@trac3er/oh-my-god 2.1.0 → 2.1.4

package/dist/public/manifest.json

@@ -3,11 +3,9 @@
   "channel": "public",
   "hosts": [
     "claude",
-    "codex",
-    "gemini",
-    "kimi"
+    "codex"
   ],
-  "contract_version": "2.1.0",
+  "contract_version": "2.1.4",
   "artifacts": [
     {
       "path": "bundle/.agents/skills/omg/AGENTS.fragment.md",
@@ -199,7 +197,7 @@
     },
     {
       "path": "bundle/.claude-plugin/marketplace.json",
-      "sha256": "be45f869562addf5052115bbee94717f03b86612169337964685029e7f79e64b"
+      "sha256": "db469d08d23b0473462773072387a5d8c0cc2427c604a98d47e874b034b72bff"
     },
     {
       "path": "bundle/.claude-plugin/mcp.json",
@@ -207,15 +205,7 @@
     },
     {
       "path": "bundle/.claude-plugin/plugin.json",
-      "sha256": "3ca12b84d8aedc4fe4ac818f8d07cb01789cbd0f20a8508f8c0dd14b2ec78e9f"
-    },
-    {
-      "path": "bundle/.gemini/settings.json",
-      "sha256": "14208140297f635cc5155cfe063c9b8a6193a3d0a264e0686cf3b80789208f27"
-    },
-    {
-      "path": "bundle/.kimi/mcp.json",
-      "sha256": "14208140297f635cc5155cfe063c9b8a6193a3d0a264e0686cf3b80789208f27"
+      "sha256": "2179506ae3d7cfa3d9c7d1f88a1723ac4cec146ae574bd06c91688a3caca70e6"
     },
     {
       "path": "bundle/.mcp.json",
@@ -223,7 +213,7 @@
     },
     {
       "path": "bundle/OMG_COMPAT_CONTRACT.md",
-      "sha256": "7e5bc1b707781358693546dc24db0c640fe67253f1df302c3ec3dcd1ea08b2b4"
+      "sha256": "6d0727a754dc8a813e4c3e65fa3a4b70bde23fdd13686742e98fd4b29f495f79"
     },
     {
       "path": "bundle/plugins/advanced/commands/OMG:code-review.md",
@@ -267,103 +257,103 @@
     },
     {
       "path": "bundle/plugins/advanced/plugin.json",
-      "sha256": "904c845d61ac3407c744674cd6f15e73e07899c8bb132cb2fe39f59f836b06f2"
+      "sha256": "44259d1cbddcc7e5b21af598e886e782bc42d82d1da3d23dea4da3f4b144386f"
     },
     {
       "path": "bundle/registry/bundles/algorithms.yaml",
-      "sha256": "d47f8d279bae18bfb538b9add770108c188f0306182e41be27352a1aa0c07dbc"
+      "sha256": "1cf6305c2826838a805f42ed2d773a2cf428d9ff5abb542e09cb86da2e3b46e5"
     },
     {
       "path": "bundle/registry/bundles/api-twin.yaml",
-      "sha256": "64dbce274c1fd4910b5201d11fc09fa596435c9bf8a8c6cf0854b5a96289c118"
+      "sha256": "1128f7cdcade155b11014c7899a3c206ef8f071091cb469300b91cc5ef5fda82"
     },
     {
       "path": "bundle/registry/bundles/claim-judge.yaml",
-      "sha256": "81aa5571545cf2b0489bab29cb3207e53f64113a85f843e7e2e338073d46ce6b"
+      "sha256": "7905b72d44fb41d4868d6b64700016fef87991729f16f9f4805de0ee673b595b"
     },
     {
       "path": "bundle/registry/bundles/control-plane.yaml",
-      "sha256": "024e1296420523d278f718be4e32ff35e4af7c9aa6cb996d85a8f5ab95252be0"
+      "sha256": "99002393ae686f02f1a8a2cf14805a60855969a394aef176ed844ebad9a99638"
     },
     {
       "path": "bundle/registry/bundles/data-lineage.yaml",
-      "sha256": "5b32e8bae66c95dd0c995b18a4106b2a8de533bea458cfebe155395e64b8a32d"
+      "sha256": "84dd116c083a5cdb5372d5a033ae67f465751f4bc141728e3259a1c49316ecd8"
     },
     {
       "path": "bundle/registry/bundles/delta-classifier.yaml",
-      "sha256": "000a9e8f438becacacfcbfe734fb8279bd8d58595689113c5a70c8b1a3b16e4b"
+      "sha256": "ac910410dfff607768990227343b82526c645eeb986ad0bfd676e2fddd742898"
     },
     {
       "path": "bundle/registry/bundles/eval-gate.yaml",
-      "sha256": "1331fd3fc25c86040321b3da270f35e3921c2157f7eb4d36168ba2efbcf1c56f"
+      "sha256": "240662404dbc7faffcfa4de0e7d52c8a355a71b66e79bc341abbf0416a420617"
     },
     {
       "path": "bundle/registry/bundles/health.yaml",
-      "sha256": "e0b0244d041676f5b46036cfe128b7b1bce6a11c4a30b76cc0e9dd7fdf8de3b1"
+      "sha256": "6fe31aa7cdb335921579fec96e8fe253b89458ddc9c4c846d7d145f9cfcac104"
     },
     {
       "path": "bundle/registry/bundles/hook-governor.yaml",
-      "sha256": "caec3b7910af44407abbee774481e51493f8444918d69e2149d12c12ece5ab54"
+      "sha256": "d273f00af67c85e7cb8700a095889b686b8b46c62248a871f5a5b36564759d77"
     },
     {
       "path": "bundle/registry/bundles/incident-replay.yaml",
-      "sha256": "c00dae32b4b0f09ea7099824234d3b1b38db16ccf21f79b985e2c2ed9c00a77d"
+      "sha256": "8ff449760c2d2d70cdf584e22eaf2d1a4ad06e91bbb3fea67072fe7d5c167245"
     },
     {
       "path": "bundle/registry/bundles/lsp-pack.yaml",
-      "sha256": "dc32c96586f7d9c47d46c3d619c284ab4efb95fd58a9cc7c2b5bc9803e379c17"
+      "sha256": "8a9cee8d7074c75e64abb1a083d68bb441f386d2497d1b3d48d476278c0adf0c"
     },
     {
       "path": "bundle/registry/bundles/mcp-fabric.yaml",
-      "sha256": "1089a0dc98fe96bab27473150dee6f1889a2daba09c04a8d80a9dedfdc083200"
+      "sha256": "7d1dac6fea6b81c6355de3910adc4b33244406c4e75ac5784ea457cabd922aeb"
     },
     {
       "path": "bundle/registry/bundles/plan-council.yaml",
-      "sha256": "f3131ea3cfdeb8c2784f4ebb75f3b5c745ff1a00f1ed0be2727b960055a57c79"
+      "sha256": "bd3534610fcf95be4f592097e085cbc6e157b36465e80724b22860ad9131c426"
     },
     {
       "path": "bundle/registry/bundles/preflight.yaml",
-      "sha256": "48c4ed8445c81cf51f52ca67692dd9389b732693ee285e59634c9a4a7eb82ae5"
+      "sha256": "4f047a339b865f48d938fe1210c16c6f81fd5997b8f9b8873c47f951a661d5be"
     },
     {
       "path": "bundle/registry/bundles/proof-gate.yaml",
-      "sha256": "dfdc8883c30dffc857efabb20a779ac220e7ee301b17aa79e9e582db968d655f"
+      "sha256": "692480c9a8c3506c05cdfbdb6a3f54fe5b190e0ceb1b7316d7c1a56b6f34a646"
     },
     {
       "path": "bundle/registry/bundles/remote-supervisor.yaml",
-      "sha256": "501af402971d6aff5b149d8c2ca861912c48c63de147e400895c54e542458870"
+      "sha256": "58d56c21926f80d1f62dabc77de467c87df27c46d6aa9823ad8b613866ffcefe"
     },
     {
       "path": "bundle/registry/bundles/robotics.yaml",
-      "sha256": "edbe04fc489acf8246718881eb3450fbeb5e48e0a73bf16fad2cbb0476fcf8f7"
+      "sha256": "9bce82dabd4128e590e088213cef59243636579088191226554beb72667c4c10"
     },
     {
       "path": "bundle/registry/bundles/secure-worktree-pipeline.yaml",
-      "sha256": "6d955fbbeecee2289603be2a7b17270839633b06b0355d4f75af2c45971265e2"
+      "sha256": "d522283991cb96a75a468c70398654476bad289fe01c62e629d8503afcf9f9c3"
     },
     {
       "path": "bundle/registry/bundles/security-check.yaml",
-      "sha256": "f8a6f15b9540d44e214a13811db224990c5bb88e3b0d62b93bd519fca4d6b9ed"
+      "sha256": "fcfe957e3a69fd3fc6fad57013b7d34420afea1f25ac9c5c2b8a1ec3cdcdfda6"
     },
     {
       "path": "bundle/registry/bundles/test-intent-lock.yaml",
-      "sha256": "c1a795205f64337fafb57442fd2744decca7166af981478b3f40d7251726dac8"
+      "sha256": "589cdecb474e3da150697ae81cab06ad5306c323d1b34871c5b6f88b70259d46"
     },
     {
       "path": "bundle/registry/bundles/tracebank.yaml",
-      "sha256": "04e93a6ac6788f4fdfb3aebf42687b8c076120c827794372582a5ee88295989c"
+      "sha256": "ee468665d4d54ad96fe73af7742aa36b3d6d830706c60259470822c9e55c6889"
     },
     {
       "path": "bundle/registry/bundles/vision.yaml",
-      "sha256": "c372e3257f2a81cdef1ba39f7404945cd049e4663cbfa35ac8c097018d5c9c69"
+      "sha256": "1642c21746608cf3809916c6bfa65e1768e3421fb24b9f649fd8e4322ac83eb9"
     },
     {
       "path": "bundle/registry/omg-capability.schema.json",
-      "sha256": "21f2c215be4df22a518f3c63593299339c2d3f43a4f5394bee73eeba2a0a2a8c"
+      "sha256": "660fb7ca3d26ba472065bc5174098337e862f89684ce22774f5ea3dec9560457"
     },
     {
       "path": "bundle/settings.json",
-      "sha256": "59b2b25a7055377d021080d7922f25a446330df1e0e98684906b5a3d5ce3b21e"
+      "sha256": "5cd958ecb7840484976b3854d3aca5e93ccf78dc11bf8f5785901956e1417cd5"
     }
   ]
 }

package/docs/install/opencode.md

@@ -0,0 +1,30 @@
+# Install OMG for OpenCode
+
+## Fast Path
+
+```bash
+npm install @trac3er/oh-my-god
+```
+
+If `opencode` is already on `PATH`, OMG wires `omg-control` into OpenCode's MCP config during install using the managed OMG Python runtime.
+
+## Manual Path
+
+```bash
+git clone https://github.com/trac3er00/OMG
+cd OMG
+./OMG-setup.sh install --mode=omg-only --preset=interop
+```
+
+## Verify
+
+- OpenCode is supported as a compatibility host in v1 (not a canonical contract host)
+- global config path: `~/.config/opencode/opencode.json`
+- project config path: `opencode.json`
+- MCP entries use the `mcp` key (not `mcpServers`)
+- plugin discovery reads `.opencode/plugins/`
+
+## Notes
+
+- OpenCode consumes OMG through compatibility-host MCP registration
+- canonical v1 contract hosts remain Claude Code and Codex

package/docs/proof.md

@@ -9,12 +9,21 @@ OMG keeps verification visible instead of burying it in implementation details.
 
 - Runtime evidence root: `.omg/evidence/`
 - Doctor output: `.omg/evidence/doctor.json`
+- Plugin diagnostics: `.omg/evidence/plugin-diagnostics.json` (via `diagnose-plugins`)
 - Security-check artifacts: `.omg/evidence/security-check-*.json`
 - Trust and external input artifacts: `.omg/evidence/trust-*.json`
 - Truth bundles:
   - `claim-judge`: `.omg/evidence/claim-judge-*.json` (verifies claim-to-evidence mapping)
   - `test-intent-lock`: `.omg/evidence/test-intent-lock-*.json` (verifies test-to-intent alignment)
   - `proof-gate`: `.omg/evidence/proof-gate-*.json` (verifies final release readiness)
+- Release execution primitives required by `omg release readiness`:
+  - run coordinator state: `.omg/state/release_run_coordinator/<run_id>.json`
+  - TDD lock evidence: `.omg/state/test-intent-lock/*.json`
+  - rollback manifest: `.omg/state/rollback_manifest/*.json`
+  - session health: `.omg/state/session_health/<run_id>.json`
+  - council verdicts: `.omg/state/council_verdicts/<run_id>.json`
+  - Forge starter proof (`proof_backed: true`): `.omg/evidence/forge-specialists-*.json`
+- Release readiness machine output includes `checks.execution_primitives` with `missing`, `invalid`, and `evidence_paths`
 - Browser evidence: `.omg/evidence/browser-*.png` and `.omg/evidence/browser-*.json` (Playwright-backed verification)
 - Canonical browser command: `/OMG:browser` with `/OMG:playwright` as a compatibility alias
 - Trace records and evidence links: `.omg/tracebank/events.jsonl`, `.omg/tracebank/evidence-links.jsonl`
@@ -28,6 +37,7 @@ OMG keeps verification visible instead of burying it in implementation details.
 |----------|------|--------|------------|------------|---------------|
 | Claude Code | Canonical | host-native | host-native | yes | primary |
 | Codex | Canonical | yes | yes | yes | primary |
+| OpenCode | Compatibility | yes | yes | yes | supported |
 | Gemini | Compatibility | yes | yes | yes | supported |
 | Kimi | Compatibility | yes | yes | yes | supported |
 
@@ -35,6 +45,7 @@ OMG keeps verification visible instead of burying it in implementation details.
 
 - Native setup writes `.omg/state/adoption-report.json`
 - Native setup writes `.omg/state/cli-config.yaml`
+- Plugin allowlist: `.omg/state/plugins-allowlist.yaml`
 - `OMG-only` and `coexist` are both covered in setup tests
 - Canonical modes: `chill`, `focused`, `exploratory`
 - OMC, OMX, and Superpowers references stay limited to compatibility and adoption guidance

package/docs/release-checklist.md

@@ -16,10 +16,22 @@ Use this checklist before making OMG public or cutting a release tag.
 
 ## Verification
 
+- [ ] `python3 scripts/sync-release-identity.py --check` — authored surfaces in sync
+- [ ] `python3 scripts/validate-release-identity.py --scope all --forbid-version 2.1.1` — full identity validation
+- `python3 scripts/omg.py diagnose-plugins --format json` exits 0
 - `python3 scripts/omg.py contract validate` passes
+- `python3 scripts/omg.py validate --format json` includes `plugin_compatibility` check
 - `python3 scripts/omg.py contract compile --host claude --host codex --channel public --output-root <tmp>` passes
 - `python3 scripts/omg.py contract compile --host claude --host codex --channel enterprise --output-root <tmp>` passes
 - `python3 scripts/omg.py release readiness --channel dual --output-root <tmp>` passes
+- Release readiness fails with machine-readable blockers unless all execution primitives are present and valid:
+  - run coordinator state: `.omg/state/release_run_coordinator/<run_id>.json`
+  - TDD proof-chain lock evidence: `.omg/state/test-intent-lock/*.json` (linked to run id or lock id)
+  - rollback manifest: `.omg/state/rollback_manifest/*.json`
+  - session health state: `.omg/state/session_health/<run_id>.json`
+  - council verdicts: `.omg/state/council_verdicts/<run_id>.json`
+  - Forge starter proof (`proof_backed: true`): `.omg/evidence/forge-specialists-*.json`
+- Release readiness output exposes primitive evidence paths in `checks.execution_primitives.evidence_paths`
 - Truth bundles (`claim-judge`, `test-intent-lock`, `proof-gate`) are verified and present in `registry/bundles/`
 - `plan-council` role is compiled and verified in `registry/bundles/`
 - `python3 scripts/check-omg-standalone-clean.py` passes
@@ -29,7 +41,8 @@ Use this checklist before making OMG public or cutting a release tag.
 ## Docs
 
 - README matches the current product surface
-- install guides for Claude Code and Codex are current
+- install guides for Claude Code, Codex, and OpenCode are current
+- OpenCode provider module exists at `runtime/providers/opencode_provider.py`
 - proof page includes current verification evidence
 - changelog includes the release entry
 

package/hooks/_agent_registry.py

@@ -224,6 +224,8 @@ INTENT_ROUTING = {
     "INTENT_EXPLORE":     "explore",      # explore/find → fast search agent
     "INTENT_REVIEW":      "reviewer",     # review/audit → code review agent
     "INTENT_QUICK":       "quick_task",   # quick/simple → fast task agent
+    # Clarification intent (Task 3) — halts mutation-capable execution
+    "INTENT_CLARIFICATION": None,         # clarification needed → halt (no agent dispatch)
 }
 
 # Core agent model preferences. NOT keyword-matched — used by orchestration pipeline only. model_version is informational (not passed to CLI).

package/hooks/firewall.py

@@ -7,23 +7,234 @@ one centralized decision model.
 import json
 import os
 import sys
+from pathlib import Path
+from typing import Any
 
 HOOKS_DIR = os.path.dirname(__file__)
-if HOOKS_DIR not in sys.path:
-    sys.path.insert(0, HOOKS_DIR)
+PROJECT_ROOT = os.path.dirname(HOOKS_DIR)
+for path in (HOOKS_DIR, PROJECT_ROOT):
+    if path not in sys.path:
+        sys.path.insert(0, path)
 
-from _common import setup_crash_handler, json_input, deny_decision, is_bypass_mode
+from _common import setup_crash_handler, json_input, deny_decision, is_bypass_mode, get_project_dir  # pyright: ignore[reportImplicitRelativeImport]
 
 # Fail-closed: deny on crash (security hook)
 setup_crash_handler("firewall", fail_closed=True)
 
 try:
-    from policy_engine import evaluate_bash_command, to_pretool_hook_output
+    from policy_engine import evaluate_bash_command, to_pretool_hook_output, scan_mutation_command, ask, deny  # pyright: ignore[reportImplicitRelativeImport]
+    from runtime.defense_state import DefenseState
+    from runtime.session_health import compute_session_health
+    from runtime.mutation_gate import check_mutation_allowed
+    from runtime.tool_plan_gate import journal_mutation_bash
 except Exception as _import_err:
     print(f"OMG firewall: policy_engine import failed: {_import_err}", file=sys.stderr)
     deny_decision(f"OMG firewall crash: policy_engine import failed: {_import_err}. Denying for safety.")
     sys.exit(0)
 
+
+def _enrich_risk_context(decision, payload: dict[str, object]):
+    try:
+        project_dir = os.environ.get("CLAUDE_PROJECT_DIR", os.getcwd())
+        run_id = _resolve_run_id(payload)
+
+        suffixes: list[str] = []
+        defense_risk = _read_defense_risk(project_dir)
+        if defense_risk:
+            suffixes.append(f"defense risk={defense_risk}")
+
+        council_signal = _read_council_signal(project_dir, run_id)
+        if council_signal:
+            suffixes.append(council_signal)
+
+        if suffixes:
+            decision.reason = f"{decision.reason} [{'; '.join(suffixes)}]".strip()
+    except Exception:
+        return decision
+    return decision
+
+
+def _resolve_run_id(payload: dict[str, object]) -> str:
+    if isinstance(payload, dict):
+        run_id = payload.get("run_id")
+        if isinstance(run_id, str) and run_id.strip():
+            return run_id.strip()
+        tool_input = payload.get("tool_input")
+        if isinstance(tool_input, dict):
+            metadata = tool_input.get("metadata")
+            if isinstance(metadata, dict):
+                metadata_run_id = metadata.get("run_id")
+                if isinstance(metadata_run_id, str) and metadata_run_id.strip():
+                    return metadata_run_id.strip()
+    env_run_id = os.environ.get("OMG_RUN_ID", "")
+    return env_run_id.strip()
+
+
+def _resolve_active_run_id(project_dir: str) -> str:
+    active_run_path = Path(project_dir) / ".omg" / "shadow" / "active-run"
+    if not active_run_path.exists():
+        return ""
+    try:
+        return active_run_path.read_text(encoding="utf-8").strip()
+    except OSError:
+        return ""
+
+
+def _read_defense_risk(project_dir: str) -> str:
+    path = Path(project_dir) / ".omg" / "state" / "defense_state" / "current.json"
+    if not path.exists():
+        return ""
+    try:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return ""
+    if not isinstance(payload, dict):
+        return ""
+    return str(payload.get("risk_level", "")).strip().lower()
+
+
+def _read_council_signal(project_dir: str, run_id: str) -> str:
+    if not run_id:
+        return ""
+    path = Path(project_dir) / ".omg" / "state" / "council_verdicts" / f"{run_id}.json"
+    if not path.exists():
+        return ""
+    try:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return ""
+    if not isinstance(payload, dict):
+        return ""
+
+    verdicts = payload.get("verdicts")
+    if not isinstance(verdicts, dict):
+        return ""
+    evidence = verdicts.get("evidence_completeness")
+    if not isinstance(evidence, dict):
+        return ""
+    verdict = str(evidence.get("verdict", "")).strip().lower()
+    findings = evidence.get("findings")
+    findings_count = len(findings) if isinstance(findings, list) else 0
+    if not verdict:
+        return ""
+    return f"council evidence={verdict} findings={findings_count}"
+
+
+def _read_clarification_state(project_dir: str, run_id: str) -> dict[str, object]:
+    if not run_id:
+        return {
+            "requires_clarification": False,
+            "intent_class": "",
+            "clarification_prompt": "",
+            "confidence": 0.0,
+        }
+    path = Path(project_dir) / ".omg" / "state" / "intent_gate" / f"{run_id}.json"
+    if not path.exists():
+        return {
+            "requires_clarification": False,
+            "intent_class": "",
+            "clarification_prompt": "",
+            "confidence": 0.0,
+        }
+    try:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return {
+            "requires_clarification": False,
+            "intent_class": "",
+            "clarification_prompt": "",
+            "confidence": 0.0,
+        }
+    if not isinstance(payload, dict):
+        return {
+            "requires_clarification": False,
+            "intent_class": "",
+            "clarification_prompt": "",
+            "confidence": 0.0,
+        }
+    prompt = " ".join(str(payload.get("clarification_prompt", "")).split())
+    try:
+        confidence = float(payload.get("confidence", 0.0))
+    except (TypeError, ValueError):
+        confidence = 0.0
+    return {
+        "requires_clarification": bool(payload.get("requires_clarification") is True),
+        "intent_class": str(payload.get("intent_class", "")).strip(),
+        "clarification_prompt": prompt,
+        "confidence": round(max(0.0, min(1.0, confidence)), 2),
+    }
+
+
+def _clarification_reason(clarification_prompt: str) -> str:
+    prompt = " ".join(str(clarification_prompt or "").split())
+    if prompt:
+        return f"Clarification required before mutation: {prompt}"
+    return "Clarification required before mutation: provide the missing intent details."
+
+
+def _to_float(value: Any, default: float) -> float:
+    try:
+        return float(value)
+    except (TypeError, ValueError):
+        return default
+
+
+def _mutating_defense_decision(
+    *,
+    project_dir: str,
+    cmd: str,
+    run_id: str,
+):
+    scan = scan_mutation_command(cmd)
+    defense_state = DefenseState(project_dir).update(
+        injection_hits=int(_to_float(scan.get("injection_hits"), 0.0)),
+        contamination_score=_to_float(scan.get("contamination_score"), 0.0),
+        overthinking_score=_to_float(scan.get("overthinking_score"), 0.0),
+        premature_fixer_score=_to_float(scan.get("premature_fixer_score"), 0.0),
+    )
+
+    resolved_run_id = run_id.strip() or _resolve_active_run_id(project_dir) or "default"
+    session_health = compute_session_health(project_dir, run_id=resolved_run_id)
+
+    contamination = _to_float(session_health.get("contamination_risk"), _to_float(defense_state.get("contamination_score"), 0.0))
+    overthinking = _to_float(session_health.get("overthinking_score"), _to_float(defense_state.get("overthinking_score"), 0.0))
+    premature_fixer = _to_float(defense_state.get("premature_fixer_score"), 0.0)
+    health_action = str(session_health.get("recommended_action", "continue"))
+    thresholds = session_health.get("thresholds") if isinstance(session_health, dict) else {}
+    contamination_thresholds = thresholds.get("contamination_risk") if isinstance(thresholds, dict) else {}
+    overthinking_thresholds = thresholds.get("overthinking_score") if isinstance(thresholds, dict) else {}
+    reflect_contamination = _to_float(contamination_thresholds.get("reflect") if isinstance(contamination_thresholds, dict) else None, 0.05)
+    reflect_overthinking = _to_float(overthinking_thresholds.get("reflect") if isinstance(overthinking_thresholds, dict) else None, 0.15)
+    reflect_triggers = session_health.get("reflect_triggers") if isinstance(session_health, dict) else {}
+    contamination_trigger = bool(reflect_triggers.get("contamination")) if isinstance(reflect_triggers, dict) else contamination > reflect_contamination
+    overthinking_trigger = bool(reflect_triggers.get("overthinking")) if isinstance(reflect_triggers, dict) else overthinking > reflect_overthinking
+    pause_required = bool(session_health.get("defense_pause_required") is True) if isinstance(session_health, dict) else (contamination_trigger or overthinking_trigger)
+    signal_text = ", ".join(str(item) for item in scan.get("signals", []) if str(item)) or "none"
+    context = (
+        f"defense hits={int(_to_float(defense_state.get('injection_hits'), 0.0))} "
+        f"contamination={contamination:.4f} overthinking={overthinking:.4f} "
+        f"premature_fixer={premature_fixer:.4f} "
+        f"session_health={health_action} signals={signal_text}"
+    )
+
+    if health_action == "block":
+        return deny(
+            f"Blocked: mutation denied by defense/session-health reducer [{context}]",
+            "high",
+            ["defense-reducer", "session-health"],
+        )
+
+    if pause_required or contamination_trigger or overthinking_trigger:
+        return ask(
+            "Pause: mutation requires reflection before execution "
+            f"[{context}; thresholds contamination>{reflect_contamination:.2f} "
+            f"overthinking>{reflect_overthinking:.2f}]",
+            "high",
+            ["reflect", "defense-reducer", "session-health"],
+        )
+
+    return None
+
 data = json_input()
 
 tool = data.get("tool_name", "")
@@ -36,11 +247,59 @@ if not cmd:
 
 decision = evaluate_bash_command(cmd)
 
+tool_input = data.get("tool_input")
+metadata = tool_input.get("metadata") if isinstance(tool_input, dict) else None
+lock_id = tool_input.get("lock_id") if isinstance(tool_input, dict) else None
+if not isinstance(lock_id, str) and isinstance(metadata, dict):
+    lock_id = metadata.get("lock_id")
+run_id = _resolve_run_id(data)
+
+gate_result = check_mutation_allowed(
+    tool="Bash",
+    file_path=cmd,
+    project_dir=get_project_dir(),
+    lock_id=lock_id if isinstance(lock_id, str) else None,
+    command=cmd,
+    run_id=run_id or None,
+    metadata=metadata if isinstance(metadata, dict) else None,
+)
+is_mutation_capable = str(gate_result.get("reason", "")) != "tool is read-only for mutation gate"
+clarification_state = _read_clarification_state(get_project_dir(), run_id)
+if is_mutation_capable:
+    defense_decision = _mutating_defense_decision(
+        project_dir=get_project_dir(),
+        cmd=cmd,
+        run_id=run_id,
+    )
+    if defense_decision is not None:
+        decision = defense_decision
+
+if clarification_state.get("requires_clarification") is True and is_mutation_capable:
+    deny_decision(_clarification_reason(str(clarification_state.get("clarification_prompt", ""))))
+    sys.exit(0)
+
+if is_mutation_capable and gate_result.get("status") == "blocked":
+    deny_decision(str(gate_result.get("reason", "mutation denied by test intent lock gate")))
+    sys.exit(0)
+
+decision = _enrich_risk_context(decision, data)
+
 # In bypass-permission mode, only enforce hard denials (critical safety).
 # Skip "ask" decisions so the user is not prompted for confirmation.
 if is_bypass_mode(data) and decision.action != "deny":
     sys.exit(0)
 
+if decision.action == "allow" and is_mutation_capable:
+    try:
+        journal_mutation_bash(
+            project_dir=get_project_dir(),
+            command=cmd,
+            run_id=run_id or None,
+            metadata=metadata if isinstance(metadata, dict) else None,
+        )
+    except Exception:
+        pass
+
 out = to_pretool_hook_output(decision)
 if out:
     json.dump(out, sys.stdout)

package/hooks/intentgate-keyword-detector.py

@@ -38,7 +38,7 @@ try:
         get_feature_flag,
         _resolve_project_dir,
         check_performance_budget,
-        PRE_TOOL_INJECT_MAX_MS,
+        PRE_TOOL_INJECT_MAX_MS as pre_tool_inject_max_ms,
     )
 except ImportError:
     import importlib
@@ -48,7 +48,7 @@ except ImportError:
     get_feature_flag = _common.get_feature_flag
     _resolve_project_dir = _common._resolve_project_dir
     check_performance_budget = _common.check_performance_budget
-    PRE_TOOL_INJECT_MAX_MS = _common.PRE_TOOL_INJECT_MAX_MS
+    pre_tool_inject_max_ms = _common.PRE_TOOL_INJECT_MAX_MS
 
 setup_crash_handler("intentgate-keyword-detector", fail_closed=False)
 
@@ -64,6 +64,18 @@ KEYWORD_INTENT_MAP = {
     "search": "INTENT_SEARCH",
     "stop": "INTENT_STOP",
     "crazy": "INTENT_CRAZY",
+    "auth": "INTENT_AUTH_SETUP",
+    "login": "INTENT_AUTH_SETUP",
+    "credentials": "INTENT_AUTH_SETUP",
+    "setup my credentials": "INTENT_AUTH_SETUP",
+    "setup credentials": "INTENT_AUTH_SETUP",
+    "remember my settings": "INTENT_PREFERENCE_MEMORY",
+    "remember settings": "INTENT_PREFERENCE_MEMORY",
+    "preferences": "INTENT_PREFERENCE_MEMORY",
+    "memory style": "INTENT_PREFERENCE_MEMORY",
+    "setup preferences": "INTENT_AMBIGUOUS_CONFIG",
+    "configure preferences": "INTENT_AMBIGUOUS_CONFIG",
+    "remember setup": "INTENT_AMBIGUOUS_CONFIG",
 }
 
 
@@ -179,7 +191,7 @@ if detected_intents:
 # PERFORMANCE BUDGET CHECK
 # ═══════════════════════════════════════════════════════════
 elapsed_ms = (time.time() - start_time) * 1000
-check_performance_budget("intentgate-keyword-detector", elapsed_ms, PRE_TOOL_INJECT_MAX_MS)
+check_performance_budget("intentgate-keyword-detector", elapsed_ms, pre_tool_inject_max_ms)
 
 # ═══════════════════════════════════════════════════════════
 # OUTPUT