@r1z4x/tezgah 1.11.0 → 1.13.0

package/hosts/omp/tezgah-hook.ts.in

@@ -315,6 +315,22 @@ function emptyRun(content: any): boolean {
   return EMPTY_RUN.test(text.slice(-EMPTY_RUN_TAIL));
 }
 
+// The text of one assistant message, whatever shape it arrives in: omp hands
+// `session_stop` the message OBJECT its `getLastAssistantMessage()` returns,
+// and the core must judge the prose, never its `str()` (plan 143). A thinking
+// or tool block is not the reply: only `type: "text"` is.
+function textOf(message: any): string | undefined {
+  if (typeof message === "string") return message;
+  if (typeof message?.content === "string") return message.content;
+  if (Array.isArray(message?.content)) {
+    // joined and trimmed exactly as the core does (`reply_prose`), so the two
+    // never hand the rule a different text for one reply
+    return message.content.map((p: any) => (p?.type === "text" && typeof p.text === "string"
+                                            ? p.text : "")).join("\n").trim();
+  }
+  return undefined;
+}
+
 // The text of the newest assistant message in an agent_end `messages` list:
 // the subagent's final report, which the hook reads like a Stop reply.
 function lastReply(messages: any): string | undefined {
@@ -322,11 +338,8 @@ function lastReply(messages: any): string | undefined {
   for (let i = messages.length - 1; i >= 0; i--) {
     const m = messages[i];
     if (m?.role !== "assistant") continue;
-    if (typeof m.content === "string") return m.content;
-    if (Array.isArray(m.content)) {
-      return m.content.map((p: any) => (p?.type === "text" && typeof p.text === "string"
-                                        ? p.text : "")).join("\n");
-    }
+    const text = textOf(m);
+    if (text !== undefined) return text;
   }
   return undefined;
 }
@@ -785,9 +798,19 @@ export default function tezgahOmp(pi: any): void {
   });
 
   pi.on("session_stop", async (event: any, ctx: any) => {
+    // `sessionModes` exists only in an interactive TUI session; its `plan`
+    // state is what every other host sends as `permission_mode`, so the core
+    // reads one field (tezgah_integrity.read_only_turn). A session without it
+    // (print, RPC, a subagent) sends nothing and is judged as `default`.
+    let mode: string | undefined;
+    try {
+      mode = ctx?.sessionModes?.getState?.()?.plan === "active" ? "plan" : undefined;
+    } catch { mode = undefined; }
     const res = ask({ event: "stop", cwd: cwdOf(ctx), session_id: sessionOf(ctx),
-                      last_assistant_message: event?.last_assistant_message,
-                      stop_hook_active: event?.stop_hook_active === true });
+                      last_assistant_message: textOf(event?.last_assistant_message)
+                                              ?? lastReply(event?.messages),
+                      stop_hook_active: event?.stop_hook_active === true,
+                      permission_mode: mode });
     if (hookError) {
       markBroken(ctx);
       return undefined;  // an unanswerable Stop rule must not block the turn

package/hosts/opencode/plugins/tezgah.js

@@ -190,13 +190,13 @@ const EXPLORE_DENY =
 // as _CREDIT is there. The parity test in tests/test_opencode_plugin.py reads
 // this literal and the Python one and fails if the two alternations differ.
 const ATTRIB =
-  /co-authored-by\s*:|generated with|made with|(?:generated|written|authored|built|assisted)\s+by\s+(?:(?:an?|the)\s+)?(?:ai|llm|claude|chatgpt|gpt|copilot|codex|cursor|gemini|deepseek|openai|anthropic)\b|noreply@anthropic|\u{1F916}/iu
+  /co-authored-by\s*:|generated with|made with|(?:generated|written|authored|built|assisted|drafted|produced|composed)\s+by\s+(?:(?:an?|the)\s+)?(?:ai|llm|claude|chatgpt|gpt|copilot|codex|cursor|gemini|deepseek|openai|anthropic)\b|(?:generated|written|authored|built|assisted|drafted|produced|composed)\s+(?:with|using)\s+(?:(?:an?|the)\s+)?(?:ai|llm|claude|chatgpt|gpt|copilot|codex|gemini|deepseek|openai|anthropic)(?:-[\w.]+)?(?:\s+(?:code|cli))?(?:\s*\([^)\n]*\))?(?=[.!)\]*_`]*(?:[\x22\x27,;]|\s+-\s|\s*(?:\n|$)))|noreply@anthropic|\u{1F916}/iu
 // The same forms anchored to the start of a line, for the text a write/edit
 // tool is about to land. Mirrors hooks/tezgah_gate.py ATTRIB_LINE: a credit owns
 // its line, while prose naming the ban does not, and that anchor is what keeps
 // the rule from denying the documentation that describes it.
 const ATTRIB_LINE =
-  /^[\s>#*/<!+-]*(?:co-authored-by\s*:|generated with|made with|(?:generated|written|authored|built|assisted)\s+by\s+(?:(?:an?|the)\s+)?(?:ai|llm|claude|chatgpt|gpt|copilot|codex|cursor|gemini|deepseek|openai|anthropic)\b|noreply@anthropic|\u{1F916})/imu
+  /^[\s>#*/<!+-]*(?:co-authored-by\s*:|generated with|made with|(?:generated|written|authored|built|assisted|drafted|produced|composed)\s+by\s+(?:(?:an?|the)\s+)?(?:ai|llm|claude|chatgpt|gpt|copilot|codex|cursor|gemini|deepseek|openai|anthropic)\b|(?:generated|written|authored|built|assisted|drafted|produced|composed)\s+(?:with|using)\s+(?:(?:an?|the)\s+)?(?:ai|llm|claude|chatgpt|gpt|copilot|codex|gemini|deepseek|openai|anthropic)(?:-[\w.]+)?(?:\s+(?:code|cli))?(?:\s*\([^)\n]*\))?(?=[.!)\]*_`]*(?:[\x22\x27,;]|\s+-\s|\s*(?:\n|$)))|noreply@anthropic|\u{1F916})/imu
 const EDIT_TEXT = ["content", "new_string", "newString", "new_str", "file_text",
   "patch", "text"]
 const WRITE_CMD =

package/hosts/qwen/hook.py

@@ -0,0 +1,206 @@
+#!/usr/bin/env python3
+"""Qwen Code lifecycle hook. Reads Qwen's JSON on stdin and answers in Qwen's own
+output shape, onto the shared tezgah core (hooks/).
+
+Qwen Code 0.21.13 fires SessionStart, UserPromptSubmit, PreToolUse, PostToolUse,
+PostToolUseFailure, SubagentStart, SubagentStop and Stop here
+(`bin/tezgah-setup::QWEN_HOOK_EVENTS`); anything else is ignored. Inert outside
+the roots.
+
+The always-on core is the managed block in `~/.qwen/QWEN.md`, which Qwen loads
+into every session, so SessionStart repeats it only when that block is missing.
+PreToolUse translates Qwen's runtime tool ids into the gate's vocabulary and
+denies with `hookSpecificOutput.permissionDecision` on exit 0 - never exit 2,
+whose stderr channel carries no reason the ledger and the probe can read. Qwen
+fires PostToolUse for a successful call and PostToolUseFailure for a failed one
+(a shell exit Qwen counts as an error, `isShellExitError`), so the event is the
+call's outcome. Stop blocks a done/tested claim with no successful check behind
+it, judged on `last_assistant_message`, the same rule Claude's Stop hook enforces
+(hooks/tezgah_integrity.py). The status line is `tezgah-statusline --qwen`, Qwen's
+`ui.statusLine` command, so no event here carries it.
+"""
+import json
+import os
+import sys
+
+ROOT = os.path.dirname(os.path.dirname(os.path.dirname(os.path.realpath(__file__))))
+sys.path.insert(0, os.path.join(ROOT, "hooks"))
+from tezgah_guard import attest_session, import_failed, safe  # noqa: E402
+try:
+    from tezgah_context import command_text, context_for, record, shell_kind  # noqa: E402
+    from tezgah_gate import cross_project_note, decision, graph_advice  # noqa: E402
+    from tezgah_integrity import (  # noqa: E402
+        SUBAGENT_CHANNEL, bind_session, note, note_tool, ran_nothing, report_bytes,
+        stop_reason, untrusted_source)
+    from tezgah_paths import HOST_DIRS, off, root_for  # noqa: E402
+    from tezgah_taste import write_note  # noqa: E402
+    from tezgah_untrusted import marks  # noqa: E402
+except Exception as exc:
+    import_failed(exc)
+
+# Qwen's runtime tool ids (the `ToolNames` table in the 0.21.13 bundle) -> the
+# shared gate's vocabulary. `replace` is the edit tool's id in older builds; the
+# 0.21.13 bundle has none, and an unknown id passes the gate untouched. MCP tools
+# arrive as `mcp__<server>__<tool>`, the shared shape, and pass through.
+# `monitor` runs a shell command too (Qwen's headless deny list pairs it with
+# SHELL), and `notebook_edit` writes an .ipynb (review of plan 138).
+GATE_TOOLS = {
+    "run_shell_command": "Bash",
+    "monitor": "Bash",
+    "write_file": "Write",
+    "edit": "Edit",
+    "replace": "Edit",
+    "notebook_edit": "NotebookEdit",
+    "agent": "Task",
+    "grep_search": "Grep",
+}
+
+
+def gate_name(name):
+    """The tool name the gate denies under and the ledger row records.
+
+    `call_id` hashes the name it is handed, so both halves map through here: a
+    PostToolUse row under the raw id would never match the PreToolUse call and
+    the loop guard would never deny (`hosts/codex/hook.py::gate_name`)."""
+    return GATE_TOOLS.get(name, name)
+
+
+def classify(payload):
+    """The used-tool kind for a tool payload, or None."""
+    name = payload.get("tool_name", "") or ""
+    if name.startswith("mcp__") and "codegraph" in name:
+        return "graph"
+    if name == "agent":
+        return "orch"
+    if name == "run_shell_command":
+        return shell_kind(command_text(payload.get("tool_input")))
+    return None
+
+
+def subagent_id(payload):
+    """The subagent id Qwen adds to a hook input run inside a subagent, else None."""
+    aid = payload.get("agent_id")
+    return aid if isinstance(aid, str) and aid else None
+
+
+def rules_carry_core():
+    """True when `QWEN.md` in Qwen's home holds tezgah-setup's managed block."""
+    try:
+        with open(os.path.join(HOST_DIRS["qwen"], "QWEN.md"), encoding="utf-8") as fh:
+            return "<!-- tezgah:start" in fh.read()
+    except OSError:
+        return False
+
+
+def result_size(result):
+    """The result's top-level length, the Claude-family writer's measure; a value
+    with no length counts as non-empty and only a missing result is None."""
+    if isinstance(result, (str, bytes, bytearray, list, tuple, dict, set, frozenset)):
+        return len(result)
+    return 1 if result is not None else None
+
+
+def inp_of(payload):
+    inp = payload.get("tool_input")
+    return inp if isinstance(inp, dict) else {}
+
+
+def post_tool(payload, cwd, session_id, failed):
+    """The ledger row for one finished call, and the notice for the model."""
+    tool = gate_name(payload.get("tool_name", ""))
+    inp = inp_of(payload)
+    # a `monitor` PostToolUse fires when the watch starts ("Monitor started"),
+    # long before its command ends: it records a run, never a pass (review of
+    # plan 138, round 2); a failed start still arrives as PostToolUseFailure
+    if payload.get("tool_name") == "monitor" and failed is False:
+        failed = None
+    safe(session_id, record, session_id, classify(payload))
+    if not root_for(cwd):
+        return None
+    result = payload.get("tool_response")
+    # read before this call's row lands: `source` is the taint's own mark
+    got = safe(session_id, marks, tool, inp, session_id, result)
+    source, notice = got or (None, None)
+    safe(session_id, note_tool, session_id, tool, inp, failed=failed,
+         interrupted=bool(failed and payload.get("is_interrupt") is True),
+         source=source, cwd=cwd,
+         out_bytes=(report_bytes(result)
+                    if untrusted_source(tool, inp) == SUBAGENT_CHANNEL
+                    else result_size(result)),
+         empty_run=ran_nothing(result), agent=subagent_id(payload))
+    advice = safe(session_id, graph_advice, tool, inp, cwd, "qwen")
+    taste = cross = None
+    if not failed:
+        taste = safe(session_id, write_note, session_id, inp, cwd, tool)
+        cross = safe(session_id, cross_project_note, session_id, tool, inp, cwd)
+    return "\n".join(p for p in (notice, advice, taste, cross) if p)
+
+
+def context(event, text):
+    return {"hookSpecificOutput": {"hookEventName": event,
+                                   "additionalContext": text}} if text else {}
+
+
+def main():
+    try:
+        payload = json.load(sys.stdin)
+    except Exception:
+        return
+    if not isinstance(payload, dict):
+        return
+    event = payload.get("hook_event_name") or ""
+    cwd = payload.get("cwd") or os.getcwd()
+    session_id = payload.get("session_id")
+    safe(session_id, bind_session, session_id)  # the switch latch (tezgah_paths.off)
+    out = {}
+    if event == "PreToolUse":
+        reason = safe(session_id, decision, gate_name(payload.get("tool_name", "")),
+                      inp_of(payload), cwd, session_id, agent=subagent_id(payload))
+        if reason:
+            out = {"hookSpecificOutput": {
+                "hookEventName": "PreToolUse",
+                "permissionDecision": "deny",
+                "permissionDecisionReason": reason,
+            }}
+    elif event in ("PostToolUse", "PostToolUseFailure"):
+        out = context(event, post_tool(payload, cwd, session_id,
+                                       event == "PostToolUseFailure"))
+    elif event == "SessionStart":
+        safe(session_id, attest_session, "qwen", session_id, cwd)
+        out = context(event, safe(session_id, context_for, "session_start", cwd,
+                                  payload, with_core=not rules_carry_core()))
+    elif event == "UserPromptSubmit":
+        out = context(event, safe(session_id, context_for, "user_prompt", cwd, payload))
+    elif event == "SubagentStart":
+        safe(session_id, record, session_id, "orch")
+        kind = payload.get("agent_type")
+        if subagent_id(payload) and isinstance(kind, str) and root_for(cwd):
+            safe(session_id, note, session_id, "subagent_start", kind,
+                 agent=subagent_id(payload))
+        # the delegate is a fresh context: Qwen documents additionalContext here
+        # as the subagent's initial context
+        out = context(event, safe(session_id, context_for, "subagent_start", cwd,
+                                  payload))
+    elif event == "SubagentStop":
+        # a subagent's end is judged record-only (ADR 011): one `subagent_end`
+        # row from its last message, never a block
+        safe(session_id, record, session_id, "orch")
+        if not off("verify-off") and root_for(cwd):
+            safe(session_id, stop_reason, payload.get("last_assistant_message") or "",
+                 session_id, cwd=cwd, subagent=True)
+    elif event == "Stop":
+        # Qwen's Stop carries `last_assistant_message` and `stop_hook_active`,
+        # and takes {"decision": "block", "reason": ...}. The reply after a block
+        # is judged again and refused at most once more (tezgah_integrity).
+        if not off("verify-off") and root_for(cwd):
+            reason = safe(session_id, stop_reason,
+                          payload.get("last_assistant_message"), session_id,
+                          cwd=cwd, after_block=bool(payload.get("stop_hook_active")),
+                          mode=payload.get("permission_mode"))
+            if reason:
+                out = {"decision": "block", "reason": reason}
+    if out:
+        print(json.dumps(out))
+
+
+main()

package/output-styles/tezgah.md

@@ -47,7 +47,10 @@ bounded action per step, and while it is in flight its position is restated in
 one line - the todo list is that source, never re-narrate the plan. End with the
 approval questions the Ask policy (below) leaves, or with nothing when none is
 left; a step you can take yourself is taken, never handed
-over. Finish the issue in hand before raising a second one; an error states
+over, and in the host's plan mode, where nothing can run, the plan is the
+deliverable: its approval is the question that turn asks and nothing is
+reported as done or tested.
+Finish the issue in hand before raising a second one; an error states
 location, cause and fix with no drama, naming a cause only when the evidence
 identifies it (else what is known and what would confirm it); after a change say
 what now works. A list shows at most five items, ranked, the rest kept in
@@ -112,15 +115,17 @@ lines: item - blocker - evidence - what unblocks it. No blockers: no heading.
 Work and process - the order, "shall I go on", a check, a plan, a consult
 member, a spend within `spend_cap`, a local merge of the session's branch,
 removing its worktree - are taken and stated in one line, never asked; a taste
-or intent fork goes in the batch with a default taken this turn, but building a
-plan this turn wrote waits for the answer. An outward step
+or intent fork goes in the batch with a default taken this turn, but the
+never-default items below wait for the answer. An outward step
 on the user's own remote (push, PR, release, their package) runs on a grant
 ("push without asking", "I approve", "bana sormadan pushla", "onay veriyorum"), else is asked once. Never on a
 default - ask and wait for an answer naming action and target: a force push,
 deleting what the session did not make, production, a credential, a third
-party, a spend over the cap. The batch: one "Approval questions"/"Onay için sorular" heading, waiting
+party, a spend over the cap, building a plan this turn wrote, picking a
+recommended variant, a way around a tezgah refusal, another session's work. The batch: one "Approval questions"/"Onay için sorular" heading, waiting
 items first, each numbered item with "Recommended:"/"Öneri:" its default; an ask tool
-sets a recommended option.
+sets a recommended option. No fresh subagent, no review verdict: say so and
+ask. Contest a finding only with a file:line; never lower a severity.
 **Say what a number was measured on.** A figure produced by a fixture - a temp
 HOME, a generated repository, a stand-in, a hand-written sample - is evidence
 about the code path, never a property of the running system, and it is reported

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@r1z4x/tezgah",
-  "version": "1.11.0",
+  "version": "1.13.0",
   "description": "One shared working contract for every AI coding assistant you run: Claude Code, Codex, Cursor, opencode, dsh and oh-my-pi (omp).",
   "license": "MIT",
   "repository": {

package/skills/harness/SKILL.md

@@ -66,6 +66,8 @@ is reported as such, and an empty list beside it is not evidence of absence.
 
 `graph-review` splits findings into `confirmed` (no refuter refuted it), `refuted` (do not report as bugs),
 and `unverified` (hit the cap, or every refuter failed - label them as such). Never promote a refuted or unverified finding.
+Before the cap, findings with the same file, line and title merge into one. The merge keeps the higher severity
+and lists every raising lens in `dimensions`; `caps.deduplicated` counts the merges.
 
 `graph-review` is one review round, not a loop: inside a plan it is round one or round two of the
 plan's single review (two rounds at most, `~/.config/tezgah/bin/tezgah-task review` refuses a third), never one run per

package/skills/i-have-adhd/SKILL.md

@@ -102,7 +102,10 @@ If something is left that only the reader can do - a decision, a credential or
 grant, consent for a step that cannot be undone - name that ONE step, small
 enough to start now. Several such decisions go in one numbered approval batch,
 each with a recommended default, and the work proceeds on the defaults (the
-tezgah contract's Ask policy). A step you can take yourself is not a next step:
+tezgah contract's Ask policy) - except a class-F item (choosing a variant or
+option a research, analysis or review recommends, a way around a tezgah
+refusal, deciding about another session's work), which waits for the answer.
+A step you can take yourself is not a next step:
 take it, and never end on asking whether to. When nothing is left, end on what
 now works.
 
@@ -110,6 +113,12 @@ Bad: "Hope that helps. Let me know if you want to dig deeper."
 Bad: "Next: run `npm test` and paste the first failing line." (you can run it)
 Good: "Blockers: the push to `main` - IRREVERSIBLE - `git push origin main` waits - your yes." (tr: "Engeller", GERİ ALINAMAZ)
 
+In the host's plan mode nothing can run. There the plan is the deliverable:
+the approval is the one step that is the reader's, every other step waits for
+it, and nothing is reported as done or tested, because nothing ran. The Stop
+rule reads the mode from the host and holds both ends of that
+(`hooks/tezgah_integrity.py::read_only_turn`).
+
 ### 5. Suppress tangents
 
 A second issue waits until the first is finished, then arrives as its own

package/skills/plan-add/SKILL.md

@@ -97,7 +97,11 @@ Input: `$ARGUMENTS` (free text describing the work). Run these steps in order.
    is refused while the tree is dirty, because the phase starts by recording
    `checkpoint:` - the commit the work returns to - and uncommitted work has none
    to record. Make the checkpoint commit it prints, then run the phase move
-   again and the sha is written. Move the phase yourself as the work reaches it
+   again and the sha is written. Before `implementation`, spawn one
+   tezgah-reviewer in plan-readiness mode over the plan file. Fix each major
+   finding in the plan, or ask the owner when only the owner can decide, then
+   move the phase. A plan of one small task may skip this review; say so in
+   one line. Move the phase yourself as the work reaches it
    (`~/.config/tezgah/bin/tezgah-task phase implementation`, then `verification`); when a write is
    refused for its path and the plan's work genuinely reaches that file, widen
    the scope with `~/.config/tezgah/bin/tezgah-task allow <glob> ... --why "<reason>"`, which records the reason. Never retype the record:

package/skills/research/SKILL.md

@@ -653,18 +653,27 @@ opened under):
 | `criteria.json` | `question`, `baseline_variant` (V0, the status quo or current design) and `criteria[]`, each with `id` (`K1`), `name`, `kind` (`measured` or `judged`), `direction` (`max`, `min` or `pass`), optional `threshold` and `guardrail` |
 | `variants.jsonl` | one row per variant: `id`, `title`, `artifact` (a path in the line or the repository, `git:<branch>` or `orx:<expId>`), `status` (`produced` or `dropped` with `drop_reason`), and `line` when it is an older line's deliverable |
 | `comparison.jsonl` | one row per cell: `variant`, `criterion`, `value` with its `source`, or `not_checked` with the reason; `rater` on a judged cell. Append with `~/.config/tezgah/bin/tezgah-research compare <slug> <id>` (one JSON object on stdin), which refuses what `check` refuses |
-| `decision.md` | `chosen: V2`, one line per rejected id naming the criterion id that ruled it out, and `flip:` - the result that would reverse the choice |
+| `decision.md` | `recommended: V2` (the line's pick), one line per rejected id naming the criterion id that ruled it out, and `flip:` - the result that would reverse the choice; `chosen:` and `owner:` only once the owner picks |
 
 `check` refuses: fewer produced variants than the deliverable takes; two produced
 files with the same content (a renamed copy is not an alternative); `criteria.json`
 not committed before the first `comparison.jsonl` commit; a comparison row changed
 after it was committed; a missing cell once `decision.md` exists or the line is
-delivering; a `chosen` that is not a produced variant, a rejected variant with no
-criterion, no `flip:`; and a chosen variant another one beats or ties on every
-numeric criterion. A judged cell with fewer than two raters warns (`--strict`
-refuses). A design or plan (and an analysis on a line before rules 5) with no
-`decisions/` warns while the line runs, is refused once it delivers, and keeps
-the line open.
+delivering; a pick (`chosen:`, else `recommended:`) that is not a produced
+variant, a rejected variant with no criterion, no `flip:`; and a picked variant
+another one beats or ties on every numeric criterion. A judged cell with fewer
+than two raters warns (`--strict` refuses). A design or plan (and an analysis on
+a line before rules 5) with no `decisions/` warns while the line runs, is refused
+once it delivers, and keeps the line open.
+
+The line recommends; the owner chooses. Choosing a variant or option a research,
+analysis or review recommends is the owner's call, so a rules-9 line writes
+`recommended:` and never `chosen:` itself - a `chosen:` with no `owner:` line
+fails `check`. Report the recommendation and wait for the answer; building it
+waits too. When the owner answers, record their words:
+`~/.config/tezgah/bin/tezgah-research choose <slug> <decision> <variant> --ack
+"<the owner's words>"` writes `chosen:` and `owner:`, on an open or a done line.
+`conclude` names each recommendation still waiting for the owner.
 
 When the variants are code or config, they are sibling orx nodes under one head
 node (orx cardinal rule 4: fan within a round, then descend onto the winner), and
@@ -681,8 +690,12 @@ into `state.json` `closed` and `log.md`, seals its experiments' file hashes
 way, and an edit after the seal fails `check`. The no-slug `check` reads a done
 line by its seal alone and counts it on one line; its other errors show in
 `check <slug>` and `check --all-lines`. `init --allow-open` is refused
-while an open line has `check` errors. A line moves to another checkout with
-`import`, never as a copy: a copy loses the order proof.
+while an open line has `check` errors, other than a criterion whose verdict is
+still `pending` (a line in flight). A line another session is running is not this
+session's to fix or close: when a refusal names one, stop and ask the owner -
+never a way around a tezgah refusal (another folder, a hidden dir). A hidden dir
+under `research/` is not a line: `check` and `status` fail it. A line moves to
+another checkout with `import`, never as a copy: a copy loses the order proof.
 
 Finally, a `## Patterns` bullet names what it generalises from - a claim id, a
 `literature/` note or a run - because a pattern is the one finding a reader carries

package/skills/tezgah-contract/SKILL.md

@@ -265,7 +265,10 @@ Routing: `~/.config/tezgah/bin/tezgah-route "<brief>"` names the worker - tezgah
 never the host's generic task agent (overrides for stored data, credentials,
 security first; then a Jev judgement; the static phase table with no key). A report missing an output field, or an
 `ESCALATE:`, gets one narrower re-brief of the same role naming that field or judgement; only a second miss is
-restarted on tezgah-frontier with the original brief, never continued; the main thread never switches model (the cache is per model). A
+restarted on tezgah-frontier with the original brief, never continued; the main thread never switches model (the cache is per model).
+A subagent's question only the owner can answer (a class-F item, `ESCALATE: owner`) is relayed to
+the user in the approval batch: the orchestrator never answers it for the user
+and never escalates it to a stronger model. A
 code-discovery brief names codegraph's tools (`codegraph callers`, `callees`,
 `impact`, `node`, `files`, `codegraph_explore`) and says "answer from
 the graph, grep only for literal text"; never a grep-only explorer (observed).
@@ -391,7 +394,11 @@ The reader has to act on the answer, and the friction between "got it" and
    line - never also narrate the plan as prose.
 4. End with the approval questions the Ask policy leaves (the executive mode's
    "Ask policy"), or with nothing when none is left. A step you can take
-   yourself is taken, never handed over.
+   yourself is taken, never handed over: "run `pytest -q` and tell me what it
+   says" is a step you run. In the host's plan mode nothing can run, and there
+   the plan is the deliverable: the approval question is the one question that
+   turn asks, every step waits for it, and nothing is reported as done or
+   tested, because nothing ran.
 5. Suppress tangents: finish the issue in hand, then raise the second as its own
    question. A question the reader raised mid-work is not a tangent - answer it
    and fold the result in.
@@ -438,7 +445,8 @@ intuitive". Such a request is NEVER built from a guess. Before any code:
 3. Ask at most three blocking questions, the ones that change the outcome and
    that no default may take. Every other question goes in the approval batch
    with a recommended default, and the work proceeds on the defaults in the
-   same turn (the executive mode's "Ask policy").
+   same turn (the executive mode's "Ask policy"); a class-F item waits for the
+   answer.
 4. Verify design, behavior and quality claims against an external source, never
    from memory alone: `~/.config/tezgah/bin/consult --online "<question>"` for a
    fast second opinion, or the OpenResearch CLI (`orx` on PATH, else
@@ -614,7 +622,12 @@ a third round.
 A round spawns its reviewers in ONE message, one per dimension (correctness
 and contract, security, tests and performance) or file group; a diff under 300
 changed lines gets one reviewer. Per-task work gets tests, not a reviewer, and
-`~/.config/tezgah/bin/tezgah-task review` refuses a third round.
+`~/.config/tezgah/bin/tezgah-task review` refuses a third round. No fresh subagent, no review verdict:
+on a host or mode that cannot start a fresh reviewer, say so and ask the owner;
+never record a verdict from your own read. The author contests a confirmed
+finding only by citing evidence the reviewer could read (file:line); knowledge
+outside the files goes to the owner as a question, and the author never lowers
+a severity.
 
 **The process is yours: never hand a step back.** The orchestrator runs the
 plan lifecycle itself - `~/.config/tezgah/bin/tezgah-task start`, every `phase` move, `review`,
@@ -642,13 +655,13 @@ whether the user already decided it (named it this session, or granted it).
 | C. Reversible choice the evidence settles | a fix's scope inside the ask, naming, a palette when tokens exist | decide from evidence; real taste goes in the batch with a default, taken this turn |
 | D. Intent fork | two readings of the ask with different deliverables | batch with a default; do the shared part first and proceed on the default |
 | E. Outward on the user's own remote | push, PR, tag, release, publishing the user's own package | act on a grant written in chat ("push without asking", "I approve", "bana sormadan pushla", "onay veriyorum"); else ask once per session, never again after a grant |
-| F. Never on a default | force push or history rewrite on a shared ref; deleting data the session did not make; production deploy, stop or migration; a credential, account or identity change; sending to a third party; a spend over `spend_cap` | do all other work first, ask, and wait: silence is no consent, and only an answer that names the action and its target clears it |
+| F. Never on a default | force push or history rewrite on a shared ref; deleting data the session did not make; production deploy, stop or migration; a credential, account or identity change; sending to a third party; a spend over `spend_cap`; building a plan this turn wrote from a research, analysis, review or plan ask; choosing a variant or option a research, analysis or review recommends; a way around a tezgah refusal (another folder, a hidden dir, a hatch the owner did not grant); deciding about another session's work (its line, plan or branch) | do all other work first, ask, and wait: silence is no consent, and only an answer that names the action and its target clears it |
 | G. ACCESS | a credential or grant no tool supplies | take every route that needs none first, then ask once, naming what it unlocks |
 
 A grant is read from the user's prompt and recorded for the session; "artık
 bana sor", "ask me again" or a later "don't push" lifts it. The batch is one
 block in the reply language: one "Approval questions"/"Onay için sorular" heading, one line saying
-the work proceeds on the defaults when no answer comes, then numbered items -
+the work proceeds on the defaults when no answer comes (a class-F item waits for its answer), then numbered items -
 the question in bold, one line of context, "Recommended:"/"Öneri:" the default, and
 the other option. Class-F items come first, marked as waiting; the defaulted
 items follow, with no count cap, because they do not block. An ask tool (omp

package/statusline.py

@@ -3,6 +3,10 @@
 
   python3 statusline.py            # Claude Code (or any Claude-format status line)
   python3 statusline.py --cursor   # Cursor CLI (same stdin shape, no Orca passthrough)
+  python3 statusline.py --qwen     # Qwen Code `ui.statusLine` command (same fields read)
+  python3 statusline.py --droid    # Factory Droid `statusLine` command (`current_dir`)
+  python3 statusline.py --copilot  # Copilot CLI `statusLine` command (fields undocumented)
+  python3 statusline.py --antigravity  # Antigravity CLI `statusLine` command (`workspace`)
 
 Claude Code's statusLine pipes session JSON on stdin; Cursor's spec is aligned
 with it. This wraps Orca's own status line for Claude, then appends the tezgah
@@ -35,8 +39,9 @@ except Exception as exc:
 
 HOME = os.path.expanduser("~")
 ORCA = os.path.join(HOME, ".orca", "agent-hooks", "claude-statusline.sh")
-HOST = "cursor" if ("--cursor" in sys.argv or
-                    os.environ.get("TEZGAH_STATUS_HOST") == "cursor") else "claude"
+HOST = next((h for h in ("cursor", "qwen", "droid", "copilot", "antigravity")
+             if "--" + h in sys.argv
+             or os.environ.get("TEZGAH_STATUS_HOST") == h), "claude")
 
 data = sys.stdin.read()
 try:
@@ -54,8 +59,11 @@ if HOST == "claude" and os.access(ORCA, os.X_OK):
     except Exception:
         orca_out = ""
 
-cwd = ((payload.get("workspace") or {}).get("current_dir")
-       or payload.get("cwd") or "")
+# Droid 0.251.0 sends `current_dir` at the top level (its status line snapshot
+# carries session_id, transcript_path, current_dir, workspace, model)
+workspace = payload.get("workspace")
+cwd = ((workspace if isinstance(workspace, dict) else {}).get("current_dir")
+       or payload.get("current_dir") or payload.get("cwd") or "")
 try:
     real = os.path.realpath(cwd) if cwd else ""
 except OSError:
@@ -113,11 +121,14 @@ def claude_used():
     return used
 
 
-seen = used_kinds(payload.get("session_id")) if HOST == "cursor" else claude_used()
-# Cursor's line reads tezgah's store, which sees the tool calls its hook fires on
-# and nothing else; Claude's transcript carries the skill reads too.
-observable = TOOL_USE_MEASURES if HOST == "cursor" else None
-segs = health_segments(real or os.getcwd(), payload.get("session_id"),
+# Copilot documents its status line input only as "session JSON", so its
+# camelCase spelling is read too
+session_id = payload.get("session_id") or payload.get("sessionId")
+seen = used_kinds(session_id) if HOST != "claude" else claude_used()
+# Cursor's, Qwen's, Droid's, Copilot's and Antigravity's lines read tezgah's store, which sees the tool calls their
+# hook fires on and nothing else; Claude's transcript carries the skill reads too.
+observable = TOOL_USE_MEASURES if HOST != "claude" else None
+segs = health_segments(real or os.getcwd(), session_id,
                        used_override=seen, observable=observable)
 # Claude Code and Cursor render ANSI; let a user or a plain terminal opt out.
 color = color_default()

package/workflows/graph-review.js

@@ -114,7 +114,18 @@ const unknown = DIMENSIONS.filter((d, i) => !reviewed[i]).map(d => `review:${d.k
 const reviews = reviewed.filter(Boolean)
 
 const rank = { high: 0, medium: 1, low: 2 }
-const all = reviews.flatMap(r => r.findings || []).sort((a, b) => rank[a.severity] - rank[b.severity])
+// two lenses often raise one defect: merge on (file, line, lowercased title), keep the higher severity
+const byKey = new Map()
+let raised = 0
+reviewed.forEach((r, i) => ((r && r.findings) || []).forEach(f => {
+  raised++
+  const key = `${f.file}\u0000${f.line || ''}\u0000${String(f.title).trim().toLowerCase()}`
+  const prev = byKey.get(key)
+  const keep = prev && rank[prev.severity] <= rank[f.severity] ? prev : f
+  byKey.set(key, { ...keep, dimensions: [...new Set([...((prev && prev.dimensions) || []), DIMENSIONS[i].key])] })
+}))
+const all = [...byKey.values()].sort((a, b) => rank[a.severity] - rank[b.severity])
+const caps = { max_verified: MAX_VERIFIED, raised, deduplicated: raised - all.length }
 if (!all.length) {
   const note = !unknown.length ? 'all four dimensions came back clean'
     : !reviews.length ? 'every dimension failed - nothing was reviewed; unknown, not clean'
@@ -124,7 +135,7 @@ if (!all.length) {
 
 const toVerify = all.slice(0, MAX_VERIFIED)
 if (all.length > toVerify.length) {
-  log(`${all.length} findings raised; verifying the ${toVerify.length} most severe. NOT verified (reported as unverified): ${all.slice(MAX_VERIFIED).map(f => f.title).join('; ')}`)
+  log(`${all.length} distinct findings (${caps.deduplicated} duplicates merged); verifying the ${toVerify.length} most severe. NOT verified (reported as unverified): ${all.slice(MAX_VERIFIED).map(f => f.title).join('; ')}`)
 }
 
 phase('Verify')
@@ -167,4 +178,5 @@ return {
   unverified: unsettled.map(v => ({ ...v.finding, verdict: 'UNVERIFIED - every refuter failed' }))
     .concat(all.slice(MAX_VERIFIED).map(f => ({ ...f, verdict: 'UNVERIFIED - budget cap' }))),
   unknown,
+  caps,
 }