@r1z4x/tezgah 1.11.0 → 1.14.0

package/docs/hosts.md

@@ -1,7 +1,7 @@
 # Hosts
 
-tezgah is one Python core with six host adapters around it: `claude`, `codex`,
-`cursor`, `opencode`, `dsh`, `omp`. This page is for the maintainer wiring a new
+tezgah is one Python core with fourteen host adapters around it: `claude`, `codex`,
+`cursor`, `opencode`, `dsh`, `omp`, `qwen`, `droid`, `commandcode`, `copilot`, `gemini`, `antigravity`, `goose`, `amp`. This page is for the maintainer wiring a new
 host, adding a mark, or debugging a status line that claims something a host
 cannot see. Read it when a question starts with "does this host get X?" or "can
 this host observe Y?" - the answer is not uniform, and guessing it produces a
@@ -17,12 +17,20 @@ surface can honestly report this session; the two skill-read marks (`pony`,
 
 | Host | Hook events it fires | Always-on contract | Per-turn reminder | Status surface, how drawn | Measures |
 |---|---|---|---|---|---|
-| claude | SessionStart, SubagentStart, PostCompact, UserPromptSubmit, PreToolUse, PostToolUse, PostToolUseFailure, Stop, SubagentStop (record-only, `subagent_end`) - `hooks/hooks.json:2-32` | the managed block in `~/.claude/CLAUDE.md` (`CLAUDE_RULES`), Claude's global memory file; the SessionStart/PostCompact hook rows declare `TEZGAH_CORE_IN_FILE` (`hooks/hooks.json:4,10`) and the hook drops the core when the block is there, so the contract is paid for once (`hooks/projects-auto-init.py::core_is_in_a_file`; the static `output-styles/tezgah.md` mirror (`output-styles/tezgah.md:1`) is the hookless build's copy) | UserPromptSubmit -> `additionalContext` (`hooks/hooks.json:12-14`, `hooks/projects-auto-init.py::main`) | `statusLine` command in `~/.claude/settings.json` (`bin/tezgah-setup::wire_claude_statusline`), ANSI, forwards Orca first (`statusline.py:47-55`) | all seven: the transcript parse covers the two skill reads, `graph`, `orch` and the three shell kinds - `consult`, `research` and the judgement callers (`statusline.py::claude_used`, `observable=None` at `statusline.py::observable`) |
+| claude | SessionStart, SubagentStart, PostCompact, UserPromptSubmit, PreToolUse, PostToolUse, PostToolUseFailure, Stop, SubagentStop (record-only, `subagent_end`) - `hooks/hooks.json:2-32` | the managed block in `~/.claude/CLAUDE.md` (`CLAUDE_RULES`), Claude's global memory file; the SessionStart/PostCompact hook rows declare `TEZGAH_CORE_IN_FILE` (`hooks/hooks.json:4,10`) and the hook drops the core when the block is there, so the contract is paid for once (`hooks/projects-auto-init.py::core_is_in_a_file`; the static `output-styles/tezgah.md` mirror (`output-styles/tezgah.md:1`) is the hookless build's copy) | UserPromptSubmit -> `additionalContext` (`hooks/hooks.json:12-14`, `hooks/projects-auto-init.py::main`) | `statusLine` command in `~/.claude/settings.json` (`bin/tezgah-setup::wire_claude_statusline`), ANSI, forwards Orca first (`orca_out`, `statusline.py:52-60`) | all seven: the transcript parse covers the two skill reads, `graph`, `orch` and the three shell kinds - `consult`, `research` and the judgement callers (`statusline.py::claude_used`, `observable=None` at `statusline.py::observable`) |
 | codex | SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, SubagentStart, PostCompact, Stop (`bin/tezgah-setup::CODEX_HOOK_EVENTS`; named in `hosts/codex/hook.py:6-7`) | hook: the normalized events inject `context_for` (`hosts/codex/hook.py::main`) | UserPromptSubmit -> `additionalContext` (`hosts/codex/hook.py::main`) | no custom footer item (`tui.status_line` is a closed enum) - the line rides `systemMessage`, plain, at SessionStart and Stop (`hosts/codex/hook.py:10-12`, `hosts/codex/hook.py::main`) | five tool-use (`TOOL_USE_MEASURES` at `hosts/codex/hook.py::main`) |
-| cursor | 13 events: sessionStart, preToolUse, postToolUse, postToolUseFailure, subagentStart, subagentStop, beforeSubmitPrompt, stop, beforeMCPExecution, afterShellExecution, afterMCPExecution, afterFileEdit, afterAgentResponse (`bin/tezgah-setup::CURSOR_HOOK_EVENTS`) | hook: sessionStart -> `additional_context` (`hosts/cursor/hook.py::dispatch`) | beforeSubmitPrompt -> `additional_context` plus `{"continue": true}` (`hosts/cursor/hook.py::dispatch`) | `statusLine` in `~/.cursor/cli-config.json` -> `tezgah-statusline --cursor` (`bin/tezgah-setup::install_cursor`), ANSI (`statusline.py:122-124`) | five tool-use (`statusline.py::observable`) |
-| opencode | no lifecycle events; plugin hooks: config, permission.ask, tool.execute.before, shell.env, experimental.session.compacting, chat.message, tool.execute.after (`hosts/opencode/plugins/tezgah.js:2372-2737`) - `tool.execute.before` carries the whole gate, `tool.execute.after` the channel on the row, the provenance label on the result and the taint notice on the next effect (`untrustedSource` `hosts/opencode/plugins/tezgah.js:1942`, `labelResult` `:1993`) | static only: generated `instructions` files, because there is no session-start injection point (`hosts/opencode/plugins/tezgah.js:3-6`, `bin/tezgah-setup::opencode_contract_text`) | chat.message pushes a synthetic part (`hosts/opencode/plugins/tezgah.js:2652-2703`) | TUI plugin `tezgah-tui.tsx` declared in `tui.json`, runs `tezgah-status` on the event bus (`hosts/opencode/tui/tezgah-tui.tsx:1-11`; wiring `bin/tezgah-setup::install_opencode`) | all seven: skill reads and kinds are classified in process (`hosts/opencode/plugins/tezgah.js:2227-2263`) |
-| dsh | SessionStart, SubagentStart, UserPromptSubmit, PreToolUse, PostToolUse (`hosts/dsh/hooks.json:2-19`); no Stop rule, because the bridge drops every call's outcome and no check there can show a pass | hook: the same Claude-family scripts, named by `configPath` (`bin/tezgah-setup::dsh_patch_block`) | UserPromptSubmit, through the bridge (`hosts/dsh/hooks.json:9-11`) | web-profile plugin: authenticated `GET /api/tezgah.status` -> `tezgah-status` (`hosts/dsh/statusline/lib/index.js:15,66-104`) | five tool-use: the route passes `--observable=consult,research,graph,orch,judge` (`hosts/dsh/statusline/lib/index.js:16-19,84,96`) |
-| omp | session_start, session_compact, session_switch, turn_end, before_agent_start, tool_call, tool_result, session_stop (`hosts/omp/tezgah-hook.ts.in:596,655,674,679,681,701,720,755`) | both: static `RULES.md` (`bin/tezgah-setup::STATIC_RULES`, `bin/tezgah-setup::rules_block`) and a session payload carrying only what a static file cannot know (`hosts/omp/hook.py::handle`) | before_agent_start returns a hidden message (`hosts/omp/tezgah-hook.ts.in:681-699`) | extension draws `ctx.ui.setWidget` below the editor, `setStatus` as fallback (`hosts/omp/tezgah-hook.ts.in:170-203`); ANSI line from `hosts/omp/hook.py::status_line` | all seven: the embedded runner filters skill reads before asking python (`hosts/omp/tezgah-hook.ts.in:257-264`) and no `observable` is passed (`hosts/omp/hook.py::status_line`) |
+| cursor | 13 events: sessionStart, preToolUse, postToolUse, postToolUseFailure, subagentStart, subagentStop, beforeSubmitPrompt, stop, beforeMCPExecution, afterShellExecution, afterMCPExecution, afterFileEdit, afterAgentResponse (`bin/tezgah-setup::CURSOR_HOOK_EVENTS`) | hook: sessionStart -> `additional_context` (`hosts/cursor/hook.py::dispatch`) | beforeSubmitPrompt -> `additional_context` plus `{"continue": true}` (`hosts/cursor/hook.py::dispatch`) | `statusLine` in `~/.cursor/cli-config.json` -> `tezgah-statusline --cursor` (`bin/tezgah-setup::install_cursor`), ANSI (`statusline.py::color`) | five tool-use (`statusline.py::observable`) |
+| opencode | no lifecycle events; plugin hooks: config, permission.ask, tool.execute.before, event, shell.env, experimental.session.compacting, chat.message, tool.execute.after (the hook object `Tezgah` in `hosts/opencode/plugins/tezgah.js` returns) - `tool.execute.before` carries the whole gate, `event` writes a `spawned` row naming the parent on a child's `session.created`, `tool.execute.after` the channel on the row, the provenance label on the result and the taint notice on the next effect (`untrustedSource` and `labelResult` in the same file) | static only: generated `instructions` files, because there is no session-start injection point (the header comment of `hosts/opencode/plugins/tezgah.js`, `bin/tezgah-setup::opencode_contract_text`) | chat.message pushes a synthetic part (the `chat.message` hook of `Tezgah`) | TUI plugin `tezgah-tui.tsx` declared in `tui.json`, runs `tezgah-status` on the event bus (`TezgahBar` in `hosts/opencode/tui/tezgah-tui.tsx`; wiring `bin/tezgah-setup::install_opencode`) | all seven: skill reads and kinds are classified in process (`classify` in `hosts/opencode/plugins/tezgah.js`) |
+| dsh | SessionStart, SubagentStart, UserPromptSubmit, PreToolUse, PostToolUse (`hosts/dsh/hooks.json:2-19`); no Stop rule, because the bridge drops every call's outcome and no check there can show a pass | hook: the same Claude-family scripts, named by `configPath` (`bin/tezgah-setup::dsh_patch_block`) | UserPromptSubmit, through the bridge (`hosts/dsh/hooks.json:9-11`) | web-profile plugin: authenticated `GET /api/tezgah.status` -> `tezgah-status` (`STATUS_PATH` and `apply` in `hosts/dsh/statusline/lib/index.js`) | five tool-use: the route passes `--observable=consult,research,graph,orch,judge` (`OBSERVABLE` in `hosts/dsh/statusline/lib/index.js`) |
+| omp | 13 events: agent_start, tool_execution_start, tool_execution_end, agent_end, session_shutdown, session_start, session_compact, session_switch, turn_end, before_agent_start, tool_call, tool_result, session_stop (the `pi.on` registrations in `hosts/omp/tezgah-hook.ts.in`); the first five drive the busy spinner, and `agent_end` also records a task subagent's end, since omp fires no `session_stop` for one | both: static `RULES.md` (`bin/tezgah-setup::STATIC_RULES`, `bin/tezgah-setup::rules_block`) and a session payload carrying only what a static file cannot know (`hosts/omp/hook.py::handle`) | before_agent_start returns a hidden message (its `pi.on` handler in `hosts/omp/tezgah-hook.ts.in`) | extension draws `ctx.ui.setWidget` below the editor, `setStatus` as fallback (`draw` in `hosts/omp/tezgah-hook.ts.in`); ANSI line from `hosts/omp/hook.py::status_line` | all seven: the embedded runner filters skill reads before asking python (`skillRead` in `hosts/omp/tezgah-hook.ts.in`) and no `observable` is passed (`hosts/omp/hook.py::status_line`) |
+| qwen | SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, PostToolUseFailure, SubagentStart, SubagentStop (record-only, `subagent_end`), Stop (`bin/tezgah-setup::QWEN_HOOK_EVENTS`), all in `~/.qwen/settings.json` beside Orca's rows | the managed block in `~/.qwen/QWEN.md` (`bin/tezgah-setup::STATIC_RULES`); SessionStart drops the core while the block is there (`hosts/qwen/hook.py::rules_carry_core`) | UserPromptSubmit -> `additionalContext` (`hosts/qwen/hook.py::main`) | `ui.statusLine` command in `~/.qwen/settings.json` -> `tezgah-statusline --qwen`, ANSI kept by `respectUserColors` (`bin/tezgah-setup::install_qwen`) | five tool-use (`statusline.py::observable`) |
+| droid | SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, SubagentStop (record-only, `subagent_end`), Stop (`bin/tezgah-setup::DROID_HOOK_EVENTS`), all in `~/.factory/hooks.json` | the managed block in `~/.factory/AGENTS.md` (`bin/tezgah-setup::STATIC_RULES`); SessionStart drops the core while the block is there (`hosts/droid/hook.py::rules_carry_core`) | UserPromptSubmit -> `additionalContext` (`hosts/droid/hook.py::main`) | `statusLine` command in `~/.factory/settings.json` -> `tezgah-statusline --droid`, set in place with the file's comments kept (`bin/tezgah-setup::install_droid`, `bin/tezgah-setup::jsonc_put`) | five tool-use (`statusline.py::observable`) |
+| commandcode | SessionStart, PreToolUse (matcher `shell\|write\|edit`), PostToolUse, Stop (`bin/tezgah-setup::COMMANDCODE_HOOK_EVENTS`), all in the `hooks` key of `~/.commandcode/settings.json` | the managed block in `~/.commandcode/AGENTS.md` (`bin/tezgah-setup::STATIC_RULES`); SessionStart drops the core while the block is there (`hosts/commandcode/hook.py::rules_carry_core`) | unavailable: Command Code has no prompt event | no custom status line - the segment rides `systemMessage`, plain, TUI only, at SessionStart and Stop (`hosts/commandcode/hook.py::status`) | five tool-use (`TOOL_USE_MEASURES` at `hosts/commandcode/hook.py::status`) |
+| copilot | SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, PostToolUseFailure, subagentStart, SubagentStop (record-only, `subagent_end`), Stop (`bin/tezgah-setup::COPILOT_HOOK_EVENTS`), all in tezgah's own `$COPILOT_HOME/hooks/tezgah.json` | the managed block in `$COPILOT_HOME/copilot-instructions.md` (`bin/tezgah-setup::STATIC_RULES`); SessionStart drops the core while the block is there (`hosts/copilot/hook.py::rules_carry_core`) | unavailable: Copilot drops a command hook's UserPromptSubmit output; the event still writes the turn row (`hosts/copilot/hook.py::main`) | `statusLine` command in `$COPILOT_HOME/settings.json` -> `tezgah-statusline --copilot`, written only while that file is plain JSON (`bin/tezgah-setup::install_copilot`) | five tool-use (`statusline.py::observable`) |
+| gemini | SessionStart, BeforeAgent, BeforeTool, AfterTool, AfterAgent (`bin/tezgah-setup::GEMINI_HOOK_EVENTS`), all in tezgah's own extension `~/.gemini/extensions/tezgah/hooks/hooks.json` | the managed block in `~/.gemini/GEMINI.md` (`bin/tezgah-setup::STATIC_RULES`), shared with Antigravity; SessionStart drops the core while the block is there (`hosts/gemini/hook.py::rules_carry_core`) | BeforeAgent -> `hookSpecificOutput.additionalContext`, appended to the prompt for that turn (`hosts/gemini/hook.py::main`) | no custom status line (`ui.footer.items` is a closed list) - the segment rides `systemMessage`, plain, at SessionStart and AfterAgent (`hosts/gemini/hook.py::status`) | five tool-use (`TOOL_USE_MEASURES` at `hosts/gemini/hook.py::status`) |
+| antigravity | SessionStart, PreInvocation, PreToolUse, PostToolUse, Stop (`bin/tezgah-setup::ANTIGRAVITY_HOOK_EVENTS`), all under the `tezgah` name of `~/.gemini/config/hooks.json`; the payload names no event, so each command passes it as its first argument | the managed block in `~/.gemini/GEMINI.md` (`bin/tezgah-setup::STATIC_RULES`), shared with Gemini CLI; SessionStart injects the core as a system message while the block is missing (`hosts/antigravity/hook.py::rules_carry_core`) | PreInvocation with `invocationNum` 0 -> an `injectSteps` `ephemeralMessage`; whether that number restarts each user turn is undocumented (`hosts/antigravity/hook.py::main`) | `statusLine` command in `~/.gemini/antigravity-cli/settings.json` -> `tezgah-statusline --antigravity`, written only while that file is plain JSON (`bin/tezgah-setup::install_antigravity`) | five tool-use (`statusline.py::observable`) |
+| goose | SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, PostToolUseFailure, Stop (`bin/tezgah-setup::GOOSE_HOOK_EVENTS`), all in tezgah's own plugin `~/.agents/plugins/tezgah/hooks/hooks.json`; the payload names the event in `event` | the managed block in `~/.config/goose/.goosehints` (`bin/tezgah-setup::STATIC_RULES`), which Goose adds to the system prompt of every request; no hook can inject it, because SessionStart is observation only | unavailable: Goose ignores UserPromptSubmit output; the event still writes the turn row (`hosts/goose/hook.py::main`) | unavailable: Goose has no status line and shows no hook output to the user | none drawn; the PostToolUse rows still record the five tool-use marks for `tezgah-status` (`hosts/goose/hook.py::post_tool`) |
+| amp | no hook file: tezgah's TypeScript plugin `$XDG_CONFIG_HOME/amp/plugins/tezgah.ts` (else `~/.config/amp/plugins/tezgah.ts`) subscribes to `session.start`, `agent.start`, `tool.call`, `tool.result` and `agent.end` and forwards each to `hosts/amp/hook.py` (`hosts/amp/tezgah-plugin.ts.in`) | the managed block in `~/.config/amp/AGENTS.md` (`bin/tezgah-setup::STATIC_RULES`), which Amp always includes; `session.start` cannot inject, so the session brief rides the thread's next `agent.start`, with the core only while that block is missing or `AMP_IGNORE_GUIDANCE_FILES` is set (`hosts/amp/hook.py::handle`) | hook: `agent.start` returns the reminder as a hidden message (`display: false`); a prompt that starts with `[tezgah:stop]` is tezgah's own continue and sends no `user_prompt` | the experimental `createStatusItem`, plain text, for the thread the user is looking at only (owner-approved, plan 140 A-D15); without it, no status surface | none drawn beyond the status item; the `tool.result` rows record the five tool-use marks and a skill read |
 
 The middle five marks (`consult`, `research`, `graph`, `orch`, `judge`) are tool-use marks:
 any adapter that sees its host's tool calls can light them by calling
@@ -36,26 +44,50 @@ What each host can enforce, in the
 [enforcement capability](glossary.md#enforcement-capability) words. `gate`: the
 hook can refuse. `observe`: it records and never refuses. `partial`: only part
 of the surface fires. `unavailable`: the host has no event for it. A cell gets
-`unverified` when no driver on this machine can probe it. Fixture payloads test
-the code path there, but no run has shown the host obeying it.
+`unverified` when no run has shown the host binary obeying it. Fixture payloads
+test the code path there. `--report --live` goes one step further: it drives the
+installed wiring, the hook command or the plugin loaded with node. No host
+binary runs, so a live `ok` proves that the wiring answers, not that the host obeys.
 
 | Host | Gate (PreToolUse) | Stop | Subagent |
 |---|---|---|---|
-| claude | gate, probed by `--report --live` (`bin/tezgah-setup::live_probe`) | gate, unverified (`hooks/projects-stop.py::main`) | observe, unverified: a brief at SubagentStart, a record-only `subagent_end` row at SubagentStop (ADR 011) |
-| codex | gate, probed by `--report --live`; Codex runs only a trusted group | gate, unverified (`hosts/codex/hook.py::main`) | partial, unverified: a brief at SubagentStart, no subagent-end event |
-| cursor | gate, probed by `--report --live` | gate, unverified (`hosts/cursor/hook.py::dispatch`) | observe, unverified: a brief at subagentStart, a record-only `subagent_end` row at subagentStop |
-| opencode | gate, probed by `--report --live` through a node driver | unavailable: the plugin API has no end-of-turn event | unavailable |
-| dsh | gate, probed by `--report --live` through the bridge | unavailable: ADR 003 removed the Stop entry, because the bridge carries no outcome | partial, unverified: a brief at SubagentStart, no SubagentStop entry |
-| omp | gate, probed by `--report --live` (node 22.6+) | gate, unverified (`hosts/omp/hook.py::handle`) | partial, unverified: a brief at a task session's start; `session_stop` does not fire for task sessions |
+| claude | gate, unverified: probed by `--report --live` (`bin/tezgah-setup::live_probe`), which runs the PreToolUse command of the plugin copy's `hooks/hooks.json` on a deny payload; no claude binary runs, so that Claude Code obeys the deny is not shown | gate, unverified (`hooks/projects-stop.py::main`) | observe, unverified: a brief at SubagentStart, a record-only `subagent_end` row at SubagentStop (ADR 011) |
+| codex | gate, unverified: probed by `--report --live` through the PreToolUse command in `$CODEX_HOME/hooks.json`; no codex binary runs, and Codex runs only a trusted group | gate, unverified (`hosts/codex/hook.py::main`) | partial, unverified: a brief at SubagentStart, no subagent-end event |
+| cursor | gate, unverified: probed by `--report --live` through the preToolUse command in `~/.cursor/hooks.json`; no cursor-agent binary runs | gate, unverified (`hosts/cursor/hook.py::dispatch`) | observe, unverified: a brief at subagentStart, a record-only `subagent_end` row at subagentStop |
+| opencode | gate, unverified: probed by `--report --live`, which imports the installed plugin with node and fires its `tool.execute.before`; opencode's own loader is not what ran it | unavailable: the plugin API has no end-of-turn event | unavailable |
+| dsh | gate, unverified: probed by `--report --live` through the bridge's PreToolUse command; no dsh binary runs | unavailable: ADR 003 removed the Stop entry, because the bridge carries no outcome | partial, unverified: a brief at SubagentStart, no SubagentStop entry |
+| omp | gate, unverified: probed by `--report --live`, which loads the installed extension with node 22.6+; omp's own loader is not what ran it | gate, unverified (`hosts/omp/hook.py::handle`) | partial, unverified: a brief at a task session's start; `session_stop` does not fire for task sessions |
+| qwen | gate, unverified: probed by `--report --live` through the hook command in `~/.qwen/settings.json`; that the qwen binary obeys the deny stays unverified until `TEZGAH_E2E_SPEND=1 python3 tests/e2e_qwen.py` runs (it spends a model call) | gate, unverified (`hosts/qwen/hook.py::main`, judged on `last_assistant_message`) | observe, unverified: a brief at SubagentStart, a record-only `subagent_end` row at SubagentStop |
+| droid | gate, unverified: probed by `--report --live` through the hook command in `~/.factory/hooks.json`; that the droid binary obeys the deny stays unverified until `TEZGAH_E2E_SPEND=1 python3 tests/e2e_droid.py` runs (it spends a model call) | gate, unverified: Droid's Stop carries no reply, so the reply is read from `transcript_path` (`hosts/droid/hook.py::last_reply`), and a turn end whose reply is not there yet is a `reply_unread` row, never judged | partial, unverified: a record-only `subagent_end` row from SubagentStop's `task_result`; no SubagentStart, so no brief |
+| commandcode | gate, unverified: probed by `--report --live` through the hook command in `~/.commandcode/settings.json`, but no run of the binary has shown it obeying the deny; only shell, write and edit reach the hook (read, MCP, subagent and web tools do not), and plan mode skips every hook | gate, unverified: Stop carries no reply, so the reply is read from `transcript_path` (`hosts/commandcode/hook.py::last_reply`) and a turn end with none there is a `reply_unread` row, never judged; the host caps a block at three retries | unavailable: the settings hooks have no subagent event |
+| copilot | gate, unverified: probed by `--report --live` through the hook command in `$COPILOT_HOME/hooks/tezgah.json`, which answers with a top-level `permissionDecision: deny`, but no run of the binary has shown it obeying the deny. A PreToolUse hook that times out (10 s) lets the call through, by Copilot's own rule; one that crashes denies it. A repo's `.claude/settings.json` hooks run there too | gate, unverified: Stop carries no reply, so the reply is the last `assistant.message` in `transcript_path` (`hosts/copilot/hook.py::last_reply`), and a turn end with none there is a `reply_unread` row, never judged; the host ends the turn anyway after 8 blocks in a row | observe, unverified: a brief at subagentStart, a record-only `subagent_end` row at SubagentStop; the built-in `general-purpose` agent fires neither |
+| gemini | gate, unverified: probed by `--report --live` through the hook command in `~/.gemini/extensions/tezgah/hooks/hooks.json`, which answers with a top-level `decision: deny`, but no run of the binary has shown it obeying the deny, and no run has shown Gemini loading an extension dir written without `gemini extensions install` (its loader reads every subdir; a non-empty `security.allowedExtensions` asks for install metadata tezgah does not write). A hook that crashes or prints bad JSON is a warning and the call goes on | gate, unverified: AfterAgent carries the reply as `prompt_response` and `stop_hook_active` (`hosts/gemini/hook.py::main`); a deny sends the reason back as a new prompt | unavailable: no subagent event; a subagent is a tool call (`codebase_investigator`, `generalist`, `invoke_agent`) the gate sees as `Task` |
+| antigravity | gate, unverified: probed by `--report --live` through the hook command under the `tezgah` name of `~/.gemini/config/hooks.json`, fed Antigravity's camelCase envelope with the event as argv, which answers with a top-level `decision: deny` (an allow answers `decision: allow`, since the field is required), but no run of the binary has shown it obeying the deny. What Antigravity does when a hook crashes or times out is undocumented. The same file arms the Antigravity App and IDE | gate, unverified: Stop carries no reply, so the reply is read from `transcriptPath` (`hosts/antigravity/hook.py::last_reply`), and a turn end with none there is a `reply_unread` row, never judged; only an idle `model_stop` is judged, and `decision: continue` sends the model back into the loop with the reason as a system message. No block counter: the turn's refusal rows bound the re-asks | unavailable: no subagent event; a child conversation keeps its own ledger, and `invoke_subagent` reaches the gate as Task |
+| goose | gate, unverified: probed by `--report --live` through the hook command in `~/.agents/plugins/tezgah/hooks/hooks.json`, which answers `{"decision": "block"}` on stdout, but no run of the binary has shown it obeying the block, nor loading a plugin dir written by hand rather than by `goose plugin install` (the plugins guide says both are discovered). `on_failure` is left at its default `allow`, so a hook that crashes, times out or prints no decision lets the call through: the gate fails open on a hook fault. Only `shell`, `write`, `edit` and `<extension>__<tool>` reach the gate | gate, unverified: Stop carries the reply as `last_assistant_message` (`hosts/goose/hook.py::main`), and a Stop with none is a `reply_unread` row, never judged. It carries no count of earlier blocks, so the turn's own refusal rows bound the re-asks; Goose ends the turn anyway after `GOOSE_STOP_HOOK_BLOCK_CAP` blocks in a row | unavailable: SubagentStart and SubagentStop are not emitted; the subagent tool is not mapped |
+| amp | gate, unverified: `--report --live` loads the installed plugin with node 22.6+ (`--experimental-strip-types`) and fires its `tool.call` on a `Bash` call carrying `cmd`; the plugin answers `{action: "reject-and-continue"}`, but Amp's own Bun loader is not what ran it, so the row stays UNVERIFIED. A hook that is missing, crashes, times out or prints no JSON answers `{action: "allow"}`: the gate fails open. Only `Bash`, `shell_command`, `edit_file`, `create_file`, `apply_patch`, `Task` and an MCP effect name reach the gate | gate, unverified: `agent.end` with status `done` asks the Stop rule on the last assistant message and continues the turn with `[tezgah:stop] <reason>`; a turn that marker started is judged as the re-ask (`stop_hook_active`), and Amp's own cap of 5 continues backs the core's budget. Error and cancelled turns are not judged. A shell result passes only on an integer `exitCode` read off an output object (`hosts/amp/hook.py::call_failed`); Amp's docs do not show that its Bash result carries one, so until a run shows it no Amp check counts as passed | partial, unverified: a thread with a parent (`ctx.thread.parentThreadID()`) gets the subagent brief and a record-only `subagent_end` row at its `agent.end`; whether a Task subagent's events reach plugins is undocumented |
 
 Every host also attests its own hook entries once per session
-(`hooks/tezgah_attest.py::run`). Claude, dsh, Codex, Cursor and omp do it at
-session start. opencode does it at the first message, through `oncePerSession`.
+(`hooks/tezgah_attest.py::run`). Every host but opencode does it at session
+start. opencode does it at the first message, through `oncePerSession`.
 The `attest` row and the `drift` mark are
 [evidence](evidence.md#the-kinds-by-what-reads-them), never a block.
 `--report` prints the same comparison per host
 (`bin/tezgah-setup::attestation_rows`).
 
+Every Stop adapter hands the core the host's permission mode for the turn
+(`hooks/tezgah_integrity.py::read_only_turn`, plan 142). Claude, Command Code,
+Qwen, Copilot, Gemini, Codex, Goose, Droid and Cursor send it as
+`permission_mode` on the Stop payload (Antigravity's envelope is camelCase,
+`permissionMode`). omp has no such field, so its extension reads
+`ctx.sessionModes.getState().plan` and sends `plan` when it is active
+(`hosts/omp/tezgah-hook.ts.in`). A host that sends nothing reads as `default`.
+Only `plan` and Droid's `spec` change a verdict, and only two of them: the rule
+lets the approval question such a turn ends on through, and refuses a
+done/tested claim in it
+([evidence](evidence.md#the-stop-rule-end-to-end)). Claude's hooks reference
+documents the field on its own Stop payload. Every other adapter reads whatever
+its payload carries.
+
 ## What each host gets, and where it is written
 
 Every host gets the skill symlinks from `SKILLS` (`bin/tezgah-setup::SKILLS`)
@@ -90,7 +122,8 @@ shared config, contract hash and the CLI symlinks every host shell can call
   (`bin/tezgah-setup::write_user_agents`).
 - **cursor** - `install_cursor` (`bin/tezgah-setup::install_cursor`): `~/.cursor/hooks.json`
   (tezgah entries replaced, a user's Orca entries merged), `skills/*` symlinks,
-  `mcp.json` servers, and `cli-config.json` `statusLine`.
+  `mcp.json` servers, and `cli-config.json` `statusLine`. The symlinks skip a
+  skill another dir Cursor reads already links (`bin/tezgah-setup::cursor_shared_copy`).
 - **opencode** - `install_opencode` (`bin/tezgah-setup::install_opencode`): the plugin under
   both `plugins/` and `plugin/` (version drift), `skills/*` symlinks, the
   generated `~/.config/tezgah/opencode-contract.md` (`bin/tezgah-setup::opencode_contract`) and
@@ -126,6 +159,131 @@ shared config, contract hash and the CLI symlinks every host shell can call
   its own: orx's `codex` target writes the shim to `~/.agents/skills/orx`,
   omp's native `agents` skill root, so `install_openresearch` maps omp onto it
   (`ORX_AGENTS`, `bin/tezgah-setup::ORX_AGENTS`).
+- **qwen** - `install_qwen` (`bin/tezgah-setup::install_qwen`) writes into
+  `~/.qwen/settings.json` (or `$QWEN_HOME`). It adds one hook group per event of
+  `QWEN_HOOK_EVENTS`, each `timeout` in milliseconds. The PreToolUse group
+  carries `QWEN_PRETOOL_MATCHER` over Qwen's runtime tool ids. It also sets
+  `ui.statusLine`. A status line the user had comes back at uninstall. Orca's
+  groups and the provider keys in that file stay, and
+  the backup is owner-only (`bin/tezgah-setup::backup`). The install links
+  `skills/*` into `~/.qwen/skills`. It writes the always-on block in
+  `~/.qwen/QWEN.md`. tezgah writes no subagent roles, MCP rows or orx shim for
+  Qwen yet.
+- **droid** - `install_droid` (`bin/tezgah-setup::install_droid`) writes
+  `~/.factory/hooks.json`, keyed by event at the top. It adds one hook group per
+  event of `DROID_HOOK_EVENTS`, each `timeout` in seconds, and keeps the user's
+  own groups. The PreToolUse group carries `DROID_PRETOOL_MATCHER` over Droid's
+  tool ids. Droid reads the `hooks` key of `settings.json` only while hooks.json
+  is absent. The install then writes no hooks.json and says why
+  (`bin/tezgah-setup::droid_hooks_blocked`). Droid's settings.json holds
+  comments, so the install edits it in place and keeps them
+  (`bin/tezgah-setup::jsonc_put`). It adds the `statusLine`. It sets
+  `includeCoAuthoredByDroid` to false, the switch for Droid's co-author trailer.
+  The uninstall puts that switch back to what the install found: the user's
+  value, or no key. A file it cannot edit safely is left alone and the run names
+  both keys. The install
+  links `skills/*` into `~/.factory/skills` beside the user's own links. It
+  writes the always-on block in `~/.factory/AGENTS.md`. The uninstall deletes a
+  hooks.json that held only tezgah's groups. An empty one would still hide
+  settings.json's hooks. tezgah writes no subagent roles, MCP rows or orx
+  shim for Droid yet.
+- **commandcode** - `install_commandcode` (`bin/tezgah-setup::install_commandcode`)
+  writes into the `hooks` key of `~/.commandcode/settings.json`. It adds one
+  hook group per event of `COMMANDCODE_HOOK_EVENTS`, each `timeout` in seconds.
+  The user's own groups stay, and the backup is owner-only. The PreToolUse group
+  carries `COMMANDCODE_PRETOOL_MATCHER`, which Command Code tests against the
+  tool's display name. The same write sets `attribution.commit` to `""`. That
+  turns off the default `Co-authored-by: CommandCodeBot` commit trailer. A value
+  the user set stays. The uninstall restores the value the install found, from
+  the install record (`bin/tezgah-setup::restore_prior`). The install links `skills/*` into `~/.commandcode/skills`. It
+  writes the always-on block in `~/.commandcode/AGENTS.md`. tezgah writes no
+  subagent roles, MCP rows or orx shim for Command Code yet.
+- **copilot** - `install_copilot` (`bin/tezgah-setup::install_copilot`) writes
+  `$COPILOT_HOME/hooks/tezgah.json`, a `{"version": 1, "hooks": ...}` file that
+  is wholly tezgah's. `COPILOT_HOME` defaults to `~/.copilot`. The file holds
+  one entry per event of `COPILOT_HOOK_EVENTS`, each `timeoutSec` in seconds.
+  The inline `hooks` key of settings.json is never used, since one bad item
+  there rejects every hook in it. The PreToolUse entry carries
+  `COPILOT_PRETOOL_MATCHER`. settings.json is JSON with comments. So the status
+  line and `includeCoAuthoredBy: false` go in only while it parses as plain
+  JSON. A file holding comments gets a `holds comments - left untouched` line,
+  and the install still exits 0. The install refuses an unreadable, non-UTF-8
+  or non-object file and fails. That setting turns off the default `Co-authored-by` trailer on the
+  agent's commits. A value the user set stays. The install links `skills/*`
+  into `$COPILOT_HOME/skills` and writes the always-on block in
+  `$COPILOT_HOME/copilot-instructions.md`. The uninstall deletes tezgah.json.
+  Each settings key goes back to what the install found, the status line
+  too. Copilot gets no subagent roles, MCP rows or orx shim from tezgah yet.
+- **gemini** - `install_gemini` (`bin/tezgah-setup::install_gemini`) writes
+  tezgah's own extension, `~/.gemini/extensions/tezgah/`, which is wholly
+  tezgah's. `GEMINI_CLI_HOME` moves `~/.gemini` under it. The dir holds
+  `gemini-extension.json`, `hooks/hooks.json` with one group per event of
+  `GEMINI_HOOK_EVENTS` (each `timeout` in milliseconds) and `skills/*` links.
+  The BeforeTool group carries `GEMINI_PRETOOL_MATCHER`. settings.json is never
+  written: it is JSON with comments and holds the user's keys. Gemini's default
+  prompt adds no co-author trailer and no setting names one, so there is
+  nothing to turn off. The install writes the always-on block in
+  `~/.gemini/GEMINI.md`, which Antigravity reads too. The uninstall deletes the
+  extension dir. It strips the block only while no other host of
+  `GEMINI_MD_HOSTS` stays armed (`bin/tezgah-setup::gemini_md_kept`). Gemini
+  gets no subagent roles, MCP rows or orx shim from tezgah yet.
+- **antigravity** - `install_antigravity` (`bin/tezgah-setup::install_antigravity`)
+  writes tezgah's hook set under the top-level `tezgah` name of
+  `~/.gemini/config/hooks.json`, beside the user's other names. Each event of
+  `ANTIGRAVITY_HOOK_EVENTS` gets one item, its `timeout` in seconds. PreToolUse
+  and PostToolUse take a matcher group, the others a bare handler. Antigravity
+  never loads hooks from `antigravity-cli/settings.json`. The Antigravity App
+  and IDE read the same global hooks.json, so the install arms them too. The
+  status line goes in `~/.gemini/antigravity-cli/settings.json` only while it
+  is plain JSON. The install names a file holding comments, leaves it alone and exits 0.
+  The skill links go in `antigravity-cli/skills`. Antigravity
+  adds no co-author trailer of its own, and no setting names one. An open
+  feature request asks for one (google-antigravity/antigravity-cli#230). The
+  always-on block is the `~/.gemini/GEMINI.md` one Gemini CLI shares
+  (`bin/tezgah-setup::gemini_md_kept`). The uninstall takes out the `tezgah`
+  name and the links, and puts the user's own statusLine back. It removes a file that held only
+  tezgah's keys. Antigravity gets no subagent roles, MCP rows or orx shim from
+  tezgah yet. Antigravity can never show a passing check. Its PostToolUse
+  carries no output. A shell call that went to the background also ends with an
+  empty `error`. So the hook records each shell call as ran, never a pass
+  (`hosts/antigravity/hook.py::post_tool`). The owner chose this: a done or
+  tested claim there always stops at the Stop rule's `no verify_ok` class.
+- **goose** - `install_goose` (`bin/tezgah-setup::install_goose`) writes
+  tezgah's own plugin, `~/.agents/plugins/tezgah/`, which is wholly tezgah's.
+  It holds `plugin.json`, `hooks/hooks.json` and `skills/*` links. The hooks
+  file has one group per event of `GOOSE_HOOK_EVENTS`, each `timeout` in
+  seconds. Goose loads the skills as `tezgah:<skill>`. Goose tests a matcher
+  unanchored, so the PreToolUse group carries the anchored
+  `GOOSE_PRETOOL_MATCHER`. No hook sets `on_failure`, so it stays at Goose's
+  default `allow`, and a hook fault lets the call through. The always-on block
+  goes in `~/.config/goose/.goosehints`. Neither Goose's docs nor its system
+  prompt add a co-author trailer or name a setting for one. The uninstall
+  deletes the plugin dir and strips the block. The rest of `~/.agents` is the
+  user's and stays. The install ignores `GOOSE_PATH_ROOT`, since the docs
+  do not say where it puts the hints file. Goose gets no subagent roles, MCP
+  rows or orx shim from tezgah yet.
+- **amp** - `install_amp` (`bin/tezgah-setup::install_amp`) writes one file,
+  `tezgah.ts`, into Amp's system plugin dir (`hooks/tezgah_paths.py::AMP_PLUGIN`,
+  under `XDG_CONFIG_HOME` when that is set). `hooks/tezgah_attest.py::amp_plugin`
+  renders it from `hosts/amp/tezgah-plugin.ts.in`. Amp loads every `.ts` there,
+  and nothing registers it. A running Amp needs `plugins: reload`. The plugin
+  spawns `hosts/amp/hook.py` without blocking, one JSON in and one out. One
+  plugin process serves many threads, so it keys all its state by thread id.
+  The install links the skills into `~/.config/amp/skills` and writes the
+  always-on block into `~/.config/amp/AGENTS.md`. By default Amp adds a
+  `Co-authored-by: Amp` and an `Amp-Thread-ID` trailer to its commits. The
+  install sets `amp.git.commit.coauthor.enabled` and
+  `amp.git.commit.ampThread.enabled` to false in `~/.config/amp/settings.json`,
+  or in `settings.jsonc` when that is the only one, unless the user set them.
+  It writes that file only while it is plain JSON. Install, uninstall and the
+  report resolve it the same way (`bin/tezgah-setup::amp_settings`). The
+  install names a file holding comments, leaves it alone and exits 0. It
+  refuses both files at once, or an unreadable one, and exits 1. Then the run
+  prints both keys to set by hand. The uninstall removes the plugin only when
+  it is a fresh render or starts with tezgah's header line
+  (`bin/tezgah-setup::amp_plugin_ours`). A trailer key still false goes back to
+  what the install found. Amp gets no subagent roles, MCP rows or orx shim from
+  tezgah.
 
 An adapter is responsible for its host's **envelope** and its **surface**: it
 translates the host's event and tool names into the shared vocabulary (one call
@@ -149,6 +307,14 @@ pays for it once.
 | opencode | no stdout-inject hook: `install_opencode` writes the generated `~/.config/tezgah/opencode-contract.md` and references it from `opencode.json` `instructions` |
 | omp | the managed block in `~/.omp/agent/RULES.md` |
 | dsh | the session's own hook context: `hosts/dsh/hooks.json` runs the Claude-family scripts through the bridge, and no dsh file carries the core, so dsh's `SessionStart` row declares nothing and still gets it here (`~/.dsh/cordis.patch.yml` mounts that bridge) |
+| qwen | the managed block in `~/.qwen/QWEN.md`, which Qwen loads into every session; its `SessionStart` hook repeats the core only while that block is missing (`hosts/qwen/hook.py::rules_carry_core`) |
+| droid | the managed block in `~/.factory/AGENTS.md`, which Droid loads as coding guidelines at startup; its `SessionStart` hook repeats the core only while that block is missing (`hosts/droid/hook.py::rules_carry_core`) |
+| commandcode | the managed block in `~/.commandcode/AGENTS.md`, the user memory file Command Code puts in the system prompt; its `SessionStart` hook repeats the core only while that block is missing (`hosts/commandcode/hook.py::rules_carry_core`) |
+| copilot | the managed block in `$COPILOT_HOME/copilot-instructions.md`, Copilot's personal instructions file, applied to every session; its `SessionStart` hook repeats the core only while that block is missing (`hosts/copilot/hook.py::rules_carry_core`) |
+| gemini | the managed block in `~/.gemini/GEMINI.md`, the global context file Gemini puts in the system prompt and Antigravity reads too; its `SessionStart` hook repeats the core only while that block is missing (`hosts/gemini/hook.py::rules_carry_core`) |
+| antigravity | the same managed block in `~/.gemini/GEMINI.md`, a standalone global rule Antigravity keeps always on (24,000-byte file limit); its `SessionStart` hook injects the core as a system message only while that block is missing (`hosts/antigravity/hook.py::rules_carry_core`) |
+| goose | the managed block in `~/.config/goose/.goosehints`, the global hints file Goose adds to the system prompt of every request; no hook repeats it, because no Goose hook output reaches the model outside a block |
+| amp | the managed block in `~/.config/amp/AGENTS.md`, which Amp always includes; the session brief on the thread's first turn repeats it only while that block is missing or `AMP_IGNORE_GUIDANCE_FILES` is set (`hosts/amp/hook.py::rules_carry_core`) |
 
 An installed host whose core line is missing is a health check's business
 (`host_checks_<host>`), not a second copy: two delivery paths for one host is the
@@ -167,11 +333,27 @@ and drops the later ones.
 | context | cursor | the `sessionStart` hook context, the repo's `AGENTS.md`, `.cursor/rules/*.mdc`, `.cursorrules` | the hook |
 | context | opencode | `~/.config/opencode/AGENTS.md`, `opencode.json` `instructions`, the repo's `AGENTS.md` | the contract and router files in `instructions` |
 | context | omp | `SYSTEM.md`, `APPEND_SYSTEM.md`, `RULES.md` (sticky), the repo's `.omp/AGENTS.md`, `AGENTS.md`, `CLAUDE.md`; another host's user files only with `enabledProviders` | block in `RULES.md`, the extension at session start |
+| context | qwen | `~/.qwen/QWEN.md`, the repo's `QWEN.md` and `AGENTS.md`, then `.qwen/QWEN.local.md`; all load | block in the first |
+| context | droid | from the cwd up to the git root, `AGENTS.md` (or `CLAUDE.md`) in each dir and its `.factory/`, `.agents/`, `.agent/`; then `~/.factory/AGENTS.md` and the other personal dirs; project files override personal ones | block in `~/.factory/AGENTS.md` |
+| context | commandcode | `~/.commandcode/AGENTS.md`, the repo's `AGENTS.md` (else `.commandcode/AGENTS.md`), then each subdirectory's; all load | block in the first |
+| context | copilot | `$COPILOT_HOME/copilot-instructions.md` and `instructions/`, then in the git root and the cwd `.github/copilot-instructions.md`, `.github/instructions/`, `AGENTS.md`, `CLAUDE.md`, `GEMINI.md` and `.claude/rules/`; all merge | block in the first |
+| context | gemini | `~/.gemini/GEMINI.md`, then from the cwd up to the git root, then subdirectories (`context.fileName` renames the file); all concatenate | block in the first |
+| context | antigravity | `~/.gemini/AGENTS.md` and `GEMINI.md`, `~/.gemini/config/rules/*.md`, `~/.gemini/antigravity-cli/rules/*.md`, then the workspace's `AGENTS.md`, `GEMINI.md` and `.agents/rules/`, and plugin rules; all combine, more specific rules win a conflict, and over 20,000 tokens the largest files become pointers | block in `~/.gemini/GEMINI.md` |
+| context | goose | `CONTEXT_FILE_NAMES` (default `AGENTS.md`, `.goosehints`) in `~/.config/goose/`, then in the project root and each directory goose reads; all load, and a local hint wins over a global one | block in `~/.config/goose/.goosehints` |
+| context | amp | `AGENTS.md` in the cwd and its parents, subtree files on a read, then `~/.config/amp/AGENTS.md` and `~/.config/AGENTS.md`; all load, and `AMP_IGNORE_GUIDANCE_FILES` skips matching files | block in `~/.config/amp/AGENTS.md` |
 | skills | omp | `skills.customDirectories`, then `.omp/skills` and `~/.omp/agent/skills`, Claude's project dir (user dir opt-in), `.agents/skills` and `~/.agents/skills`; first wins, identical copies collapse, a differing copy is renamed `<namespace>/<name>` | links in `~/.omp/agent/skills` |
 | skills | claude | `.claude/skills`, `~/.claude/skills`; plugin skills are namespaced `tezgah:<name>` | the plugin copy |
 | skills | codex | `.agents/skills` from the cwd up to the repo root, `~/.agents/skills`, `$CODEX_HOME/skills`; one name in two dirs is listed twice, not merged | links in `$CODEX_HOME/skills` |
-| skills | cursor | `.agents/skills`, `.cursor/skills`, `~/.agents/skills`, `~/.cursor/skills`, then Claude's and Codex's project and user dirs; no documented winner | links in `~/.cursor/skills` |
+| skills | cursor | `.agents/skills`, `.cursor/skills`, `~/.agents/skills`, `~/.cursor/skills`, then Claude's and Codex's project and user dirs; no documented winner | links in `~/.cursor/skills`, only for the skills `~/.codex`, `~/.claude` or `~/.agents/skills` do not already link |
 | skills | opencode | its own skill tool is denied; the router lists `~/.config/opencode/skills`, `~/.claude/skills`, `~/.agents/skills`, first wins (`bin/tezgah-setup::skill_groups`) | links and the router |
+| skills | qwen | `~/.qwen/skills`, `.qwen/skills`, extension and bundled skills; no documented winner | links in `~/.qwen/skills` |
+| skills | droid | `.factory/skills` (project and folder), `~/.factory/skills`, `.agents/skills` and `~/.agents/skills`, plugin and built-in skills; no documented winner | links in `~/.factory/skills`, beside the user's own |
+| skills | commandcode | `.commandcode/skills`, `.agents/skills`, `~/.commandcode/skills`, `~/.agents/skills`, extra locations, bundled; first wins | links in `~/.commandcode/skills` |
+| skills | copilot | `.github/skills`, `.agents/skills`, `.claude/skills`, a parent's `.github/skills`, `$COPILOT_HOME/skills`, `~/.agents/skills`, plugins, `COPILOT_SKILLS_DIRS`, bundled; first wins | links in `$COPILOT_HOME/skills` |
+| skills | gemini | workspace `.agents/skills` and `.gemini/skills`, user `~/.agents/skills` and `~/.gemini/skills`, extension skills, built-in; higher tier wins, `.agents/skills` wins within one | links in the extension's `skills/`, the lowest tier |
+| skills | antigravity | the workspace's `.agents/skills`, `~/.gemini/antigravity-cli/skills`, plugin skills; no documented winner | links in `~/.gemini/antigravity-cli/skills` |
+| skills | goose | `~/.agents/skills`, `.agents/skills`, plugin skills (namespaced `<plugin>:<name>`), then `.goose/skills`, `.claude/skills` and `~/.claude/skills` for backward compatibility; no documented winner | links in the plugin's `skills/`, loaded as `tezgah:<name>` |
+| skills | amp | `~/.config/agents/skills`, `~/.agents/skills`, `~/.config/amp/skills`, `.agents/skills`, `.claude/skills`, `~/.claude/skills`, then plugin and configured paths; first name wins | links in `~/.config/amp/skills` |
 | agents | claude | managed, the `claude --agents` flag, `.claude/agents`, `~/.claude/agents`, plugin agents namespaced `plugin:name`; a dir absent at start is not watched | `~/.claude/agents`, written at install |
 | agents | codex | `$CODEX_HOME/agents`, `/etc/codex/agents`, `.codex/agents` (trusted repos only), read at config load | `$CODEX_HOME/agents`, written at install |
 | agents | cursor | `cursor-agent`: `.cursor/agents`, then `.claude/agents`, `.grok/agents`, plugin agents; first name wins; no user dir; read at process start. The editor's docs add `~/.cursor/agents` and `~/.claude/agents` | `.cursor/agents` per repo at session start, in the CLI's line format (`hooks/tezgah_agents.py::render_md_cursor`) |
@@ -181,7 +363,16 @@ and drops the later ones.
 | hooks | codex, cursor | `hooks.json` array order, then the repo's `.codex/` or `.cursor/hooks.json`; Codex runs a row only once its hash is trusted | own rows after Orca's |
 | hooks | opencode | every `*.js`/`*.ts` in `plugins/` and `plugin/`; `tezgah.js` is linked into both, and its `globalThis.__tezgahPluginLoaded` guard makes the second load return `{}` | the plugin |
 | hooks | omp | `~/.omp/agent/extensions/` first, then `config.yml` `extensions:`, one load per absolute path; per event in that order, and the first `block` ends a tool call | the bridge in `hooks/pre/` |
-| mcp | each | omp: project `.omp/mcp.json`, then `~/.omp/agent/mcp.json`, first name wins; claude: `~/.claude.json`, the repo's `.mcp.json`, the plugin's `.mcp.json`; codex: `$CODEX_HOME/config.toml`; cursor: `~/.cursor/mcp.json`; opencode: `opencode.json` `mcp` | one `tezgah` and one `codegraph` row per host |
+| hooks | qwen | user `settings.json` rows (Orca's and tezgah's), then project `.qwen/settings.json` rows in trusted folders; groups run in parallel unless `sequential` | own rows after Orca's |
+| hooks | droid | org-managed hooks, user `~/.factory/hooks.json`, project `.factory/hooks.json` and enabled plugins' `hooks/hooks.json`, merged with no documented order; a scope's settings.json `hooks` key counts only while its hooks.json is absent | own rows in hooks.json |
+| hooks | commandcode | project `.commandcode/settings.json` rows, then user `~/.commandcode/settings.json` rows; PreToolUse runs them in order and stops at the first deny, the other events run in parallel | own rows in the user settings.json |
+| hooks | copilot | policy files, then the repo's `.github/hooks/*.json`, user `$COPILOT_HOME/hooks/*.json`, the inline `hooks` of the repo's and the user's settings.json (and the repo's `.claude/settings.json`), then plugins; every entry runs, and any PreToolUse deny blocks | own file `hooks/tezgah.json` |
+| hooks | gemini | project `.gemini/settings.json`, user `~/.gemini/settings.json`, system settings, then extensions' `hooks/hooks.json`; `hooksConfig.enabled: false` runs none | own extension `extensions/tezgah/hooks/hooks.json` |
+| hooks | antigravity | workspace `.agents/hooks.json`, global `~/.gemini/config/hooks.json`, then installed plugins' `hooks.json`; each top-level name is a hook set, and `enabled: false` on a name loads none of it | the `tezgah` name in the global hooks.json |
+| hooks | goose | user `~/.agents/plugins/<name>/hooks/hooks.json`, project `.agents/plugins/<name>/hooks/hooks.json` and installed plugins; a name in `disabledPlugins` of `~/.config/goose/settings.json` loads none of it; any PreToolUse block denies | own plugin `~/.agents/plugins/tezgah/hooks/hooks.json` |
+| hooks | amp | plugins: personal and workspace ones from Amp's settings, the project's `.amp/plugins/`, the system `$XDG_CONFIG_HOME/amp/plugins/`; a project plugin wins over a system one of the same name, and every plugin gets every event in no defined order | the system plugin `tezgah.ts` |
+| mcp | each | omp: project `.omp/mcp.json`, then `~/.omp/agent/mcp.json`, first name wins; claude: `~/.claude.json`, the repo's `.mcp.json`, the plugin's `.mcp.json`; codex: `$CODEX_HOME/config.toml`; cursor: `~/.cursor/mcp.json`; opencode: `opencode.json` `mcp`; qwen: `settings.json` `mcpServers`; droid: `~/.factory/mcp.json`; commandcode: `settings.json` `mcp.servers`, `~/.commandcode/mcp.json`, the repo's `.mcp.json`; copilot: `$COPILOT_HOME/mcp-config.json`, the repo's `.mcp.json` and `.github/mcp.json`, project first; gemini: `settings.json` `mcpServers` (user, project) and each extension's `gemini-extension.json`, settings.json first; antigravity: `~/.gemini/config/mcp_config.json`, the workspace's `.agents/mcp_config.json` and plugins, the running server keeps a shared name; goose: the `extensions:` map of `~/.config/goose/config.yaml`; tezgah writes no row for qwen, droid, commandcode, copilot, gemini, antigravity or goose yet | one `tezgah` and one `codegraph` row per host but qwen, droid, commandcode, copilot, gemini, antigravity and goose |
+| mcp | amp | `amp.mcpServers` in `~/.config/amp/settings.json`, then the workspace's `.amp/settings.json`, which wins | none: tezgah writes no MCP row for Amp |
 
 Orca is a launcher, not a host. It starts omp with its own `--extension`. It
 gives each Codex account its own `CODEX_HOME` under
@@ -224,6 +415,14 @@ three harness configurations while swapping the model inside one harness moved i
 | opencode | a selector read from `opencode models` (`hooks/tezgah_models.py:12`) | the AI SDK: `@ai-sdk/openai-compatible` for `/v1/chat/completions`, `@ai-sdk/openai` for `/v1/responses`, beside its own Anthropic and Bedrock providers (opencode's provider docs) | vendor documentation |
 | omp | the session default's family, otherwise `task.agentModelOverrides` and `modelRoles.plan` (`hooks/tezgah_models.py:13-16`) | whichever provider the selected model names - Anthropic Messages, OpenAI Responses, OpenAI chat completions, Google, Bedrock - with text-based dialects where a native tool API is unavailable; the OpenRouter route dispatches to Responses unless `PI_OPENROUTER_RESPONSES=0` (omp's own `provider-compat-reference` documentation) | the tool's own documentation |
 | dsh | the Claude-family scripts through the bridge (`hosts/dsh/hooks.json:2-18`); `README.md:27-28` calls it "DeepSeek's dsh harness" | `unverified`: its own `--help` describes it as "an ordered stack of plugin-bundle patch layers" and names no model API, and its profile directory names a provider (DeepSeek) rather than a wire (checked 2026-10-01) | - |
+| qwen | not named: tezgah writes no Qwen subagent roles | the provider `settings.json` `modelProviders` selects, keyed by auth type - `openai` (OpenAI-compatible), `anthropic`, `gemini`, `vertex-ai` - each with its own `baseUrl` (Qwen Code 0.21.13 `configuration/model-providers.md`) | the tool's own documentation |
+| droid | not named: tezgah writes no Droid subagent roles | `unverified`: tezgah has not mapped Droid's providers to a wire | - |
+| commandcode | not named: tezgah writes no Command Code subagent roles | `unverified`: tezgah has not mapped Command Code's providers to a wire | - |
+| copilot | not named: tezgah writes no Copilot subagent roles | `unverified`: tezgah has not mapped Copilot's providers to a wire | - |
+| gemini | not named: tezgah writes no Gemini subagent roles | `unverified`: tezgah has not mapped Gemini's providers to a wire | - |
+| antigravity | not named: tezgah writes no Antigravity subagent roles | `unverified`: tezgah has not mapped Antigravity's models to a wire | - |
+| goose | not named: tezgah writes no Goose subagent roles | `unverified`: tezgah has not mapped Goose's providers to a wire | - |
+| amp | not named: tezgah writes no Amp subagent roles | `unverified`: tezgah has not mapped Amp's models to a wire | - |
 
 `unverified` is the point of the column rather than a gap in it. A wrong dialect
 here is worse than a blank one: a reader would use it to explain a score, and the
@@ -234,15 +433,16 @@ and say which document it came from.
 
 A skill read is observable only where the host gives a channel that does not cost
 a process per read: Claude parses its transcript (`statusline.py::claude_used`),
-opencode classifies in process (`hosts/opencode/plugins/tezgah.js:2227-2263`),
+opencode classifies in process (`classify` in `hosts/opencode/plugins/tezgah.js`),
 omp filters in its embedded runner before it asks python
-(`hosts/omp/tezgah-hook.ts.in:257-264`). On codex, cursor and dsh a read is not
-observable at that price, so their surfaces pass the five tool-use measures as
-`observable` and the two skill marks render dim (`info`, no glyph) instead of
+(`skillRead` in `hosts/omp/tezgah-hook.ts.in`), and Amp's plugin does the same for a
+`Read` of a shipped skill (`hosts/amp/tezgah-plugin.ts.in`). On codex, cursor, qwen, droid, commandcode, copilot, gemini, antigravity, goose and dsh a read is not
+observable at that price. Their surfaces pass the five tool-use measures as
+`observable`, and the two skill marks render dim (`info`, no glyph) instead of
 claiming the skill was never opened (`hooks/tezgah_context.py::TOOL_USE_MEASURES`, and the
 `observable` branch at `hooks/tezgah_context.py::health_segments`). Callers that pass `TOOL_USE_MEASURES`:
-`statusline.py::observable`, `hosts/codex/hook.py::main`,
-`hosts/dsh/statusline/lib/index.js:16-19`. A kill switch is observable everywhere
+`statusline.py::observable`, `hosts/codex/hook.py::main`, `hosts/commandcode/hook.py::status`,
+`OBSERVABLE` in `hosts/dsh/statusline/lib/index.js`. A kill switch is observable everywhere
 and still renders `off` (`hooks/tezgah_context.py::health_segments`).
 
 ## Adding a host
@@ -252,7 +452,7 @@ In order, each step verified by the one below it:
 1. `HOST_DIRS` and, when the CLI can exist without a config dir, `HOST_BINS` in
    `hooks/tezgah_paths.py::HOST_DIRS`, `hooks/tezgah_paths.py::HOST_BINS`. These are shared by the installer, the report
    and agent generation, so "is this host installed?" has one answer
-   (`hooks/tezgah_paths.py:66-69`). Add the name to `ALL_HOSTS` in the report
+   (`hooks/tezgah_paths.py::host_installed`). Add the name to `ALL_HOSTS` in the report
    order (`bin/tezgah-setup::ALL_HOSTS`).
 2. The hook adapter(s) under `hosts/<host>/` (an `install_*`-independent
    directory like `hosts/codex/hook.py`, `hosts/cursor/hook.py`) plus, for a
@@ -260,21 +460,37 @@ In order, each step verified by the one below it:
    (`hosts/omp/tezgah-hook.ts.in` rendered at `hooks/tezgah_attest.py::omp_bridge`).
 3. `install_<host>()` writing that host's files, registered in `INSTALLERS`
    (`bin/tezgah-setup::INSTALLERS`), and `uninstall_<host>()` removing only
-   tezgah-managed links and blocks (`bin/tezgah-setup:3331-3463`).
+   tezgah-managed links and blocks, registered in `UNINSTALLERS` (`bin/tezgah-setup::UNINSTALLERS`).
 4. `host_checks_<host>()` returning `(label, bool)` rows over what was actually
    written, registered in `HOST_CHECKS` (`bin/tezgah-setup::HOST_CHECKS`); the
    `--report` output is that list (`bin/tezgah-setup::report`). Give the row a home-qualified
    label if the host's dir can be relocated (`host_checks_codex`, `bin/tezgah-setup::host_checks_codex`).
+   The first row is the host's "wired" row (`bin/tezgah-setup::hosts_row`), and a
+   row whose MISS means unarmed names a label `ARMING_ROWS` carries
+   (`bin/tezgah-setup::ARMING_ROWS`).
+   Every other table keyed by host grows with it, or the host crashes or drops
+   out there. `hooks/tezgah_stack.py::host_stack` raises on an unknown host, so
+   `tezgah-doctor --stack` fails. The other tables are
+   `hooks/tezgah_stack.py::tezgah_skill_dirs`, `hooks/tezgah_attest.py::registration`
+   and `CODE_TARGETS`, `bin/tezgah-setup::hook_entries` and
+   `bin/tezgah-setup::live_plan`. Without `live_plan` the live rows read
+   UNVERIFIED. The gate's control plane grows too: `HOOK_ENTRIES`, `HOOK_HOSTS`
+   and the shared files of `hooks/tezgah_gate.py::_registration`. The gate then
+   refuses a forged run of the new hook, and an edit of its registration, as it
+   refuses the others.
 5. Decide the surface: a `statusLine` command, a TUI/widget plugin, or the
    `systemMessage` fallback (`hosts/codex/hook.py:10-12`). Pass `observable` if
    the host cannot see a skill read, and `idx_override` on any redraw that must
    not fork git for a cosmetic glyph (`hooks/tezgah_context.py::health_segments`).
 6. Tests, in two tiers: a per-host class in `tests/test_setup.py` pinning the
-   report rows and the written files (e.g. `OmpHost:960-1030`,
-   `CodexHome:657-702`, `CursorMatcher:705-722`, `DshStatusline:872-957`), and an
+   report rows and the written files (e.g. `tests/test_setup.py::OmpHost`,
+   `tests/test_setup.py::CodexHome`, `tests/test_setup.py::CursorMatcher`,
+   `tests/test_setup.py::DshStatusline`), and an
    opt-in script under `tests/e2e_*.py` for the thing only a real host can prove
    - not collected by `unittest discover`, it exits 0 with `SKIP` when the host
-   is absent (`tests/e2e_omp_statusline.py:13-16`).
+   is absent (`tests/e2e_omp_statusline.py:13-16`). A script that calls a model
+   also exits 0 with `SKIP` unless `TEZGAH_E2E_SPEND=1` is set
+   (`tests/e2e_qwen.py`, `tests/e2e_droid.py`).
 
 ## Host-specific limits worth knowing
 
@@ -287,6 +503,26 @@ In order, each step verified by the one below it:
     `gate✗` appears only in the SessionStart/Stop status message.
   - **cursor, dsh:** observed only if their prompt payload carries `transcript_path`
     (unverified on a live host).
+  - **qwen:** unverified. Its prompt payload carries `transcript_path`. The counter
+    reads only the Claude, omp and Codex row shapes (`hooks/tezgah_context.py::_transcript_calls`).
+    No run has captured Qwen's transcript format yet, so a disarmed gate there likely counts 0.
+  - **droid:** unverified on a live host. Its transcript rows carry `message.content`
+    `tool_use` blocks with a `timestamp`, the Claude shape the counter reads, and
+    `GATED_TOOLS` names `Execute`, `Create` and `ApplyPatch`
+    (`hooks/tezgah_context.py::GATED_TOOLS`).
+  - **commandcode:** unavailable: Command Code has no prompt event, so nothing runs the
+    counter there.
+  - **copilot:** unavailable: Copilot drops a command hook's UserPromptSubmit output,
+    so no reminder carries the counter's warning there.
+  - **gemini:** unverified. BeforeAgent carries `transcript_path`, but Gemini's
+    session file is a format the counter does not read
+    (`hooks/tezgah_context.py::_transcript_calls`), so a disarmed gate there likely counts 0.
+  - **antigravity:** unavailable: its `transcript.jsonl` is not a format the counter
+    reads, so the hook does not hand it over. Only a switch armed mid-session shows.
+  - **goose:** unavailable: Goose ignores UserPromptSubmit output, so no reminder
+    carries the counter's warning there.
+  - **amp:** unavailable: the plugin hands the hook no transcript path, so only a
+    switch armed mid-session shows.
   - **omp, opencode:** not applicable: the prompt hook and the gate live in one extension or
     plugin process, so one cannot run without the other.
   - Everywhere: a disarmed PreToolUse beside a working PostToolUse writes rows and is not
@@ -313,7 +549,7 @@ In order, each step verified by the one below it:
     (`hooks/projects-auto-init.py:28-38`, `hosts/codex/hook.py::main`).
   - **opencode**: `experimental.session.compacting` carries the builder's
     post-compact block, so the contract survives the summary
-    (`hosts/opencode/plugins/tezgah.js:39-40`). It hands the builder the
+    (the `experimental.session.compacting` hook of `Tezgah` in `hosts/opencode/plugins/tezgah.js`). It hands the builder the
     session id. The builder then forgets the lessons and armed paragraphs
     that session saw, and restates its pinned user constraints. The call
     used to send `{}`, which keyed nothing on the session.
@@ -323,7 +559,7 @@ In order, each step verified by the one below it:
     `hosts/omp/hook.py` for `{"event": "post_compact"}`; the block is sent with
     `pi.sendMessage(..., {deliverAs: "nextTurn"})`, and the summary rides as
     `compact_summary` so `remember_compaction` writes the compaction row
-    (`hosts/omp/tezgah-hook.ts.in:647-664`, `hosts/omp/hook.py::handle`).
+    (the `session_compact` handler in `hosts/omp/tezgah-hook.ts.in`, `hosts/omp/hook.py::handle`).
     Subagent sessions are skipped, because the post-compact block starts the
     indexer.
   - **cursor**: not re-injected - a limitation. Cursor's only compaction hook,
@@ -347,7 +583,7 @@ In order, each step verified by the one below it:
   SubagentStop and Stop, and silently drops anything else - which is why
   `configPath` names `hosts/dsh/hooks.json` and not the Claude manifest
   (`bin/tezgah-setup::dsh_patch_block`). Its status route goes through `tezgah-status`
-  with the five tool-use measures (`hosts/dsh/statusline/lib/index.js:16-19`), it
+  with the five tool-use measures (`OBSERVABLE` in `hosts/dsh/statusline/lib/index.js`), it
   declares `TEZGAH_CALL_OUTCOME=none` because the bridge drops the outcome field
   (`hosts/dsh/hooks.json:16-18`, `hooks/projects-posttooluse.py::main`), and its
   statusline row lives in the web profile because the plugin injects the
@@ -357,9 +593,9 @@ In order, each step verified by the one below it:
   `hosts/dsh/hooks.json` until the bridge carries outcomes.
 - **opencode carries the untrusted-content control in the plugin**, not by
   importing `hooks/tezgah_untrusted.py`, which a plugin cannot do in process: the
-  channel is decided in JS (`untrustedSource` `hosts/opencode/plugins/tezgah.js:1942`,
-  the tier's argv reader at `:1902-1911`), the label and the taint notice ride the
-  result the hook is handed (`labelResult` `:1993`). A shared corpus in
+  channel is decided in JS (`untrustedSource` in `hosts/opencode/plugins/tezgah.js`,
+  the tier's argv reader `tierRead`), the label and the taint notice ride the
+  result the hook is handed (`labelResult`). A shared corpus in
   `tests/test_opencode_plugin.py::OpenCodePlugin.test_the_classifier_agrees_with_the_python_half_on_a_shared_corpus` drives both halves over the same calls and
   fails if their answers differ, so neither can move without the other.
 - **omp carries both untrusted-content marks through the shared core.** Its
@@ -391,20 +627,20 @@ In order, each step verified by the one below it:
 - **opencode asks the core for the rules it cannot port, and counts the ask.** The
   task rule's phase and allowlist and the language rule's word list are answered by
   `bin/tezgah-gate decide` (the recording verb; `check` is the dry run) rather than copied into JavaScript (`IDENT_CMD`
-  `hosts/opencode/plugins/tezgah.js:585`, the call site `:2492-2495`) - one spawn per write
+  in `hosts/opencode/plugins/tezgah.js`, tested in the `tool.execute.before` hook) - one spawn per write
   and per identifier-creating command. The delegation fails open by design: a missing
-  CLI, a non-zero exit, a broken pipe or a 10 s timeout refuses nothing (`collect`
-  `hosts/opencode/plugins/tezgah.js:152-178`). One `delegation` row now records the class when the core could not
-  answer (`noteDelegation` `:2304-2310`), so a silent fail-open is countable instead
+  CLI, a non-zero exit, a broken pipe or a 10 s timeout refuses nothing
+  (`collect`). One `delegation` row now records the class when the core could not
+  answer (`noteDelegation`), so a silent fail-open is countable instead
   of invisible.
 - **opencode has no session-start hook**, so its always-on file must carry the
   pointer every hook host appends, and the per-session index, agent and contract
   refreshes ride the first `chat.message` instead (`bin/tezgah-setup::refresh_contract`,
-  `hosts/opencode/plugins/tezgah.js:2686-2701`). It denies the native `skill`
+  the `oncePerSession` checks in the `chat.message` hook of `hosts/opencode/plugins/tezgah.js`). It denies the native `skill`
   tool - the generated router replaces the injected skill list
   (`bin/tezgah-setup::install_opencode`) - and `permission.ask` may never be emitted by a
   given build, which is why `tool.execute.before` stays the enforcing half
-  (`hosts/opencode/plugins/tezgah.js:11-14`).
+  (the header comment of `hosts/opencode/plugins/tezgah.js`).
 - **Cursor only runs a PreToolUse hook for the tool types its matcher names**, so
   the matcher must list the write spellings or the gate's edit branches are
   unreachable there (`hosts/cursor/hook.py:33-42`,
@@ -414,7 +650,7 @@ In order, each step verified by the one below it:
   longer. A busy turn with every conditional rule armed measured 10288.
   `fit()` cuts the tail to `CONTEXT_MAX` and marks the cut, so the reminder and
   the first rules arrive (`hosts/cursor/hook.py::fit`, `hosts/cursor/hook.py::CONTEXT_MAX`).
-- **Claude, dsh, omp, codex and cursor run the gate only for the tool names
+- **Claude, dsh, omp, codex, cursor, qwen, droid, commandcode, copilot, gemini, antigravity, goose and amp run the gate only for the tool names
   their matcher carries**, so a name the PostToolUse side carries and the
   PreToolUse side does not is recorded in the ledger and never refused.
   `PowerShell` and `pwsh` are both `BASH_TOOLS` members
@@ -425,14 +661,65 @@ In order, each step verified by the one below it:
   `hosts/cursor/hooks.json:8` - neither named them until 2026-09-19, so a
   PowerShell call on those two reached no hook at all while the shared rules
   already knew the spelling), and omp's `GATED` list
-  (`hosts/omp/tezgah-hook.ts.in:270-273`). A host this list does not cover is a
-  host whose shell the gate cannot see.
+  (`GATED` in `hosts/omp/tezgah-hook.ts.in`). Qwen Code has two shell tool ids,
+  `run_shell_command` and `monitor`, which `bin/tezgah-setup::QWEN_PRETOOL_MATCHER`
+  names beside `notebook_edit` and `mcp__.*`. Claude's and dsh's `Monitor` runs a
+  shell command too, so their matcher names it. Droid's shell is `Execute`, which `bin/tezgah-setup::DROID_PRETOOL_MATCHER`
+  names beside `Create`, `Edit`, `ApplyPatch`, `Task`, `Grep` and `mcp__.*`. The
+  adapter hands ApplyPatch's `input` to the gate as `patch`
+  (`hosts/droid/hook.py::gate_input`). Command Code's settings hooks see only
+  four tools and test the matcher against their display names (`SHELL`, `READ`,
+  `WRITE`, `EDIT`), so `bin/tezgah-setup::COMMANDCODE_PRETOOL_MATCHER` is
+  `shell|write|edit`. Its read, MCP, subagent and web tools never reach the
+  gate, and plan mode skips every hook. The adapter folds a shell call's `args`
+  into `command` and hands an edit's `old_value`/`new_value` over as
+  `old_string`/`new_string` (`hosts/commandcode/hook.py::gate_input`). Copilot's
+  PascalCase PreToolUse reports Claude tool names and anchors its matcher. So
+  `bin/tezgah-setup::COPILOT_PRETOOL_MATCHER` names `Bash`, `Write`, `Edit`,
+  `Agent`, `Task` and `Grep`, plus `.+-.+` for an MCP tool's `<server>-<tool>`.
+  The adapter maps the runtime spellings too (`bash`, `powershell`, `create`,
+  `edit`, `apply_patch`, `task`, `grep`, `rg`). An Edit that names no file but
+  carries a patch reaches the gate as `apply_patch`. `<server>-<tool>` becomes
+  `mcp__<server>__<tool>` for a server `mcp-config.json` names
+  (`hosts/copilot/hook.py::gate_name`). Gemini's BeforeTool matcher is a regex
+  over the tool name. `bin/tezgah-setup::GEMINI_PRETOOL_MATCHER` names the
+  shell, write, edit and grep tools, the subagent tools
+  (`codebase_investigator`, `generalist`, `invoke_agent`) and `mcp_.*`. A user's own subagents are not
+  named. `mcp_<server>_<tool>` marks no boundary between server and tool, so it
+  reaches the gate as `mcp__<server>_<tool>` (`hosts/gemini/hook.py::gate_name`).
+  Antigravity's matcher is a regex over the tool name, and
+  `bin/tezgah-setup::ANTIGRAVITY_PRETOOL_MATCHER` names `run_command`,
+  `write_to_file`, `replace_file_content`, `multi_replace_file_content`,
+  `invoke_subagent` and `grep_search`. The adapter renames their PascalCase
+  arguments into the gate's fields (`hosts/antigravity/hook.py::gate_input`).
+  `CommandLine` becomes `command`, `TargetFile` and `CodeContent` become
+  `file_path` and `content`. `TargetContent` and `ReplacementContent` become
+  `old_string` and `new_string`, and `ReplacementChunks` becomes `edits`. The
+  docs name no MCP tool spelling, so the matcher names no MCP tool. It names
+  neither `manage_task`'s `send_input` nor `schedule`.
+  Goose tests a matcher unanchored, so `bin/tezgah-setup::GOOSE_PRETOOL_MATCHER`
+  anchors `shell`, `write`, `edit` and `.+__.+`, an extension's
+  `<extension>__<tool>`, which reaches the gate as `mcp__<extension>__<tool>`
+  (`hosts/goose/hook.py::gate_name`). The adapter hands `write`'s and `edit`'s
+  `path` over as `file_path`, and `edit`'s `before`/`after` as
+  `old_string`/`new_string` (`hosts/goose/hook.py::gate_input`). Goose's own
+  `developer`, `analyze`, `summon` and `code_execution` tools other than these
+  three, and its subagent tool, are not named.
+  Amp's plugin sends the gate `Bash`, `shell_command`, `edit_file`,
+  `create_file`, `apply_patch` and `Task` (its `GATED` list) and an MCP effect
+  name. A shell call's text reaches the gate as `command`, from Amp's
+  `shellCommandFromToolCall` helper or the input's `cmd`
+  (`hosts/amp/hook.py::gate_input`). Read, search, web and `code_exec` calls
+  are not gated, and an MCP tool reached through `code_exec` or `tool_search`
+  is never seen.
+  A host this list does not cover is a host whose shell the gate cannot see.
 - **An MCP effect reaches the gate on every host that can route it**. Claude
   and dsh run it through a PreToolUse group of its own in `hooks/hooks.json` and
   `hosts/dsh/hooks.json`. That group stays apart from the literal one, because
   one regex character would end its exact-name dialect. Its pattern names the
   effect verbs of `hooks/tezgah_integrity.py::MCP_VERBS`, and omp's `tool_call`
-  tests the same pattern (`MCP_EFFECT`, `hosts/omp/tezgah-hook.ts.in`). Both
+  tests the same pattern (`MCP_EFFECT`, `hosts/omp/tezgah-hook.ts.in`), as does
+  Amp's `tool.call` (`hosts/amp/tezgah-plugin.ts.in`). Both
   hosts read a matcher as an unanchored JavaScript `RegExp`, and the pattern
   uses no lookahead. A read-only MCP call, such as a code-graph query, spawns no
   hook there. Codex's matcher carries `mcp__.*` (`hosts/codex/hooks.json`).
@@ -446,7 +733,7 @@ In order, each step verified by the one below it:
 - **omp spawns the MCP `command` as one executable** and takes the rest in
   `args`; the whole argv in `command` fails with ENOENT (`bin/tezgah-setup::install_omp`),
   and `setStatus` strips ANSI, so only the widget path keeps the per-mark colors
-  (`hosts/omp/tezgah-hook.ts.in:170-173`).
+  (the comment above `draw` in `hosts/omp/tezgah-hook.ts.in`).
 - **omp drops browser MCP servers while its native browser is on**: a server
   named `playwright`/`puppeteer`/... or running `@playwright/mcp`/... never
   connects there (omp 18.2.11 `/mcp` listed codegraph, mobile-mcp and tezgah
@@ -465,6 +752,14 @@ In order, each step verified by the one below it:
 - `hosts/dsh/hooks.json`, `hosts/dsh/statusline/lib/index.js`
 - `hosts/omp/hook.py`, `hosts/omp/tezgah-hook.ts.in`
 - `hosts/opencode/plugins/tezgah.js`, `hosts/opencode/tui/tezgah-tui.tsx`
+- `hosts/qwen/hook.py`, `tests/e2e_qwen.py` (the opt-in run of the real binary)
+- `hosts/droid/hook.py`, `tests/e2e_droid.py` (the opt-in run of the real binary)
+- `hosts/commandcode/hook.py`
+- `hosts/copilot/hook.py`
+- `hosts/gemini/hook.py`
+- `hosts/antigravity/hook.py`
+- `hosts/goose/hook.py`
+- `hosts/amp/hook.py`, `hosts/amp/tezgah-plugin.ts.in`
 - `statusline.py`, `bin/tezgah-status`, `hooks/tezgah_context.py`
 - `hooks/tezgah_models.py` - the per-host model surface in `## The model wire`
 - `hooks/tezgah_stack.py`, `bin/tezgah-doctor` `--stack` - the order in `## Precedence`