@yunhozz/arc 0.1.1 → 0.1.3

package/claude/skill/hooks/role-git-guard.mjs

@@ -1,89 +1,9 @@
 import fs from 'node:fs';
 import {pathToFileURL} from 'node:url';
 
-const deny = reason => ({allowed:false,reason});
-const isGit = word => /(?:^|[\\/])git(?:\.exe)?$/i.test(word);
-export function validateGitPolicy(policy) {
-  if (!policy || policy.schemaVersion !== 1 || !Array.isArray(policy.globalValueOptions) || !Array.isArray(policy.globalFlags) || !policy.commands || typeof policy.commands !== 'object' || Array.isArray(policy.commands)) throw Error('Invalid Git policy');
-  const strings = list => Array.isArray(list) && list.every(x=>typeof x === 'string' && x.startsWith('-'));
-  if (!strings(policy.globalValueOptions) || !strings(policy.globalFlags) || !Object.keys(policy.commands).length) throw Error('Invalid Git policy');
-  for (const rule of Object.values(policy.commands)) if (!rule || !strings(rule.flags) || !strings(rule.values) || !['any','none','query','list'].includes(rule.positionals)) throw Error('Invalid Git command policy');
-  return policy;
-}
-// This deliberately supports a small shell grammar, rather than executing a shell.
-function tokenize(command) {
-  const tokens=[]; let word='', started=false, quote=null;
-  for(let i=0;i<command.length;i++) {
-    const char=command[i];
-    if(char==='\\' && /[\r\n]/.test(command[i+1]??'')) throw Error('Escaped line terminator');
-    if(quote) {
-      if(char===quote){quote=null;continue;}
-      if(quote==='"' && /[$`]/.test(char)) throw Error('Dynamic shell syntax');
-      // Preserve Windows paths in quoted executable names.
-      if(char==='\\' && quote==='"' && /["\\$`]/.test(command[i+1]??'')){word+=command[++i];continue;}
-      word+=char;continue;
-    }
-    if(char==='"'||char==="'"){quote=char;started=true;continue;}
-    if(/[\r\n\x00<>`$(){}&]/.test(char) && !(char==='&'&&command[i+1]==='&')) throw Error('Unsupported shell syntax');
-    if(char===';'||char==='|'||char==='&') {
-      if(started){tokens.push(word);word='';started=false;}
-      const operator=command.slice(i,i+2); if(operator==='&&'||operator==='||')i++;
-      tokens.push({operator:operator==='&&'||operator==='||'?operator:char});continue;
-    }
-    if(/\s/.test(char)){if(started){tokens.push(word);word='';started=false;}continue;}
-    if(char==='\\') {if(i+1>=command.length)throw Error('Incomplete escape'); word+=command[++i];started=true;continue;}
-    if(char==='#')throw Error('Unsupported shell comment');
-    word+=char;started=true;
-  }
-  if(quote)throw Error('Unclosed quote'); if(started)tokens.push(word);return tokens;
-}
-function classifyWords(words,policy,depth) {
-  if(!words.length)return deny('Empty shell segment');
-  const executable=words[0].split(/[\\/]/).at(-1).toLowerCase();
-  if(['sh','bash','sh.exe','bash.exe'].includes(executable)) {
-    if(depth>=4 || words.length!==3 || words[1]!=='-c')return deny('Unsupported shell wrapper');
-    return classifyGitCommand(words[2],policy,depth+1);
-  }
-  if(!isGit(words[0]))return words.some(isGit)?deny('Unsupported indirect Git invocation'):{allowed:true};
-  let i=1;
-  while(i<words.length && words[i].startsWith('-')) {
-    const option=words[i++],equal=option.indexOf('='),key=equal<0?option:option.slice(0,equal);
-    if(policy.globalFlags.includes(option))continue;
-    if(!policy.globalValueOptions.includes(key))return deny('Unknown Git global option');
-    if(equal<0 && (i>=words.length || words[i++].startsWith('-')))return deny('Missing Git option value');
-    if(equal>=0 && !option.slice(equal+1))return deny('Missing Git option value');
-  }
-  const combined=`${words[i]} ${words[i+1]}`;
-  const name=Object.hasOwn(policy.commands,combined)?(i+=2,combined):words[i++];
-  const rule=Object.hasOwn(policy.commands,name)?policy.commands[name]:null; if(!rule)return deny('Git mutation or unknown subcommand');
-  let positions=0,query=false,list=false,paths=false;
-  for(;i<words.length;i++) {
-    const arg=words[i];
-    if(arg==='--' && rule.positionals==='any'){paths=true;continue;}
-    if(!paths && arg.startsWith('-')) {
-      if(/^-[0-9]+$/.test(arg)&&rule.flags.includes('-<count>'))continue;
-      const equal=arg.indexOf('='),key=equal<0?arg:arg.slice(0,equal);
-      if(rule.values.includes(key)) {if(equal<0 && (i+1>=words.length||words[++i].startsWith('-')))return deny('Missing query option value'); if(equal>=0&&!arg.slice(equal+1))return deny('Missing query option value');continue;}
-      if(!rule.flags.includes(arg))return deny('Unknown or mutating Git option');
-      if(['--get','--get-all','--get-regexp','--list','-l'].includes(arg))query=true;
-      if(['--list','-l','--show-current'].includes(arg))list=true;
-    } else positions++;
-  }
-  if(rule.positionals==='none'&&positions || rule.positionals==='query'&&(!query||positions>1) || rule.positionals==='list'&&positions&&!list)return deny('Git write or unsupported arguments');
-  return {allowed:true};
-}
-export function classifyGitCommand(command,policy,depth=0) {
-  try {
-    validateGitPolicy(policy);
-    if(typeof command!=='string'||!command.trim())return deny('Missing shell command');
-    const tokens=tokenize(command); let words=[];
-    for(const token of [...tokens,{operator:'end'}]) {
-      if(typeof token==='string'){words.push(token);continue;}
-      const result=classifyWords(words,policy,depth);if(!result.allowed)return result;words=[];
-    }
-    return {allowed:true};
-  } catch {return deny('Invalid policy or unsupported command syntax');}
-}
+import {validateGitPolicy,classifyGitCommand} from '../runtime/git-query.mjs';
+export {validateGitPolicy,classifyGitCommand};
+const deny=reason=>({allowed:false,reason});
 export function evaluateHookEvent(event,policy) {
   const result=event?.hook_event_name!=='PreToolUse' ? deny('Invalid hook event') : event?.tool_name!=='Bash' ? deny('Missing Bash event') : classifyGitCommand(event?.tool_input?.command,policy);
   return result.allowed?{}:{hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision:'deny',permissionDecisionReason:`ARC specialist Git guard: ${result.reason}. Return the operation to Orchestrator.`}};

package/claude/skill/hooks/runtime-gate.mjs

@@ -0,0 +1,12 @@
+import {runClaudeGate,renderClaudeDecision} from '../runtime/adapters/claude.mjs';
+/** Native installation must provide trusted context separately; stdin is only
+ * the platform event. Missing provider denies and never trusts event assertions. */
+export async function main(input,context){
+ try{return await runClaudeGate(JSON.parse(input),context);}catch{return renderClaudeDecision({decision:'deny',reason:'Malformed runtime hook event'});}
+}
+export async function runHook(){
+ let input='';for await(const chunk of process.stdin)input+=chunk;
+ process.stdout.write(JSON.stringify(await main(input))+'\n');
+}
+
+if(process.argv[1]&&import.meta.url===new URL(process.argv[1], 'file:').href)await runHook();

package/claude/skill/models.toml

@@ -1,5 +1,5 @@
-# Single source for all role model and effort presets.
-# Use configured settings without substitution; report unavailable settings.
+# Canonical source for every role model and effort preset.
+# Use configured settings as specified. Report unavailable settings.
 version = 1
 preset = "balanced"
 
@@ -8,12 +8,12 @@ model = "haiku"
 effort = "high"
 
 [roles.arc_scouter.balanced]
-model = "sonnet"
-effort = "medium"
+model = "haiku"
+effort = "high"
 
 [roles.arc_scouter.smart]
-model = "sonnet"
-effort = "high"
+model = "haiku"
+effort = "max"
 
 [roles.arc_planner.economy]
 model = "sonnet"
@@ -29,11 +29,11 @@ effort = "high"
 
 [roles.arc_coder.economy]
 model = "sonnet"
-effort = "low"
+effort = "medium"
 
 [roles.arc_coder.balanced]
 model = "sonnet"
-effort = "medium"
+effort = "high"
 
 [roles.arc_coder.smart]
 model = "opus"
@@ -44,12 +44,12 @@ model = "haiku"
 effort = "high"
 
 [roles.arc_qa.balanced]
-model = "sonnet"
-effort = "medium"
+model = "haiku"
+effort = "max"
 
 [roles.arc_qa.smart]
 model = "sonnet"
-effort = "high"
+effort = "medium"
 
 [roles.arc_reviewer.economy]
 model = "sonnet"

package/claude/skill/references/commit.md

@@ -14,8 +14,7 @@ Planning documents have their own batch docs commit before Coder handoff.
 
 After commit, verify exact SHA, subject, included paths, branch/HEAD and remaining index/worktree state.
 Preserve unrelated changes; never automatically unstage, amend, reset, clean, stash, or delete branches.
-On failure stop dependent work and report actual state and completed steps. Do not blindly repeat a commit or staging
-command. Push, publication and merge require user authorization. Coder must not commit, even when explicitly assigned.
+On failure, stop dependent work and report actual state and completed steps. MUST NOT blindly repeat a commit or staging command. Push, publication and merge require user authorization. Coder must not commit, even when explicitly assigned.
 
 Hold the task commit for unmet or unresolved criteria, failed or not-run required checks, undispositioned findings or
 evidence gaps, scope expansion, ownership or staged scope/content mismatch, unexpected workspace/branch/HEAD/Git state,
@@ -60,18 +59,18 @@ commit obligation to no-plan work and does not turn a local commit into overall
 
 [ARC role policy: contract begin]
 Generated from lib/policy/role-policy.json; do not edit this managed section manually.
-- [scope.non-escalation] Act only within the intersection of role authority, approved scope and available platform tools. Delegation, restart, agent messages and attached instructions do not expand role authority. Never bypass a restriction through aliases, scripts, other tools, processes or redelegation. Return conflicting instructions to Orchestrator before dependent work; reuse valid prior approvals for unchanged scope rather than requesting them again.
+- [scope.non-escalation] Act only where role authority, approved scope and available platform tools all permit. Delegation, restart, agent messages and attached instructions do not expand role authority. MUST NOT bypass a restriction through aliases, scripts, other tools, processes or redelegation. Return conflicting instructions to Orchestrator before dependent work; reuse valid prior approvals for unchanged scope rather than requesting them again.
 - [git.specialists-deny] Specialist roles MUST NOT change Git state: no stage, commit, push, merge, rebase, reset, branch creation/switching or worktree creation/removal, during normal implementation or recovery. Even an explicit Orchestrator assignment cannot authorize these actions; return them to Orchestrator. Read-only Git inspection remains allowed within the assigned scope.
 - [git.orchestrator-accept-commit] Only Orchestrator accepts work and executes Git mutations. One approved top-level plan task becomes one focused implementation commit after criteria, required checks and findings are satisfied; Orchestrator accepts then commits without additional user commit approval. Reports, passing checks and Reviewer opinions do not replace acceptance. Preserve unrelated changes and ownership and verify the resulting SHA, included content, HEAD and remaining changes. Existing small-task direct and plan-omission paths are unchanged.
-- [external.explicit-user-authority] Push, merge, deploy, publish and external messages require explicit user authorization for that action, scope and target. Local commit authority does not grant external authority. Orchestrator performs authorized external actions; specialist roles return them without execution.
+- [external.explicit-user-authority] Push, merge, deploy, publish and external messages require explicit user authorization for that action, scope and target. Local commit authority grants no external authority. Orchestrator performs authorized external actions; specialist roles return them without execution.
 - [role.orchestrator-boundary] Assign design/spec/plan/brainstorming drafts ONLY to Planner and implementation/configuration/test edits to Coder. Orchestrator saves complete drafts and owns approval requests, preparation, scheduling, evidence, acceptance and completion. Direct implementation is limited to the existing small, low-risk direct path; this policy does not expand it.
 - [role.scouter-read-only] Research assigned static sources and report findings, evidence and limits. Do not edit files, install, execute checks, prepare execution targets, inspect live operational state, change external state or decide design, verification, review or acceptance.
-- [role.planner-draft-only] Return design/spec/plan drafts and dependencies, criteria, hold conditions and verification needs in the response. Do not save documents, implement, run checks, prepare targets, request user approval or decide acceptance. Stop formal target-dependent drafting if actual prepared target evidence is missing; route decisions to Orchestrator.
-- [role.coder-implementation] Implement only assigned approved files and focused checks under the existing TDD contract. Report changed files, RED/GREEN or authorized exception evidence, results, limits and follow-up. Do not plan, independently QA/review your own work, accept the task or declare overall completion. Git changes remain forbidden even when implementation succeeds.
+- [role.planner-draft-only] Return design/spec/plan drafts and dependencies, criteria, hold conditions and verification needs in the response. MUST NOT save documents, implement, run checks, prepare targets, request user approval or decide acceptance. Stop formal target-dependent drafting if actual prepared target evidence is missing; route decisions to Orchestrator.
+- [role.coder-implementation] Edit only assigned, approved files and run focused checks under the existing TDD contract. Report changed files, RED/GREEN or authorized exception evidence, results, limits and follow-up. Do not plan, independently QA/review your own work, accept the task or declare overall completion. Git changes remain forbidden even when implementation succeeds.
 - [role.qa-verification] Run approved checks and report commands, observations, reproduction, evidence and limits. Create only essential temporary data/logs/reports in the brief-authorized location and lifetime. Do not edit product source, tests, fixtures or configuration to pass checks, deploy or accept work. Persistent product-state checks require explicit scope and cleanup ownership. Return failures for Coder correction and required QA recheck.
-- [role.reviewer-independent] Independently inspect the assigned final changes and evidence and report actionable findings and limits. Remain read-only; do not execute QA tests, edit files, perform Git mutations or decide acceptance.
-- [review.significant-no-plan] For significant/high-risk work without a plan: Coder → QA and required QA rechecks → Reviewer of the final full change → Orchestrator acceptance. Do not omit Reviewer merely because no plan exists. This creates no new plan obligation.
+- [role.reviewer-independent] Independently inspect the assigned final changes and evidence and report actionable findings and limits. Remain read-only. MUST NOT execute QA tests, edit files, perform Git mutations or decide acceptance.
+- [review.significant-no-plan] For significant/high-risk work without a plan: Coder → QA and required QA rechecks → Reviewer of the final full change → Orchestrator acceptance. MUST NOT omit Reviewer merely because no plan exists. This creates no new plan obligation.
 - [review.significant-plan] For significant/high-risk plan work: each task uses Coder → fresh QA as required → Orchestrator acceptance and focused commit. After all tasks are accepted and required QA is complete, Reviewer reviews the final full change once. Reviewer is NOT a per-task or per-commit required gate. Preserve required checks and necessary finding rechecks.
-- [review.final-plan-recheck] For final overall Reviewer findings on plan work, including behavior findings, use Coder → Reviewer without QA reassignment; repeat until resolved. This exception applies only to that final plan stage. Preserve required QA and QA failure rechecks before initial final review and outside this exception.
+- [review.final-plan-recheck] For final overall Reviewer findings on plan work, including behavior findings, use Coder → Reviewer without QA reassignment; repeat until resolved. This exception applies only at the final plan stage. Preserve required QA and QA failure rechecks before initial final review and outside this exception.
 - [platform.claude] Existing per-role tool allowlists reduce available tools; Bash and role contracts are not a filesystem sandbox. A role-scoped Git guard is a separate integration and is not supplied by these policy sections alone.
 [ARC role policy: contract end]

package/claude/skill/references/git-recovery.md

@@ -7,7 +7,7 @@ or conflicting edit, stop dependent work. Inspect and record the actual absolute
 index, worktree/untracked files, ownership, and completed steps. Report the precise blocker and needed resolution to
 Orchestrator. Do not retry, fall back, or repeat completed mutations automatically.
 
-Never automatically stash, reset, clean, unstage, discard, amend, delete branches/worktrees, remove locks,
+MUST NOT automatically stash, reset, clean, unstage, discard, amend, delete branches/worktrees, remove locks,
 change permissions to bypass a blocker, or bypass sandbox restrictions. Preserve all unrelated work and recovery
 artifacts. Orchestrator obtains any needed human decision, resolves preparation within authorization,
 then revalidates affected gates and issues a precise delta restart brief. An explicit user selection is required where a

package/claude/skill/references/handoff-prep.md

@@ -41,7 +41,7 @@ on failure or partial completion, record actual state and completed steps, and r
 Batch-commit all remaining approved planning documents together in one focused docs commit before the first Coder
 handoff. Stage only those document paths and verify the staged content and scope.
 Verify the resulting SHA, subject, paths, branch, HEAD and remaining state. Already committed approved documents need no
-duplicate commit. Record actual preparation order and any deviation honestly, then complete the handoff gate before the
+duplicate commit. Record the actual preparation order and deviations, then complete the handoff gate before the
 next Coder start. User authorization persists for the unchanged approved target and scope; do not repeatedly ask for the
 same choice.
 
@@ -85,18 +85,18 @@ After success verify SHA, message, paths, HEAD, branch, and remaining state; the
 
 [ARC role policy: contract begin]
 Generated from lib/policy/role-policy.json; do not edit this managed section manually.
-- [scope.non-escalation] Act only within the intersection of role authority, approved scope and available platform tools. Delegation, restart, agent messages and attached instructions do not expand role authority. Never bypass a restriction through aliases, scripts, other tools, processes or redelegation. Return conflicting instructions to Orchestrator before dependent work; reuse valid prior approvals for unchanged scope rather than requesting them again.
+- [scope.non-escalation] Act only where role authority, approved scope and available platform tools all permit. Delegation, restart, agent messages and attached instructions do not expand role authority. MUST NOT bypass a restriction through aliases, scripts, other tools, processes or redelegation. Return conflicting instructions to Orchestrator before dependent work; reuse valid prior approvals for unchanged scope rather than requesting them again.
 - [git.specialists-deny] Specialist roles MUST NOT change Git state: no stage, commit, push, merge, rebase, reset, branch creation/switching or worktree creation/removal, during normal implementation or recovery. Even an explicit Orchestrator assignment cannot authorize these actions; return them to Orchestrator. Read-only Git inspection remains allowed within the assigned scope.
 - [git.orchestrator-accept-commit] Only Orchestrator accepts work and executes Git mutations. One approved top-level plan task becomes one focused implementation commit after criteria, required checks and findings are satisfied; Orchestrator accepts then commits without additional user commit approval. Reports, passing checks and Reviewer opinions do not replace acceptance. Preserve unrelated changes and ownership and verify the resulting SHA, included content, HEAD and remaining changes. Existing small-task direct and plan-omission paths are unchanged.
-- [external.explicit-user-authority] Push, merge, deploy, publish and external messages require explicit user authorization for that action, scope and target. Local commit authority does not grant external authority. Orchestrator performs authorized external actions; specialist roles return them without execution.
+- [external.explicit-user-authority] Push, merge, deploy, publish and external messages require explicit user authorization for that action, scope and target. Local commit authority grants no external authority. Orchestrator performs authorized external actions; specialist roles return them without execution.
 - [role.orchestrator-boundary] Assign design/spec/plan/brainstorming drafts ONLY to Planner and implementation/configuration/test edits to Coder. Orchestrator saves complete drafts and owns approval requests, preparation, scheduling, evidence, acceptance and completion. Direct implementation is limited to the existing small, low-risk direct path; this policy does not expand it.
 - [role.scouter-read-only] Research assigned static sources and report findings, evidence and limits. Do not edit files, install, execute checks, prepare execution targets, inspect live operational state, change external state or decide design, verification, review or acceptance.
-- [role.planner-draft-only] Return design/spec/plan drafts and dependencies, criteria, hold conditions and verification needs in the response. Do not save documents, implement, run checks, prepare targets, request user approval or decide acceptance. Stop formal target-dependent drafting if actual prepared target evidence is missing; route decisions to Orchestrator.
-- [role.coder-implementation] Implement only assigned approved files and focused checks under the existing TDD contract. Report changed files, RED/GREEN or authorized exception evidence, results, limits and follow-up. Do not plan, independently QA/review your own work, accept the task or declare overall completion. Git changes remain forbidden even when implementation succeeds.
+- [role.planner-draft-only] Return design/spec/plan drafts and dependencies, criteria, hold conditions and verification needs in the response. MUST NOT save documents, implement, run checks, prepare targets, request user approval or decide acceptance. Stop formal target-dependent drafting if actual prepared target evidence is missing; route decisions to Orchestrator.
+- [role.coder-implementation] Edit only assigned, approved files and run focused checks under the existing TDD contract. Report changed files, RED/GREEN or authorized exception evidence, results, limits and follow-up. Do not plan, independently QA/review your own work, accept the task or declare overall completion. Git changes remain forbidden even when implementation succeeds.
 - [role.qa-verification] Run approved checks and report commands, observations, reproduction, evidence and limits. Create only essential temporary data/logs/reports in the brief-authorized location and lifetime. Do not edit product source, tests, fixtures or configuration to pass checks, deploy or accept work. Persistent product-state checks require explicit scope and cleanup ownership. Return failures for Coder correction and required QA recheck.
-- [role.reviewer-independent] Independently inspect the assigned final changes and evidence and report actionable findings and limits. Remain read-only; do not execute QA tests, edit files, perform Git mutations or decide acceptance.
-- [review.significant-no-plan] For significant/high-risk work without a plan: Coder → QA and required QA rechecks → Reviewer of the final full change → Orchestrator acceptance. Do not omit Reviewer merely because no plan exists. This creates no new plan obligation.
+- [role.reviewer-independent] Independently inspect the assigned final changes and evidence and report actionable findings and limits. Remain read-only. MUST NOT execute QA tests, edit files, perform Git mutations or decide acceptance.
+- [review.significant-no-plan] For significant/high-risk work without a plan: Coder → QA and required QA rechecks → Reviewer of the final full change → Orchestrator acceptance. MUST NOT omit Reviewer merely because no plan exists. This creates no new plan obligation.
 - [review.significant-plan] For significant/high-risk plan work: each task uses Coder → fresh QA as required → Orchestrator acceptance and focused commit. After all tasks are accepted and required QA is complete, Reviewer reviews the final full change once. Reviewer is NOT a per-task or per-commit required gate. Preserve required checks and necessary finding rechecks.
-- [review.final-plan-recheck] For final overall Reviewer findings on plan work, including behavior findings, use Coder → Reviewer without QA reassignment; repeat until resolved. This exception applies only to that final plan stage. Preserve required QA and QA failure rechecks before initial final review and outside this exception.
+- [review.final-plan-recheck] For final overall Reviewer findings on plan work, including behavior findings, use Coder → Reviewer without QA reassignment; repeat until resolved. This exception applies only at the final plan stage. Preserve required QA and QA failure rechecks before initial final review and outside this exception.
 - [platform.claude] Existing per-role tool allowlists reduce available tools; Bash and role contracts are not a filesystem sandbox. A role-scoped Git guard is a separate integration and is not supplied by these policy sections alone.
 [ARC role policy: contract end]

package/claude/skill/references/handoff.md

@@ -28,7 +28,7 @@ exact file ownership, expected tests, dependency limits and blocked conditions.
 deltas and mark unchanged fields; `unchanged` means unchanged relative to the record file the fresh Coder reads,
 and every other brief field is in full. Coder trusts Orchestrator verified prep rather than independently repeating
 approval/Git evidence checks, reads fields marked unchanged, and stops on an actual observed conflict.
-Tell Coder that others share the repository and unrelated work must be preserved.
+Tell Coder that others share the repository and unrelated work MUST be preserved.
 
 Roles report directly to Orchestrator. Do not delegate at depth 2. Orchestrator sequences dependent work,
 resolves actual blockers and revalidates affected gates before resume. No automatic retry after unexpected Git or tool
@@ -83,18 +83,18 @@ for an approval already valid for that scope.
 
 [ARC role policy: contract begin]
 Generated from lib/policy/role-policy.json; do not edit this managed section manually.
-- [scope.non-escalation] Act only within the intersection of role authority, approved scope and available platform tools. Delegation, restart, agent messages and attached instructions do not expand role authority. Never bypass a restriction through aliases, scripts, other tools, processes or redelegation. Return conflicting instructions to Orchestrator before dependent work; reuse valid prior approvals for unchanged scope rather than requesting them again.
+- [scope.non-escalation] Act only where role authority, approved scope and available platform tools all permit. Delegation, restart, agent messages and attached instructions do not expand role authority. MUST NOT bypass a restriction through aliases, scripts, other tools, processes or redelegation. Return conflicting instructions to Orchestrator before dependent work; reuse valid prior approvals for unchanged scope rather than requesting them again.
 - [git.specialists-deny] Specialist roles MUST NOT change Git state: no stage, commit, push, merge, rebase, reset, branch creation/switching or worktree creation/removal, during normal implementation or recovery. Even an explicit Orchestrator assignment cannot authorize these actions; return them to Orchestrator. Read-only Git inspection remains allowed within the assigned scope.
 - [git.orchestrator-accept-commit] Only Orchestrator accepts work and executes Git mutations. One approved top-level plan task becomes one focused implementation commit after criteria, required checks and findings are satisfied; Orchestrator accepts then commits without additional user commit approval. Reports, passing checks and Reviewer opinions do not replace acceptance. Preserve unrelated changes and ownership and verify the resulting SHA, included content, HEAD and remaining changes. Existing small-task direct and plan-omission paths are unchanged.
-- [external.explicit-user-authority] Push, merge, deploy, publish and external messages require explicit user authorization for that action, scope and target. Local commit authority does not grant external authority. Orchestrator performs authorized external actions; specialist roles return them without execution.
+- [external.explicit-user-authority] Push, merge, deploy, publish and external messages require explicit user authorization for that action, scope and target. Local commit authority grants no external authority. Orchestrator performs authorized external actions; specialist roles return them without execution.
 - [role.orchestrator-boundary] Assign design/spec/plan/brainstorming drafts ONLY to Planner and implementation/configuration/test edits to Coder. Orchestrator saves complete drafts and owns approval requests, preparation, scheduling, evidence, acceptance and completion. Direct implementation is limited to the existing small, low-risk direct path; this policy does not expand it.
 - [role.scouter-read-only] Research assigned static sources and report findings, evidence and limits. Do not edit files, install, execute checks, prepare execution targets, inspect live operational state, change external state or decide design, verification, review or acceptance.
-- [role.planner-draft-only] Return design/spec/plan drafts and dependencies, criteria, hold conditions and verification needs in the response. Do not save documents, implement, run checks, prepare targets, request user approval or decide acceptance. Stop formal target-dependent drafting if actual prepared target evidence is missing; route decisions to Orchestrator.
-- [role.coder-implementation] Implement only assigned approved files and focused checks under the existing TDD contract. Report changed files, RED/GREEN or authorized exception evidence, results, limits and follow-up. Do not plan, independently QA/review your own work, accept the task or declare overall completion. Git changes remain forbidden even when implementation succeeds.
+- [role.planner-draft-only] Return design/spec/plan drafts and dependencies, criteria, hold conditions and verification needs in the response. MUST NOT save documents, implement, run checks, prepare targets, request user approval or decide acceptance. Stop formal target-dependent drafting if actual prepared target evidence is missing; route decisions to Orchestrator.
+- [role.coder-implementation] Edit only assigned, approved files and run focused checks under the existing TDD contract. Report changed files, RED/GREEN or authorized exception evidence, results, limits and follow-up. Do not plan, independently QA/review your own work, accept the task or declare overall completion. Git changes remain forbidden even when implementation succeeds.
 - [role.qa-verification] Run approved checks and report commands, observations, reproduction, evidence and limits. Create only essential temporary data/logs/reports in the brief-authorized location and lifetime. Do not edit product source, tests, fixtures or configuration to pass checks, deploy or accept work. Persistent product-state checks require explicit scope and cleanup ownership. Return failures for Coder correction and required QA recheck.
-- [role.reviewer-independent] Independently inspect the assigned final changes and evidence and report actionable findings and limits. Remain read-only; do not execute QA tests, edit files, perform Git mutations or decide acceptance.
-- [review.significant-no-plan] For significant/high-risk work without a plan: Coder → QA and required QA rechecks → Reviewer of the final full change → Orchestrator acceptance. Do not omit Reviewer merely because no plan exists. This creates no new plan obligation.
+- [role.reviewer-independent] Independently inspect the assigned final changes and evidence and report actionable findings and limits. Remain read-only. MUST NOT execute QA tests, edit files, perform Git mutations or decide acceptance.
+- [review.significant-no-plan] For significant/high-risk work without a plan: Coder → QA and required QA rechecks → Reviewer of the final full change → Orchestrator acceptance. MUST NOT omit Reviewer merely because no plan exists. This creates no new plan obligation.
 - [review.significant-plan] For significant/high-risk plan work: each task uses Coder → fresh QA as required → Orchestrator acceptance and focused commit. After all tasks are accepted and required QA is complete, Reviewer reviews the final full change once. Reviewer is NOT a per-task or per-commit required gate. Preserve required checks and necessary finding rechecks.
-- [review.final-plan-recheck] For final overall Reviewer findings on plan work, including behavior findings, use Coder → Reviewer without QA reassignment; repeat until resolved. This exception applies only to that final plan stage. Preserve required QA and QA failure rechecks before initial final review and outside this exception.
+- [review.final-plan-recheck] For final overall Reviewer findings on plan work, including behavior findings, use Coder → Reviewer without QA reassignment; repeat until resolved. This exception applies only at the final plan stage. Preserve required QA and QA failure rechecks before initial final review and outside this exception.
 - [platform.claude] Existing per-role tool allowlists reduce available tools; Bash and role contracts are not a filesystem sandbox. A role-scoped Git guard is a separate integration and is not supplied by these policy sections alone.
 [ARC role policy: contract end]

package/claude/skill/references/limits.md

@@ -4,7 +4,7 @@ Before the first subagent creation, Orchestrator reads this reference and the ad
 `../limits.toml` (installed at `skills/arc/limits.toml`). Require version = 1,
 `max_total_subagents` and `max_concurrent_subagents` as positive safe integers.
 Installation defaults are max_total_subagents = 100 and max_concurrent_subagents = 5.
-A missing, malformed or unreadable policy blocks new creation; report it rather than assuming defaults.
+A missing, malformed or unreadable policy blocks new creation. Report it; MUST NOT assume defaults.
 Freeze these settings for one ARC coordination session/tree; reinstalling affects new sessions.
 
 ## Counting and reservations
@@ -23,7 +23,7 @@ created + pending reservations + proposed <= max_total_subagents, and
 active + pending reservations + proposed <= max_concurrent_subagents and available runtime capacity.
 Record a reservation before each creation call. Confirmed creation converts it into a created,
 active ID. Release a reservation only when failure proves that no instance was created.
-An uncertain result keeps its reservation and capacity until reconciled; never retry blindly.
+An uncertain result retains its reservation and capacity until reconciled. MUST NOT retry blindly.
 Serialize work when a batch does not fit. There are no reserved role slots.
 
 ## Continuation and exhaustion
@@ -31,8 +31,8 @@ Serialize work when a batch does not fit. There are no reserved role slots.
 Preserve the ledger through continuation, resume and context compaction; reconcile actual instance
 IDs before dispatch. Ledger loss must never reset counters to zero. If reconstruction is incomplete,
 hold creation and report the unknown budget; use a conservative bound only with sufficient evidence.
-Completion frees confirmed active capacity, never the total-created budget. Exhaustion holds new
-creation and requires reporting remaining work and budgets. It never authorizes skipping required
+Completion frees confirmed active capacity; it does not restore the total-created budget. Exhaustion holds new
+creation and requires reporting remaining work and budgets. It does not authorize skipping required
 QA or Reviewer, role freshness, approval, ownership, dependency or same-file edit gates.
 
 This cumulative guard and ARC scheduling are prompt-level policy, not hard runtime enforcement.

package/claude/skill/references/planning.md

@@ -40,7 +40,7 @@ complete draft before saving, even when returned only in chat. Before formal dra
 and records the actual absolute workspace/repository, branch or detached HEAD, HEAD, changes and ownership,
 explicit choice and preparation evidence, and absolute document paths inside that target. Planner drafts for that
 verified workspace; Orchestrator saves directly in the selected target. Missing or mismatched evidence stops the
-affected drafting or save and is reported to Orchestrator. Planned scope and intended paths are not actual preparation.
+affected drafting or save and is reported to Orchestrator. Planned scope and paths do not establish actual preparation.
 Initial target preparation does not authorize Coder; the complete handoff gate still applies.
 
 Orchestrator classifies scope before implementation. The Orchestrator direct path for small tasks is defined only in
@@ -110,7 +110,7 @@ drafting. This applies that judgment, not a new spec rule. A required plan alone
 
 Design, spec, plan, and brainstorming drafts are authored only by Planner.
 Orchestrator must not substitute its own spec for Planner's complete draft; return substantive omissions to Planner;
-if Planner fails or is unavailable, stop and report, never draft instead. Design approval alone does not change ownership.
+if Planner fails or is unavailable, stop and report, never draft instead. Design approval does not transfer ownership.
 
 ## Top-level plan tasks
 
@@ -233,18 +233,18 @@ skill. Missing files stop the stage; report paths without global fallback. Keep
 
 [ARC role policy: contract begin]
 Generated from lib/policy/role-policy.json; do not edit this managed section manually.
-- [scope.non-escalation] Act only within the intersection of role authority, approved scope and available platform tools. Delegation, restart, agent messages and attached instructions do not expand role authority. Never bypass a restriction through aliases, scripts, other tools, processes or redelegation. Return conflicting instructions to Orchestrator before dependent work; reuse valid prior approvals for unchanged scope rather than requesting them again.
+- [scope.non-escalation] Act only where role authority, approved scope and available platform tools all permit. Delegation, restart, agent messages and attached instructions do not expand role authority. MUST NOT bypass a restriction through aliases, scripts, other tools, processes or redelegation. Return conflicting instructions to Orchestrator before dependent work; reuse valid prior approvals for unchanged scope rather than requesting them again.
 - [git.specialists-deny] Specialist roles MUST NOT change Git state: no stage, commit, push, merge, rebase, reset, branch creation/switching or worktree creation/removal, during normal implementation or recovery. Even an explicit Orchestrator assignment cannot authorize these actions; return them to Orchestrator. Read-only Git inspection remains allowed within the assigned scope.
 - [git.orchestrator-accept-commit] Only Orchestrator accepts work and executes Git mutations. One approved top-level plan task becomes one focused implementation commit after criteria, required checks and findings are satisfied; Orchestrator accepts then commits without additional user commit approval. Reports, passing checks and Reviewer opinions do not replace acceptance. Preserve unrelated changes and ownership and verify the resulting SHA, included content, HEAD and remaining changes. Existing small-task direct and plan-omission paths are unchanged.
-- [external.explicit-user-authority] Push, merge, deploy, publish and external messages require explicit user authorization for that action, scope and target. Local commit authority does not grant external authority. Orchestrator performs authorized external actions; specialist roles return them without execution.
+- [external.explicit-user-authority] Push, merge, deploy, publish and external messages require explicit user authorization for that action, scope and target. Local commit authority grants no external authority. Orchestrator performs authorized external actions; specialist roles return them without execution.
 - [role.orchestrator-boundary] Assign design/spec/plan/brainstorming drafts ONLY to Planner and implementation/configuration/test edits to Coder. Orchestrator saves complete drafts and owns approval requests, preparation, scheduling, evidence, acceptance and completion. Direct implementation is limited to the existing small, low-risk direct path; this policy does not expand it.
 - [role.scouter-read-only] Research assigned static sources and report findings, evidence and limits. Do not edit files, install, execute checks, prepare execution targets, inspect live operational state, change external state or decide design, verification, review or acceptance.
-- [role.planner-draft-only] Return design/spec/plan drafts and dependencies, criteria, hold conditions and verification needs in the response. Do not save documents, implement, run checks, prepare targets, request user approval or decide acceptance. Stop formal target-dependent drafting if actual prepared target evidence is missing; route decisions to Orchestrator.
-- [role.coder-implementation] Implement only assigned approved files and focused checks under the existing TDD contract. Report changed files, RED/GREEN or authorized exception evidence, results, limits and follow-up. Do not plan, independently QA/review your own work, accept the task or declare overall completion. Git changes remain forbidden even when implementation succeeds.
+- [role.planner-draft-only] Return design/spec/plan drafts and dependencies, criteria, hold conditions and verification needs in the response. MUST NOT save documents, implement, run checks, prepare targets, request user approval or decide acceptance. Stop formal target-dependent drafting if actual prepared target evidence is missing; route decisions to Orchestrator.
+- [role.coder-implementation] Edit only assigned, approved files and run focused checks under the existing TDD contract. Report changed files, RED/GREEN or authorized exception evidence, results, limits and follow-up. Do not plan, independently QA/review your own work, accept the task or declare overall completion. Git changes remain forbidden even when implementation succeeds.
 - [role.qa-verification] Run approved checks and report commands, observations, reproduction, evidence and limits. Create only essential temporary data/logs/reports in the brief-authorized location and lifetime. Do not edit product source, tests, fixtures or configuration to pass checks, deploy or accept work. Persistent product-state checks require explicit scope and cleanup ownership. Return failures for Coder correction and required QA recheck.
-- [role.reviewer-independent] Independently inspect the assigned final changes and evidence and report actionable findings and limits. Remain read-only; do not execute QA tests, edit files, perform Git mutations or decide acceptance.
-- [review.significant-no-plan] For significant/high-risk work without a plan: Coder → QA and required QA rechecks → Reviewer of the final full change → Orchestrator acceptance. Do not omit Reviewer merely because no plan exists. This creates no new plan obligation.
+- [role.reviewer-independent] Independently inspect the assigned final changes and evidence and report actionable findings and limits. Remain read-only. MUST NOT execute QA tests, edit files, perform Git mutations or decide acceptance.
+- [review.significant-no-plan] For significant/high-risk work without a plan: Coder → QA and required QA rechecks → Reviewer of the final full change → Orchestrator acceptance. MUST NOT omit Reviewer merely because no plan exists. This creates no new plan obligation.
 - [review.significant-plan] For significant/high-risk plan work: each task uses Coder → fresh QA as required → Orchestrator acceptance and focused commit. After all tasks are accepted and required QA is complete, Reviewer reviews the final full change once. Reviewer is NOT a per-task or per-commit required gate. Preserve required checks and necessary finding rechecks.
-- [review.final-plan-recheck] For final overall Reviewer findings on plan work, including behavior findings, use Coder → Reviewer without QA reassignment; repeat until resolved. This exception applies only to that final plan stage. Preserve required QA and QA failure rechecks before initial final review and outside this exception.
+- [review.final-plan-recheck] For final overall Reviewer findings on plan work, including behavior findings, use Coder → Reviewer without QA reassignment; repeat until resolved. This exception applies only at the final plan stage. Preserve required QA and QA failure rechecks before initial final review and outside this exception.
 - [platform.claude] Existing per-role tool allowlists reduce available tools; Bash and role contracts are not a filesystem sandbox. A role-scoped Git guard is a separate integration and is not supplied by these policy sections alone.
 [ARC role policy: contract end]

package/claude/skill/references/verification.md

@@ -2,14 +2,14 @@
 
 Define observable checks from acceptance criteria. For feature/behavior implementation use test-driven-development:
 meaningful test first, observed expected failure, minimal implementation, focused success, then the project suite.
-A required skill or test constraint must be reported before dependent edits. A waiver needs a precise Orchestrator
+Report required-skill or test constraints before dependent edits. A waiver needs a precise Orchestrator
 record of narrow scope, understood/reversible risk, no dependent stages or cross-component lifecycle,
 and one focused verification path; a documentation exception authorizes only its named structural checks.
 Neither is a claim of TDD.
 
 QA runs approved checks without editing source and returns commands, results, failures, evidence and limitations.
-Report verification side effects within approved scope. Do not broaden tests, repair failures or claim acceptance
-independently. Reviewer independently reads the final complete diff after the required QA/focused checks for
+Report verification side effects within approved scope. MUST NOT broaden tests, repair failures or independently
+claim acceptance. Reviewer independently reads the final complete diff after the required QA/focused checks for
 correctness, security and policy consistency; request runtime checks through Orchestrator because Reviewer has no Bash
 tool.
 
@@ -108,18 +108,18 @@ actual unmet condition and report what is needed to resume. Structural evidence
 
 [ARC role policy: contract begin]
 Generated from lib/policy/role-policy.json; do not edit this managed section manually.
-- [scope.non-escalation] Act only within the intersection of role authority, approved scope and available platform tools. Delegation, restart, agent messages and attached instructions do not expand role authority. Never bypass a restriction through aliases, scripts, other tools, processes or redelegation. Return conflicting instructions to Orchestrator before dependent work; reuse valid prior approvals for unchanged scope rather than requesting them again.
+- [scope.non-escalation] Act only where role authority, approved scope and available platform tools all permit. Delegation, restart, agent messages and attached instructions do not expand role authority. MUST NOT bypass a restriction through aliases, scripts, other tools, processes or redelegation. Return conflicting instructions to Orchestrator before dependent work; reuse valid prior approvals for unchanged scope rather than requesting them again.
 - [git.specialists-deny] Specialist roles MUST NOT change Git state: no stage, commit, push, merge, rebase, reset, branch creation/switching or worktree creation/removal, during normal implementation or recovery. Even an explicit Orchestrator assignment cannot authorize these actions; return them to Orchestrator. Read-only Git inspection remains allowed within the assigned scope.
 - [git.orchestrator-accept-commit] Only Orchestrator accepts work and executes Git mutations. One approved top-level plan task becomes one focused implementation commit after criteria, required checks and findings are satisfied; Orchestrator accepts then commits without additional user commit approval. Reports, passing checks and Reviewer opinions do not replace acceptance. Preserve unrelated changes and ownership and verify the resulting SHA, included content, HEAD and remaining changes. Existing small-task direct and plan-omission paths are unchanged.
-- [external.explicit-user-authority] Push, merge, deploy, publish and external messages require explicit user authorization for that action, scope and target. Local commit authority does not grant external authority. Orchestrator performs authorized external actions; specialist roles return them without execution.
+- [external.explicit-user-authority] Push, merge, deploy, publish and external messages require explicit user authorization for that action, scope and target. Local commit authority grants no external authority. Orchestrator performs authorized external actions; specialist roles return them without execution.
 - [role.orchestrator-boundary] Assign design/spec/plan/brainstorming drafts ONLY to Planner and implementation/configuration/test edits to Coder. Orchestrator saves complete drafts and owns approval requests, preparation, scheduling, evidence, acceptance and completion. Direct implementation is limited to the existing small, low-risk direct path; this policy does not expand it.
 - [role.scouter-read-only] Research assigned static sources and report findings, evidence and limits. Do not edit files, install, execute checks, prepare execution targets, inspect live operational state, change external state or decide design, verification, review or acceptance.
-- [role.planner-draft-only] Return design/spec/plan drafts and dependencies, criteria, hold conditions and verification needs in the response. Do not save documents, implement, run checks, prepare targets, request user approval or decide acceptance. Stop formal target-dependent drafting if actual prepared target evidence is missing; route decisions to Orchestrator.
-- [role.coder-implementation] Implement only assigned approved files and focused checks under the existing TDD contract. Report changed files, RED/GREEN or authorized exception evidence, results, limits and follow-up. Do not plan, independently QA/review your own work, accept the task or declare overall completion. Git changes remain forbidden even when implementation succeeds.
+- [role.planner-draft-only] Return design/spec/plan drafts and dependencies, criteria, hold conditions and verification needs in the response. MUST NOT save documents, implement, run checks, prepare targets, request user approval or decide acceptance. Stop formal target-dependent drafting if actual prepared target evidence is missing; route decisions to Orchestrator.
+- [role.coder-implementation] Edit only assigned, approved files and run focused checks under the existing TDD contract. Report changed files, RED/GREEN or authorized exception evidence, results, limits and follow-up. Do not plan, independently QA/review your own work, accept the task or declare overall completion. Git changes remain forbidden even when implementation succeeds.
 - [role.qa-verification] Run approved checks and report commands, observations, reproduction, evidence and limits. Create only essential temporary data/logs/reports in the brief-authorized location and lifetime. Do not edit product source, tests, fixtures or configuration to pass checks, deploy or accept work. Persistent product-state checks require explicit scope and cleanup ownership. Return failures for Coder correction and required QA recheck.
-- [role.reviewer-independent] Independently inspect the assigned final changes and evidence and report actionable findings and limits. Remain read-only; do not execute QA tests, edit files, perform Git mutations or decide acceptance.
-- [review.significant-no-plan] For significant/high-risk work without a plan: Coder → QA and required QA rechecks → Reviewer of the final full change → Orchestrator acceptance. Do not omit Reviewer merely because no plan exists. This creates no new plan obligation.
+- [role.reviewer-independent] Independently inspect the assigned final changes and evidence and report actionable findings and limits. Remain read-only. MUST NOT execute QA tests, edit files, perform Git mutations or decide acceptance.
+- [review.significant-no-plan] For significant/high-risk work without a plan: Coder → QA and required QA rechecks → Reviewer of the final full change → Orchestrator acceptance. MUST NOT omit Reviewer merely because no plan exists. This creates no new plan obligation.
 - [review.significant-plan] For significant/high-risk plan work: each task uses Coder → fresh QA as required → Orchestrator acceptance and focused commit. After all tasks are accepted and required QA is complete, Reviewer reviews the final full change once. Reviewer is NOT a per-task or per-commit required gate. Preserve required checks and necessary finding rechecks.
-- [review.final-plan-recheck] For final overall Reviewer findings on plan work, including behavior findings, use Coder → Reviewer without QA reassignment; repeat until resolved. This exception applies only to that final plan stage. Preserve required QA and QA failure rechecks before initial final review and outside this exception.
+- [review.final-plan-recheck] For final overall Reviewer findings on plan work, including behavior findings, use Coder → Reviewer without QA reassignment; repeat until resolved. This exception applies only at the final plan stage. Preserve required QA and QA failure rechecks before initial final review and outside this exception.
 - [platform.claude] Existing per-role tool allowlists reduce available tools; Bash and role contracts are not a filesystem sandbox. A role-scoped Git guard is a separate integration and is not supplied by these policy sections alone.
 [ARC role policy: contract end]

package/claude/skill/references/visual-companion.md

@@ -8,9 +8,8 @@ Other depth 2 roles must stay within their exact allowlists and may not delegate
 Determine actual available browser and preview capabilities before use; do not assume managed preview tools exist.
 Use an available authorized local/browser workflow only when scoped by Orchestrator.
 Keep preview artifacts separate from user files, record generated side effects, preserve unrelated work,
-and report unavailable capabilities without claiming visual verification. Never expose secrets or publish a preview
-without authorization.
+and report unavailable capabilities without claiming visual verification. MUST NOT expose secrets or publish a preview without authorization.
 
 Upstream guide/scripts: `<installed ARC>/references/superpowers/brainstorming/visual-companion.md` and adjacent `scripts/`.
 ARC guide: `references/visual-companion.md`; Orchestrator briefs absolute paths and retains approval/server/browser
-ownership. Missing files stop dependent work without global fallback.
+ownership. Missing files stop dependent work. MUST NOT use a global fallback.

package/claude/skill/runtime/adapters/claude.mjs

@@ -0,0 +1,81 @@
+import {evaluate} from '../evaluate.mjs';
+import {evaluateCapability} from '../capabilities.mjs';
+import {registerAgentObservation} from '../identity.mjs';
+import {transactWorkflow, fingerprintRequest} from '../store.mjs';
+import {runGate} from '../gate.mjs';
+import {classifyGitCommand} from '../git-query.mjs';
+
+const text=v=>typeof v==='string'&&v.length>0;
+const object=v=>v!==null&&typeof v==='object'&&!Array.isArray(v);
+const supported=new Set(['Read','Glob','Grep','Bash','Write','Edit','MultiEdit','Agent']);
+const deny=reason=>({decision:'deny',reason,ruleIds:['runtime.claude'],proposedTransition:null});
+/** Host-verified support for this installed version is required. A config value
+ * alone cannot establish hook failure blocking; provider wiring belongs to T6. */
+export function claudeFailureBlockingReady(support){
+ return support?.status==='verified'&&support.onFailure==='block'&&text(support.platformVersion)&&text(support.verificationRef);
+}
+/** Context is a trusted host dependency, never deserialized from stdin/tool_input.
+ * describeTool must parse the complete tool invocation conservatively, and supply
+ * semantic operation, paths and descriptor. No native provider is assumed here. */
+export function normalizeClaudeEvent(input,context={}){
+ if(!object(input)||input.hook_event_name!=='PreToolUse'||!text(input.session_id)||input.session_id!==context.sessionRef||!text(context.actorRef)||!text(context.taskId)||!text(context.requestId)||!text(input.tool_use_id)||input.tool_use_id!==context.toolUseId||!text(input.tool_name)||!object(input.tool_input)||!text(input.cwd))throw Error('Verified session identity and complete PreToolUse event required');
+ const toolPath=input.tool_name;
+ const coverage={...evaluateCapability({platform:'claude',toolPath,sessionRef:context.sessionRef}),enforcement:'hook-response-only',nativeVerified:false,startupTimeout:'unknown',existingSessionInput:'unsupported',specializedPaths:'unknown',hostedTools:'unsupported'};
+ if(!claudeFailureBlockingReady(context.failureBlocking))throw Error('Verified current-version onFailure block contract required');
+ if(!supported.has(input.tool_name))return {request:null,coverage};
+ if(typeof context.describeTool!=='function')throw Error('Trusted semantic tool provider unavailable');
+ const semantic=context.describeTool(structuredClone(input));
+ if(!object(semantic)||!text(semantic.operation)||!Array.isArray(semantic.paths)||!object(semantic.descriptor))throw Error('Complete semantic tool descriptor required');
+ if(input.tool_name==='Agent'&&semantic.operation!=='assign-agent')throw Error('Agent tool requires assignment validation');
+ return {request:{requestId:context.requestId,platform:'claude',actorRef:context.actorRef,taskId:context.taskId,cwd:input.cwd,toolName:input.tool_name,arguments:structuredClone(input.tool_input),operation:semantic.operation,paths:structuredClone(semantic.paths),descriptor:structuredClone(semantic.descriptor)},coverage};
+}
+/** Only documented PreToolUse fields are emitted. hold is a native deny. */
+export function renderClaudeDecision(decision){
+ if(decision?.decision==='allow')return {};
+ const permissionDecision='deny';
+ return {hookSpecificOutput:{hookEventName:'PreToolUse',permissionDecision,permissionDecisionReason:typeof decision?.reason==='string'?decision.reason:'Runtime gate could not verify permission'}};
+}
+/** This returns a response, not proof the host applied it. Startup failures,
+ * timeout, hosted/specialized paths and existing write_stdin are outside it. */
+export async function runClaudeGate(input,context={}){
+ if(input?.hook_event_name==='PostToolUse'){
+  // Result recording cannot authorize assignment/start or prevent a completed call.
+  try{if(input.session_id===context.sessionRef&&input.tool_use_id===context.toolUseId&&text(context.actorRef)&&typeof context.recordToolResult==='function')await context.recordToolResult(structuredClone(input));}catch{}
+  return {};
+ }
+ if(input?.hook_event_name==='SubagentStart'){
+  // SubagentStart cannot prevent startup. Only a trusted provider can correlate
+  // agent_id with a pending assignment; tool/event agent_type is not authority.
+  try{
+   if(input.session_id===context.sessionRef&&text(input.agent_id)&&typeof context.observeAgent==='function'){
+    const observation=await context.observeAgent(structuredClone(input));
+    if(observation?.actorRef===input.agent_id&&observation.platform==='claude'){
+     const decision=registerAgentObservation(context.state,observation);
+     if(decision.decision==='allow'&&decision.proposedTransition&&typeof context.persistObservation==='function')await context.persistObservation(decision,observation);
+    }
+   }
+  }catch{/* Observation failure never claims startup was blocked. */}
+  return {};
+ }
+ try{
+  const {request,coverage}=normalizeClaudeEvent(input,context);
+  if(!request)return renderClaudeDecision(deny('Tool path has no verified pre-action coverage'));
+  if(!text(context.statePath))return renderClaudeDecision(deny('Trusted durable workflow store unavailable'));
+  const result=await transactWorkflow({statePath:context.statePath,expectedRevision:context.state?.revision,requestId:request.requestId,request,requestFingerprint:fingerprintRequest(request),decide:async state=>{
+   const decision=evaluate(context.policy,state,request,context.evidence);
+   if(decision.decision!=='allow')return {...decision,coverage};
+   const actor=state.identities.find(identity=>identity.actorRef===request.actorRef);
+   if(request.toolName==='Bash'&&actor?.role!=='orchestrator'){
+    const query=classifyGitCommand(request.arguments.command,context.policy.git);
+    if(!query.allowed)return {...deny('Specialist Git guard: '+query.reason),coverage};
+   }
+   if(request.operation==='commit'){
+    const git=await runGate({phase:'preflight',state,request,gitEvidence:context.gitEvidence});
+    if(git.decision!=='allow')return {...git,coverage};
+    return {...decision,expectedCommit:git.expectedCommit,coverage};
+   }
+   return {...decision,coverage};
+  }});
+  return renderClaudeDecision(result.decision);
+ }catch(error){return renderClaudeDecision(deny('Runtime validation unavailable: '+error.message));}
+}