@polymorphism-tech/morph-spec 6.0.0 → 7.1.0

package/src/lib/generators/scaffold-generator.js

@@ -9,14 +9,8 @@
 
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync } from 'fs';
 import { join, dirname, basename } from 'path';
-import { fileURLToPath } from 'url';
 import { renderTemplate } from '../../core/templates/template-renderer.js';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-/** Framework templates root (relative to this file) */
-const FRAMEWORK_TEMPLATES_DIR = join(__dirname, '../../../framework/templates');
+import { resolveFrameworkTemplatePath } from '../../core/templates/template-registry.js';
 
 /**
  * Convert kebab-case to PascalCase.
@@ -67,19 +61,23 @@ export function normalizeNamespaceToKebab(ns) {
 // .NET VSA Scaffold
 // ─────────────────────────────────────────────────────────────────────────────
 
-/** Template IDs for .NET slice-level files */
+// Each entry pairs a REGISTRY.json template `id` with the generator-specific
+// output shaping (class-name suffix, target directory). REGISTRY owns the
+// template path; the generator owns where the rendered file lands.
+
+/** .NET slice-level files (endpoint/handler/request/response/validator). */
 const DOTNET_SLICE_TEMPLATES = [
-  { id: 'endpoint', file: 'endpoint.cs.hbs', suffix: 'Endpoint' },
-  { id: 'handler', file: 'handler.cs.hbs', suffix: 'Handler' },
-  { id: 'request', file: 'request.cs.hbs', suffix: 'Request' },
-  { id: 'response', file: 'response.cs.hbs', suffix: 'Response' },
-  { id: 'validator', file: 'validator.cs.hbs', suffix: 'Validator' },
+  { templateId: 'dotnet-feature-endpoint', suffix: 'Endpoint' },
+  { templateId: 'dotnet-feature-handler', suffix: 'Handler' },
+  { templateId: 'dotnet-feature-request', suffix: 'Request' },
+  { templateId: 'dotnet-feature-response', suffix: 'Response' },
+  { templateId: 'dotnet-feature-validator', suffix: 'Validator' },
 ];
 
-/** Template IDs for .NET feature-level files */
+/** .NET feature-level files (entity, errors). */
 const DOTNET_FEATURE_TEMPLATES = [
-  { id: 'entity', file: 'entity.cs.hbs', suffix: '', dir: 'entities' },
-  { id: 'errors', file: 'errors.cs.hbs', suffix: 'Errors', dir: 'feature' },
+  { templateId: 'dotnet-feature-entity', suffix: '', dir: 'entities' },
+  { templateId: 'dotnet-feature-errors', suffix: 'Errors', dir: 'feature' },
 ];
 
 /**
@@ -98,7 +96,6 @@ export function scaffoldDotnetSlice(options) {
 
   const pascalFeature = toPascalCase(feature);
   const pascalSlice = toPascalCase(sliceName);
-  const templateDir = join(FRAMEWORK_TEMPLATES_DIR, 'code/dotnet/feature');
 
   const variables = {
     PROJECT_NAME: normalizeNamespaceToKebab(namespace),
@@ -112,7 +109,7 @@ export function scaffoldDotnetSlice(options) {
 
   // 1. Render slice-level templates
   for (const tmpl of DOTNET_SLICE_TEMPLATES) {
-    const templatePath = join(templateDir, tmpl.file);
+    const templatePath = resolveFrameworkTemplatePath(tmpl.templateId);
     const outputPath = join(
       outputDir,
       'Features',
@@ -133,7 +130,7 @@ export function scaffoldDotnetSlice(options) {
 
   // 2. Render feature-level templates (skip if already exist)
   for (const tmpl of DOTNET_FEATURE_TEMPLATES) {
-    const templatePath = join(templateDir, tmpl.file);
+    const templatePath = resolveFrameworkTemplatePath(tmpl.templateId);
     let outputPath;
 
     if (tmpl.dir === 'entities') {
@@ -164,22 +161,23 @@ export function scaffoldDotnetSlice(options) {
 // Next.js Scaffold
 // ─────────────────────────────────────────────────────────────────────────────
 
-/** Template mappings for Next.js feature */
+// Each entry pairs a REGISTRY.json template `id` with where the rendered file
+// lands. REGISTRY owns the template path; the generator owns the output path.
 const NEXTJS_TEMPLATES = [
   {
-    file: 'page.tsx.hbs',
+    templateId: 'nextjs-page',
     outputFn: (kebab) => join('app', '(dashboard)', kebab, 'page.tsx'),
   },
   {
-    file: 'client-component.tsx.hbs',
+    templateId: 'nextjs-client-component',
     outputFn: (kebab) => join('features', kebab, 'components', `${kebab}-list.tsx`),
   },
   {
-    file: 'feature-form.tsx.hbs',
+    templateId: 'nextjs-feature-form',
     outputFn: (kebab) => join('features', kebab, 'components', `create-${kebab}-form.tsx`),
   },
   {
-    file: 'use-feature.ts.hbs',
+    templateId: 'nextjs-use-feature',
     outputFn: (kebab) => join('features', kebab, 'hooks', `use-${kebab}s.ts`),
   },
 ];
@@ -197,7 +195,6 @@ export function scaffoldNextjsFeature(options) {
   const { featureName, outputDir = process.cwd(), dryRun = false } = options;
 
   const kebab = featureName.toLowerCase();
-  const templateDir = join(FRAMEWORK_TEMPLATES_DIR, 'frontend/nextjs');
 
   // Next.js templates use camelCase variable name `featureName`
   const variables = {
@@ -207,7 +204,7 @@ export function scaffoldNextjsFeature(options) {
   const files = [];
 
   for (const tmpl of NEXTJS_TEMPLATES) {
-    const templatePath = join(templateDir, tmpl.file);
+    const templatePath = resolveFrameworkTemplatePath(tmpl.templateId);
     const relativePath = tmpl.outputFn(kebab);
     const outputPath = join(outputDir, relativePath);
 

package/src/lib/installers/memory-installer.js

@@ -0,0 +1,138 @@
+/**
+ * Memory Installer — populates Claude Code persistent memory during morph-init.
+ *
+ * Writes two memory files (project + reference) plus an entry in MEMORY.md
+ * so future Claude Code sessions enter pre-contextualized about the
+ * morph-spec setup of this project.
+ *
+ * Memory location: ~/.claude/projects/<encoded-project-path>/memory/
+ *
+ * The path encoding mirrors Claude Code's own scheme: replace slashes and
+ * colons with dashes. Tests can override via MORPH_MEMORY_ROOT env var.
+ */
+
+import fs from 'fs-extra';
+import { join } from 'path';
+import { homedir } from 'os';
+
+function getMemoryRoot(projectPath) {
+  if (process.env.MORPH_MEMORY_ROOT) return process.env.MORPH_MEMORY_ROOT;
+
+  const encoded = projectPath.replace(/[:\\/]/g, '-').replace(/^-+/, '');
+  return join(homedir(), '.claude', 'projects', encoded, 'memory');
+}
+
+function projectMemoryContent(info) {
+  return `---
+name: project-morph-spec
+description: morph-spec project configuration, paths, slash commands, and trust mode
+metadata:
+  type: project
+---
+
+# ${info.projectName} — morph-spec project
+
+**Framework version:** ${info.frameworkVersion}
+**Stack:** ${info.stack ?? 'default (nextjs + dotnet + VSA + MAF + Neon)'}
+**Trust mode:** auto (gates auto-pass without risk signals)
+
+## Key paths
+
+- \`.morph/framework/MORPH.md\` — NLH charter (read once per session)
+- \`.morph/framework/agents.json\` — 7 domain personas
+- \`.morph/framework/standards/STANDARDS.json\` — standards index (load on demand)
+- \`.morph/framework/schemas/tasks.schema.json\` — JSON Schema for tasks.json
+- \`.morph/features/{feature}/\` — feature artifacts: 0-proposal / 1-design / 2-plan / 3-implement / 4-review
+- \`.morph/context/\` — long-lived architectural context (design-system, decisions)
+- \`.morph/state.json\` — feature state (managed by state-sync hook; Edit fallback allowed)
+
+## Slash commands
+
+| Command | Skill invoked |
+|---------|---------------|
+| \`/morph-proposal {feature}\` | \`Skill(morph-proposal)\` — brainstorming → Gate 1 → plan → Gate 2 |
+| \`/morph-apply {feature}\` | \`Skill(morph-apply)\` — DAG-adaptive implement loop → review → Gate 3 |
+| \`/morph-status [feature]\` | inspect state.json |
+| \`/morph-archive {feature}\` | move completed feature to .morph/archive/ |
+| \`/morph-preflight\` | pre-deploy validation |
+| \`/morph-troubleshoot [erro]\` | diagnose .NET/Next.js errors |
+
+## Core skills
+
+\`morph-proposal\`, \`morph-apply\`, \`morph-brainstorming\`, \`morph-plan\`, \`morph-implement\`, \`morph-eval\`, \`morph-review\`, \`morph-stack-scan\`, \`morph-standards\`
+
+**Why:** This project is managed by morph-spec — spec-driven autonomous development with trust-aware gates.
+
+**How to apply:**
+- When user mentions a feature, check \`.morph/features/\` first.
+- When user types \`/morph-proposal\`, invoke \`Skill(morph-proposal)\` directly.
+- In \`trust: "auto"\`, gates auto-pass; only AskUserQuestion on risk signals.
+- Prefer morph-* skills over superpowers:* equivalents in this project.
+`;
+}
+
+const REFERENCE_MEMORY_CONTENT = `---
+name: reference-morph-context
+description: where to find long-lived morph-spec project context and schema files
+metadata:
+  type: reference
+---
+
+# morph-spec context locations
+
+- \`.morph/context/README.md\` — generated architecture overview
+- \`.morph/context/design-system.md\` — design tokens and components (source of truth)
+- \`.morph/framework/MORPH.md\` — NLH charter, Trust Mode rules, gates, skills table
+- \`.morph/framework/standards/STANDARDS.json\` — index; load specific standard via \`path\` field
+- \`.morph/framework/schemas/tasks.schema.json\` — tasks.json schema reference
+- \`.morph/framework/phases.json\` — phase folder mapping and skill associations
+- \`.morph/framework/agents.json\` — domain persona definitions (dotnet-senior, ef-modeler, etc.)
+- \`.morph/framework/rubrics/\` — eval rubrics for morph-eval scoring
+`;
+
+/**
+ * Populate Claude Code persistent memory for a morph-spec project.
+ *
+ * Idempotent: re-running overwrites the memory files with current info
+ * but appends MEMORY.md index entries only if missing.
+ *
+ * @param {string} projectPath - Absolute path of the project root
+ * @param {object} info - Project facts to embed in the memory
+ * @param {string} info.projectName
+ * @param {string} info.frameworkVersion
+ * @param {string} [info.stack]
+ * @returns {Promise<{ projectMemoryPath: string, referenceMemoryPath: string, indexPath: string }>}
+ */
+export async function installProjectMemory(projectPath, info) {
+  const memoryRoot = getMemoryRoot(projectPath);
+  await fs.ensureDir(memoryRoot);
+
+  const projectMemoryPath = join(memoryRoot, 'project_morph_spec.md');
+  await fs.writeFile(projectMemoryPath, projectMemoryContent(info), 'utf8');
+
+  const referenceMemoryPath = join(memoryRoot, 'reference_morph_context.md');
+  await fs.writeFile(referenceMemoryPath, REFERENCE_MEMORY_CONTENT, 'utf8');
+
+  const indexPath = join(memoryRoot, 'MEMORY.md');
+  let indexContent = '';
+  if (await fs.pathExists(indexPath)) {
+    indexContent = await fs.readFile(indexPath, 'utf8');
+  } else {
+    indexContent = '# Memory Index\n';
+  }
+
+  const projectLine = '- [morph-spec project](project_morph_spec.md) — stack, trust mode, slash commands, key paths';
+  const refLine = '- [morph-spec context](reference_morph_context.md) — where to find long-lived context';
+
+  if (!indexContent.includes('project_morph_spec.md')) {
+    if (!indexContent.endsWith('\n')) indexContent += '\n';
+    indexContent += projectLine + '\n';
+  }
+  if (!indexContent.includes('reference_morph_context.md')) {
+    indexContent += refLine + '\n';
+  }
+
+  await fs.writeFile(indexPath, indexContent, 'utf8');
+
+  return { projectMemoryPath, referenceMemoryPath, indexPath };
+}

package/src/lib/phase-chain/phase-validator.js

@@ -66,10 +66,10 @@ const OUTPUT_PHASE_MAP = {
   'spec.md': '2-plan',
   'mandate.md': '2-plan',
   'decisions.md': '2-plan',
-  'design-system.md': '1-ui',
-  'mockups.md': '1-ui',
-  'components.md': '1-ui',
-  'flows.md': '1-ui',
+  'design-system.md': '1-design',
+  'mockups.md': '1-design',
+  'components.md': '1-design',
+  'flows.md': '1-design',
   'tasks.md': '2-plan',
   'recap.md': '3-implement',
   'review-report.md': '4-review'

package/src/lib/risk-detector.js

@@ -0,0 +1,80 @@
+/**
+ * Risk Detector — decides whether a gate should pause execution.
+ *
+ * In `trust: "auto"` mode (default), gates auto-pass UNLESS one of these
+ * risk signals triggers a forced pause. In `trust: "manual"` mode, gates
+ * always pause via AskUserQuestion.
+ *
+ * Signals checked (in order):
+ *   - designSystemDivergence: boolean — conflicting design sources detected
+ *   - standardsViolations: string[]   — violations of mandate.md proibições
+ *   - evalScore: number               — morph-eval score (pause if < 8)
+ *   - taskCount: number               — total tasks (pause if > 20)
+ */
+
+const SCOPE_TASK_THRESHOLD = 20;
+const MIN_EVAL_SCORE = 8;
+
+/**
+ * @param {object} config - .morph/config/config.json contents (uses `trust`)
+ * @param {object} signals
+ * @returns {{ pause: boolean, reason: string }}
+ */
+export function shouldPauseGate(config, signals) {
+  const trust = config?.trust ?? 'auto';
+
+  if (trust === 'manual') {
+    return { pause: true, reason: 'trust mode is manual' };
+  }
+
+  if (signals.designSystemDivergence) {
+    return { pause: true, reason: 'design-system divergence detected' };
+  }
+
+  if (Array.isArray(signals.standardsViolations) && signals.standardsViolations.length > 0) {
+    return {
+      pause: true,
+      reason: `standards violations detected: ${signals.standardsViolations.join(', ')}`,
+    };
+  }
+
+  if (typeof signals.evalScore === 'number' && signals.evalScore < MIN_EVAL_SCORE) {
+    return {
+      pause: true,
+      reason: `eval score ${signals.evalScore} below threshold ${MIN_EVAL_SCORE}`,
+    };
+  }
+
+  if (typeof signals.taskCount === 'number' && signals.taskCount > SCOPE_TASK_THRESHOLD) {
+    return {
+      pause: true,
+      reason: `scope of ${signals.taskCount} tasks exceeds threshold ${SCOPE_TASK_THRESHOLD}`,
+    };
+  }
+
+  return { pause: false, reason: '' };
+}
+
+/**
+ * Human-readable list of risk signals present (for logging/Gate summary).
+ * @returns {string[]}
+ */
+export function getRiskSignals(signals) {
+  const out = [];
+  if (signals.designSystemDivergence) out.push('design-system divergence');
+  if (Array.isArray(signals.standardsViolations) && signals.standardsViolations.length > 0) {
+    out.push(`standards violations: ${signals.standardsViolations.join(', ')}`);
+  }
+  if (typeof signals.evalScore === 'number' && signals.evalScore < MIN_EVAL_SCORE) {
+    out.push(`eval score ${signals.evalScore}/10`);
+  }
+  if (typeof signals.taskCount === 'number' && signals.taskCount > SCOPE_TASK_THRESHOLD) {
+    out.push(`${signals.taskCount} tasks (over threshold)`);
+  }
+  return out;
+}
+
+export const RISK_CONSTANTS = {
+  SCOPE_TASK_THRESHOLD,
+  MIN_EVAL_SCORE,
+};

package/src/lib/tasks/tasks-json-parser.js

@@ -0,0 +1,185 @@
+/**
+ * tasks-json-parser.js — read, validate, query, mutate tasks.json
+ *
+ * Replaces the prior Markdown-based tasks.md parser for new features.
+ * Legacy features that still use tasks.md are handled by task-parser.js.
+ *
+ * Uses a minimal hand-rolled JSON Schema validator (no AJV dep) — sufficient
+ * for the controlled schema in framework/schemas/tasks.schema.json.
+ */
+
+import fs from 'fs-extra';
+import { readFileSync, existsSync } from 'fs';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const SCHEMA_PATH = join(__dirname, '..', '..', '..', 'framework', 'schemas', 'tasks.schema.json');
+
+let cachedSchema = null;
+export function getSchema() {
+  if (cachedSchema) return cachedSchema;
+  cachedSchema = JSON.parse(readFileSync(SCHEMA_PATH, 'utf8'));
+  return cachedSchema;
+}
+
+const VALID_STATUS = ['pending', 'in_progress', 'done', 'skipped', 'blocked'];
+const VALID_EFFORT = ['S', 'M', 'L', 'XL'];
+const VALID_GROUP = ['backend', 'frontend', 'tests', 'infra', 'docs'];
+
+/**
+ * Validate a tasks.json structure.
+ * @returns {{ valid: boolean, errors: string[] }}
+ */
+export function validateTasksJson(data) {
+  const errors = [];
+  if (!data || typeof data !== 'object') {
+    errors.push('tasks.json must be an object');
+    return { valid: false, errors };
+  }
+  if (data.version !== '1.0') errors.push('version must be "1.0"');
+  if (typeof data.feature !== 'string' || !data.feature) {
+    errors.push('feature must be a non-empty string');
+  }
+  if (!Array.isArray(data.tasks)) {
+    errors.push('tasks must be an array');
+    return { valid: false, errors };
+  }
+
+  const ids = new Set();
+  for (const [i, task] of data.tasks.entries()) {
+    const ctx = `tasks[${i}]`;
+    if (!task.id || !/^T\d+$/.test(task.id)) {
+      errors.push(`${ctx}.id must match /^T\\d+$/`);
+    } else if (ids.has(task.id)) {
+      errors.push(`${ctx}.id duplicate: ${task.id}`);
+    }
+    ids.add(task.id);
+
+    if (typeof task.title !== 'string' || !task.title) errors.push(`${ctx}.title required`);
+    if (typeof task.description !== 'string' || !task.description) errors.push(`${ctx}.description required`);
+    if (!Array.isArray(task.dependencies)) {
+      errors.push(`${ctx}.dependencies must be array`);
+    } else {
+      for (const dep of task.dependencies) {
+        if (typeof dep !== 'string' || !/^T\d+$/.test(dep)) {
+          errors.push(`${ctx}.dependencies[${dep}] must match /^T\\d+$/`);
+        }
+      }
+    }
+    if (!VALID_EFFORT.includes(task.effort)) {
+      errors.push(`${ctx}.effort must be one of ${VALID_EFFORT.join(', ')}`);
+    }
+    if (typeof task.doneCriteria !== 'string' || !task.doneCriteria) {
+      errors.push(`${ctx}.doneCriteria required`);
+    }
+    if (!VALID_STATUS.includes(task.status)) {
+      errors.push(`${ctx}.status must be one of ${VALID_STATUS.join(', ')}`);
+    }
+    if (task.group !== undefined && !VALID_GROUP.includes(task.group)) {
+      errors.push(`${ctx}.group must be one of ${VALID_GROUP.join(', ')}`);
+    }
+  }
+
+  return { valid: errors.length === 0, errors };
+}
+
+/**
+ * Read and parse tasks.json from disk. Throws on validation errors.
+ * @param {string} filePath - Absolute path to tasks.json
+ * @returns {Promise<object>}
+ */
+export async function parseTasksJson(filePath) {
+  const data = await fs.readJson(filePath);
+  const { valid, errors } = validateTasksJson(data);
+  if (!valid) {
+    throw new Error(`Invalid tasks.json:\n  ${errors.join('\n  ')}`);
+  }
+  return data;
+}
+
+/**
+ * Synchronous variant — used by hooks.
+ */
+export function parseTasksJsonSync(filePath) {
+  if (!existsSync(filePath)) {
+    throw new Error(`tasks.json not found: ${filePath}`);
+  }
+  const data = JSON.parse(readFileSync(filePath, 'utf8'));
+  const { valid, errors } = validateTasksJson(data);
+  if (!valid) {
+    throw new Error(`Invalid tasks.json:\n  ${errors.join('\n  ')}`);
+  }
+  return data;
+}
+
+/**
+ * @returns {object[]} tasks with status === 'pending'
+ */
+export function getPendingTasks(data) {
+  return data.tasks.filter(t => t.status === 'pending');
+}
+
+/**
+ * Tasks ready to run: pending AND all dependencies are 'done'.
+ */
+export function getReadyTasks(data) {
+  const doneIds = new Set(data.tasks.filter(t => t.status === 'done').map(t => t.id));
+  return data.tasks.filter(t =>
+    t.status === 'pending' && t.dependencies.every(dep => doneIds.has(dep))
+  );
+}
+
+/**
+ * Mutate `data` to set task status. Returns `data` for chaining.
+ */
+export function updateTaskStatus(data, taskId, newStatus) {
+  if (!VALID_STATUS.includes(newStatus)) {
+    throw new Error(`Invalid status: ${newStatus}`);
+  }
+  const task = data.tasks.find(t => t.id === taskId);
+  if (!task) throw new Error(`Task not found: ${taskId}`);
+  task.status = newStatus;
+  return data;
+}
+
+/**
+ * Write tasks.json to disk. Validates before writing.
+ */
+export async function writeTasksJson(filePath, data) {
+  const { valid, errors } = validateTasksJson(data);
+  if (!valid) {
+    throw new Error(`Cannot write invalid tasks.json:\n  ${errors.join('\n  ')}`);
+  }
+  await fs.writeJson(filePath, data, { spaces: 2 });
+}
+
+/**
+ * Group tasks by `group` field, falling back to 'backend' when absent.
+ * Returns `{ [group]: taskId[] }` shape matching the legacy parseAndGroupTasks output.
+ */
+export function groupTasks(data) {
+  const groups = {};
+  for (const task of data.tasks) {
+    const group = task.group || 'backend';
+    if (!groups[group]) groups[group] = [];
+    groups[group].push(task.id);
+  }
+  return groups;
+}
+
+/**
+ * Convert tasks.json to the legacy taskList shape used in state.json.
+ * Lets the rest of the codebase keep using feature.taskList while migration
+ * is in progress.
+ */
+export function toTaskList(data) {
+  return data.tasks.map(t => ({
+    id: t.id,
+    title: t.title,
+    status: t.status === 'done' ? 'completed' : t.status,
+    dependencies: [...t.dependencies],
+    files: t.outputs || [],
+    checkpoint: null,
+  }));
+}

package/src/scripts/setup-infra.js

@@ -185,6 +185,7 @@ export async function setupInfra(targetPath, { _exec = execSync, reinstall = fal
     const config = {
       framework: 'global',
       frameworkVersion: getInstalledCLIVersion(),
+      trust: 'auto',
       project: {
         name: dirName
       }
@@ -243,6 +244,30 @@ export async function setupInfra(targetPath, { _exec = execSync, reinstall = fal
     await copyFile(agentsSrc, agentsDest);
   }
 
+  // --- 8b. Copy framework/MORPH.md → .morph/framework/MORPH.md ---
+  log('Step 8b: Copying MORPH.md (NLH charter)...');
+  const morphMdSrc = join(FRAMEWORK_DIR, 'MORPH.md');
+  const morphMdDest = join(frameworkDestDir, 'MORPH.md');
+  if (await pathExists(morphMdSrc)) {
+    await copyFile(morphMdSrc, morphMdDest);
+  }
+
+  // --- 8c. Copy framework/phases.json → .morph/framework/phases.json ---
+  log('Step 8c: Copying phases.json...');
+  const phasesSrc = join(FRAMEWORK_DIR, 'phases.json');
+  const phasesDest = join(frameworkDestDir, 'phases.json');
+  if (await pathExists(phasesSrc)) {
+    await copyFile(phasesSrc, phasesDest);
+  }
+
+  // --- 8d. Copy framework/schemas → .morph/framework/schemas (JSON schemas) ---
+  log('Step 8d: Copying schemas...');
+  const schemasSrc = join(FRAMEWORK_DIR, 'schemas');
+  const schemasDest = join(frameworkDestDir, 'schemas');
+  if (await pathExists(schemasSrc)) {
+    await copyDirectory(schemasSrc, schemasDest);
+  }
+
   // --- 9. Copy framework/commands → .claude/commands ---
   log('Step 9: Setting up Claude Code integration...');
   const claudeDest = join(targetPath, '.claude');

package/src/utils/hooks-installer.js

@@ -22,13 +22,13 @@ const OLD_DISPATCH_COMMAND = 'node framework/hooks/agent-teams/dispatch.js';
 
 /**
  * Native permissions.deny entries managed by MORPH-SPEC.
- * These replace the protect-readonly-files.js PreToolUse hook,
- * using Claude Code's built-in permissions system instead.
+ *
+ * state.json is NOT in deny because the agent edits it directly as a
+ * fallback to the state-sync hook (per v7 hybrid state model). The
+ * framework/ tree remains read-only — only the installer touches it.
  */
-const MORPH_PERMISSIONS = [
-  // Core framework state and readonly files
-  'Write(.morph/state.json)',
-  'Edit(.morph/state.json)',
+const MORPH_DENY = [
+  // Framework files — installer-managed, immutable at runtime
   'Write(.morph/framework/**)',
   'Edit(.morph/framework/**)',
   // .claude/CLAUDE.md (managed copy — source is framework/CLAUDE.md)
@@ -45,6 +45,30 @@ const MORPH_PERMISSIONS = [
   'Edit(.claude/skills/**)',
 ];
 
+/**
+ * Native permissions.allow entries managed by MORPH-SPEC.
+ *
+ * Pre-authorizes operations the agent legitimately performs during the
+ * morph-spec flow, so the user does not get permission prompts on every
+ * proposal.md / spec.md / tasks.json write.
+ */
+const MORPH_ALLOW = [
+  // Feature artifacts — the agent's working directory during proposal/plan/implement/review
+  'Write(.morph/features/**)',
+  'Edit(.morph/features/**)',
+  // state.json — fallback path when state-sync hook can't cover a case
+  'Edit(.morph/state.json)',
+  // Long-lived architectural context — agent may reconcile during brainstorming
+  'Write(.morph/context/**)',
+  'Edit(.morph/context/**)',
+  // Folder creation under .morph
+  'Bash(mkdir:.morph/**)',
+  'Bash(ls:.morph/**)',
+];
+
+// Backwards-compat alias used by older tests
+const MORPH_PERMISSIONS = MORPH_DENY;
+
 /**
  * All MORPH-SPEC hook definitions.
  * Each entry maps to a Claude Code hook event.
@@ -88,6 +112,17 @@ const MORPH_HOOKS = [
     }]
   },
 
+  // === PostToolUse: Write|Edit|AskUserQuestion — state-sync (autonomous state.json updates) ===
+  {
+    event: 'PostToolUse',
+    matcher: 'Write|Edit|AskUserQuestion',
+    hooks: [{
+      type: 'command',
+      command: 'node framework/hooks/claude-code/core/state-sync.js',
+      timeout: 3000
+    }]
+  },
+
   // === PostToolUse: All — loop detection ===
   {
     event: 'PostToolUse',
@@ -179,17 +214,31 @@ export async function installClaudeHooks(targetPath) {
     installed++;
   }
 
-  // Install native permissions.deny entries (idempotent)
+  // Install native permissions (idempotent — preserve user-added entries)
   settings.permissions = settings.permissions || {};
   settings.permissions.deny = settings.permissions.deny || [];
-  // Remove previously managed permissions to avoid duplicates on re-install
+  settings.permissions.allow = settings.permissions.allow || [];
+
+  // Stale-entry cleanup: remove old morph-managed deny entries (e.g. state.json
+  // was previously in deny — v7 moves it to allow)
+  const STALE_DENY = [
+    'Write(.morph/state.json)',
+    'Edit(.morph/state.json)',
+  ];
   settings.permissions.deny = settings.permissions.deny.filter(
-    p => !MORPH_PERMISSIONS.includes(p)
+    p => !MORPH_DENY.includes(p) && !STALE_DENY.includes(p)
   );
-  for (const perm of MORPH_PERMISSIONS) {
+  for (const perm of MORPH_DENY) {
     settings.permissions.deny.push(perm);
   }
 
+  settings.permissions.allow = settings.permissions.allow.filter(
+    p => !MORPH_ALLOW.includes(p)
+  );
+  for (const perm of MORPH_ALLOW) {
+    settings.permissions.allow.push(perm);
+  }
+
   // JSON Schema for IDE auto-complete and validation
   settings['$schema'] = 'https://json.schemastore.org/claude-code-settings.json';