@r1z4x/tezgah 1.9.2 → 1.13.0

package/docs/hosts.md

@@ -1,7 +1,7 @@
 # Hosts
 
-tezgah is one Python core with six host adapters around it: `claude`, `codex`,
-`cursor`, `opencode`, `dsh`, `omp`. This page is for the maintainer wiring a new
+tezgah is one Python core with fourteen host adapters around it: `claude`, `codex`,
+`cursor`, `opencode`, `dsh`, `omp`, `qwen`, `droid`, `commandcode`, `copilot`, `gemini`, `antigravity`, `goose`, `amp`. This page is for the maintainer wiring a new
 host, adding a mark, or debugging a status line that claims something a host
 cannot see. Read it when a question starts with "does this host get X?" or "can
 this host observe Y?" - the answer is not uniform, and guessing it produces a
@@ -23,6 +23,14 @@ surface can honestly report this session; the two skill-read marks (`pony`,
 | opencode | no lifecycle events; plugin hooks: config, permission.ask, tool.execute.before, shell.env, experimental.session.compacting, chat.message, tool.execute.after (`hosts/opencode/plugins/tezgah.js:2372-2737`) - `tool.execute.before` carries the whole gate, `tool.execute.after` the channel on the row, the provenance label on the result and the taint notice on the next effect (`untrustedSource` `hosts/opencode/plugins/tezgah.js:1942`, `labelResult` `:1993`) | static only: generated `instructions` files, because there is no session-start injection point (`hosts/opencode/plugins/tezgah.js:3-6`, `bin/tezgah-setup::opencode_contract_text`) | chat.message pushes a synthetic part (`hosts/opencode/plugins/tezgah.js:2652-2703`) | TUI plugin `tezgah-tui.tsx` declared in `tui.json`, runs `tezgah-status` on the event bus (`hosts/opencode/tui/tezgah-tui.tsx:1-11`; wiring `bin/tezgah-setup::install_opencode`) | all seven: skill reads and kinds are classified in process (`hosts/opencode/plugins/tezgah.js:2227-2263`) |
 | dsh | SessionStart, SubagentStart, UserPromptSubmit, PreToolUse, PostToolUse (`hosts/dsh/hooks.json:2-19`); no Stop rule, because the bridge drops every call's outcome and no check there can show a pass | hook: the same Claude-family scripts, named by `configPath` (`bin/tezgah-setup::dsh_patch_block`) | UserPromptSubmit, through the bridge (`hosts/dsh/hooks.json:9-11`) | web-profile plugin: authenticated `GET /api/tezgah.status` -> `tezgah-status` (`hosts/dsh/statusline/lib/index.js:15,66-104`) | five tool-use: the route passes `--observable=consult,research,graph,orch,judge` (`hosts/dsh/statusline/lib/index.js:16-19,84,96`) |
 | omp | session_start, session_compact, session_switch, turn_end, before_agent_start, tool_call, tool_result, session_stop (`hosts/omp/tezgah-hook.ts.in:596,655,674,679,681,701,720,755`) | both: static `RULES.md` (`bin/tezgah-setup::STATIC_RULES`, `bin/tezgah-setup::rules_block`) and a session payload carrying only what a static file cannot know (`hosts/omp/hook.py::handle`) | before_agent_start returns a hidden message (`hosts/omp/tezgah-hook.ts.in:681-699`) | extension draws `ctx.ui.setWidget` below the editor, `setStatus` as fallback (`hosts/omp/tezgah-hook.ts.in:170-203`); ANSI line from `hosts/omp/hook.py::status_line` | all seven: the embedded runner filters skill reads before asking python (`hosts/omp/tezgah-hook.ts.in:257-264`) and no `observable` is passed (`hosts/omp/hook.py::status_line`) |
+| qwen | SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, PostToolUseFailure, SubagentStart, SubagentStop (record-only, `subagent_end`), Stop (`bin/tezgah-setup::QWEN_HOOK_EVENTS`), all in `~/.qwen/settings.json` beside Orca's rows | the managed block in `~/.qwen/QWEN.md` (`bin/tezgah-setup::STATIC_RULES`); SessionStart drops the core while the block is there (`hosts/qwen/hook.py::rules_carry_core`) | UserPromptSubmit -> `additionalContext` (`hosts/qwen/hook.py::main`) | `ui.statusLine` command in `~/.qwen/settings.json` -> `tezgah-statusline --qwen`, ANSI kept by `respectUserColors` (`bin/tezgah-setup::install_qwen`) | five tool-use (`statusline.py::observable`) |
+| droid | SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, SubagentStop (record-only, `subagent_end`), Stop (`bin/tezgah-setup::DROID_HOOK_EVENTS`), all in `~/.factory/hooks.json` | the managed block in `~/.factory/AGENTS.md` (`bin/tezgah-setup::STATIC_RULES`); SessionStart drops the core while the block is there (`hosts/droid/hook.py::rules_carry_core`) | UserPromptSubmit -> `additionalContext` (`hosts/droid/hook.py::main`) | `statusLine` command in `~/.factory/settings.json` -> `tezgah-statusline --droid`, set in place with the file's comments kept (`bin/tezgah-setup::install_droid`, `bin/tezgah-setup::jsonc_put`) | five tool-use (`statusline.py::observable`) |
+| commandcode | SessionStart, PreToolUse (matcher `shell\|write\|edit`), PostToolUse, Stop (`bin/tezgah-setup::COMMANDCODE_HOOK_EVENTS`), all in the `hooks` key of `~/.commandcode/settings.json` | the managed block in `~/.commandcode/AGENTS.md` (`bin/tezgah-setup::STATIC_RULES`); SessionStart drops the core while the block is there (`hosts/commandcode/hook.py::rules_carry_core`) | unavailable: Command Code has no prompt event | no custom status line - the segment rides `systemMessage`, plain, TUI only, at SessionStart and Stop (`hosts/commandcode/hook.py::status`) | five tool-use (`TOOL_USE_MEASURES` at `hosts/commandcode/hook.py::status`) |
+| copilot | SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, PostToolUseFailure, subagentStart, SubagentStop (record-only, `subagent_end`), Stop (`bin/tezgah-setup::COPILOT_HOOK_EVENTS`), all in tezgah's own `$COPILOT_HOME/hooks/tezgah.json` | the managed block in `$COPILOT_HOME/copilot-instructions.md` (`bin/tezgah-setup::STATIC_RULES`); SessionStart drops the core while the block is there (`hosts/copilot/hook.py::rules_carry_core`) | unavailable: Copilot drops a command hook's UserPromptSubmit output; the event still writes the turn row (`hosts/copilot/hook.py::main`) | `statusLine` command in `$COPILOT_HOME/settings.json` -> `tezgah-statusline --copilot`, written only while that file is plain JSON (`bin/tezgah-setup::install_copilot`) | five tool-use (`statusline.py::observable`) |
+| gemini | SessionStart, BeforeAgent, BeforeTool, AfterTool, AfterAgent (`bin/tezgah-setup::GEMINI_HOOK_EVENTS`), all in tezgah's own extension `~/.gemini/extensions/tezgah/hooks/hooks.json` | the managed block in `~/.gemini/GEMINI.md` (`bin/tezgah-setup::STATIC_RULES`), shared with Antigravity; SessionStart drops the core while the block is there (`hosts/gemini/hook.py::rules_carry_core`) | BeforeAgent -> `hookSpecificOutput.additionalContext`, appended to the prompt for that turn (`hosts/gemini/hook.py::main`) | no custom status line (`ui.footer.items` is a closed list) - the segment rides `systemMessage`, plain, at SessionStart and AfterAgent (`hosts/gemini/hook.py::status`) | five tool-use (`TOOL_USE_MEASURES` at `hosts/gemini/hook.py::status`) |
+| antigravity | SessionStart, PreInvocation, PreToolUse, PostToolUse, Stop (`bin/tezgah-setup::ANTIGRAVITY_HOOK_EVENTS`), all under the `tezgah` name of `~/.gemini/config/hooks.json`; the payload names no event, so each command passes it as its first argument | the managed block in `~/.gemini/GEMINI.md` (`bin/tezgah-setup::STATIC_RULES`), shared with Gemini CLI; SessionStart injects the core as a system message while the block is missing (`hosts/antigravity/hook.py::rules_carry_core`) | PreInvocation with `invocationNum` 0 -> an `injectSteps` `ephemeralMessage`; whether that number restarts each user turn is undocumented (`hosts/antigravity/hook.py::main`) | `statusLine` command in `~/.gemini/antigravity-cli/settings.json` -> `tezgah-statusline --antigravity`, written only while that file is plain JSON (`bin/tezgah-setup::install_antigravity`) | five tool-use (`statusline.py::observable`) |
+| goose | SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, PostToolUseFailure, Stop (`bin/tezgah-setup::GOOSE_HOOK_EVENTS`), all in tezgah's own plugin `~/.agents/plugins/tezgah/hooks/hooks.json`; the payload names the event in `event` | the managed block in `~/.config/goose/.goosehints` (`bin/tezgah-setup::STATIC_RULES`), which Goose adds to the system prompt of every request; no hook can inject it, because SessionStart is observation only | unavailable: Goose ignores UserPromptSubmit output; the event still writes the turn row (`hosts/goose/hook.py::main`) | unavailable: Goose has no status line and shows no hook output to the user | none drawn; the PostToolUse rows still record the five tool-use marks for `tezgah-status` (`hosts/goose/hook.py::post_tool`) |
+| amp | no hook file: tezgah's TypeScript plugin `$XDG_CONFIG_HOME/amp/plugins/tezgah.ts` (else `~/.config/amp/plugins/tezgah.ts`) subscribes to `session.start`, `agent.start`, `tool.call`, `tool.result` and `agent.end` and forwards each to `hosts/amp/hook.py` (`hosts/amp/tezgah-plugin.ts.in`) | the managed block in `~/.config/amp/AGENTS.md` (`bin/tezgah-setup::STATIC_RULES`), which Amp always includes; `session.start` cannot inject, so the session brief rides the thread's next `agent.start`, with the core only while that block is missing or `AMP_IGNORE_GUIDANCE_FILES` is set (`hosts/amp/hook.py::handle`) | hook: `agent.start` returns the reminder as a hidden message (`display: false`); a prompt that starts with `[tezgah:stop]` is tezgah's own continue and sends no `user_prompt` | the experimental `createStatusItem`, plain text, for the thread the user is looking at only (owner-approved, plan 140 A-D15); without it, no status surface | none drawn beyond the status item; the `tool.result` rows record the five tool-use marks and a skill read |
 
 The middle five marks (`consult`, `research`, `graph`, `orch`, `judge`) are tool-use marks:
 any adapter that sees its host's tool calls can light them by calling
@@ -47,15 +55,37 @@ the code path there, but no run has shown the host obeying it.
 | opencode | gate, probed by `--report --live` through a node driver | unavailable: the plugin API has no end-of-turn event | unavailable |
 | dsh | gate, probed by `--report --live` through the bridge | unavailable: ADR 003 removed the Stop entry, because the bridge carries no outcome | partial, unverified: a brief at SubagentStart, no SubagentStop entry |
 | omp | gate, probed by `--report --live` (node 22.6+) | gate, unverified (`hosts/omp/hook.py::handle`) | partial, unverified: a brief at a task session's start; `session_stop` does not fire for task sessions |
+| qwen | gate, probed by `--report --live` through the hook command in `~/.qwen/settings.json`; that the qwen binary obeys the deny is unverified until `TEZGAH_E2E_SPEND=1 python3 tests/e2e_qwen.py` runs (it spends a model call) | gate, unverified (`hosts/qwen/hook.py::main`, judged on `last_assistant_message`) | observe, unverified: a brief at SubagentStart, a record-only `subagent_end` row at SubagentStop |
+| droid | gate, probed by `--report --live` through the hook command in `~/.factory/hooks.json`; that the droid binary obeys the deny is unverified until `TEZGAH_E2E_SPEND=1 python3 tests/e2e_droid.py` runs (it spends a model call) | gate, unverified: Droid's Stop carries no reply, so the reply is read from `transcript_path` (`hosts/droid/hook.py::last_reply`), and a turn end whose reply is not there yet is a `reply_unread` row, never judged | partial, unverified: a record-only `subagent_end` row from SubagentStop's `task_result`; no SubagentStart, so no brief |
+| commandcode | gate, unverified: probed by `--report --live` through the hook command in `~/.commandcode/settings.json`, but no run of the binary has shown it obeying the deny; only shell, write and edit reach the hook (read, MCP, subagent and web tools do not), and plan mode skips every hook | gate, unverified: Stop carries no reply, so the reply is read from `transcript_path` (`hosts/commandcode/hook.py::last_reply`) and a turn end with none there is a `reply_unread` row, never judged; the host caps a block at three retries | unavailable: the settings hooks have no subagent event |
+| copilot | gate, unverified: probed by `--report --live` through the hook command in `$COPILOT_HOME/hooks/tezgah.json`, which answers with a top-level `permissionDecision: deny`, but no run of the binary has shown it obeying the deny. A PreToolUse hook that times out (10 s) lets the call through, by Copilot's own rule; one that crashes denies it. A repo's `.claude/settings.json` hooks run there too | gate, unverified: Stop carries no reply, so the reply is the last `assistant.message` in `transcript_path` (`hosts/copilot/hook.py::last_reply`), and a turn end with none there is a `reply_unread` row, never judged; the host ends the turn anyway after 8 blocks in a row | observe, unverified: a brief at subagentStart, a record-only `subagent_end` row at SubagentStop; the built-in `general-purpose` agent fires neither |
+| gemini | gate, unverified: probed by `--report --live` through the hook command in `~/.gemini/extensions/tezgah/hooks/hooks.json`, which answers with a top-level `decision: deny`, but no run of the binary has shown it obeying the deny, and no run has shown Gemini loading an extension dir written without `gemini extensions install` (its loader reads every subdir; a non-empty `security.allowedExtensions` asks for install metadata tezgah does not write). A hook that crashes or prints bad JSON is a warning and the call goes on | gate, unverified: AfterAgent carries the reply as `prompt_response` and `stop_hook_active` (`hosts/gemini/hook.py::main`); a deny sends the reason back as a new prompt | unavailable: no subagent event; a subagent is a tool call (`codebase_investigator`, `generalist`, `invoke_agent`) the gate sees as `Task` |
+| antigravity | gate, unverified: probed by `--report --live` through the hook command under the `tezgah` name of `~/.gemini/config/hooks.json`, fed Antigravity's camelCase envelope with the event as argv, which answers with a top-level `decision: deny` (an allow answers `decision: allow`, since the field is required), but no run of the binary has shown it obeying the deny. What Antigravity does when a hook crashes or times out is undocumented. The same file arms the Antigravity App and IDE | gate, unverified: Stop carries no reply, so the reply is read from `transcriptPath` (`hosts/antigravity/hook.py::last_reply`), and a turn end with none there is a `reply_unread` row, never judged; only an idle `model_stop` is judged, and `decision: continue` sends the model back into the loop with the reason as a system message. No block counter: the turn's refusal rows bound the re-asks | unavailable: no subagent event; a child conversation keeps its own ledger, and `invoke_subagent` reaches the gate as Task |
+| goose | gate, unverified: probed by `--report --live` through the hook command in `~/.agents/plugins/tezgah/hooks/hooks.json`, which answers `{"decision": "block"}` on stdout, but no run of the binary has shown it obeying the block, nor loading a plugin dir written by hand rather than by `goose plugin install` (the plugins guide says both are discovered). `on_failure` is left at its default `allow`, so a hook that crashes, times out or prints no decision lets the call through: the gate fails open on a hook fault. Only `shell`, `write`, `edit` and `<extension>__<tool>` reach the gate | gate, unverified: Stop carries the reply as `last_assistant_message` (`hosts/goose/hook.py::main`), and a Stop with none is a `reply_unread` row, never judged. It carries no count of earlier blocks, so the turn's own refusal rows bound the re-asks; Goose ends the turn anyway after `GOOSE_STOP_HOOK_BLOCK_CAP` blocks in a row | unavailable: SubagentStart and SubagentStop are not emitted; the subagent tool is not mapped |
+| amp | gate, unverified: `--report --live` loads the installed plugin with node 22.6+ (`--experimental-strip-types`) and fires its `tool.call` on a `Bash` call carrying `cmd`; the plugin answers `{action: "reject-and-continue"}`, but Amp's own Bun loader is not what ran it, so the row stays UNVERIFIED. A hook that is missing, crashes, times out or prints no JSON answers `{action: "allow"}`: the gate fails open. Only `Bash`, `shell_command`, `edit_file`, `create_file`, `apply_patch`, `Task` and an MCP effect name reach the gate | gate, unverified: `agent.end` with status `done` asks the Stop rule on the last assistant message and continues the turn with `[tezgah:stop] <reason>`; a turn that marker started is judged as the re-ask (`stop_hook_active`), and Amp's own cap of 5 continues backs the core's budget. Error and cancelled turns are not judged. A shell result passes only on an integer `exitCode` read off an output object (`hosts/amp/hook.py::call_failed`); Amp's docs do not show that its Bash result carries one, so until a run shows it no Amp check counts as passed | partial, unverified: a thread with a parent (`ctx.thread.parentThreadID()`) gets the subagent brief and a record-only `subagent_end` row at its `agent.end`; whether a Task subagent's events reach plugins is undocumented |
 
 Every host also attests its own hook entries once per session
-(`hooks/tezgah_attest.py::run`). Claude, dsh, Codex, Cursor and omp do it at
-session start. opencode does it at the first message, through `oncePerSession`.
+(`hooks/tezgah_attest.py::run`). Every host but opencode does it at session
+start. opencode does it at the first message, through `oncePerSession`.
 The `attest` row and the `drift` mark are
 [evidence](evidence.md#the-kinds-by-what-reads-them), never a block.
 `--report` prints the same comparison per host
 (`bin/tezgah-setup::attestation_rows`).
 
+Every Stop adapter hands the core the host's permission mode for the turn
+(`hooks/tezgah_integrity.py::read_only_turn`, plan 142). Claude, Command Code,
+Qwen, Copilot, Gemini, Codex, Goose, Droid and Cursor send it as
+`permission_mode` on the Stop payload (Antigravity's envelope is camelCase,
+`permissionMode`). omp has no such field, so its extension reads
+`ctx.sessionModes.getState().plan` and sends `plan` when it is active
+(`hosts/omp/tezgah-hook.ts.in`). A host that sends nothing reads as `default`.
+Only `plan` and Droid's `spec` change a verdict, and only two of them: the rule
+lets the approval question such a turn ends on through, and refuses a
+done/tested claim in it
+([evidence](evidence.md#the-stop-rule-end-to-end)). Claude's hooks reference
+documents the field on its own Stop payload. Every other adapter reads whatever
+its payload carries.
+
 ## What each host gets, and where it is written
 
 Every host gets the skill symlinks from `SKILLS` (`bin/tezgah-setup::SKILLS`)
@@ -98,6 +128,15 @@ shared config, contract hash and the CLI symlinks every host shell can call
   (`instructions`, `mcp`, `permission.skill=deny`, `compaction.prune`,
   `watcher.ignore`, the two `external_directory` grants) and `tui.json` +
   `tui-plugins/tezgah-tui.tsx`.
+  The installer detects opencode 2 by its `cli.json` (`bin/tezgah-setup::opencode_v2`).
+  On opencode 2 the plugin, the skill links, `opencode.json` and its
+  `instructions` still load.
+  `tui.json` and `compaction.prune` are not written there: opencode 2 ignores
+  `tui.json` after its first start and does not support `compaction.prune`, a legacy setting.
+  The install report drops those two rows on opencode 2.
+  On opencode 2 the status line is `hosts/opencode/tui/cli/tui.tsx`. The installer
+  links it as the directory `tui-plugins/tezgah-cli` and lists it in `cli.json`
+  `plugins`. opencode 2 skips an entry that names a file. It loads a directory's `tui` module.
 - **dsh** - `install_dsh` (`bin/tezgah-setup::install_dsh`): `~/.dsh/skills/*` symlinks,
   a managed block in `~/.dsh/cordis.patch.yml` (`dsh_patch_block`, `bin/tezgah-setup::dsh_patch_block`) that
   mounts the Claude-code hook bridge on `hosts/dsh/hooks.json`, the MCP client
@@ -117,6 +156,122 @@ shared config, contract hash and the CLI symlinks every host shell can call
   its own: orx's `codex` target writes the shim to `~/.agents/skills/orx`,
   omp's native `agents` skill root, so `install_openresearch` maps omp onto it
   (`ORX_AGENTS`, `bin/tezgah-setup::ORX_AGENTS`).
+- **qwen** - `install_qwen` (`bin/tezgah-setup::install_qwen`) writes into
+  `~/.qwen/settings.json` (or `$QWEN_HOME`). It adds one hook group per event of
+  `QWEN_HOOK_EVENTS`, each `timeout` in milliseconds. The PreToolUse group
+  carries `QWEN_PRETOOL_MATCHER` over Qwen's runtime tool ids. It also sets
+  `ui.statusLine`. Orca's groups and the provider keys in that file stay, and
+  the backup is owner-only (`bin/tezgah-setup::backup`). The install links
+  `skills/*` into `~/.qwen/skills`. It writes the always-on block in
+  `~/.qwen/QWEN.md`. tezgah writes no subagent roles, MCP rows or orx shim for
+  Qwen yet.
+- **droid** - `install_droid` (`bin/tezgah-setup::install_droid`) writes
+  `~/.factory/hooks.json`, keyed by event at the top. It adds one hook group per
+  event of `DROID_HOOK_EVENTS`, each `timeout` in seconds, and keeps the user's
+  own groups. The PreToolUse group carries `DROID_PRETOOL_MATCHER` over Droid's
+  tool ids. Droid reads the `hooks` key of `settings.json` only while hooks.json
+  is absent. The install then writes no hooks.json and says why
+  (`bin/tezgah-setup::droid_hooks_blocked`). Droid's settings.json holds
+  comments, so the install edits it in place and keeps them
+  (`bin/tezgah-setup::jsonc_put`). It adds the `statusLine`. It sets
+  `includeCoAuthoredByDroid` to false, the switch for Droid's co-author trailer.
+  A file it cannot edit safely is left alone and the run names both keys. The install
+  links `skills/*` into `~/.factory/skills` beside the user's own links. It
+  writes the always-on block in `~/.factory/AGENTS.md`. The uninstall deletes a
+  hooks.json that held only tezgah's groups. An empty one would still hide
+  settings.json's hooks. tezgah writes no subagent roles, MCP rows or orx
+  shim for Droid yet.
+- **commandcode** - `install_commandcode` (`bin/tezgah-setup::install_commandcode`)
+  writes into the `hooks` key of `~/.commandcode/settings.json`. It adds one
+  hook group per event of `COMMANDCODE_HOOK_EVENTS`, each `timeout` in seconds.
+  The user's own groups stay, and the backup is owner-only. The PreToolUse group
+  carries `COMMANDCODE_PRETOOL_MATCHER`, which Command Code tests against the
+  tool's display name. The same write sets `attribution.commit` to `""`. That
+  turns off the default `Co-authored-by: CommandCodeBot` commit trailer. A value
+  the user set stays. The uninstall removes the key only while it holds what the
+  install wrote. The install links `skills/*` into `~/.commandcode/skills`. It
+  writes the always-on block in `~/.commandcode/AGENTS.md`. tezgah writes no
+  subagent roles, MCP rows or orx shim for Command Code yet.
+- **copilot** - `install_copilot` (`bin/tezgah-setup::install_copilot`) writes
+  `$COPILOT_HOME/hooks/tezgah.json`, a `{"version": 1, "hooks": ...}` file that
+  is wholly tezgah's. `COPILOT_HOME` defaults to `~/.copilot`. The file holds
+  one entry per event of `COPILOT_HOOK_EVENTS`, each `timeoutSec` in seconds.
+  The inline `hooks` key of settings.json is never used, since one bad item
+  there rejects every hook in it. The PreToolUse entry carries
+  `COPILOT_PRETOOL_MATCHER`. settings.json is JSON with comments. So the status
+  line and `includeCoAuthoredBy: false` go in only while it parses as plain
+  JSON. That setting turns off the default `Co-authored-by` trailer on the
+  agent's commits. A value the user set stays. The install links `skills/*`
+  into `$COPILOT_HOME/skills` and writes the always-on block in
+  `$COPILOT_HOME/copilot-instructions.md`. The uninstall deletes tezgah.json
+  and takes back only tezgah's settings keys. tezgah writes no subagent roles,
+  MCP rows or orx shim for Copilot yet.
+- **gemini** - `install_gemini` (`bin/tezgah-setup::install_gemini`) writes
+  tezgah's own extension, `~/.gemini/extensions/tezgah/`, which is wholly
+  tezgah's. `GEMINI_CLI_HOME` moves `~/.gemini` under it. The dir holds
+  `gemini-extension.json`, `hooks/hooks.json` with one group per event of
+  `GEMINI_HOOK_EVENTS` (each `timeout` in milliseconds) and `skills/*` links.
+  The BeforeTool group carries `GEMINI_PRETOOL_MATCHER`. settings.json is never
+  written: it is JSON with comments and holds the user's keys. Gemini's default
+  prompt adds no co-author trailer and no setting names one, so there is
+  nothing to turn off. The install writes the always-on block in
+  `~/.gemini/GEMINI.md`, which Antigravity reads too. The uninstall deletes the
+  extension dir. It strips the block only while no other host of
+  `GEMINI_MD_HOSTS` stays armed (`bin/tezgah-setup::gemini_md_kept`). Gemini
+  gets no subagent roles, MCP rows or orx shim from tezgah yet.
+- **antigravity** - `install_antigravity` (`bin/tezgah-setup::install_antigravity`)
+  writes tezgah's hook set under the top-level `tezgah` name of
+  `~/.gemini/config/hooks.json`, beside the user's other names. Each event of
+  `ANTIGRAVITY_HOOK_EVENTS` gets one item, its `timeout` in seconds. PreToolUse
+  and PostToolUse take a matcher group, the others a bare handler. Antigravity
+  never loads hooks from `antigravity-cli/settings.json`. The Antigravity App
+  and IDE read the same global hooks.json, so the install arms them too. The
+  status line goes in `~/.gemini/antigravity-cli/settings.json` only while it
+  is plain JSON. The skill links go in `antigravity-cli/skills`. Antigravity
+  adds no co-author trailer of its own, and no setting names one. An open
+  feature request asks for one (google-antigravity/antigravity-cli#230). The
+  always-on block is the `~/.gemini/GEMINI.md` one Gemini CLI shares
+  (`bin/tezgah-setup::gemini_md_kept`). The uninstall takes out the `tezgah`
+  name, the statusLine and the links. It removes a file that held only
+  tezgah's keys. Antigravity gets no subagent roles, MCP rows or orx shim from
+  tezgah yet. Antigravity can never show a passing check. Its PostToolUse
+  carries no output. A shell call that went to the background also ends with an
+  empty `error`. So the hook records each shell call as ran, never a pass
+  (`hosts/antigravity/hook.py::post_tool`). The owner chose this: a done or
+  tested claim there always stops at the Stop rule's `no verify_ok` class.
+- **goose** - `install_goose` (`bin/tezgah-setup::install_goose`) writes
+  tezgah's own plugin, `~/.agents/plugins/tezgah/`, which is wholly tezgah's.
+  It holds `plugin.json`, `hooks/hooks.json` and `skills/*` links. The hooks
+  file has one group per event of `GOOSE_HOOK_EVENTS`, each `timeout` in
+  seconds. Goose loads the skills as `tezgah:<skill>`. Goose tests a matcher
+  unanchored, so the PreToolUse group carries the anchored
+  `GOOSE_PRETOOL_MATCHER`. No hook sets `on_failure`, so it stays at Goose's
+  default `allow`, and a hook fault lets the call through. The always-on block
+  goes in `~/.config/goose/.goosehints`. Neither Goose's docs nor its system
+  prompt add a co-author trailer or name a setting for one. The uninstall
+  deletes the plugin dir and strips the block. The rest of `~/.agents` is the
+  user's and stays. The install ignores `GOOSE_PATH_ROOT`, since the docs
+  do not say where it puts the hints file. Goose gets no subagent roles, MCP
+  rows or orx shim from tezgah yet.
+- **amp** - `install_amp` (`bin/tezgah-setup::install_amp`) writes one file,
+  `tezgah.ts`, into Amp's system plugin dir (`hooks/tezgah_paths.py::AMP_PLUGIN`,
+  under `XDG_CONFIG_HOME` when that is set). `hooks/tezgah_attest.py::amp_plugin`
+  renders it from `hosts/amp/tezgah-plugin.ts.in`. Amp loads every `.ts` there,
+  and nothing registers it. A running Amp needs `plugins: reload`. The plugin
+  spawns `hosts/amp/hook.py` without blocking, one JSON in and one out. One
+  plugin process serves many threads, so it keys all its state by thread id.
+  The install links the skills into `~/.config/amp/skills` and writes the
+  always-on block into `~/.config/amp/AGENTS.md`. By default Amp adds a
+  `Co-authored-by: Amp` and an `Amp-Thread-ID` trailer to its commits. The
+  install sets `amp.git.commit.coauthor.enabled` and
+  `amp.git.commit.ampThread.enabled` to false in `~/.config/amp/settings.json`
+  unless the user set them. It writes that file only while it is plain JSON
+  with no `settings.jsonc` beside it (`bin/tezgah-setup::amp_settings`). Else it
+  prints both keys to set by hand. The uninstall removes the plugin only when
+  it is a fresh render or starts with tezgah's header line
+  (`bin/tezgah-setup::amp_plugin_ours`). It drops a trailer key only while that
+  key is still false. Amp gets no subagent roles, MCP rows or orx shim from
+  tezgah.
 
 An adapter is responsible for its host's **envelope** and its **surface**: it
 translates the host's event and tool names into the shared vocabulary (one call
@@ -124,7 +279,7 @@ has to hash to one id - `hosts/codex/hook.py::gate_name`, `hosts/cursor/hook.py:
 draws the line, and returns the host's own output shape. The contract text, the
 gate decision, the evidence ledger, the untrusted-content marks and the segment
 builder stay in the shared core under `hooks/` (`hosts/omp/hook.py:1-12`,
-`hosts/cursor/hook.py:1-41`).
+`hosts/cursor/hook.py:1-44`).
 
 ## Where the always-on core reaches each host
 
@@ -140,6 +295,14 @@ pays for it once.
 | opencode | no stdout-inject hook: `install_opencode` writes the generated `~/.config/tezgah/opencode-contract.md` and references it from `opencode.json` `instructions` |
 | omp | the managed block in `~/.omp/agent/RULES.md` |
 | dsh | the session's own hook context: `hosts/dsh/hooks.json` runs the Claude-family scripts through the bridge, and no dsh file carries the core, so dsh's `SessionStart` row declares nothing and still gets it here (`~/.dsh/cordis.patch.yml` mounts that bridge) |
+| qwen | the managed block in `~/.qwen/QWEN.md`, which Qwen loads into every session; its `SessionStart` hook repeats the core only while that block is missing (`hosts/qwen/hook.py::rules_carry_core`) |
+| droid | the managed block in `~/.factory/AGENTS.md`, which Droid loads as coding guidelines at startup; its `SessionStart` hook repeats the core only while that block is missing (`hosts/droid/hook.py::rules_carry_core`) |
+| commandcode | the managed block in `~/.commandcode/AGENTS.md`, the user memory file Command Code puts in the system prompt; its `SessionStart` hook repeats the core only while that block is missing (`hosts/commandcode/hook.py::rules_carry_core`) |
+| copilot | the managed block in `$COPILOT_HOME/copilot-instructions.md`, Copilot's personal instructions file, applied to every session; its `SessionStart` hook repeats the core only while that block is missing (`hosts/copilot/hook.py::rules_carry_core`) |
+| gemini | the managed block in `~/.gemini/GEMINI.md`, the global context file Gemini puts in the system prompt and Antigravity reads too; its `SessionStart` hook repeats the core only while that block is missing (`hosts/gemini/hook.py::rules_carry_core`) |
+| antigravity | the same managed block in `~/.gemini/GEMINI.md`, a standalone global rule Antigravity keeps always on (24,000-byte file limit); its `SessionStart` hook injects the core as a system message only while that block is missing (`hosts/antigravity/hook.py::rules_carry_core`) |
+| goose | the managed block in `~/.config/goose/.goosehints`, the global hints file Goose adds to the system prompt of every request; no hook repeats it, because no Goose hook output reaches the model outside a block |
+| amp | the managed block in `~/.config/amp/AGENTS.md`, which Amp always includes; the session brief on the thread's first turn repeats it only while that block is missing or `AMP_IGNORE_GUIDANCE_FILES` is set (`hosts/amp/hook.py::rules_carry_core`) |
 
 An installed host whose core line is missing is a health check's business
 (`host_checks_<host>`), not a second copy: two delivery paths for one host is the
@@ -158,11 +321,27 @@ and drops the later ones.
 | context | cursor | the `sessionStart` hook context, the repo's `AGENTS.md`, `.cursor/rules/*.mdc`, `.cursorrules` | the hook |
 | context | opencode | `~/.config/opencode/AGENTS.md`, `opencode.json` `instructions`, the repo's `AGENTS.md` | the contract and router files in `instructions` |
 | context | omp | `SYSTEM.md`, `APPEND_SYSTEM.md`, `RULES.md` (sticky), the repo's `.omp/AGENTS.md`, `AGENTS.md`, `CLAUDE.md`; another host's user files only with `enabledProviders` | block in `RULES.md`, the extension at session start |
+| context | qwen | `~/.qwen/QWEN.md`, the repo's `QWEN.md` and `AGENTS.md`, then `.qwen/QWEN.local.md`; all load | block in the first |
+| context | droid | from the cwd up to the git root, `AGENTS.md` (or `CLAUDE.md`) in each dir and its `.factory/`, `.agents/`, `.agent/`; then `~/.factory/AGENTS.md` and the other personal dirs; project files override personal ones | block in `~/.factory/AGENTS.md` |
+| context | commandcode | `~/.commandcode/AGENTS.md`, the repo's `AGENTS.md` (else `.commandcode/AGENTS.md`), then each subdirectory's; all load | block in the first |
+| context | copilot | `$COPILOT_HOME/copilot-instructions.md` and `instructions/`, then in the git root and the cwd `.github/copilot-instructions.md`, `.github/instructions/`, `AGENTS.md`, `CLAUDE.md`, `GEMINI.md` and `.claude/rules/`; all merge | block in the first |
+| context | gemini | `~/.gemini/GEMINI.md`, then from the cwd up to the git root, then subdirectories (`context.fileName` renames the file); all concatenate | block in the first |
+| context | antigravity | `~/.gemini/AGENTS.md` and `GEMINI.md`, `~/.gemini/config/rules/*.md`, `~/.gemini/antigravity-cli/rules/*.md`, then the workspace's `AGENTS.md`, `GEMINI.md` and `.agents/rules/`, and plugin rules; all combine, more specific rules win a conflict, and over 20,000 tokens the largest files become pointers | block in `~/.gemini/GEMINI.md` |
+| context | goose | `CONTEXT_FILE_NAMES` (default `AGENTS.md`, `.goosehints`) in `~/.config/goose/`, then in the project root and each directory goose reads; all load, and a local hint wins over a global one | block in `~/.config/goose/.goosehints` |
+| context | amp | `AGENTS.md` in the cwd and its parents, subtree files on a read, then `~/.config/amp/AGENTS.md` and `~/.config/AGENTS.md`; all load, and `AMP_IGNORE_GUIDANCE_FILES` skips matching files | block in `~/.config/amp/AGENTS.md` |
 | skills | omp | `skills.customDirectories`, then `.omp/skills` and `~/.omp/agent/skills`, Claude's project dir (user dir opt-in), `.agents/skills` and `~/.agents/skills`; first wins, identical copies collapse, a differing copy is renamed `<namespace>/<name>` | links in `~/.omp/agent/skills` |
 | skills | claude | `.claude/skills`, `~/.claude/skills`; plugin skills are namespaced `tezgah:<name>` | the plugin copy |
 | skills | codex | `.agents/skills` from the cwd up to the repo root, `~/.agents/skills`, `$CODEX_HOME/skills`; one name in two dirs is listed twice, not merged | links in `$CODEX_HOME/skills` |
 | skills | cursor | `.agents/skills`, `.cursor/skills`, `~/.agents/skills`, `~/.cursor/skills`, then Claude's and Codex's project and user dirs; no documented winner | links in `~/.cursor/skills` |
 | skills | opencode | its own skill tool is denied; the router lists `~/.config/opencode/skills`, `~/.claude/skills`, `~/.agents/skills`, first wins (`bin/tezgah-setup::skill_groups`) | links and the router |
+| skills | qwen | `~/.qwen/skills`, `.qwen/skills`, extension and bundled skills; no documented winner | links in `~/.qwen/skills` |
+| skills | droid | `.factory/skills` (project and folder), `~/.factory/skills`, `.agents/skills` and `~/.agents/skills`, plugin and built-in skills; no documented winner | links in `~/.factory/skills`, beside the user's own |
+| skills | commandcode | `.commandcode/skills`, `.agents/skills`, `~/.commandcode/skills`, `~/.agents/skills`, extra locations, bundled; first wins | links in `~/.commandcode/skills` |
+| skills | copilot | `.github/skills`, `.agents/skills`, `.claude/skills`, a parent's `.github/skills`, `$COPILOT_HOME/skills`, `~/.agents/skills`, plugins, `COPILOT_SKILLS_DIRS`, bundled; first wins | links in `$COPILOT_HOME/skills` |
+| skills | gemini | workspace `.agents/skills` and `.gemini/skills`, user `~/.agents/skills` and `~/.gemini/skills`, extension skills, built-in; higher tier wins, `.agents/skills` wins within one | links in the extension's `skills/`, the lowest tier |
+| skills | antigravity | the workspace's `.agents/skills`, `~/.gemini/antigravity-cli/skills`, plugin skills; no documented winner | links in `~/.gemini/antigravity-cli/skills` |
+| skills | goose | `~/.agents/skills`, `.agents/skills`, plugin skills (namespaced `<plugin>:<name>`), then `.goose/skills`, `.claude/skills` and `~/.claude/skills` for backward compatibility; no documented winner | links in the plugin's `skills/`, loaded as `tezgah:<name>` |
+| skills | amp | `~/.config/agents/skills`, `~/.agents/skills`, `~/.config/amp/skills`, `.agents/skills`, `.claude/skills`, `~/.claude/skills`, then plugin and configured paths; first name wins | links in `~/.config/amp/skills` |
 | agents | claude | managed, the `claude --agents` flag, `.claude/agents`, `~/.claude/agents`, plugin agents namespaced `plugin:name`; a dir absent at start is not watched | `~/.claude/agents`, written at install |
 | agents | codex | `$CODEX_HOME/agents`, `/etc/codex/agents`, `.codex/agents` (trusted repos only), read at config load | `$CODEX_HOME/agents`, written at install |
 | agents | cursor | `cursor-agent`: `.cursor/agents`, then `.claude/agents`, `.grok/agents`, plugin agents; first name wins; no user dir; read at process start. The editor's docs add `~/.cursor/agents` and `~/.claude/agents` | `.cursor/agents` per repo at session start, in the CLI's line format (`hooks/tezgah_agents.py::render_md_cursor`) |
@@ -172,7 +351,16 @@ and drops the later ones.
 | hooks | codex, cursor | `hooks.json` array order, then the repo's `.codex/` or `.cursor/hooks.json`; Codex runs a row only once its hash is trusted | own rows after Orca's |
 | hooks | opencode | every `*.js`/`*.ts` in `plugins/` and `plugin/`; `tezgah.js` is linked into both, and its `globalThis.__tezgahPluginLoaded` guard makes the second load return `{}` | the plugin |
 | hooks | omp | `~/.omp/agent/extensions/` first, then `config.yml` `extensions:`, one load per absolute path; per event in that order, and the first `block` ends a tool call | the bridge in `hooks/pre/` |
-| mcp | each | omp: project `.omp/mcp.json`, then `~/.omp/agent/mcp.json`, first name wins; claude: `~/.claude.json`, the repo's `.mcp.json`, the plugin's `.mcp.json`; codex: `$CODEX_HOME/config.toml`; cursor: `~/.cursor/mcp.json`; opencode: `opencode.json` `mcp` | one `tezgah` and one `codegraph` row per host |
+| hooks | qwen | user `settings.json` rows (Orca's and tezgah's), then project `.qwen/settings.json` rows in trusted folders; groups run in parallel unless `sequential` | own rows after Orca's |
+| hooks | droid | org-managed hooks, user `~/.factory/hooks.json`, project `.factory/hooks.json` and enabled plugins' `hooks/hooks.json`, merged with no documented order; a scope's settings.json `hooks` key counts only while its hooks.json is absent | own rows in hooks.json |
+| hooks | commandcode | project `.commandcode/settings.json` rows, then user `~/.commandcode/settings.json` rows; PreToolUse runs them in order and stops at the first deny, the other events run in parallel | own rows in the user settings.json |
+| hooks | copilot | policy files, then the repo's `.github/hooks/*.json`, user `$COPILOT_HOME/hooks/*.json`, the inline `hooks` of the repo's and the user's settings.json (and the repo's `.claude/settings.json`), then plugins; every entry runs, and any PreToolUse deny blocks | own file `hooks/tezgah.json` |
+| hooks | gemini | project `.gemini/settings.json`, user `~/.gemini/settings.json`, system settings, then extensions' `hooks/hooks.json`; `hooksConfig.enabled: false` runs none | own extension `extensions/tezgah/hooks/hooks.json` |
+| hooks | antigravity | workspace `.agents/hooks.json`, global `~/.gemini/config/hooks.json`, then installed plugins' `hooks.json`; each top-level name is a hook set, and `enabled: false` on a name loads none of it | the `tezgah` name in the global hooks.json |
+| hooks | goose | user `~/.agents/plugins/<name>/hooks/hooks.json`, project `.agents/plugins/<name>/hooks/hooks.json` and installed plugins; a name in `disabledPlugins` of `~/.config/goose/settings.json` loads none of it; any PreToolUse block denies | own plugin `~/.agents/plugins/tezgah/hooks/hooks.json` |
+| hooks | amp | plugins: personal and workspace ones from Amp's settings, the project's `.amp/plugins/`, the system `$XDG_CONFIG_HOME/amp/plugins/`; a project plugin wins over a system one of the same name, and every plugin gets every event in no defined order | the system plugin `tezgah.ts` |
+| mcp | each | omp: project `.omp/mcp.json`, then `~/.omp/agent/mcp.json`, first name wins; claude: `~/.claude.json`, the repo's `.mcp.json`, the plugin's `.mcp.json`; codex: `$CODEX_HOME/config.toml`; cursor: `~/.cursor/mcp.json`; opencode: `opencode.json` `mcp`; qwen: `settings.json` `mcpServers`; droid: `~/.factory/mcp.json`; commandcode: `settings.json` `mcp.servers`, `~/.commandcode/mcp.json`, the repo's `.mcp.json`; copilot: `$COPILOT_HOME/mcp-config.json`, the repo's `.mcp.json` and `.github/mcp.json`, project first; gemini: `settings.json` `mcpServers` (user, project) and each extension's `gemini-extension.json`, settings.json first; antigravity: `~/.gemini/config/mcp_config.json`, the workspace's `.agents/mcp_config.json` and plugins, the running server keeps a shared name; goose: the `extensions:` map of `~/.config/goose/config.yaml`; tezgah writes no row for qwen, droid, commandcode, copilot, gemini, antigravity or goose yet | one `tezgah` and one `codegraph` row per host but qwen, droid, commandcode, copilot, gemini, antigravity and goose |
+| mcp | amp | `amp.mcpServers` in `~/.config/amp/settings.json`, then the workspace's `.amp/settings.json`, which wins | none: tezgah writes no MCP row for Amp |
 
 Orca is a launcher, not a host. It starts omp with its own `--extension`. It
 gives each Codex account its own `CODEX_HOME` under
@@ -215,6 +403,14 @@ three harness configurations while swapping the model inside one harness moved i
 | opencode | a selector read from `opencode models` (`hooks/tezgah_models.py:12`) | the AI SDK: `@ai-sdk/openai-compatible` for `/v1/chat/completions`, `@ai-sdk/openai` for `/v1/responses`, beside its own Anthropic and Bedrock providers (opencode's provider docs) | vendor documentation |
 | omp | the session default's family, otherwise `task.agentModelOverrides` and `modelRoles.plan` (`hooks/tezgah_models.py:13-16`) | whichever provider the selected model names - Anthropic Messages, OpenAI Responses, OpenAI chat completions, Google, Bedrock - with text-based dialects where a native tool API is unavailable; the OpenRouter route dispatches to Responses unless `PI_OPENROUTER_RESPONSES=0` (omp's own `provider-compat-reference` documentation) | the tool's own documentation |
 | dsh | the Claude-family scripts through the bridge (`hosts/dsh/hooks.json:2-18`); `README.md:27-28` calls it "DeepSeek's dsh harness" | `unverified`: its own `--help` describes it as "an ordered stack of plugin-bundle patch layers" and names no model API, and its profile directory names a provider (DeepSeek) rather than a wire (checked 2026-10-01) | - |
+| qwen | not named: tezgah writes no Qwen subagent roles | the provider `settings.json` `modelProviders` selects, keyed by auth type - `openai` (OpenAI-compatible), `anthropic`, `gemini`, `vertex-ai` - each with its own `baseUrl` (Qwen Code 0.21.13 `configuration/model-providers.md`) | the tool's own documentation |
+| droid | not named: tezgah writes no Droid subagent roles | `unverified`: tezgah has not mapped Droid's providers to a wire | - |
+| commandcode | not named: tezgah writes no Command Code subagent roles | `unverified`: tezgah has not mapped Command Code's providers to a wire | - |
+| copilot | not named: tezgah writes no Copilot subagent roles | `unverified`: tezgah has not mapped Copilot's providers to a wire | - |
+| gemini | not named: tezgah writes no Gemini subagent roles | `unverified`: tezgah has not mapped Gemini's providers to a wire | - |
+| antigravity | not named: tezgah writes no Antigravity subagent roles | `unverified`: tezgah has not mapped Antigravity's models to a wire | - |
+| goose | not named: tezgah writes no Goose subagent roles | `unverified`: tezgah has not mapped Goose's providers to a wire | - |
+| amp | not named: tezgah writes no Amp subagent roles | `unverified`: tezgah has not mapped Amp's models to a wire | - |
 
 `unverified` is the point of the column rather than a gap in it. A wrong dialect
 here is worse than a blank one: a reader would use it to explain a score, and the
@@ -227,12 +423,13 @@ A skill read is observable only where the host gives a channel that does not cos
 a process per read: Claude parses its transcript (`statusline.py::claude_used`),
 opencode classifies in process (`hosts/opencode/plugins/tezgah.js:2227-2263`),
 omp filters in its embedded runner before it asks python
-(`hosts/omp/tezgah-hook.ts.in:257-264`). On codex, cursor and dsh a read is not
-observable at that price, so their surfaces pass the five tool-use measures as
-`observable` and the two skill marks render dim (`info`, no glyph) instead of
+(`hosts/omp/tezgah-hook.ts.in:257-264`), and Amp's plugin does the same for a
+`Read` of a shipped skill (`hosts/amp/tezgah-plugin.ts.in`). On codex, cursor, qwen, droid, commandcode, copilot, gemini, antigravity, goose and dsh a read is not
+observable at that price. Their surfaces pass the five tool-use measures as
+`observable`, and the two skill marks render dim (`info`, no glyph) instead of
 claiming the skill was never opened (`hooks/tezgah_context.py::TOOL_USE_MEASURES`, and the
 `observable` branch at `hooks/tezgah_context.py::health_segments`). Callers that pass `TOOL_USE_MEASURES`:
-`statusline.py::observable`, `hosts/codex/hook.py::main`,
+`statusline.py::observable`, `hosts/codex/hook.py::main`, `hosts/commandcode/hook.py::status`,
 `hosts/dsh/statusline/lib/index.js:16-19`. A kill switch is observable everywhere
 and still renders `off` (`hooks/tezgah_context.py::health_segments`).
 
@@ -251,11 +448,24 @@ In order, each step verified by the one below it:
    (`hosts/omp/tezgah-hook.ts.in` rendered at `hooks/tezgah_attest.py::omp_bridge`).
 3. `install_<host>()` writing that host's files, registered in `INSTALLERS`
    (`bin/tezgah-setup::INSTALLERS`), and `uninstall_<host>()` removing only
-   tezgah-managed links and blocks (`bin/tezgah-setup:3287-3419`).
+   tezgah-managed links and blocks, registered in `UNINSTALLERS` (`bin/tezgah-setup::UNINSTALLERS`).
 4. `host_checks_<host>()` returning `(label, bool)` rows over what was actually
    written, registered in `HOST_CHECKS` (`bin/tezgah-setup::HOST_CHECKS`); the
    `--report` output is that list (`bin/tezgah-setup::report`). Give the row a home-qualified
    label if the host's dir can be relocated (`host_checks_codex`, `bin/tezgah-setup::host_checks_codex`).
+   The first row is the host's "wired" row (`bin/tezgah-setup::hosts_row`), and a
+   row whose MISS means unarmed names a label `ARMING_ROWS` carries
+   (`bin/tezgah-setup::ARMING_ROWS`).
+   Every other table keyed by host grows with it, or the host crashes or drops
+   out there. `hooks/tezgah_stack.py::host_stack` raises on an unknown host, so
+   `tezgah-doctor --stack` fails. The other tables are
+   `hooks/tezgah_stack.py::tezgah_skill_dirs`, `hooks/tezgah_attest.py::registration`
+   and `CODE_TARGETS`, `bin/tezgah-setup::hook_entries` and
+   `bin/tezgah-setup::live_plan`. Without `live_plan` the live rows read
+   UNVERIFIED. The gate's control plane grows too: `HOOK_ENTRIES`, `HOOK_HOSTS`
+   and the shared files of `hooks/tezgah_gate.py::_registration`. The gate then
+   refuses a forged run of the new hook, and an edit of its registration, as it
+   refuses the others.
 5. Decide the surface: a `statusLine` command, a TUI/widget plugin, or the
    `systemMessage` fallback (`hosts/codex/hook.py:10-12`). Pass `observable` if
    the host cannot see a skill read, and `idx_override` on any redraw that must
@@ -265,7 +475,9 @@ In order, each step verified by the one below it:
    `CodexHome:657-702`, `CursorMatcher:705-722`, `DshStatusline:872-957`), and an
    opt-in script under `tests/e2e_*.py` for the thing only a real host can prove
    - not collected by `unittest discover`, it exits 0 with `SKIP` when the host
-   is absent (`tests/e2e_omp_statusline.py:13-16`).
+   is absent (`tests/e2e_omp_statusline.py:13-16`). A script that calls a model
+   also exits 0 with `SKIP` unless `TEZGAH_E2E_SPEND=1` is set
+   (`tests/e2e_qwen.py`, `tests/e2e_droid.py`).
 
 ## Host-specific limits worth knowing
 
@@ -278,6 +490,26 @@ In order, each step verified by the one below it:
     `gate✗` appears only in the SessionStart/Stop status message.
   - **cursor, dsh:** observed only if their prompt payload carries `transcript_path`
     (unverified on a live host).
+  - **qwen:** unverified. Its prompt payload carries `transcript_path`. The counter
+    reads only the Claude, omp and Codex row shapes (`hooks/tezgah_context.py::_transcript_calls`).
+    No run has captured Qwen's transcript format yet, so a disarmed gate there likely counts 0.
+  - **droid:** unverified on a live host. Its transcript rows carry `message.content`
+    `tool_use` blocks with a `timestamp`, the Claude shape the counter reads, and
+    `GATED_TOOLS` names `Execute`, `Create` and `ApplyPatch`
+    (`hooks/tezgah_context.py::GATED_TOOLS`).
+  - **commandcode:** unavailable: Command Code has no prompt event, so nothing runs the
+    counter there.
+  - **copilot:** unavailable: Copilot drops a command hook's UserPromptSubmit output,
+    so no reminder carries the counter's warning there.
+  - **gemini:** unverified. BeforeAgent carries `transcript_path`, but Gemini's
+    session file is a format the counter does not read
+    (`hooks/tezgah_context.py::_transcript_calls`), so a disarmed gate there likely counts 0.
+  - **antigravity:** unavailable: its `transcript.jsonl` is not a format the counter
+    reads, so the hook does not hand it over. Only a switch armed mid-session shows.
+  - **goose:** unavailable: Goose ignores UserPromptSubmit output, so no reminder
+    carries the counter's warning there.
+  - **amp:** unavailable: the plugin hands the hook no transcript path, so only a
+    switch armed mid-session shows.
   - **omp, opencode:** not applicable: the prompt hook and the gate live in one extension or
     plugin process, so one cannot run without the other.
   - Everywhere: a disarmed PreToolUse beside a working PostToolUse writes rows and is not
@@ -398,9 +630,14 @@ In order, each step verified by the one below it:
   (`hosts/opencode/plugins/tezgah.js:11-14`).
 - **Cursor only runs a PreToolUse hook for the tool types its matcher names**, so
   the matcher must list the write spellings or the gate's edit branches are
-  unreachable there (`hosts/cursor/hook.py:30-39`,
+  unreachable there (`hosts/cursor/hook.py:33-42`,
   `bin/tezgah-setup::CURSOR_PRETOOL_MATCHER`).
-- **Claude, dsh, omp, codex and cursor run the gate only for the tool names
+- **Cursor carries the per-turn text only up to 10000 characters.**
+  cursor-agent drops a `beforeSubmitPrompt` `additional_context` whole when it is
+  longer. A busy turn with every conditional rule armed measured 10288.
+  `fit()` cuts the tail to `CONTEXT_MAX` and marks the cut, so the reminder and
+  the first rules arrive (`hosts/cursor/hook.py::fit`, `hosts/cursor/hook.py::CONTEXT_MAX`).
+- **Claude, dsh, omp, codex, cursor, qwen, droid, commandcode, copilot, gemini, antigravity, goose and amp run the gate only for the tool names
   their matcher carries**, so a name the PostToolUse side carries and the
   PreToolUse side does not is recorded in the ledger and never refused.
   `PowerShell` and `pwsh` are both `BASH_TOOLS` members
@@ -411,14 +648,65 @@ In order, each step verified by the one below it:
   `hosts/cursor/hooks.json:8` - neither named them until 2026-09-19, so a
   PowerShell call on those two reached no hook at all while the shared rules
   already knew the spelling), and omp's `GATED` list
-  (`hosts/omp/tezgah-hook.ts.in:270-273`). A host this list does not cover is a
-  host whose shell the gate cannot see.
+  (`hosts/omp/tezgah-hook.ts.in:270-273`). Qwen Code has two shell tool ids,
+  `run_shell_command` and `monitor`, which `bin/tezgah-setup::QWEN_PRETOOL_MATCHER`
+  names beside `notebook_edit` and `mcp__.*`. Claude's and dsh's `Monitor` runs a
+  shell command too, so their matcher names it. Droid's shell is `Execute`, which `bin/tezgah-setup::DROID_PRETOOL_MATCHER`
+  names beside `Create`, `Edit`, `ApplyPatch`, `Task`, `Grep` and `mcp__.*`. The
+  adapter hands ApplyPatch's `input` to the gate as `patch`
+  (`hosts/droid/hook.py::gate_input`). Command Code's settings hooks see only
+  four tools and test the matcher against their display names (`SHELL`, `READ`,
+  `WRITE`, `EDIT`), so `bin/tezgah-setup::COMMANDCODE_PRETOOL_MATCHER` is
+  `shell|write|edit`. Its read, MCP, subagent and web tools never reach the
+  gate, and plan mode skips every hook. The adapter folds a shell call's `args`
+  into `command` and hands an edit's `old_value`/`new_value` over as
+  `old_string`/`new_string` (`hosts/commandcode/hook.py::gate_input`). Copilot's
+  PascalCase PreToolUse reports Claude tool names and anchors its matcher. So
+  `bin/tezgah-setup::COPILOT_PRETOOL_MATCHER` names `Bash`, `Write`, `Edit`,
+  `Agent`, `Task` and `Grep`, plus `.+-.+` for an MCP tool's `<server>-<tool>`.
+  The adapter maps the runtime spellings too (`bash`, `powershell`, `create`,
+  `edit`, `apply_patch`, `task`, `grep`, `rg`). An Edit that names no file but
+  carries a patch reaches the gate as `apply_patch`. `<server>-<tool>` becomes
+  `mcp__<server>__<tool>` for a server `mcp-config.json` names
+  (`hosts/copilot/hook.py::gate_name`). Gemini's BeforeTool matcher is a regex
+  over the tool name. `bin/tezgah-setup::GEMINI_PRETOOL_MATCHER` names the
+  shell, write, edit and grep tools, the subagent tools
+  (`codebase_investigator`, `generalist`, `invoke_agent`) and `mcp_.*`. A user's own subagents are not
+  named. `mcp_<server>_<tool>` marks no boundary between server and tool, so it
+  reaches the gate as `mcp__<server>_<tool>` (`hosts/gemini/hook.py::gate_name`).
+  Antigravity's matcher is a regex over the tool name, and
+  `bin/tezgah-setup::ANTIGRAVITY_PRETOOL_MATCHER` names `run_command`,
+  `write_to_file`, `replace_file_content`, `multi_replace_file_content`,
+  `invoke_subagent` and `grep_search`. The adapter renames their PascalCase
+  arguments into the gate's fields (`hosts/antigravity/hook.py::gate_input`).
+  `CommandLine` becomes `command`, `TargetFile` and `CodeContent` become
+  `file_path` and `content`. `TargetContent` and `ReplacementContent` become
+  `old_string` and `new_string`, and `ReplacementChunks` becomes `edits`. The
+  docs name no MCP tool spelling, so the matcher names no MCP tool. It names
+  neither `manage_task`'s `send_input` nor `schedule`.
+  Goose tests a matcher unanchored, so `bin/tezgah-setup::GOOSE_PRETOOL_MATCHER`
+  anchors `shell`, `write`, `edit` and `.+__.+`, an extension's
+  `<extension>__<tool>`, which reaches the gate as `mcp__<extension>__<tool>`
+  (`hosts/goose/hook.py::gate_name`). The adapter hands `write`'s and `edit`'s
+  `path` over as `file_path`, and `edit`'s `before`/`after` as
+  `old_string`/`new_string` (`hosts/goose/hook.py::gate_input`). Goose's own
+  `developer`, `analyze`, `summon` and `code_execution` tools other than these
+  three, and its subagent tool, are not named.
+  Amp's plugin sends the gate `Bash`, `shell_command`, `edit_file`,
+  `create_file`, `apply_patch` and `Task` (its `GATED` list) and an MCP effect
+  name. A shell call's text reaches the gate as `command`, from Amp's
+  `shellCommandFromToolCall` helper or the input's `cmd`
+  (`hosts/amp/hook.py::gate_input`). Read, search, web and `code_exec` calls
+  are not gated, and an MCP tool reached through `code_exec` or `tool_search`
+  is never seen.
+  A host this list does not cover is a host whose shell the gate cannot see.
 - **An MCP effect reaches the gate on every host that can route it**. Claude
   and dsh run it through a PreToolUse group of its own in `hooks/hooks.json` and
   `hosts/dsh/hooks.json`. That group stays apart from the literal one, because
   one regex character would end its exact-name dialect. Its pattern names the
   effect verbs of `hooks/tezgah_integrity.py::MCP_VERBS`, and omp's `tool_call`
-  tests the same pattern (`MCP_EFFECT`, `hosts/omp/tezgah-hook.ts.in`). Both
+  tests the same pattern (`MCP_EFFECT`, `hosts/omp/tezgah-hook.ts.in`), as does
+  Amp's `tool.call` (`hosts/amp/tezgah-plugin.ts.in`). Both
   hosts read a matcher as an unanchored JavaScript `RegExp`, and the pattern
   uses no lookahead. A read-only MCP call, such as a code-graph query, spawns no
   hook there. Codex's matcher carries `mcp__.*` (`hosts/codex/hooks.json`).
@@ -451,6 +739,14 @@ In order, each step verified by the one below it:
 - `hosts/dsh/hooks.json`, `hosts/dsh/statusline/lib/index.js`
 - `hosts/omp/hook.py`, `hosts/omp/tezgah-hook.ts.in`
 - `hosts/opencode/plugins/tezgah.js`, `hosts/opencode/tui/tezgah-tui.tsx`
+- `hosts/qwen/hook.py`, `tests/e2e_qwen.py` (the opt-in run of the real binary)
+- `hosts/droid/hook.py`, `tests/e2e_droid.py` (the opt-in run of the real binary)
+- `hosts/commandcode/hook.py`
+- `hosts/copilot/hook.py`
+- `hosts/gemini/hook.py`
+- `hosts/antigravity/hook.py`
+- `hosts/goose/hook.py`
+- `hosts/amp/hook.py`, `hosts/amp/tezgah-plugin.ts.in`
 - `statusline.py`, `bin/tezgah-status`, `hooks/tezgah_context.py`
 - `hooks/tezgah_models.py` - the per-host model surface in `## The model wire`
 - `hooks/tezgah_stack.py`, `bin/tezgah-doctor` `--stack` - the order in `## Precedence`