@polymorphism-tech/morph-spec 7.3.0 → 7.5.0

package/framework/commands/morph-archive.md

@@ -1,7 +1,7 @@
 ---
 description: Archive a completed MORPH-SPEC feature after Gate 3 approval
 argument-hint: <feature-name>
-allowed-tools: Read, Write, Edit, Bash
+allowed-tools: Read, Bash
 ---
 
 # Archive MORPH Feature
@@ -9,39 +9,29 @@ allowed-tools: Read, Write, Edit, Bash
 Archive a feature that has cleared Gate 3 (review). Use when the work is shipped and you want the
 feature out of the active set in `.morph/features/`.
 
-## Prerequisites
-
-Before archiving, verify:
-- [ ] Feature folder exists at `.morph/features/{feature}/`
-- [ ] `4-review/review-report.md` exists and Gate 3 is approved in `state.json`
-- [ ] `3-implement/recap.md` is filled in
-- [ ] Code is merged or otherwise shipped
-
-If any precondition fails, stop and report what is missing instead of archiving.
+This is a thin wrapper over the atomic, git-aware CLI command — do **not** move folders or edit state
+by hand. The command moves the folder, stamps the feature `completed` + `archivedAt` in its
+`feature.json`, stages the move in git, and cleans the derivable root index, all-or-nothing.
 
 ## Workflow
 
-1. **Validate completion** by reading `state.json`:
-   - `features[name].phase === 'review'`
-   - `features[name].approvalGates.review.approved === true`
-
-2. **Move the folder** from active to archive:
+1. **Verify** the feature cleared Gate 3:
    ```
-   .morph/features/{feature}/  →  .morph/archive/{feature}/
+   morph-spec approval-status {feature}
    ```
-   Use `Bash` (`mv` on POSIX, `Move-Item` on Windows). Preserve all phase subfolders
-   (`0-proposal/`, `1-design/`, `2-plan/`, `3-implement/`, `4-review/`).
-
-3. **Update state.json**:
-   - Set `features[name].status = 'completed'`
-   - Set `features[name].archivedAt = <ISO timestamp>`
+   Gate `review` must be `approved`. If not, stop and report what's missing (don't force it without
+   the user's say-so).
 
-4. **Confirm with the user** before any destructive step. Show the move plan first.
-
-## Output
+2. **Archive** atomically:
+   ```
+   morph-spec archive {feature}
+   ```
+   The command refuses if Gate 3 isn't approved (override with `--force` only when the user asks).
+   It moves `.morph/features/{feature}/` → `.morph/archive/{feature}/` (via `git mv` when possible),
+   sets `status: "completed"` + `archivedAt`, and drops the feature from the thin index.
 
-Present a short summary of what moved and the new path. Do not invent metrics that are not
-recorded in state.json or recap.md.
+3. **Report** the new path (`.morph/archive/{feature}/`). Do not invent metrics not recorded in
+   `feature.json` or `recap.md`.
 
 ---
 

package/framework/evals/rubrics/README.md

@@ -14,11 +14,12 @@ Cada dimensão tem uma rubrica própria. O score final é ponderado.
 
 ## Escala de scores
 
-| Score | Ação                                                                 |
-|-------|----------------------------------------------------------------------|
-| 8-10  | Aprovado — sem output no contexto, siga para próxima tarefa          |
-| 6-7.9 | Feedback priorizado — liste o que melhorar, modelo continua          |
-| < 6   | Escale para revisão humana — relatório detalhado obrigatório         |
+| Score | Ação                                                                                       |
+|-------|--------------------------------------------------------------------------------------------|
+| 9-10  | Aprovado — sem output no contexto, siga para próxima tarefa                                 |
+| < 9   | Feedback priorizado — alimenta o loop de correção autônomo do morph-apply (re-implementa, sem pausa humana, até 3 tentativas) |
+
+A barra de aprovação por tarefa é **9**. Abaixo disso o modelo corrige sozinho — não escala ao humano entre tarefas. A escalada humana só acontece quando o loop de correção esgota 3 tentativas sem atingir 9 (ver morph-apply/SKILL.md §3a e MORPH.md §0).
 
 ## Como calcular o score composto
 
@@ -28,7 +29,7 @@ score = (arquitetura × 0.30) + (contratos × 0.25) + (qualidade × 0.25) + (tes
 
 Arredonde para uma casa decimal.
 
-## Formato de output quando score < 8
+## Formato de output quando score < 9
 
 Produza exatamente este bloco (não mais, não menos):
 
@@ -38,7 +39,7 @@ Score: [X.X/10]
 Issues (ordenados por impacto):
   - [descrição do problema mais impactante]
   - [próximo problema]
-Ação: [feedback priorizado — continua | escalar para revisão humana]
+Ação: [feedback priorizado — alimenta o loop de correção | escalar (só após 3 tentativas)]
 ```
 
-Quando score ≥ 8: nenhum output. O silêncio é o sinal de aprovação.
+Quando score ≥ 9: nenhum output. O silêncio é o sinal de aprovação.

package/framework/hooks/README.md

@@ -47,6 +47,8 @@ framework/hooks/
 | **PreToolUse** (Write\|Edit) | protect-spec-files.js | Block | Blocks edits to spec files after approval |
 | **PreToolUse** (Write\|Edit) | enforce-phase-writes.js | Block | Ensures writes go to current phase directory |
 | **PreToolUse** (Bash) | _(prompt-type inline guard)_ | Block | Blocks `rm -rf .morph/` and direct state edits via Claude's reasoning |
+| **PostToolUse** (Write\|Edit\|AskUserQuestion) | state-sync.js | State sync | Autonomous state.json updates (feature register, output tracking, gate approval) |
+| **PostToolUse** (Write\|Edit\|AskUserQuestion) | gate-guard.js | Advisory | Warns (never blocks) when a gate action disagrees with the persisted gateDecisions (trust-mode enforcement, issue #63) |
 | **PostToolUse** (Bash) | dispatch.js | Dispatch | Triggers checkpoints on task completion |
 | **PostToolUseFailure** | handle-tool-failure.js | Logging | Appends structured JSON to .morph/logs/tool-failures.log |
 | **Stop** | validate-completion.js | Advisory | Warns about incomplete tasks/missing outputs/pending gates |

package/framework/hooks/claude-code/core/enforce-phase-writes.js

@@ -1,90 +1,115 @@
-#!/usr/bin/env node
-
-/**
- * PreToolUse Hook: Enforce Phase-Appropriate File Writes
- *
- * Event: PreToolUse | Matcher: Write|Edit
- *
- * Ensures writes to .morph/features/{feature}/ go to the current phase's subfolder:
- *   proposal → only 0-proposal/
- *   uiux → only 1-design/
- *   plan → only 2-plan/
- *   implement → 3-implement/ + any source code (unrestricted)
- *   review → only 4-review/
- *
- * Files outside .morph/features/ are always allowed.
- *
- * Fail-open: exits 0 on any error.
- */
-
-import { existsSync } from 'fs';
-import { resolve } from 'path';
-import { readStdin } from '../../shared/stdin-reader.js';
-import { stateExists, getFeaturePhase } from '../../shared/state-reader.js';
-import {
-  isFeaturePath,
-  extractFeatureName,
-  extractPhaseDir,
-  PHASE_DIRS
-} from '../../shared/phase-utils.js';
-import { block, pass } from '../../shared/hook-response.js';
-import { logHookActivity } from '../../shared/activity-logger.js';
-import { getFilePath } from '../../shared/payload-utils.js';
-
-try {
-  // Amend mode: bypass phase write enforcement for legitimate corrections
-  if (process.env.MORPH_AMEND_PHASE) {
-    console.error(`[morph-spec] AMEND MODE: bypassing phase protection for phase '${process.env.MORPH_AMEND_PHASE}'`);
-    pass();
-  }
-
-  if (!stateExists()) pass();
-
-  const payload = await readStdin();
-  if (!payload) pass();
-
-  const filePath = getFilePath(payload);
-  if (!filePath) pass();
-
-  // Only check files inside .morph/features/
-  if (!isFeaturePath(filePath)) pass();
-
-  const featureName = extractFeatureName(filePath);
-  if (!featureName) pass();
-
-  const phase = getFeaturePhase(featureName);
-  if (!phase) pass();
-
-  // During implement phase, all writes are allowed (source code is unrestricted)
-  if (phase === 'implement' || phase === 'sync') pass();
-
-  const targetDir = extractPhaseDir(filePath);
-  if (!targetDir) pass(); // File directly in feature root — allow
-
-  const allowedDir = PHASE_DIRS[phase];
-  if (!allowedDir) pass(); // Unknown phase — allow
-
-  if (targetDir !== allowedDir) {
-    // Allow editing already-existing files from previous phases
-    const absolutePath = resolve(process.cwd(), filePath);
-    if (existsSync(absolutePath)) {
-      logHookActivity('enforce-phase-writes', 'PreToolUse', 'ok');
-      pass(); // editing existing file — allow
-    }
-
-    const phaseLabel = phase.toUpperCase();
-    logHookActivity('enforce-phase-writes', 'PreToolUse', 'blocked');
-    block(
-      `MORPH-SPEC: Writing to '${targetDir}/' is not allowed during ${phaseLabel} phase.\n` +
-      `Current phase '${phase}' only permits writes to '${allowedDir}/'.\n\n` +
-      `If you need to write to a different phase folder, ensure the feature\n` +
-      `has advanced to the appropriate phase first (check gates in state.json).`
-    );
-  }
-
-  logHookActivity('enforce-phase-writes', 'PreToolUse', 'ok');
-  pass();
-} catch {
-  // Fail-open
-  process.exit(0);
-}
+#!/usr/bin/env node
+
+/**
+ * PreToolUse Hook: Enforce Phase-Appropriate File Writes
+ *
+ * Event: PreToolUse | Matcher: Write|Edit
+ *
+ * Ensures writes to .morph/features/{feature}/ go to the current phase's subfolder:
+ *   proposal → only 0-proposal/
+ *   uiux → only 1-design/
+ *   plan → only 2-plan/
+ *   implement → 3-implement/ + any source code (unrestricted)
+ *   review → only 4-review/
+ *
+ * Files outside .morph/features/ are always allowed.
+ *
+ * Fail-open: exits 0 on any error.
+ */
+
+import { existsSync } from 'fs';
+import { resolve } from 'path';
+import { readStdin } from '../../shared/stdin-reader.js';
+import { stateExists, getFeaturePhase, isGateApproved } from '../../shared/state-reader.js';
+import {
+  isFeaturePath,
+  extractFeatureName,
+  extractPhaseDir,
+  PHASE_DIRS
+} from '../../shared/phase-utils.js';
+
+/**
+ * The gate that authorizes writing a phase folder's FIRST artifact. Once that
+ * gate is approved, the next phase's canonical file may be created even though
+ * the phase only advances (via derivation) once that file exists — this is the
+ * fix for the forward-transition chicken-and-egg. proposal-approval unlocks both
+ * the optional `1-design/` and `2-plan/` (the uiux fork).
+ */
+const PHASE_DIR_ENTRY_GATE = {
+  '1-design': 'proposal',
+  '2-plan': 'proposal',
+  '3-implement': 'plan',
+  '4-review': 'plan',
+};
+import { block, pass } from '../../shared/hook-response.js';
+import { logHookActivity } from '../../shared/activity-logger.js';
+import { getFilePath } from '../../shared/payload-utils.js';
+
+try {
+  // Amend mode: bypass phase write enforcement for legitimate corrections
+  if (process.env.MORPH_AMEND_PHASE) {
+    console.error(`[morph-spec] AMEND MODE: bypassing phase protection for phase '${process.env.MORPH_AMEND_PHASE}'`);
+    pass();
+  }
+
+  if (!stateExists()) pass();
+
+  const payload = await readStdin();
+  if (!payload) pass();
+
+  const filePath = getFilePath(payload);
+  if (!filePath) pass();
+
+  // Only check files inside .morph/features/
+  if (!isFeaturePath(filePath)) pass();
+
+  const featureName = extractFeatureName(filePath);
+  if (!featureName) pass();
+
+  const phase = getFeaturePhase(featureName);
+  if (!phase) pass();
+
+  // During implement phase, all writes are allowed (source code is unrestricted)
+  if (phase === 'implement' || phase === 'sync') pass();
+
+  const targetDir = extractPhaseDir(filePath);
+  if (!targetDir) pass(); // File directly in feature root — allow
+
+  const allowedDir = PHASE_DIRS[phase];
+  if (!allowedDir) pass(); // Unknown phase — allow
+
+  if (targetDir !== allowedDir) {
+    // Allow editing already-existing files from previous phases
+    const absolutePath = resolve(process.cwd(), filePath);
+    if (existsSync(absolutePath)) {
+      logHookActivity('enforce-phase-writes', 'PreToolUse', 'ok');
+      pass(); // editing existing file — allow
+    }
+
+    // Gate-aware forward transition: allow creating the NEXT phase's first
+    // artifact as soon as the gate authorizing that phase is approved. Without
+    // this, the first file of a new phase can never be written (the phase only
+    // advances once that file exists) — the deadlock this hook used to create.
+    const entryGate = PHASE_DIR_ENTRY_GATE[targetDir];
+    if (entryGate && isGateApproved(featureName, entryGate)) {
+      logHookActivity('enforce-phase-writes', 'PreToolUse', 'ok');
+      pass();
+    }
+
+    const phaseLabel = phase.toUpperCase();
+    logHookActivity('enforce-phase-writes', 'PreToolUse', 'blocked');
+    block(
+      `MORPH-SPEC: Writing to '${targetDir}/' is not allowed during ${phaseLabel} phase.\n` +
+      `Current phase '${phase}' only permits writes to '${allowedDir}/'.\n\n` +
+      `To move forward, approve the current gate and scaffold the next phase in\n` +
+      `one step:  morph-spec advance ${featureName}\n` +
+      `(this approves the gate that unlocks the next phase folder).`
+    );
+  }
+
+  logHookActivity('enforce-phase-writes', 'PreToolUse', 'ok');
+  pass();
+} catch {
+  // Fail-open
+  process.exit(0);
+}

package/framework/hooks/claude-code/core/gate-guard.js

@@ -0,0 +1,160 @@
+#!/usr/bin/env node
+/**
+ * gate-guard.js — PostToolUse hook (detect-and-warn, never block)
+ *
+ * Closes the gap from issue #63: the trust-mode contract lived only in skill
+ * pseudocode, with nothing verifying the LLM actually honored it. This hook
+ * compares the OBSERVED gate action against the decision the skill persisted
+ * to state.json (`features[feature].gateDecisions[gate]`) and injects a
+ * non-blocking warning when they disagree.
+ *
+ * It is a silent guardrail, NOT an orchestrator (per MORPH.md): it never
+ * blocks, never writes state, and fails open on any error or missing data.
+ *
+ * Two mismatch directions:
+ *  - LLM PAUSED (AskUserQuestion on a gate) but the persisted decision said
+ *    pause:false  → over-pausing under trust:auto. Warn.
+ *  - LLM AUTO-APPROVED (gate became approvedBy:"auto") but the persisted
+ *    decision said pause:true → skipped a required human pause. Warn.
+ *
+ * Coherent action, no persisted decision, or any error → silence.
+ */
+
+import { readFileSync } from 'fs';
+import { loadState, stateExists } from '../../shared/state-reader.js';
+import { injectContext, pass } from '../../shared/hook-response.js';
+
+function readStdin() {
+  try {
+    return JSON.parse(readFileSync(0, 'utf8') || '{}');
+  } catch {
+    return {};
+  }
+}
+
+function projectDir() {
+  return process.env.CLAUDE_PROJECT_DIR || process.cwd();
+}
+
+function findActiveFeature(state) {
+  if (!state.features) return null;
+  const entries = Object.entries(state.features);
+  const active = entries.find(([, f]) => f.status === 'in_progress');
+  if (active) return active[0];
+  return entries[0]?.[0] ?? null;
+}
+
+/** Map a gate question's text to a gate id. Mirrors state-sync.js. */
+function gateFromQuestion(question) {
+  if (typeof question !== 'string') return null;
+  const lower = question.toLowerCase();
+  if (lower.includes('gate 1') || lower.includes('proposta')) return 'proposal';
+  if (lower.includes('gate 2') || lower.includes('plano') || lower.includes('plan')) return 'plan';
+  if (lower.includes('gate 3') || lower.includes('review')) return 'review';
+  return null;
+}
+
+function getDecision(state, feature, gate) {
+  const d = state.features?.[feature]?.gateDecisions?.[gate];
+  if (!d || typeof d.pause !== 'boolean') return null;
+  return d;
+}
+
+/**
+ * The LLM just asked a gate question. If the persisted decision said this
+ * gate should auto-pass (pause:false), the human was interrupted needlessly.
+ */
+function checkAskUserQuestion(input, state, feature) {
+  // Questions live in tool_input.questions[]; answers in tool_response.
+  const questions = input.tool_input?.questions;
+  const askedTexts = [];
+  if (Array.isArray(questions)) {
+    for (const q of questions) {
+      if (typeof q?.question === 'string') askedTexts.push(q.question);
+      if (typeof q?.header === 'string') askedTexts.push(q.header);
+    }
+  }
+  // Fallback: some payloads only surface answered question keys.
+  const answers = input.tool_response?.answers ?? input.tool_response?.responses;
+  if (answers && typeof answers === 'object') {
+    askedTexts.push(...Object.keys(answers));
+  }
+
+  for (const text of askedTexts) {
+    const gate = gateFromQuestion(text);
+    if (!gate) continue;
+    const decision = getDecision(state, feature, gate);
+    if (!decision) continue; // no persisted decision → nothing to verify
+    if (decision.pause === false) {
+      return injectContext(
+        `⚠️ [morph-spec] GATE OVER-PAUSE — você apresentou o Gate "${gate}" via AskUserQuestion, ` +
+        `mas a decisão registrada em state.json (gateDecisions.${gate}) era pause:false ` +
+        `(trust:${decision.trust ?? 'auto'}, nenhum sinal de risco). ` +
+        `Sob trust:auto sem risco, este gate deveria auto-passar com um summary curto, sem interromper o humano. ` +
+        `Se a pausa foi intencional (você detectou um risco que o registro não capturou), atualize gateDecisions.${gate}.signals antes de prosseguir; ` +
+        `caso contrário, evite pausar gates auto-aprováveis.`
+      );
+    }
+  }
+  return pass();
+}
+
+/**
+ * The LLM just edited state.json. If a gate flipped to approvedBy:"auto" but
+ * the persisted decision said pause:true, a required human pause was skipped.
+ */
+function checkStateEdit(input, state, feature) {
+  const filePath = String(input.tool_input?.file_path ?? '').replace(/\\/g, '/');
+  if (!filePath.endsWith('.morph/state.json')) return pass();
+
+  const gates = state.features?.[feature]?.approvalGates ?? {};
+  for (const gate of ['proposal', 'plan', 'review']) {
+    const g = gates[gate];
+    const autoApproved = g?.approved === true && g?.approvedBy === 'auto';
+    if (!autoApproved) continue;
+    const decision = getDecision(state, feature, gate);
+    if (!decision) continue;
+    if (decision.pause === true) {
+      return injectContext(
+        `⚠️ [morph-spec] GATE SKIPPED PAUSE — o Gate "${gate}" foi marcado approvedBy:"auto" em state.json, ` +
+        `mas a decisão registrada (gateDecisions.${gate}) era pause:true ` +
+        `(sinal: ${decision.reason || 'risco detectado'}). ` +
+        `Um sinal de risco exigia pausa humana via AskUserQuestion — uma auto-aprovação aqui ignora o trust mode. ` +
+        `Reabra o gate com AskUserQuestion (label "aprovado, prosseguir") ou corrija o sinal de risco antes de avançar.`
+      );
+    }
+  }
+  return pass();
+}
+
+function main() {
+  const cwd = projectDir();
+  if (!stateExists(cwd)) return pass();
+
+  const input = readStdin();
+  const toolName = input.tool_name;
+
+  // Short-circuit before loading state: a Write/Edit only matters if it touched
+  // state.json. Skip the disk read for the dozens of unrelated edits per feature.
+  if (toolName === 'Edit' || toolName === 'Write') {
+    const fp = String(input.tool_input?.file_path ?? '').replace(/\\/g, '/');
+    if (!fp.endsWith('.morph/state.json')) return pass();
+  } else if (toolName !== 'AskUserQuestion') {
+    return pass();
+  }
+
+  try {
+    const state = loadState(cwd);
+    if (!state) return pass();
+    const feature = findActiveFeature(state);
+    if (!feature) return pass();
+
+    if (toolName === 'AskUserQuestion') return checkAskUserQuestion(input, state, feature);
+    if (toolName === 'Edit' || toolName === 'Write') return checkStateEdit(input, state, feature);
+  } catch {
+    // fail-open
+  }
+  return pass();
+}
+
+main();

package/framework/hooks/claude-code/core/protect-spec-files.js

@@ -11,11 +11,14 @@
  *
  * Semantic exception for files in MUTABLE_SPEC_FIELDS (e.g. tasks.json):
  * the plan contract is frozen, but per-task progress fields (status, outputs,
- * notes) may still change during the implement phase. For those files a Write
- * is allowed only when the semantic diff touches solely the mutable fields;
- * Edit is always blocked because the legitimate progress path is a full Write
- * via writeTasksJson(). This lets the implement phase record task status
- * without unfreezing the plan.
+ * notes) may still change during the implement phase. For those files BOTH a
+ * full Write and a targeted Edit are allowed — but only when the semantic diff
+ * touches solely the mutable fields. The Edit is simulated (old_string →
+ * new_string applied to the current file) and diffed exactly like a Write, so a
+ * one-field status flip via Edit is permitted while any change to the frozen
+ * plan contract (titles, dependencies, doneCriteria, the task set) is blocked.
+ * This is the sanctioned progress path — the agent never has to rewrite the
+ * whole file nor reach for a Node script to record task status.
  *
  * Fail-open: exits 0 on any error.
  */
@@ -129,40 +132,39 @@ try {
   // that touches only those fields. Anything else stays blocked.
   if (mutableFields) {
     const toolName = getToolName(payload);
-    const newContent = payload?.tool_input?.content;
-
-    // Edit is never the legitimate progress path — progress is written as a
-    // full file via writeTasksJson(). Block Edit; fall through to the message.
-    if (toolName !== 'Write' || typeof newContent !== 'string') {
-      logHookActivity('protect-spec-files', 'PreToolUse', 'blocked');
-      block(
-        `MORPH-SPEC: '${filename}' is locked — the '${requiredGate}' gate has been approved.\n` +
-        `Progress updates (${mutableFields.join(', ')}) must be written as a full-file\n` +
-        `Write, not an Edit. The plan contract (titles, dependencies, doneCriteria…)\n` +
-        `is frozen. To change the plan itself, ask the user to revoke the\n` +
-        `'${requiredGate}' gate in .morph/state.json, then re-present it for approval.`
-      );
-    }
 
-    // Semantic diff: old = current file on disk, new = proposed content.
-    // Any failure to read/parse → fail-open (pass), never a false block.
+    // Build the proposed document from either a full Write or a targeted Edit,
+    // then semantic-diff it against the current file on disk. Any failure to
+    // read / parse / apply → fail-open (pass), never a false block.
+    const absPath = isAbsolute(filePath) ? filePath : join(process.cwd(), filePath);
     let oldDoc, newDoc;
     try {
-      // filePath may already be absolute (Claude Code usually sends absolute
-      // paths); only join against cwd when it is relative.
-      const absPath = isAbsolute(filePath) ? filePath : join(process.cwd(), filePath);
-      oldDoc = JSON.parse(readFileSync(absPath, 'utf-8'));
-      newDoc = JSON.parse(newContent);
+      const original = readFileSync(absPath, 'utf-8');
+      oldDoc = JSON.parse(original);
+
+      if (toolName === 'Edit') {
+        // Simulate the edit: apply old_string → new_string to the current file.
+        const oldStr = payload?.tool_input?.old_string;
+        const newStr = payload?.tool_input?.new_string;
+        if (typeof oldStr !== 'string' || typeof newStr !== 'string') throw new Error('no edit strings');
+        const edited = payload?.tool_input?.replace_all
+          ? original.split(oldStr).join(newStr)
+          : original.replace(oldStr, newStr);
+        newDoc = JSON.parse(edited);
+      } else {
+        const newContent = payload?.tool_input?.content;
+        if (typeof newContent !== 'string') throw new Error('no content');
+        newDoc = JSON.parse(newContent);
+      }
     } catch {
-      // Cannot compare — fail-open rather than block a possibly-valid write.
       logHookActivity('protect-spec-files', 'PreToolUse', 'ok');
       pass();
     }
 
     const violations = diffPlanContract(oldDoc, newDoc, mutableFields);
     if (violations.length === 0) {
-      // Only mutable progress fields changed — this is a legitimate
-      // implement-phase update.
+      // Only mutable progress fields changed — a legitimate implement-phase
+      // update via Write OR Edit.
       logHookActivity('protect-spec-files', 'PreToolUse', 'ok');
       pass();
     }
@@ -170,7 +172,7 @@ try {
     logHookActivity('protect-spec-files', 'PreToolUse', 'blocked');
     block(
       `MORPH-SPEC: '${filename}' is locked — the '${requiredGate}' gate has been approved.\n` +
-      `This Write changes the frozen plan contract:\n` +
+      `This ${toolName} changes the frozen plan contract:\n` +
       violations.map(v => `  • ${v}`).join('\n') + '\n\n' +
       `During the implement phase only these fields may change: ${mutableFields.join(', ')}.\n` +
       `To change the plan itself, ask the user to revoke the '${requiredGate}' gate\n` +