claude-dev-env 8.80.0 → 8.82.0

package/hooks/blocking/test_final_reply_gate.py

@@ -0,0 +1,94 @@
+import io
+import json
+from pathlib import Path
+
+import pytest
+
+import final_reply_gate
+
+GUESSED_REPLY = "My guess is one to two hours if those builds pass first time."
+UNCONFIRMED_REPLY = "Merge queue: I didn\u2019t confirm this one."
+MEASURED_REPLY = "The last queue build took 39 minutes, run 18239174012."
+
+
+def run_gate(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+    reply_text: str,
+    transcript_path: Path | None = None,
+) -> tuple[int, str]:
+    hook_input: dict[str, object] = {
+        "hook_event_name": "Stop",
+        "stop_hook_active": False,
+        "last_assistant_message": reply_text,
+    }
+    if transcript_path is not None:
+        hook_input["transcript_path"] = str(transcript_path)
+    monkeypatch.setattr(
+        "sys.stdin", io.TextIOWrapper(io.BytesIO(json.dumps(hook_input).encode("utf-8")))
+    )
+    exit_code = final_reply_gate.main()
+    return exit_code, capsys.readouterr().out
+
+
+@pytest.fixture(autouse=True)
+def isolated_home(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setenv("HOME", str(tmp_path))
+    monkeypatch.setenv("USERPROFILE", str(tmp_path))
+    monkeypatch.delenv("CLAUDE_REPLY_BANNED_WORDS_PATH", raising=False)
+
+
+def write_tool_result_transcript(transcript_path: Path, result_text: str) -> Path:
+    tool_result = {"type": "tool_result", "tool_use_id": "t1", "content": result_text}
+    transcript_path.write_text(
+        json.dumps({"type": "user", "message": {"content": [tool_result]}}), encoding="utf-8"
+    )
+    return transcript_path
+
+
+@pytest.mark.parametrize(
+    ("reply_text", "quoted_text"),
+    [
+        (GUESSED_REPLY, 'Banned word "guess"'),
+        (UNCONFIRMED_REPLY, 'No tool validated this: "Merge queue: I didn\u2019t confirm this one."'),
+        ("It should take about 40 minutes.", "It should take about 40 minutes."),
+    ],
+)
+def test_should_block_a_closing_reply_that_guesses(
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+    reply_text: str,
+    quoted_text: str,
+) -> None:
+    exit_code, stdout_text = run_gate(monkeypatch, capsys, reply_text)
+    decision = json.loads(stdout_text)
+    assert exit_code == 0
+    assert decision["decision"] == "block"
+    assert quoted_text in decision["reason"]
+    assert decision["reason"].endswith("Rewrite the reply without it.")
+
+
+def test_should_block_a_run_no_tool_result_shows(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    transcript_path = write_tool_result_transcript(tmp_path / "s.jsonl", "run 18239170000 ok")
+    _, stdout_text = run_gate(monkeypatch, capsys, MEASURED_REPLY, transcript_path)
+    assert 'cites "run 18239174012"' in json.loads(stdout_text)["reason"]
+
+
+def test_should_allow_a_run_a_tool_result_shows(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    transcript_path = write_tool_result_transcript(tmp_path / "s.jsonl", "run 18239174012 took 39m")
+    assert run_gate(monkeypatch, capsys, MEASURED_REPLY, transcript_path) == (0, "")
+
+
+def test_should_allow_a_closing_reply_with_no_message(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    monkeypatch.setattr("sys.stdin", io.TextIOWrapper(io.BytesIO(b'{"hook_event_name": "Stop"}')))
+    assert (final_reply_gate.main(), capsys.readouterr().out) == (0, "")
+
+
+def test_should_return_none_for_a_measured_reply_without_a_transcript() -> None:
+    assert final_reply_gate.final_reply_violation(MEASURED_REPLY, None) is None

package/hooks/blocking/test_pr_lifecycle_skill_gate.py

@@ -117,6 +117,14 @@ def test_subagent_without_invocation_is_denied(tmp_path: Path) -> None:
     _assert_denied(payload)
 
 
+def test_transcript_paths_should_add_the_subagent_transcript_after_the_session(tmp_path: Path) -> None:
+    session_path = _transcript(tmp_path)
+    subagent_path = _subagent_transcript(tmp_path, "a8865a3f3c71595ce", None)
+    payload = {"transcript_path": str(session_path), "agent_id": "a8865a3f3c71595ce"}
+    assert gate.transcript_paths(payload) == [str(session_path), str(subagent_path)]
+    assert gate.transcript_paths({"transcript_path": str(session_path)}) == [str(session_path)]
+
+
 def test_missing_subagent_transcript_keeps_session_deny(tmp_path: Path) -> None:
     payload = _payload("git push", _transcript(tmp_path))
     payload["agent_id"] = "a8865a3f3c71595ce"

package/hooks/blocking/test_pre_tool_use_dispatcher.py

@@ -806,6 +806,7 @@ def test_dispatcher_allows_clean_apply_patch_add(tmp_path: Path) -> None:
 
 ALL_RETAINED_PATHS = {
     "blocking/context_budget_blocker.py",
+    "blocking/pull_request_proof_edit_gate.py",
 }
 ALL_RETIRED_PATHS = {
     "validation/hook_format_validator.py",

package/hooks/blocking/test_pull_request_proof.py

@@ -333,3 +333,10 @@ def test_dispatch_that_names_no_head_or_runs_no_workflow_should_not_count_as_a_c
     for each_payload in all_payloads:
         assert gate.missing_proof_reason(each_payload) is None
         assert not gate.is_feature_pull_request(each_payload)
+
+
+def test_is_create_call_should_name_shell_and_mcp_creates() -> None:
+    assert gate.is_create_call(_shell("gh pr create --title t --body b"))
+    assert gate.is_create_call(_mcp_create("b"))
+    assert not gate.is_create_call(_shell("gh pr edit 7 --body b"))
+    assert not gate.is_create_call({"tool_name": "Read", "tool_input": {"file_path": "a.py"}})

package/hooks/blocking/test_pull_request_proof_edit_gate.py

@@ -0,0 +1,199 @@
+"""Behavior tests for the gate that holds an edit to the proof gate until its named route is taken."""
+
+import json
+import sys
+from pathlib import Path
+
+HOOKS_DIRECTORY = Path(__file__).resolve().parent.parent
+if str(HOOKS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(HOOKS_DIRECTORY))
+
+from blocking import pull_request_proof_edit_gate as gate
+from hooks_constants.pull_request_proof_constants import (
+    GATE_EDIT_BEFORE_ROUTE_REASON,
+    UNREADABLE_CHANGES_REASON,
+)
+
+
+def _transcript(tmp_path: Path, all_entries: list[dict[str, object]]) -> str:
+    transcript_path = tmp_path / "session.jsonl"
+    transcript_path.write_text(
+        "\n".join(json.dumps(each_entry) for each_entry in all_entries) + "\n", encoding="utf-8"
+    )
+    return str(transcript_path)
+
+
+def _tool_use(tool_use_id: object, name: str, tool_input: dict[str, object]) -> dict[str, object]:
+    return {
+        "type": "assistant",
+        "message": {"content": [{"type": "tool_use", "id": tool_use_id, "name": name, "input": tool_input}]},
+    }
+
+
+def _tool_result(tool_use_id: object, content: object, is_error: bool) -> dict[str, object]:
+    return {
+        "type": "user",
+        "message": {
+            "content": [
+                {"type": "tool_result", "tool_use_id": tool_use_id, "content": content, "is_error": is_error}
+            ]
+        },
+    }
+
+
+SHELL_CREATE_INPUT = {"command": "gh pr create --title t --body-file body.md"}
+DENIED_CREATE_ENTRIES = [
+    _tool_use("create-1", "Bash", SHELL_CREATE_INPUT),
+    _tool_result("create-1", UNREADABLE_CHANGES_REASON, True),
+]
+
+
+def _edit_payload(transcript_path: str, file_path: str) -> dict[str, object]:
+    return {
+        "tool_name": "Edit",
+        "tool_input": {"file_path": file_path, "old_string": "a", "new_string": "b"},
+        "transcript_path": transcript_path,
+    }
+
+
+GATE_FILE_PATH = "C:/workspace/x/packages/claude-dev-env/hooks/blocking/pull_request_proof.py"
+GATE_CONSTANTS_PATH = "/w/packages/claude-dev-env/hooks/hooks_constants/pull_request_proof_constants.py"
+
+
+def test_should_deny_an_edit_to_the_gate_after_its_deny_with_no_passing_create(tmp_path: Path) -> None:
+    transcript_path = _transcript(tmp_path, DENIED_CREATE_ENTRIES)
+    assert gate.gate_edit_reason(_edit_payload(transcript_path, GATE_FILE_PATH)) == GATE_EDIT_BEFORE_ROUTE_REASON
+
+
+def test_should_deny_an_edit_to_the_gate_constants_after_its_deny(tmp_path: Path) -> None:
+    transcript_path = _transcript(tmp_path, DENIED_CREATE_ENTRIES)
+    payload = _edit_payload(transcript_path, GATE_CONSTANTS_PATH)
+    payload["tool_name"] = "Write"
+    assert gate.gate_edit_reason(payload) == GATE_EDIT_BEFORE_ROUTE_REASON
+
+
+def test_should_read_a_deny_carried_as_text_blocks(tmp_path: Path) -> None:
+    all_text_blocks = [{"type": "text", "text": "Error: " + UNREADABLE_CHANGES_REASON}]
+    transcript_path = _transcript(
+        tmp_path,
+        [_tool_use("create-1", "Bash", SHELL_CREATE_INPUT), _tool_result("create-1", all_text_blocks, True)],
+    )
+    assert gate.gate_edit_reason(_edit_payload(transcript_path, GATE_FILE_PATH)) == GATE_EDIT_BEFORE_ROUTE_REASON
+
+
+def test_should_allow_a_gate_edit_once_a_later_create_passed(tmp_path: Path) -> None:
+    transcript_path = _transcript(
+        tmp_path,
+        [
+            *DENIED_CREATE_ENTRIES,
+            _tool_use("create-2", "mcp__github__create_pull_request", {"owner": "o", "repo": "r", "body": "b"}),
+            _tool_result("create-2", "https://github.com/o/r/pull/7", False),
+        ],
+    )
+    assert gate.gate_edit_reason(_edit_payload(transcript_path, GATE_FILE_PATH)) is None
+
+
+def test_should_deny_again_when_a_deny_follows_the_passing_create(tmp_path: Path) -> None:
+    transcript_path = _transcript(
+        tmp_path,
+        [
+            _tool_use("create-1", "Bash", SHELL_CREATE_INPUT),
+            _tool_result("create-1", "https://github.com/o/r/pull/7", False),
+            *DENIED_CREATE_ENTRIES,
+        ],
+    )
+    assert gate.gate_edit_reason(_edit_payload(transcript_path, GATE_FILE_PATH)) == GATE_EDIT_BEFORE_ROUTE_REASON
+
+
+def test_should_allow_an_edit_to_another_file_after_the_deny(tmp_path: Path) -> None:
+    transcript_path = _transcript(tmp_path, DENIED_CREATE_ENTRIES)
+    assert gate.gate_edit_reason(_edit_payload(transcript_path, "/w/hooks/blocking/other_gate.py")) is None
+
+
+def test_should_allow_a_gate_edit_in_a_session_this_gate_never_denied(tmp_path: Path) -> None:
+    transcript_path = _transcript(
+        tmp_path,
+        [
+            _tool_use("read-1", "Read", {"file_path": GATE_CONSTANTS_PATH}),
+            _tool_result("read-1", UNREADABLE_CHANGES_REASON, False),
+            _tool_use("other-1", "Bash", {"command": "pytest"}),
+            _tool_result("other-1", "1 failed", True),
+        ],
+    )
+    assert gate.gate_edit_reason(_edit_payload(transcript_path, GATE_FILE_PATH)) is None
+
+
+def test_should_allow_a_gate_edit_without_a_readable_transcript(tmp_path: Path) -> None:
+    payload = _edit_payload(str(tmp_path / "missing.jsonl"), GATE_FILE_PATH)
+    assert gate.gate_edit_reason(payload) is None
+
+
+def test_should_deny_an_apply_patch_to_the_edit_gate_after_its_deny(tmp_path: Path) -> None:
+    transcript_path = _transcript(tmp_path, DENIED_CREATE_ENTRIES)
+    patch_text = (
+        "*** Begin Patch\n*** Update File: hooks/blocking/pull_request_proof_edit_gate.py\n"
+        "@@\n-a\n+b\n*** End Patch\n"
+    )
+    payload = {
+        "tool_name": "apply_patch",
+        "tool_input": {"command": patch_text},
+        "cwd": str(tmp_path),
+        "transcript_path": transcript_path,
+    }
+    assert gate.gate_edit_reason(payload) == GATE_EDIT_BEFORE_ROUTE_REASON
+
+
+def test_should_ignore_an_errored_result_of_another_tool_that_names_the_guide(tmp_path: Path) -> None:
+    transcript_path = _transcript(
+        tmp_path,
+        [
+            _tool_use("cat-1", "Bash", {"command": "cat proof-before-pull-request.md"}),
+            _tool_result("cat-1", "cat: " + UNREADABLE_CHANGES_REASON, True),
+        ],
+    )
+    assert gate.gate_edit_reason(_edit_payload(transcript_path, GATE_FILE_PATH)) is None
+
+
+def test_should_skip_malformed_transcript_entries_and_keep_the_deny(tmp_path: Path) -> None:
+    transcript_path = _transcript(
+        tmp_path,
+        [
+            {"type": "user", "message": "plain text"},
+            _tool_use(["not", "a", "string"], "Bash", SHELL_CREATE_INPUT),
+            _tool_result(["not", "a", "string"], "done", False),
+            *DENIED_CREATE_ENTRIES,
+        ],
+    )
+    assert gate.gate_edit_reason(_edit_payload(transcript_path, GATE_FILE_PATH)) == GATE_EDIT_BEFORE_ROUTE_REASON
+
+
+def test_should_deny_a_multi_edit_of_a_case_variant_windows_path_from_the_agent_transcript(tmp_path: Path) -> None:
+    transcript_path = _transcript(tmp_path, DENIED_CREATE_ENTRIES)
+    payload = {
+        "tool_name": "MultiEdit",
+        "tool_input": {"file_path": "C:\\workspace\\x\\hooks\\blocking\\Pull_Request_Proof.PY", "edits": []},
+        "agent_transcript_path": transcript_path,
+    }
+    assert gate.gate_edit_reason(payload) == GATE_EDIT_BEFORE_ROUTE_REASON
+
+
+def test_should_deny_a_subagent_edit_after_a_deny_in_its_own_transcript(tmp_path: Path) -> None:
+    session_path = _transcript(tmp_path, [])
+    subagent_directory = tmp_path / "session" / "subagents"
+    subagent_directory.mkdir(parents=True)
+    (subagent_directory / "agent-a8865a3f3c71595ce.jsonl").write_text(
+        "\n".join(json.dumps(each_entry) for each_entry in DENIED_CREATE_ENTRIES) + "\n", encoding="utf-8"
+    )
+    payload = _edit_payload(session_path, GATE_FILE_PATH)
+    payload["agent_id"] = "a8865a3f3c71595ce"
+    assert gate.gate_edit_reason(payload) == GATE_EDIT_BEFORE_ROUTE_REASON
+
+
+def test_should_allow_an_apply_patch_the_patch_parser_cannot_resolve(tmp_path: Path) -> None:
+    payload = {
+        "tool_name": "apply_patch",
+        "tool_input": {"command": "*** Begin Patch\n*** Add File: a\x00b.py\n+x\n*** End Patch\n"},
+        "cwd": str(tmp_path),
+        "transcript_path": _transcript(tmp_path, DENIED_CREATE_ENTRIES),
+    }
+    assert gate.gate_edit_reason(payload) is None

package/hooks/blocking/test_reply_length_gate.py

@@ -726,3 +726,211 @@ def test_should_allow_a_reply_with_no_causal_claim(
         monkeypatch, capsys, REPLY_TOOL_NAME, {"text": "The runner restarted. Also, so far so good."}
     )
     assert exit_code == 0
+
+
+UPDATE_TOOL_NAME = "mcp__hearthbot__update_message"
+QUESTION_CARD_TOOL_NAME = "AskUserQuestion"
+RUN_LINK_REPLY = (
+    "The last build passed in [run 18239174012]"
+    "(https://github.com/owner/repo/actions/runs/18239174012)."
+)
+
+
+def write_tool_result_transcript(transcript_path: Path, result_text: str, is_error: bool = False) -> Path:
+    all_entries = [
+        {"type": "user", "message": {"content": "how close are we"}},
+        {
+            "type": "assistant",
+            "message": {"content": [{"type": "tool_use", "id": "t1", "name": "Bash", "input": {}}]},
+        },
+        {
+            "type": "user",
+            "message": {
+                "content": [
+                    {
+                        "type": "tool_result",
+                        "tool_use_id": "t1",
+                        "is_error": is_error,
+                        "content": [{"type": "text", "text": result_text}],
+                    }
+                ]
+            },
+        },
+    ]
+    transcript_path.write_text(
+        "\n".join(json.dumps(each_entry) for each_entry in all_entries), encoding="utf-8"
+    )
+    return transcript_path
+
+
+@pytest.mark.parametrize("tool_name", [REPLY_TOOL_NAME, POST_TOOL_NAME, UPDATE_TOOL_NAME])
+def test_should_deny_an_estimate_and_quote_it(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tool_name: str
+) -> None:
+    exit_code, stderr_text = run_gate(
+        monkeypatch, capsys, tool_name, {"text": "My estimate is one to two hours."}
+    )
+    assert exit_code == 2
+    assert 'No tool validated this: "My estimate is one to two hours."' in stderr_text
+
+
+@pytest.mark.parametrize(
+    "reply_text",
+    [
+        "I didn\u2019t confirm this one.",
+        "I have not checked the queue.",
+        "I assumed the build passed.",
+        "Run 18239174012 is unverified.",
+        "About 20 minutes left.",
+        "It will take two hours.",
+        "ETA is 3-4 hours.",
+        "Estimate from the last check is two builds.",
+        "I did not run the suite.",
+        "The tests have not yet been run.",
+        "The job takes 39 minutes.",
+        "The migration takes seventy minutes.",
+        "I was not able to verify the fix.",
+        "The fix has not been validated.",
+        "The fix was not verified in production.",
+        "The suite takes about 90 seconds.",
+    ],
+)
+def test_should_deny_each_unvalidated_claim_shape(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], reply_text: str
+) -> None:
+    exit_code, stderr_text = run_gate(monkeypatch, capsys, REPLY_TOOL_NAME, {"text": reply_text})
+    assert exit_code == 2
+    assert "No tool validated this" in stderr_text
+
+
+@pytest.mark.parametrize(
+    "reply_text",
+    [
+        "Two builds are left in the queue.",
+        "I will check the queue again within 15 minutes.",
+        "The last queue build took 39 minutes.",
+        "The gate now refuses `guess` and `assumed`.",
+        "The job takes 39 minutes, see run 18239174012.",
+        "The hook cannot run on Windows.",
+        "The crash is not a test problem.",
+        "That is not the check that failed.",
+        "The migration did not run out of memory.",
+        "We did not run into any errors.",
+        "This is not something to check before the release.",
+        "The result is not what we tested for.",
+        "The migration did not run on the replica.",
+        "The old parser did not validate the header length.",
+        "The job has not run yet.",
+        "The config file is not checked in.",
+        "The release branch is not checked out.",
+    ],
+)
+def test_should_allow_a_reply_with_no_unvalidated_claim(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], reply_text: str
+) -> None:
+    assert run_gate(monkeypatch, capsys, REPLY_TOOL_NAME, {"text": reply_text}) == (0, "")
+
+
+def test_should_deny_a_run_no_tool_result_shows(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    transcript_path = write_tool_result_transcript(tmp_path / "s.jsonl", "run 18239170000 ok")
+    exit_code, stderr_text = run_gate(
+        monkeypatch, capsys, REPLY_TOOL_NAME, {"text": RUN_LINK_REPLY}, transcript_path
+    )
+    assert exit_code == 2
+    assert 'cites "run 18239174012"' in stderr_text
+
+
+def test_should_deny_a_run_only_an_error_result_shows(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    transcript_path = write_tool_result_transcript(
+        tmp_path / "s.jsonl", "run 18239174012 ok", is_error=True
+    )
+    exit_code, stderr_text = run_gate(
+        monkeypatch, capsys, REPLY_TOOL_NAME, {"text": RUN_LINK_REPLY}, transcript_path
+    )
+    assert exit_code == 2
+    assert "no tool result in this session shows it" in stderr_text
+
+
+def test_should_allow_a_run_a_tool_result_shows(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str], tmp_path: Path
+) -> None:
+    transcript_path = write_tool_result_transcript(tmp_path / "s.jsonl", "run 18239174012 took 39m")
+    assert run_gate(
+        monkeypatch, capsys, REPLY_TOOL_NAME, {"text": RUN_LINK_REPLY}, transcript_path
+    ) == (0, "")
+
+
+def test_should_deny_a_question_card_that_admits_a_skipped_check(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    card = {
+        "questions": [
+            {
+                "question": "Ship the gate now?",
+                "header": "Ship",
+                "options": [
+                    {"label": "Ship", "description": "I did not test the Stop hook."},
+                    {"label": "Wait", "description": "Run the suite first."},
+                ],
+            }
+        ]
+    }
+    exit_code, stderr_text = run_gate(monkeypatch, capsys, QUESTION_CARD_TOOL_NAME, card)
+    assert exit_code == 2
+    assert "I did not test the Stop hook." in stderr_text
+
+
+def test_should_allow_a_question_card_with_no_unvalidated_claim(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    card = {
+        "questions": [
+            {
+                "question": "Which gate design?",
+                "header": "Design",
+                "options": [{"label": "Fold in", "description": "One gate checks every reply."}],
+            }
+        ]
+    }
+    assert run_gate(monkeypatch, capsys, QUESTION_CARD_TOOL_NAME, card) == (0, "")
+
+
+def test_should_collect_each_question_card_prose_field() -> None:
+    card = {
+        "questions": [
+            {"question": "Q?", "header": "H", "options": [{"label": "L", "description": "D"}, "x"]},
+            "not a question",
+        ]
+    }
+    assert reply_length_gate.all_question_card_texts(card) == ["Q?", "H", "L", "D"]
+
+
+def test_should_quote_the_hedged_sentence() -> None:
+    assert reply_length_gate.unvalidated_claim_violation("Done. It should take a few minutes.") == (
+        'No tool validated this: "It should take a few minutes.". Run the check yourself or through'
+        " a subagent, then state what the run, log line, output, or file and line shows, or leave"
+        " the claim out."
+    )
+
+
+def test_should_skip_the_citation_check_without_a_transcript() -> None:
+    assert reply_length_gate.unseen_citation_violation(RUN_LINK_REPLY, None) is None
+
+
+def test_should_leave_the_transcript_unread_when_the_text_cites_nothing(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    all_read_paths: list[object] = []
+    monkeypatch.setattr(reply_length_gate, "successful_result_text", all_read_paths.append)
+    transcript_path = write_tool_result_transcript(tmp_path / "s.jsonl", "nothing cited")
+    assert reply_length_gate.unseen_citation_violation("Two builds left.", transcript_path) is None
+    assert all_read_paths == []
+
+
+def test_should_split_prose_sentences_outside_fenced_blocks() -> None:
+    reply_text = "First one. Second one?\n```\nskipped. code\n```\nThird"
+    assert reply_length_gate.prose_sentences(reply_text) == ["First one.", "Second one?", "", "Third"]

package/hooks/features/conduct-gates.md

@@ -4,8 +4,9 @@ This family stops a chat reply, edited message, or tool call when its payload br
 
 ## Checks
 
-- `blocking/reply_length_gate.py` caps chat reply length, denies a configured banned word, requires a readable link when the text names a pull request number, and denies a causal claim in a reply that cites no code span, output block, or link. With visual reply mode on, it also runs the checks in `visual_reply_rules.py` from the rule list in `rules/visual-reply-rules.json`: no abbreviation or tracker number outside a link, a widget or page before a reply of more than one sentence, and no anchor link inside widget code. The mode is off by default; `~/.claude/visual-reply-mode.json` with `{"enabled": true}` turns the mode checks on.
-- The claim judge is a `prompt` hook in `hooks.json`, with no `model` set, so Claude Code's small default hook model reads each chat message and denies the first claim about how code, a file, a tool, a service, a run, or a process behaves, or why something happened, when nothing in the message shows it: inline code that quotes output or a code line, a file and line, or a link. A pull request link covers what that change does, what it blocks or lets through, and its checks. The author's own actions, a restatement of the user's words, questions, instructions, claims labeled as unchecked, and a decision card's option consequences pass. It catches the plain claims the causal word list in `blocking/reply_length_gate.py` misses, such as "The code lets any of them rewrite it mid-check." `continueOnBlock` returns the reason to the agent as the tool error, so it can add the source and send again. The installer owns it through the `claude-dev-env: ` prefix on its `statusMessage`. It skips `post_widget`, whose input is SVG or HTML markup.
+- `blocking/reply_length_gate.py` caps chat reply length, denies a configured banned word, requires a readable link when the text names a pull request number, and denies a causal claim in a reply that cites no code span, output block, or link. It denies a sentence that guesses, estimates, hedges a duration, or admits a skipped check, such as "I didn't confirm this one." It denies a cited Actions run, pull request, or run, job, or check id that no successful tool result in the transcript shows; a subagent's report is the result of its Agent call. A question card from `AskUserQuestion` gets the banned word check and `unvalidated_claim_violation`, like a decision card. With visual reply mode on, it also runs the checks in `visual_reply_rules.py` from the rule list in `rules/visual-reply-rules.json`: no abbreviation or tracker number outside a link, a widget or page before a reply of more than one sentence, and no anchor link inside widget code. The mode is off by default; `~/.claude/visual-reply-mode.json` with `{"enabled": true}` turns the mode checks on.
+- `blocking/final_reply_gate.py` applies the banned words, `unvalidated_claim_violation`, and `unseen_citation_violation` from the reply gate to the reply a session ends its turn with.
+- The claim judge is a `prompt` hook in `hooks.json`, with no `model` set, so Claude Code's small default hook model reads each chat message and denies the first claim about how code, a file, a tool, a service, a run, or a process behaves, or why something happened, when nothing in the message shows it: inline code that quotes output or a code line, a file and line, or a link. A pull request link covers what that change does, what it blocks or lets through, and its checks. The author's own actions, a restatement of the user's words, questions, instructions, and a decision card's option consequences pass. It catches the plain claims the causal word list in `blocking/reply_length_gate.py` misses, such as "The code lets any of them rewrite it mid-check." `continueOnBlock` returns the reason to the agent as the tool error, so it can add the source and send again. The installer owns it through the `claude-dev-env: ` prefix on its `statusMessage`. It skips `post_widget`, whose input is SVG or HTML markup.
 - `blocking/edit_marker_gate.py` rejects strikethrough and edit-note markers in replacement chat text or cards.
 - `blocking/issue_close_handoff_gate.py` denies an issue comment or issue write that closes the issue and routes a found defect to another issue or epic.
 - `blocking/session_title_format_gate.py` denies a session title that breaks the `<emoji> <name>` shape or has a name longer than 25 characters.
@@ -18,7 +19,8 @@ This family stops a chat reply, edited message, or tool call when its payload br
 
 ## When it fires
 
-- `blocking/reply_length_gate.py` runs on `PreToolUse`, matcher `mcp__hearthbot__reply|mcp__hearthbot__post_message|mcp__hearthbot__ask_decision|mcp__hearthbot__post_widget`, timeout `10` seconds in `hooks.json`.
+- `blocking/reply_length_gate.py` runs on `PreToolUse`, matcher `mcp__hearthbot__reply|mcp__hearthbot__post_message|mcp__hearthbot__update_message|mcp__hearthbot__ask_decision|AskUserQuestion|mcp__hearthbot__post_widget`, timeout `10` seconds in `hooks.json`.
+- `blocking/final_reply_gate.py` runs on `Stop`, timeout `10` seconds in `hooks.json`.
 - The claim judge runs on `PreToolUse`, matcher `mcp__hearthbot__reply|mcp__hearthbot__post_message|mcp__hearthbot__update_message|mcp__hearthbot__ask_decision`, timeout `30` seconds in `hooks.json`.
 - `blocking/edit_marker_gate.py` runs on `PreToolUse`, matcher `mcp__.*__update_message`, timeout `10` seconds in `hooks.json`.
 - `blocking/issue_close_handoff_gate.py` runs on `PreToolUse`, matcher `mcp__.*__(add_issue_comment|issue_write|update_issue_comment)`, timeout `10` seconds in `hooks.json`.
@@ -37,6 +39,7 @@ Preconditions:
 - Run each command from the repository root with Python and pytest available. The tests create transcript and payload fixtures.
 
 - **Reply length.** Input is a reply with four sentences, a plain pull request number, an abbreviation, two sentences with no widget this turn, or widget code with an anchor link. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_reply_length_gate.py -q`. The adjacent test observes a denial and its count, link, or mode reason. Widget code with no flowchart passes with a flowchart reminder in `additionalContext`.
+- **Final reply.** Input is a closing reply that says "My guess is one to two hours." or cites a run no tool result shows. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_final_reply_gate.py -q`. The adjacent test observes a `block` decision that quotes the sentence or the citation; a reply that cites a run a tool result shows passes.
 - **Claim judge.** Input is a headless `claude -p` session with a stub MCP server named `hearthbot` that exposes `reply` and `ask_decision`, told to send "The code lets any of them rewrite it mid-check." The session settings add the `hooks.json` prompt hook. The stub logs zero bytes sent, and the tool error reads `PreToolUse:mcp__hearthbot__reply hook error: [<the prompt>]: Fact with no source: ...`. The same sentence with a `file:line` in backticks posts. A hook whose `model` Claude Code does not recognize lets every message through, so leave `model` unset. Run `node --test packages/claude-dev-env/bin/install.prompt-hook.test.mjs` for the installer side; it observes one managed prompt hook after two installs and none after uninstall.
 - **Edit marker.** Input is an update message with strikethrough or an edit note. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_edit_marker_gate.py -q`. The adjacent test observes a denial; clean replacement text passes.
 - **Handoff close.** Input is an issue comment that says the issue is closed and that the found defect belongs to another issue. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_issue_close_handoff_gate.py -q`. The adjacent test observes a denial; a close with a plain cross-reference and a routing comment on an open issue both pass.
@@ -53,6 +56,7 @@ Preconditions:
 - `blocking/step_note_gate.py` is off by default and polls for the transcript record. Subagent calls and unreadable records pass.
 - `blocking/verify_before_acting.py` runs after the tool. A block asks the agent to check the claim and undo a contradicted change.
 - The reply gate counts each nonempty list line as a sentence. Link targets and code spans add no words. Its banned words come from `reply-banned-words.json` in the Claude home, or the file `CLAUDE_REPLY_BANNED_WORDS_PATH` names, with built-in defaults.
+- The final reply gate blocks the stop and returns its reason to the model, which rewrites the reply. Claude Code ends the turn anyway after eight blocks in a row. The cited number checks in both gates skip when the transcript cannot be read.
 - The edit marker gate scans replacement cards as well as the message text.
 - The handoff close gate reads the `body` and `comment` fields of issue tools only. A `gh issue close --comment` command in Bash and a pull request body that closes the issue with `Closes #N` do not reach it.
 - The lifecycle gate counts only invocations after the last compaction, so a compacted session invokes `pr-lifecycle` again. A missing or unreadable transcript allows the call.

package/hooks/features/write-edit-blocking.md

@@ -7,12 +7,14 @@ This family decides whether an agent's file mutation can run.
 - `blocking/pre_tool_use_dispatcher.py` runs its native description check and returns one permission decision.
 - `blocking/state_description_blocker.py` rejects historical or comparative prose in supported comments, docstrings, and Markdown.
 - `blocking/context_budget_blocker.py` rejects a write that grows a skill entry, `AGENTS.md`, `CLAUDE.md`, or rule file past its context budget.
+- `blocking/pull_request_proof_edit_gate.py` rejects an edit to the pull request proof gate, its constants, this edit gate, or the dispatcher roster while the proof gate's last deny of a create call in the session has no passing create call after it.
 
 ## When it fires
 
 - `blocking/pre_tool_use_dispatcher.py` runs on `PreToolUse`, matcher `Write|Edit|MultiEdit|apply_patch`, timeout `60` seconds in `hooks.json`.
 - `blocking/state_description_blocker.py` runs through the dispatcher's native evaluator on `PreToolUse`, matcher `Write|Edit|MultiEdit|apply_patch`, timeout `60` seconds. Its evaluator checks `Write`, `Edit`, and `MultiEdit` payloads and skips `apply_patch`.
 - `blocking/context_budget_blocker.py` runs inside that dispatcher as a blocking hosted entry on `PreToolUse`, matcher `Write|Edit|MultiEdit|apply_patch`, timeout `60` seconds. It reads `.claude/context-budget.json` from the edited file's own repository.
+- `blocking/pull_request_proof_edit_gate.py` runs inside that dispatcher as a blocking hosted entry on `PreToolUse` for `Write`, `Edit`, `MultiEdit`, and `apply_patch`, timeout `60` seconds. It reads the session transcript the payload names and, for a subagent, its own transcript.
 
 ## Proving it
 
@@ -22,11 +24,12 @@ Preconditions:
 
 - **Dispatcher decision.** Input is a clean Write payload. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_pre_tool_use_dispatcher.py -q`. The adjacent test checks that the dispatcher allows clean writes and carries denials from its checks.
 - **Context budget gate.** Input is a Write of the orchestrator skill at commit `3f2c3ef`, then at `98f45b1`. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_context_budget_blocker.py -q`. The adjacent test observes a denial naming "Oversee delegated work" for the first and an allow for the second.
+- **Proof edit gate.** Input is a transcript with a proof gate deny, then an Edit of `pull_request_proof.py`. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_pull_request_proof_edit_gate.py -q`. The adjacent test observes a denial before a passing create call and an allow after one.
 - **Description gate.** Input is a Write containing historical prose in a Python comment. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_state_description_blocker.py -q`. The adjacent test observes a denial reason.
 
 ## Gotchas
 
-- `ALL_HOSTED_HOOK_ENTRIES` lists the blocking context budget gate. The dispatcher calls the description evaluator through its native hook table.
+- `ALL_HOSTED_HOOK_ENTRIES` lists the blocking context budget gate and the proof edit gate. The dispatcher calls the description evaluator through its native hook table.
 - The context budget gate denies only what an edit adds. A repository with no policy file uses built-in kinds and treats the file's current text as its baseline entry, so a file under its line limit may grow to the limit and a file over it may only shrink. The CI ratchet runs in `scripts/policy_lint/adapter_context_budget.py`, never in the hook. See the [context budget reference](../../.agents/skills/build-eval/reference/context-budget.md).
 - The dispatcher runs hosted entries in roster order. A hosted advisory crash stays silent; a native blocking check can deny the write.
 - `scripts/policy_lint/adapter_detectors.py` also loads `blocking/state_description_blocker.py`. Check that adapter when changing its evaluator.