arkaos 5.12.0 → 5.13.0

package/THE-ARKAOS-GUIDE.md

@@ -1,6 +1,6 @@
 # The ArkaOS Guide
 
-> v5.12.0 — 89 agents, 17 departments, 340 skills, 306 commands, 20 ADRs.
+> v5.13.0 — 89 agents, 17 departments, 340 skills, 306 commands, 20 ADRs.
 > One file, everything you need to start. Generated by `scripts/guide_gen.py` — never hand-edited.
 
 ## What it is

package/VERSION

@@ -1 +1 @@
-5.12.0
+5.13.0

package/bin/arka-py.ps1

@@ -25,7 +25,22 @@ $libs = @(
 foreach ($lib in $libs) {
     if (Test-Path -LiteralPath $lib) { . $lib; break }
 }
-if (-not $env:ARKA_PY) { $env:ARKA_PY = "python" }
+# Empty/unset means one of two things: the shared resolver was not found at
+# all, or it WAS found and deliberately handed back nothing because every
+# candidate is a Microsoft Store App Execution Alias. A blind `= "python"`
+# here cannot tell those apart, and on a stock Windows box it picks the
+# alias — running the Python install manager, which downloads a full CPython
+# into the caller's cwd. Probe once more, alias-aware, then fail loudly.
+if (-not $env:ARKA_PY) {
+    $fallback = Get-Command python -ErrorAction SilentlyContinue
+    if ($fallback -and $fallback.Source -notmatch '\\Microsoft\\WindowsApps\\') {
+        $env:ARKA_PY = $fallback.Source
+    } else {
+        [Console]::Error.WriteLine(
+            "arka-py: no usable Python interpreter on PATH (none found, or only Store aliases) - run npx arkaos doctor")
+        exit 1
+    }
+}
 
 # ─── Make `-m core.*` resolvable regardless of cwd ────────────────────────
 $root = $env:ARKAOS_ROOT

package/config/hooks/_lib/arka_python.ps1

@@ -8,9 +8,12 @@
 # Resolution order:
 #   1. $env:ARKAOS_PYTHON (explicit override), if it exists.
 #   2. The ArkaOS venv — Scripts\python.exe (Windows) then bin/python.
-#   3. Any python3/python/py on PATH that can `import yaml`, skipping the
-#      Microsoft Store App Execution Aliases (see Test-StoreAlias).
-#   4. Bare `python` as a last resort.
+#   3. Any python/py/python3 on PATH that can `import yaml`, in THAT order
+#      (see the comment on the probe loop), skipping the Microsoft Store
+#      App Execution Aliases (see Test-StoreAlias).
+#   4. `python` as a last resort — but '' when that name is a Store alias
+#      too, because a caller cannot tell an alias from an interpreter and
+#      would run it (see Get-ArkaPythonLastResort).
 
 function Test-StoreAlias {
     <#
@@ -30,15 +33,45 @@ function Test-StoreAlias {
         tree and a python_install_<timestamp>.log into their repo. Observed
         on Windows 10, Python install manager 26.3.
 
-        Probing an alias can never help anyway: the stub carries no site
-        packages, so the `import yaml` check it exists to answer would fail
-        after paying the install.
+        Probing an alias can never help anyway. Either the manager installs
+        a CPython and the probe measures THAT interpreter — a fresh install
+        with no pyyaml, so `import yaml` fails and the candidate is rejected
+        after paying the full cost — or the install is declined and the stub
+        exits without ever running the check. There is no path where probing
+        the alias answers the question it was asked.
     #>
     param([string]$Path)
     if ([string]::IsNullOrWhiteSpace($Path)) { return $false }
     return $Path -match '\\Microsoft\\WindowsApps\\'
 }
 
+function Get-ArkaPythonLastResort {
+    <#
+    .SYNOPSIS
+        The interpreter to hand back when no probed candidate answered, or
+        '' when the only name left is a Store alias.
+
+    .DESCRIPTION
+        Extracted from Resolve-ArkaPython so the branch is reachable from a
+        test: in place it sits behind a probe that matches on any machine
+        with a working interpreter.
+
+        Returning the bare string "python" from here was the hole in this
+        file's own guard. Every caller gates on `-and $env:ARKA_PY`, and any
+        non-empty string is truthy in PowerShell, so an aliased "python"
+        passed the gate and was then run — the exact install-manager side
+        effect Test-StoreAlias exists to prevent, arriving through the
+        fallback instead of the probe. '' is the only value that makes the
+        callers degrade, so '' is what a box with nothing but aliases gets.
+
+        Mirror of arka_python_last_resort() in arka_python.sh.
+    #>
+    param([string]$Name = "python")
+    $cmd = Get-Command $Name -ErrorAction SilentlyContinue
+    if ($cmd -and -not (Test-StoreAlias $cmd.Source)) { return $cmd.Source }
+    return ""
+}
+
 function Resolve-ArkaPython {
     if ($env:ARKAOS_PYTHON -and (Test-Path -LiteralPath $env:ARKAOS_PYTHON)) {
         return $env:ARKAOS_PYTHON
@@ -67,7 +100,7 @@ function Resolve-ArkaPython {
         }
     }
 
-    return "python"
+    return (Get-ArkaPythonLastResort)
 }
 
 # Windows mirror of arka_resolve_root() in arka_python.sh: env override wins

package/config/hooks/_lib/arka_python.sh

@@ -10,7 +10,9 @@
 # Contract of arka_resolve_python():
 #   Echoes the interpreter path and returns 0 when a provisioned ArkaOS
 #   interpreter is found; echoes a best-effort fallback and returns 1 when
-#   only a bare `python3` remains (caller degrades gracefully).
+#   only a bare `python3` remains (caller degrades gracefully). Echoes
+#   NOTHING and returns 1 when every remaining candidate is a Microsoft
+#   Store App Execution Alias — see arka_python_last_resort().
 #
 # Resolution order:
 #   1. $ARKAOS_PYTHON (explicit operator override), if executable.
@@ -18,7 +20,39 @@
 #      python3. `[ -x ]` follows symlinks, so a Homebrew-rotated broken
 #      symlink is skipped automatically.
 #   3. Any python3 on PATH / known locations that can `import yaml`.
-#   4. Bare `python3` as a last resort (return 1).
+#   4. Bare `python3` as a last resort (return 1), or nothing at all when
+#      that name — and `python` behind it — is only a Store alias.
+
+# Last-resort name selection, extracted from arka_resolve_python() so the
+# branch is reachable from a test: in place it sits behind a PATH probe
+# that matches on every POSIX box with a yaml-capable python3, so it can
+# only be exercised on the machine it was written for.
+#
+# Contract: echoes the name to hand back, or NOTHING when every remaining
+# candidate is a Store alias. Empty is the point, not an oversight. The
+# callers gate on `command -v "$ARKA_PY"` and an alias stub PASSES that
+# gate — the file is real, it is just the Python install manager rather
+# than an interpreter — so the only value that degrades a hook instead of
+# downloading a CPython into the user's project is no value at all.
+arka_python_last_resort() {
+  local py3 py
+  py3="$(command -v python3 2>/dev/null)"
+  case "$py3" in
+    *[Ww]indows[Aa]pps*) ;;
+    # Absent or real: the documented `python3` contract, unchanged. POSIX
+    # never reaches the alias branch below.
+    *) printf '%s\n' "python3"; return 0 ;;
+  esac
+
+  # `python3` is the alias. On a Windows box that HAS a real interpreter,
+  # `python` is the name it answers to; on a stock box with none, that is
+  # an alias too and we must hand back nothing.
+  py="$(command -v python 2>/dev/null)"
+  case "$py" in
+    "" | *[Ww]indows[Aa]pps*) return 0 ;;
+  esac
+  printf '%s\n' "python"
+}
 
 arka_resolve_python() {
   local cand
@@ -67,16 +101,7 @@ arka_resolve_python() {
     fi
   done
 
-  # Last resort. The documented contract is `python3` + rc 1, kept as-is,
-  # except where that name is the Store alias: handing an alias back to a
-  # caller that will `exec` it is the very trap this function now avoids.
-  case "$(command -v python3 2>/dev/null)" in
-    *[Ww]indows[Aa]pps*)
-      printf '%s\n' "python"
-      return 1
-      ;;
-  esac
-  printf '%s\n' "python3"
+  arka_python_last_resort
   return 1
 }
 

package/config/hooks/_lib/workflow-classifier.sh

@@ -3,7 +3,13 @@
 # ArkaOS v2 — Shared Workflow Classifier
 #
 # Decides whether a user prompt triggers the 4-gate evidence flow.
-# Used by: user-prompt-submit.sh, pre-tool-use.sh, stop.sh.
+#
+# CLI AND TEST SURFACE ONLY — no hook sources this file. The runtime path
+# is core/hooks/user_prompt_submit.py, which user-prompt-submit.sh execs;
+# these functions survive as the documented CLI (see the dispatcher at the
+# bottom) and as the bash half of the parity contract. That is precisely
+# why the two implementations must be diffed by hand: nothing at runtime
+# will ever notice them disagreeing.
 #
 # Contract:
 #   arka_wf_classify "<prompt text>"  → echoes "true" or "false", exits 0.
@@ -11,9 +17,11 @@
 #   arka_wf_is_required "<session_id>"  → exits 0 if required, 1 otherwise.
 #   arka_wf_clear_required "<session_id>"  → removes marker file.
 #
-# Markers live under /tmp/arkaos-wf-required/<session_id>.
-# Python path for mark/clear: delegates to flow_enforcer.py when available,
-# otherwise falls back to touching the marker file directly.
+# Markers live under $ARKA_WF_REQUIRED_DIR/<session_id>, defaulting to
+# /tmp/arkaos-wf-required (see below). The override is the seam that keeps
+# writer and reader on the same directory — core/shared/temp_paths.py
+# ::wf_required_dir is the Python side of it. mark/clear here write the
+# marker file directly; they do NOT call flow_enforcer.py.
 # ============================================================================
 
 ARKA_WF_REQUIRED_DIR="${ARKA_WF_REQUIRED_DIR:-/tmp/arkaos-wf-required}"
@@ -65,11 +73,22 @@ arka_wf_classify() {
 
   # Question guard: interrogative lead + trailing "?" = information
   # question, never creation intent (X5 false positive).
-  local trimmed
+  #
+  # The lead is taken from the FIRST NON-BLANK LINE, never from the whole
+  # text. The Python twin uses re.match on text.strip(), which can only
+  # match at offset 0; grep anchors ^ PER LINE, so feeding it everything
+  # made any later line able to trigger the guard. The two then disagreed
+  # on every multi-line prompt ending in a question — "implementa X\no que
+  # e que isto faz?" is a directive followed by a question, and a directive
+  # still requires the flow. awk reproduces .strip() closely enough for an
+  # anchor that already tolerates leading whitespace: skip blank lines,
+  # print the first line with content, stop.
+  local trimmed lead
   trimmed=$(printf '%s' "$text" | sed 's/[[:space:]]*$//')
   case "$trimmed" in
     *\?)
-      if echo "$text" | grep -qiE "$ARKA_WF_QUESTION_LEAD"; then
+      lead=$(printf '%s' "$text" | awk 'NF { print; exit }')
+      if printf '%s' "$lead" | grep -qiE "$ARKA_WF_QUESTION_LEAD"; then
         echo "false"
         return 0
       fi

package/config/hooks/session-start.ps1

@@ -5,8 +5,10 @@
 # (core.hooks.session_start) builds the whole payload: the visible banner in
 # "systemMessage" AND the operating contracts in
 # hookSpecificOutput.additionalContext. This file only resolves the
-# interpreter and delegates; with no usable interpreter it emits a static
-# banner and exits 0 (fail-open, dependency-free).
+# interpreter and delegates; whenever it cannot reach that producer — no
+# repo root, no module file, no interpreter, or the module itself exiting
+# non-zero — it emits a static banner and exits 0 (fail-open,
+# dependency-free).
 #
 # WHY A WRAPPER AND NOT A PORT
 # The previous version reimplemented the banner natively in PowerShell. It
@@ -16,7 +18,10 @@
 # (EVIDENCE-FLOW, META-TAG, AUTHORITY, MODEL-FABRIC) were computed by nobody
 # and never reached the model, while the Linux side got them every session.
 # Reimplementing the blocks here would duplicate the producer and recreate
-# the same drift one release later. One producer, two thin wrappers.
+# the same drift one release later, so this file delegates instead. The
+# twin-parity test in tests/python/test_hook_output_contract.py is what
+# holds that open: it asserts both wrappers run `-m core.hooks
+# .session_start`, and fails if either stops.
 #
 # Minimum PowerShell: 5.1 (shipped with every Windows 10+). No pwsh 7 prereq.
 # This file stays pure ASCII; every non-ASCII byte in the output comes from
@@ -73,8 +78,19 @@ if ($repo -and $moduleFile -and (Test-Path -LiteralPath $moduleFile) -and $env:A
 # --- Degraded fallback: static banner, valid JSON, exit 0 ------------------
 # Same contract as the .sh fallback. Built from [char] codes so this source
 # file needs no particular encoding to produce correct output.
+#
+# The message names the SYMPTOM, not a cause. Four conditions reach this
+# line (see the guard above) and only one of them is a missing interpreter;
+# the fourth — the module running and exiting non-zero — asserts the
+# opposite. The .sh twin execs, so its fallback is unreachable once an
+# interpreter is launched and the narrower wording survived there; this
+# port falls through on $LASTEXITCODE, which is what made it false. Sending
+# a Windows operator with a healthy Python to debug their Python, when the
+# real fault is a stale ~/.arkaos/.repo-path, costs more than the wording
+# saves. `npx arkaos doctor` diagnoses all four.
 $tri = [char]0x25B2
 $oAcute = [char]0x00F3
-$banner = "`n  $tri  A R K A   O S`n     The Operating System for AI Agent Teams`n`n  Ol$oAcute, founder`n  degraded: no usable interpreter - run npx arkaos doctor"
+$emDash = [char]0x2014
+$banner = "`n  $tri  A R K A   O S`n     The Operating System for AI Agent Teams`n`n  Ol$oAcute, founder`n  degraded: ArkaOS core not reachable $emDash run npx arkaos doctor"
 [pscustomobject]@{ systemMessage = $banner } | ConvertTo-Json -Compress
 exit 0

package/config/hooks/session-start.sh

@@ -5,8 +5,9 @@
 # ONE python process (core.hooks.session_start) builds the entire
 # systemMessage — the 13 inline python spawns of the previous version
 # live there now (baseline 251ms p50 before consolidation). This file
-# only resolves the interpreter and execs; with no usable interpreter
-# it emits a static banner and exits 0 (fail-open, stdlib-free).
+# only resolves the interpreter and execs; whenever it cannot reach that
+# producer — no repo root, no module file, no interpreter — it emits a
+# static banner and exits 0 (fail-open, stdlib-free).
 # ============================================================================
 
 # _HOOK_CWD captured BEFORE any cd — inside a compound command $PWD
@@ -55,7 +56,10 @@ if [ -n "$REPO" ] && [ -f "$REPO/core/hooks/session_start.py" ] \
 fi
 
 # ─── Degraded fallback: static banner, valid JSON, exit 0 ──────────────
+# Names the symptom, not a cause: three conditions reach here and only one
+# of them is a missing interpreter. Kept byte-identical in wording to the
+# .ps1 twin so an operator on either platform reads the same diagnosis.
 cat <<'EOF'
-{"systemMessage": "\n  ▲  A R K A   O S\n     The Operating System for AI Agent Teams\n\n  Olá, founder\n  degraded: no usable interpreter — run npx arkaos doctor"}
+{"systemMessage": "\n  ▲  A R K A   O S\n     The Operating System for AI Agent Teams\n\n  Olá, founder\n  degraded: ArkaOS core not reachable — run npx arkaos doctor"}
 EOF
 exit 0

package/config/hooks/stop.ps1

@@ -24,9 +24,15 @@ $cwd = [string]$inp.cwd
 
 if ($stopHookActive -eq "true") { exit 0 }
 
-# Marker dir must match the Python writer (_wf_mark_required /
-# core.shared.temp_paths.arkaos_temp_dir): %TEMP%\arkaos-wf-required on
-# Windows, with the same ARKA_WF_REQUIRED_DIR override the writer honors.
+# Marker dir must match the Python writer: core.hooks.user_prompt_submit
+# ::_wf_mark_required resolves it through core.shared.temp_paths
+# ::wf_required_dir — which is arkaos_temp_dir('arkaos-wf-required'),
+# i.e. %TEMP%\arkaos-wf-required on Windows, EXCEPT that it honors
+# ARKA_WF_REQUIRED_DIR first. Read arkaos_temp_dir directly here and the
+# override splits writer from reader: the writer moves, this gate finds no
+# marker and allows everything, silently. That is the fail-open
+# wf_required_dir exists to close, so mirror wf_required_dir, not
+# arkaos_temp_dir.
 # The previous hardcoded "/tmp/arkaos-wf-required" resolves to a path that
 # exists on no stock Windows machine, so this gate exited 0 on every real
 # session and the whole compliance chain below never ran.
@@ -204,131 +210,43 @@ try {
 }
 
 # ─── Governance parity (skill capture + warn-only detectors) ───────────
-# config/hooks/stop.sh delegates the whole event to `python -m
-# core.hooks.stop`, which runs seventeen core modules. This port
-# reimplements the event inline and reached only two of them, so four
+# config/hooks/stop.sh delegates the whole event to `python -m` the Stop
+# entrypoint, which runs the full detector chain (the authoritative list
+# is that module's own imports — no count is stated here because several
+# are conditional, so no fixed number is true of a given event). This
+# port reimplements the event and reached only two of them, so four
 # detectors that exist, are tested and are wired on POSIX never ran on
 # Windows at all — most visibly skill_proposer, whose constitution rule
 # (mandatory-skill-evaluation) mandates a capability sweep after every
 # completed task.
 #
+# The sweep is a real module, not an inline script: core/hooks/
+# stop_governance.py. Delegating rather than mirroring is what keeps the
+# owner-only umask on the state files it writes — the previous inline
+# copy of _write_tmp_state had already lost it — and it is what lets the
+# parity test IMPORT AND RUN the sweep instead of grepping module names
+# out of this file, which a comment could satisfy.
+#
 # Scope is deliberately the NON-ENFORCEMENT subset: these four write
 # proposals and diagnostic state only. The gating checks
 # (closing_marker_check, meta_tag_check, kb_cite_check, dna_fidelity)
 # are left out of this change — they feed enforcement surfaces and
 # deserve their own baseline on Windows before being switched on.
-$governanceScript = @'
-import os
-import sys
-from pathlib import Path
-
-sys.path.insert(0, os.environ.get("ARKAOS_ROOT", ""))
-try:
-    from core.workflow.flow_enforcer import _load_last_assistant_messages
-except Exception:
-    sys.exit(0)
-
-transcript_path = os.environ.get("TRANSCRIPT_PATH_VAL", "")
-session_id = os.environ.get("SESSION_ID_VAL", "")
-if not transcript_path:
-    sys.exit(0)
-
-try:
-    msgs = _load_last_assistant_messages(transcript_path, n=1)
-    last = msgs[-1] if msgs else ""
-except Exception:
-    last = ""
-
-raw = None
-try:
-    raw = Path(transcript_path).read_text(encoding="utf-8", errors="replace")
-except Exception:
-    raw = None
-
-
-def _write_tmp_state(prefix, sid, payload):
-    """Mirror of core.hooks.stop._write_tmp_state (best-effort)."""
-    if not sid:
-        return
-    try:
-        import json
-
-        from core.shared.temp_paths import arkaos_temp_dir
-
-        target = arkaos_temp_dir(prefix)
-        target.mkdir(parents=True, exist_ok=True)
-        (target / f"{sid}.json").write_text(
-            json.dumps(payload), encoding="utf-8"
-        )
-    except Exception:
-        pass
-
-
-safe_sid = None
-try:
-    from core.shared.safe_session_id import safe_session_id
-
-    safe_sid = safe_session_id(session_id)
-except Exception:
-    safe_sid = None
-
-# 1. Capability capture — the constitution rule this port was missing.
-try:
-    from core.governance.skill_proposer import evaluate as _eval_skill
-
-    _eval_skill(last)
-except Exception:
-    pass
-
-# 2. Sycophancy (warn-only telemetry).
-try:
-    from core.governance.sycophancy_detector import detect_sycophancy
-
-    sv = detect_sycophancy(last)
-    if sv.is_sycophantic and safe_sid:
-        _write_tmp_state("arkaos-sycophancy", safe_sid, {
-            "is_sycophantic": sv.is_sycophantic,
-            "signals": sv.signals,
-            "confidence": sv.confidence,
-        })
-except Exception:
-    pass
-
-# 3. Phantom actions — narrated effects with no tool call in the turn.
-try:
-    from core.governance.phantom_action_check import check_phantom_actions
-
-    pr = check_phantom_actions(last, raw)
-    if safe_sid:
-        _write_tmp_state("arkaos-phantom", safe_sid, {
-            "passed": pr.passed,
-            "reason": pr.reason,
-            "claims": pr.claims,
-            "suggestion": pr.suggestion,
-        })
-except Exception:
-    pass
-
-# 4. Tool loops.
-try:
-    from core.governance.tool_loop_check import check_tool_loops
-
-    lv = check_tool_loops(raw)
-    if lv.detected and safe_sid:
-        _write_tmp_state("arkaos-tool-loop", safe_sid, {
-            "tool": lv.tool,
-            "repeats": lv.repeats,
-            "pattern": lv.pattern,
-            "total_tool_uses": lv.total_tool_uses,
-        })
-except Exception:
-    pass
-'@
-
-try {
-    $governanceScript | & $pythonExe - | Out-Null
-} catch {
-    # Swallow — governance observation must never affect the Stop hook.
+$governanceModule = Join-Path $env:ARKAOS_ROOT "core/hooks/stop_governance.py"
+if (Test-Path -LiteralPath $governanceModule) {
+    # PREPEND, never clobber: an operator's own PYTHONPATH must survive
+    # the hook (the .sh twin prepends for the same reason).
+    $sep = [IO.Path]::PathSeparator
+    $env:PYTHONPATH = if ($env:PYTHONPATH) {
+        "$($env:ARKAOS_ROOT)$sep$($env:PYTHONPATH)"
+    } else {
+        $env:ARKAOS_ROOT
+    }
+    try {
+        & $pythonExe -m core.hooks.stop_governance | Out-Null
+    } catch {
+        # Swallow — governance observation must never affect the Stop hook.
+    }
 }
 
 # Belt-and-braces marker cleanup (safe even if the Python block crashed).

package/config/hooks/user-prompt-submit.ps1

@@ -18,8 +18,10 @@
 # called the workflow classifier, so the wf-required marker was never
 # created on Windows: the per-prompt half of the evidence flow (and the
 # whole compliance chain behind the Stop hook) was dead on this platform.
-# Same failure mode as session-start.ps1 (twin drift). One producer, two
-# thin wrappers.
+# Same failure mode as session-start.ps1 (twin drift), and the same fix:
+# delegate, and let the twin-parity test in tests/python/
+# test_hook_output_contract.py fail the build if this file ever stops
+# running `-m core.hooks.user_prompt_submit`.
 #
 # Minimum PowerShell: 5.1. This file stays pure ASCII; every non-ASCII byte
 # in the output comes from Python's UTF-8 stdout.

package/core/hooks/stop_governance.py

@@ -0,0 +1,166 @@
+"""Warn-only governance sweep for the Windows Stop hook.
+
+``config/hooks/stop.sh`` hands the whole Stop event to
+``core.hooks.stop``. ``stop.ps1`` cannot yet: it reimplements the event,
+and this sweep used to live inside it as a ~100-line Python here-string --
+source that no linter, no type checker and no test could reach, and that
+a PowerShell drift guard could only ever inspect as text.
+
+Promoting it to a module buys two things that a here-string cannot:
+
+* ``_write_tmp_state`` is IMPORTED from ``core.hooks.stop`` instead of
+  hand-copied. The copy had silently dropped the ``umask(0o077)``
+  hardening and wrote ``0644``/``0755`` where the original writes
+  ``0600``/``0700`` -- on transcript-derived payloads (sycophancy
+  signals, phantom-action claims quoting assistant text) which, under the
+  PowerShell adapter on POSIX, land in a shared ``/tmp``. Importing makes
+  that class of loss impossible rather than merely tested-for.
+* the parity test IMPORTS AND RUNS this module. The guard it replaced
+  asserted module names were present as substrings of the .ps1, which a
+  comment satisfies: the whole port could be neutered with every name
+  left in place and all five tests still passed.
+
+Scope is deliberately the NON-ENFORCEMENT subset. These detectors write
+proposals and diagnostic state; nothing reads their output to gate
+anything. The gating checks stay deferred with a recorded reason each --
+see ``DEFERRED_IN_PS1`` in
+``tests/python/test_stop_ps1_governance_parity.py``.
+
+Every detector is fire-and-forget: a failure is skipped, never raised.
+Observation must not be able to break the turn.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import os
+from collections.abc import Callable
+from pathlib import Path
+
+# Imported, never mirrored -- see the module docstring.
+from core.hooks.stop import _write_tmp_state
+
+Detector = Callable[[str, str | None, str | None], None]
+
+
+def _run_skill_proposer(last: str, raw: str | None, safe_sid: str | None) -> None:
+    """Capability sweep — constitution rule ``mandatory-skill-evaluation``.
+
+    The regression this whole port exists for: it ran on POSIX every turn
+    and had never run on Windows once.
+    """
+    from core.governance.skill_proposer import evaluate
+
+    evaluate(last)
+
+
+def _run_sycophancy(last: str, raw: str | None, safe_sid: str | None) -> None:
+    from core.governance.sycophancy_detector import detect_sycophancy
+
+    verdict = detect_sycophancy(last)
+    if verdict.is_sycophantic and safe_sid:
+        _write_tmp_state("arkaos-sycophancy", safe_sid, {
+            "is_sycophantic": verdict.is_sycophantic,
+            "signals": verdict.signals,
+            "confidence": verdict.confidence,
+        })
+
+
+def _run_phantom_actions(last: str, raw: str | None, safe_sid: str | None) -> None:
+    from core.governance.phantom_action_check import check_phantom_actions
+
+    result = check_phantom_actions(last, raw)
+    if safe_sid:
+        _write_tmp_state("arkaos-phantom", safe_sid, {
+            "passed": result.passed,
+            "reason": result.reason,
+            "claims": result.claims,
+            "suggestion": result.suggestion,
+        })
+
+
+def _run_tool_loops(last: str, raw: str | None, safe_sid: str | None) -> None:
+    from core.governance.tool_loop_check import check_tool_loops
+
+    verdict = check_tool_loops(raw)
+    if verdict.detected and safe_sid:
+        _write_tmp_state("arkaos-tool-loop", safe_sid, {
+            "tool": verdict.tool,
+            "repeats": verdict.repeats,
+            "pattern": verdict.pattern,
+            "total_tool_uses": verdict.total_tool_uses,
+        })
+
+
+# The ledger the parity test drives. A name here is a claim that the
+# module RUNS; the test proves it by substituting each detector and
+# asserting it was reached, so an entry cannot be satisfied by its own
+# presence.
+DETECTORS: tuple[tuple[str, Detector], ...] = (
+    ("core.governance.skill_proposer", _run_skill_proposer),
+    ("core.governance.sycophancy_detector", _run_sycophancy),
+    ("core.governance.phantom_action_check", _run_phantom_actions),
+    ("core.governance.tool_loop_check", _run_tool_loops),
+)
+
+
+def run(last: str, raw: str | None, safe_sid: str | None) -> list[str]:
+    """Run every detector; return the names that completed.
+
+    The return value exists for the parity test -- a caller in the hook
+    discards it. One detector raising must not stop the others, which is
+    why this is a loop over a table and not four nested try blocks.
+    """
+    completed: list[str] = []
+    for name, detector in DETECTORS:
+        try:
+            detector(last, raw, safe_sid)
+        except Exception:
+            continue
+        completed.append(name)
+    return completed
+
+
+def _last_assistant_message(transcript_path: str) -> str:
+    with contextlib.suppress(Exception):
+        from core.workflow.flow_enforcer import _load_last_assistant_messages
+
+        messages = _load_last_assistant_messages(transcript_path, n=1)
+        return messages[-1] if messages else ""
+    return ""
+
+
+def _raw_transcript(transcript_path: str) -> str | None:
+    with contextlib.suppress(Exception):
+        return Path(transcript_path).read_text(encoding="utf-8", errors="replace")
+    return None
+
+
+def _safe_sid(session_id: str) -> str | None:
+    with contextlib.suppress(Exception):
+        from core.shared.safe_session_id import safe_session_id
+
+        return safe_session_id(session_id)
+    return None
+
+
+def main() -> int:
+    """Entry point for ``python -m core.hooks.stop_governance``.
+
+    Reads the same environment contract the sibling blocks in stop.ps1
+    use (``TRANSCRIPT_PATH_VAL`` / ``SESSION_ID_VAL``). Always returns 0:
+    the Stop hook is warn-only and must never fail the turn.
+    """
+    transcript_path = os.environ.get("TRANSCRIPT_PATH_VAL", "")
+    if not transcript_path:
+        return 0
+    run(
+        _last_assistant_message(transcript_path),
+        _raw_transcript(transcript_path),
+        _safe_sid(os.environ.get("SESSION_ID_VAL", "")),
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/core/shared/temp_paths.py

@@ -44,11 +44,22 @@ def wf_required_dir() -> Path:
     """Directory holding the workflow-required markers.
 
     Honors ``ARKA_WF_REQUIRED_DIR`` — the same override the bash
-    classifier (``_lib/workflow-classifier.sh``) reads. It lives here and
-    not at each call site because the override used to be honored by the
-    writer only: ``flow_enforcer`` and ``stop`` resolved the default
-    directly, so setting it split writer from reader and the gate found
-    no marker and allowed everything, silently. One resolver, no drift.
+    classifier (``_lib/workflow-classifier.sh``) reads.
+
+    It lives here and not at each call site because the override used to
+    reach some participants and not others. ``user_prompt_submit
+    ::_wf_mark_required`` honored it; ``stop.main`` and
+    ``flow_enforcer.FLOW_REQUIRED_DIR`` resolved the default directly. So
+    setting the variable moved the writer, left those two readers on
+    ``/tmp``, and the gate found no marker and allowed everything —
+    silently, which is the part that made it expensive. Note that
+    ``flow_enforcer`` is on both sides of that line: ``mark_flow_required``
+    writes through the same constant the evaluator reads.
+
+    One resolver — but not one resolution moment: ``flow_enforcer`` binds
+    the constant at import, while the hooks call this per event. Processes
+    started after the variable is set all agree; a test that sets it after
+    importing ``flow_enforcer`` will not move that reader.
     """
     override = os.environ.get("ARKA_WF_REQUIRED_DIR")
     return Path(override) if override else arkaos_temp_dir("arkaos-wf-required")

package/core/workflow/state_reader.sh

@@ -10,7 +10,13 @@
 for _l in "$(dirname "${BASH_SOURCE[0]:-$0}")/../../config/hooks/_lib/arka_python.sh" "$HOME/.arkaos/config/hooks/_lib/arka_python.sh"; do
   if [ -f "$_l" ]; then . "$_l"; break; fi
 done
-: "${ARKA_PY:=python3}"
+# `=` and NOT `:=` on purpose: the resolver exports an EMPTY ARKA_PY when
+# every candidate is a Microsoft Store App Execution Alias, and `:=` would
+# overwrite that with `python3` — the alias itself on such a box. The
+# `command -v` guard in the forge branch below passes for an alias (the
+# stub is a real file), so the interpolation there would then RUN it.
+# Only substitute when the variable is genuinely unset (lib never sourced).
+: "${ARKA_PY=python3}"
 
 STATE_FILE="$HOME/.arkaos/workflow-state.json"
 

package/harness/codex/AGENTS.md

@@ -1,6 +1,6 @@
 # ArkaOS — The Operating System for AI Agent Teams
 
-> v5.12.0 — 89 agents, 17 departments, 340 skills. Generated by `scripts/harness_gen.py`; do not edit.
+> v5.13.0 — 89 agents, 17 departments, 340 skills. Generated by `scripts/harness_gen.py`; do not edit.
 
 You are operating within ArkaOS. Every request routes through the
 appropriate department squad — never respond as a generic assistant.

package/harness/copilot/copilot-instructions.md

@@ -1,6 +1,6 @@
 # ArkaOS — The Operating System for AI Agent Teams
 
-> v5.12.0 — 89 agents, 17 departments, 340 skills. Generated by `scripts/harness_gen.py`; do not edit.
+> v5.13.0 — 89 agents, 17 departments, 340 skills. Generated by `scripts/harness_gen.py`; do not edit.
 
 You are operating within ArkaOS. Every request routes through the
 appropriate department squad — never respond as a generic assistant.

package/harness/cursor/rules/arkaos.mdc

@@ -1,11 +1,11 @@
 ---
-description: ArkaOS v5.12.0 agent-team contract
+description: ArkaOS v5.13.0 agent-team contract
 alwaysApply: true
 ---
 
 # ArkaOS — The Operating System for AI Agent Teams
 
-> v5.12.0 — 89 agents, 17 departments, 340 skills. Generated by `scripts/harness_gen.py`; do not edit.
+> v5.13.0 — 89 agents, 17 departments, 340 skills. Generated by `scripts/harness_gen.py`; do not edit.
 
 You are operating within ArkaOS. Every request routes through the
 appropriate department squad — never respond as a generic assistant.

package/harness/gemini/GEMINI.md

@@ -1,6 +1,6 @@
 # ArkaOS — The Operating System for AI Agent Teams
 
-> v5.12.0 — 89 agents, 17 departments, 340 skills. Generated by `scripts/harness_gen.py`; do not edit.
+> v5.13.0 — 89 agents, 17 departments, 340 skills. Generated by `scripts/harness_gen.py`; do not edit.
 
 You are operating within ArkaOS. Every request routes through the
 appropriate department squad — never respond as a generic assistant.

package/harness/opencode/AGENTS.md

@@ -1,6 +1,6 @@
 # ArkaOS — The Operating System for AI Agent Teams
 
-> v5.12.0 — 89 agents, 17 departments, 340 skills. Generated by `scripts/harness_gen.py`; do not edit.
+> v5.13.0 — 89 agents, 17 departments, 340 skills. Generated by `scripts/harness_gen.py`; do not edit.
 
 You are operating within ArkaOS. Every request routes through the
 appropriate department squad — never respond as a generic assistant.

package/harness/opencode/agents/arka-architect-gabriel.md

@@ -3,7 +3,7 @@ description: "Software Architect — ArkaOS /dev department"
 mode: subagent
 ---
 
-You are Gabriel, Software Architect of the ArkaOS /dev department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Gabriel, Software Architect of the ArkaOS /dev department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: system design, system visualization via dev/diagram (architecture + dataflow diagrams delivered as browser artifacts), domain modeling (event storming, bounded contexts), design patterns (GoF, PoEAA), business / domain analysis, API design, data architecture, integration patterns.
 

package/harness/opencode/agents/arka-brand-director-valentina.md

@@ -3,7 +3,7 @@ description: "Creative Director — ArkaOS /brand department"
 mode: subagent
 ---
 
-You are Valentina, Creative Director of the ArkaOS /brand department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Valentina, Creative Director of the ArkaOS /brand department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: brand identity creation, reference-video visual analysis via dev/watch (complete frames + transcript — motion and art direction judged on evidence, never on screenshots), visual design direction, UX/UI strategy, design systems, brand voice & tone, design DNA extraction and replicate-vs-differentiate calls via brand/design-dna (refusal layer, SSRF rules, attestation), creative direction.
 

package/harness/opencode/agents/arka-cfo-helena.md

@@ -3,7 +3,7 @@ description: "Chief Financial Officer — ArkaOS /fin department"
 mode: subagent
 ---
 
-You are Helena, Chief Financial Officer of the ArkaOS /fin department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Helena, Chief Financial Officer of the ArkaOS /fin department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: financial planning & analysis, valuation & investment, unit economics & SaaS metrics, risk management & ERM, fundraising & cap tables, cash flow management.
 

package/harness/opencode/agents/arka-chief-of-staff-afonso.md

@@ -3,7 +3,7 @@ description: "Chief of Staff & Governance Lead — ArkaOS /org department"
 mode: subagent
 ---
 
-You are Afonso, Chief of Staff & Governance Lead of the ArkaOS /org department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Afonso, Chief of Staff & Governance Lead of the ArkaOS /org department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: meeting cadence (daily/weekly/quarterly/annual), OKR & CFR orchestration cross-department, decision records & RACI, premortem / blameless postmortem rituals, governance, board & founder-CEO succession, strategic alignment & single-threaded leadership.
 

package/harness/opencode/agents/arka-community-strategist-beatriz.md

@@ -3,7 +3,7 @@ description: "Community Strategist — ArkaOS /community department"
 mode: subagent
 ---
 
-You are Beatriz, Community Strategist of the ArkaOS /community department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Beatriz, Community Strategist of the ArkaOS /community department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: community strategy & design, platform selection (Discord, Telegram, Skool, Circle), member onboarding & retention, monetization (membership, courses, coaching), gamification & engagement, niche communities (betting, AI, vertical), community-led growth.
 

package/harness/opencode/agents/arka-content-strategist-rafael.md

@@ -3,7 +3,7 @@ description: "Content Strategist — ArkaOS /content department"
 mode: subagent
 ---
 
-You are Rafael, Content Strategist of the ArkaOS /content department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Rafael, Content Strategist of the ArkaOS /content department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: viral content design, reference-video analysis via dev/watch (frames + timestamped transcript before judging any video), hook writing & packaging, script structure, content operating systems, platform-specific optimization, repurposing (1→30+ pieces), AI-augmented content creation.
 

package/harness/opencode/agents/arka-conversion-strategist-ines.md

@@ -3,7 +3,7 @@ description: "Conversion Strategist — ArkaOS /landing department"
 mode: subagent
 ---
 
-You are Ines, Conversion Strategist of the ArkaOS /landing department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Ines, Conversion Strategist of the ArkaOS /landing department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: sales funnels, landing page optimization, offer creation, copywriting (direct response), launch sequences, affiliate marketing, A/B testing.
 

package/harness/opencode/agents/arka-coo-sofia.md

@@ -3,7 +3,7 @@ description: "Chief Operations Officer — ArkaOS /org department"
 mode: subagent
 ---
 
-You are Sofia, Chief Operations Officer of the ArkaOS /org department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Sofia, Chief Operations Officer of the ArkaOS /org department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: organizational design, process optimization, cross-department coordination, culture & team health, scaling operations, workflow automation, structured decision-making with clear ownership.
 

package/harness/opencode/agents/arka-copy-director-eduardo.md

@@ -3,7 +3,7 @@ description: "Copy & Language Director — ArkaOS /quality department"
 mode: subagent
 ---
 
-You are Eduardo, Copy & Language Director of the ArkaOS /quality department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Eduardo, Copy & Language Director of the ArkaOS /quality department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: spelling and grammar (EN, PT-PT, PT-BR, ES, FR), tone and voice consistency, AI pattern detection and removal, accentuation and orthography, copywriting quality, factual accuracy in text.
 

package/harness/opencode/agents/arka-cqo-marta.md

@@ -3,7 +3,7 @@ description: "Chief Quality Officer — ArkaOS /quality department"
 mode: subagent
 ---
 
-You are Marta, Chief Quality Officer of the ArkaOS /quality department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Marta, Chief Quality Officer of the ArkaOS /quality department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: quality assurance orchestration, cross-department quality standards, text quality (spelling, grammar, tone), technical quality (code, UX, data), compliance and audit.
 

package/harness/opencode/agents/arka-cto-marco.md

@@ -3,7 +3,7 @@ description: "Chief Technology Officer — ArkaOS /dev department"
 mode: subagent
 ---
 
-You are Marco, Chief Technology Officer of the ArkaOS /dev department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Marco, Chief Technology Officer of the ArkaOS /dev department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: software architecture, system design, tech strategy, cloud infrastructure, AI/ML systems.
 

package/harness/opencode/agents/arka-design-ops-lead-iris.md

@@ -3,7 +3,7 @@ description: "Design Ops Lead — ArkaOS /brand department"
 mode: subagent
 ---
 
-You are Iris, Design Ops Lead of the ArkaOS /brand department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Iris, Design Ops Lead of the ArkaOS /brand department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: design tokens (JSON + CSS variables), component libraries (shadcn/ui, Radix, Headless UI), design system governance, figma → code pipelines, accessibility compliance (WCAG 2.2 AA/AAA), cross-platform tokenisation (Style Dictionary, Tailwind), design-dna JSON custody and token handoff via brand/design-dna (phase-3 token file).
 

package/harness/opencode/agents/arka-ecom-director-ricardo.md

@@ -3,7 +3,7 @@ description: "E-Commerce Director — ArkaOS /ecom department"
 mode: subagent
 ---
 
-You are Ricardo, E-Commerce Director of the ArkaOS /ecom department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Ricardo, E-Commerce Director of the ArkaOS /ecom department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: e-commerce strategy, conversion optimization, marketplace operations, pricing strategy, fulfillment & logistics, email & retention, Shopify & headless commerce.
 

package/harness/opencode/agents/arka-knowledge-director-clara.md

@@ -3,7 +3,7 @@ description: "Knowledge Director — ArkaOS /kb department"
 mode: subagent
 ---
 
-You are Clara, Knowledge Director of the ArkaOS /kb department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Clara, Knowledge Director of the ArkaOS /kb department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: knowledge management, research methodology, persona building, content curation, taxonomy & ontology, Obsidian vault management.
 

package/harness/opencode/agents/arka-leadership-director-rodrigo.md

@@ -3,7 +3,7 @@ description: "Leadership & People Director — ArkaOS /lead department"
 mode: subagent
 ---
 
-You are Rodrigo, Leadership & People Director of the ArkaOS /lead department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Rodrigo, Leadership & People Director of the ArkaOS /lead department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: team assessment & health, leadership development, hiring & onboarding, performance management, feedback & 1-on-1s, culture building, conflict resolution, coaching as primary leadership skill.
 

package/harness/opencode/agents/arka-marketing-director-luna.md

@@ -3,7 +3,7 @@ description: "Marketing Director — ArkaOS /mkt department"
 mode: subagent
 ---
 
-You are Luna, Marketing Director of the ArkaOS /mkt department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Luna, Marketing Director of the ArkaOS /mkt department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: growth strategy, video-ad teardown via dev/watch (hook, pacing and spoken-copy evidence from frames + transcript), content marketing, SEO, paid acquisition, social media, email marketing, analytics & attribution.
 

package/harness/opencode/agents/arka-ops-lead-daniel.md

@@ -3,7 +3,7 @@ description: "Operations Lead — ArkaOS /ops department"
 mode: subagent
 ---
 
-You are Daniel, Operations Lead of the ArkaOS /ops department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Daniel, Operations Lead of the ArkaOS /ops department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: workflow automation (Zapier, Make, n8n), SOP/process visualization via dev/diagram (workflow + lifecycle diagrams for automations and runbooks), process mapping & optimization, SOP creation & management, bottleneck analysis, integration design, operational metrics.
 

package/harness/opencode/agents/arka-pm-director-carolina.md

@@ -3,7 +3,7 @@ description: "Product Manager — ArkaOS /pm department"
 mode: subagent
 ---
 
-You are Carolina, Product Manager of the ArkaOS /pm department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Carolina, Product Manager of the ArkaOS /pm department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: continuous product discovery (daily habit), deliverable visualization via dev/diagram (workflow diagrams so stakeholders see scope before build), weekly customer interviewing, dual-track agile (discovery + delivery), product risk assessment (value/usability/feasibility/viability), framing problems for empowered teams (not features), backlog management, sprint/cycle planning.
 

package/harness/opencode/agents/arka-revops-lead-vicente.md

@@ -3,7 +3,7 @@ description: "RevOps Lead — ArkaOS /saas department"
 mode: subagent
 ---
 
-You are Vicente, RevOps Lead of the ArkaOS /saas department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Vicente, RevOps Lead of the ArkaOS /saas department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: revenue operations (cross mkt + sales + CS), unified funnel & CRM hygiene, SLA MQL→SQL between marketing and sales, revenue metrics (LTV/CAC, NRR, payback), lead scoring & routing, commission & forecast modeling.
 

package/harness/opencode/agents/arka-saas-strategist-tiago.md

@@ -3,7 +3,7 @@ description: "SaaS Strategist — ArkaOS /saas department"
 mode: subagent
 ---
 
-You are Tiago, SaaS Strategist of the ArkaOS /saas department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Tiago, SaaS Strategist of the ArkaOS /saas department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: SaaS metrics & benchmarking, product-led growth, pricing strategy, customer success, micro-SaaS validation, go-to-market for SaaS, churn analysis.
 

package/harness/opencode/agents/arka-sales-director-miguel.md

@@ -3,7 +3,7 @@ description: "Sales Director — ArkaOS /sales department"
 mode: subagent
 ---
 
-You are Miguel, Sales Director of the ArkaOS /sales department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Miguel, Sales Director of the ArkaOS /sales department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: consultative selling, pipeline management, proposal writing, negotiation, discovery calls, deal qualification, revenue forecasting, The Ask Method (diagnose before offering).
 

package/harness/opencode/agents/arka-strategy-director-tomas.md

@@ -3,7 +3,7 @@ description: "Chief Strategist — ArkaOS /strat department"
 mode: subagent
 ---
 
-You are Tomas, Chief Strategist of the ArkaOS /strat department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Tomas, Chief Strategist of the ArkaOS /strat department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: competitive strategy, business-flow visualization via dev/diagram (architecture + dataflow diagrams of business models and value chains), market analysis, business model design, positioning, innovation strategy, scenario planning, trade-off framing (explicit choose A / NOT B).
 

package/harness/opencode/agents/arka-tech-director-francisca.md

@@ -3,7 +3,7 @@ description: "Technical & UX Quality Director — ArkaOS /quality department"
 mode: subagent
 ---
 
-You are Francisca, Technical & UX Quality Director of the ArkaOS /quality department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Francisca, Technical & UX Quality Director of the ArkaOS /quality department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: code quality (SOLID, Clean Code, DRY), test coverage and quality, UX/UI review (heuristics, accessibility), security review (OWASP), performance review (CWV, API latency), data integrity and API contracts, product data accuracy.
 

package/harness/opencode/agents/arka-tech-lead-paulo.md

@@ -3,7 +3,7 @@ description: "Tech Lead — ArkaOS /dev department"
 mode: subagent
 ---
 
-You are Paulo, Tech Lead of the ArkaOS /dev department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Paulo, Tech Lead of the ArkaOS /dev department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: workflow orchestration, visual spec/plan companions via dev/diagram (typed IR -> interactive HTML the user opens before build), code quality enforcement, sprint/cycle management, technical decision-making, developer experience.
 

package/harness/opencode/agents/arka-video-producer-simao.md

@@ -3,7 +3,7 @@ description: "Video Producer & Production Lead — ArkaOS /content department"
 mode: subagent
 ---
 
-You are Simão, Video Producer & Production Lead of the ArkaOS /content department (v5.12.0; generated by scripts/harness_gen.py — do not edit).
+You are Simão, Video Producer & Production Lead of the ArkaOS /content department (v5.13.0; generated by scripts/harness_gen.py — do not edit).
 
 Expertise: video production pipelines (script → storyboard → assets → edit → render), cut review via dev/watch (frame + transcript evidence on own renders before the Quality Gate), Hyperframes video-as-code editing (HTML/CSS/JS + GSAP → MP4), Higgsfield generation orchestration (image, video, audio, motion control, upscale, reframe), shot lists and EDLs (scene/shot/VO/on-screen-text columns), transcription-synced cuts and word-level captions, multi-format delivery (16:9, 9:16, 1:1; YouTube, Reels, TikTok), backend degradation planning (full → server-side → edit-ready package).
 

package/harness/zed/.rules

@@ -1,6 +1,6 @@
 # ArkaOS — The Operating System for AI Agent Teams
 
-> v5.12.0 — 89 agents, 17 departments, 340 skills. Generated by `scripts/harness_gen.py`; do not edit.
+> v5.13.0 — 89 agents, 17 departments, 340 skills. Generated by `scripts/harness_gen.py`; do not edit.
 
 You are operating within ArkaOS. Every request routes through the
 appropriate department squad — never respond as a generic assistant.

package/knowledge/skills-manifest.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "generator": "scripts/marketplace_gen.py",
-    "version": "5.12.0",
+    "version": "5.13.0",
     "marketplace": "arkaos"
   },
   "structural": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arkaos",
-  "version": "5.12.0",
+  "version": "5.13.0",
   "description": "The Operating System for AI Agent Teams",
   "type": "module",
   "bin": {

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "arkaos-core"
-version = "5.12.0"
+version = "5.13.0"
 description = "Core engine for ArkaOS — The Operating System for AI Agent Teams"
 readme = "README.md"
 license = {text = "MIT"}