@r1z4x/tezgah 1.6.0 → 1.7.0

package/hosts/codex/hook.py

@@ -29,7 +29,7 @@ try:
     from tezgah_context import (  # noqa: E402
         TOOL_USE_MEASURES, command_text, context_for, health_lines, record,
         shell_kind)
-    from tezgah_gate import decision, graph_advice  # noqa: E402
+    from tezgah_gate import cross_project_note, decision, graph_advice  # noqa: E402
     from tezgah_integrity import (  # noqa: E402
         SUBAGENT_CHANNEL, bind_session, changed_files_notice, note_tool, ran_nothing,
         report_bytes, stop_reason, untrusted_source)
@@ -39,10 +39,6 @@ try:
 except Exception as exc:
     import_failed(exc)
 
-# How many times one stop chain may be refused (hooks/projects-stop.py names the
-# same constant): one, deliberately; raising it is owner decision 11.
-STOP_REASKS = 1
-
 EVENTS = {
     "SessionStart": "session_start",
     "UserPromptSubmit": "user_prompt",
@@ -210,7 +206,10 @@ def main():
         # (hooks/tezgah_taste.write_note), on the same channel
         taste = (safe(session_id, write_note, session_id, inp, cwd, tool)
                  if root_for(cwd) and not verify_outcome(payload) else None)
-        notice = "\n".join(p for p in (notice, advice, taste) if p)
+        # the cross-project write notice (tezgah_gate.cross_project_note)
+        cross = (safe(session_id, cross_project_note, session_id, tool, inp, cwd)
+                 if root_for(cwd) and not verify_outcome(payload) else None)
+        notice = "\n".join(p for p in (notice, advice, taste, cross) if p)
         if notice:
             # Codex's PostToolUse output carries `additionalContext` with the
             # result - the field is part of its own hook output schema
@@ -228,13 +227,13 @@ def main():
         # {"decision": "block", "reason": ...}, so the integrity rule's second
         # half runs here too: a done/tested claim with nothing observed behind it
         # cannot end the turn. `verify-off` drops it; outside a root it is inert.
-        # The reply after a block (`stop_hook_active`) is judged record-only:
-        # one `after_block` row, never a second block (STOP_REASKS).
+        # The reply after a block (`stop_hook_active`) is judged again and
+        # refused at most once more, for a class this turn was not refused for
+        # yet; otherwise it is one `after_block` row (tezgah_integrity._record_only).
         if not off("verify-off") and root_for(cwd):
-            blocked = 1 if payload.get("stop_hook_active") else 0
             reason = safe(session_id, stop_reason,
                           payload.get("last_assistant_message"), session_id,
-                          cwd=cwd, record_only=blocked >= STOP_REASKS)
+                          cwd=cwd, after_block=bool(payload.get("stop_hook_active")))
             if reason:
                 out["decision"] = "block"
                 out["reason"] = reason

package/hosts/cursor/hook.py

@@ -48,10 +48,10 @@ from tezgah_guard import attest_session, import_failed, safe  # noqa: E402
 try:
     from tezgah_context import (  # noqa: E402
         command_text, context_for, record, shell_kind, slug, under)
-    from tezgah_gate import decision, explored, graph_advice  # noqa: E402
+    from tezgah_gate import cross_project_note, decision, explored, graph_advice  # noqa: E402
     from tezgah_integrity import (  # noqa: E402
         SUBAGENT_CHANNEL, bind_session, note, note_tool, ran_nothing, report_bytes,
-        stop_reason)
+        residual_text, stop_reason)
     from tezgah_paths import off  # noqa: E402
     import tezgah_store  # noqa: E402
     from tezgah_taste import write_note  # noqa: E402
@@ -59,12 +59,10 @@ try:
 except Exception as exc:
     import_failed(exc)
 
-# How many times one stop chain may be refused (hooks/projects-stop.py names the
-# same constant): one, deliberately; raising it is owner decision 11. Cursor's
-# `stop` payload carries `loop_count` (the follow-ups already sent in this chain)
-# and no `stop_hook_active` (cursor-agent 2026.10.01, captured 2026-10-07); the
-# flag is still read for a build that sends it.
-STOP_REASKS = 1
+# Cursor's `stop` payload carries `loop_count` (the follow-ups already sent in
+# this chain) and no `stop_hook_active` (cursor-agent 2026.10.01, captured
+# 2026-10-07); the flag is still read for a build that sends it. The count goes
+# to the core, which owns the re-ask budget (tezgah_integrity._record_only).
 
 
 def asked(payload):
@@ -251,14 +249,17 @@ def remember_answer(session_id, text):
     one is stored as that many characters of its head, `ANSWER_CUT` with the
     count of what was dropped, then `ANSWER_TAIL` characters of its tail - so
     both the opener the Stop rule reads and the closing marker it must not lose
-    survive the round trip. A reply with no `conversation_id` is not stored; a
-    store that cannot be written is not fatal."""
+    survive the round trip. A residual section the cut would drop (plan 080:
+    "Açık kalanlar" in the middle of a long reply) is kept, label and items,
+    between the cut marker and the tail. A reply with no `conversation_id` is
+    not stored; a store that cannot be written is not fatal."""
     if not session_id or not text:
         return
     text = str(text)
     dropped = len(text) - ANSWER_HEAD - ANSWER_TAIL
     if dropped > 0:
-        text = text[:ANSWER_HEAD] + ANSWER_CUT % dropped + text[-ANSWER_TAIL:]
+        text = (text[:ANSWER_HEAD] + ANSWER_CUT % dropped
+                + residual_text(text[ANSWER_HEAD:-ANSWER_TAIL]) + text[-ANSWER_TAIL:])
     tezgah_store.put_doc("cursor_answer", answer_key(session_id), text)
 
 
@@ -316,7 +317,11 @@ def dispatch(payload):
         # (hooks/tezgah_taste.write_note)
         taste = (write_note(session_id, inp, cwd, gate_name(payload.get("tool_name", "")))
                  if under(cwd) and not call_failed(payload) else None)
-        text = "\n".join(t for t in (notice, reinforce, advice, taste) if t)
+        # the cross-project write notice (tezgah_gate.cross_project_note)
+        cross = (cross_project_note(session_id, gate_name(payload.get("tool_name", "")),
+                                    inp, cwd)
+                 if under(cwd) and not call_failed(payload) else None)
+        text = "\n".join(t for t in (notice, reinforce, advice, taste, cross) if t)
         out = {"additional_context": text} if text else {}
     elif event == "postToolUseFailure":
         if kind:
@@ -421,10 +426,12 @@ def dispatch(payload):
         # Only a finished turn is nudged - an aborted or errored one has no claim
         # to check - and `loop_count` is the platform's own cap on follow-ups.
         out = {}
+        # The reply a follow-up started is judged again: the core refuses it at
+        # most once more, for a class this turn was not refused for yet.
         if (payload.get("status") in (None, "completed")
-                and asked(payload) < STOP_REASKS
                 and not off("verify-off") and under(cwd)):
-            reason = stop_reason(last_answer(session_id), session_id, cwd=cwd)
+            reason = stop_reason(last_answer(session_id), session_id, cwd=cwd,
+                                 after_block=asked(payload))
             if reason:
                 out = {"decision": "block", "reason": reason}
     elif event == "beforeSubmitPrompt":

package/hosts/dsh/hooks.json

@@ -10,12 +10,12 @@
       { "hooks": [ { "type": "command", "command": "\"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-auto-init.py\"", "timeout": 10 } ] }
     ],
     "PreToolUse": [
-      { "matcher": "Agent|agent|Task|task|Grep|grep|Bash|bash|PowerShell|pwsh|Shell|shell|subagent|Edit|Write|MultiEdit|NotebookEdit", "hooks": [ { "type": "command", "command": "\"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-pretooluse.py\"", "timeout": 5 } ] },
+      { "matcher": "Agent|agent|Task|task|Grep|grep|Bash|bash|PowerShell|pwsh|Shell|shell|subagent|Edit|Write|MultiEdit|NotebookEdit|AskUserQuestion", "hooks": [ { "type": "command", "command": "\"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-pretooluse.py\"", "timeout": 5 } ] },
       { "matcher": "^mcp__(?:.*[^A-Za-z0-9])?(?:append|cancel|clear|click|close|comment|commit|copy|create|delete|deploy|drag|edit|email|evaluate|exec|execute|fill|insert|install|kill|launch|merge|message|mkdir|move|navigate|notify|patch|pause|post|press|print|publish|push|put|release|remove|rename|replace|reply|resume|review|run|save|send|set|share|skip|start|stop|submit|swipe|tag|tap|terminate|type|uninstall|update|upload|write)(?:[^A-Za-z0-9].*)?$", "hooks": [ { "type": "command", "command": "\"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-pretooluse.py\"", "timeout": 5 } ] }
     ],
     "PostToolUse": [
       { "matcher": "Edit|edit|Write|write|MultiEdit|NotebookEdit|Bash|bash|PowerShell|pwsh|str_replace_editor|WebFetch|WebSearch|web_fetch|web_search|fetch|mcp__.*", "hooks": [ { "type": "command", "command": "TEZGAH_CALL_OUTCOME=none \"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-posttooluse.py\"", "timeout": 5 } ] },
-      { "matcher": "Agent|Task|Skill", "hooks": [ { "type": "command", "command": "TEZGAH_CALL_OUTCOME=none \"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-posttooluse.py\"", "timeout": 5 } ] }
+      { "matcher": "Agent|Task|Skill|TodoWrite", "hooks": [ { "type": "command", "command": "TEZGAH_CALL_OUTCOME=none \"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-posttooluse.py\"", "timeout": 5 } ] }
     ]
   }
 }

package/hosts/omp/hook.py

@@ -8,7 +8,7 @@ the gate and the evidence ledger underneath are the shared core in `hooks/`,
 the same code every other host runs.
 
     {"event": "session_start", "cwd": ..., "session_id": ..., "subagent": bool,
-     "parent": <the main session's id>, "agent": <the child's AgentId>}
+     "parent": <the main session's id>, "agent": <the child's AgentId>, "fork_of": <id>}
         -> {"context": <this repo's live state, or the subagent brief>,
             "status": "pony✓ ...", "idx": glyph}
     {"event": "status", "cwd": ..., "session_id": ...}
@@ -19,10 +19,11 @@ the same code every other host runs.
     {"event": "user_prompt", "cwd": ..., "prompt": ...}
         -> {"context": <reminder + the rules this prompt arms>}
     {"event": "pre_tool_use", "cwd": ..., "tool": ..., "input": {...}}
-        -> {"deny": reason} | {"advice": line} (the graph line the bridge hands
-           the model with this call's result; never a block)
+        -> {"deny": reason} | {"advice": line} (the graph line, the idle-wait
+           warning on a `wait`, or the ask-policy warning on an `ask`, the
+           bridge hands the model with this call's result; never a block)
     {"event": "post_tool_use", "cwd": ..., "tool": ..., "input": {...},
-     "failed": bool, "idx": glyph}
+     "failed": bool, "idx": glyph, "todo": [...]}
         -> {"status": "pony✓ ...", "idx": glyph, "label": one line}
            (records the evidence the Stop rule reads; `idx` echoed from the
            payload skips the git probe; `label` is the untrusted-content notice
@@ -31,8 +32,9 @@ the same code every other host runs.
            and is absent for every ordinary result)
     {"event": "stop", "last_assistant_message": ..., "stop_hook_active": bool}
         -> {"decision": "block", "reason": reason}
-           (with `stop_hook_active` the reply is recorded as an `after_block`
-           row and never blocked a second time)
+           (the reply after a block is judged again and refused at most once
+           more, for a class this turn was not refused for yet; otherwise it is
+           recorded as an `after_block` row - tezgah_integrity._record_only)
 
 Every answer that carries the line carries `idx` with it - the glyph of the
 line's idx mark - so the caller can hand it back on the redraws that must not
@@ -58,7 +60,9 @@ try:
     from tezgah_context import (  # noqa: E402
         color_default, command_text, context_for, health_segments, record,
         render_tiers, shell_kind, skill_read_kind)
-    from tezgah_gate import decision, graph_advice  # noqa: E402
+    from tezgah_gate import (  # noqa: E402
+        ask_advice, cross_project_note, decision, graph_advice, ready_advice,
+        spawn_advice)
     from tezgah_integrity import (  # noqa: E402
         SUBAGENT_CHANNEL, bind_session, note, note_tool, stop_reason, untrusted_label,
         untrusted_source)
@@ -68,10 +72,9 @@ try:
 except Exception as exc:
     import_failed(exc)
 
-# How many times one stop chain may be refused (hooks/projects-stop.py names the
-# same constant): one, deliberately; raising it is owner decision 11. omp has no
-# subagent-end event: `session_stop` does not fire for task sessions.
-STOP_REASKS = 1
+# omp has no subagent-end event: `session_stop` does not fire for task sessions,
+# so the bridge sends `subagent_stop` from the child's terminal `agent_end`.
+# The re-ask budget is the core's (tezgah_integrity.STOP_REASKS, plan 083).
 
 
 def classify(tool, inp):
@@ -148,7 +151,10 @@ def handle(payload):
         reason = decision(tool, inp, cwd, session_id)
         if reason:
             return {"deny": reason}
-        advice = graph_advice(tool, inp, cwd, "omp")
+        advice = (graph_advice(tool, inp, cwd, "omp")
+                  or ready_advice(tool, session_id, cwd)
+                  or spawn_advice(tool, inp, session_id, cwd)
+                  or ask_advice(tool, inp, session_id, cwd))
         return {"advice": advice} if advice else {}
     if not root_for(cwd):
         return {}
@@ -170,6 +176,11 @@ def handle(payload):
             # `tezgah-route --report` joins the two through this row
             note(session_id, "spawned", "", parent=str(payload["parent"]),
                  agent=payload.get("agent"))
+        elif payload.get("fork_of"):
+            # an omp fork names the session it was forked from: the race rule
+            # names that relation instead of an opaque ledger id
+            # (tezgah_integrity._relation)
+            note(session_id, "forked", "", parent=str(payload["fork_of"]))
         context = context_for(kind, cwd, dict(payload, host="omp"),
                               with_core=False)
         if context:
@@ -229,7 +240,8 @@ def handle(payload):
                   failed=failed if isinstance(failed, bool) else None,
                   out_bytes=size if isinstance(size, int) and size >= 0 else None,
                   source=source, cwd=cwd,
-                  empty_run=payload.get("empty_run") is True)
+                  empty_run=payload.get("empty_run") is True,
+                  todo=payload.get("todo") if isinstance(payload.get("todo"), list) else None)
         if str(tool).lower() == "task" and isinstance(inp.get("tasks"), list):
             # omp names a child's ledger by its task name (`<parent>/<name>.jsonl`)
             # and only this call knows which agent that name runs - `task` when
@@ -248,25 +260,34 @@ def handle(payload):
         # reads where the text came from - or, on an effect after such a read,
         # the taint notice - while it reads the result.
         # the opt-in taste note for the first write to this file type
-        # (hooks/tezgah_taste.write_note) rides the same label
+        # (hooks/tezgah_taste.write_note) and the cross-project write notice
+        # (hooks/tezgah_gate.py::cross_project_note) ride the same label
         taste = (safe(session_id, write_note, session_id, inp, cwd, tool)
                  if failed is not True else None)
-        label = "\n".join(t for t in (label, taste) if t)
+        cross = (safe(session_id, cross_project_note, session_id, tool, inp, cwd)
+                 if failed is not True else None)
+        label = "\n".join(t for t in (label, taste, cross) if t)
         if label:
             out["label"] = label
         return out
     if event == "stop":
         if off("verify-off"):
             return {}
-        if (1 if payload.get("stop_hook_active") else 0) >= STOP_REASKS:
-            # the reply after a block: recorded, never refused a second time,
-            # under its own guard so a record that fails still answers empty
-            safe(session_id, stop_reason, payload.get("last_assistant_message"),
-                 session_id, cwd=cwd, record_only=True)
-            return {}
-        reason = stop_reason(payload.get("last_assistant_message"), session_id,
-                             cwd=cwd)
+        # the reply after a block is judged again; the core decides from the
+        # turn's ledger whether it may be refused once more (plan 083), and a
+        # core that raises has refused nothing
+        reason = safe(session_id, stop_reason,
+                      payload.get("last_assistant_message"), session_id,
+                      cwd=cwd, after_block=bool(payload.get("stop_hook_active")))
         return {"decision": "block", "reason": reason} if reason else {}
+    if event == "subagent_stop":
+        # record-only (ADR 011): judged on the child's own rows, the row lands
+        # in the parent's ledger so the parent's Stop reads its residual count
+        if not off("verify-off") and payload.get("parent"):
+            safe(session_id, stop_reason, payload.get("last_assistant_message"),
+                 session_id, cwd=cwd, subagent=True, agent=payload.get("agent"),
+                 parent=str(payload["parent"]))
+        return {}
     return {}
 
 

package/hosts/omp/tezgah-hook.ts.in

@@ -1,5 +1,5 @@
 import { execFileSync } from "node:child_process";
-import { existsSync, readdirSync } from "node:fs";
+import { closeSync, existsSync, openSync, readdirSync, readSync } from "node:fs";
 import { basename, delimiter, dirname, join } from "node:path";
 
 // tezgah-setup substitutes the absolute path of hosts/omp/hook.py, the python
@@ -206,10 +206,12 @@ function draw(ctx: any, line: string,
 // the Stop rule reads, or arrive from outside the user and the workspace.
 // read/grep/glob are absent on purpose: a read-heavy turn would otherwise spawn
 // python per call for nothing. The three web tools are here because their result
-// is exactly the one the untrusted-content label exists for.
+// is exactly the one the untrusted-content label exists for. `todo` and `wait`
+// are the orchestrator's queue and its idle call (tezgah_integrity.note_todo).
 const WATCHED = ["bash", "shell", "command", "edit", "write", "multiedit",
   "notebookedit", "apply_patch", "edit_file", "write_file", "search_replace",
-  "task", "agent", "spawn_agent", "web_search", "web_fetch", "browser"];
+  "task", "agent", "spawn_agent", "web_search", "web_fetch", "browser", "todo",
+  "wait"];
 
 // A read of a tezgah skill file is the one read whose result moves a status
 // mark, and matching it here keeps the rule that made reads unwatched: ordinary
@@ -266,9 +268,11 @@ function skillRead(tool: string, args: any): boolean {
 // checks (bash), the test-skip check (the edit/write names), and the code-graph
 // nudge on omp's search tools (grep, find, search, ast_grep). An MCP tool is
 // consulted when its name carries an effect verb (MCP_EFFECT, see `tool_call`).
+// `wait` gets the idle-wait warning (tezgah_gate.ready_advice) and `ask` the
+// ask-policy warning (tezgah_gate.ask_advice), never a block.
 const GATED = ["grep", "find", "search", "ast_grep", "bash", "shell", "command",
   "task", "agent", "edit", "write", "multiedit", "notebookedit", "apply_patch",
-  "edit_file", "write_file", "search_replace", "powershell", "pwsh"];
+  "edit_file", "write_file", "search_replace", "powershell", "pwsh", "wait", "ask"];
 
 // The gate's non-blocking graph line (tezgah_gate.graph_advice), held from the
 // call to its result: `tool_call` can only block, `tool_result` can hand the
@@ -311,6 +315,44 @@ function emptyRun(content: any): boolean {
   return EMPTY_RUN.test(text.slice(-EMPTY_RUN_TAIL));
 }
 
+// The text of the newest assistant message in an agent_end `messages` list:
+// the subagent's final report, which the hook reads like a Stop reply.
+function lastReply(messages: any): string | undefined {
+  if (!Array.isArray(messages)) return undefined;
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const m = messages[i];
+    if (m?.role !== "assistant") continue;
+    if (typeof m.content === "string") return m.content;
+    if (Array.isArray(m.content)) {
+      return m.content.map((p: any) => (p?.type === "text" && typeof p.text === "string"
+                                        ? p.text : "")).join("\n");
+    }
+  }
+  return undefined;
+}
+
+// The id of the session that spawned this one: the `session` header line of the
+// file `parentSession` names, so a grandchild's end reaches the child that
+// spawned it. The main session's exported id stands in when that file cannot be
+// read; only the first SESSION_HEAD bytes are read, never the transcript.
+const SESSION_HEAD = 16384;
+function parentSessionId(ctx: any): string | undefined {
+  try {
+    const file = String(ctx?.sessionManager?.getHeader?.()?.parentSession ?? "");
+    const fd = openSync(file, "r");
+    const buf = Buffer.alloc(SESSION_HEAD);
+    const n = readSync(fd, buf, 0, SESSION_HEAD, 0);
+    closeSync(fd);
+    for (const line of buf.subarray(0, n).toString("utf8").split("\n")) {
+      try {
+        const row = JSON.parse(line);
+        if (row?.type === "session" && row.id) return String(row.id);
+      } catch { /* a title line cut at the buffer's end, or another row */ }
+    }
+  } catch { /* no readable parent file: the exported id below */ }
+  return process.env.TEZGAH_SESSION || undefined;
+}
+
 // The hook's failure is the one state the bridge can see and the hook cannot
 // report: no interpreter to start it with, the checkout moved, the hook crashed
 // or ran past the timeout. It is remembered here so the next event can say so.
@@ -387,6 +429,15 @@ function sessionOf(ctx: any): string | undefined {
   }
 }
 
+// The session file is omp's transcript: the router-context line reads it.
+function sessionFileOf(ctx: any): string | undefined {
+  try {
+    return ctx?.sessionManager?.getSessionFile?.() ?? undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 // A task subagent runs in its own session with the same extensions, so it gets
 // session_start too. It must get the subagent brief, not the parent's payload:
 // the parent's runs the indexer, regenerates the agents and tells the model to
@@ -409,6 +460,20 @@ function isSubagent(ctx: any): boolean {
   }
 }
 
+// The session an omp fork was forked from: a main session whose header still
+// names a `parentSession` (an id, or a `<stamp>_<id>.jsonl` path). The hook
+// writes it as a `forked` row, so the race rule names a fork as one instead of
+// an opaque ledger id. "" for a session that is no fork.
+function forkParent(ctx: any): string {
+  try {
+    const parent = String(ctx?.sessionManager?.getHeader?.()?.parentSession ?? "");
+    const stem = basename(parent.replace(/\\/g, "/"), ".jsonl");
+    return stem.slice(stem.lastIndexOf("_") + 1);
+  } catch {
+    return "";
+  }
+}
+
 export default function tezgahOmp(pi: any): void {
   // The idx glyph the last probed answer carried. omp redraws the line after
   // every watched tool and the stamp probe behind that mark is the line's only
@@ -538,6 +603,16 @@ export default function tezgahOmp(pi: any): void {
     tool = "";
     stopMotion();
     paint(ctx);
+    // omp fires no session_stop for a task subagent, so its end is recorded
+    // here: the child's last reply, judged record-only, lands in the parent's
+    // ledger with its untyped residual count (ADR 011, S4 finding 2).
+    const parent = isSubagent(ctx) ? parentSessionId(ctx) : undefined;
+    if (parent && event?.willContinue !== true) {
+      ask({ event: "subagent_stop", cwd: cwdOf(ctx), session_id: sessionOf(ctx),
+            parent,
+            agent: basename(String(ctx?.sessionManager?.getSessionFile?.() ?? ""), ".jsonl"),
+            last_assistant_message: lastReply(event?.messages) });
+    }
   });
   pi.on("session_shutdown", async () => {
     busy = false;
@@ -559,8 +634,10 @@ export default function tezgahOmp(pi: any): void {
       ? { parent: process.env.TEZGAH_SESSION,
           agent: basename(String(ctx?.sessionManager?.getSessionFile?.() ?? ""), ".jsonl") }
       : {};
+    const fork = subagent ? "" : forkParent(ctx);
     const res = ask({ event: "session_start", cwd: cwdOf(ctx),
-                      session_id: session, subagent, ...link });
+                      session_id: session, subagent, ...link,
+                      ...(fork ? { fork_of: fork } : {}) });
     if (hookError) {
       const notice = failureNotice(ctx, session);
       if (notice) {
@@ -626,8 +703,10 @@ export default function tezgahOmp(pi: any): void {
     // again.
     const prompt = String(event?.prompt ?? "").trim();
     if (!prompt) return undefined;
+    // `subagent`: a task prompt is the parent's brief, never the user's grant
     const res = ask({ event: "user_prompt", cwd: cwdOf(ctx), prompt,
-                      session_id: session });
+                      session_id: session, transcript_path: sessionFileOf(ctx),
+                      subagent: isSubagent(ctx) });
     if (hookError) return noticeMessage(ctx, session);
     if (!res.context) return undefined;
     // A hidden message, not a system-prompt rewrite: omp keeps per-request
@@ -683,10 +762,17 @@ export default function tezgahOmp(pi: any): void {
     const content = event?.content;
     const resultLen = typeof content === "string" ? content.length
       : Array.isArray(content) ? content.length : undefined;
+    // omp's todo call holds one op and its result's `details.phases` the whole
+    // list, so that list crosses for this one tool: the queue the Stop rule and
+    // the idle-wait warning read (tezgah_integrity.note_todo).
+    const phases = tool.toLowerCase() === "todo" ? event?.details?.phases : undefined;
+    const todo = Array.isArray(phases)
+      ? phases.flatMap((p: any) => (Array.isArray(p?.tasks) ? p.tasks : []))
+      : undefined;
     const res = ask({ event: "post_tool_use", cwd: cwdOf(ctx), tool,
                       input: event?.input ?? {}, failed, idx: idxGlyph,
                       session_id: sessionOf(ctx), result_len: resultLen,
-                      empty_run: emptyRun(content) || undefined });
+                      empty_run: emptyRun(content) || undefined, todo });
     if (hookError) return markBroken(ctx);
     show(ctx, res);
     // A result that came from outside the user and the workspace is labelled in

package/hosts/opencode/plugins/tezgah.js

@@ -40,7 +40,8 @@
 //     second and third halves - the channel on the call's own ledger row (with
 //     the `external` row an MCP answer or a fetched page earns), the provenance
 //     label in front of the result itself, and the taint notice on the first
-//     effect a turn makes after such a read (hooks/tezgah_untrusted.marks).
+//     effect a turn makes after such a read (hooks/tezgah_untrusted.marks); a
+//     `task` call also writes its slice record (noteSlice, bin/tezgah-task).
 //
 // Known gap: every rule of hooks/tezgah_gate.py is enforced here, but the ledger
 // the counters read is complete only for the rules ported last - secret, loop,
@@ -1158,6 +1159,49 @@ const DETAIL_MAX = 200
 // agree on the credential itself; they differ only for an astral character
 // inside a quoted named value.
 
+// The `todo` row for `todowrite` (hooks/tezgah_integrity.note_todo): the list's
+// open, ready and blocked counts, the ready heads in `heads` and `detail`. Typed
+// blockers: BLOCKER_SAID/BLOCKER_TRIED's tokens - every hooks/lang/<code>.json
+// pack's `blockers.<kind>.pattern`, DECISION and KARAR alike - on Unicode word
+// boundaries (JS `\b` is ASCII-only); no pack found matches none, as `alts`
+// does. Read once, on the first todo call. ponytail: without the Python
+// reader's negation rule.
+const TODO_CLOSED = new Set(["completed", "done", "cancelled", "abandoned"])
+let todoTyped = null
+function todoTypedPattern() {
+  if (todoTyped) return todoTyped
+  const kinds = { decision: [], irreversible: [], access: [], env: [] }
+  const dir = hookScript("lang")
+  try {
+    for (const name of dir ? readdirSync(dir).sort() : []) {
+      if (!name.endsWith(".json")) continue
+      const blockers = JSON.parse(readFileSync(join(dir, name), "utf8")).blockers || {}
+      for (const kind of Object.keys(kinds)) {
+        if (blockers[kind]?.pattern) kinds[kind].push(blockers[kind].pattern)
+      }
+    }
+  } catch {}
+  const alt = (...names) => names.flatMap((k) => kinds[k]).join("|") || "(?!)"
+  todoTyped = new RegExp("(?<![\\p{L}\\p{N}_])(?:(?:" + alt("decision", "irreversible")
+    + ")[A-ZÇĞİIÖŞÜ]*|" + alt("access", "env") + ")(?![\\p{L}\\p{N}_])", "u")
+  return todoTyped
+}
+async function recordTodo(sessionID, tool, args, workspace) {
+  if (!Array.isArray(args?.todos)) return
+  const open = args.todos.filter((i) => i && String(i.content || "").trim()
+    && !TODO_CLOSED.has(String(i.status || "pending").toLowerCase()))
+  const typed = (i) => todoTypedPattern().test(i.content) || /\bblocked\b/i.test(i.content)
+  const heads = open.filter((i) => String(i.status || "pending").toLowerCase() === "pending"
+    && !typed(i)).map((i) => redact(String(i.content).split(/\s+/).join(" ").trim())
+    .slice(0, 60))
+  await appendRow(sessionID, {
+    kind: "todo", ts: Math.floor(Date.now() / 1000),
+    detail: heads.join("\n").slice(0, DETAIL_MAX),
+    id: actionID(tool, args), workspace: workspace || null, tool,
+    open: open.length, ready: heads.length, blocked: open.filter(typed).length, heads,
+  })
+}
+
 // Evidence ledger, the store the Python gate and Stop hook read. Written
 // per tool call so a "done/tested" claim can be checked against what ran.
 // The bash tool returns `metadata.exit` (the process exit code), so a check's
@@ -1181,6 +1225,7 @@ async function recordEvidence(sessionID, tool, args, result, workspace, cwd,
                               source) {
   if (!sessionID) return
   const t = String(tool || "").toLowerCase()
+  if (t === "todowrite") return await recordTodo(sessionID, tool, args, workspace)
   const exit = result?.metadata?.exit
   let kind = null
   let detail = String(args?.command || writtenPath(args) || "")
@@ -1259,6 +1304,60 @@ async function recordEvidence(sessionID, tool, args, result, workspace, cwd,
   }
 }
 
+// The slice journal (hooks/tezgah_task.py, plan 081). opencode's `task` call
+// runs its child to the end before this hook sees it, so one call opens the
+// record and closes it - done, or stopped with the error's class - through
+// bin/tezgah-task, the records' one writer. The id is the child session opencode
+// reports (`metadata.sessionId`), else the first 12 hex digits of the brief's
+// sha1 (tezgah_task.slice_id). Awaited under the core deadline and never thrown:
+// a journal that cannot be written costs the record, not the call.
+const TASK_BIN = join(CONFIG, "bin", "tezgah-task")
+const SLICE_ID = /^[A-Za-z0-9._-]{1,80}$/
+const SLICE_BRIEF = 4000
+// tezgah_task._CLASSES, in its order: the class a stopped record carries, and
+// `error` for any other failure text.
+const SLICE_CLASSES = [
+  ["rate_limit", /\b429\b|rate[ _-]?limit/i],
+  ["quota", /quota|key limit exceeded|usage limit|\b40[23]\b.*\blimit|\blimit\b.*\b40[23]\b/i],
+  ["aborted", /abort|cancell?ed/i],
+  ["timeout", /timed out|timeout/i],
+  ["cut_off", /max[ _]turns|max_tokens|cut off|context[ _]length/i],
+]
+
+function sliceClass(text) {
+  const hit = SLICE_CLASSES.find(([, re]) => re.test(text))
+  return hit ? hit[0] : "error"
+}
+
+// The error a `task` result reports, as text, or "" for none.
+function sliceError(result) {
+  for (const e of [result?.error, result?.metadata?.error]) {
+    const text = typeof e === "string" ? e : String(e?.message || e?.name || "")
+    if (e && text.trim()) return text.trim()
+  }
+  return ""
+}
+
+async function noteSlice(sessionID, args, result, cwd) {
+  if (!existsSync(TASK_BIN) || await off("slices-off", sessionID)) return
+  const brief = [args?.description, args?.prompt].map((p) => String(p || "").trim())
+    .filter(Boolean).join("\n\n").slice(0, SLICE_BRIEF)
+  if (!brief) return
+  const child = String(result?.metadata?.sessionId || result?.metadata?.session_id || "")
+  const id = SLICE_ID.test(child) ? child
+    : createHash("sha1").update(brief).digest("hex").slice(0, 12)
+  const run = (argv) => collect([TASK_BIN, "slice", ...argv],
+                                { cwd, stdio: ["ignore", "pipe", "ignore"] }, null,
+                                (code) => code === 0)
+  const opened = await run(["open", "--id", id, "--kind", "agent", "--host", "opencode",
+                            "--agent", String(args?.subagent_type || ""),
+                            "--brief", brief, "--parent", String(sessionID || ""),
+                            "--cwd", cwd])
+  if (!opened) return
+  const error = sliceError(result)
+  await run(error ? ["stop", id, "--class", sliceClass(error)] : ["done", id])
+}
+
 // How far back the pre-state search reads: the gate writes its snapshot row in
 // the call immediately before the write, so the newest rows are where it is
 // (SNAPSHOT_TAIL in hooks/tezgah_integrity).
@@ -2224,7 +2323,7 @@ const SWITCHES = new Set(["adhd-off", "consult-off", "docs-judge-off",
   "exec-mode.off", "judge-off", "lang-off", "orchestrate-off",
   "ponytail-auto.off", "pretooluse-off", "reminder-off", "research-off",
   "spec-off", "task-off", "triage-off", "verify-off", "workspace-off",
-  "agents-off", "skill-suggest-on", "taste-on", "update-check-off"])
+  "agents-off", "skill-suggest-on", "slices-off", "taste-on", "update-check-off"])
 
 // The session latch, mirrored from hooks/tezgah_paths.off: with a session id, a
 // switch file whose ctime or mtime is newer than the session ledger's first row
@@ -2923,6 +3022,7 @@ export const Tezgah = async ({ directory }) => {
         const taste = await recordEvidence(sessionID, tool, args, output, workspace,
                                            dir, own || inherited)
         if (taste) labelResult(output, taste)
+        if (tool === "task") await noteSlice(sessionID, args, output, dir)
       } catch {}
     },