@ngockhoale/ukit 3.4.50 → 3.4.52

package/template_project/.claude/ukit/runtime/omp-task-dispatch-guard.mjs

@@ -0,0 +1,262 @@
+// omp-task-dispatch-guard.mjs — block-only preflight for OMP `task` dispatches.
+//
+// Field evidence: an ordinary OMP agent dispatched with a `sourceSession` (or `model`)
+// field is rejected by OMP's embedded validator (18.12.5) even when the value is empty
+// (`''` / `[]` / `null`), and batch-root `sourceSession`/`model` are rejected outright.
+// The model's natural retry after that rejection re-sends the exact same invalid
+// payload, so one bad field can loop a dispatch indefinitely.
+//
+// What this guard does (host PreToolUse return supports BLOCK only — it cannot rewrite
+// the native input, so correction is always the caller's job):
+//
+// - `preflightOmpTaskDispatch()` is the only function a bridge needs to call, before
+//   the native validator sees the payload. Valid dispatches are returned as-is with
+//   `action: 'allow'` and NEVER touch disk. An invalid dispatch is never rewritten:
+//   the guard returns `action: 'block'` carrying `violations`, the exact
+//   `removeFields` paths and a `guidance` string, so the model can correct the
+//   payload itself; a corrected dispatch is a valid, different shape and is allowed
+//   without consuming any budget.
+// - `validateOmpTaskArgs()` checks exactly the confirmed ordinary restriction: batch
+//   root `sourceSession`/`model` are invalid, and a `tasks[]` item whose agent is not
+//   `seance` must not carry `sourceSession` or `model` at all — presence alone is the
+//   violation, any value included. Seance items are NOT validated here (missing
+//   `sourceSession`, custom tools, etc. remain the native validator's job); the guard
+//   never sanitizes a seance task and never switches an agent to seance. This is
+//   deliberately narrower than the full native validator, not a re-implementation.
+// - Repeat blocks are counted per (session, taskInstanceId, dispatch shape). The
+//   `taskInstanceId` is REQUIRED for a count: the bridge reads it from
+//   `readRouteState(projectRoot, { session_id })` (per-session sidecar, owner
+//   verified) and supplies it here. A missing session or task instance id means the
+//   budget cannot be scoped, so the dispatch is blocked WITHOUT recording or borrowing
+//   any count. Full session ids are hashed (no truncation), so distinct sessions that
+//   share a long prefix never collide.
+// - Once attempts reach `OMP_DISPATCH_MAX_RETRIES` identical invalid blocks for one
+//   task instance (two, by default), the guidance says STOP: the dispatch shape is
+//   provably stuck, and retrying unchanged only burns tokens. The count persists under
+//   `.ukit/storage/cache/omp-task-dispatch-guard.json` behind the shared async lock
+//   (`withAsyncLock`), so a compact or session reload does NOT reset it. Only hashed
+//   keys and counters are stored — never task prose, agent names, or raw session or
+//   task-instance ids.
+// - The fingerprint (`ompTaskDispatchFingerprint`) intentionally EXCLUDES task prose,
+//   name, read and status — a reworded prompt is the same stuck dispatch and must not
+//   reset the count — while preserving agent, the presence AND value of the offending
+//   fields, and tools/isolation/isolated, so a genuinely different branch (different
+//   agent, tools, isolation, or field value) keeps its own independent count and a new
+//   genuine task is never blocked by another task's failures.
+//
+// Failure posture: the guard is fail-CLOSED for invalid input it already understands —
+// a lock timeout or internal I/O error still BLOCKS the known-invalid dispatch
+// (reason: 'lock-unavailable' / 'internal-error') rather than letting a looping
+// payload through; the native validator would reject it anyway. Valid dispatches hit
+// no disk, so they are unaffected by any of this.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { withAsyncLock } from './async-lock.mjs';
+
+export const OMP_DISPATCH_MAX_RETRIES = 2;
+const STATE_FILE_NAME = 'omp-task-dispatch-guard.json';
+const MAX_ENTRIES = 200;
+const LOCK_BUDGET_MS = 1_000;
+const ENTRY_TTL_MS = 24 * 60 * 60_000;
+const SEANCE_AGENT = 'seance';
+// Fields the OMP validator rejects when present on an ordinary agent or the batch
+// root. Presence alone (even '' / [] / null) is the violation.
+const ORDINARY_FORBIDDEN_FIELDS = ['sourceSession', 'model'];
+
+/**
+ * Check the confirmed OMP 18.12.5 ordinary restriction on task dispatch arguments.
+ * Pure: never mutates `args`, never talks to disk, and does NOT validate seance tasks
+ * (the native validator owns all seance rules).
+ * @param {object} args - single task object, or a batch `{ tasks: [...] }`
+ * @returns {{ valid: boolean, violations: Array<{code: string, path: string, field: string}> }}
+ */
+export function validateOmpTaskArgs(args) {
+  const violations = [];
+  if (!args || typeof args !== 'object' || Array.isArray(args)) {
+    return { valid: true, violations };
+  }
+  const isBatch = Array.isArray(args.tasks);
+  // Batch-root fields are only a violation in batch shape; a single task object's own
+  // fields are validated as that task below.
+  if (isBatch) {
+    for (const field of ORDINARY_FORBIDDEN_FIELDS) {
+      if (Object.prototype.hasOwnProperty.call(args, field)) {
+        violations.push({ code: 'batch-root-field-present', path: field, field });
+      }
+    }
+  }
+  const tasks = isBatch ? args.tasks : [args];
+  tasks.forEach((task, index) => {
+    if (!task || typeof task !== 'object' || Array.isArray(task)) return;
+    // The host trims the agent name before dispatch, so the seance comparison must
+    // trim too — a padded '  seance  ' agent is a seance task, not an ordinary one.
+    if (taskAgent(task) === SEANCE_AGENT) return; // native validator owns seance rules
+    const label = isBatch ? `tasks[${index}]` : 'task';
+    for (const field of ORDINARY_FORBIDDEN_FIELDS) {
+      if (Object.prototype.hasOwnProperty.call(task, field)) {
+        violations.push({ code: 'ordinary-field-present', path: `${label}.${field}`, field });
+      }
+    }
+  });
+  return { valid: violations.length === 0, violations };
+}
+
+/**
+ * Stable shape fingerprint for repeat counting: includes agent, the presence AND value
+ * of the offending fields, tools and isolation; deliberately excludes task prose,
+ * name, read and status so a reworded prompt cannot reset the count.
+ * @param {object} args
+ * @returns {string}
+ */
+export function ompTaskDispatchFingerprint(args) {
+  if (!args || typeof args !== 'object' || Array.isArray(args)) return 'empty';
+  const shape = {};
+  for (const field of ORDINARY_FORBIDDEN_FIELDS) {
+    if (Object.prototype.hasOwnProperty.call(args, field)) shape[field] = normalizeValue(args[field]);
+  }
+  const tasks = Array.isArray(args.tasks) ? args.tasks : [args];
+  shape.tasks = tasks.map((task) => {
+    if (!task || typeof task !== 'object' || Array.isArray(task)) return { agent: String(task) };
+    const item = { agent: taskAgent(task) };
+    for (const field of ORDINARY_FORBIDDEN_FIELDS) {
+      if (Object.prototype.hasOwnProperty.call(task, field)) item[field] = normalizeValue(task[field]);
+    }
+    if (Array.isArray(task.tools)) item.tools = task.tools.map((t) => normalizeValue(t));
+    if (task.isolation !== undefined) item.isolation = normalizeValue(task.isolation);
+    if (task.isolated !== undefined) item.isolated = normalizeValue(task.isolated);
+    return item;
+  });
+  return JSON.stringify(shape);
+}
+
+// The host trims the agent name before dispatch; mirror that here so a padded agent
+// is classified and fingerprinted as its trimmed value.
+function taskAgent(task) {
+  return String(task?.agent ?? '').trim();
+}
+
+// Key-order-stable, content-exact serialization: arrays serialize their items (so
+// same-length different-value arrays never collide), objects sort their keys (so
+// insertion order never changes the fingerprint), and only whitespace-only strings
+// collapse to 'empty'. The fingerprint must isolate the ACTUAL offending field value.
+function normalizeValue(value) {
+  if (value === null) return ['null'];
+  if (Array.isArray(value)) return ['array', value.map(normalizeValue)];
+  if (typeof value === 'object') {
+    return ['object', Object.keys(value).sort().map((key) => [key, normalizeValue(value[key])])];
+  }
+  if (typeof value === 'string') return ['string', value.trim() === '' ? '' : value];
+  return [typeof value, String(value)];
+}
+
+// Full, untruncated session id — slicing (e.g. to 80 chars) would let two distinct
+// long session ids that share a prefix collide into one budget.
+function countKey(sessionId, taskInstanceId, fingerprint) {
+  return crypto.createHash('sha1').update(`${sessionId}\u0000${taskInstanceId}\u0000${fingerprint}`).digest('hex').slice(0, 16);
+}
+
+function stateFilePath(projectRoot) {
+  return path.join(projectRoot, '.ukit', 'storage', 'cache', STATE_FILE_NAME);
+}
+
+function readState(file) {
+  try {
+    const s = JSON.parse(fs.readFileSync(file, 'utf8'));
+    return s && typeof s === 'object' && s.entries && typeof s.entries === 'object' ? s : { entries: {} };
+  } catch {
+    return { entries: {} };
+  }
+}
+
+function guidanceFor(violations, exhausted, attempts) {
+  const lines = violations.map((v) => {
+    if (v.code === 'batch-root-field-present') {
+      return `Remove field \`${v.field}\` from the batch root: the OMP task validator rejects it there. Keep the tasks[] items unchanged.`;
+    }
+    return `Remove field \`${v.field}\` from ${v.path}: an ordinary agent (agent !== 'seance') must not carry it — any value, even '' or null, is rejected. Keep the agent, tools and isolation unchanged; do not switch the agent.`;
+  });
+  if (exhausted) {
+    lines.push(`This exact invalid dispatch was already blocked ${attempts} times for this task. STOP retrying it: apply the removal above ONCE, or record this reviewer as NOT_RUN with the actual reason. Continue independent authorized work; do not invent configuration changes or bypass a denied tool.`);
+  }
+  return lines.join(' ');
+}
+
+/**
+ * Block-only preflight for one OMP task dispatch. See the module header for the full
+ * contract. Never rewrites `args`; never validates seance tasks; valid calls never
+ * touch disk.
+ * @param {{
+ *   projectRoot: string,
+ *   sessionId?: string,
+ *   taskInstanceId?: string,
+ *   args: object,
+ *   now?: number,
+ * }} input
+ * @returns {Promise<{
+ *   action: 'allow' | 'block',
+ *   args: object,
+ *   violations?: Array<object>,
+ *   removeFields?: string[],
+ *   guidance?: string,
+ *   attempts?: number,
+ *   exhausted?: boolean,
+ *   reason?: 'unscoped' | 'lock-unavailable' | 'internal-error',
+ * }>}
+ */
+export async function preflightOmpTaskDispatch({ projectRoot, sessionId, taskInstanceId, args, now = Date.now() }) {
+  const verdict = validateOmpTaskArgs(args);
+  if (verdict.valid) {
+    return { action: 'allow', args };
+  }
+  const removeFields = verdict.violations.map((v) => v.path);
+  const blockBase = { action: 'block', args, violations: verdict.violations, removeFields };
+  try {
+    // A count requires a scoppable identity. Without it the dispatch is blocked
+    // WITHOUT recording or borrowing any count entry.
+    const scoped = projectRoot && sessionId && taskInstanceId
+      && fs.existsSync(path.join(projectRoot, '.ukit', 'storage'));
+    if (!scoped) {
+      return { ...blockBase, guidance: guidanceFor(verdict.violations, false, 0), reason: 'unscoped' };
+    }
+    const key = countKey(sessionId, taskInstanceId, ompTaskDispatchFingerprint(args));
+    const file = stateFilePath(projectRoot);
+    const outcome = await withAsyncLock(file, { deadlineMs: LOCK_BUDGET_MS }, async () => {
+      const state = readState(file);
+      for (const [k, v] of Object.entries(state.entries)) {
+        if (!v || now - (v.last || 0) > ENTRY_TTL_MS) delete state.entries[k];
+      }
+      const keys = Object.keys(state.entries);
+      if (!state.entries[key] && keys.length >= MAX_ENTRIES) {
+        for (const k of keys.sort((a, b) => (state.entries[a].last || 0) - (state.entries[b].last || 0)).slice(0, keys.length - MAX_ENTRIES + 1)) {
+          delete state.entries[k];
+        }
+      }
+      const entry = state.entries[key] || (state.entries[key] = { count: 0, first: now });
+      entry.count += 1;
+      entry.last = now;
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      const tmp = `${file}.${process.pid}.tmp`;
+      fs.writeFileSync(tmp, `${JSON.stringify(state)}\n`);
+      fs.renameSync(tmp, file);
+      return entry.count;
+    });
+    if (!outcome.ok) {
+      // Fail closed: the payload is known-invalid, so block it even without a count.
+      return { ...blockBase, guidance: guidanceFor(verdict.violations, false, 0), reason: 'lock-unavailable' };
+    }
+    const attempts = outcome.value;
+    // STOP guidance starts once the count REACHES the bound (after two identical
+    // blocks, by default) — not on the block after them.
+    const exhausted = attempts >= OMP_DISPATCH_MAX_RETRIES;
+    return { ...blockBase, guidance: guidanceFor(verdict.violations, exhausted, attempts), attempts, exhausted };
+  } catch (error) {
+    return {
+      ...blockBase,
+      guidance: guidanceFor(verdict.violations, false, 0),
+      reason: 'internal-error',
+      note: `omp dispatch guard count unavailable: ${String(error?.message || error).slice(0, 120)}`,
+    };
+  }
+}

package/template_project/.claude/ukit/runtime/resumable-run.mjs

@@ -519,6 +519,14 @@ export async function readResumableRun(projectRoot, {
     };
   }
 
+  // The filename is a lossy sanitization of taskId (path chars normalized, length
+  // truncated to 80), so distinct task ids can share one record file. A record
+  // whose stored taskId is not the exact requested id belongs to another task and
+  // must never be borrowed — its evidence and failures are not this task's.
+  if (taskId !== undefined && parsed.taskId !== taskId) {
+    return { status: 'absent', record: null, warnings: [] };
+  }
+
   // A new explicit task boundary resets the record — the persisted state belongs
   // to a different logical task.
   if (typeof taskBoundary === 'string' && taskBoundary.length > 0

package/template_project/.omp/agents/code-reviewer.md

@@ -15,6 +15,38 @@ You are the independent reviewer for UKit's handoff Quality Gate. Your model is
 - `code` (default, if not specified) — reviewing a handoff task diff. Follow **Code Review** below, unchanged.
 - `spec` | `plan` — reviewing a document (e.g. `docs/plans/*.md`), no diff/task file/executor report involved. Skip straight to **Spec/Plan Review** at the end of this file instead.
 
+## REVIEW_KIND (code reviews only)
+
+Set one kind per review — from the task's own classification when the spawning
+command names one, else from what the diff shows:
+
+- `product` (default when the diff changes source or tests) — the full Code
+  Review rubric below applies unchanged, including Test Plan adherence and
+  RED_OUTPUT evidence.
+- `integration-evidence` — the diff verifies or mirrors behavior already
+  accepted elsewhere (template mirrors, parity copies, runtime/docs evidence).
+  The new-tests + RED_OUTPUT TDD requirements are inapplicable when the task
+  introduces no new behavior under test; review the evidence chain instead and
+  never fabricate tests or edits to satisfy them.
+- `status-only` — the task only records status/evidence; an empty diff is
+  legitimate. Review the executor report and verification output on disk.
+
+The review kind scopes only the implementation-TDD evidence (new tests +
+RED_OUTPUT). It never waives the required executable checks — the task's
+Verification Commands still re-run in your session (fresh PASS or the severity
+ladder applies; `NOT_RUN` on a required command blocks in every kind) — and it
+never lowers the task's original acceptance criteria.
+
+**Verdict ≠ acceptance.** The review verdict and the task's original acceptance
+are separate judgments. An `integration-evidence` review may legitimately be
+`APPROVED` as a review (the evidence chain is sound and complete) while the
+verdict's NOTES/BLOCKING explicitly report that product acceptance remains
+unmet or pending external observation — that report flows through
+`NEXT_STATUS_FOR_INDEX`/the task discussion and must not flip the product task
+to `done` or close a pending parent item. A `status-only` recording is
+bookkeeping, not an independent review pass: it never counts as evidence that
+independent review approved the underlying work.
+
 ## Code Review (REVIEW_TARGET_TYPE=code)
 
 ### Inputs you expect
@@ -28,7 +60,7 @@ If any input is missing, return `CHANGES-REQUESTED` with reason "incomplete hand
 ### Review order
 
 0. **Verification package completeness** — Check whether the project has a lint or typecheck script (`package.json` scripts, or the stack's equivalent). If it does and the task's Verification Commands don't run it, that is `CHANGES-REQUESTED`: "verification commands missing lint/typecheck — re-run planner or add the command and re-verify" — do this before anything else below.
-1. **Test Plan adherence** — Were all tests in §4 actually implemented, including the ≥2 edge cases required by `handoff.plan.minTestsEdgeCase`? Check the Executor Report's `RED_OUTPUT` field: it must contain actual failing-test output (assertion failure, stack trace, non-zero exit), not a bare claim like "confirmed" or "yes". Missing or vague `RED_OUTPUT` → `CHANGES-REQUESTED`: "no evidence tests were RED before implementation — re-run TDD cycle and paste real output". Then run the tests yourself: `<task Verification Commands>`. Fresh PASS required, no trusting executor's output blindly.
+1. **Test Plan adherence (REVIEW_KIND=product)** — Were all tests in §4 actually implemented, including the ≥2 edge cases required by `handoff.plan.minTestsEdgeCase`? Check the Executor Report's `RED_OUTPUT` field: it must contain actual failing-test output (assertion failure, stack trace, non-zero exit), not a bare claim like "confirmed" or "yes". Missing or vague `RED_OUTPUT` → `CHANGES-REQUESTED`: "no evidence tests were RED before implementation — re-run TDD cycle and paste real output". For `integration-evidence`/`status-only` reviews that TDD evidence is inapplicable — grade the task's own evidence chain instead of demanding new tests or RED_OUTPUT. Either way, run the required checks yourself: `<task Verification Commands>`. Fresh PASS required, no trusting executor's output blindly.
 2. **Correctness** — Does the diff implement the requested behavior? Any obvious wrong assumptions, stale refs, missing cases?
 3. **Regression risk** — What existing behavior could this break? Are shared paths/tests/contracts still aligned? Run the wider suite only when the diff touched shared code; otherwise the task's own targeted commands are the gate and the wave-boundary full `yarn test` (see docs/AI_HANDOFF/RULES.md "Test selection") is the regression net.
 4. **Safety / security / data loss** — Destructive actions, auth/permission, path handling, unsafe shell/DB/file ops.
@@ -75,13 +107,14 @@ model, so reviewer ≠ executor still stands.
 ## Reviewer Verdict
 
 VERDICT: APPROVED | APPROVED-WITH-MINOR | CHANGES-REQUESTED | CRITICAL
+REVIEW_KIND: product | integration-evidence | status-only
 REVIEWER_MODEL: [model name actually used]
 EXECUTOR_MODEL: [from executor report]
 PANEL_MEMBER: [panel tier — `@slow`/`@default`/`@smol`, or `solo` when the panel degenerates; `-` outside panel runs]
 AGREEMENT_MAP: [lead member only — finding → panel members reporting it, from review-panel-aggregate.mjs output; `-` otherwise]
-VERIFICATION_RERUN:
-  command: [exact command]
-  result: [N pass / M fail]
+VERIFICATION_RERUN: PASS | FAIL | NOT_RUN | N/A
+  command: [exact command, or `-` when N/A]
+  result: [N pass / M fail — or NOT_RUN — <reason>, or N/A — <reason>]
 TEST_PLAN_COVERAGE: [all-followed | partial — list gaps | missing — list]
 FINDINGS:
   critical:
@@ -102,7 +135,7 @@ After writing the verdict, update `docs/AI_HANDOFF/INDEX.md` row for this task:
 TASK: TASK-xxx
 VERDICT: approved | approved_minor | changes_requested | critical_block
 REVIEWER_MODEL: <exact model ID>
-VERIFICATION_RERUN: PASS | FAIL
+VERIFICATION_RERUN: PASS | FAIL | NOT_RUN | N/A (+ one-line reason for NOT_RUN/N/A)
 BLOCKING: <one line per critical/important finding, or "none">
 ```
 
@@ -138,7 +171,9 @@ Same model is the most common silent failure. Do not skip this check.
 ### Rules
 
 - **Always re-run** the task's Verification Commands. If they fail, VERDICT = CRITICAL regardless of executor claims.
-- If executor said `TEST_PLAN_FOLLOWED: N/A` without a real justification, downgrade to at minimum CHANGES-REQUESTED.
+- **VERIFICATION_RERUN is evidence, not prose.** `NOT_RUN` = the required verification never executed in your session (blocked, timed out, environment unavailable); `FAIL` = the re-run executed and did not pass. Either one must never accompany APPROVED or APPROVED-WITH-MINOR — with `NOT_RUN` the verdict is at most CHANGES-REQUESTED, and with `FAIL` it is CRITICAL per the ladder above. State the blocking status once, with the reason — a contradicting second line (e.g. header `PASS` next to `result: NOT_RUN`) is read fail-closed: the blocking status wins. `N/A` is only legitimate when this review has no executable required checks (e.g. a read-only spec/plan review, with `command: -` or no command line); when the task package defines Verification Commands, the re-run is required, so an `N/A` claim there counts as `NOT_RUN`. An `N/A` result that sits beside a declared executable `command:` (e.g. `command: yarn test`) contradicts its own evidence and counts as `NOT_RUN` — the aggregator fails it closed too. Never fabricate a PASS — a fabricated rerun is a fake test → CRITICAL.
+- If executor said `TEST_PLAN_FOLLOWED: N/A` without a real justification, downgrade to at minimum CHANGES-REQUESTED (REVIEW_KIND=product; a check-free `integration-evidence`/`status-only` review may declare N/A legitimately when no Test Plan applies — the required Verification Commands still re-run).
+- Verdict spelling is `-`/`_`-insensitive at the aggregator: `CHANGES_REQUESTED`, `CRITICAL_BLOCK`, `APPROVED_WITH_MINOR` parse to the same canonical verdicts as the hyphen forms, so write either spelling — a blocking verdict is never dropped as unparsed.
 - Never approve when test file has no real `expect`/`assert` - that is a fake test -> CRITICAL.
 - Keep the verdict block <= 30 lines. Findings are bullet points, not essays.
 - The same-model refusal above is non-negotiable: bypassing it defeats the entire Quality Gate.

package/template_project/.omp/hooks/pre/ukit-bridge.js

@@ -29,6 +29,7 @@ import {
 // drift apart (a configured 60-120s chain used to be killed here at 14-20s, which
 // for Edit|Write is a fail-closed transport failure = every edit blocked).
 import { resolveChainExecTimeoutMs } from '../../../.claude/ukit/runtime/hook-chain-budget.mjs';
+import { preflightOmpTaskDispatch } from '../../../.claude/ukit/runtime/omp-task-dispatch-guard.mjs';
 
 // OMP-3 (TASK-002): pi.exec forwards only {cwd, signal, timeout} to its spawn —
 // an environment option is dropped (verified against the bundled omp exec), and the host's
@@ -276,6 +277,27 @@ function runtimeMetadata(event = {}, context = {}) {
   };
 }
 
+// OMP 18.12.5 before_agent_start has no origin field. Recover only the nearest
+// native prompt-bearing branch entry, never a prefix claimed by prompt text.
+export function promptOriginFromBranch(prompt, context = {}) {
+  try {
+    const branch = context?.sessionManager?.getBranch?.();
+    if (!Array.isArray(branch)) return 'user';
+    for (let i = branch.length - 1; i >= Math.max(0, branch.length - 64); i -= 1) {
+      const entry = branch[i];
+      if (entry?.type === 'message' && entry.message?.role === 'user') return 'user';
+      const custom = entry?.type === 'custom_message' ? entry
+        : entry?.type === 'message' && entry.message?.role === 'custom' ? entry.message : null;
+      if (!custom || custom.customType !== 'session-stop-continuation') continue;
+      return custom.attribution === 'agent' && typeof custom.content === 'string'
+        && custom.content.trim() === String(prompt ?? '').trim() ? 'system' : 'user';
+    }
+  } catch {
+    // Older hosts or a closed session may not expose branch metadata.
+  }
+  return 'user';
+}
+
 function buildHookPayload(hookEventName, fields = {}) {
   const payload = { hook_event_name: hookEventName, ukit_harness: 'omp' };
   const mappings = [
@@ -290,6 +312,7 @@ function buildHookPayload(hookEventName, fields = {}) {
     ['prompt', 'prompt'],
     ['transcriptPath', 'transcript_path'],
     ['source', 'source'],
+    ['promptOrigin', 'ukit_prompt_origin'],
     ['subagentSession', 'ukit_subagent_session'],
   ];
   for (const [field, payloadField] of mappings) {
@@ -892,6 +915,20 @@ export async function runToolCall(pi, event, { projectRoot, context: extensionCo
     : [];
 
   const metadata = runtimeMetadata(event, extensionContext);
+  // Only the native OMP task tool uses this schema. Block, never rewrite: ordinary
+  // agents must omit seance-only fields, including empty/null placeholders. Some
+  // host versions may reject arguments before tool_call; that remains native-owned.
+  if (String(rawToolName ?? '').trim().toLowerCase() === 'task') {
+    const state = await readRouteState(projectRoot, { session_id: metadata.sessionId });
+    const dispatch = await preflightOmpTaskDispatch({
+      projectRoot, sessionId: metadata.sessionId, taskInstanceId: state?.taskInstanceId,
+      args: event.input,
+    });
+    if (dispatch.action === 'block') {
+      return { block: true, toolName: 'Task', invoked: [], context: [],
+        reason: `UKit OMP task preflight: ${dispatch.guidance}` };
+    }
+  }
   const payload = buildHookPayload('PreToolUse', {
     toolName,
     toolInput: normalizeToolInput(toolName, event.input),
@@ -981,6 +1018,7 @@ export async function runBeforeAgentStart(pi, event, { projectRoot, context: ext
   const metadata = runtimeMetadata(event, extensionContext);
   const payload = buildHookPayload('UserPromptSubmit', {
     prompt: event.prompt,
+    promptOrigin: promptOriginFromBranch(event.prompt, extensionContext),
     ...metadata,
   });
   const result = await runScriptChain(pi, HOOK_EVENT_MAP.before_agent_start, payload, { projectRoot });