claude-dev-env 8.1.0 → 8.3.0

package/docs/CODE_RULES.md

@@ -2,7 +2,7 @@
 
 The canonical review-criteria instruction set for every AI agent that audits pull requests in this repository, loaded on demand. [`.cursor/BUGBOT.md`](../../../.cursor/BUGBOT.md) is the checked-in pointer file Cursor BugBot reads; it points here.
 
-⚡ marks rules enforced by hand-maintained `code_rules_enforcer.py` — the hook blocks the Write/Edit and returns the corrective detail at violation time, so this document lists those rules by name only. Session policy (question routing, task tracking) lives in `rules/*.md`; see [`code-standards.md`](../rules/code-standards.md).
+⚡ marks rules the hand-maintained `code_rules_enforcer.py` carries. The staged policy lint runs it over each changed file and returns the corrective detail, so this document lists those rules by name only. Session policy (question routing, task tracking) lives in `rules/*.md`; see [`code-standards.md`](../rules/code-standards.md).
 
 ---
 
@@ -25,9 +25,9 @@ Production and tests follow one rule. Changed directive, TODO, FIXME, HACK, XXX,
 
 ---
 
-## ⚡ HOOK-ENFORCED RULES
+## ⚡ LINT-ENFORCED RULES
 
-`code_rules_enforcer.py` blocks each of these at Write/Edit and explains the specific violation when it fires; exact patterns and exemption lists live in the hook:
+The staged policy lint reports each of these through `code_rules_enforcer.py` and names the specific breach; exact patterns and exemption lists live in that module:
 
 no new comments · imports at top · logging format args (`log_*("...", arg)`) · no `%s`/`%d` printf tokens in a `str.format`-logger message (`log_*` imported from `automation_logging`; `str.format` drops the args — use `{}`) · no magic values in production bodies (0, 1, -1 exempt) · UPPER_SNAKE constants only in `config/` (exempt: `config/*`; `/migrations/`; Workflow registries: path contains any of these substrings — `/workflow/`, `_tab.py`, `/states.py`, or `/modules.py`, each matching independently as a substring, so `pkg/states.py` qualifies while a top-level `states.py` follows the standard `config/` rule; test files — path or filename matches `test_`, `_test.`, `.spec.`, `conftest`, or `/tests/`) · no hardcoded user home paths · guarded `sys.path.insert` · banned identifiers (`ctx`, `cfg`, `msg`, `btn`, `idx`, `cnt`, `tmp`, `elem`, `val`) · banned function prefixes (`handle_`, `process_`, `manage_`, `do_`) · no type escape hatches (`Any` import, `cast()`, inline `Any`, a parameter typed bare `object` whose body reads `param.attribute`) outside boundary files · no bare/broad `except` · no `Any` in signatures or class attributes · no stub bodies (`pass`/`...`/`raise NotImplementedError`) outside abstract/Protocol · TypedDict `_encode_*`/`_decode_*` companions in the same module · no test-mode branching in production (use dependency injection) · no thin wrapper modules · Google-style docstrings on public functions with `Args:` matching the signature · boolean names prefixed `is_`/`has_`/`should_`/`can_`/`was_`/`did_` (assignments AND bool-typed parameters) · must-check returns (`find_and_click`, `write_outcome`) assigned and checked · known pytest fixture parameters in test files annotated with their single documented type (`tmp_path: Path`, `monkeypatch: pytest.MonkeyPatch`, `capsys`, `caplog`, `request`, …) · known pytest fixture parameters a test function declares but never references (drop the unused parameter — pytest still pays its setup cost) · JavaScript/TypeScript boolean declarations (`const`/`let`/`var` bound to a boolean literal or negation) and `@param {boolean}` JSDoc names prefixed `is`/`has`/`should`/`can`/`was`/`did` (camelCase forms) · banned identifiers as `.mjs`/`.js` declaration names (`result`, `data`, `ctx`, `msg`, …), scoped to changed lines · in test files, banned identifiers fire on changed lines, and pytest-collectable `test_*` functions need a return annotation · unused module-level imports and unsorted import blocks are ruff's job (F401, isort I001), not this hook's · a `hooks/blocking/` command classifier anchors its multi-word command regex to the command start (`^`/`\A`) or tokenizes the first word (`shlex.split`), never matching a command as a bare substring
 
@@ -53,7 +53,7 @@ The banned-noun check applies to public function definitions, parameters, and bo
 
 ## 6. COMPLETE TYPE HINTS
 
-ALL parameters typed, ALL returns typed. No `Any`. Avoid `# type: ignore`; remove it and use a typed boundary or real type. Prefer fixing the type over an ignore when a real annotation is available.
+ALL parameters typed, ALL returns typed. No `Any`. Avoid `# type: ignore`; remove it and use a typed boundary or the type. Prefer fixing the type over an ignore when an annotation is available.
 
 ## 6.5 FILE LENGTH GUIDANCE
 
@@ -83,7 +83,7 @@ Components own their complete feature (state, modals, overlays, toasts). Parents
 
 ## 9.5 NO THIN WRAPPER MODULES
 
-A non-`__init__.py` module whose body is only imports (optionally `__all__`) is indirection without payload — callers import the real module. `__init__.py` is the canonical re-export surface and is exempt.
+A non-`__init__.py` module whose body is only imports (optionally `__all__`) is indirection without payload — callers import the module. `__init__.py` is the canonical re-export surface and is exempt.
 
 ## 9.6 NO BACKWARDS-COMPATIBILITY SHIMS
 
@@ -111,7 +111,7 @@ If you already have the data, don't fetch it again.
 
 ## 11.5 VALIDATION-PHASE PRECEDENCE
 
-`code_rules_enforcer.py` decides what a run checks and reports along three independent axes. Each axis filters a narrower scope than the one before it; none widens what the axis before it already decided.
+A staged policy lint run of `code_rules_enforcer.py` selects what it checks and reports along three independent axes. Each axis filters a narrower scope than the one before it; none widens what the axis before it already decided.
 
 1. **Phase selects the roster.** `EDIT_LANE_PHASE` or `FULL_GATE_PHASE` decides which checks exist in the lane at all. `validate_content_for_phase` takes `phase` keyword-only with no default, so every caller names its lane explicitly.
 2. **Target classification filters within a lane.** The hook-infrastructure patterns and the ephemeral-path check decide whether a target is validated, and with which subset. Classification narrows a lane; it never adds a check the phase already excluded.
@@ -127,6 +127,6 @@ Hook-infrastructure targets run three checks in the edit lane — `check_same_fi
 
 Three surfaces report on the roster, and each reports a specific thing:
 
-- `hooks/validators/hook_timing_harness.py` builds a `Write` payload against a target that already holds content. `_contents_for_validation` returns `None` for that payload, so the harness times interpreter start and hook dispatch. Time an `Edit` payload against a real file to measure the checks.
+- `hooks/validators/hook_timing_harness.py` builds a `Write` payload against a target that already holds content. `_contents_for_validation` returns `None` for that payload, so the harness times interpreter start and hook dispatch. Time an `Edit` payload against a file to measure the checks.
 - `~/.claude/logs/hook-blocks.log` records the denials raised by fixtures in `test_code_rules_enforcer_*.py` and by the timing harness's default target.
 - `hooks/validators/run_all_validators.py` stages the target under a temporary root and rebuilds the shortest path tail that carries every exemption signal. The walk starts at the target's own project root and skips a directory pytest generated for its own scratch tree, so the staged path reads the same wherever `--basetemp` places that tree.

package/docs/TEST_QUALITY.md

@@ -85,7 +85,7 @@
 
 **Mock too much** - Prefer integration tests
 - Bad: Mock every hook and function
-- Good: Render with real hooks, mock only API calls
+- Good: Render with unmocked hooks, mock only API calls
 
 **Test implementation details** - Test what user experiences
 - Bad: Assert on state values, hook return values

package/docs/nas-ssh-invocation.md

@@ -66,7 +66,7 @@ running anything.
 The NAS is a Linux box and this machine is Windows, so two classes of difference show up only there:
 syntax newer than the NAS interpreter accepts, and tests that assert Windows paths.
 
-**Always separate a real break from a platform-only one.** Run the same test file at the branch head
+**Always separate a break in the code from a platform-only one.** Run the same test file at the branch head
 and at the commit the work started from. Identical failures at both mean the environment, not the
 change. Report both numbers rather than the head alone.
 

package/docs/references/advisor-tool.md

@@ -6,7 +6,7 @@ Source bones: [Anthropic Advisor tool](https://platform.claude.com/docs/en/agent
 
 ## What it is
 
-`/team-advisor` is the repository's advisor implementation. It carries the full first packet explicitly, sends later deltas, and owns the warm Agent/SendMessage or read-only Sol CLI lifecycle.
+`/team-advisor` is the repository's advisor implementation. On a Claude host with the built-in `advisor` tool on, it calls `advisor()`, which reads the whole transcript. Otherwise it carries the full first packet explicitly, sends later deltas, and owns the warm Agent/SendMessage or read-only Astra CLI lifecycle.
 
 See `team-advisor-skill.md` for the bind and lifecycle map.
 
@@ -57,7 +57,7 @@ When the consult path supports a free-text brief, append:
 
 `(Advisor: please keep your guidance under 80 words — I need a focused starting point, not a comprehensive plan.)`
 
-Size the ask at roughly 80 percent of the true ceiling; direct address to the advisor lands more reliably than a third-person description.
+Size the ask at roughly 80 percent of the ceiling; direct address to the advisor lands more reliably than a third-person description.
 
 ## Related
 

package/docs/references/prose-style-enforcement.md

@@ -10,7 +10,7 @@ The flag is `PROSE_STYLE_ENFORCEMENT_ENABLED` in `hooks/blocking/config/prose_st
 
 ## Always on
 
-Historical/comparative language detection in `state_description_blocker.py` runs unconditionally and does not read this flag. Apply `rules/asd-ste100-language.md` for user-facing word choice and sentence style. Code-rules and security blockers are out of scope for this switch.
+Historical and comparative language detection lives in `state_description_blocker.py`, which the staged policy lint applies under its state-description rule whatever this flag holds. Apply `rules/asd-ste100-language.md` for user-facing word choice and sentence style. Code-rules and security blockers are out of scope for this switch.
 
 ## Hedging claims
 

package/docs/references/team-advisor-skill.md

@@ -1,6 +1,6 @@
 # Team-advisor skill
 
-`/team-advisor` binds one standing warm advisor for this session at the strongest reachable tier. It sends explicit packets to a warm Agent/SendMessage advisor or the read-only `codex_astra_advisor.py` helper.
+`/team-advisor` binds one advisor for this session. On a Claude host with the built-in `advisor` tool on, it calls `advisor()`. Otherwise it binds a standing warm advisor at the strongest reachable tier and sends explicit packets to a warm Agent/SendMessage advisor or the read-only `codex_astra_advisor.py` helper.
 
 ## Refs
 
@@ -17,4 +17,4 @@ Follow the call rules in `advisor-tool.md` (orientation first, then consult befo
 
 ## Selected path
 
-`/team-advisor` is the repository's advisor implementation. It provides explicit first-consult packets, delta consults, a standing warm reviewer, an in-session Astra spawn on Codex, and a read-only Astra CLI option.
+`/team-advisor` is the repository's advisor implementation. It uses the built-in advisor tool when the session has it. Without the tool, it provides explicit first-consult packets, delta consults, a standing warm reviewer, an in-session Astra spawn on Codex, and a read-only Astra CLI option.

package/docs/references/weak-executor-advisor.md

@@ -30,7 +30,7 @@ carries its own packet:
 
 - **First consult** — use the complete packet in
   `~/.claude/_shared/advisor/reference/consult-format.md`: assignment,
-  desired outcome, constraints and exclusions, actions taken in order, real
+  desired outcome, constraints and exclusions, actions taken in order,
   output and current state, decision or blocker, validation evidence,
   unresolved risks, and load-bearing paths or excerpts.
 - **Later consults** — the delta since the last consult.

package/docs/subagent-model-routing.md

@@ -53,15 +53,16 @@ The matching replacement is:
 }
 ```
 
-Unknown values, invalid policy data, and unavailable replacement models stop the
-spawn with a short diagnostic. Parent inheritance stays unchanged.
+Unknown values, invalid policy data, unavailable replacement models, and
+unresolved parent inheritance stop the spawn with a short diagnostic.
 
 The direct spawn hook and advisor bridge use the same shared resolver. A Sol
 Medium remap changes only the model and effort fields in the hook's tool input.
 The hook returns an allow decision with the updated input and emits no remap
-notice. Luna High, Xhigh, and Max and Astra Low and Medium keep their routes.
-Trusted advisors also keep Astra High. A worker request for Sol without an
-effort stops because Sol has no approved pair to supply a default effort.
+notice when the selected model matches `gpt-*-luna`. Any route that resolves to
+another model is denied unless the tool input carries the explicit
+`flags: ["--advisor"]` bypass. Parent inheritance is denied because the hook
+cannot verify the inherited model before the spawn.
 
 The hook blocks advisor role claims because the current Codex hook input has no
 host-provided role binding. The Python advisor bridge passes trusted session

package/hooks/blocking/tdd_enforcer.py

@@ -4,9 +4,8 @@ Blocks a write to a production source file when no matching test was modified
 within the freshness window, enforcing "TDD IS NON-NEGOTIABLE" from CLAUDE.md.
 The gate records each candidate test's content hash at every sighting and
 compares that hash on the next write. A first sighting requires content that
-differs from HEAD. A recorded failing pytest run, written by
-``hooks/observability/test_failure_recorder.py``, is read before that fallback
-and applies while the candidate's content still matches what failed.
+differs from HEAD. A stored failing pytest run is read before that fallback
+and applies while the candidate's content still matches the stored hash.
 Each concern lives in a ``tdd_enforcer_parts`` submodule; this entry wires them
 into one PreToolUse gate and re-exports their surface for the test suite.
 """

package/hooks/blocking/test_bash_post_call_dispatcher.py

@@ -2,8 +2,7 @@
 
 One interpreter start runs every hosted PostToolUse hook a Bash call fires.
 The unit tests pin selection and call order with a fake
-runner; the end-to-end test drives the real hosted hooks through a real
-payload and confirms the recorder's own real side effect lands.
+runner; the end-to-end test checks that an ordinary Bash call stays silent.
 ``hooks/conftest.py`` already puts the hooks and blocking directories on
 sys.path for test collection, so this file needs no bootstrap of its own.
 """
@@ -23,12 +22,9 @@ from bash_post_call_dispatcher import (
 )
 from hooks_constants.bash_pre_tool_use_dispatcher_constants import BASH_TOOL_NAME
 from hooks_constants.hosted_hook_runner import HostedHookRun
-from tdd_enforcer_parts import content_hash_store
 
 _ALL_EXPECTED_ROSTER_PATHS = [
-    "observability/test_failure_recorder.py",
     "advisory/pr_done_reminder.py",
-    "advisory/msys_path_conversion_advisor.py",
 ]
 
 
@@ -63,11 +59,9 @@ def test_dispatch_forwards_hosted_hook_additional_context_as_one_payload(
     monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
 ) -> None:
     context_by_hook = {
-        "test_failure_recorder.py": "",
         "pr_done_reminder.py": json.dumps(
             {"hookSpecificOutput": {"hookEventName": "PostToolUse", "additionalContext": "PR #42"}}
         ),
-        "msys_path_conversion_advisor.py": "",
     }
 
     def _fake_run_hook(script_path: str, payload_text: str) -> HostedHookRun:
@@ -124,29 +118,18 @@ def test_main_exits_zero_and_writes_nothing_to_stdout(
     assert capsys.readouterr().out == ""
 
 
-def test_end_to_end_real_hosted_hooks_record_a_real_pytest_failure(tmp_path: Path) -> None:
-    """Drive the real recorder through the dispatcher."""
-    test_file = tmp_path / "test_orders.py"
-    test_file.write_text("def test_fulfill(): assert False\n")
-    session_id = "post-dispatcher-session"
-    failing_output = (
-        "Error: Exit code 1\n"
-        "FAILED test_orders.py::test_fulfill - AssertionError\n"
-        "1 failed in 0.02s"
-    )
+def test_end_to_end_hosted_hooks_leave_an_ordinary_call_silent(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str]
+) -> None:
     payload = json.dumps(
         {
-            "session_id": session_id,
             "cwd": str(tmp_path),
             "tool_name": "Bash",
-            "tool_input": {"command": "pytest test_orders.py"},
-            "tool_response": failing_output,
+            "tool_input": {"command": "git status"},
+            "tool_response": {"stdout": "clean", "stderr": ""},
         }
     )
 
     dispatch(payload, BASH_TOOL_NAME)
 
-    state_file = content_hash_store._state_file_path(session_id, str(tmp_path))
-    state = json.loads(state_file.read_text())
-    entry = state[content_hash_store._state_key_for(test_file)]
-    assert entry[content_hash_store.STORED_FAILURE_EXIT_STATUS_KEY] == 1
+    assert capsys.readouterr().out == ""

package/hooks/blocking/test_code_rules_enforcer_magic_allowlist.py

@@ -1,4 +1,4 @@
-"""Tests for magic-value allowlist alignment with CODE_RULES §HOOK-ENFORCED.
+"""Tests for magic-value allowlist alignment with CODE_RULES §LINT-ENFORCED.
 
 CODE_RULES.md states that only
 0, 1, and -1 (plus their float forms 0.0, 1.0) are exempt from the

package/hooks/hooks_constants/bash_post_call_dispatcher_constants.py

@@ -15,7 +15,6 @@ from __future__ import annotations
 
 from hooks_constants.bash_pre_tool_use_dispatcher_constants import (
     ALL_BASH_AND_POWERSHELL_TOOL_NAMES,
-    ALL_BASH_ONLY_TOOL_NAMES,
     BashHostedHookEntry,
 )
 
@@ -30,9 +29,7 @@ __all__ = [
 ]
 
 ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES: tuple[BashHostedHookEntry, ...] = (
-    BashHostedHookEntry("observability/test_failure_recorder.py", ALL_BASH_ONLY_TOOL_NAMES),
     BashHostedHookEntry("advisory/pr_done_reminder.py", ALL_BASH_AND_POWERSHELL_TOOL_NAMES),
-    BashHostedHookEntry("advisory/msys_path_conversion_advisor.py", ALL_BASH_ONLY_TOOL_NAMES),
 )
 
 EXIT_CODE_ERROR_PREFIX: str = "Error: Exit code "

package/hooks/hooks_constants/hosted_hook_runner.py

@@ -89,7 +89,7 @@ def resolved_hook_script_path(relative_path: str) -> str:
 
     ::
 
-        "observability/test_failure_recorder.py" -> <hooks>/observability/...
+        "advisory/pr_done_reminder.py" -> <hooks>/advisory/pr_done_reminder.py
 
     The root comes from this module's own location, so every dispatcher
     resolves against the same directory however deep it sits.

package/hooks/hooks_constants/msys_path_conversion_advisor_constants.py

@@ -1,48 +1,16 @@
-"""Constants for the MSYS path-conversion context advisory.
-
-The advisory is a PostToolUse observer on Bash. It never blocks. When a git
-call fails because Git Bash rewrote a ``<rev>:<path>`` argument before git saw
-it, the advisory adds one loud note naming the two exports that turn the
-rewriting off.
-"""
+"""Shared environment variable names for the MSYS path-conversion rewriter."""
 
 from __future__ import annotations
 
 __all__ = [
-    "ALL_MANGLED_ARGUMENT_MARKERS",
-    "MANGLED_ARGUMENT_CLOSING_QUOTE",
-    "ALL_MSYS_MANGLING_CHARACTERS",
     "ALL_MSYS_PATH_CONVERSION_VARIABLE_NAMES",
-    "ADVISORY_HEADER",
-    "MANGLED_ARGUMENT_LINE_TEMPLATE",
-    "MANGLING_EXPLANATION_LINE",
-    "FIX_LINE",
-    "SAME_COMMAND_LINE",
-    "ADVISORY_LINE_SEPARATOR",
+    "MSYS_PATH_CONVERSION_VARIABLE_NAME",
+    "MSYS_ARGUMENT_CONVERSION_EXCLUSION_VARIABLE_NAME",
 ]
 
-AMBIGUOUS_ARGUMENT_MARKER: str = "fatal: ambiguous argument '"
-INVALID_OBJECT_NAME_MARKER: str = "fatal: invalid object name '"
-ALL_MANGLED_ARGUMENT_MARKERS: tuple[str, ...] = (
-    AMBIGUOUS_ARGUMENT_MARKER,
-    INVALID_OBJECT_NAME_MARKER,
-)
-MANGLED_ARGUMENT_CLOSING_QUOTE: str = "'"
-ALL_MSYS_MANGLING_CHARACTERS: frozenset[str] = frozenset({"\\", ";"})
 MSYS_PATH_CONVERSION_VARIABLE_NAME: str = "MSYS_NO_PATHCONV"
 MSYS_ARGUMENT_CONVERSION_EXCLUSION_VARIABLE_NAME: str = "MSYS2_ARG_CONV_EXCL"
 ALL_MSYS_PATH_CONVERSION_VARIABLE_NAMES: tuple[str, ...] = (
     MSYS_PATH_CONVERSION_VARIABLE_NAME,
     MSYS_ARGUMENT_CONVERSION_EXCLUSION_VARIABLE_NAME,
 )
-MSYS_EXPORT_FIX_LINE: str = "export MSYS_NO_PATHCONV=1 MSYS2_ARG_CONV_EXCL='*'"
-
-ADVISORY_HEADER: str = "=== MSYS PATH CONVERSION (context reminder, never a block) ==="
-MANGLED_ARGUMENT_LINE_TEMPLATE: str = "Git saw:     {argument}"
-MANGLING_EXPLANATION_LINE: str = (
-    "Git Bash rewrote a <rev>:<path> argument before git saw it, turning the "
-    "colon into a semicolon and the slashes into backslashes."
-)
-FIX_LINE: str = "Fix:         " + MSYS_EXPORT_FIX_LINE
-SAME_COMMAND_LINE: str = "Put that export and the git command in the same command."
-ADVISORY_LINE_SEPARATOR: str = "\n"

package/hooks/hooks_constants/test_bash_post_call_dispatcher_constants.py

@@ -7,29 +7,21 @@ from hooks_constants.bash_post_call_dispatcher_constants import (
 from hooks_constants.bash_pre_tool_use_dispatcher_constants import BASH_TOOL_NAME
 
 
-def test_roster_runs_the_recorder_then_the_pr_reminder_then_the_msys_advisor() -> None:
+def test_roster_runs_the_pr_reminder() -> None:
     all_script_paths = [
         each_entry.script_relative_path for each_entry in ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES
     ]
     assert all_script_paths == [
-        "observability/test_failure_recorder.py",
         "advisory/pr_done_reminder.py",
-        "advisory/msys_path_conversion_advisor.py",
     ]
 
 
 def test_pr_done_reminder_also_serves_the_powershell_tool() -> None:
-    reminder_entry = ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES[1]
+    reminder_entry = ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES[0]
     assert reminder_entry.script_relative_path == "advisory/pr_done_reminder.py"
     assert "PowerShell" in reminder_entry.applicable_tool_names
 
 
-def test_msys_advisor_serves_the_bash_tool_only() -> None:
-    advisor_entry = ALL_BASH_POST_TOOL_USE_HOSTED_HOOK_ENTRIES[-1]
-    assert advisor_entry.script_relative_path == "advisory/msys_path_conversion_advisor.py"
-    assert advisor_entry.applicable_tool_names == frozenset({"Bash"})
-
-
 def test_context_forwarding_keys_match_the_hook_output_contract() -> None:
     assert constants.POST_TOOL_USE_HOOK_EVENT_NAME == "PostToolUse"
     assert constants.HOOK_SPECIFIC_OUTPUT_KEY == "hookSpecificOutput"

package/hooks/routing/subagent_model_routing.mjs

@@ -16,6 +16,13 @@ export function buildSubagentModelRoutingResponse(hookPayload, routingOptions =
     if (routingDecision.status === 'blocked') {
         return buildBlockedResponse(routingDecision.diagnostic);
     }
+    if (routingDecision.status === 'inherited') {
+        return buildBlockedResponse('subagent model must resolve to gpt-*-luna');
+    }
+    if (!hasAdvisorBypass(hookPayload.tool_input)
+        && !isLunaModel(routingDecision.selected?.model)) {
+        return buildBlockedResponse('only gpt-*-luna subagents are permitted');
+    }
     if (routingDecision.status !== 'remapped') return {};
 
     return buildAllowResponse(routingDecision.updatedInput);
@@ -52,6 +59,14 @@ function isTargetSubagentTool(hookPayload) {
     return hookPayload.tool_name === targetToolName;
 }
 
+function isLunaModel(model) {
+    return typeof model === 'string' && /^gpt-.+-luna$/i.test(model);
+}
+
+function hasAdvisorBypass(toolInput) {
+    return Array.isArray(toolInput?.flags) && toolInput.flags.includes('--advisor');
+}
+
 function buildAllowResponse(updatedInput) {
     return {
         hookSpecificOutput: {

package/hooks/routing/subagent_model_routing.test.mjs

@@ -122,32 +122,65 @@ test('blocks malformed policy, unknown input, unavailable replacement, and untru
     }
 });
 
-for (const [eachModel, eachEffort, eachSelectedModel, eachSelectedEffort] of [
-    ['Sol', 'medium', 'gpt-5.6-luna', 'max'],
-    ['Astra', 'high', 'gpt-6-astra', 'high'],
-]) {
-    test(`allows a trusted session advisor requesting ${eachModel} ${eachEffort}`, () => {
-        const hookResponse = buildSubagentModelRoutingResponse(
-            buildHookPayload({
-                agent_type: 'session-advisor',
-                model: eachModel,
-                reasoning_effort: eachEffort,
-            }),
-            {
-                trustedSessionMetadata: {
-                    authorized: true,
-                    registeredAgentType: 'session-advisor',
-                },
+test('blocks a trusted session advisor route that resolves to Astra', () => {
+    const hookResponse = buildSubagentModelRoutingResponse(
+        buildHookPayload({
+            agent_type: 'team-advisor',
+            model: 'Astra',
+            reasoning_effort: 'high',
+        }),
+        {
+            trustedSessionMetadata: {
+                authorized: true,
+                registeredAgentType: 'team-advisor',
             },
-        );
+        },
+    );
 
-        assert.deepEqual(hookResponse.hookSpecificOutput.updatedInput, {
-            agent_type: 'session-advisor',
-            model: eachSelectedModel,
-            reasoning_effort: eachSelectedEffort,
-        });
+    assert.equal(hookResponse.hookSpecificOutput.permissionDecision, 'deny');
+    assert.equal(
+        hookResponse.hookSpecificOutput.permissionDecisionReason,
+        'only gpt-*-luna subagents are permitted',
+    );
+});
+
+test('allows an Astra route when the explicit advisor flag is present', () => {
+    const toolInput = {
+        model: 'Astra',
+        reasoning_effort: 'high',
+        flags: ['--advisor'],
+    };
+    const hookResponse = buildSubagentModelRoutingResponse(buildHookPayload(toolInput));
+    assert.deepEqual(hookResponse.hookSpecificOutput.updatedInput, {
+        model: 'gpt-6-astra',
+        reasoning_effort: 'low',
+        flags: ['--advisor'],
     });
-}
+});
+
+test('does not treat unrelated flags as an advisor bypass', () => {
+    const hookResponse = buildSubagentModelRoutingResponse(buildHookPayload({
+        model: 'Astra',
+        reasoning_effort: 'high',
+        flags: ['--worker'],
+    }));
+    assert.equal(hookResponse.hookSpecificOutput.permissionDecision, 'deny');
+    assert.equal(
+        hookResponse.hookSpecificOutput.permissionDecisionReason,
+        'only gpt-*-luna subagents are permitted',
+    );
+});
+
+test('blocks parent inheritance because the selected model is unresolved', () => {
+    const hookResponse = buildSubagentModelRoutingResponse(buildHookPayload({
+        model: 'inherit-parent',
+    }));
+    assert.equal(hookResponse.hookSpecificOutput.permissionDecision, 'deny');
+    assert.equal(
+        hookResponse.hookSpecificOutput.permissionDecisionReason,
+        'subagent model must resolve to gpt-*-luna',
+    );
+});
 
 test('the standalone hook silently remaps native Sol Medium and preserves other fields', () => {
     const hookExecution = spawnSync(
@@ -183,7 +216,7 @@ test('the standalone hook silently remaps native Sol Medium and preserves other
 
 test('a session advisor name without trusted session metadata is blocked', () => {
     const hookResponse = buildSubagentModelRoutingResponse(buildHookPayload({
-        agent_type: 'session-advisor',
+        agent_type: 'team-advisor',
         model: 'Astra',
         reasoning_effort: 'high',
     }));
@@ -222,7 +255,7 @@ test('the standalone hook command blocks an advisor without host metadata', () =
         {
             encoding: 'utf8',
             input: JSON.stringify(buildHookPayload({
-                agent_type: 'session-advisor',
+                agent_type: 'team-advisor',
                 model: 'Astra',
                 reasoning_effort: 'high',
             })),

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.1.0",
+    "version": "8.3.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/rules/archiving-agent-config.md

@@ -45,18 +45,15 @@ to be reconstructed from the diff is not recoverable in any useful sense.
 
 ## Make the archive stick
 
-Three things do not follow the file on their own.
+Two things do not follow the file on their own.
 
 **A skill's name stays in `bin/ever-shipped-skills.mjs`.** The prune computes
 the retired set as every name ever shipped minus the names installed now, and
 that is how a stale copy is moved out of a host's agents home. Delete the name
-and the copy is stranded on every machine that has it.
-
-**Add the archived name to the banned active-capability list.** The reference
-checker in `scripts/active_capability_references.py` does not resolve a named
-capability against the shipped inventory; it reports a name only when that name
-sits on `ALL_BANNED_ACTIVE_CAPABILITY_NAMES`. Until the archived name is on that
-list, every leftover mention of it passes.
+and the copy is stranded on every machine that has it. The reference checker in
+`scripts/active_capability_references.py` derives its retired set the same way,
+so the registry entry is also what makes a leftover mention of the archived
+name report. No second list needs the name.
 
 **A renamed skill directory takes its tests out of the run.** The node test
 command globs `.agents/skills/**/*.test.mjs`, so a suite under an archived skill

package/rules/git-workflow.md

@@ -25,12 +25,12 @@ the next run. The merge stays in the repository. No tag is cut and the package n
 
 Spot one by its head branch, which starts `release-please--branches--`, or by a body that
 opens with the bot's own marker line. The description rules in this file, the
-`pr-description-writer` agent, and the house wording style all step aside for it. The
+`pstack:poteto-agent` writing brief, and the house wording style all step aside for it. The
 failure signature in the release job log reads
 `could not parse pull request body as a release PR`.
 
-The `pr-description-writer` agent writes a title and body from the diff when
-you want one. Publish the title and body file through
+`pstack:poteto-agent` writes a title and body from the diff when you want one.
+Publish the title and body file through
 `~/.agents/skills/pull-request/scripts/pull_request.py`. That path is under the
 agents home, not the repository. A worktree holds no `.agents/` copy.
 

package/rules/long-horizon-autonomy.md

@@ -12,7 +12,7 @@ This is the autonomous-run partner to the ambiguous case: research and recommend
 
 ## Do not end a turn on a promise
 
-Pause for the user only when the work truly needs them: a destructive or irreversible action, a scope change, or input only they can give. When you hit one, ask through `AskUserQuestion` and end the turn. Do not end on a promise about work you have not done.
+Pause for the user only when the work needs them: a destructive or irreversible action, a scope change, or input only they can give. When you hit one, ask through `AskUserQuestion` and end the turn. Do not end on a promise about work you have not done.
 
 A pause is a request you deliver, not a state you enter. Put it in the channel the user reads, name the one input you need and what resumes the moment it arrives, and shape it so a single word answers it. A decision recorded in a status line, a checklist, a working document, or a side thread is a note; the user never learns they are the bottleneck, and the work sits. Keep everything that does not depend on the answer moving while it is outstanding.
 

package/rules/shell-invocation.md

@@ -33,5 +33,3 @@ export MSYS2_ARG_CONV_EXCL='origin/main:'; git show origin/main:.claude/settings
 `MSYS2_ARG_CONV_EXCL` takes a semicolon-separated list of argument prefixes. Naming one prefix per detected token leaves every other argument in the command converting as before. The blanket pair `MSYS_NO_PATHCONV=1 MSYS2_ARG_CONV_EXCL='*'` turns conversion off for the whole command, which changes a path the command meant to convert, so the rewriter does not emit it.
 
 A quoted token is not a revision. `git commit -m "fix a/b:.py"` carries a slash and a dot in one token, and a rewrite there would break the message, so the detection skips a token holding whitespace or a quote.
-
-`advisory/msys_path_conversion_advisor.py` (PostToolUse on Bash, hosted by `bash_post_call_dispatcher`) stays behind it. It reads a failed git call, looks for the mark MSYS leaves, and names the fix. It covers a shape the rewriter misses.

package/rules/subagent-model-policy.json

@@ -29,25 +29,17 @@
     "default": "worker",
     "worker": [
       "worker",
+      "poteto-agent",
+      "pstack:poteto-agent",
       "default",
       "explorer",
       "caveman",
-      "clean-coder",
-      "code-quality-agent",
       "code-verifier",
       "deep-research",
-      "docs-agent",
-      "git-commit-crafter",
-      "issue-tracker",
-      "plan-packet-validator",
-      "pr-description-writer",
-      "skill-writer-agent",
-      "theme-prompt-agent",
-      "theme-prompt-generator",
-      "translator"
+      "docs-agent"
     ],
-    "advisor": ["advisor", "session-advisor", "team-advisor", "code-advisor"],
-    "trustedAdvisor": ["session-advisor", "team-advisor", "code-advisor"]
+    "advisor": ["advisor", "team-advisor", "code-advisor"],
+    "trustedAdvisor": ["advisor", "team-advisor", "code-advisor"]
   },
   "approvedPairs": [
     {"model": "luna", "effort": "high"},

package/rules/testing.md

@@ -26,5 +26,3 @@ Tests exercise production behavior, production data, and production code paths.
 ## No Gate Holds the Test-First Order
 
 `tdd_enforcer.py` once required a fresh, failing test before a production module was written. Nothing runs it now, and the staged policy lint carries no replacement. Hold the red-green-refactor order yourself, and let review check it on the diff.
-
-`hooks/observability/test_failure_recorder.py` still runs on every Bash call. It records a single unchained pytest run that names a test file path and reports a failing exit status, storing the command, that exit status, and the path in the content-hash store. `content_hash_store.py`'s module docstring holds the full contract. No gate reads that store today, so the record serves as history rather than a precondition.