@polymorphism-tech/morph-spec 4.3.6 → 4.5.0

package/docs/plans/2026-02-22-morph-cc-alignment-impl.md

@@ -0,0 +1,728 @@
+# Claude Code Native Alignment — Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.
+
+**Goal:** Implement all actionable improvements from the CC native alignment analysis: fix a broken SubagentStart hook, convert bash validation to a prompt-type hook, inject active feature spec into session context, add `$ARGUMENTS` support to phase skills, add `disable-model-invocation` + `context: fork` where appropriate, and convert level-2-domain specialists from skills to native Claude Code subagents.
+
+**Architecture:** The changes touch hooks-installer.js (MORPH_HOOKS array + HOOKS_VERSION), the SessionStart hook script, all six phase workflow skill files, skills-installer.js, and agents-installer.js (new `installDomainAgents` function). Tests must pass after each task. No shared-module rewrites (too risky); no trust→defaultMode mapping (deeply integrated, separate concern).
+
+**Tech Stack:** Node.js ESM, node:test, YAML frontmatter in .md files, Commander.js CLI
+
+---
+
+## Phase 1: Hooks cleanup and improvements
+
+### Task 1: Remove broken SubagentStart hook entry
+
+`MORPH_HOOKS` references `subagent/log-agent-start.js` which does not exist. This causes a `hooks` entry pointing at a missing file — fail-open semantics mean it silently passes, but the entry is dead weight.
+
+**Files:**
+- Modify: `src/utils/hooks-installer.js`
+
+**Step 1: Remove the SubagentStart entry from MORPH_HOOKS**
+
+In `src/utils/hooks-installer.js`, delete the entire SubagentStart block (lines 159–168):
+
+```js
+  // === SubagentStart ===
+  {
+    event: 'SubagentStart',
+    matcher: 'morph-.*',
+    hooks: [{
+      type: 'command',
+      command: 'node framework/hooks/claude-code/subagent/log-agent-start.js'
+    }]
+  },
+```
+
+**Step 2: Bump HOOKS_VERSION to 2.3.0**
+
+```js
+const HOOKS_VERSION = '2.3.0';
+```
+
+**Step 3: Verify no SubagentStart key appears in hooks tests**
+
+Run: `npm test -- test/hooks/hooks-installer.test.js`
+Expected: All pass (the test that checks installed events doesn't assert SubagentStart)
+
+**Step 4: Commit**
+
+```bash
+git add src/utils/hooks-installer.js
+git commit -m "fix(hooks): remove SubagentStart hook pointing at missing log-agent-start.js"
+```
+
+---
+
+### Task 2: Convert validate-bash-commands.js to a prompt-type hook
+
+The Node.js `validate-bash-commands.js` performs 3 regex checks. These can be replaced by a CC-native `type: "prompt"` hook that uses Haiku to evaluate the command — simpler, no file required.
+
+**Files:**
+- Modify: `src/utils/hooks-installer.js`
+- No file to delete yet (keep validate-bash-commands.js for reference, remove in Task 2b)
+
+**Step 1: Write failing test that expects the Bash PreToolUse hook to be type "prompt"**
+
+In `test/hooks/hooks-installer.test.js`, add inside `describe('installClaudeHooks', ...)`:
+
+```js
+test('Bash PreToolUse hook is type prompt (not command)', async () => {
+  await installClaudeHooks(tempDir);
+  const settings = readSettings();
+  const bashEntry = settings.hooks.PreToolUse.find(e => e.matcher === 'Bash');
+  assert.ok(bashEntry, 'Bash PreToolUse entry exists');
+  assert.strictEqual(bashEntry.hooks[0].type, 'prompt');
+  assert.ok(bashEntry.hooks[0].prompt, 'prompt field is set');
+});
+```
+
+**Step 2: Run test to confirm it fails**
+
+Run: `npm test -- test/hooks/hooks-installer.test.js 2>&1 | grep -A3 "Bash PreToolUse hook is type prompt"`
+Expected: FAIL — hook type is currently "command"
+
+**Step 3: Replace the Bash PreToolUse hook in MORPH_HOOKS**
+
+In `src/utils/hooks-installer.js`, replace the `// === PreToolUse: Bash ===` block:
+
+```js
+  // === PreToolUse: Bash ===
+  {
+    event: 'PreToolUse',
+    matcher: 'Bash',
+    hooks: [{
+      type: 'prompt',
+      prompt: `You are a guard for a morph-spec project. Read the bash command from the hook input and check:
+1. Does the command delete .morph/ (e.g. "rm -rf .morph" or "rm -rf .morph/")? → BLOCK
+2. Does the command edit state.json directly via sed, jq, awk, echo, cat, or printf with a shell redirect (>)? → BLOCK
+3. Does the command write to .morph/framework/ via shell redirect (>)? → BLOCK
+If any condition is true, respond: {"ok": false, "reason": "MORPH-SPEC: <brief explanation and suggested alternative>"}
+Otherwise respond: {"ok": true}`
+    }]
+  },
+```
+
+**Step 4: Run the new test — expect PASS**
+
+Run: `npm test -- test/hooks/hooks-installer.test.js 2>&1 | grep -A3 "Bash PreToolUse hook is type prompt"`
+Expected: PASS
+
+**Step 5: Run full hooks installer tests**
+
+Run: `npm test -- test/hooks/hooks-installer.test.js`
+Expected: All pass (existing "installs all hook events" test doesn't assert Bash hook type)
+
+**Step 6: Commit**
+
+```bash
+git add src/utils/hooks-installer.js test/hooks/hooks-installer.test.js
+git commit -m "feat(hooks): convert Bash guard to native prompt-type hook, remove Node.js dependency"
+```
+
+---
+
+### Task 3: Inject active feature spec into SessionStart context
+
+The framework claims to be spec-driven but the active feature's spec.md is never auto-loaded into Claude's context. Fix `inject-morph-context.js` to include the spec content (truncated to 3000 chars) when an active feature exists and has a spec.
+
+**Files:**
+- Modify: `framework/hooks/claude-code/session-start/inject-morph-context.js`
+
+**Step 1: Write failing test for spec injection behavior**
+
+In `test/hooks/shared-utils.test.js` (or create `test/hooks/inject-context.test.js`):
+
+```js
+import { test, describe } from 'node:test';
+import assert from 'node:assert';
+import { readFileSync, existsSync } from 'fs';
+
+describe('inject-morph-context spec injection', () => {
+  test('inject-morph-context.js reads spec file content', () => {
+    const src = readFileSync(
+      'framework/hooks/claude-code/session-start/inject-morph-context.js',
+      'utf-8'
+    );
+    // Must read the spec file for the active feature
+    assert.ok(src.includes('1-design/spec.md'), 'Should reference spec.md path');
+    assert.ok(src.includes('Active feature spec'), 'Should label the spec section');
+  });
+});
+```
+
+**Step 2: Run to confirm it fails**
+
+Run: `npm test -- test/hooks/inject-context.test.js`
+Expected: FAIL — "Should reference spec.md path"
+
+**Step 3: Modify inject-morph-context.js to add spec injection**
+
+After the `if (active) { ... }` block (after the "Key commands" line), add the spec reading logic. The full modified file:
+
+```js
+#!/usr/bin/env node
+
+/**
+ * SessionStart Hook: Inject MORPH-SPEC Context
+ *
+ * Event: SessionStart | Matcher: startup|resume|compact
+ *
+ * Reads state.json and injects a summary + active feature spec as
+ * additionalContext so Claude knows the current morph-spec state and
+ * spec at session start.
+ *
+ * Fail-open: exits 0 on any error.
+ */
+
+import { readFileSync, existsSync } from 'fs';
+import { join } from 'path';
+import { loadState, getActiveFeature, getPendingGates, getMissingOutputs } from '../../shared/state-reader.js';
+import { stateExists } from '../../shared/state-reader.js';
+import { injectContext, pass } from '../../shared/hook-response.js';
+
+const SPEC_MAX_CHARS = 3000;
+
+try {
+  if (!stateExists()) pass();
+
+  const state = loadState();
+  if (!state?.features || Object.keys(state.features).length === 0) pass();
+
+  const active = getActiveFeature();
+  const lines = ['MORPH-SPEC Status:'];
+
+  if (active) {
+    const { name, feature } = active;
+    lines.push(`- Active feature: ${name} (phase: ${feature.phase}, workflow: ${feature.workflow || 'auto'})`);
+    lines.push(`- Status: ${feature.status}`);
+
+    // Task progress
+    if (feature.tasks) {
+      lines.push(`- Tasks: ${feature.tasks.completed || 0}/${feature.tasks.total || 0} completed`);
+    }
+
+    // Pending approvals
+    const pending = getPendingGates(name);
+    if (pending.length > 0) {
+      lines.push(`- Pending approvals: ${pending.join(', ')}`);
+    }
+
+    // Next required output
+    const missing = getMissingOutputs(name);
+    if (missing.length > 0) {
+      const next = missing[0];
+      lines.push(`- Next required output: ${next.type} → ${next.path}`);
+    }
+
+    // Checkpoints
+    if (feature.checkpoints?.length > 0) {
+      const lastCp = feature.checkpoints[feature.checkpoints.length - 1];
+      lines.push(`- Last checkpoint: #${lastCp.checkpointNum} (${lastCp.passed ? 'passed' : 'failed'})`);
+    }
+
+    // Active feature spec (truncated)
+    const specPath = join(process.cwd(), `.morph/features/${name}/1-design/spec.md`);
+    if (existsSync(specPath)) {
+      try {
+        const specContent = readFileSync(specPath, 'utf-8');
+        const truncated = specContent.length > SPEC_MAX_CHARS
+          ? specContent.slice(0, SPEC_MAX_CHARS) + '\n\n[... spec truncated — read full file at ' + specPath + ']'
+          : specContent;
+        lines.push('');
+        lines.push(`--- Active feature spec (${name}/1-design/spec.md) ---`);
+        lines.push(truncated);
+        lines.push('--- End spec ---');
+      } catch {
+        // Non-blocking: skip spec injection on read error
+      }
+    }
+  } else {
+    // Show summary of all features
+    const featureNames = Object.keys(state.features);
+    lines.push(`- Features: ${featureNames.length} (${featureNames.join(', ')})`);
+
+    for (const [name, feature] of Object.entries(state.features)) {
+      lines.push(`  - ${name}: phase=${feature.phase}, status=${feature.status}`);
+    }
+  }
+
+  // Remind about key commands
+  lines.push('');
+  lines.push('Key commands: morph-spec status <feature> | morph-spec phase advance <feature> | morph-spec approve <feature> <gate>');
+
+  injectContext(lines.join('\n'));
+} catch {
+  // Fail-open
+  process.exit(0);
+}
+```
+
+**Step 4: Run test**
+
+Run: `npm test -- test/hooks/inject-context.test.js`
+Expected: PASS
+
+**Step 5: Commit**
+
+```bash
+git add framework/hooks/claude-code/session-start/inject-morph-context.js test/hooks/inject-context.test.js
+git commit -m "feat(hooks): inject active feature spec.md into SessionStart context"
+```
+
+---
+
+## Phase 2: Skills improvements
+
+### Task 4: Add $ARGUMENTS to all phase workflow skills
+
+Phase skills currently have no way to accept a feature name argument. `/phase-design` and `/phase-design my-feature` both work but the latter doesn't bind to the feature. Add `$ARGUMENTS` to enable bound invocations like `/phase-design my-feature`.
+
+**Files to modify:**
+- `framework/skills/level-1-workflows/phase-setup.md`
+- `framework/skills/level-1-workflows/phase-design.md`
+- `framework/skills/level-1-workflows/phase-clarify.md`
+- `framework/skills/level-1-workflows/phase-uiux.md`
+- `framework/skills/level-1-workflows/phase-tasks.md`
+- `framework/skills/level-1-workflows/phase-implement.md`
+
+**Step 1: Read each file to see current argument references**
+
+For each file, check if `{feature-name}`, `{feature}`, or `$ARGUMENTS` is already used.
+
+Run: `grep -n "feature-name\|ARGUMENTS" framework/skills/level-1-workflows/*.md`
+
+**Step 2: Add argument-hint frontmatter and $ARGUMENTS to phase-design.md**
+
+In `framework/skills/level-1-workflows/phase-design.md`, add to frontmatter:
+```yaml
+argument-hint: "[feature-name]"
+```
+Then replace all instances of `{feature-name}` with `$ARGUMENTS` in the skill body (wherever the user is expected to fill in a feature name). If no placeholder exists, add at top of body:
+```markdown
+Feature: **$ARGUMENTS**
+```
+
+Repeat this same pattern for all 6 phase skill files.
+
+**Step 3: Write test that verifies $ARGUMENTS appears in installed skills**
+
+Add to `test/utils/skills-installer.test.js` (or create it):
+```js
+test('installed phase-design skill contains $ARGUMENTS', async () => {
+  await installSkills(tempDir);
+  const skillPath = join(tempDir, '.claude', 'skills', 'phase-design.md');
+  assert.ok(existsSync(skillPath), 'phase-design.md installed');
+  const content = readFileSync(skillPath, 'utf-8');
+  assert.ok(content.includes('$ARGUMENTS') || content.includes('argument-hint'),
+    'skill supports arguments');
+});
+```
+
+**Step 4: Run test, fix any issues, run all tests**
+
+Run: `npm test -- test/utils/skills-installer.test.js`
+Run: `npm test`
+Expected: All pass
+
+**Step 5: Commit**
+
+```bash
+git add framework/skills/level-1-workflows/
+git commit -m "feat(skills): add \$ARGUMENTS support to all phase workflow skills"
+```
+
+---
+
+### Task 5: Add disable-model-invocation and context:fork to appropriate skills
+
+**phase-implement** and **phase-tasks** should not be auto-triggered by Claude (they have side effects). Add `disable-model-invocation: true`. **phase-implement** should also run in an isolated context via `context: fork`.
+
+**Files:**
+- Modify: `framework/skills/level-1-workflows/phase-implement.md`
+- Modify: `framework/skills/level-1-workflows/phase-tasks.md`
+
+**Step 1: Add to phase-implement.md frontmatter**
+
+```yaml
+disable-model-invocation: true
+context: fork
+agent: general-purpose
+```
+
+Note: `phase-implement` already has `user-invocable: false`. Keep that. Add the two new fields.
+
+**Step 2: Add to phase-tasks.md frontmatter**
+
+```yaml
+disable-model-invocation: true
+```
+
+**Step 3: Verify the frontmatter parses correctly**
+
+Read both files after editing and verify YAML is valid (no duplicate keys, correct indentation).
+
+**Step 4: Commit**
+
+```bash
+git add framework/skills/level-1-workflows/phase-implement.md \
+        framework/skills/level-1-workflows/phase-tasks.md
+git commit -m "feat(skills): disable auto-invocation and add context:fork to implementation phases"
+```
+
+---
+
+## Phase 3: Domain specialists as native subagents
+
+### Task 6: Add installDomainAgents() to agents-installer.js
+
+Domain specialist skills in `framework/skills/level-2-domains/` should be installed as Claude Code subagents (`.claude/agents/`) with `memory: project`, not as flat skill files. Create a function that converts each skill .md file into a proper agent .md file.
+
+**Files:**
+- Modify: `src/utils/agents-installer.js`
+
+**Step 1: Write failing test**
+
+Add to `test/utils/agents-installer.test.js`:
+```js
+import { installDomainAgents } from '../../src/utils/agents-installer.js';
+
+describe('installDomainAgents', () => {
+  test('creates agent files from level-2-domains skills', async () => {
+    await installDomainAgents(tempDir, 'framework');
+    const agentsDir = join(tempDir, '.claude', 'agents');
+    assert.ok(existsSync(agentsDir));
+
+    // blazor-builder skill → agent file
+    const blazorAgent = join(agentsDir, 'morph-domain-blazor-builder.md');
+    assert.ok(existsSync(blazorAgent), 'blazor-builder domain agent created');
+
+    const content = readFileSync(blazorAgent, 'utf-8');
+    assert.ok(content.includes('memory: project'), 'agent has project memory');
+    assert.ok(content.includes('model: sonnet'), 'agent uses sonnet model');
+  });
+
+  test('domain agent files have required frontmatter fields', async () => {
+    await installDomainAgents(tempDir, 'framework');
+    const blazorAgent = join(tempDir, '.claude', 'agents', 'morph-domain-blazor-builder.md');
+    const content = readFileSync(blazorAgent, 'utf-8');
+    assert.ok(content.startsWith('---'), 'has frontmatter');
+    assert.ok(content.includes('name:'), 'has name');
+    assert.ok(content.includes('description:'), 'has description');
+    assert.ok(content.includes('tools:'), 'has tools');
+    assert.ok(content.includes('memory: project'), 'has memory');
+  });
+});
+```
+
+**Step 2: Run test to confirm it fails**
+
+Run: `npm test -- test/utils/agents-installer.test.js 2>&1 | grep "installDomainAgents"`
+Expected: FAIL — function not exported
+
+**Step 3: Implement installDomainAgents() in agents-installer.js**
+
+Add after the existing `installAgents` function:
+
+```js
+import { readdirSync, readFileSync as readFileSyncFS, statSync } from 'node:fs';
+
+/**
+ * Install level-2-domains specialist skills as native Claude Code subagents.
+ * Each skill .md file becomes a .claude/agents/morph-domain-{name}.md file
+ * with memory: project and specialist tool access.
+ *
+ * @param {string} projectDir - Target project directory
+ * @param {string} frameworkDir - Path to morph-spec framework/ directory
+ */
+export async function installDomainAgents(projectDir, frameworkDir = 'framework') {
+  const domainSkillsDir = join(frameworkDir, 'skills', 'level-2-domains');
+  if (!existsSync(domainSkillsDir)) return;
+
+  const targetDir = join(projectDir, '.claude', 'agents');
+  mkdirSync(targetDir, { recursive: true });
+
+  const skillFiles = collectSkillFiles(domainSkillsDir);
+
+  for (const filePath of skillFiles) {
+    const raw = readFileSyncFS(filePath, 'utf-8');
+    const { frontmatter, body } = parseSkillFile(raw);
+
+    const name = frontmatter.name;
+    if (!name) continue;
+
+    const description = frontmatter.description?.trim().replace(/^>\s*/, '') || `${name} domain specialist`;
+    const tools = frontmatter['allowed-tools'] || 'Read, Edit, Write, Bash, Grep, Glob';
+
+    const agentFrontmatter = [
+      `name: ${name}`,
+      `description: ${description}`,
+      `model: sonnet`,
+      `tools: ${tools}`,
+      `maxTurns: 20`,
+      `memory: project`,
+    ].join('\n');
+
+    const content = `---\n${agentFrontmatter}\n---\n\n${body}\n`;
+    const filename = `morph-domain-${name}.md`;
+    writeFileSync(join(targetDir, filename), content, 'utf-8');
+  }
+}
+
+/**
+ * Recursively collect all .md files (excluding README.md) from a directory.
+ * @param {string} dir
+ * @returns {string[]}
+ */
+function collectSkillFiles(dir) {
+  const result = [];
+  for (const entry of readdirSync(dir)) {
+    const fullPath = join(dir, entry);
+    if (statSync(fullPath).isDirectory()) {
+      result.push(...collectSkillFiles(fullPath));
+    } else if (entry.endsWith('.md') && entry !== 'README.md') {
+      result.push(fullPath);
+    }
+  }
+  return result;
+}
+
+/**
+ * Parse a skill .md file with YAML frontmatter.
+ * Returns { frontmatter: Object, body: string }.
+ * @param {string} content
+ * @returns {{ frontmatter: Record<string, string>, body: string }}
+ */
+function parseSkillFile(content) {
+  const frontmatter = {};
+  let body = content;
+
+  if (content.startsWith('---')) {
+    const end = content.indexOf('\n---', 3);
+    if (end !== -1) {
+      const fmText = content.slice(3, end).trim();
+      body = content.slice(end + 4).trim();
+
+      for (const line of fmText.split('\n')) {
+        const colonIdx = line.indexOf(':');
+        if (colonIdx === -1) continue;
+        const key = line.slice(0, colonIdx).trim();
+        const val = line.slice(colonIdx + 1).trim();
+        if (key && !key.startsWith('-')) {
+          frontmatter[key] = val.replace(/^['"]|['"]$/g, '');
+        }
+      }
+    }
+  }
+
+  return { frontmatter, body };
+}
+```
+
+**Step 4: Add `existsSync` to existing imports at top of agents-installer.js**
+
+The file currently imports from `node:fs`:
+```js
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+```
+Change to:
+```js
+import { readFileSync, writeFileSync, mkdirSync, readdirSync, statSync, existsSync } from 'node:fs';
+```
+
+**Step 5: Run the new tests**
+
+Run: `npm test -- test/utils/agents-installer.test.js`
+Expected: Both new tests PASS
+
+**Step 6: Run full test suite**
+
+Run: `npm test`
+Expected: All pass
+
+**Step 7: Commit**
+
+```bash
+git add src/utils/agents-installer.js test/utils/agents-installer.test.js
+git commit -m "feat(agents): add installDomainAgents() — converts level-2-domain skills to native subagents with memory:project"
+```
+
+---
+
+### Task 7: Stop installing level-2-domains as flat skills
+
+Now that domain specialists are installed as subagents, remove them from the skills installer to avoid duplication.
+
+**Files:**
+- Modify: `src/utils/skills-installer.js`
+
+**Step 1: Write test that verifies level-2-domains are NOT installed as flat skills**
+
+In `test/utils/skills-installer.test.js`, add:
+```js
+test('level-2-domains skills are NOT installed as flat skill files', async () => {
+  await installSkills(tempDir);
+  const skillsDir = join(tempDir, '.claude', 'skills');
+  // blazor-builder should not appear as a skill (it's now a domain agent)
+  const blazorSkill = join(skillsDir, 'blazor-builder.md');
+  assert.ok(!existsSync(blazorSkill), 'blazor-builder.md should NOT be in skills (it is a domain agent now)');
+});
+```
+
+**Step 2: Run test to confirm it fails (blazor-builder.md currently IS installed)**
+
+Run: `npm test -- test/utils/skills-installer.test.js 2>&1 | grep "level-2-domains skills"`
+Expected: FAIL
+
+**Step 3: Remove level-2-domains from SKILL_LEVELS_TO_INSTALL**
+
+In `src/utils/skills-installer.js`, change:
+```js
+const SKILL_LEVELS_TO_INSTALL = ['level-0-meta', 'level-1-workflows', 'level-2-domains'];
+```
+to:
+```js
+// level-2-domains are installed as native subagents via installDomainAgents() — not as skills
+const SKILL_LEVELS_TO_INSTALL = ['level-0-meta', 'level-1-workflows'];
+```
+
+**Step 4: Run tests**
+
+Run: `npm test -- test/utils/skills-installer.test.js`
+Expected: All pass including new test
+
+**Step 5: Commit**
+
+```bash
+git add src/utils/skills-installer.js test/utils/skills-installer.test.js
+git commit -m "feat(skills): remove level-2-domains from skill installer (now installed as domain subagents)"
+```
+
+---
+
+### Task 8: Wire installDomainAgents() into init.js and update.js
+
+`init.js` already calls `installAgents()`. Add `installDomainAgents()` call after it. Same for `update.js`.
+
+**Files:**
+- Modify: `src/commands/project/init.js`
+- Modify: `src/commands/project/update.js`
+
+**Step 1: Read the relevant section of init.js to find where installAgents is called**
+
+Look for the `installAgents(` call in init.js.
+
+**Step 2: Add installDomainAgents import and call in init.js**
+
+Add to imports at top of init.js (after existing agents-installer import):
+```js
+import { installAgents, installDomainAgents } from '../../utils/agents-installer.js';
+```
+
+After the `await installAgents(targetDir, frameworkDir)` call, add:
+```js
+await installDomainAgents(targetDir, frameworkDir);
+```
+
+**Step 3: Add installDomainAgents import and call in update.js**
+
+Same pattern — add import and call after the existing `installAgents()` call.
+
+**Step 4: Run integration tests**
+
+Run: `npm test -- test/commands/init.test.js`
+Run: `npm test -- test/commands/update.test.js`
+Expected: All pass (new call is additive, doesn't break existing behavior)
+
+**Step 5: Commit**
+
+```bash
+git add src/commands/project/init.js src/commands/project/update.js
+git commit -m "feat(init,update): install domain specialist subagents alongside tier-1/2 agents"
+```
+
+---
+
+## Phase 4: Cleanup and version bump
+
+### Task 9: Remove validate-bash-commands.js dead file and update HOOKS_VERSION
+
+The Bash guard is now a prompt-type hook. The Node.js file is no longer called. Remove it to reduce confusion.
+
+**Files:**
+- Delete: `framework/hooks/claude-code/pre-tool-use/validate-bash-commands.js`
+- Bump HOOKS_VERSION in `src/utils/hooks-installer.js` to `2.4.0`
+
+**Step 1: Verify the file is no longer referenced in MORPH_HOOKS**
+
+Run: `grep -r "validate-bash-commands" src/ framework/hooks/`
+Expected: Zero matches in production code (tests may reference it)
+
+**Step 2: Delete the file**
+
+```bash
+rm "framework/hooks/claude-code/pre-tool-use/validate-bash-commands.js"
+```
+
+**Step 3: Bump HOOKS_VERSION**
+
+In `src/utils/hooks-installer.js`:
+```js
+const HOOKS_VERSION = '2.4.0';
+```
+
+**Step 4: Run all tests**
+
+Run: `npm test`
+Expected: All pass
+
+**Step 5: Commit**
+
+```bash
+git add src/utils/hooks-installer.js
+git rm framework/hooks/claude-code/pre-tool-use/validate-bash-commands.js
+git commit -m "chore(hooks): remove validate-bash-commands.js (replaced by prompt-type hook), bump HOOKS_VERSION to 2.4.0"
+```
+
+---
+
+### Task 10: Update package.json version and run full test suite
+
+**Files:**
+- Modify: `package.json`
+- Modify: `framework/CLAUDE.md` (version string)
+- Modify: `framework/CLAUDE_runtime.md` (version string)
+
+**Step 1: Bump version to 4.5.0**
+
+In `package.json`, change `"version": "4.4.0"` to `"version": "4.5.0"`.
+
+**Step 2: Update version strings in framework files**
+
+In `framework/CLAUDE.md` and `framework/CLAUDE_runtime.md`, update `v4.4.0` to `v4.5.0`.
+
+**Step 3: Run full test suite**
+
+Run: `npm test`
+Expected: All tests pass, zero failures
+
+**Step 4: Final commit**
+
+```bash
+git add package.json framework/CLAUDE.md framework/CLAUDE_runtime.md
+git commit -m "chore: bump version to 4.5.0 — CC native alignment round 3"
+```
+
+---
+
+## Deferred (out of scope for this plan)
+
+The following items from the analysis require deeper investigation or have higher risk:
+
+- **Rewrite hooks shared modules to bash/jq** — high refactor risk; hooks work correctly today
+- **Map trust scoring to `permissions.defaultMode`** — trust is deeply integrated into state + approval gating; separate PR
+- **Migrate standards CLI to skills** — large UX change; needs design discussion
+- **Reduce workflow configs from 10 to ≤4** — needs usage data
+- **Verify `.claude/rules/` native CC support** — needs official CC team confirmation
+- **Replace workflow-detector LLM call with AskUserQuestion** — behavior change requiring testing