity the loop tracker uses), so rerunning a banked check is a
     // replay — never progress — regardless of receipt-window eviction.
@@ -2406,7 +2535,8 @@ function applyReceiptCore(ledger, receipt, { vibecode = false } = {}) {
 
     // Verification-loop tracking. `terminalShellCommandUnit` gives the loop identity:
     // the same failing check rerun — `setup && yarn test` and `yarn test 2>&1 | tail`
-    // both count as the same command, while a different check resets the streak.
+    // both count as the same command (redirection IO numbers are stripped), while a
+    // different check resets the streak.
     const fingerprint = terminalShellCommandUnit(receipt.command) || receipt.command;
     const counts = { ...(next.verificationFailureCounts || {}) };
     if (receipt.success) {
@@ -2415,7 +2545,18 @@ function applyReceiptCore(ledger, receipt, { vibecode = false } = {}) {
       if (next.failedVerificationStreak?.fingerprint === fingerprint) {
         next.failedVerificationStreak = null;
       }
-    } else {
+      // A valid, newer pass of the SAME check clears its OWN verification-loop blocker:
+      // same terminal-shell identity the tracker minted it with, applied to this task's
+      // ledger in receive order (a replayed older event is deduped by journalSeen, and a
+      // foreign task never reaches this ledger — recordLedgerEvent rejects
+      // receipt-task-mismatch and a new task re-keys to a fresh ledger). Unrelated
+      // command evidence never clears another check's blocker; an unproven or failed
+      // run (success:false) never clears anything, so the exhausted-retry blocker still
+      // ends the run instead of inviting an automatic recovery loop.
+      if (next.blocker?.kind === 'verification-loop' && next.blocker.command === fingerprint) {
+        next.blocker = null;
+      }
+    } else if (!unproven) {
       const streakFingerprint = next.failedVerificationStreak?.fingerprint;
       const streakCount = streakFingerprint === fingerprint
         ? Number(next.failedVerificationStreak.count || 0) + 1
@@ -3355,8 +3496,9 @@ function recoveryInstruction(missingEvidence, ledger = {}, routeSummary = {}, {
     }
     // A pipe-masked run is UNPROVEN, not failed: name the real gap (no provable exit status)
     // instead of telling the model to "fix the failure" of a run that may have passed.
+    // Unproven never sets `verificationFailed`, so this must not key off that flag.
     const lastVerification = [...(ledger.receipts || [])].reverse().find((r) => r?.kind === 'verification');
-    if (!instruction && ledger.verificationFailed && lastVerification?.exitStatusUnproven === true) {
+    if (!instruction && lastVerification?.exitStatusUnproven === true) {
       instruction = `The last verification (\`${String(lastVerification.command || '').slice(0, 80)}\`) ran in a pipeline, so its exit status is unproven. Re-run it without the pipe, or with \`set -o pipefail\`, and inspect the exit code.`;
     }
     if (!instruction && ledger.verificationFailed) {
@@ -4442,6 +4584,17 @@ async function runEvaluateStop() {
   if (result.continue) {
     if (result.finalNotice) await markNotified(projectRoot, payload, ledger);
     else await incrementContinuation(projectRoot, payload, ledger, state?.requestKey || null, evidencePromptKey(state));
+    // Provenance: the harness will re-inject this reason as a prompt. Bind it to this
+    // session+task+exact-reason (hash) so the router can recognise our own continuation
+    // (advisory — a failed write only leaves it unbound).
+    try {
+      await recordPendingCompletionContinuation(projectRoot, {
+        sessionId: explicitSessionId(payload),
+        taskInstanceId: state?.taskInstanceId || null,
+        contract: state?.routeSummary?.executionContract?.taskKind || null,
+        reason: result.reason,
+      });
+    } catch { /* advisory */ }
     process.stdout.write(`${JSON.stringify({ decision: 'block', reason: result.reason })}\n`);
     return;
   }