@r1z4x/tezgah 1.6.0 → 1.8.2

package/hooks/tezgah_taste.py

@@ -27,7 +27,8 @@ import time
 
 import tezgah_integrity as ti
 import tezgah_paths
-from tezgah_paths import _toplevel, armed, root_for, workspace_from_repo
+from tezgah_paths import (_linked_main_at, _toplevel, armed, root_for,
+                          workspace_from_repo)
 
 ARM = "taste-on"
 LEARN_EVERY = 3600  # seconds between two background `learn` starts per repo
@@ -46,7 +47,8 @@ WHOLE_KEYS = ("content", "file_text", "text", "new_source")
 
 def enabled(cwd):
     """The git root taste rows for `cwd` go to, or None when capture is off
-    there. The marker is read first, so the default costs two stats."""
+    there: a linked worktree's rows go to its main checkout, the one `.tezgah`
+    of the repository. The marker is read first, so the default costs two stats."""
     try:
         if not cwd or not armed(ARM):
             return None
@@ -54,6 +56,7 @@ def enabled(cwd):
         if not root_for(real):
             return None
         top = _toplevel(real)
+        top = top and (_linked_main_at(top) or top)
         if not top or not os.path.isdir(os.path.join(top, ".tezgah")):
             return None
         from tezgah_context import repo_marks  # imports this module's callers
@@ -73,10 +76,11 @@ def _cut(text, limit):
 
 
 def _rel(root, path, cwd):
-    """`path` relative to `root`, or None when it resolves outside it."""
+    """`path` relative to the checkout holding `cwd` (a worktree's paths read
+    the same as main's), or None when it resolves outside it."""
     apath = os.path.realpath(
         str(path) if os.path.isabs(str(path)) else os.path.join(cwd, str(path)))
-    rel = os.path.relpath(apath, root)
+    rel = os.path.relpath(apath, _toplevel(os.path.realpath(cwd)) or root)
     return None if rel == ".." or rel.startswith(".." + os.sep) else rel
 
 

package/hosts/codex/hook.py

@@ -29,9 +29,9 @@ try:
     from tezgah_context import (  # noqa: E402
         TOOL_USE_MEASURES, command_text, context_for, health_lines, record,
         shell_kind)
-    from tezgah_gate import decision, graph_advice  # noqa: E402
+    from tezgah_gate import cross_project_note, decision, graph_advice  # noqa: E402
     from tezgah_integrity import (  # noqa: E402
-        SUBAGENT_CHANNEL, bind_session, changed_files_notice, note_tool, ran_nothing,
+        SUBAGENT_CHANNEL, bind_session, changed_files_notice, note, note_tool, ran_nothing,
         report_bytes, stop_reason, untrusted_source)
     from tezgah_paths import HOST_DIRS, off, root_for  # noqa: E402
     from tezgah_taste import write_note  # noqa: E402
@@ -39,10 +39,6 @@ try:
 except Exception as exc:
     import_failed(exc)
 
-# How many times one stop chain may be refused (hooks/projects-stop.py names the
-# same constant): one, deliberately; raising it is owner decision 11.
-STOP_REASKS = 1
-
 EVENTS = {
     "SessionStart": "session_start",
     "UserPromptSubmit": "user_prompt",
@@ -112,7 +108,16 @@ def gate_reason(payload, cwd, session_id):
     inp = payload.get("tool_input")
     if not isinstance(inp, dict):
         inp = {}
-    return decision(gate_name(name), inp, cwd, session_id)
+    # a subagent's calls carry its `agent_id` (the child thread id; optional in
+    # pre-tool-use.command.input.schema.json): its repeat ceilings are its own
+    return decision(gate_name(name), inp, cwd, session_id, agent=subagent_id(payload))
+
+
+def subagent_id(payload):
+    """The child thread id Codex puts on a subagent's hook input, else None (a
+    root-agent call; codex-rs/hooks: "Add subagent identity to hook inputs")."""
+    aid = payload.get("agent_id")
+    return aid if isinstance(aid, str) and aid else None
 
 
 def verify_outcome(payload):
@@ -200,7 +205,11 @@ def main():
                  out_bytes=(report_bytes(result)
                             if untrusted_source(tool, inp) == SUBAGENT_CHANNEL
                             else result_size(result)),
-                 empty_run=ran_nothing(result))
+                 empty_run=ran_nothing(result),
+                 # the child's rows land in the root session's ledger (Codex's
+                 # session_id is the root thread's); the route report reads them
+                 # back by this id
+                 agent=subagent_id(payload))
         # The gate's graph line for a code-symbol search rides the same
         # non-blocking channel (tezgah_gate.graph_advice): a Codex PreToolUse
         # carries a deny and nothing else.
@@ -210,7 +219,10 @@ def main():
         # (hooks/tezgah_taste.write_note), on the same channel
         taste = (safe(session_id, write_note, session_id, inp, cwd, tool)
                  if root_for(cwd) and not verify_outcome(payload) else None)
-        notice = "\n".join(p for p in (notice, advice, taste) if p)
+        # the cross-project write notice (tezgah_gate.cross_project_note)
+        cross = (safe(session_id, cross_project_note, session_id, tool, inp, cwd)
+                 if root_for(cwd) and not verify_outcome(payload) else None)
+        notice = "\n".join(p for p in (notice, advice, taste, cross) if p)
         if notice:
             # Codex's PostToolUse output carries `additionalContext` with the
             # result - the field is part of its own hook output schema
@@ -221,6 +233,13 @@ def main():
         return
     if event == "SubagentStart":
         safe(session_id, record, session_id, "orch")
+        # the child's typing row in the root ledger: SubagentStart requires
+        # agent_id and agent_type (codex-rs/hooks/schema/generated/
+        # subagent-start.command.input.schema.json)
+        kind = payload.get("agent_type")
+        if subagent_id(payload) and isinstance(kind, str) and root_for(cwd):
+            safe(session_id, note, session_id, "subagent_start", kind,
+                 agent=subagent_id(payload))
     if event == "Stop":
         out = {}
         # Codex's stop.input carries the same fields Claude's does
@@ -228,13 +247,13 @@ def main():
         # {"decision": "block", "reason": ...}, so the integrity rule's second
         # half runs here too: a done/tested claim with nothing observed behind it
         # cannot end the turn. `verify-off` drops it; outside a root it is inert.
-        # The reply after a block (`stop_hook_active`) is judged record-only:
-        # one `after_block` row, never a second block (STOP_REASKS).
+        # The reply after a block (`stop_hook_active`) is judged again and
+        # refused at most once more, for a class this turn was not refused for
+        # yet; otherwise it is one `after_block` row (tezgah_integrity._record_only).
         if not off("verify-off") and root_for(cwd):
-            blocked = 1 if payload.get("stop_hook_active") else 0
             reason = safe(session_id, stop_reason,
                           payload.get("last_assistant_message"), session_id,
-                          cwd=cwd, record_only=blocked >= STOP_REASKS)
+                          cwd=cwd, after_block=bool(payload.get("stop_hook_active")))
             if reason:
                 out["decision"] = "block"
                 out["reason"] = reason

package/hosts/cursor/hook.py

@@ -48,10 +48,10 @@ from tezgah_guard import attest_session, import_failed, safe  # noqa: E402
 try:
     from tezgah_context import (  # noqa: E402
         command_text, context_for, record, shell_kind, slug, under)
-    from tezgah_gate import decision, explored, graph_advice  # noqa: E402
+    from tezgah_gate import cross_project_note, decision, explored, graph_advice  # noqa: E402
     from tezgah_integrity import (  # noqa: E402
         SUBAGENT_CHANNEL, bind_session, note, note_tool, ran_nothing, report_bytes,
-        stop_reason)
+        residual_text, stop_reason)
     from tezgah_paths import off  # noqa: E402
     import tezgah_store  # noqa: E402
     from tezgah_taste import write_note  # noqa: E402
@@ -59,12 +59,10 @@ try:
 except Exception as exc:
     import_failed(exc)
 
-# How many times one stop chain may be refused (hooks/projects-stop.py names the
-# same constant): one, deliberately; raising it is owner decision 11. Cursor's
-# `stop` payload carries `loop_count` (the follow-ups already sent in this chain)
-# and no `stop_hook_active` (cursor-agent 2026.10.01, captured 2026-10-07); the
-# flag is still read for a build that sends it.
-STOP_REASKS = 1
+# Cursor's `stop` payload carries `loop_count` (the follow-ups already sent in
+# this chain) and no `stop_hook_active` (cursor-agent 2026.10.01, captured
+# 2026-10-07); the flag is still read for a build that sends it. The count goes
+# to the core, which owns the re-ask budget (tezgah_integrity._record_only).
 
 
 def asked(payload):
@@ -251,14 +249,17 @@ def remember_answer(session_id, text):
     one is stored as that many characters of its head, `ANSWER_CUT` with the
     count of what was dropped, then `ANSWER_TAIL` characters of its tail - so
     both the opener the Stop rule reads and the closing marker it must not lose
-    survive the round trip. A reply with no `conversation_id` is not stored; a
-    store that cannot be written is not fatal."""
+    survive the round trip. A residual section the cut would drop (plan 080:
+    "Açık kalanlar" in the middle of a long reply) is kept, label and items,
+    between the cut marker and the tail. A reply with no `conversation_id` is
+    not stored; a store that cannot be written is not fatal."""
     if not session_id or not text:
         return
     text = str(text)
     dropped = len(text) - ANSWER_HEAD - ANSWER_TAIL
     if dropped > 0:
-        text = text[:ANSWER_HEAD] + ANSWER_CUT % dropped + text[-ANSWER_TAIL:]
+        text = (text[:ANSWER_HEAD] + ANSWER_CUT % dropped
+                + residual_text(text[ANSWER_HEAD:-ANSWER_TAIL]) + text[-ANSWER_TAIL:])
     tezgah_store.put_doc("cursor_answer", answer_key(session_id), text)
 
 
@@ -316,7 +317,11 @@ def dispatch(payload):
         # (hooks/tezgah_taste.write_note)
         taste = (write_note(session_id, inp, cwd, gate_name(payload.get("tool_name", "")))
                  if under(cwd) and not call_failed(payload) else None)
-        text = "\n".join(t for t in (notice, reinforce, advice, taste) if t)
+        # the cross-project write notice (tezgah_gate.cross_project_note)
+        cross = (cross_project_note(session_id, gate_name(payload.get("tool_name", "")),
+                                    inp, cwd)
+                 if under(cwd) and not call_failed(payload) else None)
+        text = "\n".join(t for t in (notice, reinforce, advice, taste, cross) if t)
         out = {"additional_context": text} if text else {}
     elif event == "postToolUseFailure":
         if kind:
@@ -383,6 +388,17 @@ def dispatch(payload):
         else:
             record(session_id, "orch")
             out = {"permission": "allow"}
+            # The child's ledger opens with its parent, as on omp and opencode:
+            # a Cursor subagent runs under its own conversation id (observed with
+            # cursor-agent 2026.10.01), and this event names it `subagent_id`
+            # beside `parent_conversation_id` (Cursor hooks docs, subagentStart).
+            # `host` marks the row whose id the report has not seen carried by
+            # the child's own calls (tezgah_models.route_report).
+            child, parent = payload.get("subagent_id"), payload.get("parent_conversation_id")
+            if isinstance(child, str) and child and isinstance(parent, str) and parent \
+                    and under(cwd):
+                safe(child, note, child, "spawned", "", parent=parent,
+                     agent=str(payload.get("subagent_type") or "") or None, host="cursor")
             # The delegate is a fresh context that must know the rules exist, so
             # it gets the same short brief every other host hands a subagent.
             # Cursor documents no context field on subagentStart (its output is
@@ -421,10 +437,12 @@ def dispatch(payload):
         # Only a finished turn is nudged - an aborted or errored one has no claim
         # to check - and `loop_count` is the platform's own cap on follow-ups.
         out = {}
+        # The reply a follow-up started is judged again: the core refuses it at
+        # most once more, for a class this turn was not refused for yet.
         if (payload.get("status") in (None, "completed")
-                and asked(payload) < STOP_REASKS
                 and not off("verify-off") and under(cwd)):
-            reason = stop_reason(last_answer(session_id), session_id, cwd=cwd)
+            reason = stop_reason(last_answer(session_id), session_id, cwd=cwd,
+                                 after_block=asked(payload))
             if reason:
                 out = {"decision": "block", "reason": reason}
     elif event == "beforeSubmitPrompt":

package/hosts/dsh/hooks.json

@@ -10,12 +10,12 @@
       { "hooks": [ { "type": "command", "command": "\"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-auto-init.py\"", "timeout": 10 } ] }
     ],
     "PreToolUse": [
-      { "matcher": "Agent|agent|Task|task|Grep|grep|Bash|bash|PowerShell|pwsh|Shell|shell|subagent|Edit|Write|MultiEdit|NotebookEdit", "hooks": [ { "type": "command", "command": "\"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-pretooluse.py\"", "timeout": 5 } ] },
+      { "matcher": "Agent|agent|Task|task|Grep|grep|Bash|bash|PowerShell|pwsh|Shell|shell|subagent|Edit|Write|MultiEdit|NotebookEdit|AskUserQuestion", "hooks": [ { "type": "command", "command": "\"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-pretooluse.py\"", "timeout": 5 } ] },
       { "matcher": "^mcp__(?:.*[^A-Za-z0-9])?(?:append|cancel|clear|click|close|comment|commit|copy|create|delete|deploy|drag|edit|email|evaluate|exec|execute|fill|insert|install|kill|launch|merge|message|mkdir|move|navigate|notify|patch|pause|post|press|print|publish|push|put|release|remove|rename|replace|reply|resume|review|run|save|send|set|share|skip|start|stop|submit|swipe|tag|tap|terminate|type|uninstall|update|upload|write)(?:[^A-Za-z0-9].*)?$", "hooks": [ { "type": "command", "command": "\"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-pretooluse.py\"", "timeout": 5 } ] }
     ],
     "PostToolUse": [
       { "matcher": "Edit|edit|Write|write|MultiEdit|NotebookEdit|Bash|bash|PowerShell|pwsh|str_replace_editor|WebFetch|WebSearch|web_fetch|web_search|fetch|mcp__.*", "hooks": [ { "type": "command", "command": "TEZGAH_CALL_OUTCOME=none \"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-posttooluse.py\"", "timeout": 5 } ] },
-      { "matcher": "Agent|Task|Skill", "hooks": [ { "type": "command", "command": "TEZGAH_CALL_OUTCOME=none \"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-posttooluse.py\"", "timeout": 5 } ] }
+      { "matcher": "Agent|Task|Skill|TodoWrite", "hooks": [ { "type": "command", "command": "TEZGAH_CALL_OUTCOME=none \"${TEZGAH_PYTHON:-python3}\" \"${CLAUDE_PLUGIN_ROOT}/hooks/projects-posttooluse.py\"", "timeout": 5 } ] }
     ]
   }
 }

package/hosts/omp/hook.py

@@ -8,7 +8,7 @@ the gate and the evidence ledger underneath are the shared core in `hooks/`,
 the same code every other host runs.
 
     {"event": "session_start", "cwd": ..., "session_id": ..., "subagent": bool,
-     "parent": <the main session's id>, "agent": <the child's AgentId>}
+     "parent": <the main session's id>, "agent": <the child's AgentId>, "fork_of": <id>}
         -> {"context": <this repo's live state, or the subagent brief>,
             "status": "pony✓ ...", "idx": glyph}
     {"event": "status", "cwd": ..., "session_id": ...}
@@ -19,10 +19,11 @@ the same code every other host runs.
     {"event": "user_prompt", "cwd": ..., "prompt": ...}
         -> {"context": <reminder + the rules this prompt arms>}
     {"event": "pre_tool_use", "cwd": ..., "tool": ..., "input": {...}}
-        -> {"deny": reason} | {"advice": line} (the graph line the bridge hands
-           the model with this call's result; never a block)
+        -> {"deny": reason} | {"advice": line} (the graph line, the idle-wait
+           warning on a `wait`, or the ask-policy warning on an `ask`, the
+           bridge hands the model with this call's result; never a block)
     {"event": "post_tool_use", "cwd": ..., "tool": ..., "input": {...},
-     "failed": bool, "idx": glyph}
+     "failed": bool, "idx": glyph, "todo": [...]}
         -> {"status": "pony✓ ...", "idx": glyph, "label": one line}
            (records the evidence the Stop rule reads; `idx` echoed from the
            payload skips the git probe; `label` is the untrusted-content notice
@@ -31,8 +32,9 @@ the same code every other host runs.
            and is absent for every ordinary result)
     {"event": "stop", "last_assistant_message": ..., "stop_hook_active": bool}
         -> {"decision": "block", "reason": reason}
-           (with `stop_hook_active` the reply is recorded as an `after_block`
-           row and never blocked a second time)
+           (the reply after a block is judged again and refused at most once
+           more, for a class this turn was not refused for yet; otherwise it is
+           recorded as an `after_block` row - tezgah_integrity._record_only)
 
 Every answer that carries the line carries `idx` with it - the glyph of the
 line's idx mark - so the caller can hand it back on the redraws that must not
@@ -58,7 +60,9 @@ try:
     from tezgah_context import (  # noqa: E402
         color_default, command_text, context_for, health_segments, record,
         render_tiers, shell_kind, skill_read_kind)
-    from tezgah_gate import decision, graph_advice  # noqa: E402
+    from tezgah_gate import (  # noqa: E402
+        ask_advice, cross_project_note, decision, graph_advice, ready_advice,
+        spawn_advice)
     from tezgah_integrity import (  # noqa: E402
         SUBAGENT_CHANNEL, bind_session, note, note_tool, stop_reason, untrusted_label,
         untrusted_source)
@@ -68,10 +72,9 @@ try:
 except Exception as exc:
     import_failed(exc)
 
-# How many times one stop chain may be refused (hooks/projects-stop.py names the
-# same constant): one, deliberately; raising it is owner decision 11. omp has no
-# subagent-end event: `session_stop` does not fire for task sessions.
-STOP_REASKS = 1
+# omp has no subagent-end event: `session_stop` does not fire for task sessions,
+# so the bridge sends `subagent_stop` from the child's terminal `agent_end`.
+# The re-ask budget is the core's (tezgah_integrity.STOP_REASKS, plan 083).
 
 
 def classify(tool, inp):
@@ -148,7 +151,10 @@ def handle(payload):
         reason = decision(tool, inp, cwd, session_id)
         if reason:
             return {"deny": reason}
-        advice = graph_advice(tool, inp, cwd, "omp")
+        advice = (graph_advice(tool, inp, cwd, "omp")
+                  or ready_advice(tool, session_id, cwd)
+                  or spawn_advice(tool, inp, session_id, cwd)
+                  or ask_advice(tool, inp, session_id, cwd))
         return {"advice": advice} if advice else {}
     if not root_for(cwd):
         return {}
@@ -170,6 +176,11 @@ def handle(payload):
             # `tezgah-route --report` joins the two through this row
             note(session_id, "spawned", "", parent=str(payload["parent"]),
                  agent=payload.get("agent"))
+        elif payload.get("fork_of"):
+            # an omp fork names the session it was forked from: the race rule
+            # names that relation instead of an opaque ledger id
+            # (tezgah_integrity._relation)
+            note(session_id, "forked", "", parent=str(payload["fork_of"]))
         context = context_for(kind, cwd, dict(payload, host="omp"),
                               with_core=False)
         if context:
@@ -229,7 +240,8 @@ def handle(payload):
                   failed=failed if isinstance(failed, bool) else None,
                   out_bytes=size if isinstance(size, int) and size >= 0 else None,
                   source=source, cwd=cwd,
-                  empty_run=payload.get("empty_run") is True)
+                  empty_run=payload.get("empty_run") is True,
+                  todo=payload.get("todo") if isinstance(payload.get("todo"), list) else None)
         if str(tool).lower() == "task" and isinstance(inp.get("tasks"), list):
             # omp names a child's ledger by its task name (`<parent>/<name>.jsonl`)
             # and only this call knows which agent that name runs - `task` when
@@ -248,25 +260,34 @@ def handle(payload):
         # reads where the text came from - or, on an effect after such a read,
         # the taint notice - while it reads the result.
         # the opt-in taste note for the first write to this file type
-        # (hooks/tezgah_taste.write_note) rides the same label
+        # (hooks/tezgah_taste.write_note) and the cross-project write notice
+        # (hooks/tezgah_gate.py::cross_project_note) ride the same label
         taste = (safe(session_id, write_note, session_id, inp, cwd, tool)
                  if failed is not True else None)
-        label = "\n".join(t for t in (label, taste) if t)
+        cross = (safe(session_id, cross_project_note, session_id, tool, inp, cwd)
+                 if failed is not True else None)
+        label = "\n".join(t for t in (label, taste, cross) if t)
         if label:
             out["label"] = label
         return out
     if event == "stop":
         if off("verify-off"):
             return {}
-        if (1 if payload.get("stop_hook_active") else 0) >= STOP_REASKS:
-            # the reply after a block: recorded, never refused a second time,
-            # under its own guard so a record that fails still answers empty
-            safe(session_id, stop_reason, payload.get("last_assistant_message"),
-                 session_id, cwd=cwd, record_only=True)
-            return {}
-        reason = stop_reason(payload.get("last_assistant_message"), session_id,
-                             cwd=cwd)
+        # the reply after a block is judged again; the core decides from the
+        # turn's ledger whether it may be refused once more (plan 083), and a
+        # core that raises has refused nothing
+        reason = safe(session_id, stop_reason,
+                      payload.get("last_assistant_message"), session_id,
+                      cwd=cwd, after_block=bool(payload.get("stop_hook_active")))
         return {"decision": "block", "reason": reason} if reason else {}
+    if event == "subagent_stop":
+        # record-only (ADR 011): judged on the child's own rows, the row lands
+        # in the parent's ledger so the parent's Stop reads its residual count
+        if not off("verify-off") and payload.get("parent"):
+            safe(session_id, stop_reason, payload.get("last_assistant_message"),
+                 session_id, cwd=cwd, subagent=True, agent=payload.get("agent"),
+                 parent=str(payload["parent"]))
+        return {}
     return {}
 
 

package/hosts/omp/tezgah-hook.ts.in

@@ -1,5 +1,5 @@
 import { execFileSync } from "node:child_process";
-import { existsSync, readdirSync } from "node:fs";
+import { closeSync, existsSync, openSync, readdirSync, readSync } from "node:fs";
 import { basename, delimiter, dirname, join } from "node:path";
 
 // tezgah-setup substitutes the absolute path of hosts/omp/hook.py, the python
@@ -206,10 +206,12 @@ function draw(ctx: any, line: string,
 // the Stop rule reads, or arrive from outside the user and the workspace.
 // read/grep/glob are absent on purpose: a read-heavy turn would otherwise spawn
 // python per call for nothing. The three web tools are here because their result
-// is exactly the one the untrusted-content label exists for.
+// is exactly the one the untrusted-content label exists for. `todo` and `wait`
+// are the orchestrator's queue and its idle call (tezgah_integrity.note_todo).
 const WATCHED = ["bash", "shell", "command", "edit", "write", "multiedit",
   "notebookedit", "apply_patch", "edit_file", "write_file", "search_replace",
-  "task", "agent", "spawn_agent", "web_search", "web_fetch", "browser"];
+  "task", "agent", "spawn_agent", "web_search", "web_fetch", "browser", "todo",
+  "wait"];
 
 // A read of a tezgah skill file is the one read whose result moves a status
 // mark, and matching it here keeps the rule that made reads unwatched: ordinary
@@ -266,9 +268,11 @@ function skillRead(tool: string, args: any): boolean {
 // checks (bash), the test-skip check (the edit/write names), and the code-graph
 // nudge on omp's search tools (grep, find, search, ast_grep). An MCP tool is
 // consulted when its name carries an effect verb (MCP_EFFECT, see `tool_call`).
+// `wait` gets the idle-wait warning (tezgah_gate.ready_advice) and `ask` the
+// ask-policy warning (tezgah_gate.ask_advice), never a block.
 const GATED = ["grep", "find", "search", "ast_grep", "bash", "shell", "command",
   "task", "agent", "edit", "write", "multiedit", "notebookedit", "apply_patch",
-  "edit_file", "write_file", "search_replace", "powershell", "pwsh"];
+  "edit_file", "write_file", "search_replace", "powershell", "pwsh", "wait", "ask"];
 
 // The gate's non-blocking graph line (tezgah_gate.graph_advice), held from the
 // call to its result: `tool_call` can only block, `tool_result` can hand the
@@ -311,6 +315,44 @@ function emptyRun(content: any): boolean {
   return EMPTY_RUN.test(text.slice(-EMPTY_RUN_TAIL));
 }
 
+// The text of the newest assistant message in an agent_end `messages` list:
+// the subagent's final report, which the hook reads like a Stop reply.
+function lastReply(messages: any): string | undefined {
+  if (!Array.isArray(messages)) return undefined;
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const m = messages[i];
+    if (m?.role !== "assistant") continue;
+    if (typeof m.content === "string") return m.content;
+    if (Array.isArray(m.content)) {
+      return m.content.map((p: any) => (p?.type === "text" && typeof p.text === "string"
+                                        ? p.text : "")).join("\n");
+    }
+  }
+  return undefined;
+}
+
+// The id of the session that spawned this one: the `session` header line of the
+// file `parentSession` names, so a grandchild's end reaches the child that
+// spawned it. The main session's exported id stands in when that file cannot be
+// read; only the first SESSION_HEAD bytes are read, never the transcript.
+const SESSION_HEAD = 16384;
+function parentSessionId(ctx: any): string | undefined {
+  try {
+    const file = String(ctx?.sessionManager?.getHeader?.()?.parentSession ?? "");
+    const fd = openSync(file, "r");
+    const buf = Buffer.alloc(SESSION_HEAD);
+    const n = readSync(fd, buf, 0, SESSION_HEAD, 0);
+    closeSync(fd);
+    for (const line of buf.subarray(0, n).toString("utf8").split("\n")) {
+      try {
+        const row = JSON.parse(line);
+        if (row?.type === "session" && row.id) return String(row.id);
+      } catch { /* a title line cut at the buffer's end, or another row */ }
+    }
+  } catch { /* no readable parent file: the exported id below */ }
+  return process.env.TEZGAH_SESSION || undefined;
+}
+
 // The hook's failure is the one state the bridge can see and the hook cannot
 // report: no interpreter to start it with, the checkout moved, the hook crashed
 // or ran past the timeout. It is remembered here so the next event can say so.
@@ -387,6 +429,15 @@ function sessionOf(ctx: any): string | undefined {
   }
 }
 
+// The session file is omp's transcript: the router-context line reads it.
+function sessionFileOf(ctx: any): string | undefined {
+  try {
+    return ctx?.sessionManager?.getSessionFile?.() ?? undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 // A task subagent runs in its own session with the same extensions, so it gets
 // session_start too. It must get the subagent brief, not the parent's payload:
 // the parent's runs the indexer, regenerates the agents and tells the model to
@@ -409,6 +460,20 @@ function isSubagent(ctx: any): boolean {
   }
 }
 
+// The session an omp fork was forked from: a main session whose header still
+// names a `parentSession` (an id, or a `<stamp>_<id>.jsonl` path). The hook
+// writes it as a `forked` row, so the race rule names a fork as one instead of
+// an opaque ledger id. "" for a session that is no fork.
+function forkParent(ctx: any): string {
+  try {
+    const parent = String(ctx?.sessionManager?.getHeader?.()?.parentSession ?? "");
+    const stem = basename(parent.replace(/\\/g, "/"), ".jsonl");
+    return stem.slice(stem.lastIndexOf("_") + 1);
+  } catch {
+    return "";
+  }
+}
+
 export default function tezgahOmp(pi: any): void {
   // The idx glyph the last probed answer carried. omp redraws the line after
   // every watched tool and the stamp probe behind that mark is the line's only
@@ -538,6 +603,16 @@ export default function tezgahOmp(pi: any): void {
     tool = "";
     stopMotion();
     paint(ctx);
+    // omp fires no session_stop for a task subagent, so its end is recorded
+    // here: the child's last reply, judged record-only, lands in the parent's
+    // ledger with its untyped residual count (ADR 011, S4 finding 2).
+    const parent = isSubagent(ctx) ? parentSessionId(ctx) : undefined;
+    if (parent && event?.willContinue !== true) {
+      ask({ event: "subagent_stop", cwd: cwdOf(ctx), session_id: sessionOf(ctx),
+            parent,
+            agent: basename(String(ctx?.sessionManager?.getSessionFile?.() ?? ""), ".jsonl"),
+            last_assistant_message: lastReply(event?.messages) });
+    }
   });
   pi.on("session_shutdown", async () => {
     busy = false;
@@ -559,8 +634,10 @@ export default function tezgahOmp(pi: any): void {
       ? { parent: process.env.TEZGAH_SESSION,
           agent: basename(String(ctx?.sessionManager?.getSessionFile?.() ?? ""), ".jsonl") }
       : {};
+    const fork = subagent ? "" : forkParent(ctx);
     const res = ask({ event: "session_start", cwd: cwdOf(ctx),
-                      session_id: session, subagent, ...link });
+                      session_id: session, subagent, ...link,
+                      ...(fork ? { fork_of: fork } : {}) });
     if (hookError) {
       const notice = failureNotice(ctx, session);
       if (notice) {
@@ -626,8 +703,10 @@ export default function tezgahOmp(pi: any): void {
     // again.
     const prompt = String(event?.prompt ?? "").trim();
     if (!prompt) return undefined;
+    // `subagent`: a task prompt is the parent's brief, never the user's grant
     const res = ask({ event: "user_prompt", cwd: cwdOf(ctx), prompt,
-                      session_id: session });
+                      session_id: session, transcript_path: sessionFileOf(ctx),
+                      subagent: isSubagent(ctx) });
     if (hookError) return noticeMessage(ctx, session);
     if (!res.context) return undefined;
     // A hidden message, not a system-prompt rewrite: omp keeps per-request
@@ -683,10 +762,17 @@ export default function tezgahOmp(pi: any): void {
     const content = event?.content;
     const resultLen = typeof content === "string" ? content.length
       : Array.isArray(content) ? content.length : undefined;
+    // omp's todo call holds one op and its result's `details.phases` the whole
+    // list, so that list crosses for this one tool: the queue the Stop rule and
+    // the idle-wait warning read (tezgah_integrity.note_todo).
+    const phases = tool.toLowerCase() === "todo" ? event?.details?.phases : undefined;
+    const todo = Array.isArray(phases)
+      ? phases.flatMap((p: any) => (Array.isArray(p?.tasks) ? p.tasks : []))
+      : undefined;
     const res = ask({ event: "post_tool_use", cwd: cwdOf(ctx), tool,
                       input: event?.input ?? {}, failed, idx: idxGlyph,
                       session_id: sessionOf(ctx), result_len: resultLen,
-                      empty_run: emptyRun(content) || undefined });
+                      empty_run: emptyRun(content) || undefined, todo });
     if (hookError) return markBroken(ctx);
     show(ctx, res);
     // A result that came from outside the user and the workspace is labelled in