@r1z4x/tezgah 1.6.0 → 1.8.2

package/hosts/opencode/plugins/tezgah.js

@@ -40,7 +40,8 @@
 //     second and third halves - the channel on the call's own ledger row (with
 //     the `external` row an MCP answer or a fetched page earns), the provenance
 //     label in front of the result itself, and the taint notice on the first
-//     effect a turn makes after such a read (hooks/tezgah_untrusted.marks).
+//     effect a turn makes after such a read (hooks/tezgah_untrusted.marks); a
+//     `task` call also writes its slice record (noteSlice, bin/tezgah-task).
 //
 // Known gap: every rule of hooks/tezgah_gate.py is enforced here, but the ledger
 // the counters read is complete only for the rules ported last - secret, loop,
@@ -227,6 +228,48 @@ const SECRET_SINK =
 // message about the rule rather than a credential in a write. `|` is NOT a
 // boundary here but a carrier, and the split is read off the masked text.
 const SEGMENT = /\|\||&&|[;&\n]/g
+// Plan 096, as hooks/tezgah_gate reads it (SECRET_PREFIX, SECRET_RUNNER, ...,
+// _secret_runner): a token held only by a program's leading `NAME=value` words
+// is in that program's env, so its redirected output carries no key - but only
+// for a script runner named by itself, given a script file, with no option that
+// runs its own text, stdin or a preload, or traces. Any other program holds.
+const SECRET_PREFIX =
+  /^[\s;&|]*(?:env\s+)?(?:[A-Za-z_]\w*=(?:'[^']*'|"(?:\\.|[^"\\])*"|\$\([^()]*\)|`[^`]*`|\\.|[^\s;&|()<>'"`\\])*\s+)+/
+// the sinks that carry a program's output and nothing but it (SECRET_OUTPUT)
+const SECRET_OUTPUT = />>?(?![&=])|\|\s*tee\b/g
+const SECRET_RUNNER = /^(?:python[\d.]*|node|bun|deno|bash|sh|zsh)$/
+const SECRET_SCRIPT = /^[^$`\s]+\.(?:py|js|mjs|ts|sh)$/
+const SECRET_INLINE = {python: /^-[A-Za-z]*[cmi]/,
+  sh: /^(?:-[A-Za-z]*[csxv]|-o$|--(?:verbose|debugger))/,
+  js: /^(?:-[A-Za-z]*[epri]|--(?:eval|print|require|import|loader|experimental-loader|preload|interactive)(?:=|$))/}
+// the line holds (SECRET_ENVIRON, SECRET_STARTUP, SECRET_TRACE, SECRET_FUNCTION)
+const SECRET_ENVIRON = /\/proc\/[^/\s]*\/environ/
+const SECRET_STARTUP =
+  /(?<![\w$])(?:SHELLOPTS|BASHOPTS|BASH_ENV|ENV|PS4|ZDOTDIR|NODE_OPTIONS|PYTHONSTARTUP|PYTHONINSPECT|PERL5OPT|PERL5DB|RUBYOPT|LD_PRELOAD|DYLD_\w*)=/
+const SECRET_TRACE = /(?:^|[\s;&|(])set\s+(?:-[A-Za-z]*[xv]|-o\s+(?:xtrace|verbose))/
+const SECRET_FUNCTION =
+  /(?:^|[\s;&|(])(?:function\s+[^\s(){};&|]+|[^\s(){};&|$=]+\s*\(\s*\))/
+const SECRET_UNEXPANDED = /\$[A-Za-z_{(]|`/
+// the programs a carried name is printed by when they own a sink
+const SECRET_PRINTERS = new Set(["echo", "printf", "cat", "eval", "awk", "perl",
+  "ruby"])
+// a versioned python is read by /^python[\d.]+$/: only pythonBin() spells the
+// interpreter's name (tests/test_interpreter.py)
+const SECRET_INTERPRETERS = new Set(["python", "sh", "bash", "zsh", "dash"])
+const SECRET_KEYWORDS = new Set(["if", "then", "elif", "else", "do", "while",
+  "until", "!", "{", "time"])
+// the wrappers `_program` reads past, with the options that take a value
+const SECRET_WRAPPERS = new Map([
+  ["sudo", ["-u", "-g", "-h", "-p", "-C", "-D", "-r", "-t", "-U"]],
+  ["env", ["-u", "--unset", "-C", "--chdir"]], ["nice", ["-n", "--adjustment"]],
+  ["nohup", []], ["exec", ["-a"]], ["time", ["-f", "-o"]], ["command", []],
+  ["timeout", ["-s", "--signal", "-k", "--kill-after"]], ["stdbuf", ["-i", "-o", "-e"]]])
+const SECRET_INTERPRETER_OPTS = ["-X", "-W", "-o", "+o", "-O"]
+// `NAME=value` at a word start, and the `$NAME`/`${NAME}` a later word reads
+// (hooks/tezgah_gate.SHELL_ASSIGN, SHELL_VAR)
+const SECRET_ASSIGN =
+  /(?:^|(?<=[\s;&|(]))([A-Za-z_][A-Za-z0-9_]*)=((?:'[^']*'|"[^"]*"|[^\s;&|)'"])*)/g
+const SECRET_VAR = /\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g
 const SECRET_DENY =
   "Credential write denied: this command would land a credential in a file " +
   "(`>`/`>>`, `tee`, `git add` or a curl trace). Record the credential's " +
@@ -1158,6 +1201,49 @@ const DETAIL_MAX = 200
 // agree on the credential itself; they differ only for an astral character
 // inside a quoted named value.
 
+// The `todo` row for `todowrite` (hooks/tezgah_integrity.note_todo): the list's
+// open, ready and blocked counts, the ready heads in `heads` and `detail`. Typed
+// blockers: BLOCKER_SAID/BLOCKER_TRIED's tokens - every hooks/lang/<code>.json
+// pack's `blockers.<kind>.pattern`, DECISION and KARAR alike - on Unicode word
+// boundaries (JS `\b` is ASCII-only); no pack found matches none, as `alts`
+// does. Read once, on the first todo call. ponytail: without the Python
+// reader's negation rule.
+const TODO_CLOSED = new Set(["completed", "done", "cancelled", "abandoned"])
+let todoTyped = null
+function todoTypedPattern() {
+  if (todoTyped) return todoTyped
+  const kinds = { decision: [], irreversible: [], access: [], env: [] }
+  const dir = hookScript("lang")
+  try {
+    for (const name of dir ? readdirSync(dir).sort() : []) {
+      if (!name.endsWith(".json")) continue
+      const blockers = JSON.parse(readFileSync(join(dir, name), "utf8")).blockers || {}
+      for (const kind of Object.keys(kinds)) {
+        if (blockers[kind]?.pattern) kinds[kind].push(blockers[kind].pattern)
+      }
+    }
+  } catch {}
+  const alt = (...names) => names.flatMap((k) => kinds[k]).join("|") || "(?!)"
+  todoTyped = new RegExp("(?<![\\p{L}\\p{N}_])(?:(?:" + alt("decision", "irreversible")
+    + ")[A-ZÇĞİIÖŞÜ]*|" + alt("access", "env") + ")(?![\\p{L}\\p{N}_])", "u")
+  return todoTyped
+}
+async function recordTodo(sessionID, tool, args, workspace) {
+  if (!Array.isArray(args?.todos)) return
+  const open = args.todos.filter((i) => i && String(i.content || "").trim()
+    && !TODO_CLOSED.has(String(i.status || "pending").toLowerCase()))
+  const typed = (i) => todoTypedPattern().test(i.content) || /\bblocked\b/i.test(i.content)
+  const heads = open.filter((i) => String(i.status || "pending").toLowerCase() === "pending"
+    && !typed(i)).map((i) => redact(String(i.content).split(/\s+/).join(" ").trim())
+    .slice(0, 60))
+  await appendRow(sessionID, {
+    kind: "todo", ts: Math.floor(Date.now() / 1000),
+    detail: heads.join("\n").slice(0, DETAIL_MAX),
+    id: actionID(tool, args), workspace: workspace || null, tool,
+    open: open.length, ready: heads.length, blocked: open.filter(typed).length, heads,
+  })
+}
+
 // Evidence ledger, the store the Python gate and Stop hook read. Written
 // per tool call so a "done/tested" claim can be checked against what ran.
 // The bash tool returns `metadata.exit` (the process exit code), so a check's
@@ -1181,6 +1267,7 @@ async function recordEvidence(sessionID, tool, args, result, workspace, cwd,
                               source) {
   if (!sessionID) return
   const t = String(tool || "").toLowerCase()
+  if (t === "todowrite") return await recordTodo(sessionID, tool, args, workspace)
   const exit = result?.metadata?.exit
   let kind = null
   let detail = String(args?.command || writtenPath(args) || "")
@@ -1259,6 +1346,60 @@ async function recordEvidence(sessionID, tool, args, result, workspace, cwd,
   }
 }
 
+// The slice journal (hooks/tezgah_task.py, plan 081). opencode's `task` call
+// runs its child to the end before this hook sees it, so one call opens the
+// record and closes it - done, or stopped with the error's class - through
+// bin/tezgah-task, the records' one writer. The id is the child session opencode
+// reports (`metadata.sessionId`), else the first 12 hex digits of the brief's
+// sha1 (tezgah_task.slice_id). Awaited under the core deadline and never thrown:
+// a journal that cannot be written costs the record, not the call.
+const TASK_BIN = join(CONFIG, "bin", "tezgah-task")
+const SLICE_ID = /^[A-Za-z0-9._-]{1,80}$/
+const SLICE_BRIEF = 4000
+// tezgah_task._CLASSES, in its order: the class a stopped record carries, and
+// `error` for any other failure text.
+const SLICE_CLASSES = [
+  ["rate_limit", /\b429\b|rate[ _-]?limit/i],
+  ["quota", /quota|key limit exceeded|usage limit|\b40[23]\b.*\blimit|\blimit\b.*\b40[23]\b/i],
+  ["aborted", /abort|cancell?ed/i],
+  ["timeout", /timed out|timeout/i],
+  ["cut_off", /max[ _]turns|max_tokens|cut off|context[ _]length/i],
+]
+
+function sliceClass(text) {
+  const hit = SLICE_CLASSES.find(([, re]) => re.test(text))
+  return hit ? hit[0] : "error"
+}
+
+// The error a `task` result reports, as text, or "" for none.
+function sliceError(result) {
+  for (const e of [result?.error, result?.metadata?.error]) {
+    const text = typeof e === "string" ? e : String(e?.message || e?.name || "")
+    if (e && text.trim()) return text.trim()
+  }
+  return ""
+}
+
+async function noteSlice(sessionID, args, result, cwd) {
+  if (!existsSync(TASK_BIN) || await off("slices-off", sessionID)) return
+  const brief = [args?.description, args?.prompt].map((p) => String(p || "").trim())
+    .filter(Boolean).join("\n\n").slice(0, SLICE_BRIEF)
+  if (!brief) return
+  const child = String(result?.metadata?.sessionId || result?.metadata?.session_id || "")
+  const id = SLICE_ID.test(child) ? child
+    : createHash("sha1").update(brief).digest("hex").slice(0, 12)
+  const run = (argv) => collect([TASK_BIN, "slice", ...argv],
+                                { cwd, stdio: ["ignore", "pipe", "ignore"] }, null,
+                                (code) => code === 0)
+  const opened = await run(["open", "--id", id, "--kind", "agent", "--host", "opencode",
+                            "--agent", String(args?.subagent_type || ""),
+                            "--brief", brief, "--parent", String(sessionID || ""),
+                            "--cwd", cwd])
+  if (!opened) return
+  const error = sliceError(result)
+  await run(error ? ["stop", id, "--class", sliceClass(error)] : ["done", id])
+}
+
 // How far back the pre-state search reads: the gate writes its snapshot row in
 // the call immediately before the write, so the newest rows are where it is
 // (SNAPSHOT_TAIL in hooks/tezgah_integrity).
@@ -1842,23 +1983,148 @@ function realPath(p) {
 // The refusal when this command would write a credential into a file, or null.
 // Reading an env var or running a tool with a key in its env is the normal work
 // this must not touch, so a token only counts next to a write sink, and a sink
-// only carries the text of its own simple command.
+// only carries the text of its own simple command. A token held only by the
+// leading `NAME=value` words of an allowlisted program is in that program's env
+// (envPrefixOnly), unless the line reads /proc's environ or defines a function.
+// A name an earlier command assigned a token is carried, and a printer owning a
+// sink that reads it still writes it (printerOwnsSink; plan 096).
 function secretCommand(command) {
   const c = String(command || "")
   if (!c || !SECRET_TOKEN.test(c)) return null
   const masked = maskText(c)
+  const relax = !(SECRET_ENVIRON.test(c) || SECRET_STARTUP.test(c)
+                  || SECRET_FUNCTION.test(masked) || SECRET_TRACE.test(masked))
   let start = 0
+  const carried = new Set()
   const ends = [...masked.matchAll(SEGMENT)].map((m) => m.index)
   for (const end of ends.concat(c.length)) {
-    if (SECRET_TOKEN.test(c.slice(start, end))
-        && SECRET_SINK.test(masked.slice(start, end))) {
-      return SECRET_DENY
+    const text = c.slice(start, end)
+    if (SECRET_SINK.test(masked.slice(start, end))) {
+      if (SECRET_TOKEN.test(text) && !(relax && envPrefixOnly(text))) return SECRET_DENY
+      if ([...text.matchAll(SECRET_VAR)].some((v) => carried.has(v[1] || v[2]))
+          && printerOwnsSink(text, masked.slice(start, end))) {
+        return SECRET_DENY
+      }
+    }
+    for (const a of text.matchAll(SECRET_ASSIGN)) {
+      if (SECRET_TOKEN.test(a[0])) carried.add(a[1])
     }
     start = end
   }
   return null
 }
 
+// True when every token in this simple command's text sits in its leading
+// `NAME=value` words, no sink runs inside them, the sinks after them carry only
+// the program's output (a `git add` or a curl trace holds), and the program is
+// on the allowlist (hooks/tezgah_gate._env_prefix_only).
+function envPrefixOnly(text) {
+  const m = text.match(SECRET_PREFIX)
+  if (!m) return false
+  const rest = text.slice(m[0].length)
+  return !(SECRET_TOKEN.test(rest) || SECRET_SINK.test(m[0])
+           || SECRET_SINK.test(rest.replace(SECRET_OUTPUT, " "))
+           || !secretRunner(rest))
+}
+
+// the words of the first command `text` runs, a `$( )` body skipped
+function firstCommand(text) {
+  const first = shellCommands(text.replace(/^[ \t\n;&|]+/, ""))
+    .find((cmd) => cmd[1] !== "$)")
+  return first ? first[0] : []
+}
+
+// True when the first program `text` runs, past the wrappers, is a script
+// runner named by itself (a path could be any program) given a script file,
+// with no `-` or inline, stdin, preload, interactive or trace option before it
+// (hooks/tezgah_gate._secret_runner).
+function secretRunner(text) {
+  const words = secretPastWrappers(firstCommand(text))
+  if (!words.length || !SECRET_RUNNER.test(words[0])) return false
+  const name = words[0]
+  let args = words.slice(1)
+  if (name === "deno") {
+    if (args[0] !== "run") return false
+    args = args.slice(1)
+  }
+  const inline = SECRET_INLINE[name.startsWith("python") ? "python"
+    : ["node", "bun", "deno"].includes(name) ? "js" : "sh"]
+  for (let i = 0; i < args.length;) {
+    const arg = args[i]
+    if (arg === "-" || inline.test(arg)) return false
+    if (!/^[-+]/.test(arg)) return SECRET_SCRIPT.test(arg)
+    i += SECRET_INTERPRETER_OPTS.includes(arg) ? 2 : 1
+  }
+  return false
+}
+
+// True when a pipeline stage that owns a file sink - a `>` to a file other than
+// /dev/null, or a pipe into `tee` - is a printer
+// (hooks/tezgah_gate._printer_owns_sink).
+function printerOwnsSink(text, masked) {
+  const cuts = [...masked.matchAll(/(?<!>)\|/g)].map((m) => m.index)
+  const starts = [0, ...cuts.map((k) => k + 1)]
+  const stops = [...cuts, text.length]
+  for (let k = 0; k < starts.length; k++) {
+    const a = starts[k], b = stops[k]
+    let owns = [...masked.slice(a, b).matchAll(/>>?(?![&=])/g)].some((m) =>
+      text.slice(a + m.index + m[0].length, b).trim().split(/\s+/)[0] !== "/dev/null")
+    if (k + 1 < starts.length && /^\s*tee\b/.test(masked.slice(starts[k + 1]))) owns = true
+    if (owns && secretPrinter(text.slice(a, b))) return true
+  }
+  return false
+}
+
+// True when the first program `text` runs prints a carried name
+// (hooks/tezgah_gate._secret_printer).
+function secretPrinter(text) {
+  const program = secretProgram(firstCommand(text))[0]
+  return SECRET_PRINTERS.has(program) || SECRET_INTERPRETERS.has(program)
+    || /^python[\d.]+$/.test(program) || SECRET_UNEXPANDED.test(program)
+}
+
+// `words` past keywords, env assignments and the wrappers
+// (hooks/tezgah_gate._past_wrappers)
+function secretPastWrappers(words) {
+  let i = 0
+  while (i < words.length) {
+    const word = words[i]
+    if (/^[A-Za-z_]\w*=/.test(word) || SECRET_KEYWORDS.has(word)) { i += 1; continue }
+    const wrapper = basename(word)
+    const opts = SECRET_WRAPPERS.get(wrapper)
+    if (!opts) break
+    i += 1
+    while (i < words.length && words[i].startsWith("-")) i += opts.includes(words[i]) ? 2 : 1
+    if (wrapper === "timeout" && i < words.length) i += 1
+  }
+  return words.slice(i)
+}
+
+// [program basename without `.py`, its arguments] for one simple command, past
+// the wrappers and an interpreter's options before its script
+// (hooks/tezgah_gate._program).
+function secretProgram(words) {
+  words = secretPastWrappers(words)
+  if (words[0] === "[") {
+    const close = words.indexOf("]")
+    words = words.slice(close < 0 ? words.length : close + 1)
+  }
+  if (!words.length) return ["", []]
+  let name = basename(words[0])
+  if (SECRET_INTERPRETERS.has(name) || /^python[\d.]+$/.test(name)) {
+    const own = name.startsWith("python") ? /^-[A-Za-z]*[cm]$/ : /^-[A-Za-z]*c[A-Za-z]*$/
+    let j = 1
+    while (j < words.length && /^[-+]/.test(words[j]) && words[j] !== "-") {
+      if (own.test(words[j])) { j = words.length + 1; break }
+      j += SECRET_INTERPRETER_OPTS.includes(words[j]) ? 2 : 1
+    }
+    if (j < words.length) words = words.slice(j)
+  }
+  if (!words.length) return ["", []]
+  name = basename(words[0])
+  return [name.endsWith(".py") ? name.slice(0, -3) : name, words.slice(1)]
+}
+
 // --- untrusted content: the channel and the label ---------------------------
 // The two halves the Python hosts get from
 // hooks/tezgah_integrity.untrusted_source and hooks/tezgah_untrusted.marks,
@@ -2224,7 +2490,7 @@ const SWITCHES = new Set(["adhd-off", "consult-off", "docs-judge-off",
   "exec-mode.off", "judge-off", "lang-off", "orchestrate-off",
   "ponytail-auto.off", "pretooluse-off", "reminder-off", "research-off",
   "spec-off", "task-off", "triage-off", "verify-off", "workspace-off",
-  "agents-off", "skill-suggest-on", "taste-on", "update-check-off"])
+  "agents-off", "skill-suggest-on", "slices-off", "taste-on", "update-check-off"])
 
 // The session latch, mirrored from hooks/tezgah_paths.off: with a session id, a
 // switch file whose ctime or mtime is newer than the session ledger's first row
@@ -2923,6 +3189,7 @@ export const Tezgah = async ({ directory }) => {
         const taste = await recordEvidence(sessionID, tool, args, output, workspace,
                                            dir, own || inherited)
         if (taste) labelResult(output, taste)
+        if (tool === "task") await noteSlice(sessionID, args, output, dir)
       } catch {}
     },
 

package/output-styles/tezgah.md

@@ -14,10 +14,11 @@ force-for-plugin: true
 
 ## Tezgah core (auto-armed in this repo)
 
-**Reply language, BLUF.** Every user-facing reply in the language `reply_lang` sets in ~/.config/tezgah/config.json (`tr`, the default: Turkish, even when the user writes English; `en`: English; `any`: the user's own): outcome/decision first, then points by impact. Code, commits,
+**Reply language, BLUF.** Every user-facing reply in the language `language` sets in ~/.config/tezgah/config.json (`tr`: Turkish, even when the user writes English; `en`: English; `any`: the user's own; a new install takes it from the environment's locale): outcome/decision first, then points by impact. Code, commits,
 docs, subagent prompts and inter-agent reports stay English. One term per
 concept. Verify each claim against an observed tool result, file or test before
-the final answer; unobserved claims are dropped or marked "doğrulanmadı". Never
+the final answer; an unobserved claim is checked now or dropped, and
+"unverified"/"doğrulanmadı" marks only one whose check ran and failed. Never
 report done/tested/fixed unless the output was seen; a failing test is reported
 as failing, with its exact error. Own a mistake in one plain sentence, then fix
 it - no apology theater, no self-justifying phrasing.
@@ -28,27 +29,30 @@ one line -> minimum code. No unrequested abstractions, no scaffolding "for
 later", deletion over addition, fewest files, shortest working diff. Trace the
 problem fully before climbing; never simplify away validation, error handling,
 security, accessibility or anything requested, and build the full version
-without re-arguing when the user insists. Bug fix = root cause where all
-callers route through. A deliberate corner cut gets a `ponytail:` comment
-naming the ceiling. Non-trivial logic leaves ONE runnable check (an assert
-self-check or one small test); a one-liner needs none. A complex ask ships the
-lazy version and names the fuller one in the same reply instead of stalling.
-Reply: code first, then at most three lines - what was skipped, when to add it.
-In force from the first turn; levels lite|full|ultra are set with `tezgah-pony`
-and ride the per-turn reminder when not `full`; read the full `ponytail` skill
-from the router for the level table and examples. Off: "stop ponytail".
+without re-arguing when the user insists. Bug fix = root cause where all callers
+route through. A deliberate corner cut gets a `ponytail:` comment naming the
+ceiling. Non-trivial logic leaves ONE runnable check (an assert self-check or
+one small test); a one-liner needs none. A complex ask ships the lazy version
+and names the fuller one in the same reply instead of stalling. Reply: code
+first; write what was cut only when you consciously cut something the user asked
+for, in at most three lines. In force from the first turn; levels
+lite|full|ultra are set with `tezgah-pony` and ride the per-turn reminder when
+not `full`; read the full `ponytail` skill from the router for the level table
+and examples. Off: "stop ponytail".
 
 **Output shape: ADHD-friendly.** The answer or the next action is on the first
 line - a command, path, snippet or the decision itself, never context or the
 question restated - prose after it. Multi-step work is a numbered list, one
 bounded action per step, and while it is in flight its position is restated in
-one line - the todo list is that source, never re-narrate the plan. End with one
-concrete next step. Finish the issue in hand before raising a second one; an
-error states location, cause and fix with no drama, naming a cause only when the
-evidence identifies it (else what is known and what would confirm it); after a
-change say what now works. A list shows at most five items, ranked, the rest
-kept in reserve rather than dropped - presentation only, never the analysis. An
-estimate is in concrete units and marked as an estimate, never presented as a
+one line - the todo list is that source, never re-narrate the plan. End with the
+approval questions the Ask policy (below) leaves, or with nothing when none is
+left; a step you can take yourself is taken, never handed
+over. Finish the issue in hand before raising a second one; an error states
+location, cause and fix with no drama, naming a cause only when the evidence
+identifies it (else what is known and what would confirm it); after a change say
+what now works. A list shows at most five items, ranked, the rest kept in
+reserve rather than dropped - presentation only, never the analysis. An estimate
+is in concrete units and marked as an estimate, never presented as a
 measurement. No preamble, no recap, no closer, and a question the reader raises
 mid-work is answered rather than deferred as the second issue. Break the shape
 only where it would delete the answer: an explanation runs as long as it needs,
@@ -67,38 +71,68 @@ FORBIDDEN: swapping in a cheaper, deferred or partial stand-in for what was
 asked; silently narrowing scope; deciding a requested item is
 "unnecessary"/"YAGNI" and dropping it; a token gesture reported as done; stopping
 early because it got long. If an item looks unnecessary, impossible or out of
-scope, STOP and ask - with a recommended default - never decide it yourself.
+scope, ask in the approval batch with "keep it" as the default - the work never
+proceeds on a cut, and an unsafe item waits for the answer (Ask policy, below).
 Before the final answer walk the request item by item, and name first any item
-not fully delivered, with what is missing and why. Never placate: a reply never
-opens with agreement, praise or an apology ("haklısın", "you're right", "good
-catch", "detaylı bakmadım", "I didn't look closely"); if the user is right,
+not fully delivered, with what is missing and the blocker that stops it
+(Integrity, below). Never placate: a reply never
+opens with agreement, praise or an apology ("haklısın", "you're right", "good catch", "detaylı bakmadım", "I didn't look closely"); if the user is right,
 state the fact and the fix, if wrong, show the evidence.
 
-**Integrity: evidence, or "doğrulanmadı".** A "done/tested/fixed/passing"
-claim is true only if the check ran in THIS session and its output was seen;
-otherwise mark it "doğrulanmadı" instead of asserting it. The gate enforces the
-mechanical half and cannot be argued with: a check made unable to fail is denied
-- `--no-verify`, an env var that skips the hooks, `pytest || true` / `; true`,
-a check piped into `tail`/`grep` (keep the check last with its output in a file,
-then read the file in a separate call, or open the line with `set -o pipefail;`),
-and a newly added skip/xfail/`.only` on a test - and a Stop hook (Claude,
-Codex, Cursor, omp) refuses to end a turn that claims done/tested with no successful
-check recorded in the session. Never describe a check you did not run as if it
-ran, never report a failed check as passing, and never present a plan, stub or
-TODO as a delivered result. **Say what a number was measured on.** A figure
-produced by a fixture - a temp HOME, a generated repository, a stand-in, a
-hand-written sample - is evidence about the code path, never a property of the
-running system, and it is reported as the fixture it is: a demo on synthetic
-input is not progress on the product. Off: `verify-off`.
+**Integrity: evidence, or a named blocker.** A "done/tested/fixed/passing" claim
+is true only if the check ran in THIS session and its output was seen;
+"unverified"/"doğrulanmadı" is allowed only after a verification attempt that ran and failed,
+quoting the failure. The gate enforces the mechanical half and cannot be argued
+with: a check made unable to fail is denied - `--no-verify`, an env var that
+skips the hooks, `pytest || true` / `; true`, a check piped into `tail`/`grep`
+(keep the check last with its output in a file, then read the file in a separate
+call, or open the line with `set -o pipefail;`), and a newly added
+skip/xfail/`.only` on a test - and a Stop hook (Claude, Codex, Cursor, omp)
+refuses to end a turn that claims done/tested with no successful check recorded
+in the session, or that lists left-over work no blocker accounts for. Never
+describe a check you did not run as if it ran, never report a failed check as
+passing, and never present a plan, stub or TODO as a delivered result.
+**Residuals are work, not a report section.** Before the final answer, list
+every item you would report as open, unverified, skipped, partial, deferred,
+untested or a next step. For each one, do it now with the tools you have; a step
+that cannot be undone is never taken to clear a list - it is a blocker. An item
+may remain only if it is blocked by exactly one of, named in capitals: DECISION
+(tr: KARAR; a choice only the user can make - never "which first" or "shall I go
+on"), ACCESS (tr: YETKİ; a credential or grant no tool supplies), IRREVERSIBLE
+(tr: GERİ ALINAMAZ; needs consent), ENV (tr: ORTAM; a tool or environment is missing). A
+remaining item carries its evidence - for ACCESS and ENV the command you ran,
+in backticks, and its error; for DECISION the options and a recommended default,
+for IRREVERSIBLE the exact action waiting - and without it it is not a blocker, it is unfinished
+work, so finish it. "Out of scope", "for later", "time" and "could be added" are
+not blockers. Report blockers under one heading, "Blockers"/"Engeller", at most three
+lines: item - blocker - evidence - what unblocks it. No blockers: no heading.
+**Ask policy.** Ask only what the user alone can decide, once, in one batch.
+Work and process - the order, "shall I go on", a check, a plan, a consult
+member, a spend within `spend_cap`, a local merge of the session's branch,
+removing its worktree - are taken and stated in one line, never asked; a taste
+or intent fork goes in the batch with a default taken this turn. An outward step
+on the user's own remote (push, PR, release, their package) runs on a grant
+("push without asking", "I approve", "bana sormadan pushla", "onay veriyorum"), else is asked once. Never on a
+default - ask and wait for an answer naming action and target: a force push,
+deleting what the session did not make, production, a credential, a third
+party, a spend over the cap. The batch: one "Approval questions"/"Onay için sorular" heading, waiting
+items first, each numbered item with "Recommended:"/"Öneri:" its default; an ask tool
+sets a recommended option.
+**Say what a number was measured on.** A figure produced by a fixture - a temp
+HOME, a generated repository, a stand-in, a hand-written sample - is evidence
+about the code path, never a property of the running system, and it is reported
+as the fixture it is: a demo on synthetic input is not progress on the product.
+Off: `verify-off`.
 
 **Loop discipline.** Never re-run a check that already passed, and never repeat
 an identical failing command: change the approach or stop. Three attempts on one
 failure is the ceiling - then report what you tried and what is still unknown
 instead of attempting a fourth. A turn must either change the state or end the
-work. Check cadence: while working, run only the tests of what changed; run the
-full suite once, on the final tree, right before it ships - not again on the
-same revision after a merge or a scratch file outside the repo. Small asks of
-one kind (a color, an icon, a label) are batched into one change and one release.
+work. Check cadence: in a turn, run only the impacted tests of what changed plus
+compileall and ruff; the full suite, neuter, the docs audits and e2e run once,
+on the final tree, at the merge step and in CI - not again on the same revision
+after a merge or a scratch file outside the repo. Small asks of one kind (a
+color, an icon, a label) are batched into one change and one release.
 
 **Lessons ledger: stop repeating mistakes.** A repo may keep
 `.tezgah/lessons.md` (one per line; injected - recent per session, relevant

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@r1z4x/tezgah",
-  "version": "1.6.0",
+  "version": "1.8.2",
   "description": "One shared working contract for every AI coding assistant you run: Claude Code, Codex, Cursor, opencode, dsh and oh-my-pi (omp).",
   "license": "MIT",
   "repository": {

package/skills/i-have-adhd/EVALS.md

@@ -1,6 +1,6 @@
 # Evals
 
-Three inputs a session can be handed where this skill could misfire, and what a
+Four inputs a session can be handed where this skill could misfire, and what a
 good answer has to contain. Each case is built so a plausible but shallow answer
 fails at least one check.
 
@@ -41,7 +41,7 @@ long as the topic needs". The user states that completeness is the point.
 **Must contain**
 - [ ] States the location (the connection to `10.0.4.12:5432`) and what is known from the line
 - [ ] Separates what the line shows (a timeout to the database port) from guesses about why
-- [ ] Names the one check that would confirm the leading guess, as the next action
+- [ ] Runs the check that would confirm the leading guess when this machine can reach the host; when it cannot, names that check as the one step the reader takes, with the attempt and its error
 
 **Must not**
 - State a single root cause (firewall, wrong password, database down) as fact
@@ -74,6 +74,26 @@ needs". The output-shaping rules would otherwise delete the answer.
 
 ---
 
+## Case 4 - The trap: a next step the session can take itself
+
+**Input**
+> Fix the off-by-one in the pagination helper and tell me when it is ready.
+
+**Must contain**
+- [ ] Fixes the off-by-one and runs the helper's test itself, reporting its output
+- [ ] Ends on what now works, or on ONE step only the reader can take (a decision, a grant, a consent)
+
+**Must not**
+- End with "Next: run `npm test`" or any other step the session could run itself
+- End on a "Sıradaki adım" list
+
+**Why this case** - Rule 4 reads "End with the one step that is the reader's to
+take": "A step you can take yourself is not a next step: take it." Running the
+test is the session's own step, and "tell me when it is ready" invites handing it
+over.
+
+---
+
 ## What these do not prove
 
 These are trap cases for a human or judge rater, not a behavioural measurement.

package/skills/i-have-adhd/SKILL.md

@@ -85,13 +85,19 @@ restating. Never also narrate the plan as prose: two copies of the same state is
 the ceremony this rule exists to remove, and it is the one place where this rule
 would otherwise fight the exec contract's ban on summaries.
 
-### 4. End with one concrete next step
+### 4. End with the one step that is the reader's to take
 
-If anything is open, name ONE thing the reader can do, small enough to start
-now. "Open the file" counts.
+If something is left that only the reader can do - a decision, a credential or
+grant, consent for a step that cannot be undone - name that ONE step, small
+enough to start now. Several such decisions go in one numbered approval batch,
+each with a recommended default, and the work proceeds on the defaults (the
+tezgah contract's Ask policy). A step you can take yourself is not a next step:
+take it, and never end on asking whether to. When nothing is left, end on what
+now works.
 
 Bad: "Hope that helps. Let me know if you want to dig deeper."
-Good: "Next: run `npm test` and paste the first failing line."
+Bad: "Next: run `npm test` and paste the first failing line." (you can run it)
+Good: "Blockers: the push to `main` - IRREVERSIBLE - `git push origin main` waits - your yes." (tr: "Engeller", GERİ ALINAMAZ)
 
 ### 5. Suppress tangents
 
@@ -121,7 +127,8 @@ worse than a named unknown.
 
 Say what now works, not what was touched. "Login works with magic links; try
 `npm run dev` and open `/login`." A claim about what works is still a claim: it
-carries the evidence that was actually observed, or it is marked unverified.
+carries the evidence that was actually observed. Try the check first; a claim is
+marked unverified only after that check ran and failed, with the failure quoted.
 
 ### 8. Cap a list at five items