@ngockhoale/ukit 3.4.67 → 3.4.69

package/template_project/.claude/commands/ukit/handoff-implement.md

@@ -64,7 +64,10 @@ ones and run those instead. A stuck record that cannot resume (orphaned worktree
 contradicting reports) gets the recovery treatment: mark it `cancelled_superseded`, create
 `TASK-xxx-R1` with the same spec references/acceptance/verification, and run the
 replacement — never leave stranded work just because a record was pending.
-Only if nothing is actionable → report and stop.
+Only if nothing is actionable → report and stop, naming the gate: when INDEX has
+`needs_breakdown` tasks while PLAN.md lacks `PLAN_REVIEW: Approved`, report exactly
+`tasks not ready: <gate> -> run /ukit:handoff-create resume gates` — implementation does
+not re-plan and does not run the gates itself; the create command owns that resume path.
 
 Verify working tree state:
 ```bash
@@ -120,11 +123,20 @@ wave, never reorders it across waves.
 
 For each wave (and for each batch within it):
 
-### 3a — Create worktrees (from `$BASE`, no extra branch)
+### 3a — Create worktrees (from the `Base:` branch recorded in ACTIVE.md, no extra branch)
+For `Worktree-Policy: existing-only`, never use the raw command below or Agent isolation.
+An explicit owner exception is one RUN.md line per frozen task:
+`Worktree-Allow: TASK-003 handoff/task-003 .worktrees/task-003 owner-20261025`.
+Allocate only through `node .claude/ukit/index/allocate-task-worktree.mjs <absolute-project-root> TASK-003`.
+It records task/branch/path/current claim and immutable HEAD before allocation under the claims lock.
+An existing intent/path/branch refuses another allocation; inspect and resume the exact retained task,
+never repurpose or delete it. This exception does not authorize reviewer/investigator trees or cleanup.
+Other runs use the normal command:
 ```bash
-git worktree add -b handoff/task-xxx .worktrees/task-xxx $BASE
-# (omit -b if branch already exists)
+git worktree add -b handoff/task-xxx .worktrees/task-xxx <base-branch>
 ```
+(Omit `-b` when the branch already exists. One simple command per worktree — no variable,
+no compound; `<base-branch>` is the literal branch name read from ACTIVE.md.)
 
 ### 3b — Run tasks in parallel (one agent/session per task)
 
@@ -140,12 +152,12 @@ the task file is the slice. If they disagree, implement the spec and note it in
 
 TDD — mandatory:
   1. Write tests from §Test Cases
-     cd .worktrees/task-xxx && <test command>
+     run <test command> from the worktree root (your cwd IS .worktrees/task-xxx — no cd)
      Confirm RED — paste the actual failing output, don't just assert it happened
      (immediately GREEN → test is wrong — flag this)
   2. Implement → run → confirm GREEN
   3. Run §Verification Commands inside the worktree:
-     cd .worktrees/task-xxx && <each verification command>
+     run <each verification command> from the worktree root — no cd, no compound
      Paste full output.
 
 DO NOT run: git add, git commit, git push — leave files as-is in worktree.
@@ -180,7 +192,8 @@ second time is what blows up the orchestrator's context window and kills the run
 ### 3c — Orchestrator: land each task's work (task-scoped, receipt-backed)
 
 Landing uses the shared helper, never an ad-hoc cp loop. `land-worktree.mjs` snapshots
-the source worktree's FINAL content relative to the immutable `$BASE` — committed
+the source worktree's FINAL content relative to the immutable `<base-branch>` head (the
+`Base:` branch recorded in ACTIVE.md) — committed
 milestone, staged, unstaged and nonignored untracked changes, with deletions, rename
 origins and binary / executable / symlink semantics — and applies that exact delta to the
 destination. It refuses (exit 2, no mutation, no receipt) on a dirty destination, a
@@ -189,37 +202,59 @@ target-path untracked collision, an out-of-scope change or identity drift.
 For each task that reported back:
 
 **PASS + EXECUTOR_MODEL present:**
-```bash
-TASK="TASK-xxx"
-WORKTREE=".worktrees/task-xxx"
-
-# Scope file: exact task-approved target paths (both rename endpoints). Written
-# outside the source worktree AND outside the target set.
-cat > ".worktrees/$TASK-scope.json" <<JSON
-{
-  "schemaVersion": 1,
-  "taskId": "$TASK",
-  "baseCommit": "$BASE",
-  "sourceRoot": "$(git -C "$WORKTREE" rev-parse --show-toplevel)",
-  "destinationRoot": "$(git rev-parse --show-toplevel)",
-  "sourceHead": "$(git -C "$WORKTREE" rev-parse HEAD)",
-  "destinationHead": "$(git rev-parse HEAD)",
-  "targetPaths": ["<each approved path>"]
-}
-JSON
-
-node .claude/ukit/index/land-worktree.mjs \
-  --scope ".worktrees/$TASK-scope.json" \
-  --receipt "docs/AI_HANDOFF/benchmark/$TASK-landing.json"
-# exit 0 → landed; exit 2 → refused (untouched); exit 1 → apply/receipt failure.
-# After each exit-0 landing, checkpoint-commit the landed paths (receipt stays outside the target set)
-# BEFORE landing the next task: the helper refuses a destination with tracked modifications
-# (destination-dirty), so uncommitted landed work would block every later task in the wave.
-git add -- <landed paths>
-git commit --only -m "checkpoint: $TASK landed" -- <landed paths>
-
-# update INDEX.md: status → pending_review
-```
+
+1. Write the scope file with the **Write tool** (never a shell heredoc, no variable) to
+   `docs/AI_HANDOFF/benchmark/TASK-xxx-scope.json` — every field a literal. Get each value with ONE simple
+   command and paste the printed output: `git rev-parse <base-branch>` (baseCommit),
+   `git -C .worktrees/task-xxx rev-parse --show-toplevel` (sourceRoot),
+   `git rev-parse --show-toplevel` (destinationRoot),
+   `git -C .worktrees/task-xxx rev-parse HEAD` (sourceHead), `git rev-parse HEAD`
+   (destinationHead).
+   ```json
+   {
+     "schemaVersion": 1,
+     "taskId": "TASK-xxx",
+     "baseCommit": "<base-branch head sha>",
+     "sourceRoot": "<absolute worktree root>",
+     "destinationRoot": "<absolute project root>",
+     "sourceHead": "<worktree HEAD sha>",
+     "destinationHead": "<project HEAD sha>",
+     "targetPaths": ["<each approved path>"]
+   }
+   ```
+   Scope file: exact task-approved target paths (both rename endpoints); written outside
+   the source worktree AND outside the target set. This is coordinator metadata,
+   not task implementation: keep it in the docs benchmark directory so the main-session
+   ownership guard remains intact.
+2. Land with ONE simple command, literal paths:
+   `node .claude/ukit/index/land-worktree.mjs --scope docs/AI_HANDOFF/benchmark/TASK-xxx-scope.json --receipt docs/AI_HANDOFF/benchmark/TASK-xxx-landing.json`
+   — exit 0 → landed; exit 2 → refused (untouched); exit 1 → apply/receipt failure. Landing is self-fencing: it reads the destination claims store under the claims lock held through apply+receipt, and exits 2 `worker-not-terminated` while any delegated worker claim for the task remains (handback must release it; lease expiry does not), or `claims-unreadable`/`claims-busy` (fail closed). Never fabricate a claim or receipt to pass.
+3. After each exit-0 landing, checkpoint-commit the landed paths (receipt stays outside
+   the target set) BEFORE landing the next task: the helper refuses a destination with
+   tracked modifications (destination-dirty), so uncommitted landed work would block every
+   later task in the wave.
+   ```bash
+   git add -- <landed paths>
+   git commit --only -m "checkpoint: TASK-xxx landed" -- <landed paths>
+   ```
+4. Update INDEX.md: status → pending_review (the orchestrator writes it; agents never do).
+
+**Already-applied / divergent-history recovery (separate from normal landing):**
+Use `--adopt-applied` only when the complete scoped source snapshot equals destination
+blob+mode. If preserved task-record history differs, do not repeat known-failing adoption,
+copy metadata, omit scope, or fabricate a landed receipt. With explicit owner authorization,
+use `--reconcile-metadata <proof-json> --preflight --scope <scope-json> --receipt <new-json>`
+for every affected full scope before applying the same command without `--preflight`.
+File evidence must be hash-pinned and colocated with the proof in its audit directory;
+hashes establish bytes, not semantic provenance: independently review that provenance.
+A receipt with `receiptKind: metadata-reconciliation`, `status: reconciled`,
+`completion:false`, `cleanupEligible:false` resolves only its verified integration-history
+debt. Verify its HEAD/snapshot/scope identities still match; retain blocked status until
+current-source independent review and the missing verification gates justify progression.
+Continue those gates on the destination source, not another byte-identical adoption attempt.
+This receipt is NEVER a normal landing, automatic pending_review/done transition, acceptance,
+cleanup authorization or archive/completion authority; those retain their separate gates.
+Preserve source worktrees and both histories, and obey any owner prohibition on cleanup.
 
 **FAIL:**
 ```bash
@@ -267,7 +302,7 @@ already on disk (task files hold the full logs, git holds the code). Do all four
    `/compact` here. If the session ends regardless, `RUN.md` plus the `SessionStart` resume
    hook bring the run back to exactly this point.
 
-Then create the next wave's worktrees from `$BASE` and repeat 3a–3c.
+Then create the next wave's worktrees from the recorded `Base:` branch and repeat 3a–3c.
 
 ## Step 4 — Finalize: verify cleanup
 
@@ -286,7 +321,7 @@ snapshot, unmerged history. Unexplained leftovers fail the gate; nothing is remo
 An eligible task is retired only through the shared, receipt-gated helper
 (`node .claude/ukit/index/cleanup-task-worktree.mjs --receipt <json> --approval <json> --apply`).
 
-All changes are committed as **one commit per wave on `$BASE`**, nothing pushed. Worktrees and
+All changes are committed as **one commit per wave on the recorded `Base:` branch**, nothing pushed. Worktrees and
 branches are retired only through the receipt-gated helper; any that remain are named in the
 retained-reason report. Set `Phase: done` in `docs/AI_HANDOFF/RUN.md` only when no task is
 still open.

package/template_project/.claude/commands/ukit/handoff-review.md

@@ -24,8 +24,8 @@ The human is not watching.
 loop (Step 3). Escalate only for a blocker outside the repo, or a task still failing after
 both fix rounds, and even then finish everything else first.
 
-Never pause mid-review to ask for `/compact`. Reviewer agents return ≤6 lines and write the
-full verdict to disk; a compaction request belongs at the end of the command, never inside it.
+Never pause mid-review to ask for `/compact`. Reviewer agents return bounded verdict blocks
+for the orchestrator to persist with `Edit`; a compaction request belongs at the end, never inside.
 
 Maintain `docs/AI_HANDOFF/RUN.md` (`Command: handoff-review`, `Phase:`, `Cursor:`, `Next:`)
 after every step. If it already exists with `Phase:` not `done`, this is a **continuation**:
@@ -55,7 +55,7 @@ Classify by what the diff can show. An empty diff is NOT automatically "implemen
 
 **Batch the review set — mandatory.** Read `handoff.maxParallelAgents` from `.ukit/storage/config.json`. If more `pending_review` tasks exist than that, split into consecutive batches of at most that many; finish one batch's verdicts (2a–2d, appended to each task file) before starting the next. The cap counts child workers of ONE batch/review set, summed across roles (implementers and reviewers together); the main session is outside it, and it is not a session-wide limit. It is prompt-level guidance: no hook counts children, and the host's own concurrency limit is separate.
 
-**Spawn the review panel — MANDATORY, do this before anything else:** read `modelRoles['review-panel']` from `.ukit/storage/config.json` → `modelRoles` (default `['smart','code','lite']`; omp tier aliases `@smol`/`@default`/`@slow`). For each `pending_review` task in the batch, call the Agent tool **once per panel entry** (in parallel, bounded by `handoff.maxParallelAgents`), each with `subagent_type: "code-reviewer"` (omp: the `task` tool with `agent: "code-reviewer"`, likewise invoked once per panel entry per task) — each member bound to its panel tier and setting `PANEL_MEMBER: <tier>` in its verdict. Reviewer agents only read the diff and append a verdict to their own task file — no worktree, no shared write target — so running them in parallel carries none of Phase 3's file-conflict risk. Do NOT review the diff yourself in the current session — this step is contracted to the panel tiers and MUST differ from the executor's model, which only the spawned agent's frontmatter model guarantees. Pass each agent: the task file path, the executor's report, and the diff.
+**Spawn the review panel — MANDATORY, do this before anything else:** read `modelRoles['review-panel']` from `.ukit/storage/config.json` → `modelRoles` (default `['smart','code','lite']`; omp tier aliases `@smol`/`@default`/`@slow`). For each `pending_review` task in the batch, call the Agent tool **once per panel entry** (in parallel, bounded by `handoff.maxParallelAgents`), each with `subagent_type: "code-reviewer"` (omp: the `task` tool with `agent: "code-reviewer"`, likewise invoked once per panel entry per task) — each member bound to its panel tier and setting `PANEL_MEMBER: <tier>` in its verdict. Reviewers return the complete verdict block (≤30 lines), without shell writes; the orchestrator appends it with `Edit` to the task file, preserving prior rounds, before aggregation or status updates. No reviewer writes INDEX or task files; serial persistence avoids shared-write races. Do NOT review the diff yourself in the current session — this step is contracted to the panel tiers and MUST differ from the executor's model, which only the spawned agent's frontmatter model guarantees. Pass each agent: the task file path, the executor's report, and the diff.
 
 Degenerate panel: if `modelRoles['review-panel']` is empty or has one entry, spawn a single reviewer and require `PANEL_MEMBER: solo` in its verdict.
 
@@ -65,10 +65,10 @@ Degenerate panel: if `modelRoles['review-panel']` is empty or has one entry, spa
 tasks:
   - agent: "code-reviewer"
     name: "TASK-001-smart"
-    task: "Review docs/AI_HANDOFF/tasks/TASK-001.md per /ukit:handoff-review Step 2a-2d. PANEL_MEMBER: smart. Return at most 6 lines."
+    task: "Review docs/AI_HANDOFF/tasks/TASK-001.md per /ukit:handoff-review Step 2a-2d. PANEL_MEMBER: smart. Return the complete bounded verdict block; no file writes."
   - agent: "code-reviewer"
     name: "TASK-001-code"
-    task: "Review docs/AI_HANDOFF/tasks/TASK-001.md per /ukit:handoff-review Step 2a-2d. PANEL_MEMBER: code. Return at most 6 lines."
+    task: "Review docs/AI_HANDOFF/tasks/TASK-001.md per /ukit:handoff-review Step 2a-2d. PANEL_MEMBER: code. Return the complete bounded verdict block; no file writes."
 ```
 
 Never add fields ordinary dispatch does not support: `sourceSession` and a per-task `model` are not supported there — omp 18.12.5 batch validation rejects them deterministically (confirmed in the installed binary's validator; not advertised as a live-probe pass) — and model binding comes from agent frontmatter via `modelRoles`, never from a task field. There is no seance workaround for reviewer dispatch. A deterministic validation rejection is never retried with identical args. A retry is allowed only after a relevant argument changes — `agent`, or the `tasks[]` entry's unsupported-field set (removing `sourceSession`/`model`). Prompt reword, `read`, and `status` text are NOT relevant changes: they never make a retry legitimate and never reset the failure budget, which stays the existing `maxAttemptsPerFailure: 2`. When that budget is spent, preserve across resume — in the task's `## Discussion` or the `RUN.md` cursor — a compact normalized error (prose stripped) plus the relevant key fingerprint and the attempt count, mark that task's verification `NOT_RUN` (never `PASS` — unverified work is not verified), and continue with independent tasks. Host pre-hook rejection behavior is unknown: never assume a hook will or will not catch the same call.
@@ -118,6 +118,10 @@ EXECUTOR_MODEL: <from Executor Report>
 REVIEW_KIND: product | integration-evidence | status-only
 PANEL_MEMBER: <panel tier | solo | ->
 VERIFICATION_RERUN: PASS | FAIL | NOT_RUN | N/A
+  command: <exact command, or ->
+  result: <actual pass/fail counts or NOT_RUN/N/A with reason>
+TEST_PLAN_COVERAGE: all-followed | partial — <gaps> | missing — <gaps>
+NOTES: <acceptance limitations, or none>
 FINDINGS:
   critical: <file:line — what fails> | none
   important: <file:line — risk> | none
@@ -127,7 +131,7 @@ NEXT_STATUS_FOR_INDEX: approved | approved_minor | changes_requested | critical_
 
 `VERDICT:` uses the aggregator's canonical hyphen vocabulary — underscore spellings (`changes_requested`, `critical_block`, `approved_with_minor`) parse to the same verdicts, so a blocking reviewer is never dropped as unparsed. `NOT_RUN` = the required re-run never executed in your session; `FAIL` = it executed and failed; either blocks approval. `N/A` is legitimate only when this review has no executable required checks (`command: -` or none) — an `N/A` beside a declared executable `command:` counts as `NOT_RUN`. `REVIEW_KIND` comes from the Step 1 classification; it scopes only the implementation-TDD evidence (new tests + RED_OUTPUT) — required executable checks and the task's original acceptance criteria are never waived, and approving an evidence review never marks product acceptance met.
 
-Then return to the orchestrator **at most 6 lines** — the full verdict is already on disk:
+Return this routing header followed by the complete verdict block above; the orchestrator persists the block with `Edit` before reading it back and advancing 2e:
 ```
 TASK: TASK-xxx
 VERDICT: approved | approved_minor | changes_requested | critical_block
@@ -136,11 +140,11 @@ VERIFICATION_RERUN: PASS | FAIL | NOT_RUN | N/A (+ one-line reason)
 BLOCKING: <one line per critical/important finding, or "none">
 ```
 The return `VERDICT:` carries the NEXT_STATUS_FOR_INDEX vocabulary; the on-disk block's `VERDICT:` field uses the canonical hyphen vocabulary above.
-Do not paste the diff, the findings prose, or verification logs back into the orchestrator.
+Return actionable findings inside the bounded block, not the diff or raw verification logs.
 
 ### 2e — Aggregate the panel + lead bucketing
 
-Once every panel member for a task has appended its `## Reviewer Verdict`, run:
+Once the orchestrator has serially appended and read back every panel member's returned `## Reviewer Verdict`, run:
 
 ```bash
 node .claude/ukit/index/review-panel-aggregate.mjs docs/AI_HANDOFF/tasks/TASK-xxx.md
@@ -165,8 +169,8 @@ parseable blocks fail closed to `changes_requested`.
 
 Then the **lead member** (first entry in `modelRoles['review-panel']` = the judgment
 tier) applies the lead-judgment buckets to every finding — **Act on** / **Consider** /
-**Noted** / **Dismissed** — and appends a `## Panel Consensus` block to the task file
-carrying the Agreement Map and the bucketed findings. `Act on` findings feed Step 3's
+**Noted** / **Dismissed** — and returns a `## Panel Consensus` block carrying the
+Agreement Map and bucketed findings; the orchestrator appends it with `Edit` to the task file. `Act on` findings feed Step 3's
 auto-fix loop; `Consider`/`Noted`/`Dismissed` are advisory. A high-signal finding must
 not be bucketed below `Consider` without a stated reason.
 

package/template_project/.claude/hooks/auto-allow-bash.sh

@@ -111,12 +111,49 @@ if [[ "$BIN_BASENAME" =~ ^(rm|sudo|dd|mkfs|shutdown|reboot|halt|poweroff|chown|k
   exit 0
 fi
 
-# W2-D02: wrapper executables launch an arbitrary operand (a command string or
-# another binary), so minting Bash(<wrapper>:*) allows anything they can run.
-# They are NOT in the token-skip list above: skipping would resolve BIN to the
-# operand token (`timeout 30 ls` → BIN=30, `ssh host ls` → BIN=host) and mint a
-# nonsense wildcard rule. Deny outright and fall back to the permission prompt.
-if [[ "$BIN_BASENAME" =~ ^(eval|nice|timeout|xargs|ssh|su|chroot|docker|sudo|doas|watch|stdbuf|noglob)$ ]]; then
+# UKIT:AUTO-ALLOW:DENYLIST:BEGIN v1
+# Single source of truth for basenames that must never be auto-minted as
+# Bash(<token>:*) allow rules. reset-auto-permissions.mjs --sanitize parses
+# these three assignments out of this block (between the BEGIN/END markers),
+# so the hook and the sanitizer share ONE definition and cannot drift. Tokens
+# are matched as whole words against the BASENAME, so `./cd` / `/bin/cd` are
+# denied exactly like `cd`.
+#
+#   UKIT_DENY_SHELL_CONSTRUCT — shell reserved words, control constructs and
+#                               compound openers (`{`, `}`, `[[`, `]]`, `!` are
+#                               already rejected by the BIN charset check
+#                               above; they are listed so the contract
+#                               survives a charset widening), plus the
+#                               `builtin` executor, which wraps ANY builtin
+#                               (eval/source included).
+#   UKIT_DENY_STATE_BUILTIN   — builtins that only mutate shell state or the
+#                               shell's own process/context (cd included —
+#                               it resolves nothing runnable). Ordinary
+#                               builtin NAME twins that are real binaries
+#                               (/usr/bin/test, /bin/echo, /usr/bin/printf,
+#                               /bin/pwd) are deliberately NOT listed — they
+#                               keep minting.
+#   UKIT_DENY_WRAPPER         — executables that launch an arbitrary operand
+#                               (W2-D02). They are NOT in the token-skip list
+#                               above: skipping would resolve BIN to the
+#                               operand token (`timeout 30 ls` → BIN=30,
+#                               `ssh host ls` → BIN=host) and mint a nonsense
+#                               wildcard rule.
+#
+# `time` is deliberately NOT denylisted: it stays in the token-skip list
+# above so `time ls` keeps resolving to the real operand binary (`ls`).
+# Denial is fail-open: the command falls back to the normal permission
+# prompt (exit 0, nothing minted).
+UKIT_DENY_SHELL_CONSTRUCT='for while until if then else elif fi do done case esac select function coproc { } [[ ]] ! builtin'
+UKIT_DENY_STATE_BUILTIN='cd pushd popd source . exec export set unset alias trap declare typeset local readonly let shopt umask ulimit wait return exit shift break continue'
+UKIT_DENY_WRAPPER='eval nice timeout xargs ssh su chroot docker sudo doas watch stdbuf noglob'
+# UKIT:AUTO-ALLOW:DENYLIST:END
+
+# Exact whole-word match on the basename (quoted token, space-padded on both
+# sides) — deny outright, nothing is minted.
+if [[ " $UKIT_DENY_SHELL_CONSTRUCT " == *" "$BIN_BASENAME" "* ]] \
+  || [[ " $UKIT_DENY_STATE_BUILTIN " == *" "$BIN_BASENAME" "* ]] \
+  || [[ " $UKIT_DENY_WRAPPER " == *" "$BIN_BASENAME" "* ]]; then
   exit 0
 fi
 
@@ -228,18 +265,39 @@ async function applyMutation() {
 
   const allow = settings.permissions.allow;
   let settingsChanged = false;
+  let usageChanged = false;
 
+  let added = false;
   if (!allow.includes(rule)) {
     allow.push(rule);
     settingsChanged = true;
+    added = true;
     await appendAudit("auto_add", { rule });
   }
 
-  const prevMeta = usage.managedRules[rule] || {};
-  usage.managedRules[rule] = {
-    firstSeen: prevMeta.firstSeen || nowUtc,
-    lastSeen: nowUtc,
-  };
+  // LA-02: provenance is recorded ONLY when the hook itself added the rule. A
+  // rule that already existed in settings.local.json is user-authored —
+  // writing a managedRules record for it falsely attributed an owner rule to
+  // UKit (reset/sanitizer would then delete it). Already-managed rules keep
+  // their lastSeen fresh for TTL pruning, and legacy records (no `added`
+  // flag) are never laundered into proven ones by mere usage.
+  const prevMeta = usage.managedRules[rule];
+  if (added) {
+    usage.managedRules[rule] = {
+      firstSeen:
+        prevMeta && typeof prevMeta === "object" && prevMeta.firstSeen
+          ? prevMeta.firstSeen
+          : nowUtc,
+      lastSeen: nowUtc,
+      added: true,
+      addedBy: "auto-allow-bash/prov2",
+    };
+    usageChanged = true;
+  } else if (prevMeta && typeof prevMeta === "object" && prevMeta.lastSeen !== nowUtc) {
+    usage.managedRules[rule] = { ...prevMeta, lastSeen: nowUtc };
+    usageChanged = true;
+  }
+  // else: the rule pre-existed with no managed record — leave it unrecorded.
 
   const managedSorted = Object.entries(usage.managedRules).sort((a, b) => {
     const ta = Date.parse(a[1]?.lastSeen || "") || 0;
@@ -251,6 +309,7 @@ async function applyMutation() {
     const evict = managedSorted.slice(maxRules);
     for (const [evictRule] of evict) {
       delete usage.managedRules[evictRule];
+      usageChanged = true;
       const idx = allow.indexOf(evictRule);
       if (idx !== -1) {
         allow.splice(idx, 1);
@@ -263,7 +322,9 @@ async function applyMutation() {
   if (settingsChanged) {
     await writeJsonAtomic(settingsPath, settings);
   }
-  await writeJsonAtomic(usagePath, usage);
+  if (usageChanged) {
+    await writeJsonAtomic(usagePath, usage);
+  }
 }
 
 (async () => {

package/template_project/.claude/hooks/auto-prune-bash.sh

@@ -227,4 +227,14 @@ async function pruneMutation() {
 });
 ' "$SETTINGS_LOCAL" "$USAGE_FILE" "$AUDIT_FILE" "$TTL_DAYS" "$NOW_UTC" 2>/dev/null || true
 
+# LA-02: remove denylisted auto-minted rules (cd/for/while/...) that earlier UKit
+# versions wrote. The sanitizer removes ONLY rules with proven UKit provenance
+# (managedRules added:true or an audit auto_add event) AND a token in the shared
+# auto-allow denylist; owner-authored and unproven rules stay. It takes the same
+# usage lock, fails closed, and never blocks the session (exit 0 regardless).
+SANITIZER="$SCRIPT_DIR/../ukit/index/reset-auto-permissions.mjs"
+if [ -f "$SANITIZER" ] && command -v node >/dev/null 2>&1; then
+  (cd "$PROJECT_ROOT" && node "$SANITIZER" --sanitize --quiet) >/dev/null 2>&1 || true
+fi
+
 exit 0

package/template_project/.claude/hooks/delegation-gate.mjs

@@ -287,6 +287,27 @@ async function evaluate(ctx) {
   const env = ctx.env || {};
   const payload = ctx.payload || {};
   const toolName = payload.tool_name;
+  // An explicit run-owned existing-only policy applies to ALL dispatches, including
+  // read-only investigators, before role/tier exemptions or host allocation can run.
+  if (toolName === 'Agent' || toolName === 'Task' || toolName === 'Bash') {
+    const root = env.CLAUDE_PROJECT_DIR || ctx.projectRoot || process.cwd();
+    let cursor = '';
+    try { cursor = fs.readFileSync(path.join(root, 'docs/AI_HANDOFF/RUN.md'), 'utf8'); } catch (e) {
+      if (e.code !== 'ENOENT') return { code: 2, stdout: '', stderr: 'Worktree dispatch policy unreadable; refusing all Agent/Task dispatches.\n' };
+    }
+    // A runner may only add this restriction, never override a run-owned one.
+    // Planning-only sessions need enforcement before a RUN cursor exists.
+    if (env.UKIT_WORKTREE_POLICY === 'existing-only' || /^Worktree-Policy:[ \t]*existing-only\b/m.test(cursor)) {
+      const input = payload.tool_input || {};
+      if (toolName === 'Bash' && /\bworktree\s+(?:add|remove|prune|move)\b/i.test(String(input.command || ''))) {
+        return { code: 2, stdout: '', stderr: 'Worktree-Policy: existing-only — direct worktree mutation refused; task exceptions require allocate-task-worktree.mjs with a run-owned authorization and exclusive intent. Removal is not authorized.\n' };
+      }
+      const branches = [input, ...(Array.isArray(input.tasks) ? input.tasks : [])];
+      if (branches.some((entry) => entry && Object.hasOwn(entry, 'isolation'))) {
+        return { code: 2, stdout: '', stderr: 'Worktree-Policy: existing-only — isolation is forbidden before dispatch; omit isolation and use retained worktrees only.\n' };
+      }
+    }
+  }
   if (toolName !== 'Bash' && !MUTATING_TOOLS.has(toolName)) return PASS;
   if (env.UKIT_HARNESS && env.UKIT_HARNESS !== 'claude-code') return PASS;
   const projectRoot = env.CLAUDE_PROJECT_DIR || ctx.projectRoot || process.cwd();

package/template_project/.claude/hooks/handoff-model-guard.sh

@@ -765,9 +765,9 @@ async function createScopeGate() {
 }
 
 // Per-task execution claim (goal loop): no two executor agents run the same INDEX task, and a
-// finished task is never re-dispatched. Released by record-execution.mjs on the tool result;
-// an abandoned claim expires by TTL (stale takeover). Only lock/IO trouble degrades open —
-// an active foreign claim or a completed task is a hard, explained deny.
+// finished task is never re-dispatched. record-execution.mjs releases on synchronous handback
+// or host-authenticated async completion; lease expiry alone cannot authorize a successor.
+// A failed acquire denies dispatch without modifying the unavailable claim evidence.
 async function taskClaimGate() {
   if (process.env.TASK_CLAIM_RUN !== '1' || (toolName !== 'Agent' && toolName !== 'Task')) return;
   try {
@@ -780,6 +780,13 @@ async function taskClaimGate() {
   } catch { return; }
   const indexText = await readTextSafe(path.join(projectRoot, 'docs/AI_HANDOFF/INDEX.md'));
   if (!indexText) return; // no handoff cycle here
+  // Cycle identity for the claim (stale-claim across cycles): task ids restart per cycle, so
+  // the claim is stamped with the run's `Cycle:` from RUN.md — a PREVIOUS cycle's ghost claim
+  // on a reused id is then reconciled (takeover) instead of denying this cycle's dispatch,
+  // while a live same-cycle worker stays protected. No/blank Cycle → legacy cycle-blind deny.
+  const runCycle = mod.normalizeClaimCycle
+    ? mod.normalizeClaimCycle(((await readTextSafe(path.join(projectRoot, 'docs/AI_HANDOFF/RUN.md')) || '').match(/^Cycle:\s*(.+)$/m) || [])[1] || '')
+    : null;
   const rowFor = (id) => indexText.split('\n').find((line) => new RegExp(`^\\|\\s*${id}\\s*\\|`, 'i').test(line));
   const targets = mod.delegatedClaimTargets(input, { isKnownTask: (id) => Boolean(rowFor(id)) });
   const owner = mod.delegatedClaimOwner(payload);
@@ -791,9 +798,18 @@ async function taskClaimGate() {
     if (status === 'done' || status === 'cancelled' || status === 'cancelled_superseded' || status === 'archived') {
       block(`${taskId} is already ${status} in docs/AI_HANDOFF/INDEX.md — it will not be dispatched again. Pick the next open task or reopen it explicitly in INDEX.md first.`);
     }
-    const claim = await mod.acquireTaskClaim(projectRoot, taskId, { owner, sessionId: payload?.session_id || null, ttlMs: mod.DELEGATED_CLAIM_TTL_MS });
+    const claim = await mod.acquireTaskClaim(projectRoot, taskId, { owner, sessionId: payload?.session_id || null, ttlMs: mod.DELEGATED_CLAIM_TTL_MS, cycle: runCycle, requireTermination: true });
     if (!claim.ok && claim.reason === 'active-claim') {
-      block(`${taskId} is already being executed by another agent (active claim). Wait for it to finish, or pick another task; a stale claim expires on its own.`);
+      block(`${taskId} is already being executed by another agent (active claim). Wait for its verified terminal handback, or pick another task; lease expiry alone does not prove worker termination.`);
+    }
+    if (!claim.ok) {
+      block(`${taskId} claim unavailable (${claim.reason || 'acquire-failed'}) — executor not dispatched. Preserve the claim store and reconcile its availability before retrying.`);
+    }
+    if (claim.completionRecovery === 'lease-only') {
+      process.on('exit', (code) => {
+        if (code !== 0) return;
+        try { fs.writeSync(1, `${JSON.stringify({ systemMessage: `UKit: ${taskId} delegation registry full — terminal release authority unavailable; TTL alone cannot authorize a successor. Preserve evidence and reconcile worker termination.` })}\n`); } catch {}
+      });
     }
   }
 }
@@ -808,7 +824,7 @@ async function subtaskGate() {
     const dispatch = await import(require('url').pathToFileURL(path.resolve(process.env.HOOK_DIR || '.', '../ukit/runtime/plan-dispatch.mjs')).href);
     const subtaskId = dispatch.subtaskIdFromInput(input);
     if (!subtaskId) return;
-    const verdict = await dispatch.dispatchSubtask(projectRoot, subtaskId, input);
+    const verdict = await dispatch.dispatchSubtask(projectRoot, subtaskId, input, { toolUseId: payload.tool_use_id, sessionId: payload.session_id });
     if (verdict.ok) {
       const b = verdict.budget;
       if (b && (b.status === 'over-soft-budget' || b.status === 'over-cost-boundary')) {