@r1z4x/tezgah 1.11.0 → 1.14.0

package/CHANGELOG.md

@@ -6,6 +6,504 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [1.14.0] - 2026-11-01
+
+### Fixed
+
+- **The gate reads hook skips behind wrappers (plan 147).** It refuses a hook
+  skip behind a wrapper with arguments (`nice -n 5`, `timeout 60`). That covers
+  long value options, option clusters and `env -S`. It also refuses one inside
+  `eval`, `eval --` or `builtin eval`. One wrapper reader serves three rules:
+  shortcut, control and `VERIFY`. So a wrapped check meets the neuter and piped
+  refusals. A check piped into `rg`, `awk`, `sort`, `cat`, `less`, `sed` or
+  `tee` meets a refusal too. A trap other than plain cleanup on exit records
+  the check as ran, never as passed.
+
+- **The gate closes control-plane, credit, language and credential bypasses
+  (plan 148).** Git config hooks settings meet a refusal: `core.hooksPath`,
+  `include.path`, `includeIf` and worktree config. The gate reads them in a
+  file, in `git config`, in `--file` and in `-c`. It refuses credits through `--trailer`, a git
+  path or `bash -c`. It refuses non-English names from `git worktree add -b`,
+  `git branch -m`, `gh -t`, `git tag` and push refspecs. It refuses credential
+  files staged by `git stage`, `git commit <path>` or `update-index --add`. It
+  refuses `ditto`, `mkfifo` and `${VAR:-…}` into the control plane. It refuses
+  MCP writes, moves and deletes into protected paths. It refuses a write racing
+  another session's in-flight write.
+
+- **opencode sends shell writes to the core gate first (plan 149).** Every shell
+  write, swallowed check and hook-skipping line goes to the core gate. It gets
+  the core control, credential, workspace and shortcut refusals verbatim. A
+  refusal the plugin decides itself writes the `began` row the core writes.
+  `TEZGAH_HOME` is no longer exported.
+
+- **The Stop rule reads more claim shapes (plan 150).** An empty Claude Bash
+  result is no pass. English past-tense and bare test claims and "not
+  tested/checked" admissions read like their Turkish twins. Prose-only and
+  benchmark claim reads honour the question and negation window. A plan claim
+  records as a claim. A subagent brief authorizes no switch.
+
+- **Uninstall restores what the install found (plans 151, 152, 154).** Every
+  key and file goes back to its pre-install state. That covers your statusLine,
+  opencode compaction, omp codegraph row and `{}` settings files. It covers the
+  no-attribution values of Copilot, Command Code, Amp and Droid, and JSON
+  indent. It removes the directories tezgah created. It counts only tezgah's
+  own markers as leftovers. A partial uninstall keeps the farm the still-armed
+  hosts run from. A HOME behind a symlink no longer leaves
+  `~/.codex/bin/consult`.
+
+- **Install names a host file it cannot read (plan 152).** Such a host rules or
+  settings file makes install exit 1. It no longer overwrites that file or
+  crashes. Install skips a commented host settings file with exit 0 and names it.
+
+- **omp gates MCP device writes and `ast_edit` (plan 153).** An MCP device write
+  (`xd://mcp__…`) and `ast_edit` reach the gate as the calls they carry. The
+  device write itself meets the gate too. A glob or directory edit target takes the
+  control state it reaches. An MCP query records as external, not an edit.
+
+- **`--uninstall` fails while anything tezgah wrote survives (plan 154).** It
+  exits 1 in that case. The farm carries `tezgah-optimize` and `tezgah-taste`.
+  Install refuses abbreviated flags. Piped `--upgrade` output reads in order.
+  Install names an unwritable HOME instead of printing a traceback. It refuses
+  Python below 3.10 early and names the version found.
+
+- **The npm package and the READMEs match what ships (plan 156).** The package
+  ships NOTICE and the open-code-review prompts and no `__pycache__`. Every
+  vendored skill tree carries its upstream LICENSE. package.json and all five
+  READMEs name the fourteen hosts and the 17 refusal rules plus the nudge. They
+  also name the 17 rule switches and the current state of the Turkish claim
+  reader.
+
+- **Farm CLIs answer help (plan 158).** They answer `-h/--help` with exit 0 and
+  refuse unknown flags. The `consult` CLI no longer sends a mistyped flag to the
+  panel. `tezgah-research check --json` prints pure JSON. `tezgah-status
+  --observable=` refuses an unknown measure.
+
+- **Build and upgrade scripts fail clearly (plan 159).** `build.sh` without
+  `--version` names the artifact after the newest release heading instead of
+  `Unreleased`. `upgrade.sh` stops early with a clear message when `curl` or
+  `tar` is missing. The Windows CI leg checks that `install.ps1` refuses a
+  tampered artifact.
+
+- **The graph-map workflow names a failed agent (plan 160).** A failed survey,
+  module reader, synthesize or gap-check agent lands in an `unknown` list. It is
+  no longer reported as an empty, clean result.
+
+- **Subagents read the parent's switches (plan 165).** A subagent latches kill
+  switches on its parent's first ledger row when that came first. Every adapter
+  takes the parent from the host, the omp and Amp bridges and the opencode
+  plugin included. A switch the parent made mid-session no longer disarms rules
+  in subagents it spawns later.
+
+- **The design chain reaches real UI work (plan 144).** `uygulamayı redesign et`
+  arms the design rule, and the frozen arming corpus stays the same. A
+  route-file write (`src/app/dashboard/page.tsx`, `src/routes/+page.svelte`)
+  owes the design check. `tezgah-design derive` reads a nested Tailwind palette
+  (`brand: {50..900}`) and every config in a monorepo, not only the first.
+
+- **The citation ratchet holds in every checkout (plan 168).** `bin/tezgah-docs
+  --citations` never judges a path under the private `.tezgah/`. The unjudged
+  ratchet now holds the same in CI, worktrees and the main checkout.
+
+### Added
+
+- **`derive` reads JS/TS theme modules (plan 145).** A repository whose only
+  token source is a module such as `src/config/theme.ts` now derives a contract.
+  It carries `source: theme-module` with its colours, spacing unit and type
+  scale. `read_text` opens each path component with `O_NOFOLLOW` under the
+  repository root. It refuses a parent swapped for a symlink.
+
+- **`derive --suggest` prints a candidate component inventory (plan 146).** It
+  lists `{name, kind}` candidates read off component files and writes nothing.
+  It skips tests, stories and names already in the contract. It guesses `kind`
+  only from the name and exits 2 when there is no candidate. A person adds the
+  ones the repository owns.
+
+- **`tezgah-docs --citations` judges more citation shapes (plan 166).** It
+  judges bare `(N-M)` and `:N-M` ranges after a cited path, and JS/TS top-level
+  symbols. It flags ranges past a file end. Stale opencode plugin citations are
+  re-anchored by symbol.
+
+### Changed
+
+- **Two sessions meet on their first write of one file (plan 171).** The race
+  rule counts another session's unanswered write for 60 seconds. After that it
+  counts only if that host answers its writes. A refused prompt holds the file
+  about a minute.
+
+- **The gate parses a command once per call (plan 169).** Its readers share
+  one parse of a command's heredocs and shell commands. Median gate latency is
+  back at the 1.13.0 figure.
+
+- **Docs match the code again (plan 161).** The hosts, operations, skills,
+  research and testing pages document the tezgah-mcp tools and tezgah-decisions.
+  They list the omp events and the opencode `event` hook. They state that
+  `--install --dry-run` writes. Live probes no longer read as host obedience.
+  Drifted citations now name their symbol. tests/test_docs_reach.py keeps them
+  in step.
+
+- **Ledger rows carry their version (plan 162).** Snapshot and rollback rows now
+  carry the row version `v`. The evidence page (`docs/evidence.md`) lists every
+  ledger kind, all optional fields and every `subagent_end` writer. It also
+  lists the exact prose-exemption names, and a new test checks it.
+
+- **docs/contract.md and docs/environment.md match the code (plan 157).** They
+  cover the switch table, every environment variable read, budgets, DROP_ORDER
+  and the label-anchored composition order. The core and the reminder name the
+  kill-switch directory from XDG_CONFIG_HOME. The Ponytail Off line names its
+  switches. The suite never runs a real gh on upgrade.
+
+- **Status-line marks and docs are complete (plan 163).** `python3
+  bin/tezgah-docs` and `python3 bin/tezgah-research` earn the judge and research
+  marks. The legend and docs name every host that cannot observe skill reads.
+  docs/status-line.md documents the extension `{"segments": [...]}` output and
+  an unknown `--observable` measure exiting 2. `/tezgah:adhd` states `on` as the
+  default.
+
+- **`reminder-off` drops only the per-turn reminder line (plan 164).** Armed
+  rules, the gate-inactive notice and the off-note stay. Kill-switch off-notes
+  also name the matching section of the `tezgah` output style.
+
+- **The impacted test map covers docs pages (plan 167).** tests/impacted.py runs
+  tests/test_docs_reach.py for docs/ page changes. It maps the omp status-line
+  e2e by the generic helper rule. The research seal test parses `check --json`
+  stdout as pure JSON.
+
+- **Neuter rows for the audit guards (plan 155).** The neuter matrix gains 59
+  rows. Each guard the audit fixes added has one, with a behavioural killer.
+  It writes its killer cache only with `--update-killers`.
+  It answers `--help`. It runs on a push touching any mutated file. Gate vectors
+  cover every refusal rule: stateless ones by vector, stateful ones by named
+  tests.
+
+## [1.13.0] - 2026-10-29
+
+### Fixed
+
+- **omp handed the Stop rule a message object, not the reply (plan 143).**
+  omp's `session_stop` carries `last_assistant_message` as the object its
+  `getLastAssistantMessage()` returns. The bridge passed it through, so the
+  rule judged `str(dict)`: one line, no list items, diluted prose.
+  - Every line-shaped class read a text with no lines: the list cap, the
+    residual sections, the question the reply ends on, the handed step. The
+    language check read a share that was not the reply's.
+  - Measured on the owner's evidence database: 1643 of 1656 omp `shape` rows
+    of 45 days carried `lines: 1`. Every other host wrote 209 multi-line of
+    231. Of three days' refusals, 24 were `reply language` over such a row.
+  - `stop_reason` reads every reply through `reply_prose` now, so no host can
+    repeat it. The omp bridge sends the text blocks.
+
+### Added
+
+- **The Stop rule knows the host's plan mode (plan 142).** Every Stop adapter
+  passes the host's `permission_mode` to the core now. omp's extension sends
+  `plan` from `ctx.sessionModes.getState()`. `plan` and Droid's `spec` are the
+  read-only ones.
+  - In such a turn the rule lets the approval question through. It used to
+    refuse it as a `needless ask` - the one question that mode allows.
+  - A first-person claim that a command or check ran, made in such a turn, is
+    the new `plan claim` class. Nothing could run, so the claim says what
+    cannot have happened. A check that passed anyway clears it, and a plan's
+    own acceptance line ("Done when all tests pass") is no claim.
+  - The new `handed step` class refuses a reply that tells the reader to run a
+    command. It asks only of a turn that ran commands of its own, outside plan
+    mode. An outward step, one no default may take, the owner's consent,
+    tezgah's own install and a `brew` step stay the user's. So does a line that
+    types its blocker, and an answer about how a command is run.
+  - Measured on the owner's transcripts: of 3307 user turns, 27 replies handed
+    back a command and no class refused any of them. The shipped shapes refuse
+    9 turns, 8 of them a step the session could have taken.
+
+## [1.12.0] - 2026-10-29
+
+### Added
+
+- **Amp is a host (`amp`, plan 140).** `tezgah-setup --install --hosts amp`
+  writes one TypeScript plugin, `tezgah.ts`, into Amp's system plugin dir.
+  That dir is `$XDG_CONFIG_HOME/amp/plugins/`, else `~/.config/amp/plugins/`.
+  The install renders it from `hosts/amp/tezgah-plugin.ts.in`. Amp loads every
+  `.ts` there, and a running Amp needs `plugins: reload`. The install links the
+  skills into `~/.config/amp/skills` and writes the always-on block into
+  `~/.config/amp/AGENTS.md`. It sets Amp's two commit trailers
+  (`amp.git.commit.coauthor.enabled`, `amp.git.commit.ampThread.enabled`) to
+  false in `settings.json` unless the user set them. It writes that file only
+  while it is plain JSON with no `settings.jsonc` beside it. The uninstall
+  removes the plugin only when it is tezgah's render. It drops a trailer key
+  only while that key is still false.
+  - The plugin spawns `hosts/amp/hook.py` without blocking. One plugin process
+    serves many threads, so it keys its state by thread id. A dead, slow or
+    crashing hook allows every call, and the plugin tells each thread once.
+  - `tool.call` refuses with `{action: "reject-and-continue"}`. It asks the gate
+    for `Bash`, `shell_command`, the edit tools, `Task` and MCP effect names. A
+    shell call's text reaches the gate as `command`, also when Amp sends `cmd`.
+  - A tool result counts as passed only with an integer `exitCode` on its
+    output object. `error` and `cancelled` are failures. A bare `done` shell
+    result is a run, never a pass.
+  - `agent.end` judges a `done` turn and continues it with `[tezgah:stop]
+    <reason>`. The plugin never sends that prompt as the user's. So it writes no
+    turn row, grants nothing and cannot reset the re-ask budget. A thread with
+    a parent thread is a subagent. It gets the subagent brief, and its end is a
+    record-only row.
+  - The session brief rides the thread's first `agent.start`. The status line
+    goes on Amp's experimental status item for the active thread.
+  - `--report` has Amp rows. `--report --live` loads the plugin with node and
+    drives its `tool.call` and `tool.result`. The row stays UNVERIFIED, since
+    Amp's own loader did not run it. `tezgah-doctor --stack` reads Amp's
+    guidance files, skills, plugins and `amp.mcpServers`. `read_web_page` is a
+    web channel for the untrusted label. README and docs name all fourteen
+    hosts.
+- **Goose is a host (`goose`, plan 139 slice 5).** `tezgah-setup --install
+  --hosts goose` writes tezgah's own plugin dir, `~/.agents/plugins/tezgah/`.
+  It holds `plugin.json`, `hooks/hooks.json` and `skills/` links, and it is
+  wholly tezgah's. Goose loads the skills as `tezgah:<skill>`. The timeouts are in seconds: Stop 30, the
+  rest 5. `on_failure` stays at Goose's default `allow`, so the gate fails open
+  on a hook fault. The always-on block goes in `~/.config/goose/.goosehints`.
+  Goose adds no co-author trailer and names no setting for one, so there is
+  nothing to turn off. The uninstall deletes the plugin dir and the block and
+  leaves the rest of `~/.agents` alone.
+  - `hosts/goose/hook.py` handles SessionStart (attestation only),
+    UserPromptSubmit (the turn row only), PreToolUse, PostToolUse,
+    PostToolUseFailure and Stop. The event is the payload's `event`, the cwd its
+    `working_dir`, else the hook's own. `shell`, `write` and `edit` map to Bash,
+    Write and Edit, with `path` as `file_path` and `before`/`after` as
+    `old_string`/`new_string`. `<extension>__<tool>` becomes
+    `mcp__<extension>__<tool>`.
+  - PreToolUse and Stop block with `{"decision": "block", "reason": ...}` on
+    stdout. The outcome is the event: PostToolUse is a pass, PostToolUseFailure
+    a failure. Stop judges `last_assistant_message`, or writes a
+    `reply_unread` row. With no host block count, the turn rows bound the
+    re-asks.
+  - `--report` has Goose rows, including one for `disabledPlugins`. `--report
+    --live` probes the hook command with Goose's payload and block shape.
+    `tezgah-doctor --stack` reads Goose's hints, skills, plugins and the
+    `extensions:` map of `config.yaml`. No run has shown the binary obeying the
+    block. README and docs/layers.md now name all thirteen hosts.
+- **Antigravity CLI is a host (`antigravity`, plan 139 slice 4).**
+  `tezgah-setup --install --hosts antigravity` writes tezgah's hook set under
+  the `tezgah` name of `~/.gemini/config/hooks.json`. The user's other names
+  stay. The Antigravity App and IDE load that file too. The timeouts are in
+  seconds: Stop 30, the rest 5. The status line goes in
+  `~/.gemini/antigravity-cli/settings.json` while it is plain JSON, and the skill
+  links go in `antigravity-cli/skills`. Antigravity adds no co-author
+  trailer of its own, so there is nothing to turn off. The always-on block is
+  the `~/.gemini/GEMINI.md` one Gemini CLI shares. An uninstall now keeps it only
+  while another armed host reads the same file, so with `GEMINI_CLI_HOME` set
+  the two blocks come and go apart.
+  - `hosts/antigravity/hook.py` handles SessionStart, PreInvocation,
+    PreToolUse, PostToolUse and Stop. The payload names no event, so each
+    command passes it as its first argument. `conversationId` is the session
+    and `workspacePaths[0]` the cwd. The adapter renames the PascalCase tool
+    arguments into the gate's fields: `CommandLine`, `TargetFile`, `CodeContent`,
+    `TargetContent`/`ReplacementContent` and `ReplacementChunks`.
+  - PreToolUse denies with a top-level `decision: deny`. An allowed call
+    answers `decision: allow`, since Antigravity requires the field. PostToolUse reads
+    the outcome off `error`: empty is a pass, anything else a failure. The first
+    invocation of a turn writes the turn row and carries the reminder as an
+    `ephemeralMessage`. A loop that a refusal re-entered writes no turn row, so
+    the refusal budget holds.
+  - Stop reads the reply from `transcriptPath`, or writes a `reply_unread` row.
+    It judges only an idle `model_stop`, and `decision: continue` sends the
+    model back into the loop with the reason.
+  - `--report` has Antigravity rows, including one for `enabled: false` on the
+    `tezgah` name. `--report --live` probes the hook command with Antigravity's
+    camelCase payload and deny shape. No run has shown the binary obeying the
+    deny.
+- **Gemini CLI is a host (`gemini`, plan 139 slice 3).** `tezgah-setup
+  --install --hosts gemini` writes tezgah's own extension dir,
+  `~/.gemini/extensions/tezgah/`. It holds `gemini-extension.json`,
+  `hooks/hooks.json` and links to the skills.
+  `GEMINI_CLI_HOME` moves `~/.gemini` under it. The timeouts are in
+  milliseconds: AfterAgent 30000, the rest 5000. settings.json is never
+  written, since it is JSON with comments and holds the user's keys. Gemini's
+  default prompt adds no co-author trailer and no setting names one. The
+  always-on block goes in `~/.gemini/GEMINI.md`, which Antigravity reads too.
+  `--uninstall` deletes the extension dir and strips the block only while no
+  other host that reads it stays armed.
+  - `hosts/gemini/hook.py` handles SessionStart, BeforeAgent, BeforeTool,
+    AfterTool and AfterAgent. BeforeAgent writes the turn row and carries the
+    per-turn reminder. BeforeTool maps `run_shell_command`, `write_file`,
+    `replace`, the grep tools and the subagent tools into the gate's names, and
+    `mcp_<server>_<tool>` into `mcp__<server>_<tool>`. It denies with a
+    top-level `decision: deny` on exit 0.
+  - AfterTool reads the outcome off `tool_response`: an `error` is a failure,
+    and a shell result's `Exit Code: N` names a non-zero code. A shell run that
+    printed its `Output:` with no exit-code line is a pass, since Gemini writes
+    that line only for a non-zero code. AfterAgent judges `prompt_response` and
+    denies with `decision: deny`. Gemini sends the reason back through
+    BeforeAgent as the next prompt, and that turn row does not reset the
+    refusal budget. The status segment rides `systemMessage`.
+  - `--report` has Gemini rows, including one for `hooksConfig.enabled: false`
+    in settings.json, which runs no hook at all. `--report --live` probes the
+    hook command with Gemini's own payload and deny shape. No run has shown the
+    binary loading the extension or obeying the deny.
+- **GitHub Copilot CLI is a host (`copilot`, plan 139 slice 2).** `tezgah-setup
+  --install --hosts copilot` writes `$COPILOT_HOME/hooks/tezgah.json`, a hooks
+  file that is wholly tezgah's. `COPILOT_HOME` defaults to `~/.copilot`. The
+  timeouts are in seconds: PreToolUse 10, Stop and SubagentStop 30, the rest 5.
+  The inline `hooks` key of settings.json is never used, since one bad item
+  there rejects every hook in it. The install sets two keys in settings.json
+  while it is plain JSON. The status line runs `tezgah-statusline --copilot`.
+  `includeCoAuthoredBy` is `false`, so the agent's commits carry no co-author
+  trailer. A value the user set stays. The install links the skills into
+  `$COPILOT_HOME/skills` and writes the always-on block in
+  `copilot-instructions.md`. `--uninstall` deletes tezgah.json and takes back
+  only tezgah's settings keys, links and block.
+  - `hosts/copilot/hook.py` uses the PascalCase events, so payloads carry
+    snake_case fields and Claude tool names. It maps the runtime spellings too.
+    An Edit that names no file but carries a patch reaches the gate as
+    `apply_patch`. An MCP tool's `<server>-<tool>` becomes
+    `mcp__<server>__<tool>` for a server `mcp-config.json` names. It denies
+    with a top-level `permissionDecision: deny` on exit 0.
+  - A PreToolUse hook that times out lets the call through, by Copilot's own
+    rule. One that crashes denies the call. A repo's `.claude/settings.json`
+    hooks run there too.
+  - PostToolUse records a pass and PostToolUseFailure a failure. A shell
+    result's `exit code N` overrides either. Stop carries no reply, so the hook
+    reads the last `assistant.message` from `transcript_path`. A turn end with
+    none there becomes a `reply_unread` row. Copilot drops a command hook's
+    UserPromptSubmit output, so there is no per-turn reminder. The event still
+    writes the turn row. subagentStart gives a delegate the brief. A
+    SubagentStop only records its verdict.
+  - `--report` has Copilot rows, and `--report --live` probes the hook command
+    with Copilot's own payload and deny shape. No run has shown the binary
+    obeying the deny.
+- **Command Code is a host (`commandcode`, plan 139 slice 1).** `tezgah-setup
+  --install --hosts commandcode` merges tezgah's hook groups into the `hooks`
+  key of `~/.commandcode/settings.json` beside the user's. Their timeouts are in
+  seconds. The same write sets `attribution.commit` to `""`, so commits carry no
+  `CommandCodeBot` co-author trailer. A value the user set stays. The install
+  links the skills into `~/.commandcode/skills`. It writes the always-on block
+  in `~/.commandcode/AGENTS.md`. `--uninstall` takes back only tezgah's groups,
+  links and block. It drops the attribution key only while it holds what the
+  install wrote.
+  - Command Code's settings hooks see only shell, read, write and edit. So the
+    PreToolUse matcher is `shell|write|edit`. The gate there never sees read,
+    MCP, subagent or web calls, and plan mode skips every hook.
+  - `hosts/commandcode/hook.py` maps `shell_command`, `write_file` and
+    `edit_file` onto the gate. It folds a shell call's `args` into `command`.
+    It hands `old_value`/`new_value` over as `old_string`/`new_string`. It
+    denies with `permissionDecision: deny` on exit 0. It reads a shell call's
+    outcome off an `exit code N` in its result. A result with no code counts
+    as a run, never a pass.
+  - Stop carries no reply, so the hook reads it from `transcript_path`. A turn
+    end with none there becomes a `reply_unread` row. The status segment rides
+    `systemMessage` at SessionStart and Stop. There is no prompt event, so no
+    per-turn reminder.
+  - `--report` has Command Code rows, and `--report --live` probes the hook
+    command with Command Code's own payload. No run has shown the binary
+    obeying the deny.
+- **Factory Droid is a host (`droid`, plan 138 wave 1).** `tezgah-setup --install
+  --hosts droid` merges tezgah's hook groups into `~/.factory/hooks.json` beside
+  the user's. Their timeouts are in seconds, as Droid reads them. The install
+  also links the skills into `~/.factory/skills` beside the user's own links.
+  It writes the always-on block in `~/.factory/AGENTS.md`. It sets the
+  `statusLine` command and `includeCoAuthoredByDroid: false` in `settings.json`.
+  The install edits a settings.json with comments in place and keeps its
+  comments (plan 141). `--uninstall` takes back only tezgah's groups, links and keys.
+  - Droid reads the `hooks` key of settings.json only while hooks.json is
+    absent. So the install creates no hooks.json beside such a key, and the
+    report row says why. Then settings.json stays untouched.
+  - `hosts/droid/hook.py` maps Droid's tool ids (`Execute`, `Create`,
+    `ApplyPatch`, `FetchUrl`) onto the gate and hands ApplyPatch's `input` over
+    as `patch`. It denies with `permissionDecision: deny` on exit 0 and reads a
+    shell call's outcome off its `[Process exited with code N]` line.
+  - Droid's Stop carries no reply, so the hook reads the reply from
+    `transcript_path`. A turn end whose reply is not there yet becomes a
+    `reply_unread` row and is not judged. SubagentStop records `task_result`
+    as a `subagent_end` row.
+  - `--report` has Droid rows, and `--report --live` probes the hook command
+    with Droid's own payload. `tests/e2e_droid.py` runs the real binary only
+    under `TEZGAH_E2E_SPEND=1`, because it spends a model call.
+
+- **Qwen Code is a host (`qwen`, plan 138 wave 1).** `tezgah-setup --install
+  --hosts qwen` merges tezgah's hook groups into `~/.qwen/settings.json` beside
+  Orca's. Their timeouts are in milliseconds, as Qwen reads them. The install
+  also adds the `ui.statusLine` command, the skill links and the always-on
+  block in `~/.qwen/QWEN.md`. `--uninstall` takes back only tezgah's groups and keys.
+  - `hosts/qwen/hook.py` maps Qwen's tool ids (`run_shell_command`,
+    `write_file`, `edit`, `agent`, `grep_search`) onto the gate. It denies with
+    `permissionDecision: deny` on exit 0, blocks Stop on
+    `last_assistant_message`, briefs a subagent at SubagentStart and records
+    its end at SubagentStop.
+  - `--report` has Qwen rows, and `--report --live` probes the hook command
+    with Qwen's own payload. `tests/e2e_qwen.py` runs the real binary only
+    under `TEZGAH_E2E_SPEND=1`, because it spends a model call.
+  - `tezgah-doctor --stack` and the session attestation know the host. An
+    unknown host no longer crashes the attestation.
+  - A host-file backup is now owner-only, and a rewritten host config keeps
+    its file mode, because Qwen's settings.json holds provider keys.
+
+- **Review rules taken from google/elephant-goldfish-model (plan 137).** The
+  owner chose them from research line `egm-lessons`. No EGM file ships:
+  - `tezgah-task review NNN <r> approve` refuses a plan with no review slice
+    record. A host with no slice journal passes `--no-slice "<why>"`, and the
+    reason lands on the review line (`bin/tezgah-task`).
+  - The contract says that no fresh subagent means no review verdict. It also
+    says the author contests a finding only with a file:line and never lowers
+    a severity (`hooks/tezgah_policy.py`).
+  - tezgah-reviewer has a plan-readiness mode for a plan file. A design choice
+    left to the implementer is a major finding, and so is a section it cannot
+    paraphrase. plan-add runs it before `phase implementation`
+    (`hooks/tezgah_agents.py`).
+  - graph-review merges findings with the same file, line and title before its
+    verification cap, and reports `caps.deduplicated`.
+  - `tests/test_links.py` resolves every relative markdown link the repository
+    owns.
+
+### Changed
+
+- **The gate refuses a credit verb with "with" or "using" too.** The attribution
+  rule read `written by` and `built by`, so `Drafted with Claude` passed. The
+  credit verbs now include `drafted`, `produced` and `composed`, and each takes
+  `by`, `with` or `using` before a model or vendor name. Prose such as
+  `drafted with the owner` still passes (`hooks/tezgah_gate.py::_CREDIT`, plan
+  137).
+
+- **A release tag must sit on main.** A new `on-main` job in `release.yml`
+  fails the run on a tag off `origin/main`. Then no job builds or uploads
+  anything (plan 137).
+
+- **An owner-only choice waits for the owner.** Class F now names three more
+  steps. One is picking a variant a research, analysis or review recommends.
+  The others are a way around a tezgah refusal and deciding about another
+  session's work. The core
+  Ask policy, the per-turn reminder and the ask warning carry them too. The Stop
+  rule's `needless ask` lets a question that asks the owner to pick between
+  options through (`OWNER_CHOICE`, `hooks/tezgah_integrity.py`). A worker returns
+  such a question as `ESCALATE: owner`, and the orchestrator relays it to the
+  user instead of answering it (plan 136).
+
+- **A research line records the owner's pick apart from its own.** A rules-9
+  line writes its pick as `recommended:` in `decision.md`. A `chosen:` line
+  needs the owner's words, which `tezgah-research choose <slug> <decision>
+  <variant> --ack "<words>"` writes. The line's rules judge its own pick, never
+  the owner's, so an owner may take a dominated variant. `conclude` says when a
+  recommendation still waits for the owner (`hooks/tezgah_research.py`).
+
+- **A line in flight no longer blocks `init --allow-open`.** A line whose only
+  `check` errors are pending verdicts is in flight, not broken. Both `init`
+  refusals now say that another session's line goes to the owner.
+
+### Fixed
+
+- **Three new hosts no longer record a check that did not pass as a pass.**
+  Antigravity's PostToolUse has no output. A command that went to the
+  background also ends with an empty `error`. So the hook records each
+  Antigravity shell call as ran, never a pass, and Antigravity can never show
+  a passing check. A Copilot shell success with no `exit code N` text (a
+  background launch) is ran, never a pass. A Gemini result with a `Signal:`
+  line (a runner killed by a signal) is a failure.
+- **The gate guards Gemini's and Goose's hook-off keys.** These are Gemini's
+  `hooksConfig` and Goose's `disabledPlugins`. Claude's `disableAllHooks` had
+  the same guard.
+- **The Command Code uninstall removes tezgah's `attribution.commit: ""`
+  beside the user's other attribution keys**, not only when it stood alone.
+
+- **A hidden research dir is no longer invisible.** A dot dir under
+  `.tezgah/research/` is an error in `status` and in `check` with no slug. The
+  gate refuses a write there (`research_hidden_reason`, `hooks/tezgah_gate.py`).
+  A session had run a whole line under `.tezgah/research/.staging/` after an
+  `init` refusal.
+
 ## [1.11.0] - 2026-10-23
 
 ### Added
@@ -36,6 +534,10 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 - **A contract reads Hallmark's locked `design.md`, and one precedence table decides the floor.** A `design.md` or `DESIGN.md` at the repository root now feeds `derive`. It gives the palette and font roles, with `source: design-md`. The palette converts from OKLCH to the hex `check` compares. A token file beside it no longer competes. The contract gains a `precedence` block. It names `ours` (states, components, evidence, facts) and `theirs` (material, motion character). It names `shared` (contrast, focus-visible, reduced-motion, tap-target) and `verbatim: style`. `check` refuses with exit 2 a key named by two classes. It also refuses `facts` handed to a theme or to the user's own words.
 
+- **`tezgah-ocr-review` runs open-code-review's loop on omp's model.** It reaches the model through a loopback shim.
+
+- **`tezgah-review-quote` places review findings on the diff.** It finds each finding's location by the code it quotes.
+
 
 ### Changed
 
@@ -1299,7 +1801,11 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   the copy could not find `hooks/` and died on import. It now links into the
   installed tree, and also installs the command as `tezgah`.
 
-[Unreleased]: https://github.com/r1z4x/tezgah/compare/v1.10.1...HEAD
+[Unreleased]: https://github.com/r1z4x/tezgah/compare/v1.14.0...HEAD
+[1.14.0]: https://github.com/r1z4x/tezgah/releases/tag/v1.14.0
+[1.13.0]: https://github.com/r1z4x/tezgah/releases/tag/v1.13.0
+[1.12.0]: https://github.com/r1z4x/tezgah/releases/tag/v1.12.0
+[1.11.0]: https://github.com/r1z4x/tezgah/releases/tag/v1.11.0
 [1.10.1]: https://github.com/r1z4x/tezgah/releases/tag/v1.10.1
 [1.10.0]: https://github.com/r1z4x/tezgah/releases/tag/v1.10.0
 [1.9.2]: https://github.com/r1z4x/tezgah/releases/tag/v1.9.2