@polymorphism-tech/morph-spec 4.8.1 → 4.8.4

package/docs/plans/2026-02-22-morph-cc-alignment-impl.md

@@ -1,730 +0,0 @@
-# Claude Code Native Alignment — Implementation Plan
-
-**Status:** COMPLETE
-
-> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.
-
-**Goal:** Implement all actionable improvements from the CC native alignment analysis: fix a broken SubagentStart hook, convert bash validation to a prompt-type hook, inject active feature spec into session context, add `$ARGUMENTS` support to phase skills, add `disable-model-invocation` + `context: fork` where appropriate, and convert level-2-domain specialists from skills to native Claude Code subagents.
-
-**Architecture:** The changes touch hooks-installer.js (MORPH_HOOKS array + HOOKS_VERSION), the SessionStart hook script, all six phase workflow skill files, skills-installer.js, and agents-installer.js (new `installDomainAgents` function). Tests must pass after each task. No shared-module rewrites (too risky); no trust→defaultMode mapping (deeply integrated, separate concern).
-
-**Tech Stack:** Node.js ESM, node:test, YAML frontmatter in .md files, Commander.js CLI
-
----
-
-## Phase 1: Hooks cleanup and improvements
-
-### Task 1: Remove broken SubagentStart hook entry
-
-`MORPH_HOOKS` references `subagent/log-agent-start.js` which does not exist. This causes a `hooks` entry pointing at a missing file — fail-open semantics mean it silently passes, but the entry is dead weight.
-
-**Files:**
-- Modify: `src/utils/hooks-installer.js`
-
-**Step 1: Remove the SubagentStart entry from MORPH_HOOKS**
-
-In `src/utils/hooks-installer.js`, delete the entire SubagentStart block (lines 159–168):
-
-```js
-  // === SubagentStart ===
-  {
-    event: 'SubagentStart',
-    matcher: 'morph-.*',
-    hooks: [{
-      type: 'command',
-      command: 'node framework/hooks/claude-code/subagent/log-agent-start.js'
-    }]
-  },
-```
-
-**Step 2: Bump HOOKS_VERSION to 2.3.0**
-
-```js
-const HOOKS_VERSION = '2.3.0';
-```
-
-**Step 3: Verify no SubagentStart key appears in hooks tests**
-
-Run: `npm test -- test/hooks/hooks-installer.test.js`
-Expected: All pass (the test that checks installed events doesn't assert SubagentStart)
-
-**Step 4: Commit**
-
-```bash
-git add src/utils/hooks-installer.js
-git commit -m "fix(hooks): remove SubagentStart hook pointing at missing log-agent-start.js"
-```
-
----
-
-### Task 2: Convert validate-bash-commands.js to a prompt-type hook
-
-The Node.js `validate-bash-commands.js` performs 3 regex checks. These can be replaced by a CC-native `type: "prompt"` hook that uses Haiku to evaluate the command — simpler, no file required.
-
-**Files:**
-- Modify: `src/utils/hooks-installer.js`
-- No file to delete yet (keep validate-bash-commands.js for reference, remove in Task 2b)
-
-**Step 1: Write failing test that expects the Bash PreToolUse hook to be type "prompt"**
-
-In `test/hooks/hooks-installer.test.js`, add inside `describe('installClaudeHooks', ...)`:
-
-```js
-test('Bash PreToolUse hook is type prompt (not command)', async () => {
-  await installClaudeHooks(tempDir);
-  const settings = readSettings();
-  const bashEntry = settings.hooks.PreToolUse.find(e => e.matcher === 'Bash');
-  assert.ok(bashEntry, 'Bash PreToolUse entry exists');
-  assert.strictEqual(bashEntry.hooks[0].type, 'prompt');
-  assert.ok(bashEntry.hooks[0].prompt, 'prompt field is set');
-});
-```
-
-**Step 2: Run test to confirm it fails**
-
-Run: `npm test -- test/hooks/hooks-installer.test.js 2>&1 | grep -A3 "Bash PreToolUse hook is type prompt"`
-Expected: FAIL — hook type is currently "command"
-
-**Step 3: Replace the Bash PreToolUse hook in MORPH_HOOKS**
-
-In `src/utils/hooks-installer.js`, replace the `// === PreToolUse: Bash ===` block:
-
-```js
-  // === PreToolUse: Bash ===
-  {
-    event: 'PreToolUse',
-    matcher: 'Bash',
-    hooks: [{
-      type: 'prompt',
-      prompt: `You are a guard for a morph-spec project. Read the bash command from the hook input and check:
-1. Does the command delete .morph/ (e.g. "rm -rf .morph" or "rm -rf .morph/")? → BLOCK
-2. Does the command edit state.json directly via sed, jq, awk, echo, cat, or printf with a shell redirect (>)? → BLOCK
-3. Does the command write to .morph/framework/ via shell redirect (>)? → BLOCK
-If any condition is true, respond: {"ok": false, "reason": "MORPH-SPEC: <brief explanation and suggested alternative>"}
-Otherwise respond: {"ok": true}`
-    }]
-  },
-```
-
-**Step 4: Run the new test — expect PASS**
-
-Run: `npm test -- test/hooks/hooks-installer.test.js 2>&1 | grep -A3 "Bash PreToolUse hook is type prompt"`
-Expected: PASS
-
-**Step 5: Run full hooks installer tests**
-
-Run: `npm test -- test/hooks/hooks-installer.test.js`
-Expected: All pass (existing "installs all hook events" test doesn't assert Bash hook type)
-
-**Step 6: Commit**
-
-```bash
-git add src/utils/hooks-installer.js test/hooks/hooks-installer.test.js
-git commit -m "feat(hooks): convert Bash guard to native prompt-type hook, remove Node.js dependency"
-```
-
----
-
-### Task 3: Inject active feature spec into SessionStart context
-
-The framework claims to be spec-driven but the active feature's spec.md is never auto-loaded into Claude's context. Fix `inject-morph-context.js` to include the spec content (truncated to 3000 chars) when an active feature exists and has a spec.
-
-**Files:**
-- Modify: `framework/hooks/claude-code/session-start/inject-morph-context.js`
-
-**Step 1: Write failing test for spec injection behavior**
-
-In `test/hooks/shared-utils.test.js` (or create `test/hooks/inject-context.test.js`):
-
-```js
-import { test, describe } from 'node:test';
-import assert from 'node:assert';
-import { readFileSync, existsSync } from 'fs';
-
-describe('inject-morph-context spec injection', () => {
-  test('inject-morph-context.js reads spec file content', () => {
-    const src = readFileSync(
-      'framework/hooks/claude-code/session-start/inject-morph-context.js',
-      'utf-8'
-    );
-    // Must read the spec file for the active feature
-    assert.ok(src.includes('1-design/spec.md'), 'Should reference spec.md path');
-    assert.ok(src.includes('Active feature spec'), 'Should label the spec section');
-  });
-});
-```
-
-**Step 2: Run to confirm it fails**
-
-Run: `npm test -- test/hooks/inject-context.test.js`
-Expected: FAIL — "Should reference spec.md path"
-
-**Step 3: Modify inject-morph-context.js to add spec injection**
-
-After the `if (active) { ... }` block (after the "Key commands" line), add the spec reading logic. The full modified file:
-
-```js
-#!/usr/bin/env node
-
-/**
- * SessionStart Hook: Inject MORPH-SPEC Context
- *
- * Event: SessionStart | Matcher: startup|resume|compact
- *
- * Reads state.json and injects a summary + active feature spec as
- * additionalContext so Claude knows the current morph-spec state and
- * spec at session start.
- *
- * Fail-open: exits 0 on any error.
- */
-
-import { readFileSync, existsSync } from 'fs';
-import { join } from 'path';
-import { loadState, getActiveFeature, getPendingGates, getMissingOutputs } from '../../shared/state-reader.js';
-import { stateExists } from '../../shared/state-reader.js';
-import { injectContext, pass } from '../../shared/hook-response.js';
-
-const SPEC_MAX_CHARS = 3000;
-
-try {
-  if (!stateExists()) pass();
-
-  const state = loadState();
-  if (!state?.features || Object.keys(state.features).length === 0) pass();
-
-  const active = getActiveFeature();
-  const lines = ['MORPH-SPEC Status:'];
-
-  if (active) {
-    const { name, feature } = active;
-    lines.push(`- Active feature: ${name} (phase: ${feature.phase}, workflow: ${feature.workflow || 'auto'})`);
-    lines.push(`- Status: ${feature.status}`);
-
-    // Task progress
-    if (feature.tasks) {
-      lines.push(`- Tasks: ${feature.tasks.completed || 0}/${feature.tasks.total || 0} completed`);
-    }
-
-    // Pending approvals
-    const pending = getPendingGates(name);
-    if (pending.length > 0) {
-      lines.push(`- Pending approvals: ${pending.join(', ')}`);
-    }
-
-    // Next required output
-    const missing = getMissingOutputs(name);
-    if (missing.length > 0) {
-      const next = missing[0];
-      lines.push(`- Next required output: ${next.type} → ${next.path}`);
-    }
-
-    // Checkpoints
-    if (feature.checkpoints?.length > 0) {
-      const lastCp = feature.checkpoints[feature.checkpoints.length - 1];
-      lines.push(`- Last checkpoint: #${lastCp.checkpointNum} (${lastCp.passed ? 'passed' : 'failed'})`);
-    }
-
-    // Active feature spec (truncated)
-    const specPath = join(process.cwd(), `.morph/features/${name}/1-design/spec.md`);
-    if (existsSync(specPath)) {
-      try {
-        const specContent = readFileSync(specPath, 'utf-8');
-        const truncated = specContent.length > SPEC_MAX_CHARS
-          ? specContent.slice(0, SPEC_MAX_CHARS) + '\n\n[... spec truncated — read full file at ' + specPath + ']'
-          : specContent;
-        lines.push('');
-        lines.push(`--- Active feature spec (${name}/1-design/spec.md) ---`);
-        lines.push(truncated);
-        lines.push('--- End spec ---');
-      } catch {
-        // Non-blocking: skip spec injection on read error
-      }
-    }
-  } else {
-    // Show summary of all features
-    const featureNames = Object.keys(state.features);
-    lines.push(`- Features: ${featureNames.length} (${featureNames.join(', ')})`);
-
-    for (const [name, feature] of Object.entries(state.features)) {
-      lines.push(`  - ${name}: phase=${feature.phase}, status=${feature.status}`);
-    }
-  }
-
-  // Remind about key commands
-  lines.push('');
-  lines.push('Key commands: morph-spec status <feature> | morph-spec phase advance <feature> | morph-spec approve <feature> <gate>');
-
-  injectContext(lines.join('\n'));
-} catch {
-  // Fail-open
-  process.exit(0);
-}
-```
-
-**Step 4: Run test**
-
-Run: `npm test -- test/hooks/inject-context.test.js`
-Expected: PASS
-
-**Step 5: Commit**
-
-```bash
-git add framework/hooks/claude-code/session-start/inject-morph-context.js test/hooks/inject-context.test.js
-git commit -m "feat(hooks): inject active feature spec.md into SessionStart context"
-```
-
----
-
-## Phase 2: Skills improvements
-
-### Task 4: Add $ARGUMENTS to all phase workflow skills
-
-Phase skills currently have no way to accept a feature name argument. `/phase-design` and `/phase-design my-feature` both work but the latter doesn't bind to the feature. Add `$ARGUMENTS` to enable bound invocations like `/phase-design my-feature`.
-
-**Files to modify:**
-- `framework/skills/level-1-workflows/phase-setup.md`
-- `framework/skills/level-1-workflows/phase-design.md`
-- `framework/skills/level-1-workflows/phase-clarify.md`
-- `framework/skills/level-1-workflows/phase-uiux.md`
-- `framework/skills/level-1-workflows/phase-tasks.md`
-- `framework/skills/level-1-workflows/phase-implement.md`
-
-**Step 1: Read each file to see current argument references**
-
-For each file, check if `{feature-name}`, `{feature}`, or `$ARGUMENTS` is already used.
-
-Run: `grep -n "feature-name\|ARGUMENTS" framework/skills/level-1-workflows/*.md`
-
-**Step 2: Add argument-hint frontmatter and $ARGUMENTS to phase-design.md**
-
-In `framework/skills/level-1-workflows/phase-design.md`, add to frontmatter:
-```yaml
-argument-hint: "[feature-name]"
-```
-Then replace all instances of `{feature-name}` with `$ARGUMENTS` in the skill body (wherever the user is expected to fill in a feature name). If no placeholder exists, add at top of body:
-```markdown
-Feature: **$ARGUMENTS**
-```
-
-Repeat this same pattern for all 6 phase skill files.
-
-**Step 3: Write test that verifies $ARGUMENTS appears in installed skills**
-
-Add to `test/utils/skills-installer.test.js` (or create it):
-```js
-test('installed phase-design skill contains $ARGUMENTS', async () => {
-  await installSkills(tempDir);
-  const skillPath = join(tempDir, '.claude', 'skills', 'phase-design.md');
-  assert.ok(existsSync(skillPath), 'phase-design.md installed');
-  const content = readFileSync(skillPath, 'utf-8');
-  assert.ok(content.includes('$ARGUMENTS') || content.includes('argument-hint'),
-    'skill supports arguments');
-});
-```
-
-**Step 4: Run test, fix any issues, run all tests**
-
-Run: `npm test -- test/utils/skills-installer.test.js`
-Run: `npm test`
-Expected: All pass
-
-**Step 5: Commit**
-
-```bash
-git add framework/skills/level-1-workflows/
-git commit -m "feat(skills): add \$ARGUMENTS support to all phase workflow skills"
-```
-
----
-
-### Task 5: Add disable-model-invocation and context:fork to appropriate skills
-
-**phase-implement** and **phase-tasks** should not be auto-triggered by Claude (they have side effects). Add `disable-model-invocation: true`. **phase-implement** should also run in an isolated context via `context: fork`.
-
-**Files:**
-- Modify: `framework/skills/level-1-workflows/phase-implement.md`
-- Modify: `framework/skills/level-1-workflows/phase-tasks.md`
-
-**Step 1: Add to phase-implement.md frontmatter**
-
-```yaml
-disable-model-invocation: true
-context: fork
-agent: general-purpose
-```
-
-Note: `phase-implement` already has `user-invocable: false`. Keep that. Add the two new fields.
-
-**Step 2: Add to phase-tasks.md frontmatter**
-
-```yaml
-disable-model-invocation: true
-```
-
-**Step 3: Verify the frontmatter parses correctly**
-
-Read both files after editing and verify YAML is valid (no duplicate keys, correct indentation).
-
-**Step 4: Commit**
-
-```bash
-git add framework/skills/level-1-workflows/phase-implement.md \
-        framework/skills/level-1-workflows/phase-tasks.md
-git commit -m "feat(skills): disable auto-invocation and add context:fork to implementation phases"
-```
-
----
-
-## Phase 3: Domain specialists as native subagents
-
-### Task 6: Add installDomainAgents() to agents-installer.js
-
-Domain specialist skills in `framework/skills/level-2-domains/` should be installed as Claude Code subagents (`.claude/agents/`) with `memory: project`, not as flat skill files. Create a function that converts each skill .md file into a proper agent .md file.
-
-**Files:**
-- Modify: `src/utils/agents-installer.js`
-
-**Step 1: Write failing test**
-
-Add to `test/utils/agents-installer.test.js`:
-```js
-import { installDomainAgents } from '../../src/utils/agents-installer.js';
-
-describe('installDomainAgents', () => {
-  test('creates agent files from level-2-domains skills', async () => {
-    await installDomainAgents(tempDir, 'framework');
-    const agentsDir = join(tempDir, '.claude', 'agents');
-    assert.ok(existsSync(agentsDir));
-
-    // blazor-builder skill → agent file
-    const blazorAgent = join(agentsDir, 'morph-domain-blazor-builder.md');
-    assert.ok(existsSync(blazorAgent), 'blazor-builder domain agent created');
-
-    const content = readFileSync(blazorAgent, 'utf-8');
-    assert.ok(content.includes('memory: project'), 'agent has project memory');
-    assert.ok(content.includes('model: sonnet'), 'agent uses sonnet model');
-  });
-
-  test('domain agent files have required frontmatter fields', async () => {
-    await installDomainAgents(tempDir, 'framework');
-    const blazorAgent = join(tempDir, '.claude', 'agents', 'morph-domain-blazor-builder.md');
-    const content = readFileSync(blazorAgent, 'utf-8');
-    assert.ok(content.startsWith('---'), 'has frontmatter');
-    assert.ok(content.includes('name:'), 'has name');
-    assert.ok(content.includes('description:'), 'has description');
-    assert.ok(content.includes('tools:'), 'has tools');
-    assert.ok(content.includes('memory: project'), 'has memory');
-  });
-});
-```
-
-**Step 2: Run test to confirm it fails**
-
-Run: `npm test -- test/utils/agents-installer.test.js 2>&1 | grep "installDomainAgents"`
-Expected: FAIL — function not exported
-
-**Step 3: Implement installDomainAgents() in agents-installer.js**
-
-Add after the existing `installAgents` function:
-
-```js
-import { readdirSync, readFileSync as readFileSyncFS, statSync } from 'node:fs';
-
-/**
- * Install level-2-domains specialist skills as native Claude Code subagents.
- * Each skill .md file becomes a .claude/agents/morph-domain-{name}.md file
- * with memory: project and specialist tool access.
- *
- * @param {string} projectDir - Target project directory
- * @param {string} frameworkDir - Path to morph-spec framework/ directory
- */
-export async function installDomainAgents(projectDir, frameworkDir = 'framework') {
-  const domainSkillsDir = join(frameworkDir, 'skills', 'level-2-domains');
-  if (!existsSync(domainSkillsDir)) return;
-
-  const targetDir = join(projectDir, '.claude', 'agents');
-  mkdirSync(targetDir, { recursive: true });
-
-  const skillFiles = collectSkillFiles(domainSkillsDir);
-
-  for (const filePath of skillFiles) {
-    const raw = readFileSyncFS(filePath, 'utf-8');
-    const { frontmatter, body } = parseSkillFile(raw);
-
-    const name = frontmatter.name;
-    if (!name) continue;
-
-    const description = frontmatter.description?.trim().replace(/^>\s*/, '') || `${name} domain specialist`;
-    const tools = frontmatter['allowed-tools'] || 'Read, Edit, Write, Bash, Grep, Glob';
-
-    const agentFrontmatter = [
-      `name: ${name}`,
-      `description: ${description}`,
-      `model: sonnet`,
-      `tools: ${tools}`,
-      `maxTurns: 20`,
-      `memory: project`,
-    ].join('\n');
-
-    const content = `---\n${agentFrontmatter}\n---\n\n${body}\n`;
-    const filename = `morph-domain-${name}.md`;
-    writeFileSync(join(targetDir, filename), content, 'utf-8');
-  }
-}
-
-/**
- * Recursively collect all .md files (excluding README.md) from a directory.
- * @param {string} dir
- * @returns {string[]}
- */
-function collectSkillFiles(dir) {
-  const result = [];
-  for (const entry of readdirSync(dir)) {
-    const fullPath = join(dir, entry);
-    if (statSync(fullPath).isDirectory()) {
-      result.push(...collectSkillFiles(fullPath));
-    } else if (entry.endsWith('.md') && entry !== 'README.md') {
-      result.push(fullPath);
-    }
-  }
-  return result;
-}
-
-/**
- * Parse a skill .md file with YAML frontmatter.
- * Returns { frontmatter: Object, body: string }.
- * @param {string} content
- * @returns {{ frontmatter: Record<string, string>, body: string }}
- */
-function parseSkillFile(content) {
-  const frontmatter = {};
-  let body = content;
-
-  if (content.startsWith('---')) {
-    const end = content.indexOf('\n---', 3);
-    if (end !== -1) {
-      const fmText = content.slice(3, end).trim();
-      body = content.slice(end + 4).trim();
-
-      for (const line of fmText.split('\n')) {
-        const colonIdx = line.indexOf(':');
-        if (colonIdx === -1) continue;
-        const key = line.slice(0, colonIdx).trim();
-        const val = line.slice(colonIdx + 1).trim();
-        if (key && !key.startsWith('-')) {
-          frontmatter[key] = val.replace(/^['"]|['"]$/g, '');
-        }
-      }
-    }
-  }
-
-  return { frontmatter, body };
-}
-```
-
-**Step 4: Add `existsSync` to existing imports at top of agents-installer.js**
-
-The file currently imports from `node:fs`:
-```js
-import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
-```
-Change to:
-```js
-import { readFileSync, writeFileSync, mkdirSync, readdirSync, statSync, existsSync } from 'node:fs';
-```
-
-**Step 5: Run the new tests**
-
-Run: `npm test -- test/utils/agents-installer.test.js`
-Expected: Both new tests PASS
-
-**Step 6: Run full test suite**
-
-Run: `npm test`
-Expected: All pass
-
-**Step 7: Commit**
-
-```bash
-git add src/utils/agents-installer.js test/utils/agents-installer.test.js
-git commit -m "feat(agents): add installDomainAgents() — converts level-2-domain skills to native subagents with memory:project"
-```
-
----
-
-### Task 7: Stop installing level-2-domains as flat skills
-
-Now that domain specialists are installed as subagents, remove them from the skills installer to avoid duplication.
-
-**Files:**
-- Modify: `src/utils/skills-installer.js`
-
-**Step 1: Write test that verifies level-2-domains are NOT installed as flat skills**
-
-In `test/utils/skills-installer.test.js`, add:
-```js
-test('level-2-domains skills are NOT installed as flat skill files', async () => {
-  await installSkills(tempDir);
-  const skillsDir = join(tempDir, '.claude', 'skills');
-  // blazor-builder should not appear as a skill (it's now a domain agent)
-  const blazorSkill = join(skillsDir, 'blazor-builder.md');
-  assert.ok(!existsSync(blazorSkill), 'blazor-builder.md should NOT be in skills (it is a domain agent now)');
-});
-```
-
-**Step 2: Run test to confirm it fails (blazor-builder.md currently IS installed)**
-
-Run: `npm test -- test/utils/skills-installer.test.js 2>&1 | grep "level-2-domains skills"`
-Expected: FAIL
-
-**Step 3: Remove level-2-domains from SKILL_LEVELS_TO_INSTALL**
-
-In `src/utils/skills-installer.js`, change:
-```js
-const SKILL_LEVELS_TO_INSTALL = ['level-0-meta', 'level-1-workflows', 'level-2-domains'];
-```
-to:
-```js
-// level-2-domains are installed as native subagents via installDomainAgents() — not as skills
-const SKILL_LEVELS_TO_INSTALL = ['level-0-meta', 'level-1-workflows'];
-```
-
-**Step 4: Run tests**
-
-Run: `npm test -- test/utils/skills-installer.test.js`
-Expected: All pass including new test
-
-**Step 5: Commit**
-
-```bash
-git add src/utils/skills-installer.js test/utils/skills-installer.test.js
-git commit -m "feat(skills): remove level-2-domains from skill installer (now installed as domain subagents)"
-```
-
----
-
-### Task 8: Wire installDomainAgents() into init.js and update.js
-
-`init.js` already calls `installAgents()`. Add `installDomainAgents()` call after it. Same for `update.js`.
-
-**Files:**
-- Modify: `src/commands/project/init.js`
-- Modify: `src/commands/project/update.js`
-
-**Step 1: Read the relevant section of init.js to find where installAgents is called**
-
-Look for the `installAgents(` call in init.js.
-
-**Step 2: Add installDomainAgents import and call in init.js**
-
-Add to imports at top of init.js (after existing agents-installer import):
-```js
-import { installAgents, installDomainAgents } from '../../utils/agents-installer.js';
-```
-
-After the `await installAgents(targetDir, frameworkDir)` call, add:
-```js
-await installDomainAgents(targetDir, frameworkDir);
-```
-
-**Step 3: Add installDomainAgents import and call in update.js**
-
-Same pattern — add import and call after the existing `installAgents()` call.
-
-**Step 4: Run integration tests**
-
-Run: `npm test -- test/commands/init.test.js`
-Run: `npm test -- test/commands/update.test.js`
-Expected: All pass (new call is additive, doesn't break existing behavior)
-
-**Step 5: Commit**
-
-```bash
-git add src/commands/project/init.js src/commands/project/update.js
-git commit -m "feat(init,update): install domain specialist subagents alongside tier-1/2 agents"
-```
-
----
-
-## Phase 4: Cleanup and version bump
-
-### Task 9: Remove validate-bash-commands.js dead file and update HOOKS_VERSION
-
-The Bash guard is now a prompt-type hook. The Node.js file is no longer called. Remove it to reduce confusion.
-
-**Files:**
-- Delete: `framework/hooks/claude-code/pre-tool-use/validate-bash-commands.js`
-- Bump HOOKS_VERSION in `src/utils/hooks-installer.js` to `2.4.0`
-
-**Step 1: Verify the file is no longer referenced in MORPH_HOOKS**
-
-Run: `grep -r "validate-bash-commands" src/ framework/hooks/`
-Expected: Zero matches in production code (tests may reference it)
-
-**Step 2: Delete the file**
-
-```bash
-rm "framework/hooks/claude-code/pre-tool-use/validate-bash-commands.js"
-```
-
-**Step 3: Bump HOOKS_VERSION**
-
-In `src/utils/hooks-installer.js`:
-```js
-const HOOKS_VERSION = '2.4.0';
-```
-
-**Step 4: Run all tests**
-
-Run: `npm test`
-Expected: All pass
-
-**Step 5: Commit**
-
-```bash
-git add src/utils/hooks-installer.js
-git rm framework/hooks/claude-code/pre-tool-use/validate-bash-commands.js
-git commit -m "chore(hooks): remove validate-bash-commands.js (replaced by prompt-type hook), bump HOOKS_VERSION to 2.4.0"
-```
-
----
-
-### Task 10: Update package.json version and run full test suite
-
-**Files:**
-- Modify: `package.json`
-- Modify: `framework/CLAUDE.md` (version string)
-- Modify: `framework/CLAUDE_runtime.md` (version string)
-
-**Step 1: Bump version to 4.5.0**
-
-In `package.json`, change `"version": "4.4.0"` to `"version": "4.5.0"`.
-
-**Step 2: Update version strings in framework files**
-
-In `framework/CLAUDE.md` and `framework/CLAUDE_runtime.md`, update `v4.4.0` to `v4.5.0`.
-
-**Step 3: Run full test suite**
-
-Run: `npm test`
-Expected: All tests pass, zero failures
-
-**Step 4: Final commit**
-
-```bash
-git add package.json framework/CLAUDE.md framework/CLAUDE_runtime.md
-git commit -m "chore: bump version to 4.5.0 — CC native alignment round 3"
-```
-
----
-
-## Deferred (out of scope for this plan)
-
-The following items from the analysis require deeper investigation or have higher risk:
-
-- **Rewrite hooks shared modules to bash/jq** — high refactor risk; hooks work correctly today
-- **Map trust scoring to `permissions.defaultMode`** — trust is deeply integrated into state + approval gating; separate PR
-- **Migrate standards CLI to skills** — large UX change; needs design discussion
-- **Reduce workflow configs from 10 to ≤4** — needs usage data
-- **Verify `.claude/rules/` native CC support** — needs official CC team confirmation
-- **Replace workflow-detector LLM call with AskUserQuestion** — behavior change requiring testing