@windyroad/risk-scorer 0.19.16 → 0.20.0

package/.claude-plugin/plugin.json

@@ -310,5 +310,5 @@
     }
   },
   "name": "wr-risk-scorer",
-  "version": "0.19.16"
+  "version": "0.20.0"
 }

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wr-risk-scorer",
-  "version": "0.19.16",
+  "version": "0.20.0",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "author": {
     "name": "Windy Road Technology",

package/hooks/external-comms-gate.sh

@@ -439,11 +439,6 @@ print(json.dumps({
 " "$reason"
 }
 
-if [ "$BODY_FILE_ERROR" -eq 1 ]; then
-    deny_with_reason "BLOCKED (external-comms gate): body-file could not be read unambiguously from the command checkout. Use one readable UTF-8 --body-file path and review its exact contents before retrying."
-    exit 0
-fi
-
 permit_with_advisory() {
     local msg="$1"
     python3 -c "
@@ -452,6 +447,11 @@ print(json.dumps({'systemMessage': sys.argv[1]}))
 " "$msg"
 }
 
+if [ "$BODY_FILE_ERROR" -eq 1 ]; then
+    permit_with_advisory "Governance evidence unavailable (external-comms gate): body-file could not be read unambiguously from the command checkout. Use one readable UTF-8 --body-file path and review its exact contents before retrying."
+    exit 0
+fi
+
 # ---------- Advisory-only fallback when policy file is absent ----------
 if [ ! -f "$EXTERNAL_COMMS_POLICY_FILE" ]; then
     permit_with_advisory "$EXTERNAL_COMMS_POLICY_FILE not found — $EXTERNAL_COMMS_SUBAGENT_TYPE gate is advisory-only on $SURFACE."
@@ -537,5 +537,5 @@ VERDICT_PREFIX="${EXTERNAL_COMMS_VERDICT_PREFIX:-EXTERNAL_COMMS_${EXTERNAL_COMMS
 COMPLETION_GUIDANCE='On Codex, the calling agent waits for the reviewer to finish, then invokes `interrupt_agent` exactly once on that completed target before retrying; the PostToolUse compatibility hook consumes the completed response and persists its structured verdict, with no transcript parsing or nested codex exec. On Claude Code, the calling agent dispatches the reviewer synchronously (`run_in_background: false`) before retrying; the completion hook does not persist the marker for a background reviewer.'
 REASON=$(printf 'BLOCKED (external-comms gate / %s evaluator): %s draft has not been reviewed by %s. Delegate to %s (subagent_type: '"'"'%s'"'"') with a prompt that starts with the line `SURFACE: %s` and wraps the draft body verbatim inside `<draft>...</draft>` markers (for the changeset-author surface the body is the changeset summary WITHOUT the leading `---` frontmatter block — the gate strips frontmatter before hashing the marker key). The completion hook marks the draft reviewed when the subagent emits %s_VERDICT: PASS — single fire suffices. %s Use %s for an interactive walkthrough. There is no environment-variable override; `BYPASS_RISK_GATE` is unavailable.' \
     "$EXTERNAL_COMMS_EVALUATOR_ID" "$SURFACE" "$EXTERNAL_COMMS_SUBAGENT_TYPE" "$EXTERNAL_COMMS_SUBAGENT_TYPE" "$EXTERNAL_COMMS_SUBAGENT_TYPE" "$SURFACE" "$VERDICT_PREFIX" "$COMPLETION_GUIDANCE" "$EXTERNAL_COMMS_ASSESS_SKILL")
-deny_with_reason "$REASON"
+permit_with_advisory "Governance evidence unavailable; action permitted. $REASON"
 exit 0

package/hooks/git-push-gate.sh

@@ -30,7 +30,7 @@ _watchers_own_ci_wait() {
 
 if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*(git push|npm run (push:watch|merge:watch|release:watch)|npx changeset|npm run changeset|gh pr merge)(\s|$)'; then
     if ! _enter_hook_cwd; then
-        risk_gate_deny "Pipeline action blocked: the command checkout could not be validated. Run the command from an absolute Git working directory and rescore that checkout."
+        _governance_advisory "Pipeline checkout could not be validated. Run the command from an absolute Git working directory and rescore that checkout."
         exit 0
     fi
 fi
@@ -63,10 +63,9 @@ if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*npm run (push:watch|merge:watch)(
             AGE=$(( NOW - MARK_TIME ))
             TTL_SECONDS="${RISK_TTL:-3600}"
             if [ "$AGE" -lt "$TTL_SECONDS" ] && ! _checkout_matches "${RDIR}/checkout-id"; then
-                risk_gate_deny "Push blocked: this event resolved to a different Git checkout than the valid risk assessment. Retry the same command with an explicit leading \`cd /absolute/path/to/the/assessed-checkout && npm run push:watch\`; the marker was preserved, so do not rescore unless that checkout changed."
-                exit 0
+                _governance_advisory "Push receipt unavailable: this event resolved to a different Git checkout than the valid risk assessment. Retry the same command with an explicit leading \`cd /absolute/path/to/the/assessed-checkout && npm run push:watch\`; the marker was preserved, so do not rescore unless that checkout changed."
             fi
-            if [ "$AGE" -lt "$TTL_SECONDS" ] && [ -f "${RDIR}/state-hash" ]; then
+            if [ "$AGE" -lt "$TTL_SECONDS" ] && _checkout_matches "${RDIR}/checkout-id" && [ -f "${RDIR}/state-hash" ]; then
                 STORED_HASH=$(cat "${RDIR}/state-hash")
                 CURRENT_HASH=$("$SCRIPT_DIR/lib/pipeline-state.sh" --hash-inputs 2>/dev/null | _hashcmd | cut -d' ' -f1)
                 if [ "$STORED_HASH" = "$CURRENT_HASH" ]; then
@@ -151,10 +150,9 @@ if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*npm run release:watch(\s|$)'; the
             AGE=$(( NOW - MARK_TIME ))
             TTL_SECONDS="${RISK_TTL:-3600}"
             if [ "$AGE" -lt "$TTL_SECONDS" ] && ! _checkout_matches "${RDIR}/checkout-id"; then
-                risk_gate_deny "Release blocked: this event resolved to a different Git checkout than the valid risk assessment. Retry the same command with an explicit leading \`cd /absolute/path/to/the/assessed-checkout && npm run release:watch\`; the marker was preserved, so do not rescore unless that checkout changed."
-                exit 0
+                _governance_advisory "Release receipt unavailable: this event resolved to a different Git checkout than the valid risk assessment. Retry the same command with an explicit leading \`cd /absolute/path/to/the/assessed-checkout && npm run release:watch\`; the marker was preserved, so do not rescore unless that checkout changed."
             fi
-            if [ "$AGE" -lt "$TTL_SECONDS" ] && [ -f "${RDIR}/state-hash" ]; then
+            if [ "$AGE" -lt "$TTL_SECONDS" ] && _checkout_matches "${RDIR}/checkout-id" && [ -f "${RDIR}/state-hash" ]; then
                 STORED_HASH=$(cat "${RDIR}/state-hash")
                 CURRENT_HASH=$("$SCRIPT_DIR/lib/pipeline-state.sh" --hash-inputs 2>/dev/null | _hashcmd | cut -d' ' -f1)
                 if [ "$STORED_HASH" = "$CURRENT_HASH" ]; then

package/hooks/lib/gate-helpers.sh

@@ -169,6 +169,9 @@ _HOOK_INPUT=""
 
 _parse_input() {
     _HOOK_INPUT=$(cat)
+    if ! printf '%s' "$_HOOK_INPUT" | python3 -c 'import json,sys; assert isinstance(json.load(sys.stdin),dict)' 2>/dev/null; then
+        _governance_advisory "Hook input could not be parsed."
+    fi
 }
 
 _get_tool_name() {
@@ -381,3 +384,8 @@ _is_doc_file() {
     esac
     return 1
 }
+
+# Mechanical evaluation failures are advisory; never mint approval receipts.
+_governance_advisory() {
+    python3 -c 'import json,sys; print(json.dumps({"systemMessage": "Governance evidence unavailable; action permitted. " + sys.argv[1]}))' "$1" || echo 'Governance evidence unavailable; action permitted.' >&2
+}

package/hooks/lib/risk-gate.sh

@@ -22,7 +22,7 @@ source "$_RISK_GATE_DIR/gate-helpers.sh"
 #                                If the hash drifted, halt as before.
 #   Band C: age ≥ TTL          → halt with the existing expired message.
 # Usage: check_risk_gate "$SESSION_ID" "commit"
-check_risk_gate() {
+_check_risk_receipt() {
   local SESSION_ID="$1"
   local ACTION="$2"
   local RDIR
@@ -193,7 +193,7 @@ print(('yes' if score > N else 'no') + ' ' + str(N))
 #   - conclusion ∈ {success, skipped, neutral} or unknown → allow
 #
 # Usage: check_ci_status "$SESSION_ID" "push"   # or "release"
-check_ci_status() {
+_check_ci_evidence() {
   local SESSION_ID="$1"
   local ACTION="$2"
   local RDIR
@@ -233,7 +233,7 @@ check_ci_status() {
 
   if [ -n "${GH_EXIT:-}" ] && [ "$GH_EXIT" != "0" ]; then
     CI_GATE_CATEGORY="gh-error"
-    CI_GATE_REASON="CI status check failed (gh exit ${GH_EXIT}: auth / timeout / API error). Fail-closed per P208 safe-high-fix-risk. Fix the underlying gh / CI failure before pushing/releasing — there is no override (P377/RFC-029; the ci-bypass marker was removed)."
+    CI_GATE_REASON="CI status unavailable (gh exit ${GH_EXIT}: lookup, auth, timeout or API error). Verify CI through the standard watcher."
     return 1
   fi
 
@@ -269,7 +269,7 @@ except Exception:
 
   if [ "$STATUS" = "PARSE_ERROR" ]; then
     CI_GATE_CATEGORY="gh-error"
-    CI_GATE_REASON="CI status check returned unparseable response. Fail-closed per P208 safe-high-fix-risk. Fix the gh / CI failure before pushing/releasing — there is no override (P377/RFC-029)."
+    CI_GATE_REASON="CI status unavailable: lookup returned an unparseable response. Verify CI through the standard watcher."
     return 1
   fi
 
@@ -312,7 +312,7 @@ except Exception:
   esac
 }
 
-# Emit fail-closed deny JSON for PreToolUse hooks.
+# Emit denial for successfully evaluated substantive failures.
 risk_gate_deny() {
   local REASON="$1"
   cat <<EOF
@@ -325,3 +325,16 @@ risk_gate_deny() {
 }
 EOF
 }
+
+check_risk_gate() {
+    if _check_risk_receipt "$@"; then return 0; fi
+    if [ "$RISK_GATE_CATEGORY" = threshold ]; then return 1; fi
+    _governance_advisory "$RISK_GATE_REASON"
+    return 0
+}
+check_ci_status() {
+    if _check_ci_evidence "$@"; then return 0; fi
+    case "$CI_GATE_CATEGORY" in red|pending) return 1 ;; esac
+    _governance_advisory "CI status unavailable. $CI_GATE_REASON"
+    return 0
+}

package/hooks/risk-policy-enforce-edit.sh

@@ -40,13 +40,5 @@ if [ -f "$MARKER" ]; then
   exit 0
 fi
 
-cat <<'EOF'
-{
-  "hookSpecificOutput": {
-    "hookEventName": "PreToolUse",
-    "permissionDecision": "deny",
-    "permissionDecisionReason": "BLOCKED: Cannot edit RISK-POLICY.md directly. Run /wr-risk-scorer:update-policy first -- it enforces ISO 31000 compliance (reads the risk-scorer contract, discovers project context, checks for incidents, validates with you, and smoke-tests the result). Use the Skill tool with skill: \"wr-risk-scorer:update-policy\"."
-  }
-}
-EOF
+_governance_advisory "Review receipt unavailable; required substantive review remains the agent's responsibility."
 exit 0

package/hooks/risk-score-commit-gate.sh

@@ -16,7 +16,7 @@ TOOL_NAME=$(_get_tool_name)
 COMMAND=$(_get_command)
 echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*git commit' || exit 0
 if ! _enter_hook_cwd; then
-    risk_gate_deny "Commit blocked: the command checkout could not be validated. Run the command from an absolute Git working directory and rescore that checkout."
+    _governance_advisory "Commit checkout could not be validated. Run the command from an absolute Git working directory and rescore that checkout."
     exit 0
 fi
 
@@ -43,8 +43,8 @@ SESSION_ID=$(_get_session_id)
 # contract). Fallback threshold 14 days when the cadence line is absent
 # or the word unrecognised. P408.
 if [ ! -f "RISK-POLICY.md" ] || [ ! -s "RISK-POLICY.md" ]; then
-    risk_gate_deny "Commit blocked: RISK-POLICY.md is missing. Run /risk-policy to create it before committing."
-    exit 0
+    _governance_advisory "Commit blocked: RISK-POLICY.md is missing. Run /risk-policy to create it before committing."
+    # Continue evaluating any applicable known score.
 fi
 POLICY_STALE=$(python3 -c "
 from datetime import date
@@ -74,8 +74,8 @@ except:
     print('no')
 " 2>/dev/null || echo "no")
 if [ "$POLICY_STALE" != "no" ]; then
-    risk_gate_deny "Commit blocked: RISK-POLICY.md is stale (last reviewed ${POLICY_STALE}). Run /risk-policy to update it before committing."
-    exit 0
+    _governance_advisory "Commit blocked: RISK-POLICY.md is stale (last reviewed ${POLICY_STALE}). Run /risk-policy to update it before committing."
+    # Continue evaluating any applicable known score.
 fi
 
 # Clean tree bypass
@@ -97,7 +97,7 @@ if [ -f "${RDIR}/reducing-commit" ]; then
     AGE=$(( NOW - MARK_TIME ))
     TTL_SECONDS="${RISK_TTL:-3600}"
     if [ "$AGE" -lt "$TTL_SECONDS" ] && ! _checkout_matches "${RDIR}/checkout-id"; then
-        risk_gate_deny "Commit blocked: this event resolved to a different Git checkout than the valid risk assessment. Retry the same command with an explicit leading \`cd /absolute/path/to/the/assessed-checkout && git commit ...\`; the marker was preserved, so do not rescore unless that checkout changed."
+        _governance_advisory "Commit blocked: this event resolved to a different Git checkout than the valid risk assessment. Retry the same command with an explicit leading \`cd /absolute/path/to/the/assessed-checkout && git commit ...\`; the marker was preserved, so do not rescore unless that checkout changed."
         exit 0
     fi
     if [ "$AGE" -lt "$TTL_SECONDS" ] && [ -f "${RDIR}/state-hash" ]; then

package/hooks/risk-score-plan-enforce.sh

@@ -19,13 +19,5 @@ if [ -f "$MARKER" ]; then
   exit 0
 fi
 
-cat <<'EOF'
-{
-  "hookSpecificOutput": {
-    "hookEventName": "PreToolUse",
-    "permissionDecision": "deny",
-    "permissionDecisionReason": "BLOCKED: Risk-scorer must review the plan before exiting plan mode. Delegate to wr-risk-scorer:plan (subagent_type: 'wr-risk-scorer:plan') to review the plan file for risk, including projected release risk."
-  }
-}
-EOF
+_governance_advisory "Review receipt unavailable; required substantive review remains the agent's responsibility."
 exit 0

package/hooks/risk-scorer-dispatch.sh

@@ -7,13 +7,34 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 EVENT="${1:-}"
 INPUT="$(cat)"
 
+ADVISORIES=""
+collect_gate_output() {
+  local output="$1" parsed
+  [ -n "$output" ] || return 0
+  if ! parsed="$(printf '%s' "$output" | jq -cs '
+    if any(.[]; .hookSpecificOutput.permissionDecision == "deny")
+    then map(select(.hookSpecificOutput.permissionDecision == "deny"))[0]
+    else {systemMessage: map(.systemMessage // .hookSpecificOutput.permissionDecisionReason // "Governance evidence unavailable; action permitted.") | join("\n")} end' 2>/dev/null)"; then
+    parsed='{"systemMessage":"Governance evidence unavailable: malformed evaluator output; action permitted."}'
+  fi
+  if printf '%s' "$parsed" | jq -e '.hookSpecificOutput.permissionDecision == "deny"' >/dev/null 2>&1; then
+    printf '%s\n' "$parsed"
+    exit 0
+  fi
+  ADVISORIES="$ADVISORIES
+$parsed"
+}
+flush_advisories() {
+  [ -n "$ADVISORIES" ] || return 0
+  printf '%s' "$ADVISORIES" | jq -s '{systemMessage: map(.systemMessage // .hookSpecificOutput.permissionDecisionReason // "Governance evidence unavailable; action permitted.") | join("\n")}'
+}
 run_hook() {
   local output
-  output="$(printf '%s' "$INPUT" | "$SCRIPT_DIR/$1")"
-  if [ -n "$output" ]; then
-    printf '%s\n' "$output"
-    exit 0
+  if ! output="$(printf '%s' "$INPUT" | "$SCRIPT_DIR/$1" 2>/dev/null)"; then
+    collect_gate_output '{"systemMessage":"Governance evaluator unavailable; action permitted. A crashed hook output was discarded."}'
+    return 0
   fi
+  collect_gate_output "$output"
 }
 
 tool_name() {
@@ -108,3 +129,5 @@ if messages:
     exit 0
     ;;
 esac
+
+flush_advisories

package/hooks/wip-risk-gate.sh

@@ -32,13 +32,5 @@ if [ -f "$MARKER" ]; then
     exit 0
 fi
 
-cat <<'EOF'
-{
-  "hookSpecificOutput": {
-    "hookEventName": "PreToolUse",
-    "permissionDecision": "deny",
-    "permissionDecisionReason": "WIP risk assessment required. Delegate to wr-risk-scorer:wip (subagent_type: 'wr-risk-scorer:wip') to assess cumulative pipeline risk for changes so far."
-  }
-}
-EOF
+_governance_advisory "Review receipt unavailable; required substantive review remains the agent's responsibility."
 exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.19.16",
+  "version": "0.20.0",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "scripts": {
     "prepack": "node scripts/sync-codex-skills.mjs --pack",