arkaos 4.0.2 → 4.1.1

package/config/hooks/post-tool-use.sh

@@ -1,552 +1,68 @@
 #!/usr/bin/env bash
 # ============================================================================
-# ARKA OS — PostToolUse Hook (Gotchas Memory)
-# Detects errors from tool output and tracks recurring patterns
-# Timeout: 5s | Output: JSON to stdout
+# ARKA OS — PostToolUse Hook (thin wrapper, PR-6 v4.1.0 hook hygiene)
+#
+# Delegates the ENTIRE event to ONE python process:
+#   python3 -m core.hooks.post_tool_use
+#
+# The entrypoint preserves the behavior contract of the previous
+# ~38-spawn-site version:
+#   - Flow marker cache: detects [arka:routing] / [arka:trivial] in the
+#     assistant message and persists via core.workflow.marker_cache
+#     write_marker so PreToolUse can short-circuit the transcript scan.
+#   - CQO REJECTED experience auto-record + APPROVED pattern stubs.
+#   - Activation tracking for every Task/Agent dispatch.
+#   - Gotchas memory (~/.arkaos/gotchas.json) with fix suggestions.
+#   - Workflow violation rules + enforcement engine + forge scope-creep
+#     (delegated once to the ArkaOS venv python when the ambient python3
+#     lacks PyYAML — mirrors the old ARKAOS_PY resolution).
+#   - Cognition capture enqueue (detached background process).
+#   - Hook metrics. Output: JSON to stdout. Timeout: 5s.
 # ============================================================================
 
-input=$(cat)
-
-# ─── Performance Timing ──────────────────────────────────────────────────
-_HOOK_START=$(date +%s 2>/dev/null)
-_HOOK_START_NS=$(date +%s%N 2>/dev/null || echo "0")
-_hook_ms() {
-  local end_ns=$(date +%s%N 2>/dev/null || echo "0")
-  if [ "$_HOOK_START_NS" != "0" ] && [ "$end_ns" != "0" ] && [ ${#end_ns} -gt 10 ]; then
-    echo $(( (end_ns - _HOOK_START_NS) / 1000000 ))
+if [ -z "${ARKAOS_ROOT:-}" ]; then
+  if [ -f "$HOME/.arkaos/.repo-path" ]; then
+    ARKAOS_ROOT=$(cat "$HOME/.arkaos/.repo-path")
+  elif [ -d "$HOME/.arkaos" ]; then
+    ARKAOS_ROOT="$HOME/.arkaos"
   else
-    echo $(( ($(date +%s) - _HOOK_START) * 1000 ))
-  fi
-}
-
-# Extract fields
-TOOL_NAME=$(echo "$input" | jq -r '.tool_name // ""' 2>/dev/null)
-TOOL_OUTPUT=$(echo "$input" | jq -r '.tool_output // ""' 2>/dev/null)
-EXIT_CODE=$(echo "$input" | jq -r '.exit_code // "0"' 2>/dev/null)
-CWD=$(echo "$input" | jq -r '.cwd // ""' 2>/dev/null)
-SESSION_ID_PTU=$(echo "$input" | jq -r '.session_id // ""' 2>/dev/null)
-ASSISTANT_MSG=$(echo "$input" | jq -r '.assistant_message // ""' 2>/dev/null)
-
-# ─── Flow marker cache write (v2 — turn-scoped ALLOW accelerator) ───────
-# Detect [arka:routing] or [arka:trivial] in the assistant message that
-# accompanied this tool call, and persist it so the PreToolUse enforcer
-# can short-circuit the transcript scan for the rest of the turn.
-# Never blocks the hook — all failures are swallowed.
-if [ -n "$SESSION_ID_PTU" ] && [ -n "$ASSISTANT_MSG" ] && command -v python3 &>/dev/null; then
-  _MARKER_KIND=""
-  _MARKER_DEPT=""
-  _MARKER_LEAD=""
-  if printf '%s' "$ASSISTANT_MSG" | grep -qiE '\[arka:routing\][[:space:]]*[A-Za-z_-]+[[:space:]]*->[[:space:]]*[A-Za-z_-]+'; then
-    _MARKER_KIND="routing"
-    _ROUTE_LINE=$(printf '%s' "$ASSISTANT_MSG" | grep -iEo '\[arka:routing\][[:space:]]*[A-Za-z_-]+[[:space:]]*->[[:space:]]*[A-Za-z_-]+' | head -1)
-    _MARKER_DEPT=$(printf '%s' "$_ROUTE_LINE" | sed -E 's/.*\[arka:routing\][[:space:]]*([A-Za-z_-]+).*/\1/')
-    _MARKER_LEAD=$(printf '%s' "$_ROUTE_LINE" | sed -E 's/.*->[[:space:]]*([A-Za-z_-]+).*/\1/')
-  elif printf '%s' "$ASSISTANT_MSG" | grep -qiE '\[arka:trivial\][[:space:]]*\S+'; then
-    _MARKER_KIND="trivial"
-  fi
-
-  if [ -n "$_MARKER_KIND" ]; then
-    _MARKER_ROOT="${ARKAOS_ROOT:-}"
-    if [ -z "$_MARKER_ROOT" ] && [ -f "$HOME/.arkaos/.repo-path" ]; then
-      _MARKER_ROOT=$(cat "$HOME/.arkaos/.repo-path" 2>/dev/null)
-    fi
-    [ -z "$_MARKER_ROOT" ] && _MARKER_ROOT="$HOME/.arkaos"
-    SESSION_ID_PTU="$SESSION_ID_PTU" \
-    MARKER_KIND="$_MARKER_KIND" \
-    MARKER_DEPT="$_MARKER_DEPT" \
-    MARKER_LEAD="$_MARKER_LEAD" \
-    PYTHONPATH="$_MARKER_ROOT" \
-    python3 -c "
-import os, sys
-try:
-    from core.workflow.marker_cache import write_marker
-    write_marker(
-        os.environ.get('SESSION_ID_PTU', ''),
-        os.environ.get('MARKER_KIND', ''),
-        os.environ.get('MARKER_DEPT', ''),
-        os.environ.get('MARKER_LEAD', ''),
-    )
-except Exception:
-    pass
-" 2>/dev/null || true
+    ARKAOS_ROOT="${ARKA_OS:-$HOME/.claude/skills/arkaos}"
   fi
 fi
+export ARKAOS_ROOT
 
-# ─── CQO REJECTED auto-record (PR3.5 v3.74.1) ────────────────────────
-# When a Task/Agent dispatch to subagent_type=cqo returns
-# `Quality Gate Verdict: REJECTED`, append an Experience to the
-# failing agent's log. The agent under review is identified by the
-# `[arka:reviewing <agent_id>]` marker that the orchestrator MUST
-# include in the CQO dispatch prompt (constitution rule
-# `agent-experience-persistence`). Never blocks the hook.
-if [ "$TOOL_NAME" = "Task" ] || [ "$TOOL_NAME" = "Agent" ]; then
-  SUBAGENT_TYPE=$(echo "$input" | jq -r '.tool_input.subagent_type // ""' 2>/dev/null)
-  if [ "$SUBAGENT_TYPE" = "cqo" ]; then
-    TOOL_INPUT_PROMPT=$(echo "$input" | jq -r '.tool_input.prompt // ""' 2>/dev/null)
-    _AE_ROOT="${ARKAOS_ROOT:-}"
-    if [ -z "$_AE_ROOT" ] && [ -f "$HOME/.arkaos/.repo-path" ]; then
-      _AE_ROOT=$(cat "$HOME/.arkaos/.repo-path" 2>/dev/null)
-    fi
-    [ -z "$_AE_ROOT" ] && _AE_ROOT="$HOME/.arkaos"
-
-    # ─── REJECTED → experience auto-record ────────────────────────────
-    if echo "$TOOL_OUTPUT" | grep -qE 'Quality Gate Verdict:[[:space:]]*REJECTED'; then
-      REVIEWING_TARGET=$(printf '%s' "$TOOL_INPUT_PROMPT" \
-        | grep -oE '\[arka:reviewing[[:space:]]+[A-Za-z0-9_.-]+\]' \
-        | head -1 \
-        | sed -E 's/.*\[arka:reviewing[[:space:]]+([A-Za-z0-9_.-]+)\].*/\1/')
-      if [ -n "$REVIEWING_TARGET" ]; then
-        VERDICT_TEXT="$TOOL_OUTPUT" \
-        AGENT_ID="$REVIEWING_TARGET" \
-        SESSION_ID="$SESSION_ID_PTU" \
-        ARKAOS_ROOT="$_AE_ROOT" \
-        python3 - <<'PY' 2>/dev/null || true
-import os, sys
-sys.path.insert(0, os.environ["ARKAOS_ROOT"])
-try:
-    from core.governance.cqo_experience_recorder import record_from_verdict
-    record_from_verdict(
-        verdict_text=os.environ.get("VERDICT_TEXT", ""),
-        agent_id=os.environ.get("AGENT_ID", ""),
-        session_id=os.environ.get("SESSION_ID", ""),
-        context="auto-recorded via PostToolUse hook (cqo dispatch REJECTED)",
-    )
-except Exception:
-    pass
-PY
-      fi
-    fi
-
-    # ─── APPROVED → pattern stub auto-create (PR4.5 v3.75.1) ──────────
-    # When the dispatch prompt contains `[arka:pattern-suggest <id> <name>]`
-    # AND the verdict is APPROVED, create a stub PatternCard. The
-    # operator enriches by editing ~/.arkaos/patterns/cards.jsonl or
-    # calling record_pattern() with the full metadata. Skips when the
-    # id already exists (never overwrites enriched cards).
-    if echo "$TOOL_OUTPUT" | grep -qE 'Quality Gate Verdict:[[:space:]]*APPROVED'; then
-      PATTERN_LINE=$(printf '%s' "$TOOL_INPUT_PROMPT" \
-        | grep -oE '\[arka:pattern-suggest[[:space:]]+[A-Za-z0-9_.-]+[[:space:]]+[^][]+\]' \
-        | head -1)
-      if [ -n "$PATTERN_LINE" ]; then
-        PID=$(printf '%s' "$PATTERN_LINE" | sed -E 's/\[arka:pattern-suggest[[:space:]]+([A-Za-z0-9_.-]+).*/\1/')
-        PNAME=$(printf '%s' "$PATTERN_LINE" | sed -E 's/\[arka:pattern-suggest[[:space:]]+[A-Za-z0-9_.-]+[[:space:]]+([^][]+)\]/\1/')
-        if [ -n "$PID" ] && [ -n "$PNAME" ]; then
-          PATTERN_ID="$PID" \
-          PATTERN_NAME="$PNAME" \
-          ARKAOS_ROOT="$_AE_ROOT" \
-          python3 - <<'PY' 2>/dev/null || true
-import os, sys
-sys.path.insert(0, os.environ["ARKAOS_ROOT"])
-try:
-    from datetime import datetime, timezone
-    from core.knowledge.pattern_cards import PatternCard, record_pattern, query_patterns
-    pid = os.environ["PATTERN_ID"]
-    existing = [c for c in query_patterns(limit=1000) if c.id == pid]
-    if not existing:
-        ts = datetime.now(timezone.utc).isoformat()
-        record_pattern(PatternCard(
-            id=pid,
-            name=os.environ["PATTERN_NAME"],
-            feature_keywords=[pid.replace("-", " "), os.environ["PATTERN_NAME"].lower()],
-            description="Stub auto-created from APPROVED CQO verdict — enrich via record_pattern() or by editing the JSONL.",
-            stack=[],
-            files=[],
-            acceptance_criteria=[],
-            edge_cases=[],
-            references=[],
-            projects_using=["arkaos"],
-            created_at=ts,
-            last_updated=ts,
-        ))
-except Exception:
-    pass
-PY
-        fi
-      fi
-    fi
-  fi
-
-  # ─── Activation tracking (PR5 v3.76.0) ─────────────────────────────
-  # Record every Task/Agent dispatch regardless of subagent_type (CQO or
-  # any other). Runs AFTER the cqo branch so verdicts don't block it.
-  # Never blocks — _ACT_ROOT reuses the same resolution as _AE_ROOT.
-  if [ -n "$SUBAGENT_TYPE" ]; then
-    _ACT_ROOT="${ARKAOS_ROOT:-}"
-    if [ -z "$_ACT_ROOT" ] && [ -f "$HOME/.arkaos/.repo-path" ]; then
-      _ACT_ROOT=$(cat "$HOME/.arkaos/.repo-path" 2>/dev/null)
-    fi
-    [ -z "$_ACT_ROOT" ] && _ACT_ROOT="$HOME/.arkaos"
-    SUBAGENT_TYPE="$SUBAGENT_TYPE" \
-    SESSION_ID="$SESSION_ID_PTU" \
-    ARKAOS_ROOT="$_ACT_ROOT" \
-    python3 - <<'PY' 2>/dev/null || true
-import os, sys
-sys.path.insert(0, os.environ["ARKAOS_ROOT"])
-try:
-    from core.governance.activation_tracker import record_activation
-    record_activation(
-        subagent_type=os.environ.get("SUBAGENT_TYPE", ""),
-        session_id=os.environ.get("SESSION_ID", ""),
-    )
-except Exception:
-    pass
-PY
-  fi
-fi
-
-# Only process if there was an error
-if [ "$EXIT_CODE" = "0" ] || [ -z "$EXIT_CODE" ]; then
-  # Also check for error patterns in output even with exit code 0
-  if ! echo "$TOOL_OUTPUT" | grep -qiE '(error:|fatal:|exception:|failed|ENOENT|EACCES|EPERM|panic:)'; then
+if ! command -v python3 &>/dev/null; then
+  echo '{}'
+  exit 0
+fi
+# Self-root fallback: the wrapper ships next to its python entrypoint, so
+# when ARKAOS_ROOT points at a pre-PR-6 install without core/hooks/, use
+# the root this script lives in.
+if [ ! -f "$ARKAOS_ROOT/core/hooks/post_tool_use.py" ]; then
+  _SELF_ROOT="$(cd "$(dirname "$0")/../.." 2>/dev/null && pwd)"
+  if [ -n "$_SELF_ROOT" ] && [ -f "$_SELF_ROOT/core/hooks/post_tool_use.py" ]; then
+    ARKAOS_ROOT="$_SELF_ROOT"
+    export ARKAOS_ROOT
+  else
     echo '{}'
     exit 0
   fi
 fi
 
-# ─── Extract Error Pattern ────────────────────────────────────────────────
-# Get first meaningful error line (skip blank lines, timestamps)
-ERROR_LINE=$(echo "$TOOL_OUTPUT" | grep -iE '(error|fatal|exception|failed|ENOENT|EACCES|EPERM|panic|cannot|not found|permission denied)' | head -1)
-
-if [ -z "$ERROR_LINE" ]; then
-  # Fallback: first non-empty line of output for non-zero exit
-  ERROR_LINE=$(echo "$TOOL_OUTPUT" | head -5 | tail -1)
-fi
-
-[ -z "$ERROR_LINE" ] && { echo '{}'; exit 0; }
-
-# Normalize: remove timestamps, hashes, paths with unique segments, line numbers
-PATTERN=$(echo "$ERROR_LINE" | \
-  sed -E 's/[0-9]{4}-[0-9]{2}-[0-9]{2}[T ][0-9]{2}:[0-9]{2}:[0-9]{2}[^ ]*/TIMESTAMP/g' | \
-  sed -E 's/[0-9a-f]{7,40}/HASH/g' | \
-  sed -E 's/line [0-9]+/line N/g' | \
-  sed -E 's/:[0-9]+:/:N:/g' | \
-  head -c 200)
-
-[ -z "$PATTERN" ] && { echo '{}'; exit 0; }
-
-# ─── Categorize ──────────────────────────────────────────────────────────
-CATEGORY="general"
-if echo "$ERROR_LINE" | grep -qiE '(artisan|eloquent|laravel|blade|migration|composer|php )'; then
-  CATEGORY="laravel"
-elif echo "$ERROR_LINE" | grep -qiE '(npm|node|vue|react|nuxt|next|vite|webpack|typescript|tsx|jsx)'; then
-  CATEGORY="frontend"
-elif echo "$ERROR_LINE" | grep -qiE '(git |merge|rebase|checkout|branch|commit|push|pull)'; then
-  CATEGORY="git"
-elif echo "$ERROR_LINE" | grep -qiE '(sql|postgres|mysql|database|migration|table|column|constraint)'; then
-  CATEGORY="database"
-elif echo "$ERROR_LINE" | grep -qiE '(permission|denied|EACCES|EPERM|chmod|chown|sudo)'; then
-  CATEGORY="permissions"
-elif echo "$ERROR_LINE" | grep -qiE '(test|assert|expect|jest|phpunit|bats|coverage)'; then
-  CATEGORY="testing"
-fi
-
-# ─── Match Fix Suggestion ────────────────────────────────────────────────
-SUGGESTION=""
-FIXES_FILE="${ARKA_OS:-$HOME/.claude/skills/arka}/config/gotchas-fixes.json"
-# Also check repo path
-if [ ! -f "$FIXES_FILE" ]; then
-  REPO_PATH=$(cat "${ARKA_OS:-$HOME/.claude/skills/arka}/.repo-path" 2>/dev/null || echo "")
-  [ -n "$REPO_PATH" ] && FIXES_FILE="$REPO_PATH/config/gotchas-fixes.json"
-fi
-if [ -f "$FIXES_FILE" ] && command -v jq &>/dev/null; then
-  SUGGESTION=$(jq -r --arg err "$ERROR_LINE" '
-    .fixes[] | select(.pattern_match as $p | $err | test($p; "i")) | .suggestion
-  ' "$FIXES_FILE" 2>/dev/null | head -1)
-fi
-
-# ─── Detect Active Project ───────────────────────────────────────────────
-PROJECT=""
-if [ -n "$CWD" ]; then
-  # Try to extract project name from CWD
-  REPO_PATH=$(cat "${ARKA_OS:-$HOME/.claude/skills/arka}/.repo-path" 2>/dev/null || echo "")
-  if [ -n "$REPO_PATH" ] && [ -d "$REPO_PATH/projects" ]; then
-    for proj_dir in "$REPO_PATH/projects"/*/; do
-      [ -f "$proj_dir/.project-path" ] || continue
-      PROJ_PATH=$(cat "$proj_dir/.project-path" 2>/dev/null)
-      if [ -n "$PROJ_PATH" ] && [[ "$CWD" == "$PROJ_PATH"* ]]; then
-        PROJECT=$(basename "$proj_dir")
-        break
-      fi
-    done
-  fi
-  # Fallback: use directory name
-  [ -z "$PROJECT" ] && PROJECT=$(basename "$CWD")
-fi
-
-# ─── Store in gotchas.json ────────────────────────────────────────────────
-GOTCHAS_FILE="$HOME/.arkaos/gotchas.json"
-mkdir -p "$HOME/.arkaos"
-
-# Use flock for concurrent safety (fallback if flock not available on macOS)
-LOCK_FILE="$HOME/.arkaos/gotchas.lock"
-if command -v flock &>/dev/null; then
-  LOCK_CMD="flock -w 3 200"
-else
-  LOCK_CMD="true"
-fi
-(
-  eval "$LOCK_CMD" || { echo '{}'; exit 0; }
-
-  NOW=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-
-  # Initialize if missing or invalid
-  if [ ! -f "$GOTCHAS_FILE" ] || ! jq empty "$GOTCHAS_FILE" 2>/dev/null; then
-    echo '[]' > "$GOTCHAS_FILE"
-  fi
-
-  # Check if pattern already exists
-  EXISTING_IDX=$(jq -r --arg pat "$PATTERN" \
-    'to_entries[] | select(.value.pattern == $pat) | .key' \
-    "$GOTCHAS_FILE" 2>/dev/null | head -1)
-
-  if [ -n "$EXISTING_IDX" ] && [ "$EXISTING_IDX" -ge 0 ] 2>/dev/null; then
-    # Increment count, update last_seen, add project if new, add suggestion if missing
-    jq --argjson idx "$EXISTING_IDX" \
-       --arg now "$NOW" \
-       --arg proj "$PROJECT" \
-       --arg sug "$SUGGESTION" \
-       '.[$idx].count += 1 |
-        .[$idx].last_seen = $now |
-        (if $proj != "" and ($proj | IN(.[$idx].projects[]?) | not) then .[$idx].projects += [$proj] else . end) |
-        (if $sug != "" and ((.[$idx].suggestion // "") == "") then .[$idx].suggestion = $sug else . end)' \
-       "$GOTCHAS_FILE" > "$GOTCHAS_FILE.tmp" 2>/dev/null && mv "$GOTCHAS_FILE.tmp" "$GOTCHAS_FILE"
-  else
-    # Add new entry
-    jq --arg pat "$PATTERN" \
-       --arg full "$ERROR_LINE" \
-       --arg cat "$CATEGORY" \
-       --arg tool "$TOOL_NAME" \
-       --arg now "$NOW" \
-       --arg proj "$PROJECT" \
-       --arg sug "$SUGGESTION" \
-       '. += [{
-         "pattern": $pat,
-         "full_pattern": ($full | .[0:500]),
-         "category": $cat,
-         "tool": $tool,
-         "count": 1,
-         "first_seen": $now,
-         "last_seen": $now,
-         "projects": (if $proj != "" then [$proj] else [] end),
-         "suggestion": (if $sug != "" then $sug else null end)
-       }]' \
-       "$GOTCHAS_FILE" > "$GOTCHAS_FILE.tmp" 2>/dev/null && mv "$GOTCHAS_FILE.tmp" "$GOTCHAS_FILE"
-  fi
-
-  # Keep top 100 sorted by count
-  jq 'sort_by(-.count) | .[0:100]' "$GOTCHAS_FILE" > "$GOTCHAS_FILE.tmp" 2>/dev/null && \
-    mv "$GOTCHAS_FILE.tmp" "$GOTCHAS_FILE"
-
-) 200>"$LOCK_FILE"
-
-# ─── Workflow Violation Detection ────────────────────────────────────────
-VIOLATION_MSG=""
-STATE_READER=""
-[ -f "$HOME/.arkaos/.repo-path" ] && STATE_READER="$(cat "$HOME/.arkaos/.repo-path")/core/workflow/state_reader.sh"
-
-if [ -n "$STATE_READER" ] && [ -f "$STATE_READER" ] && bash "$STATE_READER" active 2>/dev/null; then
-  ARKAOS_PY=""
-  [ -f "$HOME/.arkaos/venv/bin/python3" ] && ARKAOS_PY="$HOME/.arkaos/venv/bin/python3"
-  [ -z "$ARKAOS_PY" ] && [ -f "$HOME/.arkaos/.venv/bin/python3" ] && ARKAOS_PY="$HOME/.arkaos/.venv/bin/python3"
-  [ -z "$ARKAOS_PY" ] && ARKAOS_PY=$(command -v python3 2>/dev/null)
-  ARKAOS_ROOT=$(cat "$HOME/.arkaos/.repo-path" 2>/dev/null)
-
-  # Rule 1: Branch isolation — commit on master while workflow active
-  if [ "$TOOL_NAME" = "Bash" ]; then
-    if echo "$TOOL_OUTPUT" | grep -qE '^\[(master|main)' 2>/dev/null; then
-      CMD_TEXT=$(echo "$input" | jq -r '.command // ""' 2>/dev/null)
-      if echo "$CMD_TEXT" | grep -qE 'git commit'; then
-        [ -n "$ARKAOS_PY" ] && [ -n "$ARKAOS_ROOT" ] && \
-          PYTHONPATH="$ARKAOS_ROOT" $ARKAOS_PY -c "
-from core.workflow.state import add_violation
-add_violation('branch-isolation', 'Commit on master/main while workflow active', 'Bash')
-" 2>/dev/null
-        VIOLATION_MSG="VIOLATION [branch-isolation]: Commit on master while workflow active. Use a feature branch."
-      fi
-    fi
-  fi
-
-  # Rule 2: Spec-driven — code edited without completed spec
-  if [ "$TOOL_NAME" = "Write" ] || [ "$TOOL_NAME" = "Edit" ]; then
-    FILE_PATH=$(echo "$input" | jq -r '.file_path // ""' 2>/dev/null)
-    if echo "$FILE_PATH" | grep -qE '\.(py|js|ts|vue|php|jsx|tsx)$'; then
-      if ! bash "$STATE_READER" check spec 2>/dev/null; then
-        [ -n "$ARKAOS_PY" ] && [ -n "$ARKAOS_ROOT" ] && \
-          PYTHONPATH="$ARKAOS_ROOT" _V_TOOL="$TOOL_NAME" _V_FILE="$FILE_PATH" $ARKAOS_PY -c "
-import os; from core.workflow.state import add_violation
-add_violation('spec-driven', 'Code edited without completed spec', os.environ['_V_TOOL'], os.environ['_V_FILE'])
-" 2>/dev/null
-        VIOLATION_MSG="VIOLATION [spec-driven]: Code edited without completed spec ($FILE_PATH). Complete the spec phase first."
-      fi
-    fi
-  fi
-
-  # Rule 3: Sequential — implementation before planning
-  if [ -z "$VIOLATION_MSG" ] && { [ "$TOOL_NAME" = "Write" ] || [ "$TOOL_NAME" = "Edit" ]; }; then
-    FILE_PATH=$(echo "$input" | jq -r '.file_path // ""' 2>/dev/null)
-    if echo "$FILE_PATH" | grep -qE '\.(py|js|ts|vue|php|jsx|tsx)$'; then
-      IMPL_STATUS=$(bash "$STATE_READER" phase implementation 2>/dev/null)
-      if [ "$IMPL_STATUS" = "pending" ]; then
-        [ -n "$ARKAOS_PY" ] && [ -n "$ARKAOS_ROOT" ] && \
-          PYTHONPATH="$ARKAOS_ROOT" _V_TOOL="$TOOL_NAME" _V_FILE="$FILE_PATH" $ARKAOS_PY -c "
-import os; from core.workflow.state import add_violation
-add_violation('sequential-validation', 'Code written before implementation phase started', os.environ['_V_TOOL'], os.environ['_V_FILE'])
-" 2>/dev/null
-        VIOLATION_MSG="VIOLATION [sequential-validation]: Implementation started before planning completed ($FILE_PATH)."
-      fi
-    fi
-  fi
-fi
-
-# ─── ArkaOS Enforcement Engine (All 14 Rules) ─────────────────────────────────
-# Uses core/workflow/enforcer.py to check ALL 14 NON-NEGOTIABLE rules
-# BLOCK violations halt operation; ESCALATE violations alert Tier 0
-# Gotchas auto-recovery is ALWAYS active (SIM per Sprint 3 decision)
-
-if [ -z "${ARKAOS_PY:-}" ]; then
-  [ -f "$HOME/.arkaos/venv/bin/python3" ] && ARKAOS_PY="$HOME/.arkaos/venv/bin/python3"
-  [ -z "${ARKAOS_PY:-}" ] && [ -f "$HOME/.arkaos/.venv/bin/python3" ] && ARKAOS_PY="$HOME/.arkaos/.venv/bin/python3"
-  [ -z "${ARKAOS_PY:-}" ] && ARKAOS_PY=$(command -v python3 2>/dev/null)
-fi
-[ -z "${ARKAOS_ROOT:-}" ] && ARKAOS_ROOT=$(cat "$HOME/.arkaos/.repo-path" 2>/dev/null)
-
-if [ -n "$ARKAOS_PY" ] && [ -n "$ARKAOS_ROOT" ] && [ -f "$ARKAOS_ROOT/core/workflow/enforcer.py" ]; then
-  ENFORCER_OUTPUT=$(PYTHONPATH="$ARKAOS_ROOT" $ARKAOS_PY -c "
-import json, sys
-from core.workflow.enforcer import enforce_tool
-from core.workflow.state import add_violation
-
-input_data = json.loads(sys.stdin.read())
-tool_name = input_data.get('tool_name', '')
-command = input_data.get('command', '')
-file_path = input_data.get('file_path', '')
-user_input = input_data.get('user_input', '')
-
-extra = {}
-if tool_name == 'Bash':
-    import subprocess
-    try:
-        branch = subprocess.check_output(['git', 'branch', '--show-current'], text=True, stderr=subprocess.DEVNULL).strip()
-        extra['git_branch'] = branch
-    except:
-        extra['git_branch'] = ''
-
-result = enforce_tool(
-    tool_name=tool_name,
-    command=command,
-    file_path=file_path,
-    user_input=user_input,
-    **extra
-)
-
-if result.violations:
-    for v in result.violations:
-        try:
-            add_violation(v.rule_id, v.message, v.tool, v.file_path, v.severity)
-        except:
-            pass
-
-    print(json.dumps({
-        'violations': [v.to_dict() for v in result.violations],
-        'blocked': result.blocked,
-        'escalated': result.escalated,
-        'messages': result.messages
-    }))
-else:
-    print(json.dumps({'violations': [], 'blocked': False, 'escalated': False, 'messages': []}))
-" <<< "$input" 2>/dev/null)
-
-  if [ -n "$ENFORCER_OUTPUT" ] && echo "$ENFORCER_OUTPUT" | jq -e '.violations | length > 0' &>/dev/null; then
-    ENFORCER_BLOCKED=$(echo "$ENFORCER_OUTPUT" | jq -r '.blocked')
-    ENFORCER_MESSAGES=$(echo "$ENFORCER_OUTPUT" | jq -r '.messages | join("|")')
-
-    for msg in $(echo "$ENFORCER_MESSAGES" | tr '|' '\n'); do
-      [ -n "$msg" ] && VIOLATION_MSG="${VIOLATION_MSG}${VIOLATION_MSG:+$'\n'}${msg}"
+# Interpreter resolution: prefer the ArkaOS venv (has pyyaml/pydantic);
+# otherwise probe — an unrelated project venv first on PATH would give a
+# python3 without yaml and silently degrade every gate.
+_PY=""
+for _cand in "$HOME/.arkaos/venv/bin/python3" "$HOME/.arkaos/.venv/bin/python3"; do
+  if [ -x "$_cand" ]; then _PY="$_cand"; break; fi
+done
+if [ -z "$_PY" ]; then
+  _PY="python3"
+  if ! "$_PY" -c "import yaml" 2>/dev/null; then
+    for _cand in /opt/homebrew/bin/python3 /usr/local/bin/python3 /usr/bin/python3; do
+      if [ -x "$_cand" ] && "$_cand" -c "import yaml" 2>/dev/null; then _PY="$_cand"; break; fi
     done
-
-    if [ "$ENFORCER_BLOCKED" = "true" ]; then
-      VIOLATION_MSG="🔴 BLOCK: ${VIOLATION_MSG}"
-    fi
   fi
 fi
-
-# --- Forge Violation Detection ---
-_FORGE_ACTIVE="$HOME/.arkaos/plans/active.yaml"
-
-# Ensure ARKAOS_PY and ARKAOS_ROOT are set (may not be set if no active workflow)
-if [ -z "${ARKAOS_PY:-}" ]; then
-  [ -f "$HOME/.arkaos/venv/bin/python3" ] && ARKAOS_PY="$HOME/.arkaos/venv/bin/python3"
-  [ -z "${ARKAOS_PY:-}" ] && [ -f "$HOME/.arkaos/.venv/bin/python3" ] && ARKAOS_PY="$HOME/.arkaos/.venv/bin/python3"
-  [ -z "${ARKAOS_PY:-}" ] && ARKAOS_PY=$(command -v python3 2>/dev/null)
-fi
-[ -z "${ARKAOS_ROOT:-}" ] && ARKAOS_ROOT=$(cat "$HOME/.arkaos/.repo-path" 2>/dev/null)
-
-if [ -z "$VIOLATION_MSG" ] && [ -f "$_FORGE_ACTIVE" ] && [ -n "$ARKAOS_PY" ] && [ -n "$ARKAOS_ROOT" ]; then
-  _FORGE_ID=$(cat "$_FORGE_ACTIVE" 2>/dev/null)
-  _FORGE_FILE="$HOME/.arkaos/plans/${_FORGE_ID}.yaml"
-
-  if [ -f "$_FORGE_FILE" ]; then
-    if [ "$TOOL_NAME" = "Edit" ] || [ "$TOOL_NAME" = "Write" ]; then
-      _EDITED_FILE="${tool_input_file_path:-}"
-      # Fallback: extract file_path from input JSON
-      [ -z "$_EDITED_FILE" ] && _EDITED_FILE=$(echo "$input" | jq -r '.file_path // ""' 2>/dev/null)
-      if [ -n "$_EDITED_FILE" ]; then
-        _FORGE_VIOLATION=$(FORGE_FILE="$_FORGE_FILE" EDITED_FILE="$_EDITED_FILE" PYTHONPATH="$ARKAOS_ROOT" $ARKAOS_PY -c "
-import yaml, sys, os
-plan = yaml.safe_load(open(os.environ['FORGE_FILE']))
-if plan.get('status', '') != 'executing':
-    sys.exit(0)
-phases = plan.get('plan_phases', [])
-all_deliverables = []
-for p in phases:
-    all_deliverables.extend(p.get('deliverables', []))
-edited = os.environ['EDITED_FILE']
-match = any(d in edited or edited.endswith(d) for d in all_deliverables)
-if not match and all_deliverables:
-    print('forge-scope-creep')
-" 2>/dev/null)
-        if [ "$_FORGE_VIOLATION" = "forge-scope-creep" ]; then
-          VIOLATION_MSG="⚠ Forge scope-creep: editing ${_EDITED_FILE} which is outside forge plan deliverables."
-        fi
-      fi
-    fi
-  fi
-fi
-
-# ─── Cognitive layer capture (PR4 v2.26.0 hooks-as-retrieval) ────────────
-# Backgrounded so the hook returns immediately. The retrieval helper has
-# its own internal time caps (ripgrep ≤ 1s, Python fallback capped at 500
-# files) so a runaway extract can never block the next user prompt. We
-# disown so the child cannot zombie if the hook process exits first.
-if [ -n "$SESSION_ID_PTU" ] && [ -n "$TOOL_OUTPUT" ]; then
-  _ARKAOS_REPO=$(cat "$HOME/.arkaos/.repo-path" 2>/dev/null || echo "")
-  if [ -n "$_ARKAOS_REPO" ] && [ -d "$_ARKAOS_REPO" ]; then
-    (
-      PYTHONPATH="$_ARKAOS_REPO" python3 -m core.cognition.retrieval capture "$SESSION_ID_PTU" <<EOF >/dev/null 2>&1
-$TOOL_OUTPUT
-EOF
-    ) &
-    disown 2>/dev/null || true
-  fi
-fi
-
-# ─── Log Metrics ─────────────────────────────────────────────────────────
-_DURATION_MS=$(_hook_ms)
-METRICS_FILE="$HOME/.arkaos/hook-metrics.json"
-METRICS_LOCK="$HOME/.arkaos/hook-metrics.lock"
-mkdir -p "$HOME/.arkaos"
-(
-  if command -v flock &>/dev/null; then flock -w 2 200; else true; fi
-  [ ! -f "$METRICS_FILE" ] && echo '[]' > "$METRICS_FILE"
-  NOW=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-  jq --argjson dur "$_DURATION_MS" --arg ts "$NOW" --arg hook "post-tool-use" \
-    '. += [{"hook": $hook, "duration_ms": $dur, "timestamp": $ts}] | .[-500:]' \
-    "$METRICS_FILE" > "$METRICS_FILE.tmp" 2>/dev/null && mv "$METRICS_FILE.tmp" "$METRICS_FILE"
-) 200>"$METRICS_LOCK" 2>/dev/null
-
-# Output violation as context if detected, otherwise empty
-if [ -n "$VIOLATION_MSG" ]; then
-  echo "{\"additionalContext\": \"$VIOLATION_MSG\"}"
-else
-  echo '{}'
-fi
+PYTHONPATH="$ARKAOS_ROOT${PYTHONPATH:+:$PYTHONPATH}" \
+  exec "$_PY" -m core.hooks.post_tool_use