@sabaiway/agent-workflow-kit 5.9.0 → 5.11.0

package/bridges/antigravity-cli-bridge/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "antigravity-cli-bridge",
   "kind": "execution-backend",
-  "version": "5.2.0",
+  "version": "5.3.0",
   "provides": ["review", "probe"],
   "posture": { "model": "Gemini 3.7 Flash (High)" },
   "roles": {
@@ -33,6 +33,7 @@
         ],
         "receipt": "side effect — a successful review appends one JSON receipt line to <git dir>/agent-workflow-review-receipts.jsonl (AW_REVIEW_RECEIPTS overrides; plan/diff outside a git tree: warn + skip unless overridden): fingerprint = sha256 over the canonical uncommitted-state payload (staged diff + unstaged diff + untracked-not-ignored contents — the review-payload domain; never-committable untracked paths — character/block devices, FIFOs, sockets — are excluded from the domain entirely, untracked symlinks/directories ride as name-only notes) in code mode, the artifact-file sha256 in plan/diff mode; verdict recorded verbatim from the mandated '### Verdict' section (SHIP / SHIP WITH NITS / REWORK); grounded = whether a NON-EMPTY --facts payload was supplied (code mode refuses pre-spend without one — no run, no receipt — unless --ungrounded/AGY_PROBE=1; in plan/diff an empty payload records grounded:false — fail-closed, the state gate rejects it), factsHash = sha256 of the facts payload; a continuation receipt is fresh:false (informational-only — it cannot attest the folded tree); probe = whether the run relaxed the quality guards (AGY_PROBE=1), written on EVERY receipt so it self-declares — the kit's review-state gate rejects a probe-marked receipt (a probe review never attests) and equally rejects an unmarked one (silence is not a declaration); posture = the ACTUAL run posture {model} (agy has no tier), written on EVERY receipt (D5) — the gate rejects a receipt with an absent/invalid posture (a pre-D5 wrapper minted it; re-run the review), one stderr banner line states the same posture, an ATTESTING review with AGY_MODEL explicitly emptied refuses pre-spend, and a model string carrying control bytes refuses pre-spend in every mode; delivery = how the change set REACHED the model, currently emitted as 'inline' (the whole set rode one prompt — proven by construction) or 'fed' (a chunked feed whose per-part echo proof verified); REQUIRED on every agy code receipt and its ABSENCE is what stops a pre-fed-lane receipt attesting, while the gate accepts any well-formed declaration rather than a particular value; absent by construction on plan/diff/continuation receipts, which carry no change set; a run whose output carries NO recognized '### Verdict' section — empty output included — exits 4 with NO receipt (D4: a FAILED review to RE-RUN, never a fatal session error); when the dispatch nonce seam is supplied — the AW_REVIEW_NONCE environment value or its plain-argument equivalent --nonce <n> (one seam: the flag assigns the same value; supplying both with different values refuses pre-spend) — under the safe grammar [A-Za-z0-9._-]{1,64} (anything else refuses pre-spend), the wrapper first mints the finding MANIFEST {schema, backend, nonce, fingerprint, findings} beside the receipts file (agent-workflow-finding-manifest-<backend>-<nonce>.json; atomic, no-clobber — a byte-identical rewrite is an idempotent no-op, different bytes refuse loudly) ORDERED before the receipt append — a failed manifest write EXCLUDES the receipt append, so a nonce-supplied dispatch can never land a receipt without its readable manifest; a nonce-less invocation adds NO nonce field and mints NO finding manifest (the existing wrapperVersion field still changes with each bridge release); a write failure warns, never fails the review",
         "notes": [
+          "transport: every review dispatch drives the CLI in --output-format json (plus --disable-slash-commands) and the returned envelope is parsed in node (bin/agy-envelope.mjs) — the operator-facing invocations and flags above do NOT change, and on a ZERO exit the wrapper still PRINTS the review text, never JSON. A missing or unreadable envelope on a zero exit is a loud failure with NO receipt, never a downgraded verdict and never a fallback to raw-stdout parsing; a non-zero CLI exit keeps its own code and message, and publishes the captured stdout unchanged from the SINGLE dispatch or the FINAL fed turn (which may therefore be a JSON or partial payload — the envelope is parsed only on a zero exit); an INTERMEDIATE feed turn is the exception, its output stays private (Invariant E) and its failure prints only a named error. Enforced by a PRE-SPEND capability probe, not a version floor: agy --help must advertise --output-format and --disable-slash-commands, node must be >= 22, and bin/agy-envelope.mjs must be present — otherwise the review refuses before any run is spent and names the missing capability",
           "pre-dispatch host-diff: before the FIRST dispatch of this bridge, diff its declared networkHosts against the live sandbox allow-list — a missing host is surfaced to the maintainer BEFORE dispatching, never fired into a known prompt",
           "the review posture banner appends a banner-only timeout=<duration> field — exactly the duration agy-run hands to timeout(1); the hard-timeout preflight fails CLOSED when no timeout/gtimeout binary exists (the wrapper refuses by name before any CLI run, so an uncapped review run can no longer happen), and the field never enters the receipt posture or the D5 banner↔receipt parity",
           "quote the posture banner verbatim when labeling this dispatch — the banner is the machine-stated posture; a prose re-type drifts"
@@ -229,7 +230,7 @@
       "max": 100000000,
       "default": "240000",
       "appliesTo": ["agy-review"],
-      "effect": "agy-review code: the ceiling on the SUM of all outgoing prompt bytes the chunked feed may send (every envelope, every body, the final turn). Checked BEFORE the first turn is spent; past it the fed review refuses. An economy guard, not the correctness guard — correctness is the per-part delivery echo."
+      "effect": "agy-review code: the ceiling on the SUM of all outgoing prompt bytes the chunked feed may send (every feed-turn framing block, every body, the final turn). Checked BEFORE the first turn is spent; past it the fed review refuses. An economy guard, not the correctness guard — correctness is the per-part delivery echo."
     }
   ],
   "networkHosts": ["*.googleapis.com", "accounts.google.com", "antigravity-unleash.goog", "lh3.googleusercontent.com"],

package/bridges/antigravity-cli-bridge/references/models-and-flags.md

@@ -6,13 +6,25 @@ were captured from **v1.1.13**; if the binary disagrees, the binary wins. The wr
 
 ## Headless behaviour
 
-Use `-p`, `--print`, or `--prompt` to run one non-interactive prompt and print the text response. The
-wrapper always uses headless `-p`. v1.1.13 adds `--output-format text|json|stream-json` and
-`--json-schema` (structured output); **text stays the wrapper default** — raw passthrough
-(`agy-run "…" -- --output-format json`) is possible but rides with NO first-class parsing or schema
-validation (first-class adoption is a separate backlog item). When the caller needs structure
-through the wrapper, ask for Markdown, bullets, tables, or fenced blocks, then validate the text
-yourself.
+Use `-p`, `--print`, or `--prompt` to run one non-interactive prompt and print the text response.
+Both wrappers run headless `-p`, and they differ in **transport**:
+
+- **`agy-run` stays text.** It prints the CLI's text response unchanged. JSON can ride passthrough
+  (`agy-run "…" -- --output-format json`) with NO parsing or validation — if you need structure here,
+  ask for Markdown, bullets, tables or fenced blocks and validate the text yourself.
+- **`agy-review` drives every dispatch in `--output-format json`** and reads the returned envelope
+  (`bin/agy-envelope.mjs`), so the answer TEXT and the conversation id come from **named fields**
+  instead of a guess at raw stdout. The **review contract stays prose-shaped**: the verdict is still
+  parsed out of that text's `### Verdict` section, exactly as before. It also passes
+  `--disable-slash-commands`, so a delivered change-set line that begins with a slash command stays
+  BODY rather than being expanded by the CLI. **On a zero exit** what it PRINTS is the review text,
+  never JSON — the envelope is wire format, not output format. When the **single dispatch or the
+  FINAL fed turn** exits non-zero the captured stdout is published as-is (the CLI's own failure wins,
+  and the envelope is parsed only on a zero exit), so a failing run may print a JSON or partial
+  payload. An **intermediate** feed turn is the exception: its output stays private and its failure
+  prints only a named error.
+
+`--json-schema` is **not** adopted and was measured and rejected; see the flags table below.
 
 ## Wrapper contract
 
@@ -70,6 +82,15 @@ agy-review --continue | --conversation <id>   [--decided @f] [--focus "…"]   #
 passthrough (it owns the posture). The service can still **stall on large/substantive prompts**
 (Issue-001), so keep reviews **focused**; the hard timeout is the guard.
 
+**Host requirements, enforced BEFORE any run is spent.** Because the review reads agy's JSON
+envelope in node, `agy-review` needs **Node ≥ 22** on `PATH`; and because it passes flags the CLI
+must honour, it probes `agy --help` for **`--output-format`** and **`--disable-slash-commands`**
+first. A missing flag, an unreadable `agy --help`, a missing or too-old node, or a missing
+`bin/agy-envelope.mjs` each refuse with a named cause and spend nothing. This is a **capability
+probe, not a version floor** — the release that introduced `--output-format` is not measurable from
+one installed build, so a guessed floor would refuse working installs. A failed probe is never read
+as "capability present".
+
 ## Models
 
 Pass the **exact display string** from `agy models`, or set `AGY_MODEL`.
@@ -112,19 +133,31 @@ AGY_MODEL="Claude Sonnet 4.6 (Thinking)" AGY_TIMEOUT=10m agy-run @review-prompt.
 | `--dangerously-skip-permissions` | auto-approve all tool permissions | avoid by default; use only with explicit user approval |
 | `--sandbox` | run with terminal restrictions enabled | prefer when delegating a prompt that might trigger tool/terminal work |
 | `--log-file <path>` | override the CLI log-file path | keep logs secret-free and out of committed artifacts |
-| `--output-format <fmt>` | print-mode output: `text` (default), `json`, `stream-json` | NEW in 1.1.x; not wrapper-adopted (backlog) |
-| `--json-schema <s\|path>` | enforce structured output (stream-json final result) | NEW in 1.1.x; not wrapper-adopted (backlog) |
+| `--output-format <fmt>` | print-mode output: `text` (default), `json`, `stream-json` | **ADOPTED by `agy-review`** — every dispatch runs `json` and the envelope is parsed (`bin/agy-envelope.mjs`). `agy-run` stays `text`; JSON there rides passthrough, unparsed. `stream-json` is adopted by neither (see below) |
+| `--json-schema <s\|path>` | enforce structured output (stream-json final result) | **REJECTED, and the reason is a measurement.** It is not a constrained decode: the model answers in prose and the CLI then spends a **second turn** asking it to restate that answer in schema shape (`num_turns: 2`). Matched control — same prompt, same model, schema off vs on: **16,585 vs 33,446 total tokens**. So a schema does not remove prose parsing; it replaces a free, deterministic, anchored regex with a billed non-deterministic re-read (the structured `reason` came back reworded, not quoted) and adds a failure mode — a run dying between the two turns has prose but no `structured_output` |
 | `--effort <low\|medium\|high>` | reasoning effort for the session | NEW in 1.1.x; the display strings already carry an effort tier — the wrapper keeps model selection in ONE place (`AGY_MODEL`) |
 | `--mode <m>` | agent execution mode (`accept-edits`, `plan`) | NEW in 1.1.x; not used by the wrapper |
 | `--agent` / `--project <id>` / `--new-project` | agent + project selection for the session | NEW in 1.1.x; not used by the wrapper |
-| `--disable-slash-commands` | disable slash command/skill expansion in print mode | NEW in 1.1.x; not used by the wrapper |
+| `--disable-slash-commands` | disable slash command/skill expansion in print mode | **ADOPTED by `agy-review`** on every dispatch — a delivered change-set line beginning with a slash command stays BODY instead of being expanded, so the model reviews the delivered bytes. Not used by `agy-run` |
 
 ## Subcommands (v1.1.13)
 
 `agent` / `agents`, `changelog`, `help`, `install`, `models`, `plugin` / `plugins`, `update`.
 
-**Still not available in v1.1.13:** any `agy inspect`. Wrapper output stays plain text (the
-`--output-format` lane is not adopted here — see the backlog row).
+**Still not available in v1.1.13:** any `agy inspect`. On output format the two wrappers differ:
+`agy-run` is a **text-by-default passthrough** — it hands back the CLI's stdout unchanged, so
+`agy-run "…" -- --output-format json` really does print JSON; `agy-review` prints the review text it
+read out of the JSON envelope on a **successful** run. (When its single dispatch or FINAL fed turn
+exits non-zero, `agy-review` publishes that captured stdout unchanged — never an intermediate feed
+turn's; see the transport bullet above.)
+
+**`--output-format stream-json` is deliberately NOT adopted.** Its two measured gains are queued as
+follow-ups rather than built: its `init` event names the **resolved** model (neither the plain `json`
+envelope nor the stream's own `result` event carries one), which would let the receipt record what
+actually ran; and its live `step_update` events would make a stalled run visible (Issue-001). The
+seam built here makes the FLAG easy to switch, but neither gain is free: `bin/agy-envelope.mjs`
+parses ONE JSON object and refuses anything else, so NDJSON needs a stream-aware reader, and live
+progress needs an event relay rather than a captured file.
 
 ## Project-context flags
 

package/bridges/antigravity-cli-bridge/references/review-prompt.md

@@ -89,6 +89,12 @@ itself can never reveal the very text it asks for, and the wrapper needs no seco
   construction) or `fed` (proven by echo). The kit's review-state gate requires the field present and
   well-formed, never a particular value, so a receipt minted before this lane existed no longer
   attests. The recovery is stated: re-run the review.
+- **Later turns are routed by a NAMED field.** Turn 1's `--output-format json` envelope carries
+  `conversation_id`; the wrapper validates it against the UUID grammar and dispatches every later
+  turn with `--conversation <id>`. There is no `--continue` fallback in this lane: an id that is
+  absent, wrong-typed or malformed stops the run **before turn 2 is spent**, with NO receipt. (It was
+  formerly scraped from `agy`'s own run log — a format that is `agy`'s to change, so the pin could
+  rot silently; a named field fails loudly instead.)
 
 ### Honest residuals (recorded, not engineered away)
 
@@ -99,9 +105,6 @@ itself can never reveal the very text it asks for, and the wrapper needs no seco
 - A change set whose parts carry **no unique interior line** in the 24..200-byte window (a single
   huge minified line, for instance) cannot be proven delivered, so the wrapper **refuses** rather
   than reviewing unprovably. Split the review, or exclude the blob.
-- The conversation id is parsed from `agy`'s own run log, whose format is `agy`'s to change. An
-  unparseable log **degrades loudly** to `--continue`; correctness still rests on the echo proof,
-  which fails closed when the wrong conversation answers.
 
 ## agy's own permission ask — surfaced, never applied
 

package/bridges/antigravity-cli-bridge/setup/README.md

@@ -9,11 +9,18 @@ works in any project.
 ```bash
 curl -fsSL https://antigravity.google/cli/install.sh | bash
 export PATH="$HOME/.local/bin:$PATH"   # add to ~/.bashrc / ~/.zshrc to persist
-agy --version                          # expect 1.1.13 or newer
+agy --version                          # captured here from 1.1.13 — see the capability note below
 ```
 
 - The binary is **`agy`** (not `antigravity`); it installs to `~/.local/bin/agy`.
 - Keep `$HOME/.local/bin` on `PATH` (the wrapper also prepends it defensively).
+- **There is no version floor.** The docs in this skill were captured from **v1.1.13**, but the
+  release that introduced each flag is not measurable from one installed build, so a guessed floor
+  would refuse working installs. What actually gates a review is a **capability probe** —
+  `agy-review` reads `agy --help` and refuses BEFORE spending a run unless the install advertises
+  both **`--output-format`** and **`--disable-slash-commands`**, plus **Node ≥ 22** on `PATH` (the
+  review parses agy's JSON envelope in node) and the skill's own `bin/agy-envelope.mjs`. Each
+  refusal names the missing capability and the recovery. `agy-run` needs none of these.
 
 ## 2. Sign in once (subscription only)
 
@@ -59,13 +66,19 @@ agy --version
 echo "say OK" | agy-run -
 ```
 
-Expected: the version prints (`1.1.13` or newer), then a short reply containing `OK`. If `agy-run`
-reports `'agy' not found`, fix your `PATH` (step 1). If it asks you to sign in, complete step 2.
+Expected: a version prints (any — `agy-review` probes its required capabilities, not a version
+floor; `agy-run` probes nothing), then a short reply containing `OK`. If `agy-run` reports
+`'agy' not found`, fix your `PATH` (step 1). If it asks you to sign in, complete step 2. If
+`agy-review` later refuses naming a missing flag or Node, that is the capability probe from step 1,
+not a broken install — follow the recovery it prints.
 
 ## Notes
 
-- `agy-run` is headless and text by default; the CLI's 1.1.x `--output-format json` can ride
-  passthrough (`-- --output-format json`) but the wrapper adds no parsing/validation.
+- `agy-run` is headless and text: `--output-format json` can ride passthrough
+  (`-- --output-format json`) but that wrapper adds no parsing/validation. `agy-review` is the one
+  that drives `--output-format json` first-class and reads the envelope (a successful run still
+  prints text; when its single dispatch or FINAL fed turn exits non-zero it publishes that captured
+  stdout unchanged, never an intermediate feed turn's).
 - `AGY_MODEL` selects the exact model display string; `AGY_TIMEOUT` controls `--print-timeout`.
 - Extra `agy` flags go after `--`, e.g. `agy-run @prompt.md -- --add-dir .`.
 - Re-run interactive `agy` only when the OAuth token expires or the account changes.

package/bridges/codex-cli-bridge/bin/codex-review.test.mjs

@@ -1198,7 +1198,7 @@ describe('codex-review.sh — review receipts (AD-038)', () => {
       // The grammar ENUMERATES the ASCII set (no ranges): a locale-collated [A-Za-z] could admit a
       // non-ASCII letter the kit's JS reader then refuses, breaking correlation after a paid run.
       const utf8 = makeSandbox();
-      const r2 = run(utf8, { env: { AW_REVIEW_NONCE: 'ré1', LC_ALL: 'en_US.UTF-8', LANG: 'en_US.UTF-8' } });
+      const r2 = run(utf8, { env: { AW_REVIEW_NONCE: 'r\u00e91', LC_ALL: 'en_US.UTF-8', LANG: 'en_US.UTF-8' } });
       rmSync(utf8.root, { recursive: true, force: true });
       assert.equal(r2.status, 2, 'a non-ASCII nonce letter refuses whatever the locale collation says');
       assert.match(r2.stderr, /safe nonce grammar/);

package/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "agent-workflow-kit",
   "kind": "composition-root",
-  "version": "5.9.0",
+  "version": "5.11.0",
   "provides": [],
   "roles": {},
   "detect": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sabaiway/agent-workflow-kit",
-  "version": "5.9.0",
+  "version": "5.11.0",
   "description": "Portable, cross-agent memory & workflow for AI coding agents — Claude Code, Codex, Cursor, Devin Desktop. One command deploys an AGENTS.md entry point + docs/ai context with cap/archive/index enforcement into any repo.",
   "keywords": [
     "ai-agents",

package/references/hooks/state-block-guard.mjs

@@ -7,9 +7,9 @@
 //
 // At Stop time the turn is ENDING. That single fact turns two closing shapes from "discouraged" into
 // FALSE, so they can be judged mechanically:
-//   • the «what I need from you» slot answering "nothing" — a stopped turn always needs a resume, so
+//   * the "what I need from you" slot answering "nothing" — a stopped turn always needs a resume, so
 //     the slot must NAME it. "Nothing needed" is honest only while work is actually running;
-//   • a first-person promise of imminent work in the closing block — the turn is over, so the work
+//   * a first-person promise of imminent work in the closing block — the turn is over, so the work
 //     is not starting. This is the announce-and-stop shape.
 // A promise GATED on something named (after your yes, when CI finishes) is honest and passes.
 //
@@ -19,6 +19,12 @@
 // required a second classifier to decide what counts as a real ask, the rule was DELETED and its
 // residual written down instead — twice. The mode contract lists every residual by name.
 //
+// ONE VOCABULARY, ENGLISH. The kit ships English markers and enumerates no other language: a
+// language list would be a shipped guess about somebody else's dialogue, and it never stops growing.
+// A deployment whose dialogue language is not English extends the arrays in ITS OWN placed copy —
+// this file is copied into the project and self-contained, so that edit is local and survives an
+// uninstalled kit. Until then such a deployment gets no detection, which the mode contract states.
+//
 // HONEST LIMIT, stated because it bounds what this can claim: a Stop hook cannot un-send the turn it
 // judges. This is DETECTION — it converts a silent recurrence into a loud one. It never blocks, and
 // every anomaly path exits 0: a hook that fires on every turn must not become the blocker or the
@@ -39,18 +45,17 @@ const EXIT_OK = 0;
 // The three slots, matched on their LABEL and ANCHORED TO A LINE START. The anchor is not cosmetic:
 // a message that DISCUSSES this contract — which the sessions this guard was built for do constantly
 // — mentions the labels inline, and an unanchored match would judge that prose instead of the real
-// closing block. Russian is the dialogue language this contract was written for; the English twins
-// keep the guard usable in an English-dialogue deployment.
+// closing block.
 const LINE_LEAD = '^[ \\t\\-•]*';
 const SLOT_PATTERNS = Object.freeze({
-  now: new RegExp(`${LINE_LEAD}(?:что сейчас|where we are|state now)\\s*[:：]`, 'gim'),
-  fromYou: new RegExp(`${LINE_LEAD}(?:что нужно от вас|что от вас|what i need from you|from you)\\s*[:：]`, 'gim'),
-  next: new RegExp(`${LINE_LEAD}(?:что дальше|what(?:'s| is)? next|next)\\s*[:：]`, 'gim'),
+  now: new RegExp(`${LINE_LEAD}(?:now|where we are|state now)\\s*[:：]`, 'gim'),
+  fromYou: new RegExp(`${LINE_LEAD}(?:what i need from you|from you)\\s*[:：]`, 'gim'),
+  next: new RegExp(`${LINE_LEAD}(?:what(?:'s| is)? next|next)\\s*[:：]`, 'gim'),
 });
 
 // Quoted and fenced material is EXAMPLE text, not the turn's own closing block. Stripped before any
 // label search — otherwise pasting the very specimen this guard catches would make the guard judge
-// the paste. Emphasis marks are stripped after, so `**Что сейчас:**` still parses.
+// the paste. Emphasis marks are stripped after, so `**Now:**` still parses.
 // Scanned line by line rather than matched as one regex: an UNCLOSED fence must run to the end of
 // the message. A pattern that only removes CLOSED fences would take an unfinished example's labels
 // for a real block — judging a demonstration as if it were the turn, which is precisely the mistake
@@ -84,9 +89,11 @@ const stripFences = (text) => {
 
 const BLOCKQUOTE_LINE = /^[ \t]*>.*$/gm;
 const EMPHASIS_MARKS = /[*_`]/g;
-// A model writes «What’s next» and «I’ll» with a typographic apostrophe far more often than with the
-// ASCII one, so matching only ASCII made the English half fail silently on ordinary output.
-const APOSTROPHES = /[’‘ʼ‛]/g;
+// A model writes "What's next" and "I'll" with a typographic apostrophe far more often than with the
+// ASCII one, so matching only ASCII made every label and every promise marker fail silently on
+// ordinary output. U+02BC rides as an escape because it is a modifier LETTER, and this family's
+// sources carry no non-ASCII letter; the escaped class matches exactly the same characters.
+const APOSTROPHES = /[’‘\u02bc‛]/g;
 const toProse = (text) => stripFences(text)
   .replace(BLOCKQUOTE_LINE, '')
   .replace(EMPHASIS_MARKS, '')
@@ -103,69 +110,93 @@ const openingAnswer = (slot) => {
   const at = slot.search(CLAUSE_END);
   return at === -1 ? slot : slot.slice(0, at);
 };
-// A rule excusing «…, ничего другого не нужно» was built, tightened twice, and then DELETED. Every
+// A rule excusing "…, nothing else is needed" was built, tightened twice, and then DELETED. Every
 // version let a banned answer through behind some harmless prefix, and the next version would have
 // needed an "is this a real ask" recogniser — a second lexical classifier with its own edge set. The
 // residual is stated instead of coded: a comma-joined qualifier IS flagged, and the writer's fix is
 // a clause break, which the first-clause rule already passes.
 
 const NOTHING_FORMS = Object.freeze([
-  'ничего',
-  'ничем',
-  'не требуется',
-  'не нужно',
-  'не нужен',
-  'нет необходимости',
   'nothing',
   'none',
   'n/a',
   'no action',
+  'no need',
+  'not needed',
+  'not required',
+]);
+
+// -- the "what is happening NOW" slot is not a report of what was DONE ----------------------------
+// The third judgeable shape. The three slots answer three different questions; when the now-slot
+// opens with finished work, the reader's one question — what is running — is buried behind a
+// summary they can already read in the message body above.
+// Judged by TOKEN ORDER, the technique the promise/gate rule uses: a COMPLETION marker standing
+// BEFORE the first CURRENCY marker means the running fact was buried. Two consequences are
+// deliberate — a slot with NO currency marker is never judged here (nothing running is a legitimate
+// state, and whether that is honest is the from-you slot's question), and a slot that LEADS with
+// what is running passes whatever it adds afterwards.
+// Stated residual, in this file's own style: a CURRENT state phrased with a COMPLETION MARKER
+// ("the work is closed, waiting on your call" — `closed` is in the list below) is flagged, and the
+// writer's fix is to phrase the state rather than the transition. Telling that from a real
+// completion report needs a classifier this layer lacks. The specimen is deliberately one the list
+// really carries: a residual written with a word the code does not match would document a false
+// positive that cannot happen, which is worse than no residual at all.
+const COMPLETION_FORMS = Object.freeze([
+  'done', 'completed', 'finished', 'closed', 'landed', 'shipped', 'merged', 'published',
+  'committed', 'fixed', 'added', 'removed', 'updated', 'recorded', 'measured', 'marked',
+  'verified', 'ran', 'wrote',
+  "i've", 'i have',
+]);
+
+// Running STATE only, never a time-deictic. "now" is the slot's own label, so accepting it as a
+// currency marker would put one at position 0 of nearly every slot and every completion after it
+// would read as honest — one word defeating the whole rule. A marker that names WHEN rather than
+// WHAT-IS-HAPPENING cannot carry this judgement.
+const CURRENCY_FORMS = Object.freeze([
+  'running', 'in progress', 'waiting', 'awaiting', 'pending', 'is up', 'under way', 'underway',
+  'in flight', 'blocked on',
 ]);
 
 // First-person promises of imminent work. Present tense counts: at Stop it describes work that is
 // NOT running.
-// Action verbs only. «считаю» and «смотрю» were dropped rather than qualified: they are as often
-// stative («считаю задачу завершённой», «смотрю на вопрос как на закрытый») as they are promises, and
-// a form that cannot tell the two apart buys detection with false flags.
-// The English markers are pronoun+modal rather than action verbs, so they cannot tell «I'll start» from
-// «I'll wait». Waiting is not work: it is what a turn that ENDS actually does, and it needs no gate to
-// be honest. So a modal followed by a waiting verb is excluded rather than the modal being dropped —
-// dropping it would need an open-ended list of every action verb English can put after it.
+// The markers are pronoun+modal or pronoun+verb, so they cannot tell "I'll start" from "I'll wait".
+// Waiting is not work: it is what a turn that ENDS actually does, and it needs no gate to be honest.
+// So a modal followed by a waiting verb is excluded rather than the modal being dropped — dropping
+// it would need an open-ended list of every action verb English can put after it.
 const WAITING_CONTINUATIONS = Object.freeze([
   "i'll wait", 'i will wait', "i'll be waiting", "i'll stand by", 'i will stand by',
   "i'll hold", 'i will hold', "i'll stay", 'i will stay', "i'll remain", 'i will remain',
 ]);
 
 const PROMISE_FORMS = Object.freeze([
-  'беру', 'начинаю', 'перехожу', 'сажусь', 'продолжаю', 'иду', 'проверяю', 'пишу', 'строю',
-  'планирую', 'разбираюсь',
-  "i'll", 'i will', "i'm going to", 'i am going to', 'i start', 'i begin', 'next i',
+  "i'll", 'i will', "i'm going to", 'i am going to', "i'm starting", "i'm taking",
+  'i start', 'i begin', 'i take', 'i move on', 'next i',
 ]);
 
 // A gate the promise may depend on. What is actually checked is TOKEN ORDER inside one segment: a
 // gate is treated as excusing a promise when it appears in the same segment and earlier in it. That
 // is a lexical approximation of dependency, not dependency itself, and it carries two named
-// residuals — an honest TRAILING gate («беру, когда вы скажете») is flagged, and a gate belonging to
-// an earlier comma-clause («если тест упадёт, сообщу, а сейчас начинаю…») wrongly excuses a promise
-// that follows it. Both are accepted limits of a lexical layer, documented in the mode contract.
+// residuals — an honest TRAILING gate ("I'll take it when you say so") is flagged, and a gate
+// belonging to an earlier comma-clause ("if the test fails I'll report, and now I start the next
+// class") wrongly excuses a promise that follows it. Both are accepted limits of a lexical layer,
+// documented in the mode contract.
 const CONDITIONAL_FORMS = Object.freeze([
-  'после', 'когда', 'если', 'как только',
-  'after', 'when', 'if', 'as soon as', 'once', 'pending',
+  'after', 'when', 'if', 'as soon as', 'once', 'upon', 'pending',
 ]);
 
-// Segment boundaries for the promise/gate rule. Deliberately NOT the comma: «если вы согласны, беру
-// класс» is one honest thought, and splitting it would flag the shape the rule exists to permit.
+// Segment boundaries for the promise/gate rule. Deliberately NOT the comma: "if you agree, I'll take
+// the class" is one honest thought, and splitting it would flag the shape the rule exists to permit.
 const PROMISE_SEGMENT_BREAK = /;|\n|[.!?](?=\s|$)/;
 
-// Word-bounded matching, Unicode-aware. JavaScript's `\b` is ASCII-only and therefore useless here:
-// with raw substring matching «не нужно» hides inside the honest «мне нужно ваше подтверждение»
-// («м|не нужно»), so the most natural way to name a real ask was read as answering "nothing".
-// The trailing exclusion covers the interrogative particle: «не нужно ЛИ добавить тест» asks a
-// question, it does not decline help.
+// Word-bounded matching, Unicode-aware. The markers are English but the TEXT is the project's
+// dialogue language, which need not be ASCII, and JavaScript's `\b` is ASCII-only: under it every
+// non-ASCII letter reads as a word break, so an English marker sitting inside a non-ASCII word would
+// match as if it stood alone. The Unicode class costs nothing and keeps that door shut; on the
+// English side it is what stops `none` matching inside `nonexistent`.
 const WORD_CHAR = '\\p{L}\\p{N}';
 const escapeForRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&');
 const boundedPattern = (phrase) => new RegExp(
-  `(?<![${WORD_CHAR}])${escapeForRegExp(phrase)}(?![${WORD_CHAR}])(?!\\s+ли(?![${WORD_CHAR}]))`,
+  `(?<![${WORD_CHAR}])${escapeForRegExp(phrase)}(?![${WORD_CHAR}])`,
   'iu',
 );
 const firstMatchAt = (haystack, needles) => needles.reduce((best, needle) => {
@@ -175,6 +206,25 @@ const firstMatchAt = (haystack, needles) => needles.reduce((best, needle) => {
 }, -1);
 const containsAny = (haystack, needles) => firstMatchAt(haystack, needles) !== -1;
 
+// Nearly every English completion marker doubles as an ADJECTIVE, which the Russian verbs this rule
+// was first written against did not: "the updated test suite is running" is an honest now-slot that
+// leads with the running fact, and reading `updated` there as a completion report would flag it. A
+// marker sitting directly after a DETERMINER is attributive — it modifies the noun after it instead
+// of reporting a transition — so it is not counted.
+// Residual, stated: this also loses a completion phrased attributively ("the finished council, the
+// matrix is running" passes). That trade is deliberate. A false flag on a correct slot is noise from
+// a hook that fires on EVERY turn, and noise is the failure this file is most careful to avoid; a
+// missed marginal shape is not.
+const DETERMINERS = Object.freeze(['the', 'a', 'an', 'this', 'that', 'these', 'those', 'its', 'my', 'our', 'your', 'their']);
+const AFTER_DETERMINER = new RegExp(`(?:^|[^${WORD_CHAR}])(?:${DETERMINERS.join('|')})[ \\t]+$`, 'iu');
+const matchesIn = (haystack, needle) => [...haystack.matchAll(new RegExp(boundedPattern(needle).source, 'giu'))]
+  .map((match) => match.index);
+const firstReportedAt = (haystack, needles) => needles.reduce((best, needle) => {
+  const at = matchesIn(haystack, needle).find((index) => !AFTER_DETERMINER.test(haystack.slice(0, index)));
+  if (at === undefined) return best;
+  return best === -1 ? at : Math.min(best, at);
+}, -1);
+
 const normalise = (value) => (typeof value === 'string'
   ? value.replace(EMPHASIS_MARKS, '').replace(APOSTROPHES, "'").toLowerCase()
   : '');
@@ -197,7 +247,7 @@ const groupLabels = (labels) => labels.reduce((state, label) => {
     : { current: candidate, completed: state.completed };
 }, { current: [], completed: null });
 
-// findStateBlock(text) → { now, fromYou, next } or null. The LAST STARTED candidate decides: if the
+// findStateBlock(text) -> { now, fromYou, next } or null. The LAST STARTED candidate decides: if the
 // message ends mid-block, the turn did not end on a block at all, and falling back to an earlier
 // complete one would judge text the turn already moved past.
 export const findStateBlock = (text) => {
@@ -213,7 +263,7 @@ export const findStateBlock = (text) => {
   return block;
 };
 
-// decideStop({ closingText, requireBlock }) → { ok, reasons }. Never throws: junk input decides
+// decideStop({ closingText, requireBlock }) -> { ok, reasons }. Never throws: junk input decides
 // "no block", which is a reportable state rather than a crash. An ABSENT block is reported only
 // under `requireBlock`: this kit does not mandate the three-part block, so warning about its absence
 // by default would fire on nearly every turn of a project that never adopted it — noise, from a hook
@@ -225,7 +275,7 @@ export const decideStop = (options) => {
     return requireBlock
       ? {
         ok: false,
-        reasons: ['no state block: the closing message must end with «что сейчас · что нужно от вас · что дальше»'],
+        reasons: ['no state block: the closing message must end with "now / what I need from you / what\'s next"'],
       }
       : { ok: true, reasons: [] };
   }
@@ -236,6 +286,11 @@ export const decideStop = (options) => {
       'from-you slot answers "nothing": the turn is ENDING, so a resume from the maintainer IS required — name the real unblocker instead',
     );
   }
+  if (buriesTheRunningFact(normalise(block.now))) {
+    reasons.push(
+      'the now-slot reports finished work before it names what is running — "now" is the state at this instant; move what you completed into the message body above the block',
+    );
+  }
   if (hasUngatedPromise(normalise(block.next))) {
     reasons.push(
       'announce-and-stop: the what-next slot promises imminent first-person work while the turn ends — either do it in this turn, or state what the work waits on',
@@ -244,6 +299,13 @@ export const decideStop = (options) => {
   return { ok: reasons.length === 0, reasons };
 };
 
+const buriesTheRunningFact = (nowSlot) => {
+  const currencyAt = firstMatchAt(nowSlot, CURRENCY_FORMS);
+  if (currencyAt === -1) return false;
+  const completionAt = firstReportedAt(nowSlot, COMPLETION_FORMS);
+  return completionAt !== -1 && completionAt < currencyAt;
+};
+
 const hasUngatedPromise = (nextSlot) => nextSlot.split(PROMISE_SEGMENT_BREAK).some((segment) => {
   const promiseAt = firstMatchAt(segment, PROMISE_FORMS);
   if (promiseAt === -1) return false;
@@ -285,7 +347,7 @@ const parsePayload = (rawInput) => {
 //
 // An EMPTY string is delivered text, not an absent one: a turn that ended with no prose really did
 // end without a closing block, and `--require-block` should be able to say so.
-// runHook(raw, {requireBlock}) → a decision, or null when there is genuinely nothing to judge.
+// runHook(raw, {requireBlock}) -> a decision, or null when there is genuinely nothing to judge.
 // Never throws.
 export const runHook = (rawInput, deps) => {
   const requireBlock = (deps ?? {}).requireBlock === true;

package/references/modes/commit-guard.md

@@ -7,13 +7,16 @@ The **read-only pre-commit guard** (strip-the-kit D10) — the last line of the
 Run `node ${CLAUDE_SKILL_DIR}/tools/commit-guard.mjs --check [--cwd <dir>]` — it refuses, each with a named recovery, on:
 
 1. **an INDEX that lags the verified working tree** — the gates and the fingerprint both describe the WORKING tree, while `git commit` builds the commit from the INDEX alone, and the fingerprint domain is identical whether a hunk sits staged or unstaged (staging a lone tracked modification does not even move it). So this arm runs FIRST, before the fingerprint is computed: it refuses when the working tree holds anything the index does not — tracked paths differing between index and worktree, or reviewable untracked-not-ignored paths (the SAME never-committable stat filter the fingerprint applies; ignored paths never refuse). An index entry carrying **skip-worktree** or **assume-unchanged** is invisible to `git diff`, so those entries are compared DIRECTLY against the worktree (type, symlink target, executable bit where `core.fileMode` says so, and the blob oid through git's own clean filters) — a de-materialised skip-worktree path is an ordinary sparse checkout and never refuses, while a missing assume-unchanged path does. The submodule probe forces `--ignore-submodules=none`, so `diff.ignoreSubmodules` / `submodule.<name>.ignore` cannot erase a dirty submodule from the comparison. Offending paths are named in THREE categories — plain lagging paths, paths held back by an index bit, and submodules — because their recoveries differ; ONE shared cap spans all of them, each category reserves a slot so no clause is ever nameless, the remainder is stated once, and every path is rendered as one escaped line. Recovery is ONE ordered sequence, and `git add -A` alone is NOT it: a bit-carrying entry must have its `skip-worktree` / `assume-unchanged` bit cleared FIRST (scoped to the paths the refusal names — never to everything `git ls-files -v` reports, which includes de-materialised sparse paths whose deletions would then be staged), then `git add -A`, then re-run `run-gates --final` at its RESOLVED path beside this tool, then commit the WHOLE tree. The listed paths are capped, so the loop is the completion signal: re-run the guard until it names none. A tracked **submodule** the index cannot prove current is named separately with its own recovery — commit or clean inside the submodule and stage the gitlink — because a root-level `git add -A` cannot capture a submodule's internal worktree changes. A submodule whose gitlink itself carries one of those index bits is **not probed at all**: it lags by construction. That is a deliberate REDUCTION — three consecutive review rounds each found a new way for a nested probe to answer "clean" wrongly (inherited superproject `GIT_*`, status config blindness, the submodule's OWN flagged entries, a symlink standing in for the directory) — and it stays a CONVERGING refusal, since clearing the bit is a recovery the guard prints and then falls silent on. An UNflagged submodule is judged by the ordinary probe exactly as before. **Fail-closed:** an undecidable git probe refuses with its own named cause, never a silent pass;
-2. no completed final record for the CURRENT fingerprint (the tree moved after the final run — any edit re-stales it);
-3. a RED latest attempt (a dead green never revives — the latest attempt at a fingerprint is authoritative);
-4. fingerprint before ≠ after on the receipt (the tree moved UNDER the final run);
-5. a LATER `final-start` whose attempt never completed (interrupted run / failed receipt append — an attempt of unknown outcome never lets an earlier green stand);
-6. declaration content drift (the current `docs/ai/gates.json` {id, cmd} array no longer matches the receipt's recorded one);
-7. evidence-hash drift (the store's canonical red-proof/degrade serializations moved under the receipt) or lcov drift (the consumed file's sha moved or vanished);
-8. unsatisfied review obligations — the SAME normative decision `review-state --check` computes (configured recipe backends, ship-class-only on the latest normal receipt, veto, the explicit degrade escape), recomputed over a SANITIZED env: the guard resolves FIXED git-dir paths for its own reads and ignores `AW_REVIEW_RECEIPTS`/`AW_CORE_EVIDENCE` (producer test seams are never guard inputs — a forged out-of-repo store never satisfies).
+2. **a CONTENT-FREE fingerprint over a DIRTY index** — the payload carries no bytes while the index really carries a change, which means staged content the fingerprint domain cannot see: a submodule gitlink hidden from `git diff` by `submodule.<name>.ignore` or `diff.ignoreSubmodules`. No receipt can describe what that commit will carry, so the guard refuses and names the CONFIGURATION as the recovery — clear the ignore setting (or set it to `none`) until `git diff --cached --no-ext-diff` shows the change, then re-run `run-gates --final`. Re-staging is not the recovery: the change is already staged;
+3. no completed final record for the CURRENT fingerprint (the tree moved after the final run — any edit re-stales it);
+4. a RED latest attempt (a dead green never revives — the latest attempt at a fingerprint is authoritative);
+5. fingerprint before ≠ after on the receipt (the tree moved UNDER the final run);
+6. a LATER `final-start` whose attempt never completed (interrupted run / failed receipt append — an attempt of unknown outcome never lets an earlier green stand);
+7. declaration content drift (the current `docs/ai/gates.json` {id, cmd} array no longer matches the receipt's recorded one);
+8. evidence-hash drift (the store's canonical red-proof/degrade serializations moved under the receipt) or lcov drift (the consumed file's sha moved or vanished);
+9. unsatisfied review obligations — the SAME normative decision `review-state --check` computes (configured recipe backends, ship-class-only on the latest normal receipt, veto, the explicit degrade escape), recomputed over a SANITIZED env: the guard resolves FIXED git-dir paths for its own reads and ignores `AW_REVIEW_RECEIPTS`/`AW_CORE_EVIDENCE` (producer test seams are never guard inputs — a forged out-of-repo store never satisfies).
+
+**The empty-commit lane is a PASS that attests NOTHING — and it consults no receipt.** A content-free fingerprint over a CLEAN index means the index contributes no tree-content delta, so the commit changes no tree content: `git commit --allow-empty`, a message- or signature-only `--amend`, an empty merge. (What such a commit DOES change — its message, its parents, its signature — was never in the guard's domain.) The guard passes and says exactly that, because its whole claim is about the bytes a commit carries and here there are none. The receipt arms are SKIPPED rather than satisfied: the content-free fingerprint is the one value every clean moment shares, so a receipt found there cannot be correlated to THIS moment or base — letting it decide would make the outcome depend on which stray moment the store recorded last, the same reason `flow-check`'s `#65` rung steps over a content-free RED. The flow arm still runs (the commit still moves HEAD, and the chain bookkeeping is about that), with its own fingerprint-keyed correlations dropped through the explicit `treeCarriesBytes: false` the guard declares — the checker never derives that fact, because a routine clean-tree check still wants those rungs.
 
 **Wiring:** this repo's dogfood rides `scripts/install-git-hooks.mjs`; a consumer install is a consented surface (init/recommendations) — the hook INSTALLER resolves the installed kit location at install time and writes the RESOLVED invocation into the hook it places (no runtime guessing). The final-run ordering that keeps the guard green is D13: stage everything FIRST → run the reviews on the staged tree → `run-gates --final` → commit immediately (any index/worktree mutation after the final run re-stales the receipt).
 
@@ -21,7 +24,7 @@ Run `node ${CLAUDE_SKILL_DIR}/tools/commit-guard.mjs --check [--cwd <dir>]` —
 
 **Boundary — what «the commit captures the tree» means for submodules.** The guard proves the SUPERPROJECT commit captures the SUPERPROJECT working tree. A superproject commit stores a submodule as a gitlink OID and never captures its file content — that content is the submodule's own commit boundary. The dirty-submodule refusal is therefore a best-effort COURTESY beyond the guard's boundary, and its completeness is bounded by what the submodule itself reports: a file held behind a `skip-worktree` / `assume-unchanged` bit in the SUBMODULE's own index is invisible to the submodule's status and so to this refusal. Deepening the nested probe was tried and abandoned — three consecutive review rounds each produced a new way for it to answer wrongly — so the honest contract is the boundary, not a completeness claim. Tracked as its own class.
 
-**Stated residual — the fingerprint can still be blinded by config.** Refusal 1 makes the COMMIT capture the whole current working tree. It does not make the RECEIPT unforgeable: `computeFingerprintPayload` still runs its diffs without `--ignore-submodules=none`, so under `diff.ignoreSubmodules=all` a submodule can be changed and its gitlink staged AFTER a green `--final` while the fingerprint stays put, and the stale receipt is reused. That is a receipt-collision defect, not an under-capture one — no commit ships less than the working tree because of it — and closing it means moving the node payload and both bash twins together (the AD-044 lockstep). Tracked as its own class.
+**Stated residual — the fingerprint can still be blinded by config.** Refusal 1 makes the COMMIT capture the whole current working tree. It does not make the RECEIPT unforgeable: `computeFingerprintPayload` still runs its diffs without `--ignore-submodules=none`, so under `diff.ignoreSubmodules=all` a submodule can be changed and its gitlink staged AFTER a green `--final` while the fingerprint stays put, and the stale receipt is reused. That is a receipt-collision defect, not an under-capture one — no commit ships less than the working tree because of it — and closing it means moving the node payload and both bash twins together (the AD-044 lockstep). Tracked as its own class. **Narrowed:** the case where the hidden gitlink is the ONLY staged change is now closed by refusal 2 — there the payload is empty and the index is not, which is decidable without touching the payload definition. A hidden gitlink riding ALONGSIDE other visible changes still produces an ordinary fingerprint and still reuses its receipt; that remainder is what the lockstep owns.
 
 **Human residual (stated, accepted):** `git commit --no-verify` bypasses any pre-commit hook — a self-discipline mechanism, not a security boundary.
 

package/references/modes/core-evidence.md

@@ -7,7 +7,7 @@ The ONE **loop-evidence writer** (strip-the-kit D6a/D7) — every core evidence
 Run `node ${CLAUDE_SKILL_DIR}/tools/core-evidence.mjs <verb> …`:
 
 1. **`red-proof "<test-file>#<test-name-pattern>"`** — the D3(c) observed-red DECLARATION, minted **BEFORE a bugfix is applied**: it runs the named test N times (default 3, `AW_CORE_EVIDENCE_RERUNS`; per-run timeout `AW_CORE_EVIDENCE_TIMEOUT_S`) on the CURRENT (pre-fix) tree, requires red N/N (observed green / unresolvable / mixed / timed-out are DISTINGUISHED refusals — nothing is written; mixed/timeout is QUARANTINE, no override lane), and records { testId · repo-relative file · content sha256 (custody) · N/N red · base = HEAD sha · the pre-fix tree fingerprint }. The final run (`coverage-check --check`) then requires every current-base record's test green N/N with the hash unchanged; a record whose pre-fix fingerprint EQUALS the current tree never satisfies (nothing changed — reuse/forgery); a commit expires records (base moves); editing a bound test file means re-observing red (the new record supersedes the old — same {base, testId} key).
-2. **`degrade --backend <name> --reason "<why>"`** — the ONLY escape from a required review backend (D3(b)): an explicit per-backend, per-tree record at the CURRENT fingerprint. Never all backends: the review gate still requires ≥1 non-degraded ship-class receipt whenever ≥1 backend is configured. Any tree edit re-stales the record (fingerprint-bound).
+2. **`degrade --backend <name> --reason "<why>"`** — the ONLY escape from a required review backend (D3(b)): an explicit per-backend record at the CURRENT fingerprint. Never all backends: the review gate still requires ≥1 non-degraded ship-class receipt whenever ≥1 backend is configured. Any tree edit that MOVES the fingerprint re-stales the record — which is every edit the payload can see, and no more: a change the payload cannot see (a gitlink hidden from `git diff` by an ignore configuration) leaves the record standing. **The per-tree claim has one honest exception, and it is not a corner case:** a degrade minted while the work tree is CLEAN binds the CONTENT-FREE fingerprint — the one value every clean moment of every repository shares — so it identifies no working state and, since the record carries no base, no moment either. Such a record is therefore OUTSIDE the `#64` degrade-before-final ordering rung (`flow-check` records the skip as an advisory naming how many were skipped), because the ORDER of two records that cannot be shown to belong to the same moment states nothing about any tree. The writer still accepts it — refusing would strand the one lane that honestly records an unavailable backend during a plan round, which attests no tree at all. Closing the exception needs a durable `base` on the record, which is the queued store migration.
 3. **`summary`** — the ONE stateless end-of-loop render (D6): gate result from the latest final attempt, per-backend verdicts from the review receipts, red-proof outcomes, degrade records. Computed from the stores at read time — no ledger, no rounds, nothing remembered. A malformed store exits non-zero and WITHHOLDS the affected section, never renders a partial as complete. The final-run line NAMES an absent coverage verdict from the `coverage` token the run RECORDED (an ADDITIVE optional field on the `final` record — the closed `certified | not-run | unknown` set, never `none`, and `certified` requires a bound `lcovSha256`): GREEN never renders unqualified over a run that issued no verdict. A LEGACY receipt carrying no token and no lcov digest is named as exactly that, never as a claim about what it read — the withheld verdict travels here too, as DETAIL beside the unchanged status word.
 
 **Promptless writer lane (D7):** both verbs ride plain `node ${CLAUDE_SKILL_DIR}/tools/core-evidence.mjs …` invocations — surface the paste-ready allow entries once (`.claude/settings.json`), and a full loop transcript runs at zero writer approval prompts.