@ngockhoale/ukit 3.4.68 → 3.4.70

package/template_project/.claude/ukit/runtime/cron-operation-adapter.mjs

@@ -53,8 +53,14 @@ const GIT_STATE = /^git\s+(?:fsck\b|diff\s+(?:--check|--exit-code|--quiet)\b|sta
 const SERVICE_MUTATION = /^(?:docker(?:\s+compose)?|docker-compose)\s+(?:restart|up|down|stop|start|build)\b|^(?:sudo\s+)?systemctl\s+(?:restart|start|stop|reload)\b|^pm2\s+(?:restart|reload|start)\b|^kubectl\s+(?:rollout|apply)\b|^launchctl\s+kickstart\b|^(?:\.\/)?(?:scripts\/)?deploy[\w.-]*(?:\s|$)|^(?:npm|yarn|pnpm)\s+(?:run\s+)?deploy\b/;
 // Authoritative remote observation: `git ls-remote <remote> refs/heads/<branch>` asks the remote itself (a local
 // tracking ref / `git status -sb` can be stale). The gate later requires that sha to equal live HEAD on the
-// branch's own tracking remote with a clean tree, so a masked commit/push is recovered without re-running it.
+// branch's own tracking remote with a clean tree; successful native mutations are required separately.
 const GIT_LS_REMOTE = /^git\s+ls-remote\s+(\S+)\s+(refs\/heads\/\S+)\s*$/;
+// Native GitHub repository postcondition: `gh repo view [repo] --json url,visibility` asks GitHub itself
+// (like ls-remote asks the Git remote). Strict: unmasked single command, BOTH JSON fields present, enum
+// visibility — the gate then binds the observed url to the gate-time Git remote URL
+// (ledger.gitAuthority.remoteUrl), so a masked/public/wrong-repo reply never completes publication.
+const GH_REPO_VIEW = /^gh\s+repo\s+view(?:\s+(\S+))?\s+--json\s+([A-Za-z0-9_,]+)\s*$/;
+const GH_VISIBILITY = /^(?:PUBLIC|PRIVATE|INTERNAL)$/;
 const DRY_RUN = /(?:^|\s)(?:--dry-run|--check|--no-act|-n)(?:\s|=|$)/;
 const CURL = /^curl\s/;
 // A leading `cd <dir>;` / `cd <dir> &&` only selects the working directory: it prints nothing and the shell's
@@ -69,18 +75,30 @@ function requiredTargetOf(segment, required) {
   const tokens = segment.split(/\s+/);
   return required.find((name) => tokens.some((tok) => tok === name || tok.endsWith(`/${name}`))) || '(other)';
 }
+// Hide shell words, not separators; escaped quotes must never start a quoted span.
+function maskShellArguments(command) {
+  return command.replace(/'[^']*'|"(?:\\.|[^"\\])*"|\\./g, (word) => ' '.repeat(word.length));
+}
 export function bashOperationReceipt(rawCommand, response, transportSuccess, goal, { sessionId, harness } = {}) {
   const command = stripLeadingCd(rawCommand);
   const domain = goal?.domain;
   const scope = typeof sessionId === 'string' && sessionId.trim() ? `session:${sessionId.trim()}` : null;
   if (!['git-integrity', 'service-runtime'].includes(domain) || typeof command !== 'string') return null;
   const required = Array.isArray(goal.requiredTargets) ? goal.requiredTargets : [];
-  const bare = command.replace(/'[^']*'|"[^"]*"/g, '""');
-  const masked = /;|\n|\|\|/.test(bare) || (/\|/.test(bare) && !/\bpipefail\b/.test(command));
-  const real = command.split('&&').map((seg) => seg.trim());
+  // Preserve offsets while hiding quoted arguments: only unquoted && separates commands.
+  const bare = maskShellArguments(command);
+  // Pipelines have no per-command exit proof here; the word "pipefail" is not shell state.
+  const masked = /;|\n|\|/.test(bare.replace(/&&/g, ''));
+  const real = [];
+  let start = 0;
+  for (const separator of bare.matchAll(/&&/g)) {
+    real.push(command.slice(start, separator.index).trim());
+    start = separator.index + 2;
+  }
+  real.push(command.slice(start).trim());
   const text = responseText(response);
   const hasOutputField = typeof response === 'string' || typeof response?.stdout === 'string' || typeof response?.output === 'string';
-  let role = null; let proven = false; let target = null; let remoteSync = null;
+  let role = null; let proven = false; let target = null; let remoteSync = null; let github = null; let ghObserved = false;
   for (const seg of real) {
     // `git diff --check` is a real verification, not a dry-run mutation.
     if (!seg || /^cd\s+\S+$/.test(seg) || (DRY_RUN.test(seg.replace(/'[^']*'|"[^"]*"/g, '""'))
@@ -95,6 +113,20 @@ export function bashOperationReceipt(rawCommand, response, transportSuccess, goa
           remoteSync = { remote: lsRemote[1], ref: hit[2], sha: hit[1] };
           proven = true;
         }
+      } else if (seg.match(GH_REPO_VIEW)) {
+        const ghView = seg.match(GH_REPO_VIEW);
+        role = 'state';
+        ghObserved = true;
+        const fields = ghView[2].split(',').map((f) => f.trim());
+        let parsed = null;
+        try { parsed = JSON.parse(text); } catch { parsed = null; }
+        if (hasOutputField && text.length > 0 && text.length <= 4096 && fields.includes('url') && fields.includes('visibility')
+          && parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)
+          && typeof parsed.url === 'string' && parsed.url.length > 0 && parsed.url.length <= 256
+          && typeof parsed.visibility === 'string' && GH_VISIBILITY.test(parsed.visibility)) {
+          github = { ...(ghView[1] ? { repo: ghView[1] } : {}), url: parsed.url, visibility: parsed.visibility };
+          proven = true;
+        }
       } else if (GIT_STATE.test(seg)) {
         const wanted = goal.check;
         const kind = /\bfsck\b/.test(seg) ? 'fsck' : /\bdiff\b/.test(seg) ? 'diff-check' : 'status';
@@ -129,12 +161,18 @@ export function bashOperationReceipt(rawCommand, response, transportSuccess, goa
   // compound/masked chain the stdout of its parts is mixed, so it can neither prove nor refute the state and
   // must not overwrite earlier authoritative evidence. (A standalone dirty status still records as failed.)
   if (domain === 'git-integrity' && role === 'state'
-    && (masked || transportSuccess !== true || real.filter((seg) => seg && !/^cd\s+\S+$/.test(seg)).length !== 1)) return null;
+    && (masked || real.filter((seg) => seg && !/^cd\s+\S+$/.test(seg)).length !== 1)) return null;
+  // A failed `gh repo view` (nonzero exit / unparseable JSON) IS an observation: it records as a FAILED
+  // state receipt (no github field) so it invalidates any earlier PRIVATE proof until a fresh successful
+  // view lands — the postcondition must hold at the LATEST check, not at some earlier one. Other git
+  // state commands keep the rule that a transport failure is unattributable and records nothing.
+  if (domain === 'git-integrity' && role === 'state' && transportSuccess !== true && !ghObserved) return null;
   const ok = transportSuccess === true && !masked && Boolean(scope) && (role === 'mutation' || proven);
   return { kind: 'operation', success: ok, transportSuccess: transportSuccess === true, harness,
     ...(masked ? { exitStatusUnproven: true } : {}),
     operation: { domain, role, scope, target: role === 'state' ? null : target,
-      ...(role === 'state' ? { state: 'verified', complete: ok, ...(remoteSync && ok ? { remoteSync } : {}) } : {}) } };
+      ...(role === 'state' ? { state: 'verified', complete: ok,
+        ...(remoteSync && ok ? { remoteSync } : {}), ...(github && ok ? { github } : {}) } : {}) } };
 }
 
 // Release evidence: `npm publish` and `npm view <pkg> version` as REAL Bash tool results. The command must
@@ -147,7 +185,7 @@ const SEMVER_LINE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 export function releaseReceipt(rawCommand, response, transportSuccess) {
   if (typeof rawCommand !== 'string') return null;
   const command = stripLeadingCd(rawCommand);
-  const masked = /;|\n|\|/.test(command.replace(/'[^']*'|"[^"]*"/g, '""'));
+  const masked = /;|\n|\|/.test(maskShellArguments(command));
   const segments = command.split('&&').map((seg) => seg.trim()).filter((seg) => seg && !/^cd\s+\S+$/.test(seg));
   if (segments.length !== 1) return null;
   const [seg] = segments;

package/template_project/.claude/ukit/runtime/execution-ledger.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { ordersPublication, publicationScope, analyzeTaskIntent, applyTaskSemantics } from '../index/publication-intent.mjs';
 
 import crypto from 'node:crypto';
 import { execFileSync } from 'node:child_process';
@@ -344,8 +345,16 @@ function promptKeyFromText(promptText) {
   return `prompt-${crypto.createHash('sha256').update(normalized).digest('hex').slice(0, 20)}`;
 }
 
+// A conditional-predicate projection (resolveConditionalContract) is ephemeral: it rewrites
+// lastExplicitUserPromptText only for obligation evaluation and records the authoritative owner
+// prompt here, so every identity (prompt key, continuation/resume ownership) stays bound to it.
+function authoritativePromptText(routeState) {
+  const ctx = routeState?.routingContext;
+  return ctx?.ephemeralProjection ? ctx.ephemeralProjection.authoritativePromptText : ctx?.lastExplicitUserPromptText;
+}
+
 function explicitPromptKey(routeState = {}) {
-  return promptKeyFromText(routeState?.routingContext?.lastExplicitUserPromptText);
+  return promptKeyFromText(authoritativePromptText(routeState));
 }
 
 export function hasUnfinishedCompletion(state = {}, ledger = {}, { cwd } = {}) {
@@ -608,6 +617,28 @@ function detailsExitCode(details) {
   return lastCode;
 }
 
+const EXIT_FIELDS = ['exitCode', 'exit_code'];
+const RESULT_CONTAINERS = ['tool_response', 'tool_output', 'tool_result'];
+
+// F-4: true when the payload carries a native result that cannot be trusted as an exit proof.
+// Absent exit codes are NOT malformed (Claude Code success responses omit them).
+function malformedNativeExitPayload(payload = {}) {
+  const invalidExit = (value) => value === null || !Number.isFinite(Number(value)) || typeof value === 'boolean' || (typeof value === 'string' && value.trim() === '');
+  const objects = [payload];
+  for (const key of RESULT_CONTAINERS) {
+    if (!Object.hasOwn(payload, key)) continue;
+    const container = payload[key];
+    if (container === null || Array.isArray(container) || !['object', 'string'].includes(typeof container)) return true;
+    if (typeof container === 'string') {
+      // bare-string results are legitimate only for omp/tool_output text; tool_response must be structured
+      if (key === 'tool_response') return true;
+      continue;
+    }
+    objects.push(container);
+  }
+  return objects.some((obj) => EXIT_FIELDS.some((field) => Object.hasOwn(obj, field) && invalidExit(obj[field])));
+}
+
 function extractExitCode(payload = {}) {
   const candidates = [
     payload.tool_output?.exitCode,
@@ -1584,7 +1615,7 @@ function carriedEvidenceLedger(fresh, current) {
 // evidence survives any re-key/re-route within one request without leaking across requests.
 // States with no recorded prompt text get no identity and never carry evidence.
 function evidencePromptKey(routeState) {
-  const promptText = String(routeState?.routingContext?.lastExplicitUserPromptText || '').trim();
+  const promptText = String(authoritativePromptText(routeState) || '').trim();
   if (!promptText) return null;
   return `prompt-${crypto.createHash('sha256').update(promptText).digest('hex').slice(0, 20)}`;
 }
@@ -3244,6 +3275,11 @@ export async function recordExecutionReceipt({
     Object.assign(receipt, bgCompletion);
   } else if (operationReceipt) {
     Object.assign(receipt, operationReceipt);
+    // An absent native exit is not successful execution, even when no error flag was supplied.
+    if (toolName === 'Bash' && exitCode === null) {
+      receipt.exitStatusUnproven = true;
+      receipt.success = false;
+    }
   } else if (toolName === 'Read' || toolName === 'Grep' || toolName === 'Glob') {
     receipt.kind = 'source';
     receipt.file = toolInput.file_path || toolInput.path || null;
@@ -3265,6 +3301,8 @@ export async function recordExecutionReceipt({
     // verdict stays restricted to real verification commands: attestation
     // alone must never mint verification evidence.
     receipt.kind = 'verification';
+    receipt.taskInstanceId = routeState?.taskInstanceId || null;
+    receipt.sessionKey = sessionIdentity(payload);
     receipt.command = String(toolInput.command || '').trim();
     // A pipe-masked runner status (exit 0 from `| tail`) is not evidence of a pass.
     const maskedStage = isVerificationCommand(toolInput.command) ? maskedVerificationStage(toolInput.command) : null;
@@ -3279,6 +3317,13 @@ export async function recordExecutionReceipt({
       receipt.success = false;
       receipt.exitStatusUnproven = true;
       noteUnprovenExitStatus(maskedStage);
+    } else if (receipt.success && isVerificationCommand(toolInput.command) && malformedNativeExitPayload(payload)) {
+      // F-4: a malformed native payload (exit field present but non-numeric/null, or a result
+      // container of the wrong type) is unproven input — fail closed, never mint a passing
+      // verification receipt from it. A wholly absent exit code stays host-legitimate.
+      receipt.success = false;
+      receipt.exitStatusUnproven = true;
+      noteUnprovenExitStatus(`${receipt.command} (native exit payload malformed)`);
     }
     // WS-C routed-verification receipt: a command counts as "targeted" when it matches the
     // routed plan (preferredOrder / primaryCommands). Off-plan verification still records
@@ -3435,6 +3480,7 @@ function requiredEvidence(state = {}) {
 
 function evidenceSatisfied(evidence, ledger = {}, state = {}, { cwd } = {}) {
   const routeSummary = state?.routeSummary || {};
+  if (evidence === 'release-publication') return releasePublicationMissing(state, ledger, cwd) === null;
   if (evidence === 'report-artifact') {
     const artifact = routeSummary.executionContract?.reportArtifact;
     if (!cwd || typeof artifact !== 'string') return false;
@@ -3749,11 +3795,17 @@ function gitAuthority(cwd) {
   const branch = gitOutput(['symbolic-ref', '--short', 'HEAD'], cwd);
   if (!head || !branch) return null;
   const remote = gitOutput(['config', `branch.${branch}.remote`], cwd);
-  const dirty = gitOutput(['status', '--porcelain'], cwd);
-  // Tags that dereference (`--points-at` peels annotated tags) to live HEAD: a masked `git tag` is recovered by
-  // this independent local state, exactly like a masked push is recovered by remote parity.
+  const remoteUrl = remote ? gitOutput(['config', `remote.${remote}.url`], cwd) : null;
+  // gitOutput conflates empty output with failure; cleanliness needs an explicit successful status read.
+  let clean = false;
+  try {
+    clean = execFileSync('git', ['status', '--porcelain'], {
+      cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000,
+    }).trim() === '';
+  } catch { /* an unreadable working tree is not clean */ }
+  // Annotated tags are peeled by --points-at; this state corroborates successful native tag execution.
   const tagsAtHead = (gitOutput(['tag', '--points-at', 'HEAD'], cwd) || '').split('\n').map((t) => t.trim()).filter(Boolean).slice(0, 16);
-  return { head, branch, remote, tagsAtHead, clean: dirty === null && gitOutput(['rev-parse', '--git-dir'], cwd) !== null };
+  return { head, branch, remote, remoteUrl, tagsAtHead, clean };
 }
 function withGitAuthority(ledger, cwd) {
   const gitAuth = ledger && Object.keys(ledger).length ? gitAuthority(cwd) : null;
@@ -3796,44 +3848,8 @@ function defectRepairBranches(text) {
 }
 
 export function promptOrdersNpmPublish(state = {}) {
-  const text = String(state?.routingContext?.lastExplicitUserPromptText || '')
-    .normalize('NFD').replace(/[\u0300-\u036f]/g, '').replace(/[đĐ]/g, 'd').toLowerCase();
-  // Quoted commands and historical/example blocks describe orders; they do not issue them.
-  let active = text.replace(/```[^]*?```|~~~[^]*?~~~/g, '')
-    .replace(/^[ \t]*>.*$/gm, '').replace(/[“"][^”"\n]*[”"]|‘[^’\n]*’/g, '');
-  for (const branch of defectRepairBranches(active)) active = active.replace(branch, '');
-  let prohibited = false;
-  let ordered = false;
-  let blockNegated = false;
-  for (const line of active.split('\n')) {
-    const bullet = /^\s*(?:[-*\u2022]|\d+[.)])\s+/.test(line);
-    if (!line.trim()) { blockNegated = false; continue; }
-    if (!bullet) blockNegated = line.trim().length <= 80 && (PUBLISH_ORDER_NEGATOR.test(line) || PUBLISH_ORDER_HEADER.test(line)) && /:\s*$|^[^.]{0,40}$/.test(line.trim()) && !/\bnpm\s+publish\b/.test(line);
-    for (const sentence of line.split(/\s*;\s*|\.\s+|\.$/)) {
-      for (const hard of sentence.split(/\bthen\b|\bbut\b|\binstead\b/)) {
-        let negated = bullet && blockNegated;
-        for (const raw of hard.split(/,|\band\b|\bor\b|\bnor\b/)) {
-          const item = raw.replace(/^[\s\-*\u2022]+|^\d+[.)]\s*/g, '').trim();
-          if (PUBLISH_ORDER_NEGATOR.test(item)) negated = true;
-          // Bare list nouns (push, tag, commit) must not revoke an earlier "No".
-          else if (/^(?:please\s+|now\s+|also\s+)*(?:run|execute|perform|chay)\s+\S/.test(item)) negated = false;
-          const publication = /\bnpm\s+publish\b/.test(item);
-          const releaseOrder = /^(?:please\s+|just\s+|now\s+|also\s+)*(?:release|ship|publish)\s+(?!readiness\b|verification\b|evidence\b|policy\b|intent\b|notes\b|terminology\b)\S/.test(item);
-          const releaseReference = /\b(?:release|publish|publication)\b/.test(item);
-          if (negated && releaseReference && !/--dry-run/.test(item)) prohibited = true;
-          // Politeness/sequencing prefixes ("please npm publish ...") and Vietnamese verbs ("dua ... len npm",
-          // "phat hanh ... len npm") are still affirmative orders when nothing negates them.
-          const politeItem = item.replace(/^(?:(?:please|just|now|also|then|vui long|hay)\s+)+/, '');
-          const viPublish = /^(?:dua|phat hanh|xuat ban|deploy|day)\b[^.]{0,60}\b(?:len|to|vao)\s+npm\b/.test(politeItem);
-          if (!negated && (releaseOrder || viPublish || (publication && (
-            /^npm\s+publish\b/.test(politeItem) || PUBLISH_ORDER_IMPERATIVE.test(item)
-            || /\b(?:chay|run)\s+`?npm\s+publish\b/.test(item)
-            || /continue the release workflow:/.test(item))))) ordered = true;
-        }
-      }
-    }
-  }
-  return ordered && !prohibited;
+  const prompt = state?.routingContext?.lastExplicitUserPromptText || '';
+  return ordersPublication(prompt) && !publicationScope(prompt).prohibited;
 }
 
 function isConditionalRuntimeWrite(receipt, cwd) {
@@ -3867,15 +3883,18 @@ function conditionalRepairOrdersPublish(state, ledger, cwd) {
   return defectBranches.some((branch) => promptOrdersNpmPublish({ routingContext: {
     lastExplicitUserPromptText: branch.replace(/^[^,\n]*[,\n]\s*/, '').replace(/\s*\n\s*/g, ' '),
   } })) || Boolean(legacyBranch && promptOrdersNpmPublish({ routingContext: {
-    lastExplicitUserPromptText: legacyBranch.replace(/^.*?:/, 'Run '),
+    lastExplicitUserPromptText: legacyBranch.replace(/^[^:]*:/, 'Run '),
   } }));
 }
 
 function releasePublicationMissing(state, ledger, cwd) {
-  if (!promptOrdersNpmPublish(state) && !conditionalRepairOrdersPublish(state, ledger, cwd)) return null;
+  const routedPublication = state?.routeSummary?.executionContract?.publication === true
+    && ordersPublication(state?.routingContext?.lastExplicitUserPromptText);
+  if (!routedPublication && !promptOrdersNpmPublish(state)
+    && !conditionalRepairOrdersPublish(state, ledger, cwd)) return null;
   let pkg = null;
-  try { pkg = JSON.parse(fsSync.readFileSync(path.join(cwd || process.cwd(), 'package.json'), 'utf8')); } catch { return null; }
-  if (!pkg?.version) return null;
+  try { pkg = JSON.parse(fsSync.readFileSync(path.join(cwd || process.cwd(), 'package.json'), 'utf8')); } catch { return 'release-publication'; }
+  if (!pkg?.name || !pkg?.version) return 'release-publication';
   const release = Object.values(ledger?.operationBank || {}).filter((entry) => entry && typeof entry === 'object');
   const view = release.map((entry) => entry.state).filter((proof) => proof?.operation?.domain === 'release'
     && proof.success === true && proof.operation.complete === true)
@@ -3951,6 +3970,49 @@ function workingTreeShippedChange(pkg, tagCommit, cwd) {
   } catch { return true; }
 }
 
+// Resolve only explicit package-test predicates from native receipts. Unknown
+// predicates, missing currency and evicted receipts remain pending, never false.
+function resolveConditionalContract(state, ledger, cwd) {
+  const promptText = state?.routingContext?.lastExplicitUserPromptText || '';
+  const intent = analyzeTaskIntent({ promptText });
+  const obligations = state?.routeSummary?.executionContract?.conditionalObligations || [];
+  const replacements = [];
+  for (const spanIndex of new Set(obligations.map(action => action.spanIndex))) {
+    const span = intent.spans[spanIndex];
+    const condition = span?.condition?.replace(/^otherwise:/, '');
+    const match = condition?.match(/^if ((?:yarn (?:test(?::[\w:-]+)?|release:verify)|npm run (?:test(?::[\w:-]+)?|release:verify)|npm test)) (passes|fails)$/);
+    if (!match || !state.taskInstanceId || !state.sessionId) return null;
+    const receipt = [...(ledger.receipts || [])].reverse().find(item => item.command === match[1]);
+    if (!receipt || receipt.kind !== 'verification' || receipt.toolName !== 'Bash'
+      || receipt.taskInstanceId !== state.taskInstanceId || receipt.sessionKey !== ledger.sessionKey
+      || !Number.isInteger(receipt.exitCode) || receipt.exitStatusUnproven || receipt.backgroundTaskId
+      || !receipt.verdict?.dirtyFp || !receipt.verdict?.contentFp
+      || receipt.verdict.workspaceRoot || !verdictCurrent(receipt.verdict, { cwd }).current) return null;
+    const passed = receipt.success === true && receipt.exitCode === 0
+      && VERDICT_SATISFYING_KINDS.has(receipt.verdict.kind);
+    const failed = receipt.success === false && receipt.exitCode !== 0 && receipt.verdict.kind === 'failed';
+    if (!passed && !failed) return null;
+    const taken = (match[2] === 'passes' ? passed : failed) !== span.condition.startsWith('otherwise:');
+    const consequence = span.condition.startsWith('otherwise:')
+      ? span.raw.replace(/^\s*otherwise\s*,?\s*/i, '')
+      : span.raw.replace(/^[^,]*,\s*/, '');
+    if (consequence === span.raw) return null;
+    replacements.push({ ...span, text: taken ? ` ${consequence}` : ' ' });
+  }
+  if (!replacements.length) return null;
+  let activePrompt = promptText;
+  for (const span of replacements.sort((a, b) => b.start - a.start)) {
+    activePrompt = activePrompt.slice(0, span.start) + span.text + activePrompt.slice(span.end);
+  }
+  const semantic = analyzeTaskIntent({ promptText: activePrompt }).semantic;
+  const { conditionalObligations: _pending, verificationOnly: _verificationOnly,
+    statusReport: _statusReport, publication: _publication, operationGoal: _operationGoal, ...base } = state.routeSummary.executionContract;
+  const contract = applyTaskSemantics(base, semantic);
+  return { ...state, routingContext: { ...state.routingContext, lastExplicitUserPromptText: activePrompt,
+      ephemeralProjection: { authoritativePromptText: promptText } },
+    routeSummary: { ...state.routeSummary, executionContract: contract } };
+}
+
 function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null } = {}) {
   const routeSummary = state?.routeSummary || {};
   // Explicit vibecode autonomy: the user asked UKit to run one prompt to a finished result,
@@ -3992,6 +4054,20 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
       reason: `UKit stopped automatic recovery: ${requestLedger.blocker.detail || 'a recorded blocker ended this run.'}`,
     };
   }
+  // Predicate resolution changes completion obligations only, never permission.
+  const conditionalObligations = routeSummary.executionContract?.conditionalObligations;
+  if (Array.isArray(conditionalObligations) && conditionalObligations.length > 0) {
+    const resolved = resolveConditionalContract(state, requestLedger, cwd);
+    if (resolved) return evaluateCompletionContract({ state: resolved, ledger, cwd, phase });
+    return { continue: false, notify: true, complete: false, outcome: 'blocked',
+      missingEvidence: ['conditional-predicate'],
+      reason: 'UKit conditional obligation unresolved: no native owned predicate resolver is available for this branch. Report the predicate and retained actions; do not infer authorization, request publication evidence, or claim completion from a generic verification receipt.' };
+  }
+  const publicationOrdered = ordersPublication(state?.routingContext?.lastExplicitUserPromptText);
+  if (publicationOrdered && (!state?.routeSummary?.executionContract?.taskKind || state.routeSummary.executionContract.taskKind === 'READ_ONLY')) {
+    return { continue: true, notify: true, complete: false, missingEvidence: ['release-publication'],
+      reason: 'UKit completion gate: missing release-publication. Publication intent has no valid routed contract; restore routing without publishing or inferring authorization.' };
+  }
   if (!state || !state.routeSummary) {
     // No routable state at all: a never-routed session (or a foreign-owned one) is silent
     // success — there is nothing to report. The CLI's lost-route path handles the case where
@@ -4075,7 +4151,7 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
     missingEvidence.push('release-preflight');
   }
   const releaseMissing = releasePublicationMissing(state, effectiveLedger, cwd);
-  if (releaseMissing) missingEvidence.push(releaseMissing);
+  if (releaseMissing && !missingEvidence.includes(releaseMissing)) missingEvidence.push(releaseMissing);
   // TASK-009 (BL-011): the bug-fix floor. On a `playbookId: bug-fix` route a
   // green verdict requires verbatim repro-before (fail) + repro-after (pass)
   // receipts on the same surface plus a named root cause in the exec-ledger —
@@ -4303,8 +4379,18 @@ function evaluateCompletionContract({ state = {}, ledger = {}, cwd, phase = null
   }
 
   const finalAttempt = !vibecode && continuationCount === MAX_CONTINUATIONS - 1;
-  const instruction = missingEvidence.includes('release-publication')
-    ? 'The release is not proven published: run `npm publish` once if the registry does not yet serve this version, then confirm with `npm view <package> version` (must equal package.json) and that the release tag dereferences to HEAD (or to an ancestor of HEAD with no shipped change since). Never move the tag. Do not republish a version the registry already serves. Accepted evidence: a Bash result of exactly `npm view <package> version` (optionally `2>&1`, optionally after `cd <dir> &&`) that exited 0 and printed a bare semver. Rejected as unproven: the same command behind `| tail/head/cat`, `;`, `||` or inside a compound (a pipeline hides the exit status), dry runs, prose claims. Re-run the bare command once; do not republish.'
+  const publicationPending = missingEvidence.includes('release-publication');
+  const publicationProhibited = publicationScope(state?.routingContext?.lastExplicitUserPromptText).prohibited
+    && !conditionalRepairOrdersPublish(state, effectiveLedger, cwd);
+  const prerequisites = missingEvidence.filter((item) => item !== 'release-publication');
+  if (publicationPending && publicationProhibited && prerequisites.length === 0) {
+    return { continue: false, notify: true, complete: false, outcome: 'blocked', missingEvidence,
+      reason: 'UKit publication BLOCKED: the current owner prompt prohibits publication. No authorized publication action remains; do not retry or infer permission from missing evidence.' };
+  }
+  const instruction = publicationPending
+    ? prerequisites.length > 0
+      ? `Complete the permitted prerequisites first (${prerequisites.join(', ')}). ${recoveryInstruction(prerequisites, effectiveLedger, routeSummary, { cwd })} Do not publish before mandatory verification and separate execution authorization are established.`
+      : 'Publication remains unproven. Accepted evidence: a Bash result of exactly `npm view <package> version` (optionally --prefer-online) with successful native exit and the current package version, owned by this task. Rejected as unproven: the same command behind a pipeline, masked exit, stale or foreign-task receipt. Inspect existing owned registry/tag evidence first; never republish a served version or move its tag. Missing evidence does not authorize execution: publication requires the owner permission and mandatory release prerequisites. If either is unavailable, report BLOCKED with provenance; do not retry the same blocker.'
     : operationalTask
     ? 'Inspect native mutation receipts and verify the requested operational state; do not fabricate source edits or source-test evidence.'
     : recoveryInstruction(missingEvidence, effectiveLedger, routeSummary, { cwd });
@@ -4626,8 +4712,7 @@ async function writeSeal(projectRoot, payload, state, result, ledger) {
   await writeJsonAtomic(file, Object.fromEntries(keep));
 }
 
-const CLASSIFIER_OWNED_FIELDS = ['operationGoal', 'configurationScope', 'releasePolicy', 'reportArtifact', 'verificationOnly', 'statusReport'];
-const contractSignature = (c) => JSON.stringify([c?.taskKind, c?.operationGoal ?? null, c?.configurationScope ?? null, c?.releasePolicy?.kind ?? null, c?.reportArtifact ?? null]);
+const CLASSIFIER_OWNED_FIELDS = ['publication', 'operationGoal', 'configurationScope', 'releasePolicy', 'conditionalObligations', 'reportArtifact', 'verificationOnly', 'statusReport'];
 
 // Re-derive a router-classified contract from the task's own explicit prompt. Only a contract
 // this router classified itself (contractOrigin 'classified') is eligible: system-carried,
@@ -4639,7 +4724,9 @@ export async function reconcileStaleContract(projectRoot, state) {
     if (!stored?.taskKind || stored.statusReport || state.contractOrigin !== 'classified' || typeof prompt !== 'string' || !prompt.trim()) return state;
     const resolver = await import(new URL('../index/route-resolver.mjs', import.meta.url).href);
     const fresh = resolver.classifyTaskSemantics({ promptText: prompt, targetFile: state.routingContext?.targetFile });
-    if (!fresh?.taskKind || contractSignature(fresh) === contractSignature(stored)) return state;
+    if (!fresh?.taskKind) return state;
+    const engine = await import(new URL('../index/publication-intent.mjs', import.meta.url).href);
+    const identity = engine.semanticContractIdentity({ promptText: prompt, targetFile: state.routingContext?.targetFile || '', taskInstanceId: state.taskInstanceId });
     const base = { ...stored };
     for (const key of CLASSIFIER_OWNED_FIELDS) delete base[key];
     // Evidence tags added by the stale classification (operation-verification, report-artifact, ...) do not
@@ -4650,7 +4737,11 @@ export async function reconcileStaleContract(projectRoot, state) {
       const baseEvidence = resolver.buildExecutionContract(mode)?.completionEvidence;
       if (Array.isArray(baseEvidence)) base.completionEvidence = baseEvidence;
     }
-    return { ...state, routeSummary: { ...state.routeSummary, executionContract: resolver.applyTaskSemantics(base, fresh) } };
+    const executionContract = resolver.applyTaskSemantics(base, fresh);
+    const comparison = engine.compareSemanticContracts({ stored, fresh: executionContract, previousIdentity: state.semanticIdentity, identity });
+    if (comparison.status === 'invariant-violation') return { ...state, semanticDiagnostic: comparison };
+    return { ...state, semanticIdentity: identity, semanticDiagnostic: comparison,
+      routeSummary: { ...state.routeSummary, executionContract } };
   } catch { return state; }
 }
 
@@ -4691,7 +4782,18 @@ async function runEvaluateStop() {
   // never heals a contract classified by an older classifier. Reconcile it from the task's own
   // prompt at the gate boundary (in memory; the stored route state is left untouched).
   const reconciled = await reconcileStaleContract(projectRoot, state);
+  if (reconciled.semanticDiagnostic?.status === 'invariant-violation') {
+    process.stdout.write(`${JSON.stringify({ decision: 'block', reason: `UKit semantic contract invariant violation: unchanged authoritative task/prompt/engine produced contradictory contracts. No new operation or publication obligation has been accepted. ${JSON.stringify(reconciled.semanticDiagnostic)}` })}\n`);
+    return;
+  }
   let result = evaluateCompletion({ state: reconciled, ledger, cwd: projectRoot, phase });
+  if (result.continue && result.missingEvidence?.includes('release-publication')) {
+    const progress = await noteStopProgress(projectRoot, payload);
+    if (progress?.value?.reentrant === true) {
+      result = { ...result, continue: false, notify: true, complete: false, outcome: 'blocked',
+        reason: `UKit publication recovery BLOCKED: no new owned receipts since the previous Stop. Missing ${result.missingEvidence.join(', ')}. Do not repeat evidence requests or retry publication; report the unavailable authorization/prerequisite with task provenance. [task=${state?.taskInstanceId || 'unknown'}]` };
+    }
+  }
   if (result.continue === true && !result.finalNotice) {
     try {
       const seal = await readSeal(projectRoot, payload, state?.taskInstanceId);
@@ -4777,6 +4879,7 @@ async function runEvaluateStop() {
   if (result.continue) {
     if (result.finalNotice) await markNotified(projectRoot, payload, ledger);
     else await incrementContinuation(projectRoot, payload, ledger, state?.requestKey || null, evidencePromptKey(state));
+    if (result.missingEvidence?.includes('release-publication')) await noteStopProgress(projectRoot, payload);
     // Provenance: the harness will re-inject this reason as a prompt. Bind it to this
     // session+task+exact-reason (hash) so the router can recognise our own continuation
     // (advisory — a failed write only leaves it unbound).
@@ -4798,7 +4901,9 @@ async function runEvaluateStop() {
     // single line (evaluator stdout is parsed first-line-wins by the stop coordinator).
     const message = result.playbookAdvisory ? `${result.reason} ${result.playbookAdvisory}` : result.reason;
     process.stderr.write(`[ukit-completion] ${result.reason}\n`);
-    process.stdout.write(`${JSON.stringify({ systemMessage: message })}\n`);
+    process.stdout.write(`${JSON.stringify({ systemMessage: message,
+      ...(result.outcome === 'blocked' ? { outcome: 'blocked', complete: false } : {}),
+    })}\n`);
     return;
   }
   if (result.complete) {

package/template_project/.claude/ukit/runtime/hook-chain-runner.mjs

@@ -12,7 +12,8 @@ import { runHookProcess, resolveHookCommand, SPAWN_UNAVAILABLE_CODES } from './h
 // Loaded dynamically so a partially-updated runtime (module missing) degrades to "no advice"
 // instead of crashing the whole fail-closed chain on a static-import error.
 let adviseOnBlock = () => '';
-try { ({ adviseOnBlock } = await import('./block-breaker.mjs')); } catch { /* advisory only */ }
+let recordAllowedSuccess = () => 0;
+try { ({ adviseOnBlock, recordAllowedSuccess } = await import('./block-breaker.mjs')); } catch { /* advisory only */ }
 // TASK-019: chain rows and direct-hook rows share one versioned schema and one
 // append API (hook-telemetry.mjs) — including safeName for session files.
 import { appendTelemetryRow, recordHookTiming, TELEMETRY_VERSION } from './hook-telemetry.mjs';
@@ -725,7 +726,56 @@ try {
     decisionShortCircuit: emitVerdict,
     stdinStageMs,
   });
+  // Allowed-success invalidation (stop-reconciliation read side): an unblocked PostToolUse
+  // chain whose tool_response is not an error proves the tool ran, so a stale exhausted
+  // denial for THAT tool in THIS session/task must not release a later stop as blocked —
+  // the condition is resolved. Best-effort and advisory: never throws, never changes
+  // the verdict of this chain.
+  try {
+    const eventPayload = JSON.parse(payloadText || '{}');
+    if (eventPayload.hook_event_name === 'PostToolUse' && eventPayload.tool_response?.is_error !== true
+      && !chain.results.some((r) => {
+        if (!r) return false;
+        if (r.code === 2) return true;
+        if (typeof r.stdout !== 'string' || !r.stdout.includes('"hookSpecificOutput"')) return false;
+        try { return JSON.parse(r.stdout)?.hookSpecificOutput?.permissionDecision === 'deny'; } catch { return false; }
+      })) {
+      const first = scriptPaths[0] ? parseScriptArg(scriptPaths[0]).scriptPath : '';
+      const root = first ? path.resolve(path.dirname(first), '../..') : (eventPayload.cwd || process.cwd());
+      recordAllowedSuccess({ projectRoot: root, payload: eventPayload });
+    }
+  } catch { /* advisory only */ }
   if (!emitVerdict) {
+    // omp-bridge aggregate mode: the block reason travels inside the aggregate's
+    // per-result stderr (the bridge's translateExecResult owns the verdict text), so
+    // the stop-and-report directive must be appended THERE — the runner's own stderr
+    // never reaches the model on this transport. Mirrors the --emit-verdict priority:
+    // a structured deny's reason first, else the exit-2 stderr. Advisory only.
+    try {
+      const blocked = chain.results.find((r) => {
+        if (!r) return false;
+        if (r.code === 2) return true;
+        if (typeof r.stdout !== 'string' || !r.stdout.includes('"hookSpecificOutput"')) return false;
+        try { return JSON.parse(r.stdout)?.hookSpecificOutput?.permissionDecision === 'deny'; } catch { return false; }
+      });
+      if (blocked) {
+        const structured = typeof blocked.stdout === 'string' && blocked.stdout.includes('"hookSpecificOutput"')
+          ? (() => { try { return JSON.parse(blocked.stdout)?.hookSpecificOutput ?? null; } catch { return null; } })()
+          : null;
+        const reason = structured?.permissionDecision === 'deny'
+          ? String(structured.permissionDecisionReason || blocked.stderr || '')
+          : String(blocked.stderr || `${blocked.scriptName} blocked (exit 2) with no reason`);
+        const advice = breakerAdvice(reason);
+        if (advice) {
+          if (structured?.permissionDecision === 'deny') {
+            structured.permissionDecisionReason = `${structured.permissionDecisionReason || ''}\n${advice}`;
+            blocked.stdout = JSON.stringify({ hookSpecificOutput: structured });
+          } else {
+            blocked.stderr = `${blocked.stderr || ''}${advice}`;
+          }
+        }
+      }
+    } catch { /* advisory only */ }
     process.stdout.write(JSON.stringify(chain));
   } else {
     // TASK-234: a script that emits a hookSpecificOutput decision JSON owns the