@qijenchen/design-system 0.1.0-beta.13 → 0.1.0-beta.131

package/ds-canonical/hooks/check_canonical_propagation.sh

@@ -4,7 +4,7 @@
 # Merges 3 PreToolUse hooks(原各檔已 retire,合併入此):
 #   E.1 principles canonical(原 check_principles_canonical,P0 BLOCK new file / P1 warn existing)
 #   E.2 L3 primitive import(原 check_l3_primitive_import,P0 BLOCK)
-#   E.3 spec-impl default alignment(原 check_spec_impl_default_alignment,P1 stderr)
+#   E.3 spec-impl default alignment(原 check_spec_impl_default_alignment,P1 context)
 #
 # Why merge:皆 canonical SSOT propagation invariant — principles structure / L3 layer 邊界 /
 # spec→impl 一致性,共用 INPUT parsing 模式。散裝是 M17 + Anthropic ≤ 15 hook 偏離。
@@ -23,22 +23,81 @@ source "$(dirname "$0")/_log-fire.sh" 2>/dev/null && log_hook_fire
 
 set -uo pipefail
 
+_HOOK_CONTEXT_EVENT="PreToolUse"
+_HOOK_OUTPUT_CAPTURE=$(mktemp "${TMPDIR:-/tmp}/check-canonical-propagation.XXXXXX") || {
+  printf 'GOVERNANCE_INTEGRITY: canonical propagation output capture unavailable\n' >&2
+  exit 70
+}
+exec 3>&1 4>&2
+exec >"$_HOOK_OUTPUT_CAPTURE" 2>&1
+
+_finalize_hook_output() {
+  _hook_rc=$?
+  trap - EXIT
+  exec 1>&3 2>&4
+  _hook_output=$(cat "$_HOOK_OUTPUT_CAPTURE" 2>/dev/null || true)
+  rm -f "$_HOOK_OUTPUT_CAPTURE" 2>/dev/null || true
+
+  case "$_hook_rc" in
+    0)
+      [ -z "$_hook_output" ] && exit 0
+      if ! jq -cn \
+        --arg event "$_HOOK_CONTEXT_EVENT" \
+        --arg message "$_hook_output" \
+        '{governanceContext:{hookEventName:$event,message:$message}}'; then
+        printf 'GOVERNANCE_INTEGRITY: canonical propagation warning envelope encoding failed\n' >&2
+        exit 70
+      fi
+      exit 0
+      ;;
+    2)
+      if grep -q 'GOVERNANCE_INTEGRITY:' <<<"$_hook_output"; then
+        printf '%s\n' "$_hook_output" >&2
+        exit 70
+      elif [ -n "$_hook_output" ]; then
+        printf '%s\n' "$_hook_output" >&2
+      else
+        printf 'canonical propagation hook blocked without diagnostic\n' >&2
+      fi
+      exit 2
+      ;;
+    70)
+      if [ -n "$_hook_output" ]; then
+        printf '%s\n' "$_hook_output" >&2
+      else
+        printf 'GOVERNANCE_INTEGRITY: canonical propagation failed without diagnostic\n' >&2
+      fi
+      exit 70
+      ;;
+    *)
+      printf 'GOVERNANCE_INTEGRITY: canonical propagation undefined exit code %s\n' "$_hook_rc" >&2
+      [ -n "$_hook_output" ] && printf '%s\n' "$_hook_output" >&2
+      exit 70
+      ;;
+  esac
+}
+trap _finalize_hook_output EXIT
+
 INPUT=$(cat)
-TOOL=$(echo "$INPUT" | jq -r '.tool_name // ""')
-FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // ""')
+if ! jq -e 'type == "object"' <<<"$INPUT" >/dev/null 2>&1; then
+  printf 'GOVERNANCE_INTEGRITY: canonical propagation invalid input envelope\n' >&2
+  exit 70
+fi
+TOOL=$(jq -r '.tool_name // ""' <<<"$INPUT")
+FILE_PATH=$(jq -r '.tool_input.file_path // ""' <<<"$INPUT")
 
 case "$TOOL" in
   Edit|Write|MultiEdit) ;;
   *) exit 0 ;;
 esac
 
-NEW_CONTENT=$(echo "$INPUT" | jq -r '
+NEW_CONTENT=$(jq -r '
   (.tool_input.content // "") + "\n" +
   (.tool_input.new_string // "") + "\n" +
   ([.tool_input.edits[]? | .new_string] | join("\n"))
-' 2>/dev/null || echo "")
+' <<<"$INPUT" 2>/dev/null || echo "")
 
-[ -z "${NEW_CONTENT//[[:space:]]/}" ] && exit 0
+grep -q '[^[:space:]]' <<<"$NEW_CONTENT" || exit 0
 
 WORST=0
 record_worst() { local lvl=$1; [ "$lvl" -gt "$WORST" ] && WORST=$lvl; }
@@ -46,19 +105,19 @@ record_worst() { local lvl=$1; [ "$lvl" -gt "$WORST" ] && WORST=$lvl; }
 # ── E.1 principles canonical(*.principles.stories.tsx)──────────────────────
 case "$FILE_PATH" in
   *.principles.stories.tsx)
-    if ! echo "$NEW_CONTENT" | grep -q "@principles-rationale:"; then
+    if ! grep -q "@principles-rationale:" <<<"$NEW_CONTENT"; then
       EXISTING_CONTENT=""
       [ -f "$FILE_PATH" ] && EXISTING_CONTENT=$(cat "$FILE_PATH" 2>/dev/null || echo "")
       FULL_CONTENT="${EXISTING_CONTENT}
 ${NEW_CONTENT}"
-      STORY_EXPORTS=$(echo "$FULL_CONTENT" | grep -oE "^export const [A-Z][a-zA-Z]+" | awk '{print $3}' | sort -u)
+      STORY_EXPORTS=$(grep -oE "^export const [A-Z][a-zA-Z]+" <<<"$FULL_CONTENT" | awk '{print $3}' | sort -u)
 
       VIOLATIONS_E1=""
       WARNINGS_E1=""
 
       DEPRECATED_NAMES=("Forbidden" "Donts" "Pitfalls" "Prohibitions" "NonGoals" "VisualDonts")
       for deprecated in "${DEPRECATED_NAMES[@]}"; do
-        if echo "$STORY_EXPORTS" | grep -qE "^${deprecated}"; then
+        if grep -qE "^${deprecated}" <<<"$STORY_EXPORTS"; then
           if [ -z "$EXISTING_CONTENT" ]; then
             VIOLATIONS_E1="${VIOLATIONS_E1}\n  • [P0] Deprecated naming '${deprecated}*' — rename to 'WhenNotToUse'"
           else
@@ -68,22 +127,22 @@ ${NEW_CONTENT}"
       done
 
       HAS_WHEN_TO_USE=0; HAS_WHEN_NOT_TO_USE=0; HAS_VS_RULE=0; HAS_CONTENT_GUIDELINES=0; HAS_USAGE_GUIDANCE=0
-      echo "$STORY_EXPORTS" | grep -qE "^WhenToUse$" && HAS_WHEN_TO_USE=1
-      echo "$STORY_EXPORTS" | grep -qE "^WhenNotToUse$" && HAS_WHEN_NOT_TO_USE=1
-      echo "$STORY_EXPORTS" | grep -qE "^Vs[A-Z].*Rule$|^.+Vs.+Rule$" && HAS_VS_RULE=1
-      echo "$STORY_EXPORTS" | grep -qE "^ContentGuidelines$" && HAS_CONTENT_GUIDELINES=1
-      echo "$STORY_EXPORTS" | grep -qE "^(UsageScenarioRule|WhatItIs)$" && HAS_WHEN_TO_USE=1
+      grep -qE "^WhenToUse$" <<<"$STORY_EXPORTS" && HAS_WHEN_TO_USE=1
+      grep -qE "^WhenNotToUse$" <<<"$STORY_EXPORTS" && HAS_WHEN_NOT_TO_USE=1
+      grep -qE "^Vs[A-Z].*Rule$|^.+Vs.+Rule$" <<<"$STORY_EXPORTS" && HAS_VS_RULE=1
+      grep -qE "^ContentGuidelines$" <<<"$STORY_EXPORTS" && HAS_CONTENT_GUIDELINES=1
+      grep -qE "^(UsageScenarioRule|WhatItIs)$" <<<"$STORY_EXPORTS" && HAS_WHEN_TO_USE=1
       for deprecated in "${DEPRECATED_NAMES[@]}"; do
-        echo "$STORY_EXPORTS" | grep -qE "^${deprecated}" && HAS_WHEN_NOT_TO_USE=1
+        grep -qE "^${deprecated}" <<<"$STORY_EXPORTS" && HAS_WHEN_NOT_TO_USE=1
       done
-      echo "$STORY_EXPORTS" | grep -qE "^UsageGuidance$" && HAS_USAGE_GUIDANCE=1
+      grep -qE "^UsageGuidance$" <<<"$STORY_EXPORTS" && HAS_USAGE_GUIDANCE=1
 
       CORE_COUNT=$((HAS_WHEN_TO_USE + HAS_WHEN_NOT_TO_USE + HAS_VS_RULE + HAS_CONTENT_GUIDELINES))
       [ "$HAS_USAGE_GUIDANCE" -eq 1 ] && CORE_COUNT=2
 
       if [ "$CORE_COUNT" -lt 2 ]; then
         if [ -z "$EXISTING_CONTENT" ]; then
-          VIOLATIONS_E1="${VIOLATIONS_E1}\n  • [P0] Universal core ≥ 2 required: have ${CORE_COUNT} of {WhenToUse, WhenNotToUse, Vs*Rule, ContentGuidelines}"
+          VIOLATIONS_E1="${VIOLATIONS_E1}\n  • [P0] Need ONE complete UsageGuidance or ≥ 2 split decision dimensions; have ${CORE_COUNT}/2"
         else
           WARNINGS_E1="${WARNINGS_E1}\n  • [P1] Universal core ${CORE_COUNT}/2 — add WhenToUse / WhenNotToUse / Vs*Rule / ContentGuidelines"
         fi
@@ -98,7 +157,9 @@ ${NEW_CONTENT}"
 Violations:$(echo -e "$VIOLATIONS_E1")
 
 Per category-templates.md「Principles canonical」:
-  ‣ Universal core ≥ 2 of {WhenToUse, WhenNotToUse, Vs*Rule, ContentGuidelines}
+  ‣ ONE complete UsageGuidance is sufficient
+  ‣ Split style needs ≥ 2 distinct dimensions of {WhenToUse, WhenNotToUse, Vs*Rule, ContentGuidelines}
+  ‣ Extra stories only when they teach a distinct topic and pass earn-existence
   ‣ Anti-pattern naming → WhenNotToUse(Forbidden/Donts/Pitfalls/Prohibitions/NonGoals/VisualDonts deprecated)
   ‣ 例外:加 \`// @principles-rationale: <reason>\`
 
@@ -119,15 +180,15 @@ case "$FILE_PATH" in
         # File-level allowlist:檔頭 5 行
         ALLOW_E2=0
         FIRST_LINES_E2=$(printf '%s\n' "$NEW_CONTENT" | sed -n '1,5p')
-        echo "$FIRST_LINES_E2" | grep -qE '//[[:space:]]*@l3-import-allow:' && ALLOW_E2=1
+        grep -qE '//[[:space:]]*@l3-import-allow:' <<<"$FIRST_LINES_E2" && ALLOW_E2=1
         if [ -f "$FILE_PATH" ] && [ "$ALLOW_E2" = "0" ]; then
           ON_DISK_FIRST=$(sed -n '1,5p' "$FILE_PATH" 2>/dev/null || true)
-          echo "$ON_DISK_FIRST" | grep -qE '//[[:space:]]*@l3-import-allow:' && ALLOW_E2=1
+          grep -qE '//[[:space:]]*@l3-import-allow:' <<<"$ON_DISK_FIRST" && ALLOW_E2=1
         fi
         if [ "$ALLOW_E2" = "0" ]; then
           L3_IMPORT_PATTERN='from\s+["'"'"'][^"'"'"']*patterns/element-anatomy/item-anatomy["'"'"']'
-          if printf '%s\n' "$NEW_CONTENT" | grep -qE "$L3_IMPORT_PATTERN"; then
-            MATCHED_LINE=$(printf '%s\n' "$NEW_CONTENT" | grep -nE "$L3_IMPORT_PATTERN" | head -1)
+          if grep -qE "$L3_IMPORT_PATTERN" <<<"$NEW_CONTENT"; then
+            MATCHED_LINE=$(grep -m 1 -nE "$L3_IMPORT_PATTERN" <<<"$NEW_CONTENT")
             cat >&2 <<EOF
 
 ┄┄┄ E.2 check_canonical_propagation — L3 primitive import BLOCKER ┄┄┄
@@ -158,8 +219,8 @@ esac
 case "$FILE_PATH" in
   *.spec.md)
     FIRST_LINES_E3=$(printf '%s\n' "$NEW_CONTENT" | sed -n '1,5p')
-    if ! echo "$FIRST_LINES_E3" | grep -q '@spec-impl-allow'; then
-      DEFAULT_LINES=$(printf '%s' "$NEW_CONTENT" | grep -nE '預設|預値|default[ \t]*[=:]|`default`|預設值' | head -3)
+    if ! grep -q '@spec-impl-allow' <<<"$FIRST_LINES_E3"; then
+      DEFAULT_LINES=$(grep -m 3 -nE '預設|預値|default[ \t]*[=:]|`default`|預設值' <<<"$NEW_CONTENT")
       if [ -n "$DEFAULT_LINES" ]; then
         cat >&2 <<EOF
 

package/ds-canonical/hooks/check_chrome_header_avatar_canonical.sh

@@ -0,0 +1,106 @@
+#!/bin/bash
+# check_chrome_header_avatar_canonical.sh — PreToolUse Edit/Write 攔 chrome header descendant 用 ItemAvatar(2026-05-27)
+#
+# Per user 2026-05-27 抓 UserFooter vertical stack drift + codex collab Step 4 cite battle:
+#   header-canonical.spec.md:57-72 + sidebar.spec.md:241-247 + item-anatomy.spec.md:513-537 明文:
+#   「Chrome header 不是 row context → 必 raw <Avatar size={24}>,禁 <ItemAvatar>(會誤啟動 row anatomy lookup)」
+#
+# Detection:
+#   PreToolUse Edit/Write content 偵測 `<SidebarHeader>` block 內含 `<ItemAvatar` → soft BLOCKER inject
+#   (允許 SidebarFooter 內 ItemAvatar — footer 是 SidebarMenu row context)
+#
+# Scope:
+#   - packages/design-system/src/components/Sidebar/**.tsx + **.stories.tsx
+#   - apps/**.tsx (consumer)
+#   - node_modules/@qijenchen/design-system/**(禁改 — block_prototype_imports 已攔)
+#
+# 對應 audit dim 預留 — TBD 升 audit dim 65
+
+source "$(dirname "$0")/_log-fire.sh" 2>/dev/null && log_hook_fire
+source "$(dirname "$0")/lib/_hook_integrity.sh" 2>/dev/null || {
+  printf 'GOVERNANCE_INTEGRITY: hook integrity helper unavailable\n' >&2
+  exit 70
+}
+
+set -uo pipefail
+governance_hook_load_input
+governance_hook_require_commands python3
+TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // ""' 2>/dev/null) \
+  || governance_hook_integrity_fail 'chrome-header tool extraction failed'
+FILE_PATH=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // ""' 2>/dev/null) \
+  || governance_hook_integrity_fail 'chrome-header path extraction failed'
+EVENT=$(printf '%s' "$INPUT" | jq -r '.hook_event_name // ""' 2>/dev/null) \
+  || governance_hook_integrity_fail 'chrome-header event extraction failed'
+NEW=$(printf '%s' "$INPUT" | jq -r '.tool_input.content // .tool_input.new_string // ""' 2>/dev/null) \
+  || governance_hook_integrity_fail 'chrome-header content extraction failed'
+
+[ "$EVENT" != "PreToolUse" ] && exit 0
+case "$TOOL" in Edit|Write|MultiEdit) ;; *) exit 0 ;; esac
+case "$FILE_PATH" in *.tsx) ;; *) exit 0 ;; esac
+case "$FILE_PATH" in *.test.tsx|*.spec.md) exit 0 ;; esac
+
+# Multi-line detection:`<SidebarHeader>...<ItemAvatar...>...</SidebarHeader>` block
+# Use python for proper multiline match
+# 2026-06-11 R2 held-item #9:strip 註解再 match — apps/template/src/App.tsx:57 canonical citation
+# 註解({/* ... 禁用 <ItemAvatar> ... */})在 SidebarHeader block 內被當真 JSX 誤發 P0(code 實際正確
+# 用 raw <Avatar size={24}>)。Strip 順序:JSX comment {/* */} → block comment /* */ → 行首 // 整行
+# (不 strip 行內 //,避免 mutilate https:// URL — 對齊 check_story_invariants.sh R9 idiom)。
+HAS_DRIFT=$(printf '%s' "$NEW" | python3 -c '
+import sys, re
+content = sys.stdin.read()
+# Strip comments(citation 註解含 <ItemAvatar> 字樣不是 drift)
+content = re.sub(r"\{/\*.*?\*/\}", "", content, flags=re.DOTALL)
+content = re.sub(r"/\*.*?\*/", "", content, flags=re.DOTALL)
+content = re.sub(r"(?m)^[ \t]*//.*$", "", content)
+# Find SidebarHeader blocks(opening tag → closing tag,non-greedy)
+blocks = re.findall(r"<SidebarHeader[^>]*>.*?</SidebarHeader>", content, re.DOTALL)
+for block in blocks:
+    if re.search(r"<ItemAvatar\b", block):
+        print("DRIFT")
+        sys.exit(0)
+' 2>/dev/null) || governance_hook_integrity_fail 'chrome-header parser failed'
+
+[ "$HAS_DRIFT" != "DRIFT" ] && exit 0
+
+# Override env var
+if [ "${GOVERNANCE_BYPASS_CHROME_HEADER_AVATAR:-0}" = "1" ]; then
+  if STATE_DIR="$(governance_runtime_state_dir 2>/dev/null)"; then
+    mkdir -p "$STATE_DIR" 2>/dev/null
+    jq -nc --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" --arg file "$FILE_PATH" \
+      '{ts:$ts,event:"chrome-header-avatar-bypass",file:$file}' >> "$STATE_DIR/governance-bypass.jsonl" 2>/dev/null || true
+  fi
+  exit 0
+fi
+
+REL=${FILE_PATH#*/my-project/}
+
+cat >&2 <<EOF
+🚨 Chrome header avatar canonical violation(per user 2026-05-27 抓 + codex collab cite battle):
+
+📁 File: $REL
+🔍 偵測:<SidebarHeader> block 內含 <ItemAvatar>(禁用)
+
+Canonical citation:
+  - header-canonical.spec.md:57-72:「Chrome header 不是 row context → 必用 raw <Avatar size={24}>,禁用 <ItemAvatar>(會誤啟動 row anatomy lookup)」
+  - sidebar.spec.md:241-247:「consumer 用 raw <Avatar size={24}>(chrome header 不是 row context → 不該用 <ItemAvatar>)」
+  - item-anatomy.spec.md:513-537:「ItemAvatar scope = row context only;Chrome header 有自己的 canonical = raw <Avatar size={24}>」
+
+修法(per DS canonical):
+  ❌ <SidebarHeader>
+       <ItemAvatar alt="..." shape="square" color="..." solid />
+       <span>brand</span>
+     </SidebarHeader>
+
+  ✅ <SidebarHeader>
+       <Avatar size={24} shape="square" color="..." solid alt="..." />
+       <span className="text-body-lg font-medium truncate">brand</span>
+     </SidebarHeader>
+
+注意:SidebarFooter 內 ItemAvatar OK(footer 是 SidebarMenu row context)。本 hook 只攔 SidebarHeader。
+
+Bypass(極罕見):GOVERNANCE_BYPASS_CHROME_HEADER_AVATAR=1 env var(audit-logged)。
+EOF
+# 2026-05-31:exit 0 → exit 2(folded-hook-audit:原宣稱 BLOCKER 但 exit 0 = 假 enforcement;
+# chrome-header avatar 是 SSOT canonical [feedback_ssot_mechanical_p0_not_p1 = 必 P0 BLOCK],
+# verified clean on 現有 canonical sidebar code + 有 env escape 兜 false-positive)。
+exit 2

package/ds-canonical/hooks/check_codex_brief_invariants.sh

@@ -1,50 +1,122 @@
 #!/bin/bash
-# Codex brief invariants enforcement(2026-05-23 永久 per user verbatim「codex 跑的稽核流程理應要跟你跑的深度稽核流程是一模一樣 SSOT 的不能偏移」)
+# Peer brief invariants enforcement(legacy filename retained for compatibility).
 #
-# PreToolUse(Bash)hook:catch codex exec / cat ... | codex exec / 任何 codex CLI invocation
-# Scan codex brief content for 3 mandatory invariants(per feedback_codex_brief_invariants_2026_05_23.md):
+# PreToolUse(Bash) hook:catch the registry-resolved independent peer CLI invocation.
+# Scan the peer brief content for 7 mandatory invariants(the author and independent peer must
+# receive the same task, evidence inventory, and decision rubric):
 #   1. 全盤閱讀(全部 source 列舉 or 「DS-wide」「全盤閱讀」「全 N files」 keyword)
 #   2. Triple-verify(「triple-verify」/「三重驗證」/「grep + Read + canonical exception」 keyword)
 #   3. 禁抽樣(「禁抽樣」/「禁 sample」/「NO-SAMPLE」/「DS-wide ALL files」 keyword)
+#   4. 禁列檔(「禁列檔」/「禁 rg --files」/「只讀 N file」/「直接出 verdict」 keyword)
+#   5. 輸入對等(閱讀清單逐字鏡射 A.0:含 meta-patterns rules + memory MEMORY.md index 錨點)
+#   6. 判準對等(brief 給 peer audit-prompts.md 每-dim rubric + 逐 dim 套用)
+#   7. A.1b 對等(brief 要求 peer 做 per-component claim-vs-code 對抗驗證 = author A.1b 鏡像)
 #
-# 缺任一 → exit 2 BLOCKER(stop codex 啟動)。Escape:brief 含 `// @codex-brief-invariant-skip: <rationale>`(極罕見)。
+# 缺任一 → exit 2 BLOCKER(stop peer 啟動)。Escape:brief 含 `// @peer-brief-invariant-skip: <rationale>`(極罕見)。
+
+fail_integrity() {
+  printf 'GOVERNANCE_INTEGRITY: peer brief enforcement %s\n' "$1" >&2
+  exit 70
+}
 
 source "$(dirname "$0")/_log-fire.sh" 2>/dev/null && log_hook_fire
+source "$(dirname "$0")/lib/_provider_paths.sh" 2>/dev/null \
+  || fail_integrity "canonical provider resolver unavailable"
 
 set -uo pipefail
 
-INPUT=$(cat 2>/dev/null || echo "{}")
-TOOL=$(echo "$INPUT" | jq -r '.tool_name // ""' 2>/dev/null)
-EVENT=$(echo "$INPUT" | jq -r '.hook_event_name // ""' 2>/dev/null)
+INPUT=$(cat 2>/dev/null) || fail_integrity "could not read hook input"
+if ! printf '%s' "$INPUT" | jq -e '
+  type == "object"
+  and (.tool_name | type == "string")
+  and (.tool_input | type == "object")
+' >/dev/null 2>&1; then
+  fail_integrity "input envelope is invalid"
+fi
+TOOL=$(jq -r '.tool_name // ""' <<<"$INPUT" 2>/dev/null)
+EVENT=$(jq -r '.hook_event_name // ""' <<<"$INPUT" 2>/dev/null)
+
+SELF_PROVIDER="${GOVERNANCE_SELF_PROVIDER:-${GOVERNANCE_PROVIDER:-}}"
+PEER_PROVIDER="${GOVERNANCE_PEER_PROVIDER:-}"
+PEER_DISPLAY_NAME="${GOVERNANCE_PEER_DISPLAY_NAME:-${PEER_PROVIDER:-independent peer}}"
+PEER_CLI="${GOVERNANCE_PEER_CLI:-}"
+PEER_MARKERS_JSON="${GOVERNANCE_PEER_BRIEF_MARKERS_JSON:-[]}"
+
+# These values are injected from the validated provider registry. Direct execution without a
+# complete context is blocked instead of silently applying a one-way provider assumption.
+if ! printf '%s' "$SELF_PROVIDER" | grep -qE '^[a-z][a-z0-9-]*$' \
+  || ! printf '%s' "$PEER_PROVIDER" | grep -qE '^[a-z][a-z0-9-]*$' \
+  || ! printf '%s' "$PEER_CLI" | grep -qE '^[a-z][a-z0-9-]*$'; then
+  fail_integrity "registry-resolved self/peer CLI context is missing or invalid"
+fi
+CANONICAL_RULE_REL="$(governance_canonical_relative_root rules 2>/dev/null)" \
+  || fail_integrity "canonical rule root is unavailable"
+CANONICAL_SKILL_REL="$(governance_canonical_relative_root skills 2>/dev/null)" \
+  || fail_integrity "canonical skill root is unavailable"
+
+PEER_MARKER_RE=$(
+  node -- "$(dirname "$0")/lib/provider-marker-regex.mjs" \
+    peer-invocation "$PEER_MARKERS_JSON" 2>/dev/null
+) || {
+  fail_integrity "registry-resolved peer invocation markers are missing or invalid"
+}
 
 case "${TOOL:-}" in
   Bash) ;;
   *) exit 0 ;;
 esac
 
-CMD=$(echo "$INPUT" | jq -r '.tool_input.command // ""' 2>/dev/null)
+CMD=$(jq -r '.tool_input.command // ""' <<<"$INPUT" 2>/dev/null)
 
-# Only fire on codex CLI invocations
-if ! echo "$CMD" | grep -qE 'codex[[:space:]]+(exec|review)|node_modules/.bin/codex'; then
+# Only fire on peer CLI invocations actually executing a brief
+# (must be followed by `exec` or `review` subcommand; bare path mention like
+# `ls node_modules/.bin/<peer>` or `which <peer>` is discovery, not a brief).
+if ! grep -qE "(^|[[:space:]/])${PEER_CLI}[[:space:]]+(${PEER_MARKER_RE})([[:space:]]|$)" <<<"$CMD"; then
   exit 0
 fi
 
-# Extract brief content — handles `cat /tmp/file | codex exec` OR `codex exec "inline"` patterns
+# Discovery / introspection flags are not briefs — skip
+if grep -qE '(^|[[:space:]])-{1,2}(help|h|version|V)\b' <<<"$CMD"; then
+  exit 0
+fi
+
+# Extract brief content — handles multiple invocation patterns:
+#   1. `cat /tmp/file | <peer> <marker>`          (cat-pipe → file)
+#   2. `<peer> <marker> "$(cat /tmp/file)"`       (arg-substitution → file)
+#   3. `<peer> <marker> < /tmp/file`              (stdin redirect → file)
+#   4. `<peer> <marker> "inline brief..."`        (inline arg → CMD itself)
 BRIEF_CONTENT=""
-if echo "$CMD" | grep -qE 'cat[[:space:]]+[^|]+\|[[:space:]]*[^|]*codex'; then
-  # cat-pipe pattern — try reading the cat'd file
-  BRIEF_FILE=$(echo "$CMD" | grep -oE 'cat[[:space:]]+[^[:space:]|]+' | head -1 | sed 's/^cat[[:space:]]*//')
-  if [ -n "$BRIEF_FILE" ] && [ -f "$BRIEF_FILE" ]; then
-    BRIEF_CONTENT=$(cat "$BRIEF_FILE" 2>/dev/null)
-  fi
-fi
-# Inline prompt pattern fallback — grab everything after `codex exec` quotes
+BRIEF_FILE=""
+
+# Pattern 1: cat-pipe
+if grep -qE "cat[[:space:]]+[^|]+\\|[[:space:]]*[^|]*${PEER_CLI}" <<<"$CMD"; then
+  BRIEF_FILE=$(grep -m 1 -oE 'cat[[:space:]]+[^[:space:]|]+' <<<"$CMD" | sed 's/^cat[[:space:]]*//')
+fi
+
+# Pattern 2: arg-substitution `"$(cat /path)"` or `$(cat /path)`
+if [ -z "$BRIEF_FILE" ] && grep -qE '\$\([[:space:]]*cat[[:space:]]+[^)]+\)' <<<"$CMD"; then
+  BRIEF_FILE=$(grep -m 1 -oE '\$\([[:space:]]*cat[[:space:]]+[^)]+\)' <<<"$CMD" | sed -E 's/^\$\([[:space:]]*cat[[:space:]]+//; s/[[:space:]]*\)$//')
+fi
+
+# Pattern 3: stdin redirect `< /path`
+if [ -z "$BRIEF_FILE" ] && grep -qE "(^|[[:space:]/])${PEER_CLI}[[:space:]]+(${PEER_MARKER_RE})([[:space:]]|$).*<[[:space:]]*[^[:space:]<>|&]+" <<<"$CMD"; then
+  BRIEF_FILE=$(grep -m 1 -oE '<[[:space:]]*[^[:space:]<>|&]+' <<<"$CMD" | sed -E 's/^<[[:space:]]*//')
+fi
+
+if [ -n "$BRIEF_FILE" ] && [ -f "$BRIEF_FILE" ]; then
+  BRIEF_CONTENT=$(cat "$BRIEF_FILE" 2>/dev/null) \
+    || fail_integrity "could not read the resolved brief file"
+fi
+
+# Pattern 4 fallback — inline prompt (or unparseable cmd): scan CMD itself
 if [ -z "$BRIEF_CONTENT" ]; then
   BRIEF_CONTENT="$CMD"
 fi
 
-# Escape clause
-if echo "$BRIEF_CONTENT" | grep -qE '@codex-brief-invariant-skip:'; then
+# Escape clause. The neutral marker is canonical;the old Codex marker remains a
+# provider-gated compatibility alias so existing reviewed briefs do not break.
+if grep -qE '@peer-brief-invariant-skip:' <<<"$BRIEF_CONTENT" \
+  || { [ "$PEER_PROVIDER" = "codex" ] && grep -qE '@codex-brief-invariant-skip:' <<<"$BRIEF_CONTENT"; }; then
   exit 0
 fi
 
@@ -52,31 +124,68 @@ fi
 MISSING=""
 
 # 1. 全盤閱讀 invariant
-if ! echo "$BRIEF_CONTENT" | grep -qiE '全盤閱讀|全部 source|DS-wide ALL|read all files|全部.*spec\.md|全[[:space:]]*[0-9]+[[:space:]]*spec|全[[:space:]]*[0-9]+[[:space:]]*stories|全[[:space:]]*[0-9]+[[:space:]]*components'; then
+if ! grep -qiE '全盤閱讀|全部 source|DS-wide ALL|read all files|全部.*spec\.md|全[[:space:]]*[0-9]+[[:space:]]*spec|全[[:space:]]*[0-9]+[[:space:]]*stories|全[[:space:]]*[0-9]+[[:space:]]*components' <<<"$BRIEF_CONTENT"; then
   MISSING="${MISSING}  • 1️⃣ 全盤閱讀 invariant 缺(「全盤閱讀全部 source」/「DS-wide ALL files」/「全 N spec.md」keyword)\n"
 fi
 
 # 2. Triple-verify invariant
-if ! echo "$BRIEF_CONTENT" | grep -qiE 'triple-verify|三重驗證|grep.*Read.*canonical|grep DS-wide.*Read.*exception|前必先 inline 跑|再三確認問題|無病呻吟'; then
+if ! grep -qiE 'triple-verify|三重驗證|grep.*Read.*canonical|grep DS-wide.*Read.*exception|前必先 inline 跑|再三確認問題|無病呻吟' <<<"$BRIEF_CONTENT"; then
   MISSING="${MISSING}  • 2️⃣ Triple-verify invariant 缺(「triple-verify」/「三重驗證」/「禁無病呻吟」keyword)\n"
 fi
 
 # 3. 禁抽樣 invariant
-if ! echo "$BRIEF_CONTENT" | grep -qiE '禁抽樣|禁 sample|NO-SAMPLE|不抽樣|sub-agent.*sampled.*reject|sample.*reject|spot-check.*reject|不應該抽樣'; then
+if ! grep -qiE '禁抽樣|禁 sample|NO-SAMPLE|不抽樣|sub-agent.*sampled.*reject|sample.*reject|spot-check.*reject|不應該抽樣' <<<"$BRIEF_CONTENT"; then
   MISSING="${MISSING}  • 3️⃣ 禁抽樣 invariant 缺(「禁抽樣」/「NO-SAMPLE」/「sample = reject」keyword)\n"
 fi
 
+# 4. 禁列檔 invariant(2026-05-27 token-burn anchor)
+# Peer CLI 不得用全庫無界列檔取代 evidence-complete brief。
+# Brief 必含 directive 限制 peer 探索範圍 — 「只讀 N 列檔 + 禁列檔 / 禁 rg --files / 禁 find 全 repo」
+if ! grep -qiE '禁列檔|禁 rg --files|禁 find 全|只讀.*[0-9]+.*file|限定.*file|targeted rg|不需報告探索|直接出' <<<"$BRIEF_CONTENT"; then
+  MISSING="${MISSING}  • 4️⃣ 禁列檔 invariant 缺(「禁列檔」/「禁 rg --files」/「只讀 N file」/「直接出 verdict」keyword)— per 2026-05-27 token-burn anchor\n"
+fi
+
+# 5️⃣ 輸入對等:author 與 peer 的任務、資訊、閱讀清單要一致。
+# 閱讀清單必逐字鏡射 A.0(泛 glob ≠ 對等;至少含 meta-patterns rules + memory index 兩錨點,
+# 具名鏡射時自然存在)。
+if ! grep -qF "${CANONICAL_RULE_REL}/meta-patterns.md" <<<"$BRIEF_CONTENT" \
+  || ! grep -qF 'governance/memory/MEMORY.md' <<<"$BRIEF_CONTENT"; then
+  MISSING="${MISSING}  • 5️⃣ 輸入對等 invariant 缺(閱讀清單必逐字鏡射 A.0 六項:含 ${CANONICAL_RULE_REL}/meta-patterns.md 等具名 rules + governance/memory/MEMORY.md index;泛 glob 不算)\n"
+fi
+
+# 6️⃣ 判準對等(2026-07-10 user directive「兩邊都用同樣的完美標準去稽核」):brief 必給 peer
+# 我用的每-dim 判準 rubric(audit-prompts.md,SKILL.md:257「Use prompts in audit-prompts.md」=
+# 我的 dim sub-agent 判準 SSOT),並要求逐 dim 套用 —— 只給 dim 編號 = peer 憑自己理解判 =
+# 否則 peer 會在沒有同一治理資訊時憑自己理解判斷。
+if ! grep -qF "${CANONICAL_SKILL_REL}/design-system-audit/references/audit-prompts.md" <<<"$BRIEF_CONTENT"; then
+  # 2026-07-16 fix:原文用 raw backtick 包路徑在雙引號字串內 = command substitution 每 fire 執行該路徑
+  # (stderr 噪音 + 訊息路徑消失)→ 改 \` escape。
+  MISSING="${MISSING}  • 6️⃣ 判準對等 invariant 缺(brief 必給 peer \`${CANONICAL_SKILL_REL}/design-system-audit/references/audit-prompts.md\` 每-dim rubric + 要求逐 dim 套用同一判準;只給 dim 編號 = peer 憑己意判 = 標準不對稱)\n"
+fi
+
+# 7️⃣ A.1b 對等(2026-07-10 user「所有稽核任務都應對等」全盤盤點抓):brief 必要求 peer 做
+# A.1b(per-component claim-vs-code 對抗驗證,讀每元件 .tsx + wrap lib 逐句驗宣稱)—— author
+# 最高產出 pass(2026-05-30 抓 403 findings),漏了 = peer 少做一整趟 = 任務不對等。
+if ! grep -qiE 'A\.1b|claim-vs-code|per-component.*(對抗|逐句|verif)' <<<"$BRIEF_CONTENT"; then
+  MISSING="${MISSING}  • 7️⃣ A.1b 對等 invariant 缺(brief 必要求 peer 做 per-component claim-vs-code 對抗驗證 = author A.1b 鏡像;漏 = 少做最高產出 pass = 任務不對等)\n"
+fi
+
 if [ -n "$MISSING" ]; then
-  printf '🚨 CODEX BRIEF MISSING INVARIANTS BLOCKER(2026-05-23 user verbatim:「codex 會跑的稽核流程理應要跟你跑的深度稽核流程是一模一樣 SSOT 的不能偏移」):\n' >&2
+  printf '🚨 PEER BRIEF MISSING INVARIANTS BLOCKER(self=%s,peer=%s):\n' "$SELF_PROVIDER" "$PEER_PROVIDER" >&2
   printf '\n  Brief 缺以下 invariant:\n' >&2
   printf '%b' "$MISSING" >&2
-  printf '\n  Per memory/feedback_codex_brief_invariants_2026_05_23.md + codex-collab/references/brief-template.md:\n' >&2
-  printf '  必含三 invariant 明文(verbatim):\n' >&2
+  printf '\n  Per the provider-neutral peer brief canonical:\n' >&2
+  printf '  必含七 invariant 明文(verbatim;2026-07-16 同步實數 — 原訊息只列 3,跟上方檢查 7 條 drift):\n' >&2
   printf '    1. 全盤閱讀全部 source(列舉 N files / DS-wide / 禁憑記憶)\n' >&2
   printf '    2. Triple-verify per finding(grep + Read + canonical exception check)\n' >&2
   printf '    3. 禁抽樣(DS-wide ALL files / sub-agent sample admission = reject)\n' >&2
-  printf '\n  修方向:brief content 補上三 invariant 文字。\n' >&2
-  printf '  Escape(極罕見): brief 含 `// @codex-brief-invariant-skip: <rationale>`\n' >&2
+  printf '    4. 禁列檔(禁 rg --files / find 全 repo;只讀 brief 列的 file,直接出 verdict)\n' >&2
+  printf '    5. 輸入對等(閱讀清單具名鏡射 A.0:%s/meta-patterns.md + governance/memory/MEMORY.md)\n' "$CANONICAL_RULE_REL" >&2
+  printf '    6. 判準對等(附 %s/design-system-audit/references/audit-prompts.md 每-dim rubric,逐 dim 套用)\n' "$CANONICAL_SKILL_REL" >&2
+  printf '    7. A.1b 對等(per-component claim-vs-code 對抗驗證 = author A.1b 鏡像)\n' >&2
+  printf '\n  修方向:brief content 補上缺的 invariant 文字(使用 provider-neutral brief template 的「七 invariant」段)。\n' >&2
+  printf '  Peer runtime: %s (%s)\n' "$PEER_DISPLAY_NAME" "$PEER_CLI" >&2
+  printf '  Escape(極罕見): brief 含 `// @peer-brief-invariant-skip: <rationale>`\n' >&2
   exit 2
 fi