@windyroad/itil 1.2.0 → 2.0.0-preview.1111

package/bin/wr-itil-skill-invocations

@@ -4,7 +4,7 @@
 # shim files in packages/*/bin/wr-* directly; edit the template + run
 # `npm run sync:shim-wrappers` to regenerate.
 #
-# Resolution (ADR-080):
+# Resolution (highest-version-wins-shim-wrapper-for-plugin-scaffold-template-shims-architecture-rule):
 #   1. If the wrapper's parent dir is semver-shaped, treat as installed-
 #      cache execution and resolve to the highest-version sibling's
 #      scripts/ entry below.
@@ -15,9 +15,9 @@
 #   3. If the cache parent contains zero semver-shaped siblings, exit
 #      127 with a stderr message naming the cache parent (per SQ-080-2).
 #
-# @adr ADR-080 (highest-version-wins shim wrapper plugin scaffold)
-# @adr ADR-049 (plugin-bundled scripts resolve via bin/ on $PATH — amended)
-# @problem P343 (mid-session staleness window)
+# @adr highest-version-wins-shim-wrapper-for-plugin-scaffold-template-shims-architecture-rule (highest-version-wins shim wrapper plugin scaffold)
+# @adr plugin-bundled-scripts-invoked-from-skill-md-resolve-via-bin-on-path-architecture-rule (plugin-bundled scripts resolve via bin/ on $PATH — amended)
+# @problem install-updates-refreshes-the-global-plugin-cache-but-does-not-fix-path-ordering-stale-plugin-version-shims-stay-first-on-path-so-subsequent-shim-invocations-run-old-code-problem (mid-session staleness window)
 
 set -euo pipefail
 

package/bin/wr-itil-story-map-edit

@@ -4,7 +4,7 @@
 # shim files in packages/*/bin/wr-* directly; edit the template + run
 # `npm run sync:shim-wrappers` to regenerate.
 #
-# Resolution (ADR-080):
+# Resolution (highest-version-wins-shim-wrapper-for-plugin-scaffold-template-shims-architecture-rule):
 #   1. If the wrapper's parent dir is semver-shaped, treat as installed-
 #      cache execution and resolve to the highest-version sibling's
 #      scripts/ entry below.
@@ -15,9 +15,9 @@
 #   3. If the cache parent contains zero semver-shaped siblings, exit
 #      127 with a stderr message naming the cache parent (per SQ-080-2).
 #
-# @adr ADR-080 (highest-version-wins shim wrapper plugin scaffold)
-# @adr ADR-049 (plugin-bundled scripts resolve via bin/ on $PATH — amended)
-# @problem P343 (mid-session staleness window)
+# @adr highest-version-wins-shim-wrapper-for-plugin-scaffold-template-shims-architecture-rule (highest-version-wins shim wrapper plugin scaffold)
+# @adr plugin-bundled-scripts-invoked-from-skill-md-resolve-via-bin-on-path-architecture-rule (plugin-bundled scripts resolve via bin/ on $PATH — amended)
+# @problem install-updates-refreshes-the-global-plugin-cache-but-does-not-fix-path-ordering-stale-plugin-version-shims-stay-first-on-path-so-subsequent-shim-invocations-run-old-code-problem (mid-session staleness window)
 
 set -euo pipefail
 

package/bin/wr-itil-story-map-query

@@ -4,7 +4,7 @@
 # shim files in packages/*/bin/wr-* directly; edit the template + run
 # `npm run sync:shim-wrappers` to regenerate.
 #
-# Resolution (ADR-080):
+# Resolution (highest-version-wins-shim-wrapper-for-plugin-scaffold-template-shims-architecture-rule):
 #   1. If the wrapper's parent dir is semver-shaped, treat as installed-
 #      cache execution and resolve to the highest-version sibling's
 #      scripts/ entry below.
@@ -15,9 +15,9 @@
 #   3. If the cache parent contains zero semver-shaped siblings, exit
 #      127 with a stderr message naming the cache parent (per SQ-080-2).
 #
-# @adr ADR-080 (highest-version-wins shim wrapper plugin scaffold)
-# @adr ADR-049 (plugin-bundled scripts resolve via bin/ on $PATH — amended)
-# @problem P343 (mid-session staleness window)
+# @adr highest-version-wins-shim-wrapper-for-plugin-scaffold-template-shims-architecture-rule (highest-version-wins shim wrapper plugin scaffold)
+# @adr plugin-bundled-scripts-invoked-from-skill-md-resolve-via-bin-on-path-architecture-rule (plugin-bundled scripts resolve via bin/ on $PATH — amended)
+# @problem install-updates-refreshes-the-global-plugin-cache-but-does-not-fix-path-ordering-stale-plugin-version-shims-stay-first-on-path-so-subsequent-shim-invocations-run-old-code-problem (mid-session staleness window)
 
 set -euo pipefail
 

package/bin/wr-itil-update-jtbd-references-section

@@ -4,7 +4,7 @@
 # shim files in packages/*/bin/wr-* directly; edit the template + run
 # `npm run sync:shim-wrappers` to regenerate.
 #
-# Resolution (ADR-080):
+# Resolution (highest-version-wins-shim-wrapper-for-plugin-scaffold-template-shims-architecture-rule):
 #   1. If the wrapper's parent dir is semver-shaped, treat as installed-
 #      cache execution and resolve to the highest-version sibling's
 #      scripts/ entry below.
@@ -15,9 +15,9 @@
 #   3. If the cache parent contains zero semver-shaped siblings, exit
 #      127 with a stderr message naming the cache parent (per SQ-080-2).
 #
-# @adr ADR-080 (highest-version-wins shim wrapper plugin scaffold)
-# @adr ADR-049 (plugin-bundled scripts resolve via bin/ on $PATH — amended)
-# @problem P343 (mid-session staleness window)
+# @adr highest-version-wins-shim-wrapper-for-plugin-scaffold-template-shims-architecture-rule (highest-version-wins shim wrapper plugin scaffold)
+# @adr plugin-bundled-scripts-invoked-from-skill-md-resolve-via-bin-on-path-architecture-rule (plugin-bundled scripts resolve via bin/ on $PATH — amended)
+# @problem install-updates-refreshes-the-global-plugin-cache-but-does-not-fix-path-ordering-stale-plugin-version-shims-stay-first-on-path-so-subsequent-shim-invocations-run-old-code-problem (mid-session staleness window)
 
 set -euo pipefail
 

package/bin/wr-itil-update-problem-references-section

@@ -4,7 +4,7 @@
 # shim files in packages/*/bin/wr-* directly; edit the template + run
 # `npm run sync:shim-wrappers` to regenerate.
 #
-# Resolution (ADR-080):
+# Resolution (highest-version-wins-shim-wrapper-for-plugin-scaffold-template-shims-architecture-rule):
 #   1. If the wrapper's parent dir is semver-shaped, treat as installed-
 #      cache execution and resolve to the highest-version sibling's
 #      scripts/ entry below.
@@ -15,9 +15,9 @@
 #   3. If the cache parent contains zero semver-shaped siblings, exit
 #      127 with a stderr message naming the cache parent (per SQ-080-2).
 #
-# @adr ADR-080 (highest-version-wins shim wrapper plugin scaffold)
-# @adr ADR-049 (plugin-bundled scripts resolve via bin/ on $PATH — amended)
-# @problem P343 (mid-session staleness window)
+# @adr highest-version-wins-shim-wrapper-for-plugin-scaffold-template-shims-architecture-rule (highest-version-wins shim wrapper plugin scaffold)
+# @adr plugin-bundled-scripts-invoked-from-skill-md-resolve-via-bin-on-path-architecture-rule (plugin-bundled scripts resolve via bin/ on $PATH — amended)
+# @problem install-updates-refreshes-the-global-plugin-cache-but-does-not-fix-path-ordering-stale-plugin-version-shims-stay-first-on-path-so-subsequent-shim-invocations-run-old-code-problem (mid-session staleness window)
 
 set -euo pipefail
 

package/bin/wr-itil-update-problem-rfcs-section

@@ -4,7 +4,7 @@
 # shim files in packages/*/bin/wr-* directly; edit the template + run
 # `npm run sync:shim-wrappers` to regenerate.
 #
-# Resolution (ADR-080):
+# Resolution (highest-version-wins-shim-wrapper-for-plugin-scaffold-template-shims-architecture-rule):
 #   1. If the wrapper's parent dir is semver-shaped, treat as installed-
 #      cache execution and resolve to the highest-version sibling's
 #      scripts/ entry below.
@@ -15,9 +15,9 @@
 #   3. If the cache parent contains zero semver-shaped siblings, exit
 #      127 with a stderr message naming the cache parent (per SQ-080-2).
 #
-# @adr ADR-080 (highest-version-wins shim wrapper plugin scaffold)
-# @adr ADR-049 (plugin-bundled scripts resolve via bin/ on $PATH — amended)
-# @problem P343 (mid-session staleness window)
+# @adr highest-version-wins-shim-wrapper-for-plugin-scaffold-template-shims-architecture-rule (highest-version-wins shim wrapper plugin scaffold)
+# @adr plugin-bundled-scripts-invoked-from-skill-md-resolve-via-bin-on-path-architecture-rule (plugin-bundled scripts resolve via bin/ on $PATH — amended)
+# @problem install-updates-refreshes-the-global-plugin-cache-but-does-not-fix-path-ordering-stale-plugin-version-shims-stay-first-on-path-so-subsequent-shim-invocations-run-old-code-problem (mid-session staleness window)
 
 set -euo pipefail
 

package/bin/wr-itil-update-rfc-commits-section

@@ -4,7 +4,7 @@
 # shim files in packages/*/bin/wr-* directly; edit the template + run
 # `npm run sync:shim-wrappers` to regenerate.
 #
-# Resolution (ADR-080):
+# Resolution (highest-version-wins-shim-wrapper-for-plugin-scaffold-template-shims-architecture-rule):
 #   1. If the wrapper's parent dir is semver-shaped, treat as installed-
 #      cache execution and resolve to the highest-version sibling's
 #      scripts/ entry below.
@@ -15,9 +15,9 @@
 #   3. If the cache parent contains zero semver-shaped siblings, exit
 #      127 with a stderr message naming the cache parent (per SQ-080-2).
 #
-# @adr ADR-080 (highest-version-wins shim wrapper plugin scaffold)
-# @adr ADR-049 (plugin-bundled scripts resolve via bin/ on $PATH — amended)
-# @problem P343 (mid-session staleness window)
+# @adr highest-version-wins-shim-wrapper-for-plugin-scaffold-template-shims-architecture-rule (highest-version-wins shim wrapper plugin scaffold)
+# @adr plugin-bundled-scripts-invoked-from-skill-md-resolve-via-bin-on-path-architecture-rule (plugin-bundled scripts resolve via bin/ on $PATH — amended)
+# @problem install-updates-refreshes-the-global-plugin-cache-but-does-not-fix-path-ordering-stale-plugin-version-shims-stay-first-on-path-so-subsequent-shim-invocations-run-old-code-problem (mid-session staleness window)
 
 set -euo pipefail
 

package/bin/wr-itil-update-rfc-references-section

@@ -4,7 +4,7 @@
 # shim files in packages/*/bin/wr-* directly; edit the template + run
 # `npm run sync:shim-wrappers` to regenerate.
 #
-# Resolution (ADR-080):
+# Resolution (highest-version-wins-shim-wrapper-for-plugin-scaffold-template-shims-architecture-rule):
 #   1. If the wrapper's parent dir is semver-shaped, treat as installed-
 #      cache execution and resolve to the highest-version sibling's
 #      scripts/ entry below.
@@ -15,9 +15,9 @@
 #   3. If the cache parent contains zero semver-shaped siblings, exit
 #      127 with a stderr message naming the cache parent (per SQ-080-2).
 #
-# @adr ADR-080 (highest-version-wins shim wrapper plugin scaffold)
-# @adr ADR-049 (plugin-bundled scripts resolve via bin/ on $PATH — amended)
-# @problem P343 (mid-session staleness window)
+# @adr highest-version-wins-shim-wrapper-for-plugin-scaffold-template-shims-architecture-rule (highest-version-wins shim wrapper plugin scaffold)
+# @adr plugin-bundled-scripts-invoked-from-skill-md-resolve-via-bin-on-path-architecture-rule (plugin-bundled scripts resolve via bin/ on $PATH — amended)
+# @problem install-updates-refreshes-the-global-plugin-cache-but-does-not-fix-path-ordering-stale-plugin-version-shims-stay-first-on-path-so-subsequent-shim-invocations-run-old-code-problem (mid-session staleness window)
 
 set -euo pipefail
 

package/bin/wr-itil-verify-iter-summary

@@ -4,7 +4,7 @@
 # shim files in packages/*/bin/wr-* directly; edit the template + run
 # `npm run sync:shim-wrappers` to regenerate.
 #
-# Resolution (ADR-080):
+# Resolution (highest-version-wins-shim-wrapper-for-plugin-scaffold-template-shims-architecture-rule):
 #   1. If the wrapper's parent dir is semver-shaped, treat as installed-
 #      cache execution and resolve to the highest-version sibling's
 #      scripts/ entry below.
@@ -15,9 +15,9 @@
 #   3. If the cache parent contains zero semver-shaped siblings, exit
 #      127 with a stderr message naming the cache parent (per SQ-080-2).
 #
-# @adr ADR-080 (highest-version-wins shim wrapper plugin scaffold)
-# @adr ADR-049 (plugin-bundled scripts resolve via bin/ on $PATH — amended)
-# @problem P343 (mid-session staleness window)
+# @adr highest-version-wins-shim-wrapper-for-plugin-scaffold-template-shims-architecture-rule (highest-version-wins shim wrapper plugin scaffold)
+# @adr plugin-bundled-scripts-invoked-from-skill-md-resolve-via-bin-on-path-architecture-rule (plugin-bundled scripts resolve via bin/ on $PATH — amended)
+# @problem install-updates-refreshes-the-global-plugin-cache-but-does-not-fix-path-ordering-stale-plugin-version-shims-stay-first-on-path-so-subsequent-shim-invocations-run-old-code-problem (mid-session staleness window)
 
 set -euo pipefail
 

package/hooks/itil-assistant-output-gate.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# P085 / ADR-013 / ADR-038: itil UserPromptSubmit gate.
+# problem-085-assistant-asks-for-input-when-the-next-step-is-obvious-and-uses-prose-asks-instead-of-askuserquestion-when-input-is-actually-needed-problem / structured-user-interaction-for-governance-skill-decisions-architecture-rule / progressive-disclosure-once-per-session-budget-for-userpromptsubmit-governance-prose-architecture-rule: itil UserPromptSubmit gate.
 #
 # When the incoming user prompt contains a direction-pinning signal
 # (yes / go ahead / just do it / act now / proceed / ...), inject a
@@ -29,7 +29,7 @@ fi
 
 if has_announced "itil-assistant-gate" "$SESSION_ID"; then
   cat <<'HOOK_OUTPUT'
-MANDATORY: direction pinned. Act on obvious next step; use AskUserQuestion tool for genuine ambiguity; NEVER prose-ask. See ADR-013.
+MANDATORY: direction pinned. Act on obvious next step; use AskUserQuestion tool for genuine ambiguity; NEVER prose-ask. See structured-user-interaction-for-governance-skill-decisions-architecture-rule.
 HOOK_OUTPUT
 else
   cat <<'HOOK_OUTPUT'
@@ -46,7 +46,7 @@ NON-OPTIONAL RULES:
 2. If the decision is genuinely ambiguous (multiple-valid-paths, none
    clearly better per direction/policy), use the AskUserQuestion tool.
    Never prose-ask. Prose questions are unanswerable under AFK
-   notifications and violate ADR-013 Rule 1.
+   notifications and violate structured-user-interaction-for-governance-skill-decisions-architecture-rule Rule 1.
 
 3. Canonical prose-ask phrasings to AVOID in your next response:
    "Want me to", "Should I", "Would you like me to", "Shall we",

package/hooks/itil-assistant-output-review.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# P085 / ADR-013: itil Stop hook.
+# problem-085-assistant-asks-for-input-when-the-next-step-is-obvious-and-uses-prose-asks-instead-of-askuserquestion-when-input-is-actually-needed-problem / structured-user-interaction-for-governance-skill-decisions-architecture-rule: itil Stop hook.
 #
 # Reads the last assistant turn from transcript_path on stdin and scans
 # for canonical prose-ask phrasings. If a prose-ask is detected (and
@@ -62,23 +62,23 @@ if [ -n "$MATCH" ]; then
       "PROSE-ASK DETECTED in your last turn (pattern: \"" + $match + "\"). " +
       "If the decision is obvious from direction / policy / session context, ACT — do not ask. " +
       "If genuinely ambiguous, re-emit via the AskUserQuestion tool. " +
-      "Never prose-ask. See ADR-013 Rule 1 + feedback_act_on_obvious_decisions.md."
+      "Never prose-ask. See structured-user-interaction-for-governance-skill-decisions-architecture-rule Rule 1 + feedback_act_on_obvious_decisions.md."
     )
   }'
   exit 0
 fi
 
-# P403: scan for mechanical-step-framed-as-user-optional. When a skill
+# agent-frames-skill-mandatory-mechanical-steps-as-user-optional-problem: scan for mechanical-step-framed-as-user-optional. When a skill
 # contract mandates a mechanical step, re-surfacing it as a user decision
 # (or a budget-caution skip) reintroduces the friction the mechanical-stage
-# carve-out (P132 / ADR-044) was engineered to remove.
+# carve-out (agents-over-ask-in-interactive-sessions-conflating-mechanical-stages-with-user-interactive-stages-of-multi-stage-skill-contracts-inverse-problem / decision-delegation-contract-when-agents-act-on-the-framework-vs-ask-the-user-architecture-rule) was engineered to remove.
 MECH_MATCH=$(echo "$ASSISTANT_TEXT" | detect_mechanical_optional 2>/dev/null) || true
 if [ -n "$MECH_MATCH" ]; then
   jq -n --arg match "$MECH_MATCH" '{
     stopReason: (
       "MECHANICAL-STEP-FRAMED-AS-OPTIONAL detected in your last turn (closer: \"" + $match + "\"). " +
       "A skill contract that mandates a mechanical step has already resolved that decision — do not re-surface it as a user choice or skip it on budget-caution grounds. " +
-      "Run the step, then report it done. See P132 / ADR-044 mechanical-stage carve-out."
+      "Run the step, then report it done. See agents-over-ask-in-interactive-sessions-conflating-mechanical-stages-with-user-interactive-stages-of-multi-stage-skill-contracts-inverse-problem / decision-delegation-contract-when-agents-act-on-the-framework-vs-ask-the-user-architecture-rule mechanical-stage carve-out."
     )
   }'
   exit 0

package/hooks/itil-bash-polling-antipattern-detect.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# P232: PreToolUse:Bash hook — denies bash polling loops that
+# bash-until-loop-with-pgrep-f-bats-recursive-self-references-the-polling-loop-s-own-command-line-new-variant-of-stuck-before-emit-deadlock-skill-md-prompt-warning-insufficient-problem: PreToolUse:Bash hook — denies bash polling loops that
 # self-reference via `pgrep -f` (parent class) or `pkill -0`
 # (sibling) and deadlock in AFK iters when the polling loop's
 # own command line matches the search pattern.
@@ -20,14 +20,14 @@
 #   - parse failure on stdin       (mirrors create-gate.sh fail-open)
 #
 # References:
-#   ADR-005  — plugin testing strategy (hook bats live under hooks/test/).
-#   ADR-013  Rule 1 — deny redirects with mechanical recovery.
-#   ADR-038  — progressive disclosure / deny-message terseness budget.
-#   ADR-045  — hook injection budget; deny-path band 200-700 bytes.
-#   ADR-052  — behavioural tests default (positive + negative cases).
-#   P146     — parent class (bash until-loop polls bats output with
+#   plugin-testing-strategy-architecture-rule  — plugin testing strategy (hook bats live under hooks/test/).
+#   structured-user-interaction-for-governance-skill-decisions-architecture-rule  Rule 1 — deny redirects with mechanical recovery.
+#   progressive-disclosure-once-per-session-budget-for-userpromptsubmit-governance-prose-architecture-rule  — progressive disclosure / deny-message terseness budget.
+#   hook-injection-budget-policy-for-pretooluse-and-posttooluse-hooks-architecture-rule  — hook injection budget; deny-path band 200-700 bytes.
+#   behavioural-tests-default-for-skill-testing-architecture-rule  — behavioural tests default (positive + negative cases).
+#   afk-iteration-subprocess-bash-until-loop-polls-bats-output-file-with-bats-console-regex-against-tap-format-output-deadlocks-indefinitely-manual-sigterm-required-json-metadata-lost-problem     — parent class (bash until-loop polls bats output with
 #              bats-console-summary regex against TAP output).
-#   P232     — this hook; self-referential pgrep -f variant.
+#   bash-until-loop-with-pgrep-f-bats-recursive-self-references-the-polling-loop-s-own-command-line-new-variant-of-stuck-before-emit-deadlock-skill-md-prompt-warning-insufficient-problem     — this hook; self-referential pgrep -f variant.
 #   p057-staging-trap-detect.sh — sibling PreToolUse:Bash detect
 #              hook; mirror the deny-message shape.
 
@@ -76,9 +76,9 @@ fi
 
 # Antipattern detected — emit deny with terse recovery.
 # Voice-tone target ~245 bytes (sibling p057-staging-trap-detect.sh
-# precedent). Cites P232, names BOTH recovery alternatives, fits
-# inside ADR-045 deny-path 200-700 byte band.
-REASON="BLOCKED: P232 self-referential polling antipattern. \\\`pgrep -f\\\` / \\\`pkill -0\\\` inside until/while loop matches the loop's own command line and deadlocks in AFK iters. Use \\\`wait \\\$bg_pid\\\` (shell-native) OR Bash-tool BashOutput polling (run_in_background=true) instead."
+# precedent). Cites bash-until-loop-with-pgrep-f-bats-recursive-self-references-the-polling-loop-s-own-command-line-new-variant-of-stuck-before-emit-deadlock-skill-md-prompt-warning-insufficient-problem, names BOTH recovery alternatives, fits
+# inside hook-injection-budget-policy-for-pretooluse-and-posttooluse-hooks-architecture-rule deny-path 200-700 byte band.
+REASON="BLOCKED: bash-until-loop-with-pgrep-f-bats-recursive-self-references-the-polling-loop-s-own-command-line-new-variant-of-stuck-before-emit-deadlock-skill-md-prompt-warning-insufficient-problem self-referential polling antipattern. \\\`pgrep -f\\\` / \\\`pkill -0\\\` inside until/while loop matches the loop's own command line and deadlocks in AFK iters. Use \\\`wait \\\$bg_pid\\\` (shell-native) OR Bash-tool BashOutput polling (run_in_background=true) instead."
 
 cat <<EOF
 {

package/hooks/itil-changeset-discipline.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# P141: PreToolUse:Bash hook — denies `git commit` invocations whose
+# afk-iter-packages-plugin-commits-without-changesets-orchestrator-main-turn-back-fill-is-fragile-recovery-hook-level-enforcement-preferable-problem: PreToolUse:Bash hook — denies `git commit` invocations whose
 # staged set includes `packages/<plugin>/` source files but no
 # `.changeset/*.md` is staged. Hook-level enforcement replaces the
 # unreliable iter-prompt-time changeset reminder (40% miss rate
@@ -8,7 +8,7 @@
 # Detection delegates to `lib/changeset-detect.sh::detect_changeset_required`.
 # When the helper returns 1, this hook emits PreToolUse deny JSON
 # with the offending plugin slug inline and the literal `bun run
-# changeset` recovery command, satisfying ADR-013 Rule 1's "deny
+# changeset` recovery command, satisfying structured-user-interaction-for-governance-skill-decisions-architecture-rule Rule 1's "deny
 # redirects to a recovery path" contract via the mechanical-recovery
 # shape (no skill wrapper required — authoring a changeset is a
 # single command).
@@ -17,12 +17,12 @@
 # `lib/command-detect.sh::command_invokes_git_commit`, which strips
 # common prefix shapes (leading whitespace, env-var assignments,
 # `cd <path> &&`) and checks whether the residual leading token pair
-# is literally `git commit`. P272: replaced the prior substring match
+# is literally `git commit`. itil-changeset-discipline-sh-hook-substring-matches-git-commit-anywhere-in-bash-command-sibling-problem: replaced the prior substring match
 # `*"git commit"*` that misfired on non-commit Bash whose argument
 # vectors merely mentioned the phrase (grep / sed / cat-heredoc /
 # echo / `git log --grep`).
 #
-# Allow paths (exit 0 silently per ADR-045 Pattern 1):
+# Allow paths (exit 0 silently per hook-injection-budget-policy-for-pretooluse-and-posttooluse-hooks-architecture-rule Pattern 1):
 #   - tool_name != "Bash"            (only Bash invocations are gated)
 #   - command is not a `git commit` invocation by leading-executable
 #                                   semantics (helper returns 1)
@@ -32,27 +32,27 @@
 #   - parse failure on stdin         (mirrors create-gate.sh fail-open)
 #
 # References:
-#   ADR-005 — plugin testing strategy (hook bats live under hooks/test/).
-#   ADR-009 — gate marker lifecycle (this hook deliberately does NOT
+#   plugin-testing-strategy-architecture-rule — plugin testing strategy (hook bats live under hooks/test/).
+#   gate-marker-lifecycle-ttl-drift-not-stop-hook-reset-architecture-rule — gate marker lifecycle (this hook deliberately does NOT
 #             use markers; detection is per-invocation deterministic
-#             — same precedent as P125 `p057-staging-trap-detect.sh`).
-#   ADR-013 Rule 1 — deny redirects with mechanical recovery.
-#   ADR-014 — governance skills commit their own work (the hook keeps
+#             — same precedent as staging-trap-recurs-despite-documentation-hook-level-enforcement-candidate-problem `p057-staging-trap-detect.sh`).
+#   structured-user-interaction-for-governance-skill-decisions-architecture-rule Rule 1 — deny redirects with mechanical recovery.
+#   governance-skills-commit-their-own-completed-work-architecture-rule — governance skills commit their own work (the hook keeps
 #             iter commits self-contained — no orchestrator-main-turn
 #             back-fill needed).
-#   ADR-018 — inter-iteration release cadence (the hook strengthens
+#   inter-iteration-release-cadence-for-afk-loops-architecture-rule — inter-iteration release cadence (the hook strengthens
 #             release-cadence integrity by ensuring every publishable
 #             iter has a changeset to drain).
-#   ADR-038 — progressive disclosure / deny-message terseness budget.
-#   ADR-045 — hook injection budget (Pattern 1 silent-on-pass; deny
+#   progressive-disclosure-once-per-session-budget-for-userpromptsubmit-governance-prose-architecture-rule — progressive disclosure / deny-message terseness budget.
+#   hook-injection-budget-policy-for-pretooluse-and-posttooluse-hooks-architecture-rule — hook injection budget (Pattern 1 silent-on-pass; deny
 #             band ≤300 bytes for this hook).
-#   P073    — sibling changeset author-time gate (Write/Edit on
+#   problem-073-no-voice-and-tone-check-or-risk-assessment-on-changeset-bodies-which-populate-changelog-md-release-prs-github-releases-and-npm-release-notes-problem    — sibling changeset author-time gate (Write/Edit on
 #             `.changeset/*.md`); composes-with as defence-in-depth.
-#   P125    — sibling staging-trap hook (same enforcement-layer shape).
-#   P141    — this hook.
-#   P268    — shared `command_invokes_git_commit` helper landed for
+#   staging-trap-recurs-despite-documentation-hook-level-enforcement-candidate-problem    — sibling staging-trap hook (same enforcement-layer shape).
+#   afk-iter-packages-plugin-commits-without-changesets-orchestrator-main-turn-back-fill-is-fragile-recovery-hook-level-enforcement-preferable-problem    — this hook.
+#   hook-substring-matches-git-commit-anywhere-in-bash-command-not-just-actual-git-commit-invocations-problem    — shared `command_invokes_git_commit` helper landed for
 #             `itil-readme-refresh-discipline.sh`; consumed here.
-#   P272    — sibling-hook refactor: substring-match → helper here.
+#   itil-changeset-discipline-sh-hook-substring-matches-git-commit-anywhere-in-bash-command-sibling-problem    — sibling-hook refactor: substring-match → helper here.
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 # shellcheck source=lib/changeset-detect.sh
@@ -89,7 +89,7 @@ except:
 # `lib/command-detect.sh::command_invokes_git_commit`, which strips
 # common prefix shapes (leading whitespace, env-var assignments,
 # `cd <path> &&`) and checks whether the residual leading token pair
-# is literally `git commit`. P272: replaced the prior substring match
+# is literally `git commit`. itil-changeset-discipline-sh-hook-substring-matches-git-commit-anywhere-in-bash-command-sibling-problem: replaced the prior substring match
 # `*"git commit"*` that misfired on non-commit Bash whose argument
 # vectors merely mentioned the phrase (grep / sed / cat-heredoc /
 # echo / `git log --grep`).
@@ -98,21 +98,21 @@ command_invokes_git_commit "$COMMAND" || exit 0
 # Run detection. Helper echoes offending plugin slug on stdout when
 # detected; returns 1 in that case. Returns 0 (allow) on no-trap,
 # bypass env, or fail-open (non-git tree, parse error). The COMMAND is
-# passed so Check 2b can change-scope to the commit's work-item ID (P387):
+# passed so Check 2b can change-scope to the commit's work-item ID (changeset-discipline-check-2b-is-plugin-scoped-not-change-scoped-plugin-source-commits-ship-undocumented-when-a-sibling-changeset-already-targets-the-plugin-problem):
 # an in-scope changeset for an UNRELATED ticket no longer covers this commit.
 TRAPPED_SLUG=$(detect_changeset_required "$COMMAND" 2>/dev/null) && exit 0
 
 # Trap detected — emit deny with terse recovery.
-# Voice-tone budget per ADR-045 deny-band ≤300 bytes total. Names the
+# Voice-tone budget per hook-injection-budget-policy-for-pretooluse-and-posttooluse-hooks-architecture-rule deny-band ≤300 bytes total. Names the
 # plugin slug, the literal in-flight recovery command (`bun run
-# changeset` — staging ANY changeset satisfies the gate), and the P141
-# cite. P173: the deny no longer advertises BYPASS_CHANGESET_GATE=1 as an
+# changeset` — staging ANY changeset satisfies the gate), and the afk-iter-packages-plugin-commits-without-changesets-orchestrator-main-turn-back-fill-is-fragile-recovery-hook-level-enforcement-preferable-problem
+# cite. bypass-gate-env-vars-do-not-propagate-from-bash-subshell-to-pretooluse-hook-context-problem: the deny no longer advertises BYPASS_CHANGESET_GATE=1 as an
 # in-flight escape — that env var only takes effect when set in Claude
 # Code's process env BEFORE the session started; a mid-session Bash
 # export/inline assignment never reaches the hook process. The deny
 # states the bypass is pre-session-only so maintainers stop wasting a
-# turn trying it mid-session (the original P173 cost).
-REASON="BLOCKED: P141 changeset discipline. packages/${TRAPPED_SLUG}/ source needs .changeset/*.md. Recovery: bun run changeset. Env bypass is pre-session only."
+# turn trying it mid-session (the original bypass-gate-env-vars-do-not-propagate-from-bash-subshell-to-pretooluse-hook-context-problem cost).
+REASON="BLOCKED: afk-iter-packages-plugin-commits-without-changesets-orchestrator-main-turn-back-fill-is-fragile-recovery-hook-level-enforcement-preferable-problem changeset discipline. packages/${TRAPPED_SLUG}/ source needs .changeset/*.md. Recovery: bun run changeset. Env bypass is pre-session only."
 
 cat <<EOF
 {

package/hooks/itil-claude-space-protection.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# P131: PreToolUse:Write|Edit enforcement hook for `.claude/` user-space.
+# agents-write-project-generated-artefacts-under-claude-user-controlled-config-space-gate-exclusions-are-read-tolerance-not-write-permission-problem: PreToolUse:Write|Edit enforcement hook for `.claude/` user-space.
 #
 # DENIES Write|Edit to project-scoped `.claude/` paths that are NOT in the
 # user-space allow-list, unless the user has pre-authorized that specific
@@ -11,7 +11,7 @@
 # gate-exclusion list as "approved write zones" and write project-generated
 # content (plans, audits, scratch state) under `.claude/`, polluting user
 # space. Project-generated content belongs in `docs/` (plans, audits) or
-# inline in problem-ticket bodies. See P131 + project CLAUDE.md MANDATORY
+# inline in problem-ticket bodies. See agents-write-project-generated-artefacts-under-claude-user-controlled-config-space-gate-exclusions-are-read-tolerance-not-write-permission-problem + project CLAUDE.md MANDATORY
 # rule.
 #
 # Allow-list (per is_protected_claude_path in lib/claude-space-gate.sh):
@@ -25,25 +25,25 @@
 # Bypass: user creates `.claude/.agent-write-approved-<sha256>` marker
 # (sha256 of project-relative path). Marker is persistent (no TTL); user
 # pre-authorizes once per path. Distinct from session-scoped review
-# markers (ADR-009) — this is the persistent in-tree shape used by
-# `.claude/.install-updates-consent` (ADR-030 / P120 precedent).
+# markers (gate-marker-lifecycle-ttl-drift-not-stop-hook-reset-architecture-rule) — this is the persistent in-tree shape used by
+# `.claude/.install-updates-consent` (repo-local-skills-for-project-specific-workflow-tooling-architecture-rule / install-updates-consent-gate-fires-on-every-invocation-despite-the-answer-being-invariably-all-confirmed-siblings-problem precedent).
 #
 # Out of scope:
 #   - Read|Glob|Grep on .claude/ paths — only Write|Edit gated
 #   - Paths outside PWD project root (~/.claude/, other repos' .claude/)
-#   - Empty session_id / file_path — fail-open (ADR-013 Rule 6 parity
+#   - Empty session_id / file_path — fail-open (structured-user-interaction-for-governance-skill-decisions-architecture-rule Rule 6 parity
 #     with sibling hooks like manage-problem-enforce-create.sh)
 #
 # References:
-#   ADR-009 — gate marker lifecycle (this hook adds a NEW persistent
-#             marker class; ADR-009's session-scoped /tmp markers
+#   gate-marker-lifecycle-ttl-drift-not-stop-hook-reset-architecture-rule — gate marker lifecycle (this hook adds a NEW persistent
+#             marker class; gate-marker-lifecycle-ttl-drift-not-stop-hook-reset-architecture-rule's session-scoped /tmp markers
 #             unchanged)
-#   ADR-013 Rule 6 — non-interactive fail-safe; deny via stdin JSON
-#   ADR-030 — persistent in-tree consent marker precedent
-#   ADR-038 — progressive disclosure (deny message <500 bytes)
-#   ADR-045 — hook injection budget (silent on allow path)
-#   P119    — manage-problem-enforce-create.sh hook shape precedent
-#   P131    — driver
+#   structured-user-interaction-for-governance-skill-decisions-architecture-rule Rule 6 — non-interactive fail-safe; deny via stdin JSON
+#   repo-local-skills-for-project-specific-workflow-tooling-architecture-rule — persistent in-tree consent marker precedent
+#   progressive-disclosure-once-per-session-budget-for-userpromptsubmit-governance-prose-architecture-rule — progressive disclosure (deny message <500 bytes)
+#   hook-injection-budget-policy-for-pretooluse-and-posttooluse-hooks-architecture-rule — hook injection budget (silent on allow path)
+#   agent-bypasses-wr-itil-manage-problem-step-2-duplicate-check-by-writing-tickets-directly-to-docs-problems-problem    — manage-problem-enforce-create.sh hook shape precedent
+#   agents-write-project-generated-artefacts-under-claude-user-controlled-config-space-gate-exclusions-are-read-tolerance-not-write-permission-problem    — driver
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 # shellcheck source=lib/claude-space-gate.sh
@@ -93,6 +93,13 @@ if has_approval_marker "$FILE_PATH" "$PWD"; then
 fi
 
 BASENAME=$(basename "$FILE_PATH")
+REL_PATH="${FILE_PATH#"$PWD"/}"
+CONFIG_DIR="${REL_PATH%%/*}"
 
-claude_space_deny "BLOCKED: Cannot Write|Edit '${BASENAME}' under .claude/. That directory is user-controlled config space — agents must not write project-generated artefacts there. Use docs/plans/ for plans, docs/audits/ for audit logs, or attach inline to the relevant problem ticket. To pre-authorize a specific .claude/ path, create marker '.claude/.agent-write-approved-<sha256-of-rel-path>' (P131; see project CLAUDE.md MANDATORY rule)."
+if [ "$CONFIG_DIR" = ".claude" ]; then
+  INSTRUCTIONS="project CLAUDE.md MANDATORY rule"
+else
+  INSTRUCTIONS="project AGENTS.md MANDATORY rule"
+fi
+claude_space_deny "BLOCKED: Cannot Write|Edit '${BASENAME}' under ${CONFIG_DIR}/. That directory is user-controlled config space — agents must not write project-generated artefacts there. Use docs/plans/ for plans, docs/audits/ for audit logs, or attach inline to the relevant problem ticket. To pre-authorize a specific ${CONFIG_DIR}/ path, create marker '${CONFIG_DIR}/.agent-write-approved-<sha256-of-rel-path>' (agents-write-project-generated-artefacts-under-claude-user-controlled-config-space-gate-exclusions-are-read-tolerance-not-write-permission-problem; see ${INSTRUCTIONS})."
 exit 0