@pareto4/pp-core 1.13.0 → 1.17.1

package/pp-core/workflows/new-project.md

@@ -70,21 +70,9 @@ _PP_SHIM_NAME="pp-tools.cjs"; _pp_root() { ( for _v in $(env | sed -n 's/^\(GIT_
 # Gate on presence via reader — absent file → {present:false} exit 0 (inert, step skipped, no jq)
 if [ "$(pp_run query platform-bindings --pick present 2>/dev/null)" = "true" ]; then
   PINNED=$(pp_run query platform-bindings --pick platform.tag)
-  REPO=$(pp_run query platform-bindings --pick platform.repo)
-  HOST_FROM_BINDINGS=$(pp_run query platform-bindings --pick platform.host 2>/dev/null)
-  PLATFORM_HOST="${HOST_FROM_BINDINGS:-${HOST:-gitlab.com}}"
-  PLATFORM_REPO_URL="https://${PLATFORM_HOST}/${REPO}.git"
-  # Resolve latest STABLE tag from remote — never hard-block if offline (empty LATEST → skip drift check)
-  # Keep --refs to strip ^{} annotated-tag rows; --sort=-v:refname sorts server-side
-  # Stable filter fixes prerelease mis-ordering: git ranks v1.4.0-rc.1 after v1.4.0 (wrong by semver)
-  # semver-compare.cjs is the single blessed source for comparison — do NOT reimplement
-  REMOTE_TAGS=$(git ls-remote --tags --refs --sort=-v:refname "$PLATFORM_REPO_URL" 'v*' 2>/dev/null | sed 's#.*/##')
-  LATEST=$(printf '%s\n' "$REMOTE_TAGS" | node -e "
-const sc = require('${PP_TOOLS%/*}/lib/semver-compare.cjs');
-const lines = require('fs').readFileSync(0, 'utf-8').split('\n').map(s=>s.trim()).filter(Boolean);
-const stable = lines.filter(sc.isStableTripletSemver).sort(sc.compareSemverCore);
-process.stdout.write((stable[stable.length-1] || '') + '\n');
-" 2>/dev/null)
+  # The owner is compose-bindings resolveLatestPlatformTag — the same lookup pp-tools init and check ship.platform-drift use — so the URL is never composed in shell.
+  # Tagless, offline and unreachable all print as empty: latest=<unresolved> and the drift comparison is skipped (never hard-block).
+  LATEST=$(pp_run query platform-latest-tag --pick latest 2>/dev/null)
   echo "platform preflight: pinned=${PINNED:-<none>} latest=${LATEST:-<unresolved>}"
   if [ -n "$LATEST" ] && [ -n "$PINNED" ] && [ "$PINNED" != "$LATEST" ]; then
     echo "PP_PLATFORM_DRIFT=1"
@@ -102,15 +90,10 @@ choose:
 - **Proceed on the older pin** — continue knowingly; record the deferral in
   `PROJECT.md` so it's a conscious decision, not silent drift.
 
-If `LATEST` was unresolved (offline / no network), note it and proceed — never
-hard-block initiation on an unreachable remote. For non-Pareto repos the block is
+If `LATEST` was unresolved (no stable release tag, offline, or an unreachable
+remote), note it and proceed — never hard-block initiation on an unresolved tag. For non-Pareto repos the block is
 a no-op and this step is skipped entirely.
 
-When the bindings file is present, also run `pp_run query init-contract --arm-vault`
-(sets `vault.enabled` and `vault.required` to true, each only where absent; `ok:false` = no client vault bound — run
-`/pp-init`) and `pp_run vault probe` (one reachability line; empty when the vault is
-disabled). Show both outputs verbatim; neither blocks.
-
 ## 1. Setup
 
 **MANDATORY FIRST STEP — Execute these checks before ANY user interaction:**
@@ -149,7 +132,7 @@ with "agent type not found" if `required_agents_installed` is false. Run the ins
 
 Proceeding without research subagents — roadmap will be generated inline.
 ```
-Skip Steps 6–7 (parallel research and synthesis) and proceed directly to roadmap creation in Step 8.
+Continue through Steps 2–5.5 as normal. When you reach Step 6, skip Steps 6–7 (parallel research and synthesis) and go straight to roadmap creation in Step 8.
 
 **Detect runtime and set instruction file name:**
 
@@ -453,6 +436,11 @@ Loop until "Create PROJECT.md" selected.
 
 Synthesize all context into `.planning/PROJECT.md` using the template from `templates/project.md`.
 
+**Init deferral (D-07-03, OD-2).** Before writing the file, Read
+`pp-core/workflows/init/steps/project-md-deferral-narration.md` and follow it — the single
+rendering of the reachability-proof deferral `/pp-init` recorded, silent when none is on
+file. Do not restate its logic here.
+
 **For greenfield projects:**
 
 Initialize requirements as hypotheses:
@@ -887,6 +875,26 @@ Config changes are saved locally — no commit needed since `commit_docs` is `fa
 
 Use models from init: `researcher_model`, `synthesizer_model`, `roadmapper_model`.
 
+**Arm the client vault (both modes, every route).**
+It sits here, not in Step 6, because Step 1's agents-not-installed note skips Steps 6–7, and this step must run on that route too.
+
+```bash
+ARM=$(pp_run query init-contract --arm-vault); ARM_EXIT=$?
+echo "$ARM"
+ARMED=$(printf '%s' "$ARM" | node -e 'let s="";process.stdin.on("data",d=>{s+=d}).on("end",()=>{try{process.stdout.write(String(JSON.parse(s).armed===true))}catch{process.stdout.write("false")}})')
+if [ "$ARM_EXIT" -eq 0 ] && [ "$ARMED" = "true" ]; then
+  if [ -f .platform-bindings.json ]; then
+    pp_run query commit "chore: arm client vault from org profile" --files .planning/config.json .platform-bindings.json
+  else
+    pp_run query commit "chore: arm client vault from org profile" --files .planning/config.json
+  fi
+fi
+```
+
+- `ok: false` (or `ARM_EXIT` is non-zero): **STOP.** Print the engine's `message` verbatim and tell the user to run `/pp-init` before continuing. Do not continue with the vault silently off.
+- `armed: true` (the block above already committed it): tell the user, in one or two short lines, that a client-vault binding was composed from the org profile `<profile.packageName>@<profile.version>` without a prompt, and that setting `vault.enabled: false` in `.planning/config.json` opts out and is honoured by every later arming run.
+- `armed: false`: nothing was written or committed and the vault is NOT armed — do not say it was. If `reason` is `vault_disabled`, tell the user the project's `vault.enabled` setting keeps the vault off. Continue.
+
 ## 6. Research Decision
 
 **If auto mode:** Default to "Research first" without asking.

package/pp-core/workflows/plan-phase.md

@@ -72,8 +72,7 @@ Load all context in one call (paths only to minimize orchestrator context):
 ```bash
 _PP_SHIM_NAME="pp-tools.cjs"; _pp_root() { ( for _v in $(env | sed -n 's/^\(GIT_[A-Za-z0-9_]*\)=.*/\1/p'); do unset "$_v"; done; _c=$(git rev-parse --git-common-dir 2>/dev/null); if [ "${_c##*/}" = .git ] && cd "$_c/.." 2>/dev/null; then pwd -P; else git rev-parse --show-toplevel 2>/dev/null || pwd; fi ); }; pp_run() { case "$PP_TOOLS" in *.cjs) node "$PP_TOOLS" "$@";; *) "$PP_TOOLS" "$@";; esac; }; _PP_RUNTIME_ROOT="${RUNTIME_DIR:-$(_pp_root)}"; PP_TOOLS="${_PP_RUNTIME_ROOT}/pp-core/bin/${_PP_SHIM_NAME}"; if [ -f "$PP_TOOLS" ]; then :; elif [ -f "${_PP_RUNTIME_ROOT}/.claude/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${_PP_RUNTIME_ROOT}/.claude/pp-core/bin/${_PP_SHIM_NAME}"; elif [ -f "${_PP_RUNTIME_ROOT}/.codex/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${_PP_RUNTIME_ROOT}/.codex/pp-core/bin/${_PP_SHIM_NAME}"; elif [ -f "$HOME/.claude/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="$HOME/.claude/pp-core/bin/${_PP_SHIM_NAME}"; elif [ -f "${HERMES_HOME:-$HOME/.hermes}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${HERMES_HOME:-$HOME/.hermes}/pp-core/bin/${_PP_SHIM_NAME}"; elif [ -f "${CURSOR_CONFIG_DIR:-$HOME/.cursor}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${CURSOR_CONFIG_DIR:-$HOME/.cursor}/pp-core/bin/${_PP_SHIM_NAME}"; elif [ -f "${CODEX_HOME:-$HOME/.codex}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${CODEX_HOME:-$HOME/.codex}/pp-core/bin/${_PP_SHIM_NAME}"; elif [ -f "${GEMINI_CONFIG_DIR:-$HOME/.gemini}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${GEMINI_CONFIG_DIR:-$HOME/.gemini}/pp-core/bin/${_PP_SHIM_NAME}"; elif [ -f "${COPILOT_CONFIG_DIR:-$HOME/.copilot}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${COPILOT_CONFIG_DIR:-$HOME/.copilot}/pp-core/bin/${_PP_SHIM_NAME}"; elif [ -f "${WINDSURF_CONFIG_DIR:-$HOME/.codeium/windsurf}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${WINDSURF_CONFIG_DIR:-$HOME/.codeium/windsurf}/pp-core/bin/${_PP_SHIM_NAME}"; elif [ -f "${AUGMENT_CONFIG_DIR:-$HOME/.augment}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${AUGMENT_CONFIG_DIR:-$HOME/.augment}/pp-core/bin/${_PP_SHIM_NAME}"; elif [ -f "${TRAE_CONFIG_DIR:-$HOME/.trae}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${TRAE_CONFIG_DIR:-$HOME/.trae}/pp-core/bin/${_PP_SHIM_NAME}"; elif [ -f "${QWEN_CONFIG_DIR:-$HOME/.qwen}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${QWEN_CONFIG_DIR:-$HOME/.qwen}/pp-core/bin/${_PP_SHIM_NAME}"; elif [ -f "${CODEBUDDY_CONFIG_DIR:-$HOME/.codebuddy}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${CODEBUDDY_CONFIG_DIR:-$HOME/.codebuddy}/pp-core/bin/${_PP_SHIM_NAME}"; elif [ -f "${CLINE_CONFIG_DIR:-$HOME/.cline}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${CLINE_CONFIG_DIR:-$HOME/.cline}/pp-core/bin/${_PP_SHIM_NAME}"; elif [ -f "${GROK_AGENTS_HOME:-$HOME/.agents}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${GROK_AGENTS_HOME:-$HOME/.agents}/pp-core/bin/${_PP_SHIM_NAME}"; elif [ -f "${ANTIGRAVITY_CONFIG_DIR:-$HOME/.gemini/antigravity}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${ANTIGRAVITY_CONFIG_DIR:-$HOME/.gemini/antigravity}/pp-core/bin/${_PP_SHIM_NAME}"; elif [ -f "${OPENCODE_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/opencode}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${OPENCODE_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/opencode}/pp-core/bin/${_PP_SHIM_NAME}"; elif [ -f "${KILO_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/kilo}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${KILO_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/kilo}/pp-core/bin/${_PP_SHIM_NAME}"; elif command -v pp-tools >/dev/null 2>&1; then PP_TOOLS="$(command -v pp-tools)"; else echo "ERROR: pp-tools.cjs not found at $PP_TOOLS and pp-tools is not on PATH. Run: npx -y @pareto4/pp-core@latest --claude --local" >&2; exit 1; fi; if [ -n "${CLAUDE_ENV_FILE:-}" ] && [ -n "${PP_TOOLS:-}" ]; then printf "export PATH='%s':\"\$PATH\"\n" "${PP_TOOLS%/*}" >> "$CLAUDE_ENV_FILE" 2>/dev/null || true; fi
 GRAN_PARAM=""; if [[ "$ARGUMENTS" =~ (^|[[:space:]])--granularity[[:space:]]+([^[:space:]-][^[:space:]]*) ]]; then GRAN_PARAM="--granularity ${BASH_REMATCH[2]}"; fi
-TIER_FLAG=$(printf '%s\n' "$ARGUMENTS" | grep -oE -- '--tier[[:space:]=]+(light|standard|heavy)' | head -1 | sed -E 's/^--tier[[:space:]=]+/--tier=/')
-INIT=$(pp_run query init.plan-phase "$PHASE" $GRAN_PARAM $TIER_FLAG)
+INIT=$(pp_run query init.plan-phase "$PHASE" $GRAN_PARAM)
 if [[ "$INIT" == @file:* ]]; then INIT=$(cat "${INIT#@file:}"); fi
 AGENT_SKILLS_RESEARCHER=$(pp_run query agent-skills pp-phase-researcher)
 AGENT_SKILLS_PLANNER=$(pp_run query agent-skills pp-planner)
@@ -90,8 +89,6 @@ Parse JSON for: `researcher_model`, `planner_model`, `checker_model`, `research_
 
 **If `response_language` is set:** Include `response_language: {value}` in all spawned subagent prompts so any user-facing output stays in the configured language.
 
-**Ceremony tier:** Read and follow `pp-core/workflows/plan-phase/steps/phase-tier.md` now; every `render-hooks` call below passes `--phase "$PHASE" $TIER_FLAG`.
-
 **File paths (for <files_to_read> blocks):** `state_path`, `roadmap_path`, `requirements_path`, `context_path`, `research_path`, `verification_path`, `uat_path`, `reviews_path`. These are null if files don't exist.
 
 **If `planning_exists` is false:** Error — run `/pp:init` first.
@@ -141,7 +138,7 @@ The gate fires only on `Complete`. `Executed` and `Needs Review` are not gated
 
 ## 2. Parse and Normalize Arguments
 
-Extract from $ARGUMENTS: phase number (integer or decimal like `2.1`), flags (`--research`, `--skip-research`, `--research-phase <N>`, `--gaps`, `--skip-verify`, `--skip-ui`, `--prd <filepath>`, `--ingest <path-or-glob>`, `--ingest-format <auto|nygard|madr|narrative>`, `--reviews`, `--text`, `--bounce`, `--skip-bounce`, `--chunked`, `--mvp`, `--tdd`, `--granularity <coarse|standard|fine>`, `--tier <light|standard|heavy>`, `--force` (override closed-phase gate, see §1.5), `--unattended`).
+Extract from $ARGUMENTS: phase number (integer or decimal like `2.1`), flags (`--research`, `--skip-research`, `--research-phase <N>`, `--gaps`, `--skip-verify`, `--skip-ui`, `--prd <filepath>`, `--ingest <path-or-glob>`, `--ingest-format <auto|nygard|madr|narrative>`, `--reviews`, `--text`, `--bounce`, `--skip-bounce`, `--chunked`, `--mvp`, `--tdd`, `--granularity <coarse|standard|fine>`, `--force` (override closed-phase gate, see §1.5), `--unattended`).
 
 **`--research-phase <N>` — research-only mode (#3042 + #3044).** When this flag is present, parse `<N>` as the phase number (overrides any positional phase argument), set `RESEARCH_ONLY=true`, and treat the rest of this workflow as a research-dispatch only — the planner spawn (step 8), plan-checker, verification, gaps, bounce, and post-planning-gaps blocks all skip on `RESEARCH_ONLY`. Use this for cross-phase research, doc review before committing to a planning approach, and correction-without-replanning loops. Replaces the deleted `/pp-research-phase` command.
 
@@ -430,10 +427,6 @@ If `AI_SPEC_FILE` is non-empty, pass `AI_SPEC_PATH` and `FRAMEWORK_LINE` to the
 
 ## 5. Handle Research
 
-### 5.00. plan:pre vault load — ALWAYS, before the skip rule below
-
-Every path runs this before any agent: `PLAN_PRE_HOOKS_JSON=${PLAN_PRE_HOOKS_JSON:-$(pp_run loop render-hooks plan:pre --raw --phase "$PHASE" $TIER_FLAG)} || exit 1`. Then Read and execute `pp-core/workflows/execute-phase/steps/vault-fetch.md` (active only for a `capId == "vault"` step hook; writes `.planning/vault/SUMMARY.md`; `onError:skip`). Then, if an active plan:pre gate has `check.query == "vault.status"`, set `VAULT_GATE_POINT=plan` and Read and execute `pp-core/workflows/execute-phase/steps/vault-load-gate.md` — it relays the CLI's vault card and acts on its `action` only (`stop` halts planning in every mode; `confirm` asks, or logs under --auto/--chain). Skip silently when neither hook is active.
-
 **Skip if:** `--gaps` flag or `--skip-research` flag or `--reviews` flag.
 
 ### 5.0. Research-Only Modifiers (`--view`, `--research`)
@@ -501,10 +494,32 @@ fi
 ```bash
 PHASE_DESC=$(pp_run query roadmap.get-phase "${PHASE}" --pick section)
 if [ -z "${PLAN_PRE_HOOKS_JSON:-}" ]; then
-  PLAN_PRE_HOOKS_JSON=$(pp_run loop render-hooks plan:pre --raw --phase "$PHASE" $TIER_FLAG) || exit 1
+  PLAN_PRE_HOOKS_JSON=$(pp_run loop render-hooks plan:pre --raw)
 fi
 ```
 
+### plan:pre vault fetch + summary
+
+Reached on **every** path through §5.1 — including the exits that reuse an existing RESEARCH.md or skip research. Those skip the researcher spawn, not this section: the vault load is not conditional on research. Scope: paths through §5.1 only — §5.0's research-only exits leave the workflow before §5.1 runs and are not build paths.
+
+**Admission first (D-28, D-05):** a config the gate cannot read renders no vault hook at all, so this runs before the render; without bindings it is inert.
+
+```bash
+VAULT_ADMIT_PRESENT=$(pp_run query platform-bindings --pick present 2>/dev/null || echo true)
+VAULT_ADMIT=inert
+if [ "$VAULT_ADMIT_PRESENT" = true ]; then VAULT_ADMIT=$(pp_run vault admission 2>/dev/null || echo unrecognised); fi
+case "$VAULT_ADMIT" in on) echo "VAULT_ADMIT=on" ;; off|inert) : ;; *) pp_run vault admission --explain; echo "PARETO_GATE_BLOCKED:vault.admission"; exit 1 ;; esac
+```
+
+```bash
+PLAN_PRE_HOOKS_JSON=${PLAN_PRE_HOOKS_JSON:-$(pp_run loop render-hooks plan:pre --raw)}
+printf '%s' "$PLAN_PRE_HOOKS_JSON" | node -e "let h=[];try{h=JSON.parse(require('fs').readFileSync(0,'utf-8')).activeHooks||[]}catch{}console.log('PLAN_PRE_HOOKS_JSON='+JSON.stringify({activeHooks:h}))"
+```
+
+Set `VAULT_FETCH_HOOKS_JSON=$PLAN_PRE_HOOKS_JSON`.
+
+Read and execute `pp-core/workflows/execute-phase/steps/vault-fetch.md` — the bespoke plan:pre vault fetch + summary dispatch (active only for a `capId == "vault"` step hook; produces `.planning/vault/SUMMARY.md` for the researcher/planner read paths; `onError:skip`). Skip silently when none.
+
 ### into:researcher contributions
 
 In `PLAN_PRE_HOOKS_JSON`, read active plan:pre entries where `kind == "contribution"` and `into == "researcher"` (in array order). If none, inject nothing. If present, append each entry's `fragment.inline` verbatim to `filled_research_hook_fragment` (or add it as a `<files_to_read>`/context line in the researcher prompt) — typically a pointer to `.planning/vault/SUMMARY.md` (the bounded vault index). Inject verbatim — do not paraphrase.
@@ -584,7 +599,7 @@ test -f "${PHASE_DIR}/${PADDED_PHASE}-VALIDATION.md" && echo "VALIDATION_CREATED
 > Capability-driven dispatch. Resolves active `plan:pre` hooks via the capability registry; the security hook's `when` condition is evaluated by the registry.
 
 ```bash
-PLAN_PRE_HOOKS_JSON=$(pp_run loop render-hooks plan:pre --raw --phase "$PHASE" $TIER_FLAG) || exit 1
+PLAN_PRE_HOOKS_JSON=$(pp_run loop render-hooks plan:pre --raw)
 ```
 
 Resolve active contribution hooks from `PLAN_PRE_HOOKS_JSON` where `kind == "contribution"` and `capId == "security"`.
@@ -614,11 +629,12 @@ Continue to step 5.6. Security config is passed to the planner in step 8.
 > **Config semantics (cutover fix):** `workflow.ui_phase` gates UI-SPEC *generation* (step); `workflow.ui_safety_gate` gates the *planning block* (gate). Both-on = identical to OLD §5.6. Intended change: `{ui_phase:true, ui_safety_gate:false}` now auto-generates in pipelines but does NOT block manual planning (each key controls exactly what its description says).
 
 ```bash
-PLAN_PRE_HOOKS_JSON=${PLAN_PRE_HOOKS_JSON:-$(pp_run loop render-hooks plan:pre --raw --phase "$PHASE" $TIER_FLAG)} || exit 1
+PLAN_PRE_HOOKS_JSON=${PLAN_PRE_HOOKS_JSON:-$(pp_run loop render-hooks plan:pre --raw)}
+printf '%s' "$PLAN_PRE_HOOKS_JSON" | node -e "let h=[];try{h=JSON.parse(require('fs').readFileSync(0,'utf-8')).activeHooks||[]}catch{}console.log('PLAN_PRE_HOOKS_JSON='+JSON.stringify({activeHooks:h}))"
 HOOKS_JSON="$PLAN_PRE_HOOKS_JSON"
 ```
 
-Read the `activeHooks` array directly from `PLAN_PRE_HOOKS_JSON` / `HOOKS_JSON` (in-context — do NOT invoke a shell pipeline).
+Read the `activeHooks` array directly from the printed `PLAN_PRE_HOOKS_JSON=` line (in-context — do NOT invoke a shell pipeline).
 
 **Branch 1 — all plan:pre hooks inactive (`activeHooks` is empty or absent):** Skip to step 6.
 
@@ -686,11 +702,30 @@ Output this markdown directly (not as a code block):
 ───────────────────────────────────────────────
 Also available:
 - `/pp:plan-phase {N} --skip-ui ${GSD_WS}` — plan without UI-SPEC (not recommended for frontend phases)
-- Not a UI phase? Matched: {GATE.tokens}. Add `**UI:** none` on its own line in the ROADMAP phase section.
 ```
 
 **Exit the plan-phase workflow. Do not continue.**
 
+### plan:pre vault gate — enforce, then render
+
+Reached on **every** path through §5.6. Branches 1-5 skip the UI work, not this section: their "skip/continue to step 6" passes THROUGH this section and the render sentence below it on the way to `## 6.`. Only Branch 6's explicit **EXIT the plan-phase workflow** stops before it. A §5.1-originating "skip to step 6" (use existing, or Skip research) likewise passes THROUGH the fetch section above and this section on its way to `## 6.`.
+A researcher-return "continue to step 6" (the `## RESEARCH COMPLETE` arm) and a §5.5-originating "continue to step 6" (the research-disabled warning arm and the Nyquist-not-applicable arm) likewise pass THROUGH the fetch section above and this section on their way to `## 6.`.
+
+**Admission again (D-28):** `--gaps`, `--skip-research` and `--reviews` skip §5, fetch section included, so the same check runs here before the gate lookup.
+
+```bash
+VAULT_ADMIT_PRESENT=$(pp_run query platform-bindings --pick present 2>/dev/null || echo true)
+VAULT_ADMIT=inert
+if [ "$VAULT_ADMIT_PRESENT" = true ]; then VAULT_ADMIT=$(pp_run vault admission 2>/dev/null || echo unrecognised); fi
+case "$VAULT_ADMIT" in on) echo "VAULT_ADMIT=on" ;; off|inert) : ;; *) pp_run vault admission --explain; echo "PARETO_GATE_BLOCKED:vault.admission"; exit 1 ;; esac
+```
+
+In `PLAN_PRE_HOOKS_JSON` (already loaded), find active plan:pre entries where `kind == "gate"` and `check.query == "vault.status"`. If none, skip silently to step 6.
+
+**Enforce first.** §5.6 already ran `ui.plan-gate` with its own positional and owns its outcome (Branch 6 blocks in manual mode; Branch 5 continues), so skip that entry — the enforcer never sees it. Set `GATE_POINT=plan:pre`, `GATE_HOOKS_JSON=$PLAN_PRE_HOOKS_JSON`, leave `GATE_POSITIONAL_ARG` empty deliberately (`vault.status` reads project state, not a phase; every plan:pre gate needing one is caller-handled — D-VH-7), then Read `pp-core/workflows/execute-phase/steps/check-query-gate.md` — the single generic enforcer (GATE-02); it owns the halt.
+
+**Then render.** If still running, set `VAULT_GATE_POINT=plan` and Read `pp-core/workflows/execute-phase/steps/vault-load-gate.md` — it surfaces the §8 load-state message and decides nothing.
+
 ## 6. Check Existing Plans
 
 ```bash
@@ -816,7 +851,7 @@ Continue to step 8.
 Run this Bash command to emit the branded Plan stage banner (renders on stderr, auto-degrades on non-TTY — do NOT print an inline ASCII banner, that would double-print):
 ```bash
 pp_run banner plan "PLANNING PHASE {X}"
-touch "${PHASE_DIR}/.planner-run-mark"   # the threat-model gate examines only newer plans
+touch "${PHASE_DIR}/.planner-run-mark"   # step 9d examines only plans newer than this
 ```
 
 Then announce the spawn:
@@ -970,7 +1005,7 @@ Read and execute `pp-core/workflows/plan-phase/steps/chunked-planning.md` — th
 
 ## 9. Handle Planner Return
 
-- **`## PLANNING COMPLETE`:** Display plan count, then run "After planning" in `plan-phase/steps/phase-tier.md`. If `--skip-verify` or `plan_checker_enabled` is false (from init): skip to step 13. Otherwise: step 10.
+- **`## PLANNING COMPLETE`:** Run the step 9d gate first. Then display plan count. If `--skip-verify` or `plan_checker_enabled` is false (from init): skip to step 13. Otherwise: step 10.
 - **`## PHASE SPLIT RECOMMENDED`:** The planner determined the phase exceeds the context budget for full-fidelity implementation of all source items. Handle in step 9b.
 - **`## ⚠ Source Audit: Unplanned Items Found`:** The planner's multi-source coverage audit found items from REQUIREMENTS.md, RESEARCH.md, ROADMAP goal, or CONTEXT.md decisions that are not covered by any plan. Handle in step 9c.
 - **`## CHECKPOINT REACHED`:** Present to user, get response, spawn continuation (step 12) (U-P4 — hard stop)
@@ -1065,6 +1100,33 @@ Use AskUserQuestion for each gap (or batch if multiple gaps) (U-P7).
 **If "Split":** Use `/pp:phase --insert` for overflow items, then replan.
 **If "Defer":** Record in CONTEXT.md `## Deferred Ideas` with developer's confirmation. Proceed to step 10.
 
+## 9d. Threat Model Presence Gate
+
+> Mechanical post-planner check. Active only when the security capability's `plan:pre` contribution is active — the same hook step 5.55 banners on; otherwise it prints `false` and changes nothing. Runs on every `## PLANNING COMPLETE` (including plans accepted through step 9a) before step 10 or step 13.
+
+```bash
+PLAN_PRE_HOOKS_JSON=${PLAN_PRE_HOOKS_JSON:-$(pp_run loop render-hooks plan:pre --raw)}
+SEC_ON=$(printf '%s' "$PLAN_PRE_HOOKS_JSON" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const h=JSON.parse(s||"{}").activeHooks||[];process.stdout.write(h.some(x=>x.kind==="contribution"&&x.capId==="security")?"true":"false")})')
+MARK="${PHASE_DIR}/.planner-run-mark"
+[ -f "$MARK" ] || touch -t 197001010000 "$MARK"
+NO_TM=""
+if [ "$SEC_ON" = "true" ]; then
+  for p in $(find "${PHASE_DIR}" -maxdepth 1 -name '*-PLAN.md' -newer "$MARK" | sort); do
+    grep -q '<threat_model>' "$p" || NO_TM="${NO_TM} ${p##*/}"
+  done
+fi
+echo "THREAT_MODEL_GATE=${SEC_ON}${NO_TM:+ MISSING:${NO_TM}}"
+```
+
+**If the output carries `MISSING:`:** STOP. Do not proceed to step 10 or step 13. Display:
+
+```text
+✗ Security enforcement is active, but these plans carry no <threat_model> block: {NO_TM}
+  Remedy: re-spawn the planner (step 8) with the block required for each plan named above, then re-run this gate.
+```
+
+**Otherwise:** continue with the step 9 branch (`false` means the security contribution is inactive and this gate examined nothing).
+
 ## 10. Spawn pp-plan-checker Agent
 
 Display banner:
@@ -1172,17 +1234,17 @@ Offer 3 options (U-P9):
 
 **If `DISK_PLANS` is 0:** No plans on disk — something is seriously wrong. Display error and stop.
 
-## 12. Revision Loop (Max `plan_check_passes` Iterations, from init)
+## 12. Revision Loop (Max 3 Iterations)
 
 Track `iteration_count` (starts at 1 after initial plan + check).
 Track `prev_issue_count` (initialized to `Infinity` before the loop begins).
 Track `stall_reentry_count` (starts at 0; incremented each time "Adjust approach" re-enters step 8).
 
-**If iteration_count < plan_check_passes:**
+**If iteration_count < 3:**
 
 Parse issue count from checker return: count BLOCKER + WARNING entries in the YAML issues block (structured output from pp-plan-checker). If the checker's return contains no YAML issues block (i.e., the plan was approved with no issues), treat `issue_count` as 0 and skip the stall check — the plan passed. Proceed to step 13.
 
-Display: `Revision iteration {N}/{plan_check_passes} -- {blocker_count} blockers, {warning_count} warnings`
+Display: `Revision iteration {N}/3 -- {blocker_count} blockers, {warning_count} warnings`
 
 **Stall detection (U-P16):** If `issue_count >= prev_issue_count`:
   Display: `Revision loop stalled — issue count not decreasing ({issue_count} issues remain after {N} iterations)`
@@ -1241,7 +1303,7 @@ Agent(
 
 After planner returns -> spawn checker again (step 10), increment iteration_count.
 
-**If iteration_count >= plan_check_passes:**
+**If iteration_count >= 3:**
 
 Display: `Max iterations reached. {N} issues remain:` + issue list
 
@@ -1251,7 +1313,7 @@ Offer: 1) Force proceed, 2) Provide guidance and retry, 3) Abandon (U-P10)
 
 **Skip if:** `--skip-bounce` flag, `--gaps` flag, or bounce is not activated.
 
-**Activation:** Bounce runs when `--bounce` flag is present OR `plan_bounce_enabled` (init, tier-resolved) is `true`. The `--skip-bounce` flag always wins (disables bounce even if config enables it). The `--gaps` flag also disables bounce (gap-closure mode should not modify plans externally).
+**Activation:** Bounce runs when `--bounce` flag is present OR `workflow.plan_bounce` config is `true`. The `--skip-bounce` flag always wins (disables bounce even if config enables it). The `--gaps` flag also disables bounce (gap-closure mode should not modify plans externally).
 
 **Prerequisites:** `workflow.plan_bounce_script` must be set to a valid script path. If bounce is activated but no script is configured, display warning and skip:
 ```
@@ -1477,31 +1539,22 @@ Proactive, non-blocking coverage report gated on `workflow.post_planning_gaps`
 `<decisions>` and cross-references each REQ-ID / D-ID against `${PHASE_DIR}/*-PLAN.md`.
 
 ```bash
-PLAN_POST_HOOKS_JSON=$(pp_run loop render-hooks plan:post --raw --phase "$PHASE" $TIER_FLAG) || exit 1
-TRACE_GATE_JSON=$(pp_run loop run-gates plan:post --phase "$PHASE" $TIER_FLAG --query vault.trace) || exit 1
+PLAN_POST_HOOKS_JSON=$(pp_run loop render-hooks plan:post --raw)
+printf '%s' "$PLAN_POST_HOOKS_JSON" | node -e "let h=[];try{h=JSON.parse(require('fs').readFileSync(0,'utf-8')).activeHooks||[]}catch{}console.log('PLAN_POST_HOOKS_JSON='+JSON.stringify({activeHooks:h}))"
 PHASE_REQ_IDS=$(pp_run query init.plan-phase "$PHASE" --pick phase_req_ids 2>/dev/null || echo TBD)
-```
-
-The `run-gates` line runs the blocking `vault.trace` gate (vault practices on) and owns its halt: exit 1 (a `⛔` line) stops planning here — relay it verbatim and do not present the plans as ready. Read the `activeHooks` array from `PLAN_POST_HOOKS_JSON` in-context. If the
-`gap-analysis` gate hook is absent (capability inactive), skip the rest of this step.
-
-**For each active entry where `kind == "gate"`** except `check.query == "vault.trace"` (run above), in array order:
-
-```bash
-GATE_RESULT=$(pp_run check ${hook.check.query} "${PHASE_DIR}" "${PHASE_REQ_IDS}" --raw)
-CHECK_EXIT=$?
-```
-
-**Step 1 — did the CHECK COMMAND itself succeed?**
-If the check command failed (non-zero `CHECK_EXIT`, empty output, or unparseable JSON):
-- `onError == "halt"` → halt and surface command error.
-- `onError == "skip"` → log a warning and continue to the next hook.
-
-**Step 2 — read `GATE_RESULT.block` (boolean).** Only reached when command succeeded.
-
-- If `hook.blocking == true` and `GATE_RESULT.block == true`: halt. (gap-analysis is always `blocking: false` so this branch is informational only.)
-- If `hook.blocking == false` (advisory): if `GATE_RESULT.block == true` or non-empty `table`/`summary`, output the gap table and continue. Advisory gates never block phase completion.
-- If `hook.blocking == true` and `GATE_RESULT.block == false`: continue silently.
+echo "PHASE_REQ_IDS=$PHASE_REQ_IDS"
+```
+
+Set `GATE_POINT=plan:post`, `GATE_HOOKS_JSON=$PLAN_POST_HOOKS_JSON`,
+`GATE_POSITIONAL_ARG="${PHASE_DIR}"`, `GATE_POSITIONAL_ARG_2="${PHASE_REQ_IDS}"`, `GATE_STAGE=plan`
+— this point validates plan artifacts, and without the scope the trace gate would demand an
+execute-stage trace from every historical SUMMARY.md in the phase directory, hard-halting any re-plan
+of an executed phase — and `GATE_WS` to the
+active workstream name (empty in flat mode), then Read and
+follow `pp-core/workflows/execute-phase/steps/check-query-gate.md` — the single generic `check.query`
+gate enforcer already used at `plan:pre`, `execute:pre` and `execute:post` (GATE-02, D-VH-7). It
+dispatches every active gate entry at this point, not only gap-analysis, and owns the two-step
+contract, the halt and the message passthrough. Do not restate its loop here.
 
 ## 14. Present Final Status
 

package/pp-core/workflows/quick.md

@@ -38,6 +38,7 @@ Parse `$ARGUMENTS` for:
 - `--validate` flag → store `$VALIDATE_MODE=true`
 - `--discuss` flag → store `$DISCUSS_MODE=true`
 - `--research` flag → store `$RESEARCH_MODE=true`
+- `--from-debug <slug>` → store `$FROM_DEBUG_SLUG` (D-08: `debug.md` hands a confirmed root cause to a quick task). Sanitise it exactly as `debug.md` does: strip whitespace, reject unless it matches `^[a-z0-9][a-z0-9-]*$`, max 30 chars, reject any `..`, `/` or `\`; if invalid, print `Invalid --from-debug slug` and stop. If `.planning/debug/${FROM_DEBUG_SLUG}.md` does not exist, print `No debug session found with slug: ${FROM_DEBUG_SLUG}` and stop. Otherwise Steps 5 and 6 add that file to the planner's and the executor's reading lists; nothing else changes.
 - Remaining text → use as `$DESCRIPTION` if non-empty
 
 After parsing, normalize: if `$DISCUSS_MODE` and `$RESEARCH_MODE` and `$VALIDATE_MODE` are all true, set `$FULL_MODE=true`. This ensures `--discuss --research --validate` is treated identically to `--full`.
@@ -176,7 +177,49 @@ Quick tasks can run mid-phase - validation only checks ROADMAP.md exists, not ph
 
 ---
 
-**Step 2.4: Vault door gate** — Step 2.5 is the first write. Read and execute `pp-core/workflows/execute-phase/steps/vault-door-gate.md` now; a stop ends the quick task before anything is written.
+**Step 2.4: Vault admission and load gate**
+
+Runs here because Step 2.5 is the first step that writes anything — it creates the quick-task branch
+— and the gate has to decide before code can be written, not after.
+
+Quick renders the loop points' own hooks (`plan:pre` here, `plan:post` in Step 5.55, `execute:pre`
+for the executor prompt, `execute:post` in Step 6.1) and keeps only the `vault` and
+`vault-practices` hooks, mechanically in each fence (D-30): no other capability's gate, step or
+fragment is run or injected by quick. Mode filtering, the practices switch and the seal gates
+therefore reach quick with no second copy of any rule (D-01). The renders pass no `--ws`: every
+`pp_run` call here resolves the same workstream ladder as the admission verb, and each trace gate's
+positional is the quick directory, which carries its own partition (D-73).
+
+Admission first (D-28): bindings first, then every config file the gate reads is parsed. With
+bindings present, a config the gate cannot read halts here, naming the file and the repair (D-05).
+
+```bash
+VAULT_ADMIT_PRESENT=$(pp_run query platform-bindings --pick present 2>/dev/null || echo true)
+VAULT_ADMIT=inert
+if [ "$VAULT_ADMIT_PRESENT" = true ]; then VAULT_ADMIT=$(pp_run vault admission 2>/dev/null || echo unrecognised); fi
+case "$VAULT_ADMIT" in on) echo "VAULT_ADMIT=on" ;; off|inert) : ;; *) pp_run vault admission --explain; echo "PARETO_GATE_BLOCKED:vault.admission"; exit 1 ;; esac
+```
+
+**If the fence printed no `VAULT_ADMIT=on` line** (`off` and `inert` print nothing): skip the rest of this step and the vault sub-steps below
+(the planner fragments, Step 5.55, the anchor and executor fragments in Step 6, Step 6.1) silently
+and continue to Step 2.5. Print nothing: a non-Pareto or `vault.enabled=false` project runs this
+workflow byte-identically to how it ran before this gate existed (GATE-04).
+
+**Otherwise, fetch and load-gate at `plan:pre`:**
+
+```bash
+QUICK_PLAN_PRE_HOOKS_JSON=$(pp_run loop render-hooks plan:pre --raw | node -e "const d=require('fs').readFileSync(0,'utf-8');try{const j=JSON.parse(d);j.activeHooks=(j.activeHooks||[]).filter((x)=>x&&(x.capId==='vault'||x.capId==='vault-practices'));process.stdout.write(JSON.stringify(j));}catch{process.stdout.write('');}")
+printf '%s' "$QUICK_PLAN_PRE_HOOKS_JSON" | node -e "let h=[];try{h=JSON.parse(require('fs').readFileSync(0,'utf-8')).activeHooks||[]}catch{}console.log('QUICK_PLAN_PRE_HOOKS_JSON='+JSON.stringify({activeHooks:h}))"
+```
+
+Set `VAULT_FETCH_HOOKS_JSON=$QUICK_PLAN_PRE_HOOKS_JSON`, then Read and execute
+`pp-core/workflows/execute-phase/steps/vault-fetch.md` (hook mode). Then, in the
+`QUICK_PLAN_PRE_HOOKS_JSON=` line that fence printed, find active entries where `kind == "gate"` and `check.query ==
+"vault.status"`; if none, skip silently. Otherwise set `GATE_POINT=plan:pre` and
+`GATE_HOOKS_JSON=$QUICK_PLAN_PRE_HOOKS_JSON`, leave `GATE_POSITIONAL_ARG`, `GATE_WS` and
+`GATE_STAGE` empty (`vault.status` reads project state), then Read and follow
+`pp-core/workflows/execute-phase/steps/check-query-gate.md`. That single enforcer (GATE-02) owns the
+two-step contract, the halt and the message passthrough; none of them are restated here.
 
 ---
 
@@ -464,6 +507,16 @@ If research file not found, warn but continue: "Research agent did not produce o
 
 **If NOT `$VALIDATE_MODE`:** Use standard `quick` mode.
 
+Vault fragments for the planner: the `plan:pre` contributions `into: planner`, re-rendered and
+filtered in this fence (a shell variable from Step 2.4 does not survive into this call). Skip unless
+Step 2.4 printed `VAULT_ADMIT=on`. The fence prints the fragments; put that printed text verbatim where
+the prompt says `${QUICK_PLANNER_HOOK_FRAGMENTS}` (nothing when it printed nothing).
+
+```bash
+QUICK_PLANNER_HOOK_FRAGMENTS=$(pp_run loop render-hooks plan:pre --raw | node -e "const d=require('fs').readFileSync(0,'utf-8');try{const j=JSON.parse(d);j.activeHooks=(j.activeHooks||[]).filter((x)=>x&&(x.capId==='vault'||x.capId==='vault-practices'));process.stdout.write(JSON.stringify(j));}catch{process.stdout.write('');}" | node -e "const d=require('fs').readFileSync(0,'utf-8');try{const h=(JSON.parse(d).activeHooks||[]).filter((x)=>x&&x.kind==='contribution'&&x.into==='planner'&&x.fragment&&typeof x.fragment.inline==='string');process.stdout.write(h.map((x)=>x.fragment.inline).join('\n\n'));}catch{process.stdout.write('');}")
+if [ -n "$QUICK_PLANNER_HOOK_FRAGMENTS" ]; then printf '%s\n' "$QUICK_PLANNER_HOOK_FRAGMENTS"; fi
+```
+
 Display: `◆ Spawning planner... (runs in a subagent — no output until it returns, ~1–5 min; expected, not a freeze)`
 
 ```
@@ -480,10 +533,13 @@ Agent(
 - ./CLAUDE.md or ./.claude/CLAUDE.md (if exists — follow project-specific guidelines)
 ${DISCUSS_MODE ? '- ' + QUICK_DIR + '/' + quick_id + '-CONTEXT.md (User decisions — locked, do not revisit)' : ''}
 ${RESEARCH_MODE ? '- ' + QUICK_DIR + '/' + quick_id + '-RESEARCH.md (Research findings — use to inform implementation choices)' : ''}
+${FROM_DEBUG_SLUG ? '- .planning/debug/' + FROM_DEBUG_SLUG + '.md (Debug session from --from-debug — the confirmed root cause this task fixes)' : ''}
 </files_to_read>
 
 ${AGENT_SKILLS_PLANNER}
 
+${QUICK_PLANNER_HOOK_FRAGMENTS}
+
 **Project skills:** Check .claude/skills/ or .agents/skills/ directory (if either exists) — read SKILL.md files, plans should account for project skill rules
 
 </planning_context>
@@ -633,6 +689,26 @@ Offer: 1) Force proceed, 2) Abort
 
 ---
 
+**Step 5.55: plan:post trace gate (runs before Step 5.6)**
+
+Skip silently unless Step 2.4 printed `VAULT_ADMIT=on`. Runs after the planner (and the checker under
+`$VALIDATE_MODE`) and BEFORE Step 5.6, so a malformed or absent record halts the task with nothing
+committed and no executor spawned (D-02, D-34).
+
+```bash
+QUICK_PLAN_POST_HOOKS_JSON=$(pp_run loop render-hooks plan:post --raw | node -e "const d=require('fs').readFileSync(0,'utf-8');try{const j=JSON.parse(d);j.activeHooks=(j.activeHooks||[]).filter((x)=>x&&(x.capId==='vault'||x.capId==='vault-practices'));process.stdout.write(JSON.stringify(j));}catch{process.stdout.write('');}")
+printf '%s' "$QUICK_PLAN_POST_HOOKS_JSON" | node -e "let h=[];try{h=JSON.parse(require('fs').readFileSync(0,'utf-8')).activeHooks||[]}catch{}console.log('QUICK_PLAN_POST_HOOKS_JSON='+JSON.stringify({activeHooks:h}))"
+```
+
+In the `QUICK_PLAN_POST_HOOKS_JSON=` line that fence printed, find active entries where `kind == "gate"` and `check.query ==
+"vault.trace"`; if none, skip silently. Otherwise set `GATE_POINT=plan:post`,
+`GATE_HOOKS_JSON=$QUICK_PLAN_POST_HOOKS_JSON`, `GATE_POSITIONAL_ARG="${QUICK_DIR}"` and
+`GATE_STAGE=plan` (the plan stage, tolerant: nothing has run yet, D-03), leave `GATE_WS` empty (a
+quick directory carries its own partition), then Read and follow
+`pp-core/workflows/execute-phase/steps/check-query-gate.md`; it owns the halt.
+
+---
+
 **Step 5.6: Pre-dispatch plan commit (worktree mode only)**
 
 When `USE_WORKTREES !== "false"`, commit PLAN.md to the current branch **before** spawning the executor. This ensures the worktree inherits PLAN.md at its branch HEAD so the executor can read it via a worktree-rooted path — avoiding the main-repo path priming that triggers CC #36182 path-resolution drift.
@@ -674,9 +750,10 @@ fi
 
 **Step 6: Spawn executor**
 
-Capture current HEAD before spawning (used for worktree branch check):
+Capture current HEAD before spawning (used for worktree branch check, and as the vault START anchor):
 ```bash
 EXPECTED_BASE=$(git rev-parse HEAD)
+pp_run vault anchor start "${QUICK_DIR}" --raw
 if [ "${USE_WORKTREES:-true}" != "false" ]; then
   QUICK_WORKTREE_MANIFEST=$(mktemp "${TMPDIR:-/tmp}/pp-quick-worktree-XXXXXX.json")
   printf '{"worktrees":[]}\n' > "$QUICK_WORKTREE_MANIFEST"
@@ -684,6 +761,20 @@ if [ "${USE_WORKTREES:-true}" != "false" ]; then
 fi
 ```
 
+`vault anchor start` records HEAD (this `EXPECTED_BASE`) as the quick directory's START anchor
+(D-31); the executor's record verb reads it, so the SUMMARY carries start and end. The verb prints
+nothing and writes nothing unless `vault admission` answers `on`, so it needs no guard.
+
+Vault fragments for the executor: the `execute:pre` contributions `into: executor`, from a filtered
+render (never the unfiltered `--into` form of the render, which no capability filter narrows). Skip unless
+Step 2.4 printed `VAULT_ADMIT=on`. The fence prints the fragments; put that printed text verbatim where the
+prompt says `${QUICK_EXECUTOR_HOOK_FRAGMENTS}` (nothing when it printed nothing).
+
+```bash
+QUICK_EXECUTOR_HOOK_FRAGMENTS=$(pp_run loop render-hooks execute:pre --raw | node -e "const d=require('fs').readFileSync(0,'utf-8');try{const j=JSON.parse(d);j.activeHooks=(j.activeHooks||[]).filter((x)=>x&&(x.capId==='vault'||x.capId==='vault-practices'));process.stdout.write(JSON.stringify(j));}catch{process.stdout.write('');}" | node -e "const d=require('fs').readFileSync(0,'utf-8');try{const h=(JSON.parse(d).activeHooks||[]).filter((x)=>x&&x.kind==='contribution'&&x.into==='executor'&&x.fragment&&typeof x.fragment.inline==='string');process.stdout.write(h.map((x)=>x.fragment.inline).join('\n\n'));}catch{process.stdout.write('');}")
+if [ -n "$QUICK_EXECUTOR_HOOK_FRAGMENTS" ]; then printf '%s\n' "$QUICK_EXECUTOR_HOOK_FRAGMENTS"; fi
+```
+
 Spawn pp-executor with plan reference:
 
 ```
@@ -717,10 +808,13 @@ MANDATORY: load every file listed here with the Read tool before you start the w
 - .planning/STATE.md (Project state)
 - ./CLAUDE.md or ./.claude/CLAUDE.md (Project instructions, if exists)
 - .claude/skills/ or .agents/skills/ (Project skills, if either exists — list skills, read SKILL.md for each, follow relevant rules during implementation)
+${FROM_DEBUG_SLUG ? '- .planning/debug/' + FROM_DEBUG_SLUG + '.md (Debug session from --from-debug — the confirmed root cause this task fixes)' : ''}
 </files_to_read>
 
 ${AGENT_SKILLS_EXECUTOR}
 
+${QUICK_EXECUTOR_HOOK_FRAGMENTS}
+
 <submodule_commit_guard>
 SUBMODULE_PATHS for this project: ${SUBMODULE_PATHS}
 
@@ -806,13 +900,33 @@ Note: For quick tasks producing multiple plans (rare), spawn executors in parall
 
 ---
 
+**Step 6.1: execute:post trace gate**
+
+Skip silently unless Step 2.4 printed `VAULT_ADMIT=on`. Strict, because a quick task is complete here: one plan,
+one SUMMARY, nothing pending (D-03). Runs before code review, verification and the STATE.md update,
+so a blocked task never gets a STATE.md row and never reaches the final commit (D-34); task commits
+the executor already made stay in history, and the SEAL-01 check names them (D-02).
+
+```bash
+QUICK_EXECUTE_POST_HOOKS_JSON=$(pp_run loop render-hooks execute:post --raw | node -e "const d=require('fs').readFileSync(0,'utf-8');try{const j=JSON.parse(d);j.activeHooks=(j.activeHooks||[]).filter((x)=>x&&(x.capId==='vault'||x.capId==='vault-practices'));process.stdout.write(JSON.stringify(j));}catch{process.stdout.write('');}")
+printf '%s' "$QUICK_EXECUTE_POST_HOOKS_JSON" | node -e "let h=[];try{h=JSON.parse(require('fs').readFileSync(0,'utf-8')).activeHooks||[]}catch{}console.log('QUICK_EXECUTE_POST_HOOKS_JSON='+JSON.stringify({activeHooks:h}))"
+```
+
+In the `QUICK_EXECUTE_POST_HOOKS_JSON=` line that fence printed, find active entries where `kind == "gate"` and `check.query ==
+"vault.trace"`; if none, skip silently. Otherwise set `GATE_POINT=execute:post`,
+`GATE_HOOKS_JSON=$QUICK_EXECUTE_POST_HOOKS_JSON`, `GATE_POSITIONAL_ARG="${QUICK_DIR}"` and
+`GATE_UNPAIRED=strict`, leave `GATE_STAGE` and `GATE_WS` empty, then Read and follow
+`pp-core/workflows/execute-phase/steps/check-query-gate.md`; it owns the halt.
+
+---
+
 **Step 6.25: Code review (auto)**
 
 Skip this step entirely if `$FULL_MODE` is false.
 
 **Capability gate:**
 ```bash
-EXECUTE_POST_HOOKS_JSON=$(pp_run loop render-hooks execute:post --raw) || exit 1
+EXECUTE_POST_HOOKS_JSON=$(pp_run loop render-hooks execute:post --raw)
 ```
 
 Resolve active step hooks from `EXECUTE_POST_HOOKS_JSON` where `kind == "step"` and `ref.skill == "code-review"`.

package/pp-core/workflows/secure-phase.md

@@ -26,7 +26,7 @@ Parse: `phase_dir`, `phase_number`, `phase_name`, `phase_slug`, `padded_phase`.
 
 ```bash
 AUDITOR_MODEL=$(pp_run query resolve-model pp-security-auditor --raw)
-VERIFY_POST_HOOKS_JSON=$(pp_run loop render-hooks verify:post --raw) || exit 1
+VERIFY_POST_HOOKS_JSON=$(pp_run loop render-hooks verify:post --raw)
 ```
 
 Resolve active step hooks from `VERIFY_POST_HOOKS_JSON` where `kind == "step"` and `ref.skill == "secure-phase"`.