@ngockhoale/ukit 3.4.67 → 3.4.68

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to UKit are documented here.
 
+## 3.4.68 - 2026-10-25
+
+**Stable hardening release; outstanding live acceptance explicitly deferred by the owner for the internal six-person team. This is not certification of unattended Handoff.**
+
+- Planning: durable source snapshots, recorded validator/independent-review ready gates, amendment/plan-count/overwrite controls, and realpath-safe installed helper entrypoints.
+- Runtime: authenticated asynchronous delegation completion, bounded recovery and claim fencing; landing coordinated with claims; explicit already-applied adoption and non-completing metadata reconciliation; completed-only archive/resume safeguards and three-engine adapter consistency.
+- Owner preservation: managed Handoff templates refresh only with provenance, retain custom content/sidecars safely through update and uninstall; prevent shell-keyword/state-builtin permission minting, with provenance-only sanitizer.
+- Classification/continuation: read-only output specifications and scheduled permission reminders no longer manufacture implementation work; real edit orders retain evidence obligations.
+- Safety: existing-only delegation guard also honors restrictive runner policy without a RUN marker. Planning instructions omit isolation, but **actual native dispatch is not fixed**: the latest create10 failed at its first isolation-bearing Agent call (0/10 accepted, nine skipped). The guard remains; no payload stripping, trust/permission expansion or provider workaround.
+- Known limits retained: clean unattended multi-plan execution, review-return/replan, blocked-independent scheduling, wait/no-duplicate, interruption/cycle resume, late-create frozen scope, pause/compact, current-candidate OMP lifecycle and missing native-host/platform coverage are not certified. Historical unidentified `79/1` and lost `ukitcmd25` (29/30) remain unexplained; later passing checks do not resolve them. Inspection-command friction also remains.
+- Evidence: reviewed repair groups; full code-candidate suite 673 files / 10,771 tests passed, three skipped. Recovered roadmap 8/8, integration 61/61, completed-only archive and unchanged reinvocation remain recovery evidence, not a clean unattended PASS. The owner explicitly waived these outstanding live gates as release blockers, not technical/package/registry-consumer checks. No FAIL/BLOCKED evidence is relabeled PASS.
+
 ## 3.4.67 - 2026-10-23
 
 - Fix: a wait/monitor/hold-only request ("keep waiting on the verifier job, read output to the footer, do not edit while the candidate is frozen") is now classified verification-only (`READ_ONLY`, `verification-evidence`) instead of the `CODE_IMPLEMENTATION` default that demanded `write-evidence` and forced an Edit/Write. A wait that also carries a real order ("wait, then fix src/app.js") stays an implementation. Vietnamese "rồi" now splits clauses for this check. Both classifier copies (`src/core/executionContracts.js`, installed `route-resolver.mjs`) changed together; regression in `tests/hooks/gateIntentClassification.test.js`.

package/manifests/documentation.yaml

@@ -517,6 +517,17 @@ entries:
     validation: [none]
     archive_policy: immutable
     notes: 2026-10-09 handoff root-cause audit (create-scope authority + Stop verification semantics)
+  - id: docs-analysis-handoff-post-3467-trace
+    path: docs/analysis/HANDOFF-POST-3467-TRACE.md
+    class: derived
+    audience: [maintainer]
+    owner: runtime
+    source_of_truth: template_project/.claude/ukit/runtime/execution-ledger.mjs
+    merge_strategy: none
+    load_policy: on-demand
+    validation: [none]
+    archive_policy: date-rotate
+    notes: Field trace and per-host evidence for narrow post-3.4.67 task-binding and claim hardening
   - id: docs-analysis-handoff-remediation-plan
     path: docs/analysis/HANDOFF-REMEDIATION-PLAN.md
     class: archive
@@ -627,6 +638,28 @@ entries:
     validation: [manual]
     archive_policy: never
     notes: Current owner scope, hardening evidence and remaining release obligations; not runtime state
+  - id: docs-analysis-handoff-goal-coverage
+    path: docs/analysis/HANDOFF-GOAL-COVERAGE.md
+    class: canonical
+    audience: [maintainer]
+    owner: product
+    source_of_truth: docs/analysis/HANDOFF-GOAL-COVERAGE.md
+    merge_strategy: none
+    load_policy: on-demand
+    validation: [manual]
+    archive_policy: never
+    notes: Independent requirement oracle vs current handoff state; nine coverage rows, per-host termination outcomes T1..T11, mutation-proofed coverage checker
+  - id: docs-analysis-handoff-write-boundary
+    path: docs/analysis/HANDOFF-WRITE-BOUNDARY.md
+    class: canonical
+    audience: [maintainer]
+    owner: product
+    source_of_truth: docs/analysis/HANDOFF-WRITE-BOUNDARY.md
+    merge_strategy: none
+    load_policy: on-demand
+    validation: [manual]
+    archive_policy: never
+    notes: Native planning Write permission evidence, authorized configuration provenance and unresolved live acceptance boundaries
   - id: docs-analysis-orchestration-final-verification
     path: docs/analysis/ORCHESTRATION-FINAL-VERIFICATION.md
     class: archive

package/manifests/instructionRules.yaml

@@ -349,6 +349,16 @@ rules:
     marker_in: [template_project/CLAUDE.md, template_project/AGENTS.md, CLAUDE.md, AGENTS.md]
     anchor: 'RUN.md'
     paths: [docs/AI_HANDOFF/**]
+  - id: HAND-03
+    title: Handoff planning gates are mechanical and read from disk
+    kind: supporting
+    statement: >-
+      Tasks flip needs_breakdown to ready only on a recorded validator VERDICT ok
+      plus PLAN_REVIEW Approved; ready-gate.mjs must print READY_GATE ok before
+      any flip; owner docs persist through source-snapshot.mjs; work lands
+      through land-worktree.mjs; rewrites need an amendments/rev copy
+      (amend-guard.mjs) — all bare single node commands.
+    marker_in: [template_project/AGENTS.md, AGENTS.md]
   - id: BUDGET-01
     title: Context budget per task class
     kind: critical

package/manifests/platform.full.yaml

@@ -171,6 +171,9 @@ items:
     type: config
     sourceTemplate: docs/AI_HANDOFF
     targetPath: docs/AI_HANDOFF
+    managedChildStrategies:
+      RULES.md: managed_template
+      queued/README.md: managed_template
     requires:
       - docs-project
       - docs-memory
@@ -2096,6 +2099,70 @@ items:
     packs:
       - core
 
+  # Roadmap-create field regression (2026-10-24): create runs recorded no SOURCE.md /
+  # sha256. The planner docs call this snapshot helper as ONE simple command — same
+  # manifest rule as the validator above, or autoDiscoverTemplates:false skips it and
+  # the documented command 404s on installs.
+  - id: ukit-index-source-snapshot-script
+    type: config
+    sourceTemplate: .claude/ukit/index/source-snapshot.mjs
+    targetPath: .claude/ukit/index/source-snapshot.mjs
+    requires: []
+    mergeStrategy: overwrite_with_backup
+    variables: []
+    enabledByDefault: true
+    packs:
+      - core
+
+  # CR-06: the flip-to-ready gate reads both readiness gates from disk. The create /
+  # fullstack / planner docs invoke it before every flip — same manifest rule as the
+  # validator above, or the documented command 404s on installs.
+  - id: ukit-index-allocate-task-worktree-script
+    type: config
+    sourceTemplate: .claude/ukit/index/allocate-task-worktree.mjs
+    targetPath: .claude/ukit/index/allocate-task-worktree.mjs
+    requires: []
+    mergeStrategy: overwrite_with_backup
+    variables: []
+    enabledByDefault: true
+    packs:
+      - core
+
+  - id: ukit-index-ready-gate-script
+    type: config
+    sourceTemplate: .claude/ukit/index/ready-gate.mjs
+    targetPath: .claude/ukit/index/ready-gate.mjs
+    requires: []
+    mergeStrategy: overwrite_with_backup
+    variables: []
+    enabledByDefault: true
+    packs:
+      - core
+
+  # CR-10: the amendments/rev copy check that must run before PLAN/SPEC/LEDGER rewrites.
+  - id: ukit-index-amend-guard-script
+    type: config
+    sourceTemplate: .claude/ukit/index/amend-guard.mjs
+    targetPath: .claude/ukit/index/amend-guard.mjs
+    requires: []
+    mergeStrategy: overwrite_with_backup
+    variables: []
+    enabledByDefault: true
+    packs:
+      - core
+
+  # CR-11: verifies an owner-stated plan count is delivered as that many real plan units.
+  - id: ukit-index-plan-count-script
+    type: config
+    sourceTemplate: .claude/ukit/index/plan-count.mjs
+    targetPath: .claude/ukit/index/plan-count.mjs
+    requires: []
+    mergeStrategy: overwrite_with_backup
+    variables: []
+    enabledByDefault: true
+    packs:
+      - core
+
   # Mechanic #10 (TASK-004): both scripts ship in template_project/ and must be
   # manifest-listed or autoDiscoverTemplates:false skips them and the documented
   # `node .claude/ukit/index/handoff-doc-validator.mjs` gate 404s on installs —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "3.4.67",
+  "version": "3.4.68",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/src/core/applyPlan.js

@@ -1,7 +1,32 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import { createHash } from 'node:crypto';
 import { writeFileAtomic, writeFileExclusive, copyFileSafe, createDirectoryLink, removeLinkOnly } from './fileOps.js';
 
+// CR-13 provenance: a `<file>.ukit-new` sidecar is only UKit's when install.json
+// records its sha256 (metadata.sidecars). The filename alone proves nothing — an
+// owner-authored file at that path must never be overwritten or removed.
+const sha256Hex = (buf) => createHash('sha256').update(buf).digest('hex');
+
+// lstat-first: a symlink/non-regular sidecar is never read through or replaced.
+async function readSidecarState(sidecarPath) {
+  let stat;
+  try {
+    stat = await fs.lstat(sidecarPath);
+  } catch (error) {
+    return error?.code === 'ENOENT' ? { state: 'absent' } : { state: 'unreadable', error };
+  }
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    return { state: 'non-regular' };
+  }
+  try {
+    const bytes = await fs.readFile(sidecarPath);
+    return { state: 'file', hash: sha256Hex(bytes) };
+  } catch (error) {
+    return { state: 'unreadable', error };
+  }
+}
+
 // legacy: '.antigravity/' stays TCC-protected — Antigravity adapter removed in v2.2.0, but a
 // stale install may still have the dir and must not lose TCC protection.
 const TCC_PROTECTED_PREFIXES = ['.codex/', '.antigravity/', '.omp/'];
@@ -80,12 +105,96 @@ export async function pruneOldBackups(backupRoot, {
   return { scanned: files.length, removed };
 }
 
-export async function applyDiffResults(diffResults, { backupRoot, projectRoot } = {}) {
+// Writes the new template beside an owner-edited managed file. Returns the recorded
+// sidecar hash when UKit created/refreshed it, or null when it was preserved as owner
+// content. Absent sidecar → exclusive create (race-safe: an appearing owner file is
+// never overwritten). Existing sidecar → update ONLY when install.json recorded its
+// current hash; otherwise preserve and report a conflict.
+async function writeManagedTemplateSidecar(sidecarPath, content, recordedSidecarHash) {
+  const bytes = Buffer.isBuffer(content) ? content : Buffer.from(content, 'utf8');
+  const nextHash = sha256Hex(bytes);
+  const state = await readSidecarState(sidecarPath);
+
+  if (state.state === 'absent') {
+    try {
+      await writeFileExclusive(sidecarPath, content);
+      return nextHash;
+    } catch (error) {
+      if (error?.code === 'EEXIST') {
+        // Lost the race to an owner file — never overwrite it.
+        console.warn(`[UKit] Warning: ${sidecarPath} appeared during install; left untouched (possible owner content).`);
+        return null;
+      }
+      throw error;
+    }
+  }
+  if (state.state === 'file' && typeof recordedSidecarHash === 'string' && recordedSidecarHash === state.hash) {
+    if (state.hash === nextHash) {
+      return nextHash; // already the current template — nothing to write
+    }
+    // Re-verify immediately before the rename: an owner edit landing between the
+    // first read and this write must not be silently replaced (TOCTOU window).
+    const recheck = await readSidecarState(sidecarPath);
+    if (recheck.state !== 'file' || recheck.hash !== recordedSidecarHash) {
+      console.warn(`[UKit] Warning: ${sidecarPath} changed during install; left untouched (possible owner content).`);
+      return null;
+    }
+    await writeFileAtomic(sidecarPath, content);
+    return nextHash;
+  }
+  // Owner-authored, owner-modified, symlink, or unreadable sidecar: keep it.
+  console.warn(
+    `[UKit] Warning: ${sidecarPath} is not UKit-managed (${state.state === 'file' ? 'content changed since UKit wrote it' : state.state}); preserved. Review it manually.`,
+  );
+  return null;
+}
+
+// Removes a sidecar only when install.json recorded the hash that is on disk now.
+// Unrecorded/owner-modified/symlink sidecars are preserved and reported.
+async function removeManagedTemplateSidecar(sidecarPath, recordedSidecarHash) {
+  const state = await readSidecarState(sidecarPath);
+  if (state.state === 'absent') {
+    return true;
+  }
+  if (state.state === 'file' && typeof recordedSidecarHash === 'string' && recordedSidecarHash === state.hash) {
+    await fs.rm(sidecarPath, { force: true });
+    return true;
+  }
+  console.warn(
+    `[UKit] Warning: keeping ${sidecarPath} — ${state.state === 'file' ? 'its content no longer matches the UKit-written copy' : `it is ${state.state}`}; remove it manually if it is no longer needed.`,
+  );
+  return false;
+}
+
+export async function applyDiffResults(diffResults, { backupRoot, projectRoot, recordedSidecarHashes = null, sidecarHashes = {} } = {}) {
   const writes = [];
   let skippedUpdates = 0;
   const skippedByAction = { create: 0, update: 0 };
 
   for (const entry of diffResults) {
+    // CR-13: owner-edited managed template — keep the file, write the new template beside it.
+    // Provenance is the recorded sidecar hash, never the filename (see writeManagedTemplateSidecar).
+    if (entry.action === 'sidecar') {
+      const sidecarPath = `${entry.targetPath}.ukit-new`;
+      const recorded = recordedSidecarHashes?.get(sidecarPath) ?? null;
+      const writtenHash = await writeManagedTemplateSidecar(sidecarPath, entry.renderedContent, recorded);
+      if (writtenHash) {
+        sidecarHashes[sidecarPath] = writtenHash;
+        console.log(`[UKit] Kept your edited ${path.basename(entry.targetPath)} unchanged; the new UKit template is at ${path.basename(sidecarPath)} — review and merge it.`);
+      } else {
+        console.log(`[UKit] Kept your edited ${path.basename(entry.targetPath)} unchanged; an owner file already exists at ${path.basename(sidecarPath)} and was preserved.`);
+      }
+      skippedUpdates += 1;
+      skippedByAction.update += 1;
+      continue;
+    }
+    if (entry.action === 'unchanged' && entry.removeSidecar) {
+      // Only a UKit-generated, unmodified sidecar is cleaned up; owner files stay.
+      await removeManagedTemplateSidecar(
+        `${entry.targetPath}.ukit-new`,
+        recordedSidecarHashes?.get(`${entry.targetPath}.ukit-new`) ?? null,
+      );
+    }
     if (entry.action !== 'create' && entry.action !== 'update') {
       continue;
     }
@@ -224,5 +333,5 @@ export async function applyDiffResults(diffResults, { backupRoot, projectRoot }
     });
   }
 
-  return { writes, skippedUpdates, skippedByAction };
+  return { writes, skippedUpdates, skippedByAction, sidecarHashes };
 }

package/src/core/buildPlan.js

@@ -231,8 +231,10 @@ export async function buildInstallPlan({
           const targetPath = safeResolve(projectRoot, path.join(item.targetPath, relativeChildPath));
           manifestSourcePaths.add(nestedSourcePath);
           explicitTargetPaths.add(targetPath);
+          const childKey = relativeChildPath.split(path.sep).join('/');
           fileItems.push({
             item,
+            mergeStrategy: item.managedChildStrategies?.[childKey],
             sourcePath: nestedSourcePath,
             targetPath,
             sourceMode: nestedStats[index].mode & 0o777,
@@ -270,7 +272,7 @@ export async function buildInstallPlan({
       type: item.type,
       sourcePath,
       targetPath,
-      mergeStrategy: item.mergeStrategy,
+      mergeStrategy: fileItems[i].mergeStrategy ?? item.mergeStrategy,
       renderedContent,
       requires: item.requires ?? [],
       mode: fileItems[i].sourceMode,

package/src/core/diffPlan.js

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 import fs from 'node:fs/promises';
 import YAML from 'yaml';
 import { isSymlinkTo } from './fileOps.js';
@@ -14,6 +15,49 @@ const GATEWAY_RESILIENCE_KEYS = new Set(Object.keys(GATEWAY_RESILIENCE_ENV_DEFAU
 // look identical to "missing" and the apply step would either overwrite the
 // live file atomically with no .bak (W2-C4) or crash mid-install on a 'wx'
 // create (W2-C6). Unreadable targets get a non-write action instead.
+// CR-13: managed AI_HANDOFF templates. Refresh only when the installed file is still the
+// content UKit last recorded (its sha256 in install.json); an owner-edited or legacy
+// (no recorded hash) file stays byte-identical and the new template goes to a sidecar.
+const sha256 = (buf) => createHash('sha256').update(buf).digest('hex');
+
+async function resolveManagedTemplateAction(entry, recordedHashes) {
+  const template = Buffer.isBuffer(entry.renderedContent) ? entry.renderedContent : Buffer.from(entry.renderedContent, 'utf8');
+  const templateHash = sha256(template);
+
+  // A symlink or non-regular target is owner content, never a managed copy we may
+  // replace: following it would read/write outside the project. lstat first so a
+  // symlink to a readable file is not mistaken for a normal managed file.
+  let lstat = null;
+  try {
+    lstat = await fs.lstat(entry.targetPath);
+  } catch (error) {
+    if (error?.code !== 'ENOENT') {
+      return conflictResult(entry, error); // unreadable parent etc. — never treat as absent
+    }
+  }
+  if (lstat && (lstat.isSymbolicLink() || !lstat.isFile())) {
+    return conflictResult(entry, { code: lstat.isSymbolicLink() ? 'ESYMLINK' : 'ENOTFILE' });
+  }
+
+  const read = await readFileOrStatus(entry.targetPath, null);
+  if (read.status === 'missing') {
+    // ONLY a confirmed absence permits create; unreadable must never overwrite.
+    return { ...entry, exists: false, action: 'create', existingContent: null, managedHash: templateHash };
+  }
+  if (read.status !== 'ok') {
+    return conflictResult(entry, read.error);
+  }
+  const installed = read.content;
+  const installedHash = sha256(installed);
+  if (installedHash === templateHash) {
+    return { ...entry, exists: true, action: 'unchanged', existingContent: installed, managedHash: templateHash, removeSidecar: true };
+  }
+  if (recordedHashes?.get(entry.targetPath) === installedHash) {
+    return { ...entry, exists: true, action: 'update', existingContent: installed, managedHash: templateHash, removeSidecar: true };
+  }
+  return { ...entry, exists: true, action: 'sidecar', existingContent: installed, managedHash: null };
+}
+
 async function readFileOrStatus(filePath, encoding = 'utf8') {
   try {
     if (encoding === null) {
@@ -358,7 +402,7 @@ async function resolveSkipEntryAction(entry, ompOwnership = null) {
   return resolveFileAction(entry, read.content, ompOwnership);
 }
 
-export async function diffInstallPlan(plan, { ompOwnership = null, settingsMigration = null } = {}) {
+export async function diffInstallPlan(plan, { ompOwnership = null, settingsMigration = null, recordedManagedHashes = null } = {}) {
   // Check all entries in parallel
   const results = await Promise.all(
     plan.entries.map(async (entry) => {
@@ -371,6 +415,10 @@ export async function diffInstallPlan(plan, { ompOwnership = null, settingsMigra
         return resolveSkipEntryAction(entry, ompOwnership);
       }
 
+      if (entry.mergeStrategy === 'managed_template') {
+        return resolveManagedTemplateAction(entry, recordedManagedHashes);
+      }
+
       const read = await readFileOrStatus(
         entry.targetPath,
         Buffer.isBuffer(entry.renderedContent) ? null : 'utf8',

package/src/core/executionContracts.js

@@ -207,10 +207,16 @@ const VERIFICATION_GOAL = /(?:^|\n)[ \t*#_-]*(?:muc tieu|goal|purpose|objective)
 const CONDITIONAL_BRANCH = /(?:^|\n|\.\s+)[ \t]*(?:\d+[.)]\s*)?(?:neu\s+(?:phat hien\s+(?:false-block|loi|bug|defect)|co\s+(?:source fix|sua doi))|if\s+(?:(?:a\s+)?(?:bug|defect|failure)\s+is\s+found|(?:you\s+)?find\s+(?:a\s+)?(?:bug|defect)))\b[^\n]*?(?=\.\s+|$|\n)/g;
 const GOAL_LABEL = /\b(?:muc tieu|goal|purpose|objective)\s*:/g;
 const DISPOSABLE_SETUP = /\b(?:tao|create)\s+(?:mot\s+)?(?:project|du an)\s+(?:thu nghiem|test|disposable|doc lap)\b(?:\s+(?:doc lap|independent))?/g;
+// Round-2b (FS-01 B5): a bare "no <verb>, <verb>, ..." enumeration names operations that are NOT
+// ordered ("no commit, release, publish"). The clause splitter cuts at commas, so without this the
+// tails ("release", "publish") would look like separate imperative clauses to the request-wide order
+// guard. Only a "no"-headed verb list is consumed; a real order never starts with "no". Built lazily
+// because ORDER_VERBS is declared below this function.
+const noVerbList = () => new RegExp(`\\bno\\s+(?:${ORDER_VERBS})\\b(?:\\s*,\\s*(?:${ORDER_VERBS})\\b)*`, 'g');
 function neutralizeNonOrders(text) {
   let source = String(text).replace(/```[\s\S]*?```/g, ' ').replace(/^[ \t]*>.*$/gm, ' ');
   if (VERIFICATION_GOAL.test(source)) source = source.replace(GOAL_LABEL, ' ').replace(CONDITIONAL_BRANCH, '\n').replace(DISPOSABLE_SETUP, ' ');
-  return source
+  return source.replace(noVerbList(), ' ')
     // A list item that DESCRIBES test cases ("Negative controls: yêu cầu thực sự chỉnh config/restart/deploy ...") is
     // specification of the work, not an order; it runs to the next bullet or blank line.
     .replace(/^[ \t]*(?:[-*+\u2022]|\d+[.)])[ \t]*(?:negative|positive)\s+controls?\b[^\n]*(?:\n(?![ \t]*(?:[-*+\u2022]|\d+[.)])|[ \t]*\n)[^\n]*)*/gm, ' ')
@@ -225,8 +231,26 @@ function neutralizeNonOrders(text) {
     .replace(/[^.;\n]*\b(?:nao|gi|sao|the nao|bao nhieu)\b[^.;\n]*\?/g, ' ')
     .replace(/\bchinh\s+(?:xac|sach)\b|\b(?:phuong an|cach|de xuat|ban)\s+(?:sua|fix)\b|\b(?:diem|cho|muc|phan)\s+(?:phai|can|nen)\s+(?:sua|fix)\b/g, ' ')
     .replace(/\bwrite\s*\/\s*verification\b|\bverification\s*\/\s*write\b|\bwrite\s+(?:or|and)\s+verification\b/g, ' ')
+    .replace(/\bwrite\s+permission\b/g, 'permission')
     .replace(/\b(?:state|status)\s+changes?\b/g, ' ')
-    .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ');
+    .replace(/\b(?:proposed|suggested|recommended|minimal|each|the|an?|any|that|this|no|which|exact|smallest|possible)\s+fix(?:es)?\b/g, ' ')
+    // An output/deliverable spec ("Output: fix direction", "each: title, fix direction", "Output:
+    // fixes / fix list / acceptance to close") NAMES the artifacts the answer must contain; inside
+    // such a clause "fix" is a deliverable noun, not a mutation order, so a read-only audit with a
+    // fix-shaped deliverable list must not owe write evidence (FS-07, src twin of the FS-01 fix in
+    // route-resolver.mjs). A determiner object inside the span ("Output: fix the bug in parser.ts")
+    // stays a real order - fail closed.
+    // Round-2 (FS-01 B1-B4, src twin): a span runs through a file-extension dot ("fix items.ts"), a bare
+    // singular "fix" is an order (never a noun), and a span keeps its order unless EVERY fix token in it is a
+    // deliverable noun and no order verb / "then" remains in the clause ("fix list, commit and push").
+    .replace(/(?:^|[\n.;])[ \t]*(?:[-*+•]|\d+[.)])?[ \t]*(?:outputs?|reports?|deliverables?|each|lists?|includes?|fields?|format|sections?|columns?)(?:\s+\w+){0,3}?\s*:(?:[^\n.;]|\.(?=\w))*/g,
+      (span) => {
+        const fixNouns = /\bfix(?:es)?(?:\s+applied\b|\s+(?:directions?|lists?|plans?|suggestions?|proposals?|items?|entries?|notes?|findings?|acceptance|recommendations?)\b)(?=\s*(?:,|$))|\bfixes\b(?=\s*(?:,|$))/g;
+        const residual = span.replace(fixNouns, ' ');
+        if (residual === span) return span;
+        if (new RegExp(`\\b(?:then|${NON_ORDER_VERBS}|${ORDER_VERBS})\\b`).test(residual)) return span;
+        return residual;
+      });
 }
 
 // Explicit scope declaration (intent ownership): when the request itself declares it is read-only
@@ -236,13 +260,25 @@ function neutralizeNonOrders(text) {
 // An explicit order (imperative-initial or modal request) keeps the request MIXED/IMPLEMENTATION:
 // the declaration never overrides a real instruction, and fenced/quoted/blockquoted text is never one.
 // A bare verb with no object is the tail of a negated list ("no commit, release, publish"), not an order.
-const READ_ONLY_DECLARATION = /\bread[\s-]*only\s+(?:audit|investigation|review|analysis|inspection|task|request|session|pass|check|diagnos\w+|verification|forensics?)\b|(?:^|\n)[\s*#>_-]*read[\s-]*only\s*[.:!—-]|\b(?:audit|investigation|review|analysis)[\s-]*only\b|[(,]\s*read[\s-]*only\s*[).]|\bchi\s+(?:doc|audit|kiem tra|phan tich|dieu tra)\b|\b(?:make|with)\s+no\s+(?:source\s+|code\s+|file\s+)?(?:changes|edits|modifications)\b/;
+const READ_ONLY_DECLARATION = /\bread[\s-]*only(?:\s+\w+){0,3}?\s+(?:audit|investigation|review|analysis|inspection|inventory|task|request|session|pass|check|diagnos\w+|verification|forensics?|reports?)\b|(?:^|\n)[\s*#>_-]*read[\s-]*only\s*[.:!—-]|\b(?:audit|investigation|review|analysis|inventory)[\s-]*only\b|[(,]\s*read[\s-]*only\s*[).]|\bchi\s+(?:doc|audit|kiem tra|kiem ke|phan tich|dieu tra)\b|\bkhong\s+sua\b|\b(?:make|with)\s+no\s+(?:source\s+|code\s+|file\s+)?(?:changes|edits|modifications)\b|\b(?:do\s+not|don't|dont|never)\s+(?:\w+\s+){0,2}edits?\b/;
 const ORDER_VERBS = 'implement|fix|apply|refactor|modify|edit|write|update|add|create|build|install|deploy|redeploy|restart|push|commit|rename|remove|delete|replace|change|sua|viet|chinh|them|tao|xoa|enable|disable|set|toggle|configure|migrate|upgrade|publish|release|trien khai|khoi dong lai|(?:run|execute)\\s+(?:git\\s+(?:push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)|(?:npm|yarn)\\s+publish)|git\\s+(?:push|clean|commit|reset|rebase|merge|tag|stash|checkout|restore|cherry-pick)';
 const IMPERATIVE_ORDER = new RegExp(`^(?:[-*+\\u2022>\\d.)\\s]*)(?:(?:please|hay|vui long|now|also|first|then)\\s+)*(?:${ORDER_VERBS})\\b\\s+\\S`);
 const MODAL_ORDER = new RegExp(`\\b(?:please|hay|vui long|need to|needs to|must|should|want(?:\\s+you)? to|toi muon|can phai|yeu cau)\\s+(?:[\\w-]+\\s+){0,2}(?:${ORDER_VERBS})\\b`);
 function hasExplicitOrder(clauses) {
   return clauses.some((clause) => IMPERATIVE_ORDER.test(clause) || MODAL_ORDER.test(clause));
 }
+// Round-2b (FS-01 B5): a clause AFTER the output span still orders a change ("Output: fix lists\ncommit
+// the changes", "Output: fix lists; commit"). Order detection must be request-wide, not span-local: any
+// non-negated clause whose command position is an ORDER verb - with or without an object, so a bare
+// trailing "commit" counts - is an explicit order. The vocabulary is the order class the read-only
+// declaration must never absorb (git/publish/release/apply/run-implementation); noun-ish scaffolding
+// ("tao timeline ...", "create a list") is NOT an order and must not defeat a read-only audit.
+// Negated lists ("no commit, release, publish", "Khong npm publish, git push, release") are blanked
+// first by neutralizeNonOrders, so their bare tails never read as orders.
+const CLAUSE_ORDER_LEAD = /^(?:[-*+•>\d.)\s]*)(?:(?:please|hay|vui long|now|also|first|then)\s+)*(?:commit|push(?!\s+back\b)|publish|release(?!\s+(?:notes?|process|works?|plan|candidate|checklist)\b)|apply|(?:run|execute)\s+(?:the\s+)?(?:implementation|build|migration|deploy(?:ment)?|publish|release|script|command))\b/;
+function ordersChangeAcrossClauses(clauses) {
+  return clauses.some((clause) => CLAUSE_ORDER_LEAD.test(clause));
+}
 function declaredReadOnly(promptText, releasePolicy) {
   if (releasePolicy) return false;
   const plain = String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[đĐ]/g, 'd').toLowerCase()
@@ -251,9 +287,10 @@ function declaredReadOnly(promptText, releasePolicy) {
   const text = neutralizeNonOrders(plain);
   const clauses = text.split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/)
     .map((clause) => clause.split(/\bwithout\b/)[0])
-    .filter((clause) => !/\b(?:do not|don't|never|khong|dung)\b/.test(clause));
-  return /\b(?:audit|inspect|review|analyze|analyse|explain|read|investigate|investigation|forensic|root cause|kiem tra|phan tich|dieu tra|doc log|tim hieu)\b/.test(text)
-    && !hasExplicitOrder(clauses);
+    .filter((clause) => !/\b(?:do not|don't|never|khong)\b|^[\s*+•>\d.)-]*(?:(?:vui long|xin|hay|please)\s+)*dung\b/.test(clause));
+  return /\b(?:audit|inspect|review|analyze|analyse|explain|read|investigate|investigation|inventory|forensic|root cause|kiem tra|kiem ke|phan tich|dieu tra|doc log|tim hieu)\b/.test(text)
+    && !hasExplicitOrder(clauses)
+    && !ordersChangeAcrossClauses(clauses);
 }
 
 // Verification-only request. Root cause of a false `write-evidence` block on a "verify / re-run /
@@ -297,7 +334,8 @@ export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {})
     ? { kind: 'conditional-release', preflight } : null;
   const text = neutralizeBannedLists(neutralizeNonOrders(String(promptText).normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[đĐ]/g, 'd').toLowerCase()));
   const clauses = text.split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/);
-  const actionable = clauses.map((clause) => clause.split(/\bwithout\b/)[0]).filter((clause) => !/\b(?:do not|don't|never|khong|dung)\b/.test(clause)
+  // Folded đúng (correctly) is also "dung"; only command-position đừng negates an order.
+  const actionable = clauses.map((clause) => clause.split(/\bwithout\b/)[0]).filter((clause) => !/\b(?:do not|don't|never|khong)\b|^[\s*+•>\d.)-]*(?:(?:vui long|xin|hay|please)\s+)*dung\b/.test(clause)
     && !/^[\s*+•>\d.)-]*(?:audit|inspect|review|analyze|analyse|explain|read|kiem tra|phan tich)\b/.test(clause));
   if (declaredReadOnly(promptText, releasePolicy)) return { taskKind: 'READ_ONLY' };
   const sourceOrder = actionable.some((clause) => /\b(?:implement|fix(?:es)?|apply|refactor|modify|edit|write|update|sua|viet|chinh)\b/.test(clause)
@@ -397,8 +435,11 @@ export function classifyTaskSemantics({ promptText = '', targetFile = '' } = {})
   const statusReport = (configReportQuestion || (!mutationWord
       && /\b(?:check|status|report|show|summari[sz]e|result|results|kiem tra|bao cao|trang thai|ket qua|da len chua)\b/.test(text)))
     && !operation && !config;
+  // Round-2b (FS-01 B5): order detection is request-wide. A later clause that commands an order verb
+  // ("Output: fix lists\ncommit the changes", "...; publish") keeps the mutation even when the output
+  // span itself was neutralised to deliverable nouns; a true noun-only audit output stays read-only.
   const readOnly = (/\b(?:audit|inspect|review|analyze|analyse|explain|read|investigate|debug|forensic|root cause|kiem tra|phan tich|dieu tra|doc log|tim hieu)\b/.test(text.replace(/\bread[\s-]*only\b/g, ' ')) || statusReport)
-    && !sourceOrder && !codeChangeVerb && !operation && !config;
+    && !sourceOrder && !codeChangeVerb && !operation && !config && !ordersChangeAcrossClauses(actionable);
   const taskKind = operation ? (sourceOrder || (nativeDomain !== 'scheduled-job' && codeChangeVerb) ? 'MIXED' : 'OPERATIONAL')
     : config ? 'CONFIGURATION' : documentation ? 'DOCUMENTATION_OUTPUT' : readOnly ? 'READ_ONLY' : 'CODE_IMPLEMENTATION';
   const id = text.match(/\b[a-f0-9]{8}(?:[a-f0-9-]{0,28})\b/)?.[0] || null;

package/src/core/metadata.js

@@ -1,4 +1,6 @@
 import path from 'node:path';
+import fs from 'node:fs/promises';
+import { createHash } from 'node:crypto';
 import { ensureDir, writeJson, readJsonIfExists, withFileLock } from './fileOps.js';
 
 // FR-015 (W2-C2): install.json is the project's install ledger — a corrupt
@@ -70,6 +72,8 @@ export async function writeInstallMetadata({
   retainedManagedRelativePaths = [],
   ompConfigOwnership = null,
   settingsDefaultsMigration = null,
+  managedHashes = null,
+  sidecarHashes = null,
   lockStaleMs,
   lockMaxWaitMs,
 }) {
@@ -121,6 +125,17 @@ export async function writeInstallMetadata({
       return !newPaths.has(p);
     });
     const allFiles = [...retained, ...newEntries];
+    // CR-13: optional content hash (`h`) for managed templates; absent = legacy entry.
+    const hashEntries = Object.entries(managedHashes ?? {});
+    if (hashEntries.length > 0) {
+      const normalized = allFiles.map((e) => (typeof e === 'string' ? { p: e, t: 'config' } : e));
+      for (const [p, h] of hashEntries) {
+        const found = normalized.find((e) => normalizeTrackedRelativePath(e.p) === p);
+        if (found) found.h = h;
+        else normalized.push({ p, t: 'config', h });
+      }
+      allFiles.splice(0, allFiles.length, ...normalized);
+    }
 
     const metadata = {
       tool: 'ukit',
@@ -143,6 +158,36 @@ export async function writeInstallMetadata({
     const migrationMarker = settingsDefaultsMigration ?? (previousData?.tool === 'ukit' ? previousData.settingsDefaultsMigration : null);
     if (migrationMarker) metadata.settingsDefaultsMigration = migrationMarker;
 
+    // CR-13 provenance for `.ukit-new` sidecars. Only hashes recorded for a sidecar
+    // UKit actually created this run are kept; every other recorded sidecar is
+    // re-verified against disk so a record never outlives (or claims) owner content.
+    // A sidecar whose bytes changed is dropped — it is owner-modified from then on.
+    const previousSidecars = previousData?.tool === 'ukit' && previousData.sidecars && typeof previousData.sidecars === 'object'
+      ? previousData.sidecars
+      : {};
+    const mergedSidecars = { ...previousSidecars };
+    for (const [relPath, hash] of Object.entries(sidecarHashes ?? {})) {
+      if (typeof hash === 'string') mergedSidecars[normalizeTrackedRelativePath(relPath)] = hash;
+    }
+    const verifiedSidecars = {};
+    if (projectRoot) {
+      for (const [relPath, hash] of Object.entries(mergedSidecars)) {
+        if (typeof hash !== 'string' || !relPath) continue;
+        const absPath = path.join(projectRoot, relPath);
+        try {
+          const stat = await fs.lstat(absPath);
+          if (stat.isSymbolicLink() || !stat.isFile()) continue;
+          const current = await fs.readFile(absPath);
+          if (createHash('sha256').update(current).digest('hex') === hash) {
+            verifiedSidecars[relPath] = hash;
+          }
+        } catch {
+          // vanished/unreadable — forget the record
+        }
+      }
+    }
+    if (Object.keys(verifiedSidecars).length > 0) metadata.sidecars = verifiedSidecars;
+
     await ensureDir(path.dirname(installMetaPath));
     await writeJson(installMetaPath, metadata);
     return 'written';

package/src/core/runInstallPipeline.js

@@ -442,13 +442,26 @@ export async function runInstallPipeline({
   const trackedSettings = (Array.isArray(installMetaData?.files) ? installMetaData.files : [])
     .some((e) => (typeof e === 'string' ? e : e?.p) === '.claude/settings.json');
   const settingsMigration = { pending: trackedSettings && !installMetaData?.settingsDefaultsMigration };
-  const diffResults = await diffInstallPlan(plan, { ompOwnership, settingsMigration });
+  const recordedManagedHashes = new Map(
+    (Array.isArray(installMetaData?.files) ? installMetaData.files : [])
+      .filter((e) => e && typeof e === 'object' && typeof e.h === 'string')
+      .map((e) => [path.join(pathConfig.projectRoot, e.p), e.h]),
+  );
+  // CR-13 provenance: sha256 of each `.ukit-new` sidecar UKit itself wrote.
+  // Absent record = the file is not UKit's; never overwrite or remove it.
+  const recordedSidecarHashes = new Map(
+    Object.entries(installMetaData?.sidecars ?? {})
+      .filter(([p, h]) => typeof p === 'string' && typeof h === 'string')
+      .map(([p, h]) => [path.join(pathConfig.projectRoot, p), h]),
+  );
+  const diffResults = await diffInstallPlan(plan, { ompOwnership, settingsMigration, recordedManagedHashes });
   const plannedSummary = summarizeDiff(diffResults);
 
   if (!dryRun) {
-    const { writes, skippedUpdates, skippedByAction } = await applyDiffResults(diffResults, {
+    const { writes, skippedUpdates, skippedByAction, sidecarHashes } = await applyDiffResults(diffResults, {
       backupRoot: pathConfig.backupRoot,
       projectRoot: pathConfig.projectRoot,
+      recordedSidecarHashes,
     });
 
     for (const entry of diffResults) {
@@ -550,8 +563,23 @@ export async function runInstallPipeline({
     // adjusted counts never go negative.
     const summary = adjustSummaryForSkips(plannedSummary, skippedByAction, skippedUpdates);
 
+    const managedHashes = Object.fromEntries(
+      diffResults
+        .filter((e) => e.managedHash && ['create', 'update', 'unchanged'].includes(e.action))
+        .map((e) => [path.relative(pathConfig.projectRoot, e.targetPath).split(path.sep).join('/'), e.managedHash]),
+    );
+    // Sidecar provenance map (relative path → sha256 UKit wrote this run). Written
+    // only after apply succeeded, so a failed create never claims ownership.
+    const sidecarRecords = Object.fromEntries(
+      Object.entries(sidecarHashes).map(([absPath, h]) => [
+        path.relative(pathConfig.projectRoot, absPath).split(path.sep).join('/'),
+        h,
+      ]),
+    );
     await writeInstallMetadata({
       installMetaPath: pathConfig.installMetaPath,
+      managedHashes,
+      sidecarHashes: sidecarRecords,
       packageVersion,
       manifest,
       stackContext,