@r1z4x/tezgah 1.9.2 → 1.13.0

package/CHANGELOG.md

@@ -6,6 +6,415 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [1.13.0] - 2026-10-29
+
+### Fixed
+
+- **omp handed the Stop rule a message object, not the reply (plan 143).**
+  omp's `session_stop` carries `last_assistant_message` as the object its
+  `getLastAssistantMessage()` returns. The bridge passed it through, so the
+  rule judged `str(dict)`: one line, no list items, diluted prose.
+  - Every line-shaped class read a text with no lines: the list cap, the
+    residual sections, the question the reply ends on, the handed step. The
+    language check read a share that was not the reply's.
+  - Measured on the owner's evidence database: 1643 of 1656 omp `shape` rows
+    of 45 days carried `lines: 1`. Every other host wrote 209 multi-line of
+    231. Of three days' refusals, 24 were `reply language` over such a row.
+  - `stop_reason` reads every reply through `reply_prose` now, so no host can
+    repeat it. The omp bridge sends the text blocks.
+
+### Added
+
+- **The Stop rule knows the host's plan mode (plan 142).** Every Stop adapter
+  passes the host's `permission_mode` to the core now. omp's extension sends
+  `plan` from `ctx.sessionModes.getState()`. `plan` and Droid's `spec` are the
+  read-only ones.
+  - In such a turn the rule lets the approval question through. It used to
+    refuse it as a `needless ask` - the one question that mode allows.
+  - A first-person claim that a command or check ran, made in such a turn, is
+    the new `plan claim` class. Nothing could run, so the claim says what
+    cannot have happened. A check that passed anyway clears it, and a plan's
+    own acceptance line ("Done when all tests pass") is no claim.
+  - The new `handed step` class refuses a reply that tells the reader to run a
+    command. It asks only of a turn that ran commands of its own, outside plan
+    mode. An outward step, one no default may take, the owner's consent,
+    tezgah's own install and a `brew` step stay the user's. So does a line that
+    types its blocker, and an answer about how a command is run.
+  - Measured on the owner's transcripts: of 3307 user turns, 27 replies handed
+    back a command and no class refused any of them. The shipped shapes refuse
+    9 turns, 8 of them a step the session could have taken.
+
+## [1.12.0] - 2026-10-29
+
+### Added
+
+- **Amp is a host (`amp`, plan 140).** `tezgah-setup --install --hosts amp`
+  writes one TypeScript plugin, `tezgah.ts`, into Amp's system plugin dir.
+  That dir is `$XDG_CONFIG_HOME/amp/plugins/`, else `~/.config/amp/plugins/`.
+  The install renders it from `hosts/amp/tezgah-plugin.ts.in`. Amp loads every
+  `.ts` there, and a running Amp needs `plugins: reload`. The install links the
+  skills into `~/.config/amp/skills` and writes the always-on block into
+  `~/.config/amp/AGENTS.md`. It sets Amp's two commit trailers
+  (`amp.git.commit.coauthor.enabled`, `amp.git.commit.ampThread.enabled`) to
+  false in `settings.json` unless the user set them. It writes that file only
+  while it is plain JSON with no `settings.jsonc` beside it. The uninstall
+  removes the plugin only when it is tezgah's render. It drops a trailer key
+  only while that key is still false.
+  - The plugin spawns `hosts/amp/hook.py` without blocking. One plugin process
+    serves many threads, so it keys its state by thread id. A dead, slow or
+    crashing hook allows every call, and the plugin tells each thread once.
+  - `tool.call` refuses with `{action: "reject-and-continue"}`. It asks the gate
+    for `Bash`, `shell_command`, the edit tools, `Task` and MCP effect names. A
+    shell call's text reaches the gate as `command`, also when Amp sends `cmd`.
+  - A tool result counts as passed only with an integer `exitCode` on its
+    output object. `error` and `cancelled` are failures. A bare `done` shell
+    result is a run, never a pass.
+  - `agent.end` judges a `done` turn and continues it with `[tezgah:stop]
+    <reason>`. The plugin never sends that prompt as the user's. So it writes no
+    turn row, grants nothing and cannot reset the re-ask budget. A thread with
+    a parent thread is a subagent. It gets the subagent brief, and its end is a
+    record-only row.
+  - The session brief rides the thread's first `agent.start`. The status line
+    goes on Amp's experimental status item for the active thread.
+  - `--report` has Amp rows. `--report --live` loads the plugin with node and
+    drives its `tool.call` and `tool.result`. The row stays UNVERIFIED, since
+    Amp's own loader did not run it. `tezgah-doctor --stack` reads Amp's
+    guidance files, skills, plugins and `amp.mcpServers`. `read_web_page` is a
+    web channel for the untrusted label. README and docs name all fourteen
+    hosts.
+- **Goose is a host (`goose`, plan 139 slice 5).** `tezgah-setup --install
+  --hosts goose` writes tezgah's own plugin dir, `~/.agents/plugins/tezgah/`.
+  It holds `plugin.json`, `hooks/hooks.json` and `skills/` links, and it is
+  wholly tezgah's. Goose loads the skills as `tezgah:<skill>`. The timeouts are in seconds: Stop 30, the
+  rest 5. `on_failure` stays at Goose's default `allow`, so the gate fails open
+  on a hook fault. The always-on block goes in `~/.config/goose/.goosehints`.
+  Goose adds no co-author trailer and names no setting for one, so there is
+  nothing to turn off. The uninstall deletes the plugin dir and the block and
+  leaves the rest of `~/.agents` alone.
+  - `hosts/goose/hook.py` handles SessionStart (attestation only),
+    UserPromptSubmit (the turn row only), PreToolUse, PostToolUse,
+    PostToolUseFailure and Stop. The event is the payload's `event`, the cwd its
+    `working_dir`, else the hook's own. `shell`, `write` and `edit` map to Bash,
+    Write and Edit, with `path` as `file_path` and `before`/`after` as
+    `old_string`/`new_string`. `<extension>__<tool>` becomes
+    `mcp__<extension>__<tool>`.
+  - PreToolUse and Stop block with `{"decision": "block", "reason": ...}` on
+    stdout. The outcome is the event: PostToolUse is a pass, PostToolUseFailure
+    a failure. Stop judges `last_assistant_message`, or writes a
+    `reply_unread` row. With no host block count, the turn rows bound the
+    re-asks.
+  - `--report` has Goose rows, including one for `disabledPlugins`. `--report
+    --live` probes the hook command with Goose's payload and block shape.
+    `tezgah-doctor --stack` reads Goose's hints, skills, plugins and the
+    `extensions:` map of `config.yaml`. No run has shown the binary obeying the
+    block. README and docs/layers.md now name all thirteen hosts.
+- **Antigravity CLI is a host (`antigravity`, plan 139 slice 4).**
+  `tezgah-setup --install --hosts antigravity` writes tezgah's hook set under
+  the `tezgah` name of `~/.gemini/config/hooks.json`. The user's other names
+  stay. The Antigravity App and IDE load that file too. The timeouts are in
+  seconds: Stop 30, the rest 5. The status line goes in
+  `~/.gemini/antigravity-cli/settings.json` while it is plain JSON, and the skill
+  links go in `antigravity-cli/skills`. Antigravity adds no co-author
+  trailer of its own, so there is nothing to turn off. The always-on block is
+  the `~/.gemini/GEMINI.md` one Gemini CLI shares. An uninstall now keeps it only
+  while another armed host reads the same file, so with `GEMINI_CLI_HOME` set
+  the two blocks come and go apart.
+  - `hosts/antigravity/hook.py` handles SessionStart, PreInvocation,
+    PreToolUse, PostToolUse and Stop. The payload names no event, so each
+    command passes it as its first argument. `conversationId` is the session
+    and `workspacePaths[0]` the cwd. The adapter renames the PascalCase tool
+    arguments into the gate's fields: `CommandLine`, `TargetFile`, `CodeContent`,
+    `TargetContent`/`ReplacementContent` and `ReplacementChunks`.
+  - PreToolUse denies with a top-level `decision: deny`. An allowed call
+    answers `decision: allow`, since Antigravity requires the field. PostToolUse reads
+    the outcome off `error`: empty is a pass, anything else a failure. The first
+    invocation of a turn writes the turn row and carries the reminder as an
+    `ephemeralMessage`. A loop that a refusal re-entered writes no turn row, so
+    the refusal budget holds.
+  - Stop reads the reply from `transcriptPath`, or writes a `reply_unread` row.
+    It judges only an idle `model_stop`, and `decision: continue` sends the
+    model back into the loop with the reason.
+  - `--report` has Antigravity rows, including one for `enabled: false` on the
+    `tezgah` name. `--report --live` probes the hook command with Antigravity's
+    camelCase payload and deny shape. No run has shown the binary obeying the
+    deny.
+- **Gemini CLI is a host (`gemini`, plan 139 slice 3).** `tezgah-setup
+  --install --hosts gemini` writes tezgah's own extension dir,
+  `~/.gemini/extensions/tezgah/`. It holds `gemini-extension.json`,
+  `hooks/hooks.json` and links to the skills.
+  `GEMINI_CLI_HOME` moves `~/.gemini` under it. The timeouts are in
+  milliseconds: AfterAgent 30000, the rest 5000. settings.json is never
+  written, since it is JSON with comments and holds the user's keys. Gemini's
+  default prompt adds no co-author trailer and no setting names one. The
+  always-on block goes in `~/.gemini/GEMINI.md`, which Antigravity reads too.
+  `--uninstall` deletes the extension dir and strips the block only while no
+  other host that reads it stays armed.
+  - `hosts/gemini/hook.py` handles SessionStart, BeforeAgent, BeforeTool,
+    AfterTool and AfterAgent. BeforeAgent writes the turn row and carries the
+    per-turn reminder. BeforeTool maps `run_shell_command`, `write_file`,
+    `replace`, the grep tools and the subagent tools into the gate's names, and
+    `mcp_<server>_<tool>` into `mcp__<server>_<tool>`. It denies with a
+    top-level `decision: deny` on exit 0.
+  - AfterTool reads the outcome off `tool_response`: an `error` is a failure,
+    and a shell result's `Exit Code: N` names a non-zero code. A shell run that
+    printed its `Output:` with no exit-code line is a pass, since Gemini writes
+    that line only for a non-zero code. AfterAgent judges `prompt_response` and
+    denies with `decision: deny`. Gemini sends the reason back through
+    BeforeAgent as the next prompt, and that turn row does not reset the
+    refusal budget. The status segment rides `systemMessage`.
+  - `--report` has Gemini rows, including one for `hooksConfig.enabled: false`
+    in settings.json, which runs no hook at all. `--report --live` probes the
+    hook command with Gemini's own payload and deny shape. No run has shown the
+    binary loading the extension or obeying the deny.
+- **GitHub Copilot CLI is a host (`copilot`, plan 139 slice 2).** `tezgah-setup
+  --install --hosts copilot` writes `$COPILOT_HOME/hooks/tezgah.json`, a hooks
+  file that is wholly tezgah's. `COPILOT_HOME` defaults to `~/.copilot`. The
+  timeouts are in seconds: PreToolUse 10, Stop and SubagentStop 30, the rest 5.
+  The inline `hooks` key of settings.json is never used, since one bad item
+  there rejects every hook in it. The install sets two keys in settings.json
+  while it is plain JSON. The status line runs `tezgah-statusline --copilot`.
+  `includeCoAuthoredBy` is `false`, so the agent's commits carry no co-author
+  trailer. A value the user set stays. The install links the skills into
+  `$COPILOT_HOME/skills` and writes the always-on block in
+  `copilot-instructions.md`. `--uninstall` deletes tezgah.json and takes back
+  only tezgah's settings keys, links and block.
+  - `hosts/copilot/hook.py` uses the PascalCase events, so payloads carry
+    snake_case fields and Claude tool names. It maps the runtime spellings too.
+    An Edit that names no file but carries a patch reaches the gate as
+    `apply_patch`. An MCP tool's `<server>-<tool>` becomes
+    `mcp__<server>__<tool>` for a server `mcp-config.json` names. It denies
+    with a top-level `permissionDecision: deny` on exit 0.
+  - A PreToolUse hook that times out lets the call through, by Copilot's own
+    rule. One that crashes denies the call. A repo's `.claude/settings.json`
+    hooks run there too.
+  - PostToolUse records a pass and PostToolUseFailure a failure. A shell
+    result's `exit code N` overrides either. Stop carries no reply, so the hook
+    reads the last `assistant.message` from `transcript_path`. A turn end with
+    none there becomes a `reply_unread` row. Copilot drops a command hook's
+    UserPromptSubmit output, so there is no per-turn reminder. The event still
+    writes the turn row. subagentStart gives a delegate the brief. A
+    SubagentStop only records its verdict.
+  - `--report` has Copilot rows, and `--report --live` probes the hook command
+    with Copilot's own payload and deny shape. No run has shown the binary
+    obeying the deny.
+- **Command Code is a host (`commandcode`, plan 139 slice 1).** `tezgah-setup
+  --install --hosts commandcode` merges tezgah's hook groups into the `hooks`
+  key of `~/.commandcode/settings.json` beside the user's. Their timeouts are in
+  seconds. The same write sets `attribution.commit` to `""`, so commits carry no
+  `CommandCodeBot` co-author trailer. A value the user set stays. The install
+  links the skills into `~/.commandcode/skills`. It writes the always-on block
+  in `~/.commandcode/AGENTS.md`. `--uninstall` takes back only tezgah's groups,
+  links and block. It drops the attribution key only while it holds what the
+  install wrote.
+  - Command Code's settings hooks see only shell, read, write and edit. So the
+    PreToolUse matcher is `shell|write|edit`. The gate there never sees read,
+    MCP, subagent or web calls, and plan mode skips every hook.
+  - `hosts/commandcode/hook.py` maps `shell_command`, `write_file` and
+    `edit_file` onto the gate. It folds a shell call's `args` into `command`.
+    It hands `old_value`/`new_value` over as `old_string`/`new_string`. It
+    denies with `permissionDecision: deny` on exit 0. It reads a shell call's
+    outcome off an `exit code N` in its result. A result with no code counts
+    as a run, never a pass.
+  - Stop carries no reply, so the hook reads it from `transcript_path`. A turn
+    end with none there becomes a `reply_unread` row. The status segment rides
+    `systemMessage` at SessionStart and Stop. There is no prompt event, so no
+    per-turn reminder.
+  - `--report` has Command Code rows, and `--report --live` probes the hook
+    command with Command Code's own payload. No run has shown the binary
+    obeying the deny.
+- **Factory Droid is a host (`droid`, plan 138 wave 1).** `tezgah-setup --install
+  --hosts droid` merges tezgah's hook groups into `~/.factory/hooks.json` beside
+  the user's. Their timeouts are in seconds, as Droid reads them. The install
+  also links the skills into `~/.factory/skills` beside the user's own links.
+  It writes the always-on block in `~/.factory/AGENTS.md`. It sets the
+  `statusLine` command and `includeCoAuthoredByDroid: false` in `settings.json`.
+  The install edits a settings.json with comments in place and keeps its
+  comments (plan 141). `--uninstall` takes back only tezgah's groups, links and keys.
+  - Droid reads the `hooks` key of settings.json only while hooks.json is
+    absent. So the install creates no hooks.json beside such a key, and the
+    report row says why. Then settings.json stays untouched.
+  - `hosts/droid/hook.py` maps Droid's tool ids (`Execute`, `Create`,
+    `ApplyPatch`, `FetchUrl`) onto the gate and hands ApplyPatch's `input` over
+    as `patch`. It denies with `permissionDecision: deny` on exit 0 and reads a
+    shell call's outcome off its `[Process exited with code N]` line.
+  - Droid's Stop carries no reply, so the hook reads the reply from
+    `transcript_path`. A turn end whose reply is not there yet becomes a
+    `reply_unread` row and is not judged. SubagentStop records `task_result`
+    as a `subagent_end` row.
+  - `--report` has Droid rows, and `--report --live` probes the hook command
+    with Droid's own payload. `tests/e2e_droid.py` runs the real binary only
+    under `TEZGAH_E2E_SPEND=1`, because it spends a model call.
+
+- **Qwen Code is a host (`qwen`, plan 138 wave 1).** `tezgah-setup --install
+  --hosts qwen` merges tezgah's hook groups into `~/.qwen/settings.json` beside
+  Orca's. Their timeouts are in milliseconds, as Qwen reads them. The install
+  also adds the `ui.statusLine` command, the skill links and the always-on
+  block in `~/.qwen/QWEN.md`. `--uninstall` takes back only tezgah's groups and keys.
+  - `hosts/qwen/hook.py` maps Qwen's tool ids (`run_shell_command`,
+    `write_file`, `edit`, `agent`, `grep_search`) onto the gate. It denies with
+    `permissionDecision: deny` on exit 0, blocks Stop on
+    `last_assistant_message`, briefs a subagent at SubagentStart and records
+    its end at SubagentStop.
+  - `--report` has Qwen rows, and `--report --live` probes the hook command
+    with Qwen's own payload. `tests/e2e_qwen.py` runs the real binary only
+    under `TEZGAH_E2E_SPEND=1`, because it spends a model call.
+  - `tezgah-doctor --stack` and the session attestation know the host. An
+    unknown host no longer crashes the attestation.
+  - A host-file backup is now owner-only, and a rewritten host config keeps
+    its file mode, because Qwen's settings.json holds provider keys.
+
+- **Review rules taken from google/elephant-goldfish-model (plan 137).** The
+  owner chose them from research line `egm-lessons`. No EGM file ships:
+  - `tezgah-task review NNN <r> approve` refuses a plan with no review slice
+    record. A host with no slice journal passes `--no-slice "<why>"`, and the
+    reason lands on the review line (`bin/tezgah-task`).
+  - The contract says that no fresh subagent means no review verdict. It also
+    says the author contests a finding only with a file:line and never lowers
+    a severity (`hooks/tezgah_policy.py`).
+  - tezgah-reviewer has a plan-readiness mode for a plan file. A design choice
+    left to the implementer is a major finding, and so is a section it cannot
+    paraphrase. plan-add runs it before `phase implementation`
+    (`hooks/tezgah_agents.py`).
+  - graph-review merges findings with the same file, line and title before its
+    verification cap, and reports `caps.deduplicated`.
+  - `tests/test_links.py` resolves every relative markdown link the repository
+    owns.
+
+### Changed
+
+- **The gate refuses a credit verb with "with" or "using" too.** The attribution
+  rule read `written by` and `built by`, so `Drafted with Claude` passed. The
+  credit verbs now include `drafted`, `produced` and `composed`, and each takes
+  `by`, `with` or `using` before a model or vendor name. Prose such as
+  `drafted with the owner` still passes (`hooks/tezgah_gate.py::_CREDIT`, plan
+  137).
+
+- **A release tag must sit on main.** A new `on-main` job in `release.yml`
+  fails the run on a tag off `origin/main`. Then no job builds or uploads
+  anything (plan 137).
+
+- **An owner-only choice waits for the owner.** Class F now names three more
+  steps. One is picking a variant a research, analysis or review recommends.
+  The others are a way around a tezgah refusal and deciding about another
+  session's work. The core
+  Ask policy, the per-turn reminder and the ask warning carry them too. The Stop
+  rule's `needless ask` lets a question that asks the owner to pick between
+  options through (`OWNER_CHOICE`, `hooks/tezgah_integrity.py`). A worker returns
+  such a question as `ESCALATE: owner`, and the orchestrator relays it to the
+  user instead of answering it (plan 136).
+
+- **A research line records the owner's pick apart from its own.** A rules-9
+  line writes its pick as `recommended:` in `decision.md`. A `chosen:` line
+  needs the owner's words, which `tezgah-research choose <slug> <decision>
+  <variant> --ack "<words>"` writes. The line's rules judge its own pick, never
+  the owner's, so an owner may take a dominated variant. `conclude` says when a
+  recommendation still waits for the owner (`hooks/tezgah_research.py`).
+
+- **A line in flight no longer blocks `init --allow-open`.** A line whose only
+  `check` errors are pending verdicts is in flight, not broken. Both `init`
+  refusals now say that another session's line goes to the owner.
+
+### Fixed
+
+- **Three new hosts no longer record a check that did not pass as a pass.**
+  Antigravity's PostToolUse has no output. A command that went to the
+  background also ends with an empty `error`. So the hook records each
+  Antigravity shell call as ran, never a pass, and Antigravity can never show
+  a passing check. A Copilot shell success with no `exit code N` text (a
+  background launch) is ran, never a pass. A Gemini result with a `Signal:`
+  line (a runner killed by a signal) is a failure.
+- **The gate guards Gemini's and Goose's hook-off keys.** These are Gemini's
+  `hooksConfig` and Goose's `disabledPlugins`. Claude's `disableAllHooks` had
+  the same guard.
+- **The Command Code uninstall removes tezgah's `attribution.commit: ""`
+  beside the user's other attribution keys**, not only when it stood alone.
+
+- **A hidden research dir is no longer invisible.** A dot dir under
+  `.tezgah/research/` is an error in `status` and in `check` with no slug. The
+  gate refuses a write there (`research_hidden_reason`, `hooks/tezgah_gate.py`).
+  A session had run a whole line under `.tezgah/research/.staging/` after an
+  `init` refusal.
+
+## [1.11.0] - 2026-10-23
+
+### Added
+
+- **A window names the row contract it read.** `tezgah-status --rates` now
+  counts each row's `v` per window. A window that read two contracts prints the
+  split, and a delta whose two windows lean on different contracts says so. The
+  reason is that `claims` is one quantity under `v2` and another under `v3`
+  (plan 135). A `v2` writer recorded every judged reply as a `claim` row. A `v3`
+  writer records a reply that claimed nothing as a `refusal` row. A share
+  compared across that seam is not one number, and the report no longer presents
+  it as one (`rates`, `hooks/tezgah_integrity.py`, `bin/tezgah-status`).
+
+- **The ledger reads a window, not only a lifetime.** `tezgah-status --rates
+  --since DATE --until DATE` folds every real ledger's rows in that span. The
+  fold runs per window and per calendar day. It carries turns, `claim` rows and
+  the Stop classes that blocked them. It also carries the shape flags of each
+  judged reply, and denies by rule (`rates`, `hooks/tezgah_integrity.py`). The
+  rates are blocks per 100 turns and denies per 100 sessions. They also carry
+  the claim block and Stop shape shares, and blocked claims per 100 sessions by
+  class. `--until` is exclusive, so two adjacent windows partition the span. A
+  repeated `--since`/`--until` pair prints the pp delta between adjacent
+  windows. `counters_all()` keeps answering exactly what it answered on the
+  same ledger: the window lives in the new reader. `--json` prints
+  `{"windows": [...]}`, and `docs/status-line.md` carries the reading.
+
+- **Hallmark ships as tezgah's UI generator.** `skills/hallmark` ships whole at revision `7ec8682`. It brings 48 themes, each with a picture, and 20 macrostructures. It also brings 98 reference pages and the zero-dependency `sloplint`. Every file is upstream's bytes, hashed in its own `SOURCE`. Upstream's `LICENSE` sits beside it. `tezgah-design slop --repo . [--render]` runs its gate list and writes `.tezgah/design/slop.json`. It exits 1 on a Floor FAIL. It exits 3 when Node or the skill is missing, which is a check that did not run. The Stop rule counts that verdict where it counts `tezgah-design check`. The UI floor is the union of both.
+
+- **A contract reads Hallmark's locked `design.md`, and one precedence table decides the floor.** A `design.md` or `DESIGN.md` at the repository root now feeds `derive`. It gives the palette and font roles, with `source: design-md`. The palette converts from OKLCH to the hex `check` compares. A token file beside it no longer competes. The contract gains a `precedence` block. It names `ours` (states, components, evidence, facts) and `theirs` (material, motion character). It names `shared` (contrast, focus-visible, reduced-motion, tap-target) and `verbatim: style`. `check` refuses with exit 2 a key named by two classes. It also refuses `facts` handed to a theme or to the user's own words.
+
+
+### Changed
+
+- **Skills reach the session on every armed host.** A UI ask arms a new conditional rule that names `design-contract`, `design-library`, `analyze-app` and `feature-audit`. `design-off` turns it off. The product rule also names `pm-frameworks`. A repeat match keeps the rule's action and its skill names (`ARMED_ACTIONS`), not a bare "Armed again". Every tezgah CLI in the injected text renders as its installed absolute path (`BIN_TOOLS`). Under a tight budget the skill hint now outlives the per-turn lessons and the index line. Shipped skill descriptions open with `Use when`, carry English and Turkish triggers and stay within 160 characters. Their longer text moved to a `## When to use` section, which the collision table now reads. Skill bodies call `~/.config/tezgah/bin/<cmd>`. The local skill hint ranks tezgah's and the project's skills before the hosts' global corpora. It folds Turkish letters, indexes five-letter prefixes and keeps one index per project that ships skills. The 144 vendored library entries are `ENTRY.md`, so codex and Cursor no longer list them as skills. `tezgah-skill` and `codegen` run through their `~/.config/tezgah/bin` symlink. `codegen --help` and `tezgah-research init --help` print their usage and exit zero. Cursor's per-turn text is cut to its 10000-unit hook limit, counted in UTF-16 units as Cursor counts, so Cursor no longer drops it whole. On opencode 2 the installer skips `tui.json` and `compaction.prune`, and the status line is a `cli.json` plugin. `--install --hosts X` keeps the hosts already recorded, and a partial uninstall takes its hosts off the record. A skill the repository ships reaches the hint by its path, marked as repository-provided data and read bounded. A UI build goes to `tezgah-standard`, whose brief loads `design-contract`. Agent briefs and the gate and Stop refusals name the installed CLI path too (plan 126).
+
+### Fixed
+
+- **A runner's flag does not hide its check.** `pnpm --filter mobile test` was
+  read as a plain command. The same held for `npm`, `yarn` and `bun`. A check the
+  turn really ran recorded as `run`. The Stop rule then refused the claim it
+  supported (`no verify_ok`). `VERIFY` now reads a run of flags before the task.
+  It reads the value a flag takes too: `--filter <name>`, `--prefix <dir>`,
+  `-C <dir>` and `--workspace <name>`. `uv run --project <dir> pytest` and
+  `uv run python -m pytest` join the table. So does
+  `pnpm --filter <name> exec <tool>`, which reaches the JS tool entry the same
+  way. A formatter's write mode is still a change. An information form still
+  checks nothing (`hooks/tezgah_integrity.py`, `tests/test_integrity.py`).
+
+- **A turn of reads owes no check, and the shell readers agree with bash**. The Stop rule refused an advice turn of reads in a `for` loop or a `$( )`. The model then answered in self-defence rather than acting. Such a turn now ends without a check. An edit, or a done/tested claim, is still refused. The readers that decide what a command runs now follow bash on these shapes. Both readers delete a backslash-newline exactly where bash deletes it. A `)` closing a substitution is part of the word. A `#` after a backtick, an escaped boundary or a `)` is mid-word. An fd number glued to its redirect is no program word, while `1 <` stays a program. An arm after a negated command stays alive. A `printf -v` or a `set -o` is no read. The opencode port answers the same, and `tests/fuzz_shell.py` draws these shapes so real bash checks the readers.
+
+- **More rules-8 refusals give way.** A registered metric that rewords the lock (`read-path p95 latency` for `p95 latency of the read path`) matches it. A run log above 16 MiB files whole with `source --ack "<the user's words>"`, which the refusal now names. A draw after labels is a `gold ... --redraw --ack "<the user's words>"`, which `check` reads as the draw every rule uses. A gold sample too small to reach the `mde` leaves the instrument `unvalidated`, not `rejected`. `search` takes PubMed, Scopus and ACM DL. Scopus needs `TEZGAH_SCOPUS_KEY`. ACM DL reads through Crossref's ACM member, because its site answers a browser check. `orx runs`'s table is read as runs for the census, since orx 0.2.20 has no `--json`. A quote still matches where an extraction dropped a space (`human-inthe-loop`).
+
+- **Rules-8 checks stop refusing sound lines.** A quote passes when any cited note's capture holds it. Its refusal names the notes it searched. A superseded claim's quotes go unchecked. Normalisation drops inner quotation marks and reads arXiv TeX as rendered. An open-access landing page under 100 body sentences captures as `abstract`, a step instead of a refusal. A receipt naming another id for the work warns instead of refusing. The report's share takes `closed-access`, `not full text` or `abstract-only`. Ledgers keep each version's rows in order, so merged appends pass and `check` refuses a reorder. Receipt and search rows carry their `parser` version. `check` re-derives every row and refuses one from a newer parser. `cite` keeps only 200 answers, and `check --online` compares only those. A `metric:` list no longer splits inside parentheses, digit groups or the locked name, and a word prefix matches the lock both ways. `source` refuses before writing over a metric other than the locked one or an uncommitted arena. The `not_reported` message names the exit that still works before and after the run. Log numbers read with a unit glued on. A label a refile left stale reads unlabelled. A concluded line reads its evaluator as sealed at its conclusion, and `check` also finds it in the checkout it runs in. `commit` with nothing to commit exits 0. `gold` refuses over uncommitted verdict rows. `docs/research.md` covers each change and the formats a new line writes by hand (plan 128).
+
+## [1.10.1] - 2026-10-19
+
+### Fixed
+
+- **The opencode member of a second opinion answers again.** `consult` and the judge ran `opencode run --pure`, whose exit 1 left that member silent. Both argv sites now run `opencode run` the way the user's own CLI does. No 2.x flag replaces `--pure`, so the judge's inline config still denies its tools, and `docs/judge.md` lists the flags each CLI really takes.
+- **A worktree made outside tezgah links the workspace instead of forking it.** `ensure_workspace` made a second `.tezgah` there, with its own `git init`. Research, migrate and the session start all forked the store that way. It now links the main checkout's workspace and returns it, the link a session start already made. A relative `.tezgah/...` write from the worktree lands in the one store. The link is also made on a compaction and on a delegated agent's first call. A worktree Orca or a plain `git worktree add` made stayed without one until a session started there.
+
+## [1.10.0] - 2026-10-19
+
+### Added
+
+- **A repository extends the status line with its own chips.** The repository puts `.tezgah/extension.json` at its top and names a command that prints segments. `health_segments()` walks up to the nearest manifest and runs it once per render, with the repo root as cwd. Each call reaches the child as one JSON object on its stdin: `api`, `event`, `cwd`, `repo_root` and `session_id`. The extension then knows which repository and which session asked it. It appends what comes back after every built-in mark. An extension produces data - `{key, state, glyph, text}` - and tezgah draws it. Color, the narrow-surface drop and the group separators then stay identical. The extension belongs to the user's repo in whatever language, so it runs as a bounded subprocess and never an import. A missing or malformed manifest, an absent command, a non-zero exit, a timeout or a bad shape all cost it its chips. A repo with no manifest pays one `os.path.isfile` per level.
+- **A repository says its workspace is not this harness's.** Tezgah armed every repository under a root, and no project could opt out. A committed `tezgah.owner` at the repository's top now says who owns the workspace, and its two settings turn seams off. `tasks: off` stops the plan and task machine. No active task, no per-turn phase line, and no `tezgah-task` command that writes a record runs - the slice journal and `sweep` included. The gate holds no write to its own plan files. The scope gate, research and lessons keep reading the repository. `harness: excluded` takes the repository out of every root, and nothing runs there. A repository cloned inside a marked one answers for itself, since the file comes from the nearest `.git` top. A file that cannot be …
+
+### Changed
+
+- **The no-plan refusal on a trunk offers no bind route.** On `main` or `master` it used to offer `tezgah-task start NNN --branch <trunk>`. The gate never honoured that binding, so the next write met the same refusal. The text now names the `plan/NNN-slug` route or a non-trunk branch a plan declares. `tezgah-task start --branch main` or `--branch master` now exits 2 and writes nothing.
+- **The impacted run checks a changelog entry's prose.** `tests/impacted.py` now maps `CHANGELOG.md` to `test_clarity.py` too. Before, the impacted run stayed green on an entry the ratchet refuses. The v1.9.1 release CI failed on exactly that.
+- **A linked worktree starts with its main checkout's code graph.** A new worktree had no index, so its slices fell back to text search. The auto-index now copies the main checkout's index into a worktree that has none, before the worker starts. The worker then runs the incremental `codegraph sync` on that copy. On this repository that took 1 s, against 10 s for a full `init`. `tezgah-task start` run inside a worktree does the same when it binds the plan. A copy that fails falls back to `init`.
+
+### Fixed
+
+- **A stopped installer leaves no orphan behind.** A Ctrl-C or a timeout kills the installer's whole process group. On macOS under load, a member caught mid-fork could survive that kill and hold the caller's pipes open. The cleanup now signals the group again until it is empty, for at most 2 s. Under load, 1800 runs gave 0 hangs, against 6 in about 638 before the fix.
+- **A subagent message no longer counts as a product file.** The no-plan rule read `agent://<id>` or `local://x.md` as a checkout file. Two such messages and one real file on `main` met the third-file refusal. A path with a URI scheme other than `file://` now never counts. A `file://` URL now counts as the local file it names, for the no-plan rule and the cross-session write guard alike. A Windows drive path such as `C:/x` still counts. The write guard now matches another URI such as `s3://bucket/key` on its spelling, so two sessions in different directories still race on it.
+- **The replay lists only the writers the race rule refuses on.** The replay named another writer in three cases the live race rule skips. They are a temp file, a shell target whose `$VAR` has no value, and a file an ended subagent of this session wrote. `tezgah-gate replay` and the rule now read one gate helper, so the page lists only writers the live rule would weigh. A live refusal names at most three of them, for its first path.
+
 ## [1.9.2] - 2026-10-17
 
 ### Fixed
@@ -1219,7 +1628,12 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   the copy could not find `hooks/` and died on import. It now links into the
   installed tree, and also installs the command as `tezgah`.
 
-[Unreleased]: https://github.com/r1z4x/tezgah/compare/v1.9.2...HEAD
+[Unreleased]: https://github.com/r1z4x/tezgah/compare/v1.13.0...HEAD
+[1.13.0]: https://github.com/r1z4x/tezgah/releases/tag/v1.13.0
+[1.12.0]: https://github.com/r1z4x/tezgah/releases/tag/v1.12.0
+[1.11.0]: https://github.com/r1z4x/tezgah/releases/tag/v1.11.0
+[1.10.1]: https://github.com/r1z4x/tezgah/releases/tag/v1.10.1
+[1.10.0]: https://github.com/r1z4x/tezgah/releases/tag/v1.10.0
 [1.9.2]: https://github.com/r1z4x/tezgah/releases/tag/v1.9.2
 [1.9.1]: https://github.com/r1z4x/tezgah/releases/tag/v1.9.1
 [1.9.0]: https://github.com/r1z4x/tezgah/releases/tag/v1.9.0