@r1z4x/tezgah 1.11.0 → 1.13.0

package/CHANGELOG.md

@@ -6,6 +6,335 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [1.13.0] - 2026-10-29
+
+### Fixed
+
+- **omp handed the Stop rule a message object, not the reply (plan 143).**
+  omp's `session_stop` carries `last_assistant_message` as the object its
+  `getLastAssistantMessage()` returns. The bridge passed it through, so the
+  rule judged `str(dict)`: one line, no list items, diluted prose.
+  - Every line-shaped class read a text with no lines: the list cap, the
+    residual sections, the question the reply ends on, the handed step. The
+    language check read a share that was not the reply's.
+  - Measured on the owner's evidence database: 1643 of 1656 omp `shape` rows
+    of 45 days carried `lines: 1`. Every other host wrote 209 multi-line of
+    231. Of three days' refusals, 24 were `reply language` over such a row.
+  - `stop_reason` reads every reply through `reply_prose` now, so no host can
+    repeat it. The omp bridge sends the text blocks.
+
+### Added
+
+- **The Stop rule knows the host's plan mode (plan 142).** Every Stop adapter
+  passes the host's `permission_mode` to the core now. omp's extension sends
+  `plan` from `ctx.sessionModes.getState()`. `plan` and Droid's `spec` are the
+  read-only ones.
+  - In such a turn the rule lets the approval question through. It used to
+    refuse it as a `needless ask` - the one question that mode allows.
+  - A first-person claim that a command or check ran, made in such a turn, is
+    the new `plan claim` class. Nothing could run, so the claim says what
+    cannot have happened. A check that passed anyway clears it, and a plan's
+    own acceptance line ("Done when all tests pass") is no claim.
+  - The new `handed step` class refuses a reply that tells the reader to run a
+    command. It asks only of a turn that ran commands of its own, outside plan
+    mode. An outward step, one no default may take, the owner's consent,
+    tezgah's own install and a `brew` step stay the user's. So does a line that
+    types its blocker, and an answer about how a command is run.
+  - Measured on the owner's transcripts: of 3307 user turns, 27 replies handed
+    back a command and no class refused any of them. The shipped shapes refuse
+    9 turns, 8 of them a step the session could have taken.
+
+## [1.12.0] - 2026-10-29
+
+### Added
+
+- **Amp is a host (`amp`, plan 140).** `tezgah-setup --install --hosts amp`
+  writes one TypeScript plugin, `tezgah.ts`, into Amp's system plugin dir.
+  That dir is `$XDG_CONFIG_HOME/amp/plugins/`, else `~/.config/amp/plugins/`.
+  The install renders it from `hosts/amp/tezgah-plugin.ts.in`. Amp loads every
+  `.ts` there, and a running Amp needs `plugins: reload`. The install links the
+  skills into `~/.config/amp/skills` and writes the always-on block into
+  `~/.config/amp/AGENTS.md`. It sets Amp's two commit trailers
+  (`amp.git.commit.coauthor.enabled`, `amp.git.commit.ampThread.enabled`) to
+  false in `settings.json` unless the user set them. It writes that file only
+  while it is plain JSON with no `settings.jsonc` beside it. The uninstall
+  removes the plugin only when it is tezgah's render. It drops a trailer key
+  only while that key is still false.
+  - The plugin spawns `hosts/amp/hook.py` without blocking. One plugin process
+    serves many threads, so it keys its state by thread id. A dead, slow or
+    crashing hook allows every call, and the plugin tells each thread once.
+  - `tool.call` refuses with `{action: "reject-and-continue"}`. It asks the gate
+    for `Bash`, `shell_command`, the edit tools, `Task` and MCP effect names. A
+    shell call's text reaches the gate as `command`, also when Amp sends `cmd`.
+  - A tool result counts as passed only with an integer `exitCode` on its
+    output object. `error` and `cancelled` are failures. A bare `done` shell
+    result is a run, never a pass.
+  - `agent.end` judges a `done` turn and continues it with `[tezgah:stop]
+    <reason>`. The plugin never sends that prompt as the user's. So it writes no
+    turn row, grants nothing and cannot reset the re-ask budget. A thread with
+    a parent thread is a subagent. It gets the subagent brief, and its end is a
+    record-only row.
+  - The session brief rides the thread's first `agent.start`. The status line
+    goes on Amp's experimental status item for the active thread.
+  - `--report` has Amp rows. `--report --live` loads the plugin with node and
+    drives its `tool.call` and `tool.result`. The row stays UNVERIFIED, since
+    Amp's own loader did not run it. `tezgah-doctor --stack` reads Amp's
+    guidance files, skills, plugins and `amp.mcpServers`. `read_web_page` is a
+    web channel for the untrusted label. README and docs name all fourteen
+    hosts.
+- **Goose is a host (`goose`, plan 139 slice 5).** `tezgah-setup --install
+  --hosts goose` writes tezgah's own plugin dir, `~/.agents/plugins/tezgah/`.
+  It holds `plugin.json`, `hooks/hooks.json` and `skills/` links, and it is
+  wholly tezgah's. Goose loads the skills as `tezgah:<skill>`. The timeouts are in seconds: Stop 30, the
+  rest 5. `on_failure` stays at Goose's default `allow`, so the gate fails open
+  on a hook fault. The always-on block goes in `~/.config/goose/.goosehints`.
+  Goose adds no co-author trailer and names no setting for one, so there is
+  nothing to turn off. The uninstall deletes the plugin dir and the block and
+  leaves the rest of `~/.agents` alone.
+  - `hosts/goose/hook.py` handles SessionStart (attestation only),
+    UserPromptSubmit (the turn row only), PreToolUse, PostToolUse,
+    PostToolUseFailure and Stop. The event is the payload's `event`, the cwd its
+    `working_dir`, else the hook's own. `shell`, `write` and `edit` map to Bash,
+    Write and Edit, with `path` as `file_path` and `before`/`after` as
+    `old_string`/`new_string`. `<extension>__<tool>` becomes
+    `mcp__<extension>__<tool>`.
+  - PreToolUse and Stop block with `{"decision": "block", "reason": ...}` on
+    stdout. The outcome is the event: PostToolUse is a pass, PostToolUseFailure
+    a failure. Stop judges `last_assistant_message`, or writes a
+    `reply_unread` row. With no host block count, the turn rows bound the
+    re-asks.
+  - `--report` has Goose rows, including one for `disabledPlugins`. `--report
+    --live` probes the hook command with Goose's payload and block shape.
+    `tezgah-doctor --stack` reads Goose's hints, skills, plugins and the
+    `extensions:` map of `config.yaml`. No run has shown the binary obeying the
+    block. README and docs/layers.md now name all thirteen hosts.
+- **Antigravity CLI is a host (`antigravity`, plan 139 slice 4).**
+  `tezgah-setup --install --hosts antigravity` writes tezgah's hook set under
+  the `tezgah` name of `~/.gemini/config/hooks.json`. The user's other names
+  stay. The Antigravity App and IDE load that file too. The timeouts are in
+  seconds: Stop 30, the rest 5. The status line goes in
+  `~/.gemini/antigravity-cli/settings.json` while it is plain JSON, and the skill
+  links go in `antigravity-cli/skills`. Antigravity adds no co-author
+  trailer of its own, so there is nothing to turn off. The always-on block is
+  the `~/.gemini/GEMINI.md` one Gemini CLI shares. An uninstall now keeps it only
+  while another armed host reads the same file, so with `GEMINI_CLI_HOME` set
+  the two blocks come and go apart.
+  - `hosts/antigravity/hook.py` handles SessionStart, PreInvocation,
+    PreToolUse, PostToolUse and Stop. The payload names no event, so each
+    command passes it as its first argument. `conversationId` is the session
+    and `workspacePaths[0]` the cwd. The adapter renames the PascalCase tool
+    arguments into the gate's fields: `CommandLine`, `TargetFile`, `CodeContent`,
+    `TargetContent`/`ReplacementContent` and `ReplacementChunks`.
+  - PreToolUse denies with a top-level `decision: deny`. An allowed call
+    answers `decision: allow`, since Antigravity requires the field. PostToolUse reads
+    the outcome off `error`: empty is a pass, anything else a failure. The first
+    invocation of a turn writes the turn row and carries the reminder as an
+    `ephemeralMessage`. A loop that a refusal re-entered writes no turn row, so
+    the refusal budget holds.
+  - Stop reads the reply from `transcriptPath`, or writes a `reply_unread` row.
+    It judges only an idle `model_stop`, and `decision: continue` sends the
+    model back into the loop with the reason.
+  - `--report` has Antigravity rows, including one for `enabled: false` on the
+    `tezgah` name. `--report --live` probes the hook command with Antigravity's
+    camelCase payload and deny shape. No run has shown the binary obeying the
+    deny.
+- **Gemini CLI is a host (`gemini`, plan 139 slice 3).** `tezgah-setup
+  --install --hosts gemini` writes tezgah's own extension dir,
+  `~/.gemini/extensions/tezgah/`. It holds `gemini-extension.json`,
+  `hooks/hooks.json` and links to the skills.
+  `GEMINI_CLI_HOME` moves `~/.gemini` under it. The timeouts are in
+  milliseconds: AfterAgent 30000, the rest 5000. settings.json is never
+  written, since it is JSON with comments and holds the user's keys. Gemini's
+  default prompt adds no co-author trailer and no setting names one. The
+  always-on block goes in `~/.gemini/GEMINI.md`, which Antigravity reads too.
+  `--uninstall` deletes the extension dir and strips the block only while no
+  other host that reads it stays armed.
+  - `hosts/gemini/hook.py` handles SessionStart, BeforeAgent, BeforeTool,
+    AfterTool and AfterAgent. BeforeAgent writes the turn row and carries the
+    per-turn reminder. BeforeTool maps `run_shell_command`, `write_file`,
+    `replace`, the grep tools and the subagent tools into the gate's names, and
+    `mcp_<server>_<tool>` into `mcp__<server>_<tool>`. It denies with a
+    top-level `decision: deny` on exit 0.
+  - AfterTool reads the outcome off `tool_response`: an `error` is a failure,
+    and a shell result's `Exit Code: N` names a non-zero code. A shell run that
+    printed its `Output:` with no exit-code line is a pass, since Gemini writes
+    that line only for a non-zero code. AfterAgent judges `prompt_response` and
+    denies with `decision: deny`. Gemini sends the reason back through
+    BeforeAgent as the next prompt, and that turn row does not reset the
+    refusal budget. The status segment rides `systemMessage`.
+  - `--report` has Gemini rows, including one for `hooksConfig.enabled: false`
+    in settings.json, which runs no hook at all. `--report --live` probes the
+    hook command with Gemini's own payload and deny shape. No run has shown the
+    binary loading the extension or obeying the deny.
+- **GitHub Copilot CLI is a host (`copilot`, plan 139 slice 2).** `tezgah-setup
+  --install --hosts copilot` writes `$COPILOT_HOME/hooks/tezgah.json`, a hooks
+  file that is wholly tezgah's. `COPILOT_HOME` defaults to `~/.copilot`. The
+  timeouts are in seconds: PreToolUse 10, Stop and SubagentStop 30, the rest 5.
+  The inline `hooks` key of settings.json is never used, since one bad item
+  there rejects every hook in it. The install sets two keys in settings.json
+  while it is plain JSON. The status line runs `tezgah-statusline --copilot`.
+  `includeCoAuthoredBy` is `false`, so the agent's commits carry no co-author
+  trailer. A value the user set stays. The install links the skills into
+  `$COPILOT_HOME/skills` and writes the always-on block in
+  `copilot-instructions.md`. `--uninstall` deletes tezgah.json and takes back
+  only tezgah's settings keys, links and block.
+  - `hosts/copilot/hook.py` uses the PascalCase events, so payloads carry
+    snake_case fields and Claude tool names. It maps the runtime spellings too.
+    An Edit that names no file but carries a patch reaches the gate as
+    `apply_patch`. An MCP tool's `<server>-<tool>` becomes
+    `mcp__<server>__<tool>` for a server `mcp-config.json` names. It denies
+    with a top-level `permissionDecision: deny` on exit 0.
+  - A PreToolUse hook that times out lets the call through, by Copilot's own
+    rule. One that crashes denies the call. A repo's `.claude/settings.json`
+    hooks run there too.
+  - PostToolUse records a pass and PostToolUseFailure a failure. A shell
+    result's `exit code N` overrides either. Stop carries no reply, so the hook
+    reads the last `assistant.message` from `transcript_path`. A turn end with
+    none there becomes a `reply_unread` row. Copilot drops a command hook's
+    UserPromptSubmit output, so there is no per-turn reminder. The event still
+    writes the turn row. subagentStart gives a delegate the brief. A
+    SubagentStop only records its verdict.
+  - `--report` has Copilot rows, and `--report --live` probes the hook command
+    with Copilot's own payload and deny shape. No run has shown the binary
+    obeying the deny.
+- **Command Code is a host (`commandcode`, plan 139 slice 1).** `tezgah-setup
+  --install --hosts commandcode` merges tezgah's hook groups into the `hooks`
+  key of `~/.commandcode/settings.json` beside the user's. Their timeouts are in
+  seconds. The same write sets `attribution.commit` to `""`, so commits carry no
+  `CommandCodeBot` co-author trailer. A value the user set stays. The install
+  links the skills into `~/.commandcode/skills`. It writes the always-on block
+  in `~/.commandcode/AGENTS.md`. `--uninstall` takes back only tezgah's groups,
+  links and block. It drops the attribution key only while it holds what the
+  install wrote.
+  - Command Code's settings hooks see only shell, read, write and edit. So the
+    PreToolUse matcher is `shell|write|edit`. The gate there never sees read,
+    MCP, subagent or web calls, and plan mode skips every hook.
+  - `hosts/commandcode/hook.py` maps `shell_command`, `write_file` and
+    `edit_file` onto the gate. It folds a shell call's `args` into `command`.
+    It hands `old_value`/`new_value` over as `old_string`/`new_string`. It
+    denies with `permissionDecision: deny` on exit 0. It reads a shell call's
+    outcome off an `exit code N` in its result. A result with no code counts
+    as a run, never a pass.
+  - Stop carries no reply, so the hook reads it from `transcript_path`. A turn
+    end with none there becomes a `reply_unread` row. The status segment rides
+    `systemMessage` at SessionStart and Stop. There is no prompt event, so no
+    per-turn reminder.
+  - `--report` has Command Code rows, and `--report --live` probes the hook
+    command with Command Code's own payload. No run has shown the binary
+    obeying the deny.
+- **Factory Droid is a host (`droid`, plan 138 wave 1).** `tezgah-setup --install
+  --hosts droid` merges tezgah's hook groups into `~/.factory/hooks.json` beside
+  the user's. Their timeouts are in seconds, as Droid reads them. The install
+  also links the skills into `~/.factory/skills` beside the user's own links.
+  It writes the always-on block in `~/.factory/AGENTS.md`. It sets the
+  `statusLine` command and `includeCoAuthoredByDroid: false` in `settings.json`.
+  The install edits a settings.json with comments in place and keeps its
+  comments (plan 141). `--uninstall` takes back only tezgah's groups, links and keys.
+  - Droid reads the `hooks` key of settings.json only while hooks.json is
+    absent. So the install creates no hooks.json beside such a key, and the
+    report row says why. Then settings.json stays untouched.
+  - `hosts/droid/hook.py` maps Droid's tool ids (`Execute`, `Create`,
+    `ApplyPatch`, `FetchUrl`) onto the gate and hands ApplyPatch's `input` over
+    as `patch`. It denies with `permissionDecision: deny` on exit 0 and reads a
+    shell call's outcome off its `[Process exited with code N]` line.
+  - Droid's Stop carries no reply, so the hook reads the reply from
+    `transcript_path`. A turn end whose reply is not there yet becomes a
+    `reply_unread` row and is not judged. SubagentStop records `task_result`
+    as a `subagent_end` row.
+  - `--report` has Droid rows, and `--report --live` probes the hook command
+    with Droid's own payload. `tests/e2e_droid.py` runs the real binary only
+    under `TEZGAH_E2E_SPEND=1`, because it spends a model call.
+
+- **Qwen Code is a host (`qwen`, plan 138 wave 1).** `tezgah-setup --install
+  --hosts qwen` merges tezgah's hook groups into `~/.qwen/settings.json` beside
+  Orca's. Their timeouts are in milliseconds, as Qwen reads them. The install
+  also adds the `ui.statusLine` command, the skill links and the always-on
+  block in `~/.qwen/QWEN.md`. `--uninstall` takes back only tezgah's groups and keys.
+  - `hosts/qwen/hook.py` maps Qwen's tool ids (`run_shell_command`,
+    `write_file`, `edit`, `agent`, `grep_search`) onto the gate. It denies with
+    `permissionDecision: deny` on exit 0, blocks Stop on
+    `last_assistant_message`, briefs a subagent at SubagentStart and records
+    its end at SubagentStop.
+  - `--report` has Qwen rows, and `--report --live` probes the hook command
+    with Qwen's own payload. `tests/e2e_qwen.py` runs the real binary only
+    under `TEZGAH_E2E_SPEND=1`, because it spends a model call.
+  - `tezgah-doctor --stack` and the session attestation know the host. An
+    unknown host no longer crashes the attestation.
+  - A host-file backup is now owner-only, and a rewritten host config keeps
+    its file mode, because Qwen's settings.json holds provider keys.
+
+- **Review rules taken from google/elephant-goldfish-model (plan 137).** The
+  owner chose them from research line `egm-lessons`. No EGM file ships:
+  - `tezgah-task review NNN <r> approve` refuses a plan with no review slice
+    record. A host with no slice journal passes `--no-slice "<why>"`, and the
+    reason lands on the review line (`bin/tezgah-task`).
+  - The contract says that no fresh subagent means no review verdict. It also
+    says the author contests a finding only with a file:line and never lowers
+    a severity (`hooks/tezgah_policy.py`).
+  - tezgah-reviewer has a plan-readiness mode for a plan file. A design choice
+    left to the implementer is a major finding, and so is a section it cannot
+    paraphrase. plan-add runs it before `phase implementation`
+    (`hooks/tezgah_agents.py`).
+  - graph-review merges findings with the same file, line and title before its
+    verification cap, and reports `caps.deduplicated`.
+  - `tests/test_links.py` resolves every relative markdown link the repository
+    owns.
+
+### Changed
+
+- **The gate refuses a credit verb with "with" or "using" too.** The attribution
+  rule read `written by` and `built by`, so `Drafted with Claude` passed. The
+  credit verbs now include `drafted`, `produced` and `composed`, and each takes
+  `by`, `with` or `using` before a model or vendor name. Prose such as
+  `drafted with the owner` still passes (`hooks/tezgah_gate.py::_CREDIT`, plan
+  137).
+
+- **A release tag must sit on main.** A new `on-main` job in `release.yml`
+  fails the run on a tag off `origin/main`. Then no job builds or uploads
+  anything (plan 137).
+
+- **An owner-only choice waits for the owner.** Class F now names three more
+  steps. One is picking a variant a research, analysis or review recommends.
+  The others are a way around a tezgah refusal and deciding about another
+  session's work. The core
+  Ask policy, the per-turn reminder and the ask warning carry them too. The Stop
+  rule's `needless ask` lets a question that asks the owner to pick between
+  options through (`OWNER_CHOICE`, `hooks/tezgah_integrity.py`). A worker returns
+  such a question as `ESCALATE: owner`, and the orchestrator relays it to the
+  user instead of answering it (plan 136).
+
+- **A research line records the owner's pick apart from its own.** A rules-9
+  line writes its pick as `recommended:` in `decision.md`. A `chosen:` line
+  needs the owner's words, which `tezgah-research choose <slug> <decision>
+  <variant> --ack "<words>"` writes. The line's rules judge its own pick, never
+  the owner's, so an owner may take a dominated variant. `conclude` says when a
+  recommendation still waits for the owner (`hooks/tezgah_research.py`).
+
+- **A line in flight no longer blocks `init --allow-open`.** A line whose only
+  `check` errors are pending verdicts is in flight, not broken. Both `init`
+  refusals now say that another session's line goes to the owner.
+
+### Fixed
+
+- **Three new hosts no longer record a check that did not pass as a pass.**
+  Antigravity's PostToolUse has no output. A command that went to the
+  background also ends with an empty `error`. So the hook records each
+  Antigravity shell call as ran, never a pass, and Antigravity can never show
+  a passing check. A Copilot shell success with no `exit code N` text (a
+  background launch) is ran, never a pass. A Gemini result with a `Signal:`
+  line (a runner killed by a signal) is a failure.
+- **The gate guards Gemini's and Goose's hook-off keys.** These are Gemini's
+  `hooksConfig` and Goose's `disabledPlugins`. Claude's `disableAllHooks` had
+  the same guard.
+- **The Command Code uninstall removes tezgah's `attribution.commit: ""`
+  beside the user's other attribution keys**, not only when it stood alone.
+
+- **A hidden research dir is no longer invisible.** A dot dir under
+  `.tezgah/research/` is an error in `status` and in `check` with no slug. The
+  gate refuses a write there (`research_hidden_reason`, `hooks/tezgah_gate.py`).
+  A session had run a whole line under `.tezgah/research/.staging/` after an
+  `init` refusal.
+
 ## [1.11.0] - 2026-10-23
 
 ### Added
@@ -1299,7 +1628,10 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   the copy could not find `hooks/` and died on import. It now links into the
   installed tree, and also installs the command as `tezgah`.
 
-[Unreleased]: https://github.com/r1z4x/tezgah/compare/v1.10.1...HEAD
+[Unreleased]: https://github.com/r1z4x/tezgah/compare/v1.13.0...HEAD
+[1.13.0]: https://github.com/r1z4x/tezgah/releases/tag/v1.13.0
+[1.12.0]: https://github.com/r1z4x/tezgah/releases/tag/v1.12.0
+[1.11.0]: https://github.com/r1z4x/tezgah/releases/tag/v1.11.0
 [1.10.1]: https://github.com/r1z4x/tezgah/releases/tag/v1.10.1
 [1.10.0]: https://github.com/r1z4x/tezgah/releases/tag/v1.10.0
 [1.9.2]: https://github.com/r1z4x/tezgah/releases/tag/v1.9.2

package/MANIFEST

@@ -161,19 +161,28 @@ hooks/tezgah_taste.py
 hooks/tezgah_taste_ledger.py
 hooks/tezgah_untrusted.py
 hooks/tezgah_update.py
+hosts/amp/hook.py
+hosts/amp/tezgah-plugin.ts.in
+hosts/antigravity/hook.py
 hosts/codex/hook.py
 hosts/codex/hooks.json
+hosts/commandcode/hook.py
+hosts/copilot/hook.py
 hosts/cursor/hook.py
 hosts/cursor/hooks.json
+hosts/droid/hook.py
 hosts/dsh/hooks.json
 hosts/dsh/statusline/lib/client.js
 hosts/dsh/statusline/lib/index.js
 hosts/dsh/statusline/package.json
+hosts/gemini/hook.py
+hosts/goose/hook.py
 hosts/omp/hook.py
 hosts/omp/tezgah-hook.ts.in
 hosts/opencode/plugins/tezgah.js
 hosts/opencode/tui/cli/tui.tsx
 hosts/opencode/tui/tezgah-tui.tsx
+hosts/qwen/hook.py
 output-styles/tezgah.md
 package.json
 packaging/build.sh
@@ -830,6 +839,7 @@ skills/rl-env/rl-env-from-description/references/verifiers.md
 skills/tezgah-contract/EVALS.md
 skills/tezgah-contract/SKILL.md
 statusline.py
+tests/_amp_plugin_harness.mjs
 tests/_fuzz_shell_reader.mjs
 tests/_mcp_stdio.py
 tests/_omp_extension_harness.mjs
@@ -849,10 +859,12 @@ tests/e2e_analyze_mobile.py
 tests/e2e_analyze_web.py
 tests/e2e_analyze_wiring.py
 tests/e2e_docker_cycle.py
+tests/e2e_droid.py
 tests/e2e_dsh_statusline.py
 tests/e2e_omp_statusline.py
 tests/e2e_packaged_install.py
 tests/e2e_plan_flow.py
+tests/e2e_qwen.py
 tests/e2e_tezgah_mcp.py
 tests/fixtures/rules8-known-truth/bodies/arxiv-1.xml
 tests/fixtures/rules8-known-truth/bodies/arxiv-10.xml
@@ -906,6 +918,9 @@ tests/stop_spec_eval.py
 tests/support.py
 tests/test_agents.py
 tests/test_ai_research_library.py
+tests/test_amp_hook.py
+tests/test_amp_plugin.py
+tests/test_antigravity_hook.py
 tests/test_apps_registry.py
 tests/test_attest.py
 tests/test_bash_agreement.py
@@ -916,12 +931,14 @@ tests/test_claude_adapters.py
 tests/test_claude_registration.py
 tests/test_codegen.py
 tests/test_codex_hook.py
+tests/test_commandcode_hook.py
 tests/test_components.py
 tests/test_constraint_pinning.py
 tests/test_consult_arena.py
 tests/test_context.py
 tests/test_context_diet.py
 tests/test_control_plane.py
+tests/test_copilot_hook.py
 tests/test_cursor_cap.py
 tests/test_cursor_hook.py
 tests/test_decisions.py
@@ -929,6 +946,7 @@ tests/test_design_cli.py
 tests/test_docs.py
 tests/test_docs_router.py
 tests/test_doctor.py
+tests/test_droid_hook.py
 tests/test_dsh_hooks.py
 tests/test_dsh_launcher.py
 tests/test_dsh_statusline.py
@@ -940,6 +958,8 @@ tests/test_extension.py
 tests/test_fuzz_shell.py
 tests/test_gate.py
 tests/test_gate_vectors.py
+tests/test_gemini_hook.py
+tests/test_goose_hook.py
 tests/test_graph_verbs.py
 tests/test_graph_workflows.py
 tests/test_guard.py
@@ -961,6 +981,7 @@ tests/test_lesson_lineage.py
 tests/test_lessons.py
 tests/test_lessons_compile.py
 tests/test_lifecycle_sweep.py
+tests/test_links.py
 tests/test_live_probe.py
 tests/test_mcp_features.py
 tests/test_mcp_server.py
@@ -981,6 +1002,7 @@ tests/test_platform.py
 tests/test_product_flow_e2e.py
 tests/test_product_next.py
 tests/test_providers.py
+tests/test_qwen_hook.py
 tests/test_rank.py
 tests/test_replay.py
 tests/test_replay_context.py

package/README.md

@@ -35,8 +35,9 @@ reaches every host the same way.
 
 ## What tezgah enforces and records
 
-- **One contract, six hosts.** omp, Claude Code, Codex, Cursor, opencode and
-  dsh see the same rules, because every host is a thin adapter over one shared
+- **One contract, fourteen hosts.** omp, Claude Code, Codex, Cursor, opencode,
+  dsh, Qwen Code, Factory Droid, Command Code, GitHub Copilot CLI, Gemini CLI,
+  Antigravity CLI, Goose and Amp see the same rules, because every host is a thin adapter over one shared
   core — change a rule once and all of them pick it up.
 - **A done claim needs a passing check on record.** A gate of 15 refusals stops
   the neutered check — `--no-verify`, `|| true`, a test piped into `tail`, a
@@ -154,7 +155,7 @@ and the optional integrations are in the [docs](docs/README.md).
 
 ## Supported hosts
 
-**omp** (the primary host, developed and verified against), **Claude Code**, **Codex**, **Cursor**, **opencode**, **dsh** — thin adapters over one shared core.
+**omp** (the primary host, developed and verified against), **Claude Code**, **Codex**, **Cursor**, **opencode**, **dsh**, **Qwen Code**, **Factory Droid**, **Command Code**, **GitHub Copilot CLI**, **Gemini CLI**, **Antigravity CLI**, **Goose**, **Amp** — thin adapters over one shared core. The last six are wired from their vendors' docs alone: no run of their binaries has shown them obeying a deny yet ([hosts](docs/hosts.md)).
 
 ## Where the depth lives
 

package/bin/tezgah-docs

@@ -106,7 +106,7 @@ RUN = re.compile(r"((?:`[A-Za-z_][A-Za-z0-9_]*(?:\(\))?`\s*[/,]?\s*){1,5})$")
 CITE = re.compile(r"`([\w.-]+(?:/[\w.-]+)+|[\w-]+\.\w+):(\d+)(?:-(\d+))?`"
                   r"|`(:(\d+)(?:-(\d+))?)`")
 # The symbol written after the citation instead of before it, the way a table
-# cell reads: `hooks/tezgah_policy.py:806-1135` (`CORE`).
+# cell reads: `hooks/tezgah_policy.py:819-1158` (`CORE`).
 AFTER = re.compile(r"\s*\(`([A-Za-z_][A-Za-z0-9_]*)(?:\(\))?`\)")
 # Any `path:line`, backticked or not: what CITE does not match of these (a
 # bare token, a comma list `x.py:12,40`) is counted as unjudged, so a citation

package/bin/tezgah-research

@@ -25,6 +25,8 @@
   tezgah-research verdict <slug> <id> met|not-met|unanswerable --evidence "<ref>"
                                                    record one success criterion's verdict
   tezgah-research conclude <slug>                  conclude a line whose criteria all carry a verdict
+  tezgah-research choose <slug> <decision> <variant> --ack "<the owner's words>"
+                                                   record the owner's pick of a recommended variant
   tezgah-research migrate-layout                   move flat research/<slug> into open/ or done/
   tezgah-research close <slug> --limit "<reason>"  conclude a line as a deliberate limit
   tezgah-research seal <slug> [--history-lost] --ack "<owner decision>"
@@ -121,14 +123,20 @@ no status, a design/plan/analysis/code deliverable with no decision comparing it
 variants - printing every open slug with its reasons. `--allow-open "<reason>"`
 opens the new line anyway and writes the reason into its `log.md` as the first
 entry; an empty reason is misuse, and the hatch is refused while any open line has
-`check` errors. `close <slug> --limit "<reason>"` concludes a line on purpose,
+`check` errors other than a criterion whose verdict is still `pending` (a line in
+flight). Both refusals say that a line another session is running goes to the
+owner, not to this session. `close <slug> --limit "<reason>"` concludes a line on purpose,
 writing the reasons it was still open into `state.json` `closed` and `log.md`.
 `--supersedes <old>` opens a new version of an existing line, which then carries
 the old deliverable as a variant; a line asking an existing line's exact question
 without it is refused. `compare` appends one cell to
 `decisions/<decision>/comparison.jsonl` under the rule `check` applies to it.
+A rules-9 decision.md writes the line's pick as `recommended:`; `choose` records
+the owner's `chosen:` with an `owner:` line holding their words, and `conclude`
+names each recommendation still waiting for it.
 `check` prints the same list of open lines after the per-line report, and so does
-`status`, so neither state has to be discovered by being refused.
+`status`, so neither state has to be discovered by being refused. Both also fail
+a hidden dir under `research/`, which no line may live in.
 
 `init --method exploratory` (rules 7) opens a campaign instead of a question:
 `--arena` and `--budget` (and, for a measurable arena, `--evaluator` with its
@@ -286,6 +294,7 @@ def cmd_init(args):
             print("  %s: %s" % (name, "; ".join(reasons)))
         print('to open %s anyway, say why: tezgah-research init %s '
               '--allow-open "<reason>"' % (slug, slug))
+        print(tr.OWNER_ASK)
         return 1
     broken = tr.broken_open_lines(repo) if unfinished else []
     if broken:
@@ -297,6 +306,7 @@ def cmd_init(args):
             print("  %s: %d error(s), first: %s" % (name, len(errors), errors[0]))
         print('fix them, or record what is left: tezgah-research close <slug> '
               '--limit "<reason>"')
+        print(tr.OWNER_ASK)
         return 1
     twins = [t for t in tr.serial_twins(repo, slug, {"question": question})
              if t != supersedes]
@@ -490,7 +500,7 @@ def cmd_check(args):
         return 1
     problems = 0
     report = {}
-    if known:
+    if known or tr.stray_dirs(repo):
         report = tr.check(repo, rest[0] if rest else None, strict=strict,
                           all_lines=all_lines, code=checkout_root(os.getcwd()),
                           flags={"online": online, "orx": ask_orx})
@@ -1067,6 +1077,28 @@ def cmd_conclude(args):
             print("FAIL conclude: %s" % problem)
         return 1
     print("concluded %s; it moved to research/done/%s" % (slug, slug))
+    for decision, variant in tr.owner_waits(repo, slug):
+        print("report to the owner: %s is recommended, not chosen; building it waits "
+              "for the owner's answer (tezgah-research choose %s %s %s --ack "
+              "\"<their words>\")" % (variant, slug, decision, variant))
+    return 0
+
+
+def cmd_choose(args):
+    """Record the owner's pick among a decision's produced variants."""
+    usage = 'choose <slug> <decision> <variant> --ack "<the owner\'s words>"'
+    if len(args) != 5 or args[3] != "--ack":
+        return misuse(usage)
+    slug, decision, variant, _flag, ack = args
+    repo = repo_root(os.getcwd())
+    if slug not in tr.slugs(repo):
+        return misuse("no such research line: %s" % slug)
+    problem = tr.choose_line(repo, slug, decision, variant, ack,
+                             time.strftime("%Y-%m-%d"))
+    if problem:
+        print("FAIL choose: %s" % problem)
+        return 1
+    print("decisions/%s: the owner chose %s" % (decision, variant))
     return 0
 
 
@@ -1212,6 +1244,8 @@ def main(argv):
         return cmd_verdict(rest)
     if cmd == "conclude":
         return cmd_conclude(rest)
+    if cmd == "choose":
+        return cmd_choose(rest)
     if cmd == "migrate-layout":
         return cmd_migrate_layout(rest)
     if cmd == "close":
@@ -1237,7 +1271,8 @@ def main(argv):
         if cmd in commands:
             return commands[cmd](repo_root(os.getcwd()), rest)
     return misuse("unknown command %r (init, commit, check, status, --all, claim, predict, "
-                  "components, migrate, source, compare, verdict, conclude, migrate-layout, "
+                  "components, migrate, source, compare, verdict, conclude, choose, "
+                  "migrate-layout, "
                   "close, seal, import, next, idea, stage, match, board, dedup, yield, cite, "
                   "fetch, search, instrument, gold, label, switch, release-check, "
                   "calibration)" % cmd)