@sabaiway/agent-workflow-kit 14.29.0 → 14.29.1

package/CHANGELOG.md

@@ -4,6 +4,31 @@ Semantically versioned ([semver](https://semver.org)), newest first. The `versio
 is the current release. `upgrade` mode reads a project's `docs/ai/.workflow-version` and applies
 every `migrations/<version>-<slug>.md` newer than it, in semver order.
 
+## 14.29.1 — an upgrade keeps the sandbox-masks block byte for byte and names every non-blank line it takes out (AD-181)
+
+**On a hidden deployment, the footprint step of `/agent-workflow-kit upgrade` (`hide-footprint --reconcile`) now leaves
+the sandbox-masks block in `.git/info/exclude` byte-identical.** Before, the step read every line outside its own
+managed block as its own: it could take `/.claude/skills` out of the masks block and re-encode the block's line
+endings while it reported `+0/−0 — the hidden set is unchanged`, and the masks lane then read its block as drifted.
+
+- **Another kit lane's block is kept whole.** A block opened by a `# >>> agent-workflow…` line and closed by its own
+  lane's `# <<< agent-workflow… <<<` line keeps every line, its order and its own line endings, a last line with no
+  line ending included; none of its lines is folded into the hidden-mode block. A hidden-mode block the run creates
+  goes at the end of the file, or right before such a block when that block ends the file with no line ending.
+- **A malformed marker stops the step with nothing written.** A damaged hidden-mode marker, a block opened inside
+  another, a closer with no open block, a closer of another block, a block never closed or a repeated marker refuse
+  with exit 1 and `refusing to edit a malformed managed block in <file>: …`, naming the line at fault; the exclude
+  file is unchanged, on a dry run and under `--unhide` alike.
+- **Every non-blank line taken out is named.** The report lists each non-blank line the run takes out outside the hidden-mode block,
+  verbatim and in file order, one per line: `[hide-footprint] removed=<line>` after an apply,
+  `[hide-footprint] would-remove=<line>` on a dry run. A run that takes out nothing prints none.
+- **The apply ask rule is named by its purpose.** The velocity help, `references/modes/velocity.md`, the README
+  velocity row and the advisor's `velocity-core` texts now say why the rule exists: so all work can stay in auto mode.
+  Without it auto mode refuses a harness apply and you must leave auto mode for it; with it the harness shows its
+  usual dialog. The rule and what it seeds are unchanged.
+- Known limits: the file is read and written as UTF-8, so a byte that is not UTF-8 is not kept, as before; a stop
+  after the file has changed can leave a removed line unreported.
+
 ## 14.29.0 — in auto mode the chat yes applies a harness item through the harness's own dialog: one seeded ask rule (AD-179)
 
 **In a session the harness runs in its auto mode, once the apply ask rule is seeded (every velocity-core, kit-tools-tier or bridge-tier apply seeds it), the

package/README.md

@@ -261,7 +261,7 @@ file), or run the guarded `/agent-workflow-kit uninstall`.
 | `/agent-workflow-kit dispatch` | any time | **the delegation engine** — makes "how much does delegating a sub-task actually buy?" a measured number instead of a feeling. `check <file>` validates a sub-task brief's contract block and exits 0/1 naming the first violated field — **form only**: whether the task is genuinely bounded, its design decided and its acceptance adequate stays your judgment, and a well-formed absurdity passes here by construction. `advise --step-class <c>` answers the question that comes BEFORE that one — which vehicle should carry this kind of sub-task, whether it is even present on this machine, and what the ledger has already recorded for threads of that class (finished, failed, closed without a fold, and still open — counted separately) — and it decides nothing: it refuses no dispatch, gates no verb, and a choice that diverges from the advice is noted rather than blocked. It reads the filesystem only: nothing is launched to find out what is installed, an absent ledger prints "no recorded history", an unreadable one prints the store's own words, and either way the advice still prints. The same block appears as a footer under a form-valid `check` — never under a refusal, so it can never hide one. `register` pre-registers an acceptance wave (step classes, pairing key, minimum observations per class, the mean and first-pass thresholds) so the bar can never be chosen after the results it judges — immutable per wave. `observe` records ONE hand-written observation (`solo-construction`, the baseline whose ratio is 1 by construction — except over a scope measuring zero bytes, which has no ratio at all and is recorded ineligible by name — or `self-reported`) — delegated numbers are never hand-written, they are derived. The writer verbs are where that derivation happens: `open` puts a delegated thread on the record with every mint-time field copied from the brief's own header, refusing a deadline the wrapper's cap plus its kill grace would not fit inside, and recording whether the tree it started from was clean against the thread's base — HEAD by default, or the tree `--checkpoint <oid>` names, so the second task of a story is measured over the first one's uncommitted work instead of opening dirty (a dirty one makes the result honestly unmeasurable rather than quietly counted), while `--task <brief>` also records which task brief the thread carries out and the files that brief lists, refusing, since the last commit, a task thread whose files overlap by path prefix those of an open task thread or of a folded thread of another brief (`files-overlap`), and a mix of the two kinds — an untasked open beside an open task thread or, for a `code` open of backend `codex`, after a task fold, and a task open beside an open untasked thread (`mixed-open`), refusing at open a Files path the snapshot scope can never hold (`task-files-scope`), and measuring a task thread over its files alone, so `return` and `fold` refuse a changed path that no open or folded task thread on the same base claims (`out-of-files`); `await` waits for that one dispatch to answer and writes nothing — only the finished receipt satisfies it, a run still holding the nonce means keep waiting, and a wait that runs out says so with its own exit code, names whether the deadline or your own timeout ended it, and authorizes nothing: a wait that ended without an answer is a question for you, never permission to dispatch again; `return` absorbs the receipt the wrapper minted — only a finished one, checked against the contract it actually ran, its deadline and its own report, and refused outright when the tree hides changes from git or moves while the return is being computed — and derives the bytes from git rather than from anyone's claim; `fold` is the acceptance, and it refuses if the tree moved since the return — precisely, it re-confirms **equality of the visible canonical payload**, which is a change detector rather than a cryptographic identity of the tree: under the default head base that payload's untracked section is unframed and carries no file mode, so a content or symlink target that imitates the marker opening the next entry can alias two trees, and making an untracked file executable moves nothing (both named as residuals in the mode doc, with the fix queued); under a checkpoint base it is one indexed diff that carries modes. A change set carrying a binary, a non-regular path, a submodule, or a symlink whose target is not valid UTF-8 is **refused** at `return` and `fold` — CONSERVATIVELY, rather than promise what the default head payload may not be able to follow — and the same refusals hold for a checkpoint thread. `degrade` closes a thread that never earned a fold, on the record and with its reason. `aggregate` prints one wave: the registered thresholds, every observation as context, and per step class the finished threads — a folded success with git-provable bytes contributes its ratio, one whose bytes are unprovable is excluded from the mean but still counts in the first-pass rate, and a failed thread, a degrade-closed one, or one folded after failing acceptance each count as a real zero. Below the registered minimum nothing is computed (insufficient); at or above it is computed and labeled PILOT evidence. It REFUSES rather than guessing: no pre-registration, an unfinished thread in scope, a recorded refusal-to-delegate that never opened a thread, or an ambiguous wave each stop the computation by name. `handoff-return --slug <s>` closes the worktree loop after `land --prepare`: it re-attests that main still holds exactly the prepared tree under the same HEAD (both recorded in the handoff at prepare time), prints the satellite handoff's user-owned content byte for byte with its boundaries, byte lengths and the main-owned destinations each part folds into, prints the handoff digest and both OIDs as its proof, states the after-the-fold order (a fold landed after the gates leaves them stale), and records ONE self-reported worktree-stream observation only when the whole prepared change set is measurable — a deletion, a rename, a symlink, a submodule or a mode-only change ends with a named NOT RECORDED instead, never a partial number. Appends only to its own ledger inside the git dir (never committable); it also writes `handoff-return`'s `write-tree` tree object and, for a checkpoint measurement, the leaf's OWN temporary index file and the blobs its forced adds store — never a ref, never the real index; never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit worktrees` | any time | **parallel feature worktrees** — run several features in DIFFERENT agent sessions on one repo, zero interference on working-tree files (the ONE exception is the dependency cache, below): `provision <slug> --plan <file>` creates a sibling git worktree on branch `aw/<slug>` and populates it (registry-derived footprint copy-if-missing — a tracked file is never overwritten; EXACTLY ONE seeded feature plan; the `handoff-<slug>.md` record from minute zero; `node_modules` symlinked where the link stays ignored — a shared MUTABLE dependency cache: writes through it hit MAIN's node_modules; for isolation run the printed isolated-install command (`--install` only PRINTS it; on `--resume` run the printed unlink-first recovery first — printed only for a link whose RAW TARGET is MAIN's `node_modules`, since a foreign or unreadable link is reported as such with no removal advised); absolute root-pinned gate commands rebased on untracked copies only, and only while their bytes equal the MAIN source or its rebased form — user-modified copies stay untouched); `list` is read-only (slug, branch, base, dirty, handoff); `prompt <slug>` is read-only too and re-prints the satellite's cold-start prompt — the same text `provision` ends its report with: where the worktree is, its ONE seeded plan, the handoff as the one channel back, MAIN's orientation (shared series index, landing) and, under its own heading because it is probed on the satellite, that checkout's install posture — every value derived LIVE rather than replayed from the frozen provision record, a recorded value that no longer matches NAMED as a divergence (with the cause its source makes likely) instead of printed as the runnable one, every offered command marked with WHO runs it (`MAIN $ …` for the landing, `HERE $ …` for this checkout's own install, a posture with nothing to run staying prose), and a control character in any rendered value a typed STOP rather than a forged prompt line; `land <slug> --prepare` locks the common git dir, fail-closes on divergence or incomplete satellite state, transfers the complete accepted satellite diff onto a CLEAN main, runs sync plus the declared gates, and reports HEAD/TRANSFER/PREPARED OIDs — the commit ALWAYS stays a dialogue ask; `cleanup <slug>` takes the same lock and removes a LANDED worktree only after live landed-verification against main HEAD, while `--abandon` is the ONE destructive arm (destroys unlanded work; **no preview step** on any writer). The parent dir is the `docs/ai/worktrees.json` `parentDir` setting (default: the repo's sibling parent); an unwritable parent degrades to printed maintainer-pasted commands, and the one-time host consent that makes it promptless surfaces via `recommendations`. Never commits, never pushes, never runs a subscription CLI. |
 | `/agent-workflow-kit uninstall` | opt-in, any time | **guarded teardown** — the inverse of `init` / `setup`. Removes only what's **provably ours** (managed skill dirs + bridge wrappers; in a project, the hidden-mode git-ignore block it added + the pre-commit hook it installed); **never deletes** your `docs/ai` / `AGENTS.md` (prints the exact `rm` to run by hand) or your `.claude/settings.json` (prints an **edit** — remove the attribution key, review any velocity `permissions.*` — never an `rm`). Always `--dry-run` first; preflight-then-mutate; never commits. |
-| `/agent-workflow-kit velocity` | Claude Code · opt-in | **onboarding velocity profile** — seeds a fixed, audited **read-only** allowlist into `.claude/settings.json` so routine read-only commands stop idling on approval prompts while you're away; every allowlist apply (flagless, `--kit-tools`, `--bridge-tier`) also seeds one `permissions.ask` rule, so the harness asks before every harness apply (the `apply:` line of each harness item the upgrade advisor renders) instead of judging it in its auto mode — a question added, it removes no prompt; opt-in `acceptEdits`; plus a **read-only advisory** of likely project gate commands to add by hand. Writes **only** `.claude/settings.json` — **never** allowlists commit/push/publish, never writes `settings.local.json`, never commits. A seeded entry is a **trust posture, not a sandbox** (a runtime residual remains at the settings level — its guard ships as the opt-in `hook` command); a direct commit/push/publish still asks. `--dry-run` first. |
+| `/agent-workflow-kit velocity` | Claude Code · opt-in | **onboarding velocity profile** — seeds a fixed, audited **read-only** allowlist into `.claude/settings.json` so routine read-only commands stop idling on approval prompts while you're away; every allowlist apply (flagless, `--kit-tools`, `--bridge-tier`) also seeds one `permissions.ask` rule, so all work can stay in auto mode: without it auto mode refuses a harness apply (the `apply:` line of each harness item the upgrade advisor renders) and you must leave auto mode for it; with it the harness shows its usual dialog — the rule allows nothing; opt-in `acceptEdits`; plus a **read-only advisory** of likely project gate commands to add by hand. Writes **only** `.claude/settings.json` — **never** allowlists commit/push/publish, never writes `settings.local.json`, never commits. A seeded entry is a **trust posture, not a sandbox** (a runtime residual remains at the settings level — its guard ships as the opt-in `hook` command); a direct commit/push/publish still asks. `--dry-run` first. |
 | `/agent-workflow-kit agents` | Claude Code · opt-in | **subagent vehicles** — places the five bundled subagent definitions into `.claude/agents/`: **four read-only vehicles + one full-tool `executor`**. **No read-only vehicle gets `Bash`**, and that is the load-bearing property: a read-only fan-out on a full-tool subagent shells out for facts it could have read, and every shelled command is an approval prompt you never needed to see. Three of the four ride a **cheap model** (haiku, low effort) for mechanical work — extraction sweeps, changelog fact-skeletons, gate-failure triage; the fourth, **`review-lens`**, is an ADDITIONAL independent read-only review opinion on code your configured backends have already seen (never a replacement for your plan or diff review recipe, advisory like every review; an epic is reviewed by the lens alone, whatever `epic.review` resolves to). The fifth, **`executor`** (all tools; model and effort from `docs/ai/vehicles.json`), is the ONE vehicle with a shell and the instrument behind the **Subagent** recipe: dispatched only for a bounded, file-disjoint execution / authoring / routine slice you verify afterwards — never for read-only work, never as a review backend, and it never commits. Its state (`placed` / `customized` / `unusable` / `missing`) is what a `subagent` slot's readiness resolves from. Writing code and running gates stay off the four read-only vehicles; the executor carries a bounded slice you re-verify on your main lane, and every vehicle's output is verified. Preview by default (`--apply` writes); an existing customized read-only vehicle or lens is **preserved, never overwritten**; the executor's body is re-derived from `docs/ai/vehicles.json` (a hand edit is replaced); never touches `settings*.json`, never commits. |
 | `/agent-workflow-kit hook` | Claude Code · opt-in | **gate-approval hook** — places a self-contained PreToolUse hook (`.claude/hooks/`) and wires it into `.claude/settings.json`: a Bash command **byte-identical** to a gate you declared in `docs/ai/gates.json` (run from the project root) is auto-approved — no prompt, no idle; a seeded read-only command carrying a runtime residual (output redirection, command substitution, `--output` writes) now **asks** even where an allow rule would have silently passed it (proven live — hook `ask` overrides an allow rule). Detection is a conservative string scan, so it over-asks on a byte that is ordinary text — searching for `=>`, or a read wearing `2>/dev/null`, prompts. That is a documented open limit: 4.1.0 built three mechanisms to narrow it and removed all three in review, each counterexample kept as a test (see Mode: hook). Exact matches only, never patterns; never `deny`; a broken `gates.json` only disables auto-approval, never the guard. An opt-in **read-lane** (`--read-lane` → `docs/ai/lanes.json`, a **separate** file from `gates.json`) additionally auto-approves *compounds* of seeded read-only commands carrying no shell metaprogramming; `--apply --read-lane` verifies the placed hook is current first (delete-to-reseed otherwise). Preview by default; never writes `settings.local.json`; never commits. |
 | `/agent-workflow-kit state-block-guard` | Claude Code · opt-in | **closing-block detector** — a `Stop` hook that reads the turn's final assistant message and warns when the closing state block is defective: the «what I need from you» slot answering *nothing* (a turn that ENDS always needs a resume, so the answer is false, not merely unhelpful), or a first-person promise of imminent work in a turn that is over. Judged on the slot's first clause, so a real ask followed by a clause break and "nothing else" passes, and a promise gated on something named passes; matching is word-bounded and Unicode-aware, quoted and fenced examples are stripped, and the last STARTED block decides — an incomplete tail counts as no block rather than falling back to an earlier one. A message carrying no block at all is silent unless you pass `--require-block` — this kit does not mandate the block, and a hook that runs every turn must not warn every turn. The judgement is lexical and the mode doc names every residual it leaves. **Detection, never prevention** — a `Stop` hook cannot un-send the message it judges; what it buys is that a silent recurrence becomes a visible one. Warns via `systemMessage` and **exits 0 on every path**: never `deny`, never blocks the stop, never re-enters the model. Reads nothing but the message, makes no network call, approves nothing. This mode is **read-only and has no writer** — it ships the self-contained hook and a paste-ready wiring block you merge into `.claude/settings.json` yourself. |

package/SKILL.md

@@ -3,7 +3,7 @@ name: agent-workflow-kit
 description: Deploy or upgrade a portable AI-agent memory-and-workflow system in any project. Use when the user wants to bootstrap `docs/ai/` + an entry-point `AGENTS.md` (+ `CLAUDE.md` alias) + cap/archive/index enforcement in a new or existing repo, set up the Memory Map and session protocols, install the docs-rotation pre-commit hook, or run `/agent-workflow-kit` / `/agent-workflow-kit upgrade`. Triggers on phrases like "set up the memory system", "deploy the AI workflow here", "bootstrap docs/ai", "upgrade the workflow". New to the epic, story and task tier? Run `/agent-workflow-kit tier`. A typed decision with a confidence from Jev? Run `/agent-workflow-kit jev`.
 disable-model-invocation: true
 metadata:
-  version: '14.29.0'
+  version: '14.29.1'
 ---
 
 # agent-workflow-kit

package/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "agent-workflow-kit",
   "kind": "composition-root",
-  "version": "14.29.0",
+  "version": "14.29.1",
   "provides": [],
   "roles": {},
   "detect": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sabaiway/agent-workflow-kit",
-  "version": "14.29.0",
+  "version": "14.29.1",
   "description": "Portable, cross-agent memory & workflow for AI coding agents — Claude Code, Codex, Cursor, Devin Desktop. One command deploys an AGENTS.md entry point + docs/ai context with cap/archive/index enforcement into any repo.",
   "keywords": [
     "ai-agents",

package/references/modes/velocity.md

@@ -18,7 +18,7 @@ Run `node ${CLAUDE_SKILL_DIR}/tools/velocity-profile.mjs [--dry-run | --apply] [
 2. **Ask the opt-ins** via **`AskUserQuestion` where supported** — two separate choices, the safe option FIRST in each. First the **`--kit-tools` tier** (separate from `acceptEdits`; **"core only" remains the default answer** — seed the tier only on an explicit yes, then add `--kit-tools` to the `--apply` re-run). Then the `acceptEdits` opt-in:
    - **"Keep per-edit approval prompts (recommended)"** — seed only the read-only allowlist; file edits still prompt.
    - **"Auto-accept file edits (`defaultMode: acceptEdits`)"** — present the honest FULL posture: it auto-applies Edit/Write AND auto-runs `mkdir`/`touch`/`mv`/`cp` in the working dir, is paired with the read-only allowlist, and — stated plainly — a settings-level allow rule is a **trust posture, not a sandbox**: a read-only entry can still write a file via output redirection, and (Claude Code's allow rules do not inspect command substitution) could in principle run another command via `cmd $(…)`. velocity **never adds `commit`/`push`/`publish` as allow rules** — so a direct `git push` still ASKs — and the residual guard for the seeded core ships as the opt-in PreToolUse hook (`${CLAUDE_SKILL_DIR}/references/modes/hook.md`; probe-proven on the `--output` family — current engine builds already intercept redirection/substitution upstream). The approval **floor** (never auto-approved, with or without the tier): every writer `--apply`/`--write`/`--yes` still prompts; clobber-protection STOPs still stop; the three release asks (commit/push/publish) stay maintainer-owned. Note also that a `defaultMode` in `settings.local.json` would override this project-level write (local > project), since velocity writes only `.claude/settings.json`.
-3. **Only on an explicit yes**, re-run with `--apply` (add `--accept-edits` only if they chose the second option). It merges-don't-clobber (preserves `includeCoAuthoredBy`, every key, and existing allow entries) and writes **only** `.claude/settings.json`. Every apply — flagless, `--kit-tools`, `--bridge-tier` — also appends one ask rule, `Bash(node *apply-danger-check.mjs*--apply*)`, to `permissions.ask` once, beside any ask entries already there: the harness then asks before every harness apply (the `apply:` line of each harness item the advisor renders) instead of judging it in its auto mode. It is a question added, never an allow, and it removes no prompt; `--autonomy` leaves it in place.
+3. **Only on an explicit yes**, re-run with `--apply` (add `--accept-edits` only if they chose the second option). It merges-don't-clobber (preserves `includeCoAuthoredBy`, every key, and existing allow entries) and writes **only** `.claude/settings.json`. Every apply — flagless, `--kit-tools`, `--bridge-tier` — also appends one ask rule, `Bash(node *apply-danger-check.mjs*--apply*)`, to `permissions.ask` once, beside any ask entries already there: the rule exists so all work can stay in auto mode: without it auto mode refuses a harness apply (the `apply:` line of each harness item the advisor renders) and the user must leave auto mode for it; with it the harness shows its usual dialog. The rule allows nothing, and `--autonomy` leaves it in place. When you name the rule to the user, lead with this purpose.
 4. **Surface delegation-readiness, read-only.** If they want a step run Delegated, set it with `/agent-workflow-kit set-recipe --set plan-execution.execute=delegated` (`${CLAUDE_SKILL_DIR}/references/modes/set-recipe.md`) or by hand-editing `docs/ai/orchestration.json`; **velocity itself never writes the orchestration config.**
 
 **The `--kit-tools` tier (opt-in).** On top of the read-only core, `--kit-tools` seeds an audited kit-tool tier — every path **resolved absolute from the running skill at seed time**, so the posture is **fail-safe**: a moved or reinstalled skill leaves a stale rule that simply **prompts again** (re-run velocity to reseed; nothing widens silently). A seeded entry equals its covered dispatch line below with `${CLAUDE_SKILL_DIR}` replaced by the resolved skill dir and `${PROJECT_ROOT}` by this project's resolved root, **UNQUOTED** — a quoted path is a different byte string and will still prompt (a dead rule, not a hole). The covered dispatch lines (this list IS the documented-invocation source):

package/tools/hide-footprint.mjs

@@ -35,6 +35,11 @@ import {
 
 export const START_MARKER = '# >>> agent-workflow-kit hidden mode (managed; do not edit between markers) >>>';
 export const END_MARKER = '# <<< agent-workflow-kit hidden mode <<<';
+// Any other line opening or closing with these prefixes (a damaged hidden-mode marker aside: it
+// refuses) marks ANOTHER kit lane's block (the sandbox-masks lane's): this writer never absorbs,
+// moves or re-encodes a byte of it, a byte that is not UTF-8 aside (the file is read as UTF-8).
+const FOREIGN_OPEN = '# >>> agent-workflow';
+const FOREIGN_CLOSE = '# <<< agent-workflow';
 
 // Recognized legacy forms we ABSORB (local) or MIGRATE (global). Matched by prefix so a minor wording
 // drift can't strand a line (D7/D8).
@@ -101,11 +106,18 @@ const detectEol = (content) => {
 };
 // Split into logical lines; `lines.join(eol)` reproduces the structure (CRLF normalized to `eol`).
 const splitLines = (content) => (content === '' ? [] : content.replace(/\r\n/g, '\n').replace(/\r/g, '\n').split('\n'));
-// Re-join, dropping trailing blank lines and ending with exactly one EOL (canonical, idempotent).
+// Each logical line's own ending ('' on an unterminated last line), index-aligned with splitLines.
+const lineEnds = (content) => {
+  if (content === '') return [];
+  const parts = content.split(/(\r\n|\n|\r)/);
+  return parts.filter((_, i) => i % 2 === 0).map((_, i) => parts[2 * i + 1] ?? '');
+};
+// Re-join, dropping trailing blank lines (canonical, idempotent): a plain line takes `eol`; a line
+// given as { text, end } (a foreign block's) keeps its own ending, an absent one on the last line included.
 const joinLines = (lines, eol) => {
   const out = [...lines];
   while (out.length && out[out.length - 1] === '') out.pop();
-  return out.length ? `${out.join(eol)}${eol}` : '';
+  return out.map((l, i) => (typeof l === 'string' ? `${l}${eol}` : `${l.text}${l.end || (i < out.length - 1 ? eol : '')}`)).join('');
 };
 
 // A raw exclude line → an anchored pattern (leading "/"), or null when blank/comment.
@@ -261,15 +273,44 @@ const assembleCandidates = (deps, dir, fsx, forcedPreserve) => {
 
 export const buildBlock = (patterns) => [...new Set(patterns)].sort();
 
-// Find the managed fence in a line array. { state:'none' } | { state:'ok', startIdx, endIdx } |
-// { state:'malformed', reason }. Malformed → caller STOPs with the file byte-for-byte unchanged.
+// Scan every kit marker line (judged trimmed, as the masks lane reads its own): our fence and each
+// foreign block. { state:'none'|'ok', startIdx, endIdx, foreign:Set<lineIdx>, blockStart:Map<closer
+// idx, opener idx> } | { state:'malformed', reason }. A closer `# <<< <lane> <<<` closes only an
+// opener whose lane (its name up to ' — ' or ' >>>') is <lane>; malformed → caller STOPs, file unchanged.
+const DAMAGED_OWN = ['# >>> agent-workflow-kit hidden mode', '# <<< agent-workflow-kit hidden mode'];
 const findFence = (lines) => {
-  const starts = lines.map((l, i) => (l === START_MARKER ? i : -1)).filter((i) => i >= 0);
-  const ends = lines.map((l, i) => (l === END_MARKER ? i : -1)).filter((i) => i >= 0);
-  if (starts.length === 0 && ends.length === 0) return { state: 'none' };
-  if (starts.length !== 1 || ends.length !== 1) return { state: 'malformed', reason: `expected exactly one managed marker pair, found ${starts.length} start / ${ends.length} end` };
-  if (ends[0] < starts[0]) return { state: 'malformed', reason: 'end marker precedes start marker' };
-  return { state: 'ok', startIdx: starts[0], endIdx: ends[0] };
+  const bad = (reason) => ({ state: 'malformed', reason });
+  const foreign = new Set();
+  const blockStart = new Map();
+  const seen = new Set();
+  let open = null;
+  let own = null;
+  for (const [i, raw] of lines.entries()) {
+    const t = raw.trim();
+    const opens = t.startsWith(FOREIGN_OPEN);
+    if (!opens && !t.startsWith(FOREIGN_CLOSE)) continue;
+    const mine = t === START_MARKER || t === END_MARKER;
+    if (!mine && DAMAGED_OWN.some((p) => t.startsWith(p))) return bad(`line ${i + 1} is a damaged hidden-mode marker`);
+    if (opens) {
+      if (open) return bad(`line ${i + 1} opens a block inside the one opened at line ${open.i + 1}`);
+      open = { i, mine, name: t.slice(6) };
+    } else {
+      if (!open) return bad(`line ${i + 1} closes a block that was never opened`);
+      const lane = t.endsWith(' <<<') ? t.slice(6, -4) : null;
+      const closes = mine ? open.mine : !open.mine && lane !== null && open.name.split(/ — | >>>/)[0] === lane;
+      if (!closes) return bad(`line ${i + 1} closes another block than the one opened at line ${open.i + 1}`);
+    }
+    if (seen.has(t)) return bad(`line ${i + 1} repeats the marker of an earlier block`);
+    seen.add(t);
+    if (!opens) {
+      if (mine) own = { startIdx: open.i, endIdx: i };
+      else for (let j = open.i; j <= i; j += 1) foreign.add(j);
+      if (!mine) blockStart.set(i, open.i);
+      open = null;
+    }
+  }
+  if (open) return bad(`the block opened at line ${open.i + 1} is never closed`);
+  return { state: own ? 'ok' : 'none', ...own, foreign, blockStart };
 };
 
 // ── absorb (local pre-existing recognized lines → folded into the fence) ──────────
@@ -280,21 +321,24 @@ const findFence = (lines) => {
 // block. Low-risk rules fold regardless of presence (D8 preserve). A HIGH-RISK rule folds as consent
 // only while its file is still PRESENT; if its file is absent it is left exactly as-is (a deliberate
 // pre-emptive user hide is never silently removed, and there is no present-file report mismatch).
+// A foreign block's line arrives as { text, end } and is kept whole; `removed` lists, in file order,
+// every line taken out (the report names each one).
 const absorbOutside = (outsideLines, isPresent) => {
   const kept = [];
   const absorbed = [];
+  const removed = [];
   for (const raw of outsideLines) {
+    if (typeof raw !== 'string') { kept.push(raw); continue; }
     const t = raw.trim();
-    if (isAd013Comment(t) || isLegacyGlobalHeader(t)) continue; // orphan header for an absorbed rule
     const pat = lineToPattern(raw);
     const canon = pat ? recognizeHideRule(pat) : null;
-    if (canon && (LOWRISK_SET.has(canon) || isPresent(canon))) {
+    if (isAd013Comment(t) || isLegacyGlobalHeader(t)) removed.push(raw); // orphan header for an absorbed rule
+    else if (canon && (LOWRISK_SET.has(canon) || isPresent(canon))) {
       absorbed.push(canon);
-      continue;
-    }
-    kept.push(raw); // unrecognized, or a high-risk recognized rule whose file is absent → leave it
+      removed.push(raw);
+    } else kept.push(raw); // unrecognized, or a high-risk recognized rule whose file is absent → leave it
   }
-  return { kept, absorbed };
+  return { kept, absorbed, removed };
 };
 
 // ── verify (D5 — over the WROTE set; "hidden" ≡ untracked ∧ ignored-by-OUR-source) ─
@@ -396,9 +440,13 @@ export const hideFootprint = (opts = {}, deps = {}) => {
     }
   })();
   const eol = detectEol(content);
-  const lines = splitLines(content);
-  const fence = findFence(lines);
+  const ends = lineEnds(content);
+  const texts = splitLines(content);
+  const fence = findFence(texts);
   if (fence.state === 'malformed') throw stop(`refusing to edit a malformed managed block in ${excludeFile}: ${fence.reason} (file left unchanged)`);
+  const lines = texts.map((l, i) => (fence.foreign.has(i) ? { text: l, end: ends[i] } : l));
+  // A created fence goes before a foreign block that ends the file unterminated, so no byte of it moves.
+  const tailBlock = ends.at(-1) === '' ? lines[fence.blockStart.get(texts.length - 1)] : undefined;
 
   const before = fence.state === 'ok' ? lines.slice(0, fence.startIdx) : lines;
   const fenceBodyLines = fence.state === 'ok' ? lines.slice(fence.startIdx + 1, fence.endIdx) : [];
@@ -416,8 +464,8 @@ export const hideFootprint = (opts = {}, deps = {}) => {
 
   // ── absorb pre-existing recognized lines, assemble + classify candidates ───────
   const isPresentCanon = (canon) => presentOnDisk(canon, fsx, dir);
-  const { kept: cleanBefore, absorbed: absorbedBefore } = absorbOutside(before, isPresentCanon);
-  const { kept: cleanAfter, absorbed: absorbedAfter } = absorbOutside(after, isPresentCanon);
+  const { kept: cleanBefore, absorbed: absorbedBefore, removed: removedBefore } = absorbOutside(before, isPresentCanon);
+  const { kept: cleanAfter, absorbed: absorbedAfter, removed: removedAfter } = absorbOutside(after, isPresentCanon);
   const fenceBodyPatterns = fenceBodyLines.map((l) => recognizeHideRule(lineToPattern(l) ?? '')).filter(Boolean);
   // Every pre-existing recognized hide rule (current fence body + absorbed loose lines, glob children
   // included) is prior consent. LOW-RISK rules are force-preserved as candidates regardless of presence
@@ -455,8 +503,9 @@ export const hideFootprint = (opts = {}, deps = {}) => {
 
   // ── build the new file (splice the fence; preserve outside lines) ──────────────
   const fenceLines = writtenPatterns.length ? [START_MARKER, ...writtenPatterns, END_MARKER] : [];
+  const at = fence.state === 'none' && tailBlock ? cleanBefore.indexOf(tailBlock) : cleanBefore.length;
   const newLines = writtenPatterns.length
-    ? [...cleanBefore, ...fenceLines, ...cleanAfter]
+    ? [...cleanBefore.slice(0, at), ...fenceLines, ...cleanBefore.slice(at), ...cleanAfter]
     : [...cleanBefore, ...cleanAfter];
   const newContent = joinLines(newLines, eol);
   const changed = newContent !== content;
@@ -482,6 +531,7 @@ export const hideFootprint = (opts = {}, deps = {}) => {
     wrote: writtenPatterns,
     added,
     removed,
+    removedOutside: [...removedBefore, ...removedAfter],
     asks: asks.filter((a) => !includedAsks.some((i) => i.pattern === a.pattern)).map((a) => ({ path: a.pattern, reason: a.reason, owner: a.owner })),
     needsUntrack: needsUntrack.map((a) => {
       const target = patternToProbe(a.pattern).replace(/\/$/, '');
@@ -558,6 +608,8 @@ export const formatReport = (r, dryRun) => {
     if (r.removed.length) lines.push(`  • −${r.removed.length} removed: ${r.removed.join(', ')}`);
     if (!r.added.length && !r.removed.length) lines.push('  • +0/−0 — the hidden set is unchanged');
   }
+  // Each line taken out outside the fence, verbatim, on the whole-line machine channel (exempt by grammar).
+  for (const l of r.removedOutside ?? []) lines.push(`  [hide-footprint] ${dryRun ? 'would-remove' : 'removed'}=${l}`);
   for (const a of r.asks) lines.push(`  • ASK ${a.path} — ${a.reason}`);
   for (const n of r.needsUntrack) lines.push(`  • tracked, NOT hidden: ${n.path} — run \`${n.command}\` to un-track (kept on disk)`);
   if (r.dropped.length) lines.push(`  • skipped ${r.dropped.length} already-ignored (tracked .gitignore)`);

package/tools/recommendations.mjs

@@ -244,8 +244,8 @@ export const composeVerdict = ({ attention, optional, skipped }) => {
 // WHAT is never truncated: the leaf's suite pins every composed WHAT under the cap.
 export const WHATS = Object.freeze({
   'velocity-core': 'routine read-only commands still prompt — {n} audited read-only allowlist entr(ies) not seeded',
-  'velocity-core.rule': 'in auto mode a harness apply is judged instead of asked — the apply ask rule is not seeded',
-  'velocity-core.both': 'routine read-only commands still prompt, and in auto mode a harness apply is judged instead of asked — {n} entr(ies) not seeded',
+  'velocity-core.rule': 'auto mode refuses a harness apply, so work cannot stay in auto mode — the apply ask rule is not seeded',
+  'velocity-core.both': 'routine read-only commands still prompt, and auto mode refuses a harness apply — {n} entr(ies) not seeded',
   'kit-tools-tier': "the kit's own read-only tools still prompt — {n} kit-tools tier entr(ies) not seeded",
   'bridge-tier': 'bridge-wrappers tier incomplete — {n} entr(ies) missing (allow rules, exclusions, hosts or state dirs of used bridges)',
   'autonomy-policy': 'no {path} — the computed defaults apply implicitly (red-lines ask/deny; every activity floors at prompt)',
@@ -319,7 +319,7 @@ const templateBudget = (template) => ITEM_LINE_CAP - template.replace(/\{[A-Za-z
 
 // ── the frozen benefit registry (fact-true; pinned by tests) ────────────────────────────────────
 export const BENEFITS = Object.freeze({
-  'velocity-core': 'velocity — routine read-only commands stop prompting while the maintainer is away; the harness asks before each harness apply',
+  'velocity-core': 'velocity — routine read-only commands stop prompting while the maintainer is away; all work stays in auto mode',
   'kit-tools-tier': "velocity — the kit's own read-only tools run promptless (audited, resolved-absolute tier)",
   'bridge-tier':
     'velocity — used bridges get <wrapper> * exclusions (codex-exec * if delegated), hosts, state dirs (allowWrite); reviews: code-mode allows',

package/tools/velocity-profile.mjs

@@ -39,7 +39,7 @@ export const WORKFLOW_STAMP = 'docs/ai/.workflow-version';
 export const SAFE_DEFAULT_MODES = Object.freeze(['default', 'acceptEdits', 'plan']);
 export const UNSAFE_BYPASS_MODE = 'bypassPermissions';
 export const ACCEPT_EDITS_MODE = 'acceptEdits';
-// The harness asks before every harness apply; an ask rule allows nothing.
+// Lets all work stay in auto mode: a harness apply meets the harness dialog, not a refusal; an ask rule allows nothing.
 export const APPLY_ASK_RULE = 'Bash(node *apply-danger-check.mjs*--apply*)';
 
 // The audited read-only core. Every entry is a Claude Code Bash allow pattern whose command runs NO
@@ -337,8 +337,8 @@ absolute path (args wildcard), run-gates.mjs as ONE exact project-root-pinned by
 (project-exec - it runs YOUR declared gates.json), source-size-check.mjs as ONE exact --check
 byte-string (its read-only mode only - its writers keep prompting), and the writers' exact arg-free
 dry-run preview byte-strings. Never touches settings.local.json.
-Every apply also appends the apply ask rule ${APPLY_ASK_RULE} to permissions.ask
-once, so the harness asks before every harness apply; it allows nothing.
+Every apply also appends the apply ask rule ${APPLY_ASK_RULE} to permissions.ask once, so all work
+can stay in auto mode: without it auto mode refuses a harness apply and you must leave auto mode for it; with it the harness shows its usual dialog. It allows nothing.
 --bridge-tier (own consent) derives each entry for a used bridge from the effective project recipes:
 review wrappers' CODE mode (codex-review code, agy-review code), the quoted grounding pre-step rule,
 and <wrapper> * exclusions in sandbox.excludedCommands. An execute slot delegating to codex adds