@r1z4x/tezgah 1.11.0 → 1.13.0

package/docs/hosts.md

@@ -1,7 +1,7 @@
 # Hosts
 
-tezgah is one Python core with six host adapters around it: `claude`, `codex`,
-`cursor`, `opencode`, `dsh`, `omp`. This page is for the maintainer wiring a new
+tezgah is one Python core with fourteen host adapters around it: `claude`, `codex`,
+`cursor`, `opencode`, `dsh`, `omp`, `qwen`, `droid`, `commandcode`, `copilot`, `gemini`, `antigravity`, `goose`, `amp`. This page is for the maintainer wiring a new
 host, adding a mark, or debugging a status line that claims something a host
 cannot see. Read it when a question starts with "does this host get X?" or "can
 this host observe Y?" - the answer is not uniform, and guessing it produces a
@@ -23,6 +23,14 @@ surface can honestly report this session; the two skill-read marks (`pony`,
 | opencode | no lifecycle events; plugin hooks: config, permission.ask, tool.execute.before, shell.env, experimental.session.compacting, chat.message, tool.execute.after (`hosts/opencode/plugins/tezgah.js:2372-2737`) - `tool.execute.before` carries the whole gate, `tool.execute.after` the channel on the row, the provenance label on the result and the taint notice on the next effect (`untrustedSource` `hosts/opencode/plugins/tezgah.js:1942`, `labelResult` `:1993`) | static only: generated `instructions` files, because there is no session-start injection point (`hosts/opencode/plugins/tezgah.js:3-6`, `bin/tezgah-setup::opencode_contract_text`) | chat.message pushes a synthetic part (`hosts/opencode/plugins/tezgah.js:2652-2703`) | TUI plugin `tezgah-tui.tsx` declared in `tui.json`, runs `tezgah-status` on the event bus (`hosts/opencode/tui/tezgah-tui.tsx:1-11`; wiring `bin/tezgah-setup::install_opencode`) | all seven: skill reads and kinds are classified in process (`hosts/opencode/plugins/tezgah.js:2227-2263`) |
 | dsh | SessionStart, SubagentStart, UserPromptSubmit, PreToolUse, PostToolUse (`hosts/dsh/hooks.json:2-19`); no Stop rule, because the bridge drops every call's outcome and no check there can show a pass | hook: the same Claude-family scripts, named by `configPath` (`bin/tezgah-setup::dsh_patch_block`) | UserPromptSubmit, through the bridge (`hosts/dsh/hooks.json:9-11`) | web-profile plugin: authenticated `GET /api/tezgah.status` -> `tezgah-status` (`hosts/dsh/statusline/lib/index.js:15,66-104`) | five tool-use: the route passes `--observable=consult,research,graph,orch,judge` (`hosts/dsh/statusline/lib/index.js:16-19,84,96`) |
 | omp | session_start, session_compact, session_switch, turn_end, before_agent_start, tool_call, tool_result, session_stop (`hosts/omp/tezgah-hook.ts.in:596,655,674,679,681,701,720,755`) | both: static `RULES.md` (`bin/tezgah-setup::STATIC_RULES`, `bin/tezgah-setup::rules_block`) and a session payload carrying only what a static file cannot know (`hosts/omp/hook.py::handle`) | before_agent_start returns a hidden message (`hosts/omp/tezgah-hook.ts.in:681-699`) | extension draws `ctx.ui.setWidget` below the editor, `setStatus` as fallback (`hosts/omp/tezgah-hook.ts.in:170-203`); ANSI line from `hosts/omp/hook.py::status_line` | all seven: the embedded runner filters skill reads before asking python (`hosts/omp/tezgah-hook.ts.in:257-264`) and no `observable` is passed (`hosts/omp/hook.py::status_line`) |
+| qwen | SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, PostToolUseFailure, SubagentStart, SubagentStop (record-only, `subagent_end`), Stop (`bin/tezgah-setup::QWEN_HOOK_EVENTS`), all in `~/.qwen/settings.json` beside Orca's rows | the managed block in `~/.qwen/QWEN.md` (`bin/tezgah-setup::STATIC_RULES`); SessionStart drops the core while the block is there (`hosts/qwen/hook.py::rules_carry_core`) | UserPromptSubmit -> `additionalContext` (`hosts/qwen/hook.py::main`) | `ui.statusLine` command in `~/.qwen/settings.json` -> `tezgah-statusline --qwen`, ANSI kept by `respectUserColors` (`bin/tezgah-setup::install_qwen`) | five tool-use (`statusline.py::observable`) |
+| droid | SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, SubagentStop (record-only, `subagent_end`), Stop (`bin/tezgah-setup::DROID_HOOK_EVENTS`), all in `~/.factory/hooks.json` | the managed block in `~/.factory/AGENTS.md` (`bin/tezgah-setup::STATIC_RULES`); SessionStart drops the core while the block is there (`hosts/droid/hook.py::rules_carry_core`) | UserPromptSubmit -> `additionalContext` (`hosts/droid/hook.py::main`) | `statusLine` command in `~/.factory/settings.json` -> `tezgah-statusline --droid`, set in place with the file's comments kept (`bin/tezgah-setup::install_droid`, `bin/tezgah-setup::jsonc_put`) | five tool-use (`statusline.py::observable`) |
+| commandcode | SessionStart, PreToolUse (matcher `shell\|write\|edit`), PostToolUse, Stop (`bin/tezgah-setup::COMMANDCODE_HOOK_EVENTS`), all in the `hooks` key of `~/.commandcode/settings.json` | the managed block in `~/.commandcode/AGENTS.md` (`bin/tezgah-setup::STATIC_RULES`); SessionStart drops the core while the block is there (`hosts/commandcode/hook.py::rules_carry_core`) | unavailable: Command Code has no prompt event | no custom status line - the segment rides `systemMessage`, plain, TUI only, at SessionStart and Stop (`hosts/commandcode/hook.py::status`) | five tool-use (`TOOL_USE_MEASURES` at `hosts/commandcode/hook.py::status`) |
+| copilot | SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, PostToolUseFailure, subagentStart, SubagentStop (record-only, `subagent_end`), Stop (`bin/tezgah-setup::COPILOT_HOOK_EVENTS`), all in tezgah's own `$COPILOT_HOME/hooks/tezgah.json` | the managed block in `$COPILOT_HOME/copilot-instructions.md` (`bin/tezgah-setup::STATIC_RULES`); SessionStart drops the core while the block is there (`hosts/copilot/hook.py::rules_carry_core`) | unavailable: Copilot drops a command hook's UserPromptSubmit output; the event still writes the turn row (`hosts/copilot/hook.py::main`) | `statusLine` command in `$COPILOT_HOME/settings.json` -> `tezgah-statusline --copilot`, written only while that file is plain JSON (`bin/tezgah-setup::install_copilot`) | five tool-use (`statusline.py::observable`) |
+| gemini | SessionStart, BeforeAgent, BeforeTool, AfterTool, AfterAgent (`bin/tezgah-setup::GEMINI_HOOK_EVENTS`), all in tezgah's own extension `~/.gemini/extensions/tezgah/hooks/hooks.json` | the managed block in `~/.gemini/GEMINI.md` (`bin/tezgah-setup::STATIC_RULES`), shared with Antigravity; SessionStart drops the core while the block is there (`hosts/gemini/hook.py::rules_carry_core`) | BeforeAgent -> `hookSpecificOutput.additionalContext`, appended to the prompt for that turn (`hosts/gemini/hook.py::main`) | no custom status line (`ui.footer.items` is a closed list) - the segment rides `systemMessage`, plain, at SessionStart and AfterAgent (`hosts/gemini/hook.py::status`) | five tool-use (`TOOL_USE_MEASURES` at `hosts/gemini/hook.py::status`) |
+| antigravity | SessionStart, PreInvocation, PreToolUse, PostToolUse, Stop (`bin/tezgah-setup::ANTIGRAVITY_HOOK_EVENTS`), all under the `tezgah` name of `~/.gemini/config/hooks.json`; the payload names no event, so each command passes it as its first argument | the managed block in `~/.gemini/GEMINI.md` (`bin/tezgah-setup::STATIC_RULES`), shared with Gemini CLI; SessionStart injects the core as a system message while the block is missing (`hosts/antigravity/hook.py::rules_carry_core`) | PreInvocation with `invocationNum` 0 -> an `injectSteps` `ephemeralMessage`; whether that number restarts each user turn is undocumented (`hosts/antigravity/hook.py::main`) | `statusLine` command in `~/.gemini/antigravity-cli/settings.json` -> `tezgah-statusline --antigravity`, written only while that file is plain JSON (`bin/tezgah-setup::install_antigravity`) | five tool-use (`statusline.py::observable`) |
+| goose | SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, PostToolUseFailure, Stop (`bin/tezgah-setup::GOOSE_HOOK_EVENTS`), all in tezgah's own plugin `~/.agents/plugins/tezgah/hooks/hooks.json`; the payload names the event in `event` | the managed block in `~/.config/goose/.goosehints` (`bin/tezgah-setup::STATIC_RULES`), which Goose adds to the system prompt of every request; no hook can inject it, because SessionStart is observation only | unavailable: Goose ignores UserPromptSubmit output; the event still writes the turn row (`hosts/goose/hook.py::main`) | unavailable: Goose has no status line and shows no hook output to the user | none drawn; the PostToolUse rows still record the five tool-use marks for `tezgah-status` (`hosts/goose/hook.py::post_tool`) |
+| amp | no hook file: tezgah's TypeScript plugin `$XDG_CONFIG_HOME/amp/plugins/tezgah.ts` (else `~/.config/amp/plugins/tezgah.ts`) subscribes to `session.start`, `agent.start`, `tool.call`, `tool.result` and `agent.end` and forwards each to `hosts/amp/hook.py` (`hosts/amp/tezgah-plugin.ts.in`) | the managed block in `~/.config/amp/AGENTS.md` (`bin/tezgah-setup::STATIC_RULES`), which Amp always includes; `session.start` cannot inject, so the session brief rides the thread's next `agent.start`, with the core only while that block is missing or `AMP_IGNORE_GUIDANCE_FILES` is set (`hosts/amp/hook.py::handle`) | hook: `agent.start` returns the reminder as a hidden message (`display: false`); a prompt that starts with `[tezgah:stop]` is tezgah's own continue and sends no `user_prompt` | the experimental `createStatusItem`, plain text, for the thread the user is looking at only (owner-approved, plan 140 A-D15); without it, no status surface | none drawn beyond the status item; the `tool.result` rows record the five tool-use marks and a skill read |
 
 The middle five marks (`consult`, `research`, `graph`, `orch`, `judge`) are tool-use marks:
 any adapter that sees its host's tool calls can light them by calling
@@ -47,15 +55,37 @@ the code path there, but no run has shown the host obeying it.
 | opencode | gate, probed by `--report --live` through a node driver | unavailable: the plugin API has no end-of-turn event | unavailable |
 | dsh | gate, probed by `--report --live` through the bridge | unavailable: ADR 003 removed the Stop entry, because the bridge carries no outcome | partial, unverified: a brief at SubagentStart, no SubagentStop entry |
 | omp | gate, probed by `--report --live` (node 22.6+) | gate, unverified (`hosts/omp/hook.py::handle`) | partial, unverified: a brief at a task session's start; `session_stop` does not fire for task sessions |
+| qwen | gate, probed by `--report --live` through the hook command in `~/.qwen/settings.json`; that the qwen binary obeys the deny is unverified until `TEZGAH_E2E_SPEND=1 python3 tests/e2e_qwen.py` runs (it spends a model call) | gate, unverified (`hosts/qwen/hook.py::main`, judged on `last_assistant_message`) | observe, unverified: a brief at SubagentStart, a record-only `subagent_end` row at SubagentStop |
+| droid | gate, probed by `--report --live` through the hook command in `~/.factory/hooks.json`; that the droid binary obeys the deny is unverified until `TEZGAH_E2E_SPEND=1 python3 tests/e2e_droid.py` runs (it spends a model call) | gate, unverified: Droid's Stop carries no reply, so the reply is read from `transcript_path` (`hosts/droid/hook.py::last_reply`), and a turn end whose reply is not there yet is a `reply_unread` row, never judged | partial, unverified: a record-only `subagent_end` row from SubagentStop's `task_result`; no SubagentStart, so no brief |
+| commandcode | gate, unverified: probed by `--report --live` through the hook command in `~/.commandcode/settings.json`, but no run of the binary has shown it obeying the deny; only shell, write and edit reach the hook (read, MCP, subagent and web tools do not), and plan mode skips every hook | gate, unverified: Stop carries no reply, so the reply is read from `transcript_path` (`hosts/commandcode/hook.py::last_reply`) and a turn end with none there is a `reply_unread` row, never judged; the host caps a block at three retries | unavailable: the settings hooks have no subagent event |
+| copilot | gate, unverified: probed by `--report --live` through the hook command in `$COPILOT_HOME/hooks/tezgah.json`, which answers with a top-level `permissionDecision: deny`, but no run of the binary has shown it obeying the deny. A PreToolUse hook that times out (10 s) lets the call through, by Copilot's own rule; one that crashes denies it. A repo's `.claude/settings.json` hooks run there too | gate, unverified: Stop carries no reply, so the reply is the last `assistant.message` in `transcript_path` (`hosts/copilot/hook.py::last_reply`), and a turn end with none there is a `reply_unread` row, never judged; the host ends the turn anyway after 8 blocks in a row | observe, unverified: a brief at subagentStart, a record-only `subagent_end` row at SubagentStop; the built-in `general-purpose` agent fires neither |
+| gemini | gate, unverified: probed by `--report --live` through the hook command in `~/.gemini/extensions/tezgah/hooks/hooks.json`, which answers with a top-level `decision: deny`, but no run of the binary has shown it obeying the deny, and no run has shown Gemini loading an extension dir written without `gemini extensions install` (its loader reads every subdir; a non-empty `security.allowedExtensions` asks for install metadata tezgah does not write). A hook that crashes or prints bad JSON is a warning and the call goes on | gate, unverified: AfterAgent carries the reply as `prompt_response` and `stop_hook_active` (`hosts/gemini/hook.py::main`); a deny sends the reason back as a new prompt | unavailable: no subagent event; a subagent is a tool call (`codebase_investigator`, `generalist`, `invoke_agent`) the gate sees as `Task` |
+| antigravity | gate, unverified: probed by `--report --live` through the hook command under the `tezgah` name of `~/.gemini/config/hooks.json`, fed Antigravity's camelCase envelope with the event as argv, which answers with a top-level `decision: deny` (an allow answers `decision: allow`, since the field is required), but no run of the binary has shown it obeying the deny. What Antigravity does when a hook crashes or times out is undocumented. The same file arms the Antigravity App and IDE | gate, unverified: Stop carries no reply, so the reply is read from `transcriptPath` (`hosts/antigravity/hook.py::last_reply`), and a turn end with none there is a `reply_unread` row, never judged; only an idle `model_stop` is judged, and `decision: continue` sends the model back into the loop with the reason as a system message. No block counter: the turn's refusal rows bound the re-asks | unavailable: no subagent event; a child conversation keeps its own ledger, and `invoke_subagent` reaches the gate as Task |
+| goose | gate, unverified: probed by `--report --live` through the hook command in `~/.agents/plugins/tezgah/hooks/hooks.json`, which answers `{"decision": "block"}` on stdout, but no run of the binary has shown it obeying the block, nor loading a plugin dir written by hand rather than by `goose plugin install` (the plugins guide says both are discovered). `on_failure` is left at its default `allow`, so a hook that crashes, times out or prints no decision lets the call through: the gate fails open on a hook fault. Only `shell`, `write`, `edit` and `<extension>__<tool>` reach the gate | gate, unverified: Stop carries the reply as `last_assistant_message` (`hosts/goose/hook.py::main`), and a Stop with none is a `reply_unread` row, never judged. It carries no count of earlier blocks, so the turn's own refusal rows bound the re-asks; Goose ends the turn anyway after `GOOSE_STOP_HOOK_BLOCK_CAP` blocks in a row | unavailable: SubagentStart and SubagentStop are not emitted; the subagent tool is not mapped |
+| amp | gate, unverified: `--report --live` loads the installed plugin with node 22.6+ (`--experimental-strip-types`) and fires its `tool.call` on a `Bash` call carrying `cmd`; the plugin answers `{action: "reject-and-continue"}`, but Amp's own Bun loader is not what ran it, so the row stays UNVERIFIED. A hook that is missing, crashes, times out or prints no JSON answers `{action: "allow"}`: the gate fails open. Only `Bash`, `shell_command`, `edit_file`, `create_file`, `apply_patch`, `Task` and an MCP effect name reach the gate | gate, unverified: `agent.end` with status `done` asks the Stop rule on the last assistant message and continues the turn with `[tezgah:stop] <reason>`; a turn that marker started is judged as the re-ask (`stop_hook_active`), and Amp's own cap of 5 continues backs the core's budget. Error and cancelled turns are not judged. A shell result passes only on an integer `exitCode` read off an output object (`hosts/amp/hook.py::call_failed`); Amp's docs do not show that its Bash result carries one, so until a run shows it no Amp check counts as passed | partial, unverified: a thread with a parent (`ctx.thread.parentThreadID()`) gets the subagent brief and a record-only `subagent_end` row at its `agent.end`; whether a Task subagent's events reach plugins is undocumented |
 
 Every host also attests its own hook entries once per session
-(`hooks/tezgah_attest.py::run`). Claude, dsh, Codex, Cursor and omp do it at
-session start. opencode does it at the first message, through `oncePerSession`.
+(`hooks/tezgah_attest.py::run`). Every host but opencode does it at session
+start. opencode does it at the first message, through `oncePerSession`.
 The `attest` row and the `drift` mark are
 [evidence](evidence.md#the-kinds-by-what-reads-them), never a block.
 `--report` prints the same comparison per host
 (`bin/tezgah-setup::attestation_rows`).
 
+Every Stop adapter hands the core the host's permission mode for the turn
+(`hooks/tezgah_integrity.py::read_only_turn`, plan 142). Claude, Command Code,
+Qwen, Copilot, Gemini, Codex, Goose, Droid and Cursor send it as
+`permission_mode` on the Stop payload (Antigravity's envelope is camelCase,
+`permissionMode`). omp has no such field, so its extension reads
+`ctx.sessionModes.getState().plan` and sends `plan` when it is active
+(`hosts/omp/tezgah-hook.ts.in`). A host that sends nothing reads as `default`.
+Only `plan` and Droid's `spec` change a verdict, and only two of them: the rule
+lets the approval question such a turn ends on through, and refuses a
+done/tested claim in it
+([evidence](evidence.md#the-stop-rule-end-to-end)). Claude's hooks reference
+documents the field on its own Stop payload. Every other adapter reads whatever
+its payload carries.
+
 ## What each host gets, and where it is written
 
 Every host gets the skill symlinks from `SKILLS` (`bin/tezgah-setup::SKILLS`)
@@ -126,6 +156,122 @@ shared config, contract hash and the CLI symlinks every host shell can call
   its own: orx's `codex` target writes the shim to `~/.agents/skills/orx`,
   omp's native `agents` skill root, so `install_openresearch` maps omp onto it
   (`ORX_AGENTS`, `bin/tezgah-setup::ORX_AGENTS`).
+- **qwen** - `install_qwen` (`bin/tezgah-setup::install_qwen`) writes into
+  `~/.qwen/settings.json` (or `$QWEN_HOME`). It adds one hook group per event of
+  `QWEN_HOOK_EVENTS`, each `timeout` in milliseconds. The PreToolUse group
+  carries `QWEN_PRETOOL_MATCHER` over Qwen's runtime tool ids. It also sets
+  `ui.statusLine`. Orca's groups and the provider keys in that file stay, and
+  the backup is owner-only (`bin/tezgah-setup::backup`). The install links
+  `skills/*` into `~/.qwen/skills`. It writes the always-on block in
+  `~/.qwen/QWEN.md`. tezgah writes no subagent roles, MCP rows or orx shim for
+  Qwen yet.
+- **droid** - `install_droid` (`bin/tezgah-setup::install_droid`) writes
+  `~/.factory/hooks.json`, keyed by event at the top. It adds one hook group per
+  event of `DROID_HOOK_EVENTS`, each `timeout` in seconds, and keeps the user's
+  own groups. The PreToolUse group carries `DROID_PRETOOL_MATCHER` over Droid's
+  tool ids. Droid reads the `hooks` key of `settings.json` only while hooks.json
+  is absent. The install then writes no hooks.json and says why
+  (`bin/tezgah-setup::droid_hooks_blocked`). Droid's settings.json holds
+  comments, so the install edits it in place and keeps them
+  (`bin/tezgah-setup::jsonc_put`). It adds the `statusLine`. It sets
+  `includeCoAuthoredByDroid` to false, the switch for Droid's co-author trailer.
+  A file it cannot edit safely is left alone and the run names both keys. The install
+  links `skills/*` into `~/.factory/skills` beside the user's own links. It
+  writes the always-on block in `~/.factory/AGENTS.md`. The uninstall deletes a
+  hooks.json that held only tezgah's groups. An empty one would still hide
+  settings.json's hooks. tezgah writes no subagent roles, MCP rows or orx
+  shim for Droid yet.
+- **commandcode** - `install_commandcode` (`bin/tezgah-setup::install_commandcode`)
+  writes into the `hooks` key of `~/.commandcode/settings.json`. It adds one
+  hook group per event of `COMMANDCODE_HOOK_EVENTS`, each `timeout` in seconds.
+  The user's own groups stay, and the backup is owner-only. The PreToolUse group
+  carries `COMMANDCODE_PRETOOL_MATCHER`, which Command Code tests against the
+  tool's display name. The same write sets `attribution.commit` to `""`. That
+  turns off the default `Co-authored-by: CommandCodeBot` commit trailer. A value
+  the user set stays. The uninstall removes the key only while it holds what the
+  install wrote. The install links `skills/*` into `~/.commandcode/skills`. It
+  writes the always-on block in `~/.commandcode/AGENTS.md`. tezgah writes no
+  subagent roles, MCP rows or orx shim for Command Code yet.
+- **copilot** - `install_copilot` (`bin/tezgah-setup::install_copilot`) writes
+  `$COPILOT_HOME/hooks/tezgah.json`, a `{"version": 1, "hooks": ...}` file that
+  is wholly tezgah's. `COPILOT_HOME` defaults to `~/.copilot`. The file holds
+  one entry per event of `COPILOT_HOOK_EVENTS`, each `timeoutSec` in seconds.
+  The inline `hooks` key of settings.json is never used, since one bad item
+  there rejects every hook in it. The PreToolUse entry carries
+  `COPILOT_PRETOOL_MATCHER`. settings.json is JSON with comments. So the status
+  line and `includeCoAuthoredBy: false` go in only while it parses as plain
+  JSON. That setting turns off the default `Co-authored-by` trailer on the
+  agent's commits. A value the user set stays. The install links `skills/*`
+  into `$COPILOT_HOME/skills` and writes the always-on block in
+  `$COPILOT_HOME/copilot-instructions.md`. The uninstall deletes tezgah.json
+  and takes back only tezgah's settings keys. tezgah writes no subagent roles,
+  MCP rows or orx shim for Copilot yet.
+- **gemini** - `install_gemini` (`bin/tezgah-setup::install_gemini`) writes
+  tezgah's own extension, `~/.gemini/extensions/tezgah/`, which is wholly
+  tezgah's. `GEMINI_CLI_HOME` moves `~/.gemini` under it. The dir holds
+  `gemini-extension.json`, `hooks/hooks.json` with one group per event of
+  `GEMINI_HOOK_EVENTS` (each `timeout` in milliseconds) and `skills/*` links.
+  The BeforeTool group carries `GEMINI_PRETOOL_MATCHER`. settings.json is never
+  written: it is JSON with comments and holds the user's keys. Gemini's default
+  prompt adds no co-author trailer and no setting names one, so there is
+  nothing to turn off. The install writes the always-on block in
+  `~/.gemini/GEMINI.md`, which Antigravity reads too. The uninstall deletes the
+  extension dir. It strips the block only while no other host of
+  `GEMINI_MD_HOSTS` stays armed (`bin/tezgah-setup::gemini_md_kept`). Gemini
+  gets no subagent roles, MCP rows or orx shim from tezgah yet.
+- **antigravity** - `install_antigravity` (`bin/tezgah-setup::install_antigravity`)
+  writes tezgah's hook set under the top-level `tezgah` name of
+  `~/.gemini/config/hooks.json`, beside the user's other names. Each event of
+  `ANTIGRAVITY_HOOK_EVENTS` gets one item, its `timeout` in seconds. PreToolUse
+  and PostToolUse take a matcher group, the others a bare handler. Antigravity
+  never loads hooks from `antigravity-cli/settings.json`. The Antigravity App
+  and IDE read the same global hooks.json, so the install arms them too. The
+  status line goes in `~/.gemini/antigravity-cli/settings.json` only while it
+  is plain JSON. The skill links go in `antigravity-cli/skills`. Antigravity
+  adds no co-author trailer of its own, and no setting names one. An open
+  feature request asks for one (google-antigravity/antigravity-cli#230). The
+  always-on block is the `~/.gemini/GEMINI.md` one Gemini CLI shares
+  (`bin/tezgah-setup::gemini_md_kept`). The uninstall takes out the `tezgah`
+  name, the statusLine and the links. It removes a file that held only
+  tezgah's keys. Antigravity gets no subagent roles, MCP rows or orx shim from
+  tezgah yet. Antigravity can never show a passing check. Its PostToolUse
+  carries no output. A shell call that went to the background also ends with an
+  empty `error`. So the hook records each shell call as ran, never a pass
+  (`hosts/antigravity/hook.py::post_tool`). The owner chose this: a done or
+  tested claim there always stops at the Stop rule's `no verify_ok` class.
+- **goose** - `install_goose` (`bin/tezgah-setup::install_goose`) writes
+  tezgah's own plugin, `~/.agents/plugins/tezgah/`, which is wholly tezgah's.
+  It holds `plugin.json`, `hooks/hooks.json` and `skills/*` links. The hooks
+  file has one group per event of `GOOSE_HOOK_EVENTS`, each `timeout` in
+  seconds. Goose loads the skills as `tezgah:<skill>`. Goose tests a matcher
+  unanchored, so the PreToolUse group carries the anchored
+  `GOOSE_PRETOOL_MATCHER`. No hook sets `on_failure`, so it stays at Goose's
+  default `allow`, and a hook fault lets the call through. The always-on block
+  goes in `~/.config/goose/.goosehints`. Neither Goose's docs nor its system
+  prompt add a co-author trailer or name a setting for one. The uninstall
+  deletes the plugin dir and strips the block. The rest of `~/.agents` is the
+  user's and stays. The install ignores `GOOSE_PATH_ROOT`, since the docs
+  do not say where it puts the hints file. Goose gets no subagent roles, MCP
+  rows or orx shim from tezgah yet.
+- **amp** - `install_amp` (`bin/tezgah-setup::install_amp`) writes one file,
+  `tezgah.ts`, into Amp's system plugin dir (`hooks/tezgah_paths.py::AMP_PLUGIN`,
+  under `XDG_CONFIG_HOME` when that is set). `hooks/tezgah_attest.py::amp_plugin`
+  renders it from `hosts/amp/tezgah-plugin.ts.in`. Amp loads every `.ts` there,
+  and nothing registers it. A running Amp needs `plugins: reload`. The plugin
+  spawns `hosts/amp/hook.py` without blocking, one JSON in and one out. One
+  plugin process serves many threads, so it keys all its state by thread id.
+  The install links the skills into `~/.config/amp/skills` and writes the
+  always-on block into `~/.config/amp/AGENTS.md`. By default Amp adds a
+  `Co-authored-by: Amp` and an `Amp-Thread-ID` trailer to its commits. The
+  install sets `amp.git.commit.coauthor.enabled` and
+  `amp.git.commit.ampThread.enabled` to false in `~/.config/amp/settings.json`
+  unless the user set them. It writes that file only while it is plain JSON
+  with no `settings.jsonc` beside it (`bin/tezgah-setup::amp_settings`). Else it
+  prints both keys to set by hand. The uninstall removes the plugin only when
+  it is a fresh render or starts with tezgah's header line
+  (`bin/tezgah-setup::amp_plugin_ours`). It drops a trailer key only while that
+  key is still false. Amp gets no subagent roles, MCP rows or orx shim from
+  tezgah.
 
 An adapter is responsible for its host's **envelope** and its **surface**: it
 translates the host's event and tool names into the shared vocabulary (one call
@@ -149,6 +295,14 @@ pays for it once.
 | opencode | no stdout-inject hook: `install_opencode` writes the generated `~/.config/tezgah/opencode-contract.md` and references it from `opencode.json` `instructions` |
 | omp | the managed block in `~/.omp/agent/RULES.md` |
 | dsh | the session's own hook context: `hosts/dsh/hooks.json` runs the Claude-family scripts through the bridge, and no dsh file carries the core, so dsh's `SessionStart` row declares nothing and still gets it here (`~/.dsh/cordis.patch.yml` mounts that bridge) |
+| qwen | the managed block in `~/.qwen/QWEN.md`, which Qwen loads into every session; its `SessionStart` hook repeats the core only while that block is missing (`hosts/qwen/hook.py::rules_carry_core`) |
+| droid | the managed block in `~/.factory/AGENTS.md`, which Droid loads as coding guidelines at startup; its `SessionStart` hook repeats the core only while that block is missing (`hosts/droid/hook.py::rules_carry_core`) |
+| commandcode | the managed block in `~/.commandcode/AGENTS.md`, the user memory file Command Code puts in the system prompt; its `SessionStart` hook repeats the core only while that block is missing (`hosts/commandcode/hook.py::rules_carry_core`) |
+| copilot | the managed block in `$COPILOT_HOME/copilot-instructions.md`, Copilot's personal instructions file, applied to every session; its `SessionStart` hook repeats the core only while that block is missing (`hosts/copilot/hook.py::rules_carry_core`) |
+| gemini | the managed block in `~/.gemini/GEMINI.md`, the global context file Gemini puts in the system prompt and Antigravity reads too; its `SessionStart` hook repeats the core only while that block is missing (`hosts/gemini/hook.py::rules_carry_core`) |
+| antigravity | the same managed block in `~/.gemini/GEMINI.md`, a standalone global rule Antigravity keeps always on (24,000-byte file limit); its `SessionStart` hook injects the core as a system message only while that block is missing (`hosts/antigravity/hook.py::rules_carry_core`) |
+| goose | the managed block in `~/.config/goose/.goosehints`, the global hints file Goose adds to the system prompt of every request; no hook repeats it, because no Goose hook output reaches the model outside a block |
+| amp | the managed block in `~/.config/amp/AGENTS.md`, which Amp always includes; the session brief on the thread's first turn repeats it only while that block is missing or `AMP_IGNORE_GUIDANCE_FILES` is set (`hosts/amp/hook.py::rules_carry_core`) |
 
 An installed host whose core line is missing is a health check's business
 (`host_checks_<host>`), not a second copy: two delivery paths for one host is the
@@ -167,11 +321,27 @@ and drops the later ones.
 | context | cursor | the `sessionStart` hook context, the repo's `AGENTS.md`, `.cursor/rules/*.mdc`, `.cursorrules` | the hook |
 | context | opencode | `~/.config/opencode/AGENTS.md`, `opencode.json` `instructions`, the repo's `AGENTS.md` | the contract and router files in `instructions` |
 | context | omp | `SYSTEM.md`, `APPEND_SYSTEM.md`, `RULES.md` (sticky), the repo's `.omp/AGENTS.md`, `AGENTS.md`, `CLAUDE.md`; another host's user files only with `enabledProviders` | block in `RULES.md`, the extension at session start |
+| context | qwen | `~/.qwen/QWEN.md`, the repo's `QWEN.md` and `AGENTS.md`, then `.qwen/QWEN.local.md`; all load | block in the first |
+| context | droid | from the cwd up to the git root, `AGENTS.md` (or `CLAUDE.md`) in each dir and its `.factory/`, `.agents/`, `.agent/`; then `~/.factory/AGENTS.md` and the other personal dirs; project files override personal ones | block in `~/.factory/AGENTS.md` |
+| context | commandcode | `~/.commandcode/AGENTS.md`, the repo's `AGENTS.md` (else `.commandcode/AGENTS.md`), then each subdirectory's; all load | block in the first |
+| context | copilot | `$COPILOT_HOME/copilot-instructions.md` and `instructions/`, then in the git root and the cwd `.github/copilot-instructions.md`, `.github/instructions/`, `AGENTS.md`, `CLAUDE.md`, `GEMINI.md` and `.claude/rules/`; all merge | block in the first |
+| context | gemini | `~/.gemini/GEMINI.md`, then from the cwd up to the git root, then subdirectories (`context.fileName` renames the file); all concatenate | block in the first |
+| context | antigravity | `~/.gemini/AGENTS.md` and `GEMINI.md`, `~/.gemini/config/rules/*.md`, `~/.gemini/antigravity-cli/rules/*.md`, then the workspace's `AGENTS.md`, `GEMINI.md` and `.agents/rules/`, and plugin rules; all combine, more specific rules win a conflict, and over 20,000 tokens the largest files become pointers | block in `~/.gemini/GEMINI.md` |
+| context | goose | `CONTEXT_FILE_NAMES` (default `AGENTS.md`, `.goosehints`) in `~/.config/goose/`, then in the project root and each directory goose reads; all load, and a local hint wins over a global one | block in `~/.config/goose/.goosehints` |
+| context | amp | `AGENTS.md` in the cwd and its parents, subtree files on a read, then `~/.config/amp/AGENTS.md` and `~/.config/AGENTS.md`; all load, and `AMP_IGNORE_GUIDANCE_FILES` skips matching files | block in `~/.config/amp/AGENTS.md` |
 | skills | omp | `skills.customDirectories`, then `.omp/skills` and `~/.omp/agent/skills`, Claude's project dir (user dir opt-in), `.agents/skills` and `~/.agents/skills`; first wins, identical copies collapse, a differing copy is renamed `<namespace>/<name>` | links in `~/.omp/agent/skills` |
 | skills | claude | `.claude/skills`, `~/.claude/skills`; plugin skills are namespaced `tezgah:<name>` | the plugin copy |
 | skills | codex | `.agents/skills` from the cwd up to the repo root, `~/.agents/skills`, `$CODEX_HOME/skills`; one name in two dirs is listed twice, not merged | links in `$CODEX_HOME/skills` |
 | skills | cursor | `.agents/skills`, `.cursor/skills`, `~/.agents/skills`, `~/.cursor/skills`, then Claude's and Codex's project and user dirs; no documented winner | links in `~/.cursor/skills` |
 | skills | opencode | its own skill tool is denied; the router lists `~/.config/opencode/skills`, `~/.claude/skills`, `~/.agents/skills`, first wins (`bin/tezgah-setup::skill_groups`) | links and the router |
+| skills | qwen | `~/.qwen/skills`, `.qwen/skills`, extension and bundled skills; no documented winner | links in `~/.qwen/skills` |
+| skills | droid | `.factory/skills` (project and folder), `~/.factory/skills`, `.agents/skills` and `~/.agents/skills`, plugin and built-in skills; no documented winner | links in `~/.factory/skills`, beside the user's own |
+| skills | commandcode | `.commandcode/skills`, `.agents/skills`, `~/.commandcode/skills`, `~/.agents/skills`, extra locations, bundled; first wins | links in `~/.commandcode/skills` |
+| skills | copilot | `.github/skills`, `.agents/skills`, `.claude/skills`, a parent's `.github/skills`, `$COPILOT_HOME/skills`, `~/.agents/skills`, plugins, `COPILOT_SKILLS_DIRS`, bundled; first wins | links in `$COPILOT_HOME/skills` |
+| skills | gemini | workspace `.agents/skills` and `.gemini/skills`, user `~/.agents/skills` and `~/.gemini/skills`, extension skills, built-in; higher tier wins, `.agents/skills` wins within one | links in the extension's `skills/`, the lowest tier |
+| skills | antigravity | the workspace's `.agents/skills`, `~/.gemini/antigravity-cli/skills`, plugin skills; no documented winner | links in `~/.gemini/antigravity-cli/skills` |
+| skills | goose | `~/.agents/skills`, `.agents/skills`, plugin skills (namespaced `<plugin>:<name>`), then `.goose/skills`, `.claude/skills` and `~/.claude/skills` for backward compatibility; no documented winner | links in the plugin's `skills/`, loaded as `tezgah:<name>` |
+| skills | amp | `~/.config/agents/skills`, `~/.agents/skills`, `~/.config/amp/skills`, `.agents/skills`, `.claude/skills`, `~/.claude/skills`, then plugin and configured paths; first name wins | links in `~/.config/amp/skills` |
 | agents | claude | managed, the `claude --agents` flag, `.claude/agents`, `~/.claude/agents`, plugin agents namespaced `plugin:name`; a dir absent at start is not watched | `~/.claude/agents`, written at install |
 | agents | codex | `$CODEX_HOME/agents`, `/etc/codex/agents`, `.codex/agents` (trusted repos only), read at config load | `$CODEX_HOME/agents`, written at install |
 | agents | cursor | `cursor-agent`: `.cursor/agents`, then `.claude/agents`, `.grok/agents`, plugin agents; first name wins; no user dir; read at process start. The editor's docs add `~/.cursor/agents` and `~/.claude/agents` | `.cursor/agents` per repo at session start, in the CLI's line format (`hooks/tezgah_agents.py::render_md_cursor`) |
@@ -181,7 +351,16 @@ and drops the later ones.
 | hooks | codex, cursor | `hooks.json` array order, then the repo's `.codex/` or `.cursor/hooks.json`; Codex runs a row only once its hash is trusted | own rows after Orca's |
 | hooks | opencode | every `*.js`/`*.ts` in `plugins/` and `plugin/`; `tezgah.js` is linked into both, and its `globalThis.__tezgahPluginLoaded` guard makes the second load return `{}` | the plugin |
 | hooks | omp | `~/.omp/agent/extensions/` first, then `config.yml` `extensions:`, one load per absolute path; per event in that order, and the first `block` ends a tool call | the bridge in `hooks/pre/` |
-| mcp | each | omp: project `.omp/mcp.json`, then `~/.omp/agent/mcp.json`, first name wins; claude: `~/.claude.json`, the repo's `.mcp.json`, the plugin's `.mcp.json`; codex: `$CODEX_HOME/config.toml`; cursor: `~/.cursor/mcp.json`; opencode: `opencode.json` `mcp` | one `tezgah` and one `codegraph` row per host |
+| hooks | qwen | user `settings.json` rows (Orca's and tezgah's), then project `.qwen/settings.json` rows in trusted folders; groups run in parallel unless `sequential` | own rows after Orca's |
+| hooks | droid | org-managed hooks, user `~/.factory/hooks.json`, project `.factory/hooks.json` and enabled plugins' `hooks/hooks.json`, merged with no documented order; a scope's settings.json `hooks` key counts only while its hooks.json is absent | own rows in hooks.json |
+| hooks | commandcode | project `.commandcode/settings.json` rows, then user `~/.commandcode/settings.json` rows; PreToolUse runs them in order and stops at the first deny, the other events run in parallel | own rows in the user settings.json |
+| hooks | copilot | policy files, then the repo's `.github/hooks/*.json`, user `$COPILOT_HOME/hooks/*.json`, the inline `hooks` of the repo's and the user's settings.json (and the repo's `.claude/settings.json`), then plugins; every entry runs, and any PreToolUse deny blocks | own file `hooks/tezgah.json` |
+| hooks | gemini | project `.gemini/settings.json`, user `~/.gemini/settings.json`, system settings, then extensions' `hooks/hooks.json`; `hooksConfig.enabled: false` runs none | own extension `extensions/tezgah/hooks/hooks.json` |
+| hooks | antigravity | workspace `.agents/hooks.json`, global `~/.gemini/config/hooks.json`, then installed plugins' `hooks.json`; each top-level name is a hook set, and `enabled: false` on a name loads none of it | the `tezgah` name in the global hooks.json |
+| hooks | goose | user `~/.agents/plugins/<name>/hooks/hooks.json`, project `.agents/plugins/<name>/hooks/hooks.json` and installed plugins; a name in `disabledPlugins` of `~/.config/goose/settings.json` loads none of it; any PreToolUse block denies | own plugin `~/.agents/plugins/tezgah/hooks/hooks.json` |
+| hooks | amp | plugins: personal and workspace ones from Amp's settings, the project's `.amp/plugins/`, the system `$XDG_CONFIG_HOME/amp/plugins/`; a project plugin wins over a system one of the same name, and every plugin gets every event in no defined order | the system plugin `tezgah.ts` |
+| mcp | each | omp: project `.omp/mcp.json`, then `~/.omp/agent/mcp.json`, first name wins; claude: `~/.claude.json`, the repo's `.mcp.json`, the plugin's `.mcp.json`; codex: `$CODEX_HOME/config.toml`; cursor: `~/.cursor/mcp.json`; opencode: `opencode.json` `mcp`; qwen: `settings.json` `mcpServers`; droid: `~/.factory/mcp.json`; commandcode: `settings.json` `mcp.servers`, `~/.commandcode/mcp.json`, the repo's `.mcp.json`; copilot: `$COPILOT_HOME/mcp-config.json`, the repo's `.mcp.json` and `.github/mcp.json`, project first; gemini: `settings.json` `mcpServers` (user, project) and each extension's `gemini-extension.json`, settings.json first; antigravity: `~/.gemini/config/mcp_config.json`, the workspace's `.agents/mcp_config.json` and plugins, the running server keeps a shared name; goose: the `extensions:` map of `~/.config/goose/config.yaml`; tezgah writes no row for qwen, droid, commandcode, copilot, gemini, antigravity or goose yet | one `tezgah` and one `codegraph` row per host but qwen, droid, commandcode, copilot, gemini, antigravity and goose |
+| mcp | amp | `amp.mcpServers` in `~/.config/amp/settings.json`, then the workspace's `.amp/settings.json`, which wins | none: tezgah writes no MCP row for Amp |
 
 Orca is a launcher, not a host. It starts omp with its own `--extension`. It
 gives each Codex account its own `CODEX_HOME` under
@@ -224,6 +403,14 @@ three harness configurations while swapping the model inside one harness moved i
 | opencode | a selector read from `opencode models` (`hooks/tezgah_models.py:12`) | the AI SDK: `@ai-sdk/openai-compatible` for `/v1/chat/completions`, `@ai-sdk/openai` for `/v1/responses`, beside its own Anthropic and Bedrock providers (opencode's provider docs) | vendor documentation |
 | omp | the session default's family, otherwise `task.agentModelOverrides` and `modelRoles.plan` (`hooks/tezgah_models.py:13-16`) | whichever provider the selected model names - Anthropic Messages, OpenAI Responses, OpenAI chat completions, Google, Bedrock - with text-based dialects where a native tool API is unavailable; the OpenRouter route dispatches to Responses unless `PI_OPENROUTER_RESPONSES=0` (omp's own `provider-compat-reference` documentation) | the tool's own documentation |
 | dsh | the Claude-family scripts through the bridge (`hosts/dsh/hooks.json:2-18`); `README.md:27-28` calls it "DeepSeek's dsh harness" | `unverified`: its own `--help` describes it as "an ordered stack of plugin-bundle patch layers" and names no model API, and its profile directory names a provider (DeepSeek) rather than a wire (checked 2026-10-01) | - |
+| qwen | not named: tezgah writes no Qwen subagent roles | the provider `settings.json` `modelProviders` selects, keyed by auth type - `openai` (OpenAI-compatible), `anthropic`, `gemini`, `vertex-ai` - each with its own `baseUrl` (Qwen Code 0.21.13 `configuration/model-providers.md`) | the tool's own documentation |
+| droid | not named: tezgah writes no Droid subagent roles | `unverified`: tezgah has not mapped Droid's providers to a wire | - |
+| commandcode | not named: tezgah writes no Command Code subagent roles | `unverified`: tezgah has not mapped Command Code's providers to a wire | - |
+| copilot | not named: tezgah writes no Copilot subagent roles | `unverified`: tezgah has not mapped Copilot's providers to a wire | - |
+| gemini | not named: tezgah writes no Gemini subagent roles | `unverified`: tezgah has not mapped Gemini's providers to a wire | - |
+| antigravity | not named: tezgah writes no Antigravity subagent roles | `unverified`: tezgah has not mapped Antigravity's models to a wire | - |
+| goose | not named: tezgah writes no Goose subagent roles | `unverified`: tezgah has not mapped Goose's providers to a wire | - |
+| amp | not named: tezgah writes no Amp subagent roles | `unverified`: tezgah has not mapped Amp's models to a wire | - |
 
 `unverified` is the point of the column rather than a gap in it. A wrong dialect
 here is worse than a blank one: a reader would use it to explain a score, and the
@@ -236,12 +423,13 @@ A skill read is observable only where the host gives a channel that does not cos
 a process per read: Claude parses its transcript (`statusline.py::claude_used`),
 opencode classifies in process (`hosts/opencode/plugins/tezgah.js:2227-2263`),
 omp filters in its embedded runner before it asks python
-(`hosts/omp/tezgah-hook.ts.in:257-264`). On codex, cursor and dsh a read is not
-observable at that price, so their surfaces pass the five tool-use measures as
-`observable` and the two skill marks render dim (`info`, no glyph) instead of
+(`hosts/omp/tezgah-hook.ts.in:257-264`), and Amp's plugin does the same for a
+`Read` of a shipped skill (`hosts/amp/tezgah-plugin.ts.in`). On codex, cursor, qwen, droid, commandcode, copilot, gemini, antigravity, goose and dsh a read is not
+observable at that price. Their surfaces pass the five tool-use measures as
+`observable`, and the two skill marks render dim (`info`, no glyph) instead of
 claiming the skill was never opened (`hooks/tezgah_context.py::TOOL_USE_MEASURES`, and the
 `observable` branch at `hooks/tezgah_context.py::health_segments`). Callers that pass `TOOL_USE_MEASURES`:
-`statusline.py::observable`, `hosts/codex/hook.py::main`,
+`statusline.py::observable`, `hosts/codex/hook.py::main`, `hosts/commandcode/hook.py::status`,
 `hosts/dsh/statusline/lib/index.js:16-19`. A kill switch is observable everywhere
 and still renders `off` (`hooks/tezgah_context.py::health_segments`).
 
@@ -260,11 +448,24 @@ In order, each step verified by the one below it:
    (`hosts/omp/tezgah-hook.ts.in` rendered at `hooks/tezgah_attest.py::omp_bridge`).
 3. `install_<host>()` writing that host's files, registered in `INSTALLERS`
    (`bin/tezgah-setup::INSTALLERS`), and `uninstall_<host>()` removing only
-   tezgah-managed links and blocks (`bin/tezgah-setup:3331-3463`).
+   tezgah-managed links and blocks, registered in `UNINSTALLERS` (`bin/tezgah-setup::UNINSTALLERS`).
 4. `host_checks_<host>()` returning `(label, bool)` rows over what was actually
    written, registered in `HOST_CHECKS` (`bin/tezgah-setup::HOST_CHECKS`); the
    `--report` output is that list (`bin/tezgah-setup::report`). Give the row a home-qualified
    label if the host's dir can be relocated (`host_checks_codex`, `bin/tezgah-setup::host_checks_codex`).
+   The first row is the host's "wired" row (`bin/tezgah-setup::hosts_row`), and a
+   row whose MISS means unarmed names a label `ARMING_ROWS` carries
+   (`bin/tezgah-setup::ARMING_ROWS`).
+   Every other table keyed by host grows with it, or the host crashes or drops
+   out there. `hooks/tezgah_stack.py::host_stack` raises on an unknown host, so
+   `tezgah-doctor --stack` fails. The other tables are
+   `hooks/tezgah_stack.py::tezgah_skill_dirs`, `hooks/tezgah_attest.py::registration`
+   and `CODE_TARGETS`, `bin/tezgah-setup::hook_entries` and
+   `bin/tezgah-setup::live_plan`. Without `live_plan` the live rows read
+   UNVERIFIED. The gate's control plane grows too: `HOOK_ENTRIES`, `HOOK_HOSTS`
+   and the shared files of `hooks/tezgah_gate.py::_registration`. The gate then
+   refuses a forged run of the new hook, and an edit of its registration, as it
+   refuses the others.
 5. Decide the surface: a `statusLine` command, a TUI/widget plugin, or the
    `systemMessage` fallback (`hosts/codex/hook.py:10-12`). Pass `observable` if
    the host cannot see a skill read, and `idx_override` on any redraw that must
@@ -274,7 +475,9 @@ In order, each step verified by the one below it:
    `CodexHome:657-702`, `CursorMatcher:705-722`, `DshStatusline:872-957`), and an
    opt-in script under `tests/e2e_*.py` for the thing only a real host can prove
    - not collected by `unittest discover`, it exits 0 with `SKIP` when the host
-   is absent (`tests/e2e_omp_statusline.py:13-16`).
+   is absent (`tests/e2e_omp_statusline.py:13-16`). A script that calls a model
+   also exits 0 with `SKIP` unless `TEZGAH_E2E_SPEND=1` is set
+   (`tests/e2e_qwen.py`, `tests/e2e_droid.py`).
 
 ## Host-specific limits worth knowing
 
@@ -287,6 +490,26 @@ In order, each step verified by the one below it:
     `gate✗` appears only in the SessionStart/Stop status message.
   - **cursor, dsh:** observed only if their prompt payload carries `transcript_path`
     (unverified on a live host).
+  - **qwen:** unverified. Its prompt payload carries `transcript_path`. The counter
+    reads only the Claude, omp and Codex row shapes (`hooks/tezgah_context.py::_transcript_calls`).
+    No run has captured Qwen's transcript format yet, so a disarmed gate there likely counts 0.
+  - **droid:** unverified on a live host. Its transcript rows carry `message.content`
+    `tool_use` blocks with a `timestamp`, the Claude shape the counter reads, and
+    `GATED_TOOLS` names `Execute`, `Create` and `ApplyPatch`
+    (`hooks/tezgah_context.py::GATED_TOOLS`).
+  - **commandcode:** unavailable: Command Code has no prompt event, so nothing runs the
+    counter there.
+  - **copilot:** unavailable: Copilot drops a command hook's UserPromptSubmit output,
+    so no reminder carries the counter's warning there.
+  - **gemini:** unverified. BeforeAgent carries `transcript_path`, but Gemini's
+    session file is a format the counter does not read
+    (`hooks/tezgah_context.py::_transcript_calls`), so a disarmed gate there likely counts 0.
+  - **antigravity:** unavailable: its `transcript.jsonl` is not a format the counter
+    reads, so the hook does not hand it over. Only a switch armed mid-session shows.
+  - **goose:** unavailable: Goose ignores UserPromptSubmit output, so no reminder
+    carries the counter's warning there.
+  - **amp:** unavailable: the plugin hands the hook no transcript path, so only a
+    switch armed mid-session shows.
   - **omp, opencode:** not applicable: the prompt hook and the gate live in one extension or
     plugin process, so one cannot run without the other.
   - Everywhere: a disarmed PreToolUse beside a working PostToolUse writes rows and is not
@@ -414,7 +637,7 @@ In order, each step verified by the one below it:
   longer. A busy turn with every conditional rule armed measured 10288.
   `fit()` cuts the tail to `CONTEXT_MAX` and marks the cut, so the reminder and
   the first rules arrive (`hosts/cursor/hook.py::fit`, `hosts/cursor/hook.py::CONTEXT_MAX`).
-- **Claude, dsh, omp, codex and cursor run the gate only for the tool names
+- **Claude, dsh, omp, codex, cursor, qwen, droid, commandcode, copilot, gemini, antigravity, goose and amp run the gate only for the tool names
   their matcher carries**, so a name the PostToolUse side carries and the
   PreToolUse side does not is recorded in the ledger and never refused.
   `PowerShell` and `pwsh` are both `BASH_TOOLS` members
@@ -425,14 +648,65 @@ In order, each step verified by the one below it:
   `hosts/cursor/hooks.json:8` - neither named them until 2026-09-19, so a
   PowerShell call on those two reached no hook at all while the shared rules
   already knew the spelling), and omp's `GATED` list
-  (`hosts/omp/tezgah-hook.ts.in:270-273`). A host this list does not cover is a
-  host whose shell the gate cannot see.
+  (`hosts/omp/tezgah-hook.ts.in:270-273`). Qwen Code has two shell tool ids,
+  `run_shell_command` and `monitor`, which `bin/tezgah-setup::QWEN_PRETOOL_MATCHER`
+  names beside `notebook_edit` and `mcp__.*`. Claude's and dsh's `Monitor` runs a
+  shell command too, so their matcher names it. Droid's shell is `Execute`, which `bin/tezgah-setup::DROID_PRETOOL_MATCHER`
+  names beside `Create`, `Edit`, `ApplyPatch`, `Task`, `Grep` and `mcp__.*`. The
+  adapter hands ApplyPatch's `input` to the gate as `patch`
+  (`hosts/droid/hook.py::gate_input`). Command Code's settings hooks see only
+  four tools and test the matcher against their display names (`SHELL`, `READ`,
+  `WRITE`, `EDIT`), so `bin/tezgah-setup::COMMANDCODE_PRETOOL_MATCHER` is
+  `shell|write|edit`. Its read, MCP, subagent and web tools never reach the
+  gate, and plan mode skips every hook. The adapter folds a shell call's `args`
+  into `command` and hands an edit's `old_value`/`new_value` over as
+  `old_string`/`new_string` (`hosts/commandcode/hook.py::gate_input`). Copilot's
+  PascalCase PreToolUse reports Claude tool names and anchors its matcher. So
+  `bin/tezgah-setup::COPILOT_PRETOOL_MATCHER` names `Bash`, `Write`, `Edit`,
+  `Agent`, `Task` and `Grep`, plus `.+-.+` for an MCP tool's `<server>-<tool>`.
+  The adapter maps the runtime spellings too (`bash`, `powershell`, `create`,
+  `edit`, `apply_patch`, `task`, `grep`, `rg`). An Edit that names no file but
+  carries a patch reaches the gate as `apply_patch`. `<server>-<tool>` becomes
+  `mcp__<server>__<tool>` for a server `mcp-config.json` names
+  (`hosts/copilot/hook.py::gate_name`). Gemini's BeforeTool matcher is a regex
+  over the tool name. `bin/tezgah-setup::GEMINI_PRETOOL_MATCHER` names the
+  shell, write, edit and grep tools, the subagent tools
+  (`codebase_investigator`, `generalist`, `invoke_agent`) and `mcp_.*`. A user's own subagents are not
+  named. `mcp_<server>_<tool>` marks no boundary between server and tool, so it
+  reaches the gate as `mcp__<server>_<tool>` (`hosts/gemini/hook.py::gate_name`).
+  Antigravity's matcher is a regex over the tool name, and
+  `bin/tezgah-setup::ANTIGRAVITY_PRETOOL_MATCHER` names `run_command`,
+  `write_to_file`, `replace_file_content`, `multi_replace_file_content`,
+  `invoke_subagent` and `grep_search`. The adapter renames their PascalCase
+  arguments into the gate's fields (`hosts/antigravity/hook.py::gate_input`).
+  `CommandLine` becomes `command`, `TargetFile` and `CodeContent` become
+  `file_path` and `content`. `TargetContent` and `ReplacementContent` become
+  `old_string` and `new_string`, and `ReplacementChunks` becomes `edits`. The
+  docs name no MCP tool spelling, so the matcher names no MCP tool. It names
+  neither `manage_task`'s `send_input` nor `schedule`.
+  Goose tests a matcher unanchored, so `bin/tezgah-setup::GOOSE_PRETOOL_MATCHER`
+  anchors `shell`, `write`, `edit` and `.+__.+`, an extension's
+  `<extension>__<tool>`, which reaches the gate as `mcp__<extension>__<tool>`
+  (`hosts/goose/hook.py::gate_name`). The adapter hands `write`'s and `edit`'s
+  `path` over as `file_path`, and `edit`'s `before`/`after` as
+  `old_string`/`new_string` (`hosts/goose/hook.py::gate_input`). Goose's own
+  `developer`, `analyze`, `summon` and `code_execution` tools other than these
+  three, and its subagent tool, are not named.
+  Amp's plugin sends the gate `Bash`, `shell_command`, `edit_file`,
+  `create_file`, `apply_patch` and `Task` (its `GATED` list) and an MCP effect
+  name. A shell call's text reaches the gate as `command`, from Amp's
+  `shellCommandFromToolCall` helper or the input's `cmd`
+  (`hosts/amp/hook.py::gate_input`). Read, search, web and `code_exec` calls
+  are not gated, and an MCP tool reached through `code_exec` or `tool_search`
+  is never seen.
+  A host this list does not cover is a host whose shell the gate cannot see.
 - **An MCP effect reaches the gate on every host that can route it**. Claude
   and dsh run it through a PreToolUse group of its own in `hooks/hooks.json` and
   `hosts/dsh/hooks.json`. That group stays apart from the literal one, because
   one regex character would end its exact-name dialect. Its pattern names the
   effect verbs of `hooks/tezgah_integrity.py::MCP_VERBS`, and omp's `tool_call`
-  tests the same pattern (`MCP_EFFECT`, `hosts/omp/tezgah-hook.ts.in`). Both
+  tests the same pattern (`MCP_EFFECT`, `hosts/omp/tezgah-hook.ts.in`), as does
+  Amp's `tool.call` (`hosts/amp/tezgah-plugin.ts.in`). Both
   hosts read a matcher as an unanchored JavaScript `RegExp`, and the pattern
   uses no lookahead. A read-only MCP call, such as a code-graph query, spawns no
   hook there. Codex's matcher carries `mcp__.*` (`hosts/codex/hooks.json`).
@@ -465,6 +739,14 @@ In order, each step verified by the one below it:
 - `hosts/dsh/hooks.json`, `hosts/dsh/statusline/lib/index.js`
 - `hosts/omp/hook.py`, `hosts/omp/tezgah-hook.ts.in`
 - `hosts/opencode/plugins/tezgah.js`, `hosts/opencode/tui/tezgah-tui.tsx`
+- `hosts/qwen/hook.py`, `tests/e2e_qwen.py` (the opt-in run of the real binary)
+- `hosts/droid/hook.py`, `tests/e2e_droid.py` (the opt-in run of the real binary)
+- `hosts/commandcode/hook.py`
+- `hosts/copilot/hook.py`
+- `hosts/gemini/hook.py`
+- `hosts/antigravity/hook.py`
+- `hosts/goose/hook.py`
+- `hosts/amp/hook.py`, `hosts/amp/tezgah-plugin.ts.in`
 - `statusline.py`, `bin/tezgah-status`, `hooks/tezgah_context.py`
 - `hooks/tezgah_models.py` - the per-host model surface in `## The model wire`
 - `hooks/tezgah_stack.py`, `bin/tezgah-doctor` `--stack` - the order in `## Precedence`

package/docs/layers.md

@@ -56,7 +56,7 @@ Must not own the user's rules, the evidence of the turn or the refusal. A
 runtime runs what the model asks; nothing inside it stops the model, which is
 the whole reason tezgah exists ([architecture](architecture.md)).
 
-Here the six hosts are the runtimes, one config dir per host
+Here the fourteen hosts (claude, codex, cursor, opencode, dsh, omp, qwen, droid, commandcode, copilot, gemini, antigravity, goose, amp) are the runtimes, one config dir per host
 (`hooks/tezgah_paths.py::HOST_DIRS`) with one presence test (`host_installed`
 `hooks/tezgah_paths.py::host_installed`), and the adapter under `hosts/<name>/` holds the
 host's envelope and nothing else ([hosts](hosts.md)). The README's own intro

package/docs/models.md

@@ -40,6 +40,12 @@ field or judgement, and only a second miss restarts the task on `tezgah-frontier
 with the original brief rather than handing the failed trajectory up: continuing a
 cheap trajectory on a frontier model was the most expensive option measured
 (arXiv 2608.24358, Table 1: 1.61 cost units against 0.72 for frontier-only).
+A question only the owner can answer climbs past every tier, frontier included.
+It is choosing a variant or option a research, analysis or review recommends, a
+way around a tezgah refusal, or deciding about another session's work. The
+worker answers `ESCALATE: owner` with the options and a recommended default
+(`hooks/tezgah_agents.py::OWNER_ESCALATE`). The orchestrator puts it to the
+user in the approval batch and does not re-brief it.
 
 ## The table (snapshot 2026-09-30)
 

package/docs/operations.md

@@ -19,8 +19,8 @@ before an install is considered.
 | `--install` | Arm the `--hosts` (default: every detected host): writes `~/.config/tezgah/config.json`, the contract hash, the `~/.config/tezgah/bin` symlinks and every host file, then prints the report. Installs the missing optional tools first unless `--no-deps`; third-party host CLIs (cursor-agent, pnpm, dsh) only with `--host-deps`, otherwise their exact install command is printed. Exits 1 when a requested tool is still missing, naming the cause (`installer failed with exit N`, or `exited 0 but not on PATH`) (`bin/tezgah-setup::main`, `bin/tezgah-setup::install_all`, `bin/tezgah-setup::install_deps`). It also exits 1 when a planned host is left unarmed, and names it under `not armed:`. Only the arming rows count: hooks wired, the contract current, and the row a host's own CLI arms where that CLI exists: omp's extension row with an omp CLI, Claude's `plugin copy current` with a `claude` CLI. Codex `hooks trusted` and the provider-key rows stay out, because a correct fresh install leaves them MISS (`ARMING_ROWS`, `arming_miss()`). A host config that does not parse as a JSON object is refused: the run names the file and the parse error, never writes it, and exits 1 (`read_config()`); tezgah's own `config.json` is refused the same way. Claude is registered through its own CLI (`register_claude_plugin()`): the run renders `.claude-plugin/{plugin,marketplace}.json` from the release version into the tree it runs from (untracked; a pair under another marketplace name is kept), runs `claude plugin marketplace add <tree>` (a directory source pinned to that tree) and `claude plugin install tezgah@tezgah-local`, and skips both when any `tezgah@*` row is already in `installed_plugins.json`, because a second row fires every hook twice. `--reply-lang tr|en|any` stores `reply_lang` in `config.json`; without it the stored value stays, and a config with none reads as `tr`. |
 | `--wizard` | Ask the install questions and write only after the final yes; the other flags supply the defaults, so `--wizard --hosts omp` asks only the rest (`bin/tezgah-setup::wizard`). |
 | `--report` | Print what is armed, per host, and stop (`bin/tezgah-setup::main`, `bin/tezgah-setup::report`). |
-| `--report --live` | Proves the hooks run, not only that they are written (audit Phase 1.2). For each host, one synthetic PostToolUse (`true`) goes through that host's own wiring: the command in `~/.codex/hooks.json`, `~/.cursor/hooks.json`, the enabled Claude plugin copy's `hooks/hooks.json` (with `CLAUDE_PLUGIN_ROOT`), the hooks.json named by dsh's `cordis.patch.yml`; the opencode plugin is imported with node the way opencode imports it; the omp extension `.ts` is loaded with node `--experimental-strip-types` after checking it is in omp's `extensions` list. A ledger row for a dedicated `tezgah-live-<pid>-<ms>` session must appear; the event runs against a throwaway root (`TEZGAH_ROOTS`) and every cache file named for that session is deleted afterwards. A second probe per host proves the gate: one PreToolUse for `git commit --no-verify -m x` through the same wiring must come back as that host's deny (Claude, Codex and dsh `permissionDecision: deny`, Cursor `permission: deny`, omp `block: true`, opencode a throw) and leave a `deny` row in the ledger; under `pretooluse-off` or `verify-off` it reads UNVERIFIED and names the switch (`live_probe()`, `LIVE_DENY_COMMAND`). The omp bridge must also match a fresh render byte for byte, from the renderer the install writes with (`omp_bridge()`). Rows read `ok live <host>` / `ok live <host> deny`, `MISS live <host>: <cause>` (no tezgah command in the host file, the command wrote no row, no deny envelope or no deny row, a hand-edited omp bridge, Codex does not trust tezgah's group) or `UNVERIFIED live <host>: <why>` (node missing or older than 22.6, the omp CLI did not answer, a switch that stands the refusal down). It exits 1 when any host is MISS; UNVERIFIED never fails the run and is never shown as ok. No model is called. |
-| `--refresh` | Re-render every always-on contract artifact of the armed hosts - the managed blocks of `CLAUDE.md`, Codex's `AGENTS.md` and omp's `RULES.md`, opencode's contract and skill routers - after a policy edit or a kill switch; prints the paths it refreshed, else `contract is current`. Before the first install there is no hash record, so it changes nothing (`refresh_contract`, `bin/tezgah-setup::refresh_contract`). |
+| `--report --live` | Proves the hooks run, not only that they are written (audit Phase 1.2). For each host, one synthetic PostToolUse (`true`) goes through that host's own wiring: the command in `~/.codex/hooks.json`, `~/.cursor/hooks.json`, `~/.qwen/settings.json` (a `run_shell_command` payload), `~/.factory/hooks.json` (an `Execute` payload), `~/.commandcode/settings.json` (a `shell_command` payload), `$COPILOT_HOME/hooks/tezgah.json` (a `Bash` payload), `~/.gemini/extensions/tezgah/hooks/hooks.json` (a `run_shell_command` payload), the `tezgah` name of `~/.gemini/config/hooks.json` (a camelCase `run_command` payload, the event on the command line), `~/.agents/plugins/tezgah/hooks/hooks.json` (a `shell` payload, the event in `event`), the enabled Claude plugin copy's `hooks/hooks.json` (with `CLAUDE_PLUGIN_ROOT`), the hooks.json named by dsh's `cordis.patch.yml`; the opencode plugin is imported with node the way opencode imports it; the omp extension `.ts` is loaded with node `--experimental-strip-types` after checking it is in omp's `extensions` list; Amp's plugin `tezgah.ts` is loaded the same way and fed Amp's own `tool.call`/`tool.result` events (a `Bash` call carrying `cmd`). A ledger row for a dedicated `tezgah-live-<pid>-<ms>` session must appear; the event runs against a throwaway root (`TEZGAH_ROOTS`) and every cache file named for that session is deleted afterwards. A second probe per host proves the gate: one PreToolUse for `git commit --no-verify -m x` through the same wiring must come back as that host's deny (Claude, Codex, dsh, Qwen, Droid and Command Code `permissionDecision: deny` under `hookSpecificOutput`, Copilot the same at the top level, Gemini and Antigravity a top-level `decision: deny`, Goose a top-level `decision: block`, Cursor `permission: deny`, omp `block: true`, Amp `action: reject-and-continue`, opencode a throw) and leave a `deny` row in the ledger; under `pretooluse-off` or `verify-off` it reads UNVERIFIED and names the switch (`live_probe()`, `LIVE_DENY_COMMAND`). The omp bridge and the Amp plugin must also match a fresh render byte for byte, from the renderer the install writes with (`omp_bridge()`, `hooks/tezgah_attest.py::amp_plugin`). Rows read `ok live <host>` / `ok live <host> deny`, `MISS live <host>: <cause>` (no tezgah command in the host file, the command wrote no row, no deny envelope or no deny row, a hand-edited omp bridge or Amp plugin, Codex does not trust tezgah's group) or `UNVERIFIED live <host>: <why>` (node missing or older than 22.6, the omp CLI did not answer, a switch that stands the refusal down, and always for Amp, whose own Bun loader is not what ran the plugin). It exits 1 when any host is MISS; UNVERIFIED never fails the run and is never shown as ok. No model is called, so the probe proves the hook command, not that the host binary obeys it: for Qwen that is `TEZGAH_E2E_SPEND=1 python3 tests/e2e_qwen.py` and for Droid `TEZGAH_E2E_SPEND=1 python3 tests/e2e_droid.py`, each spending a model call; Command Code, Copilot, Gemini, Antigravity, Goose and Amp have no such script yet, so their obedience is unverified. |
+| `--refresh` | Re-render every always-on contract artifact of the armed hosts - the managed blocks of `CLAUDE.md`, Codex's `AGENTS.md`, omp's `RULES.md`, Qwen's `QWEN.md`, Droid's, Command Code's and Amp's `AGENTS.md`, Copilot's `copilot-instructions.md`, the `GEMINI.md` Gemini and Antigravity share, Goose's `.goosehints`, opencode's contract and skill routers - after a policy edit or a kill switch; prints the paths it refreshed, else `contract is current`. Before the first install there is no hash record, so it changes nothing (`refresh_contract`, `bin/tezgah-setup::refresh_contract`). |
 | `--uninstall` | Remove everything tezgah installed — per host the wiring it wrote, plus (a full run) the Claude plugin copy with its registry rows, the generated config state, the kill switches, the caches and the versioned install tree — then verify the removal; nonzero exit while anything tezgah wrote survives (`bin/tezgah-setup::verify_uninstall`, `bin/tezgah-setup::uninstall`). |
 | `--adopt` | Move pre-tezgah wiring aside instead of deleting it; alone it stops there, with `--install` it runs first (`bin/tezgah-setup::main`, `bin/tezgah-setup::adopt`). |
 | `--sync` | Copy this checkout over the Claude plugin [copy](glossary.md#plugin-copy) `installed_plugins.json` names, or over every copy when it names none (`bin/tezgah-setup::sync`, `bin/tezgah-setup::live_plugin_copies`). An older version dir is Claude's cache to collect, so it is left alone. Each copy is built in a staging tree beside the plugin cache and swapped in with two renames, its `.git` carried over, so a failed or killed sync leaves the previous copy whole (`bin/tezgah-setup::_swap`). Every copied file is 0644, or 0755 when the tree marks it executable, whatever mode the source has (`bin/tezgah-setup::_copy_normalised`). |
@@ -41,7 +41,7 @@ before an install is considered.
 | `update` | `tezgah update [--dry-run]` moves this install to the newest release through the channel it came from, then re-arms the hosts from the new tree. A release prefix goes through `--upgrade`. A Homebrew keg runs `brew upgrade r1z4x/tezgah/tezgah`, an npm tree runs `npm install -g @r1z4x/tezgah@latest`, and a git checkout runs `git pull --ff-only` (`update()`, `hooks/tezgah_update.py`). Before re-arming it prints every tezgah hook entry the new tree adds, removes or changes, per host. Paths compare with the tree root taken out, so a move to the new release's own path is no change. A real change on a terminal waits for a yes; Enter is no. A piped run goes on without asking (decision 12; `hooks/tezgah_update.py::confirm_rearm`). A no exits 1 after the fetch and says what it left. A checkout or an npm package is replaced in place, and the prefix's `current` already points at the new tree, so there the hooks run the new code and only the changed entries wait. A Homebrew keg is new beside the old one, so hooks wired to the old keg's path run the old code until the re-arm (`NOT_REARMED`, `hooks/tezgah_update.py::NOT_REARMED`). |
 | `--version` | Print the plugin version and exit (`bin/tezgah-setup::main`, `hooks/tezgah_context.py::version`). |
 | `--roots R` | Set the roots for this install, `os.pathsep`-separated. Without `--install` it exits 1: `--roots only means something with --install` (`bin/tezgah-setup::main`). |
-| `--hosts H` | Comma-separated subset of `claude,codex,opencode,cursor,dsh,omp`; an unknown name exits 1 before anything is written, and naming hosts switches off the re-detection that follows a tool install (`bin/tezgah-setup::main`, `bin/tezgah-setup::install_all`). `--install --hosts X` adds X to the hosts recorded in `config.json` and keeps the others. |
+| `--hosts H` | Comma-separated subset of `claude,codex,opencode,cursor,dsh,omp,qwen,droid,commandcode,copilot,gemini,antigravity,goose,amp`; an unknown name exits 1 before anything is written, and naming hosts switches off the re-detection that follows a tool install (`bin/tezgah-setup::main`, `bin/tezgah-setup::install_all`). `--install --hosts X` adds X to the hosts recorded in `config.json` and keeps the others. |
 | `-h`, `--help` | Usage and the list above (`bin/tezgah-setup::main`). |
 
 A green `--report` says the wiring is on disk; `--report --live` says it ran. What it cannot cover is the host binary itself: it runs the command the host would run, not the host, so a host that refuses to load its own config (a Claude plugin disabled in the UI after the check, a dsh build whose bridge drops the event) still needs a real session to show.
@@ -186,7 +186,7 @@ too, from the same `hosts_row`, so the mismatch reaches the surface a session
 checks its own health with. Two places deliberately do not: the status line's
 marks are the armed/used checklist and are redrawn by a fresh process on every
 host (omp re-renders per tool result), while "wired" is `HOST_CHECKS`, the
-installer's own reading of six host files — a second reading of it in `hooks/`
+installer's own reading of eight host files — a second reading of it in `hooks/`
 would be the drift `AGENTS.md` names as the report's source of truth; and
 `bin/tezgah-doctor` accounts for the bytes the hosts' stores hold and never reads
 a host's config, so a wiring row there would belong to a different tool.
@@ -233,7 +233,7 @@ After a change to the contract text (`hooks/tezgah_policy.py`,
 - `--install` re-renders every host file, the opencode contract and the skill
   router, and rewrites `~/.config/tezgah/contract.sha256`, which holds one
   `<sha>  <path>` line per rendered artifact - the managed blocks of
-  `CLAUDE.md`, `AGENTS.md` and `RULES.md`, `opencode-contract.md` and the
+  `CLAUDE.md`, Codex's, Droid's, Command Code's and Amp's `AGENTS.md`, `RULES.md`, `QWEN.md`, `copilot-instructions.md`, `GEMINI.md` and `.goosehints`, `opencode-contract.md` and the
   `opencode-skills*.md` routers - rather than one hash over the sources
   (`bin/tezgah-setup::record_shas`, `bin/tezgah-setup::contract_artifacts`).
 - `--refresh` does that without a reinstall, for every armed host's static
@@ -687,6 +687,13 @@ The reviewer brief carries the matching rule
 accounts for every listed file as reviewed or skipped with a reason. It still
 applies the rest of its brief.
 
+The reviewer also has a plan-readiness mode for a plan file instead of a diff
+(`hooks/tezgah_agents.py::_reviewer_body`). It restates each section's intent in
+one sentence. A section it cannot restate is a major finding. A build choice the
+plan leaves to the implementer is a major finding too. A file the plan will
+create is not a missing reference. `skills/plan-add/SKILL.md` runs this review
+once before the `implementation` phase.
+
 `tezgah-review-quote --from BASE [--to HEAD] FINDINGS.json` places each finding by
 its quoted code (`bin/tezgah-review-quote::main`). Each finding needs `path` and
 `quote`, and may carry the `start_line` it cites. The tool adds a `status`.
@@ -849,6 +856,10 @@ that was active when it opened, and only that plan's records count. A record
 with no plan counts when it changed after the plan's checkpoint commit. A
 `resumed` record hands the guard to its re-dispatch's own record
 (`bin/tezgah-task::unfinished_review`).
+`tezgah-task review` also refuses an approve with no record of that reviewer for the plan. A
+reviewer with no status did not run. A host that keeps no slice journal passes
+`--no-slice "<why>"`, and the plan's `review:` line keeps that reason
+(`bin/tezgah-task::cmd_review`). A `changes` verdict needs no record.
 The lever map is a closed set. `rate_limit` and `quota` point at the
 `hooks/tezgah_models.py` fallback chain. `cut_off` and `timeout` point at a
 per-slice deadline, `aborted` at the `wip:` commit cadence, a duplicate job at