claude-dev-env 8.98.6 → 8.98.7

package/.agents/skills/pr-lifecycle/SKILL.md

@@ -22,7 +22,7 @@ User-level rule: applies to **every** git repo that uses GitHub with `gh`. Small
 
 ### Pull request submission rules
 
-**Prove the change where it runs before opening a PR.** Read `~/.claude/docs/rule-guides/proof-before-pull-request.md` for the body and hook requirements. A `feat` PR also needs an "Eval" section and a session that invoked `/claude-api build-eval`; read `~/.claude/docs/rule-guides/features-start-with-an-eval.md` before you build the feature.
+**Prove the change where it runs before opening a PR.** Read `~/.claude/docs/rule-guides/proof-before-pull-request.md` for the body and hook requirements. A `feat` PR also needs an "Eval" section and a session that invoked `/claude-api build-eval`; read `~/.claude/docs/rule-guides/features-start-with-an-eval.md` before you build the feature. A new workflow that runs only on `workflow_dispatch` cannot run until its file is on the default branch: before the PR, run its `run:` steps with a stub `gh` on PATH, name in the body the live run that waits on the merge, and dispatch it right after the merge.
 
 **Open PRs ready for review; use `--draft` when the owner requests it.** Before you commit copied files or open a PR, list the open PRs that change a file whose path starts with yours, then read each hit, with `gh pr list --state open --limit 1000 --json number,files --jq '.[] | select(any(.files[]; .path | startswith("<path>"))) | .number'`, so you do not duplicate a peer's PR. Each pre-existing failure or remaining defect the PR body names links a tracked issue.
 
@@ -121,7 +121,7 @@ An image a PR needs as visual evidence is not an exception to that row. Upload i
 1. Fetch every reviewer comment before making any fix.
 2. Create a checklist in the session's task tool with one item per comment.
 3. Fix systematically, marking each todo complete.
-4. Reply to each comment inline.
+4. Reply to each comment inline, read the reply back from the thread, and resolve the thread only after the reply shows there.
 
 Repair only the reported findings. A finding that comes back on a second head escalates. Fix the source the reviewer reads, or change the gate that files the finding. Post no second reply with the same text, because a repeat finding shows the first reply changed nothing the reviewer sees.
 
@@ -405,7 +405,7 @@ Resolve the active managed root (`CLAUDE_CONFIG_DIR` when set, `~/.claude`
 otherwise), then run `<managed-root>/scripts/durable_post_lint.py` before the
 server write. Pass the matching action and body file. Use `pr-create`,
 `pr-edit`, `pr-comment`, `pr-review`, `issue-create`, `issue-edit`,
-`issue-comment`, or `github-mcp-post`.
+`issue-comment`, `github-mcp-post`, or `github-mcp-comment` for an MCP comment or reply.
 
 Pass `--repository <owner>/<name>` for the repository the post targets. A
 post may name a private organization only inside a repository that
@@ -440,7 +440,7 @@ For pull requests, use
 `.agents/skills/pull-request/scripts/pull_request.py`. It passes
 `--body-file` to `gh` after the action-aware linter succeeds. For issues and
 GitHub MCP posts, run the linter directly with `issue-create`, `issue-edit`,
-`issue-comment`, or `github-mcp-post` as the action.
+`issue-comment`, `github-mcp-post`, or `github-mcp-comment` as the action.
 
 ### Paginated reads slurp before they filter
 

package/hooks/blocking/reply_length_gate.py

@@ -559,15 +559,24 @@ def gh_command_token_runs(all_command_tokens: list[str]) -> list[list[str]]:
     return all_runs
 
 
+def comment_length_violation(comment_text: str) -> str | None:
+    """Return the deny reason for one over-long GitHub comment text, or None when it fits.
+
+    Fenced code blocks and collapsed ``<details>`` blocks carry no words.
+    """
+    violation = length_violation(DETAILS_BLOCK_PATTERN.sub(" ", comment_text))
+    return None if violation is None else violation + COMMENT_RETRY_INSTRUCTION
+
+
 def github_comment_violation(tool_name: object, all_tool_input: dict[str, object]) -> tuple[str, str] | None:
     """Return the deny reason and text for an over-long GitHub comment, or None.
 
     Fenced code blocks and collapsed ``<details>`` blocks carry no words.
     """
     for each_comment_text in github_comment_texts(tool_name, all_tool_input):
-        violation = length_violation(DETAILS_BLOCK_PATTERN.sub(" ", each_comment_text))
+        violation = comment_length_violation(each_comment_text)
         if violation is not None:
-            return violation + COMMENT_RETRY_INSTRUCTION, each_comment_text
+            return violation, each_comment_text
     return None
 
 

package/hooks/blocking/resolve_thread_reply_gate.py

@@ -0,0 +1,135 @@
+"""Deny a review thread resolve until a reply posted after the last user prompt and the last resolve."""
+
+from __future__ import annotations
+
+import sys
+from collections.abc import Iterable
+from pathlib import Path
+
+hooks_directory = str(Path(__file__).resolve().parent.parent)
+if hooks_directory not in sys.path:
+    sys.path.insert(0, hooks_directory)
+
+from blocking.pr_lifecycle_skill_gate import deny_decision, transcript_paths
+from hooks_constants.pr_lifecycle_skill_gate_constants import SHELL_TOOL_NAMES
+from hooks_constants.pre_tool_use_stdin import print_decision_from_stdin
+from hooks_constants.resolve_thread_reply_gate_constants import (
+    ALL_REPLY_TOOL_NAME_SUFFIXES,
+    MISSING_REPLY_REASON,
+    RESOLVE_TOOL_NAME_PATTERN,
+    SHELL_COMMAND_KEY,
+    SHELL_REPLY_COMMAND_PATTERN,
+)
+from hooks_constants.setup_project_paths_constants import DECODE_ERRORS_POLICY, UTF8_ENCODING
+from transcript_skill_scan import TranscriptToolCall, tool_calls_since_last_prompt
+
+
+def is_resolve_call(tool_name: object) -> bool:
+    """Return whether a tool name resolves a review thread, such as ``mcp__github__resolve_review_thread``.
+
+    Args:
+        tool_name: The tool name from a hook payload or transcript.
+    """
+    return isinstance(tool_name, str) and RESOLVE_TOOL_NAME_PATTERN.match(tool_name) is not None
+
+
+def is_reply_call(tool_call: TranscriptToolCall) -> bool:
+    """Return whether a transcript tool call replies on a review thread.
+
+    ::
+
+        mcp__github__add_reply_to_pull_request_comment               -> True
+        Bash "gh api repos/o/r/pulls/7/comments/99/replies -f body=x" -> True
+        Bash "gh api graphql" with addPullRequestReviewThreadReply    -> True
+        mcp__github__add_issue_comment                                -> False
+
+    Args:
+        tool_call: One tool call read from the transcript.
+    """
+    if tool_call.name.endswith(ALL_REPLY_TOOL_NAME_SUFFIXES):
+        return True
+    command = tool_call.tool_input.get(SHELL_COMMAND_KEY)
+    return (
+        tool_call.name in SHELL_TOOL_NAMES
+        and isinstance(command, str)
+        and SHELL_REPLY_COMMAND_PATTERN.search(command) is not None
+    )
+
+
+def has_posted_reply_since_last_resolve(all_transcript_lines: Iterable[str]) -> bool:
+    """Return whether a reply that succeeded since the last user prompt is not yet spent on a successful resolve.
+
+    ::
+
+        prompt, reply ok, resolve pending                                 -> True
+        prompt, reply refused by a hook, resolve                          -> False
+        prompt, resolve                                                   -> False
+        prompt, reply ok, resolve ok, resolve pending                     -> False
+        prompt, reply ok, reply ok, resolve ok, resolve pending           -> True
+
+    Each successful resolve spends one successful reply. A failed or denied
+    resolve spends none, so a retry after a resolve error needs no second reply.
+
+    Args:
+        all_transcript_lines: JSON transcript entries, one per line.
+    """
+    unspent_reply_count = 0
+    for each_call in tool_calls_since_last_prompt(all_transcript_lines):
+        unspent_reply_count = _unspent_reply_count_after(unspent_reply_count, each_call)
+    return unspent_reply_count > 0
+
+
+def _unspent_reply_count_after(unspent_reply_count: int, tool_call: TranscriptToolCall) -> int:
+    if not tool_call.succeeded:
+        return unspent_reply_count
+    if is_resolve_call(tool_call.name):
+        return max(0, unspent_reply_count - 1)
+    if is_reply_call(tool_call):
+        return unspent_reply_count + 1
+    return unspent_reply_count
+
+
+def _transcript_shows_reply(transcript_path: str) -> bool | None:
+    try:
+        with open(transcript_path, encoding=UTF8_ENCODING, errors=DECODE_ERRORS_POLICY) as transcript:
+            return has_posted_reply_since_last_resolve(transcript)
+    except OSError:
+        return None
+
+
+def decision_for(all_payload_fields: dict[str, object]) -> dict[str, object] | None:
+    """Return a deny for a review thread resolve with no posted reply before it, else None.
+
+    ::
+
+        resolve after a reply that posted        -> None
+        resolve after a reply a hook refused     -> MISSING_REPLY_REASON
+        resolve with no reply this turn          -> MISSING_REPLY_REASON
+        second resolve after one reply           -> MISSING_REPLY_REASON
+        resolve with an unreadable transcript    -> None
+        any other tool                           -> None
+
+    The gate reads the calling agent's own transcript: a subagent's file when
+    the payload names one, else the session transcript.
+
+    Args:
+        all_payload_fields: The parsed PreToolUse input.
+    """
+    if not is_resolve_call(all_payload_fields.get("tool_name")):
+        return None
+    all_paths = transcript_paths(all_payload_fields)
+    if not all_paths:
+        return None
+    shows_reply = _transcript_shows_reply(all_paths[-1])
+    if shows_reply is None or shows_reply:
+        return None
+    return deny_decision(MISSING_REPLY_REASON)
+
+
+def main() -> int:
+    """Read one payload, print a deny when needed, and exit zero."""
+    return print_decision_from_stdin(decision_for)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/hooks/blocking/test_reply_length_gate.py

@@ -1065,3 +1065,14 @@ def test_should_read_gh_comment_body_and_skip_pr_create() -> None:
     assert reply_length_gate.github_comment_texts("Bash", {"command": flagged_command}) == [f"note=x. {LONG_GITHUB_COMMENT}"]
     chained_command = f"git push && {comment_command}"
     assert reply_length_gate.github_comment_texts("Bash", {"command": chained_command}) == [LONG_GITHUB_COMMENT]
+
+
+def test_should_report_an_over_long_comment_text_with_the_comment_instruction() -> None:
+    violation = reply_length_gate.comment_length_violation(LONG_GITHUB_COMMENT)
+    assert violation is not None
+    assert violation.endswith(reply_length_gate.COMMENT_RETRY_INSTRUCTION)
+
+
+def test_should_pass_a_comment_text_whose_long_part_sits_in_a_details_block() -> None:
+    comment_text = "Fixed.\n<details><summary>Log</summary>\n" + LONG_GITHUB_COMMENT + "\n</details>"
+    assert reply_length_gate.comment_length_violation(comment_text) is None

package/hooks/blocking/test_resolve_thread_reply_gate.py

@@ -0,0 +1,199 @@
+"""Behavior tests for the gate that holds a review thread resolve until a reply posts."""
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+HOOKS_DIRECTORY = Path(__file__).resolve().parent.parent
+if str(HOOKS_DIRECTORY) not in sys.path:
+    sys.path.insert(0, str(HOOKS_DIRECTORY))
+
+from blocking import resolve_thread_reply_gate as gate
+from hooks_constants.resolve_thread_reply_gate_constants import MISSING_REPLY_REASON
+from transcript_skill_scan import TranscriptToolCall
+
+GATE_PATH = Path(__file__).resolve().parent / "resolve_thread_reply_gate.py"
+RESOLVE_TOOL_NAME = "mcp__github__resolve_review_thread"
+REPLY_TOOL_NAME = "mcp__github__add_reply_to_pull_request_comment"
+HOOK_DENIAL_TEXT = "PreToolUse:mcp__github__add_reply_to_pull_request_comment hook error: too many sentences"
+
+
+def _prompt(text: str) -> str:
+    return json.dumps({"type": "user", "message": {"content": text}})
+
+
+def _call(tool_use_id: str, tool_name: str, tool_input: dict[str, object] | None = None) -> str:
+    tool_use = {"type": "tool_use", "id": tool_use_id, "name": tool_name, "input": tool_input or {}}
+    return json.dumps({"type": "assistant", "message": {"content": [tool_use]}})
+
+
+def _result(tool_use_id: str, is_error: bool = False, text: str = "ok") -> str:
+    tool_result = {"type": "tool_result", "tool_use_id": tool_use_id, "is_error": is_error, "content": text}
+    return json.dumps({"type": "user", "message": {"content": [tool_result]}})
+
+
+def _write_transcript(tmp_path: Path, all_lines: list[str]) -> Path:
+    transcript_path = tmp_path / "session.jsonl"
+    transcript_path.write_text("\n".join(all_lines) + "\n", encoding="utf-8")
+    return transcript_path
+
+
+def _resolve_payload(transcript_path: Path) -> dict[str, object]:
+    return {
+        "hook_event_name": "PreToolUse",
+        "tool_name": RESOLVE_TOOL_NAME,
+        "tool_input": {"threadId": "PRRT_1"},
+        "transcript_path": str(transcript_path),
+    }
+
+
+def _deny_reason(decision: dict[str, object] | None) -> str | None:
+    if decision is None:
+        return None
+    hook_output = decision["hookSpecificOutput"]
+    assert isinstance(hook_output, dict)
+    assert hook_output["permissionDecision"] == "deny"
+    return str(hook_output["permissionDecisionReason"])
+
+
+def should_allow_a_resolve_after_a_reply_that_posted(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [
+            _prompt("Address the review threads."),
+            _call("reply-1", REPLY_TOOL_NAME, {"body": "Fixed in `abc1234`."}),
+            _result("reply-1"),
+            _call("resolve-1", RESOLVE_TOOL_NAME),
+        ],
+    )
+    assert gate.decision_for(_resolve_payload(transcript_path)) is None
+
+
+def should_deny_a_resolve_after_a_reply_a_hook_refused(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [
+            _prompt("Address the review threads."),
+            _call("reply-1", REPLY_TOOL_NAME, {"body": "A long reply."}),
+            _result("reply-1", is_error=True, text=HOOK_DENIAL_TEXT),
+            _call("resolve-1", RESOLVE_TOOL_NAME),
+        ],
+    )
+    assert _deny_reason(gate.decision_for(_resolve_payload(transcript_path))) == MISSING_REPLY_REASON
+
+
+def should_deny_a_resolve_with_no_reply(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [_prompt("Address the review threads."), _call("resolve-1", RESOLVE_TOOL_NAME)],
+    )
+    assert _deny_reason(gate.decision_for(_resolve_payload(transcript_path))) == MISSING_REPLY_REASON
+
+
+def should_deny_a_second_resolve_after_one_reply(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [
+            _prompt("Address the review threads."),
+            _call("reply-1", REPLY_TOOL_NAME, {"body": "Fixed in `abc1234`."}),
+            _result("reply-1"),
+            _call("resolve-1", RESOLVE_TOOL_NAME),
+            _result("resolve-1"),
+            _call("resolve-2", RESOLVE_TOOL_NAME),
+        ],
+    )
+    assert _deny_reason(gate.decision_for(_resolve_payload(transcript_path))) == MISSING_REPLY_REASON
+
+
+def should_allow_a_second_resolve_after_two_replies(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [
+            _prompt("Address the review threads."),
+            _call("reply-1", REPLY_TOOL_NAME, {"body": "Fixed in `abc1234`."}),
+            _result("reply-1"),
+            _call("reply-2", REPLY_TOOL_NAME, {"body": "Fixed in `def5678`."}),
+            _result("reply-2"),
+            _call("resolve-1", RESOLVE_TOOL_NAME),
+            _result("resolve-1"),
+            _call("resolve-2", RESOLVE_TOOL_NAME),
+        ],
+    )
+    assert gate.decision_for(_resolve_payload(transcript_path)) is None
+
+
+def should_deny_a_resolve_whose_reply_came_before_the_last_prompt(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [
+            _prompt("Reply on the thread."),
+            _call("reply-1", REPLY_TOOL_NAME, {"body": "Fixed in `abc1234`."}),
+            _result("reply-1"),
+            _prompt("Now resolve the other thread."),
+            _call("resolve-1", RESOLVE_TOOL_NAME),
+        ],
+    )
+    assert _deny_reason(gate.decision_for(_resolve_payload(transcript_path))) == MISSING_REPLY_REASON
+
+
+def should_allow_a_retry_after_a_resolve_error(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [
+            _prompt("Address the review threads."),
+            _call("reply-1", REPLY_TOOL_NAME, {"body": "Fixed in `abc1234`."}),
+            _result("reply-1"),
+            _call("resolve-1", RESOLVE_TOOL_NAME),
+            _result("resolve-1", is_error=True, text="Bad gateway"),
+            _call("resolve-2", RESOLVE_TOOL_NAME),
+        ],
+    )
+    assert gate.decision_for(_resolve_payload(transcript_path)) is None
+
+
+def should_allow_a_resolve_when_the_transcript_cannot_be_read(tmp_path: Path) -> None:
+    assert gate.decision_for(_resolve_payload(tmp_path / "missing.jsonl")) is None
+
+
+def should_ignore_tools_other_than_a_resolve(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(tmp_path, [_prompt("Reply on the thread.")])
+    payload = _resolve_payload(transcript_path) | {"tool_name": REPLY_TOOL_NAME}
+    assert gate.decision_for(payload) is None
+
+
+def should_read_a_resolve_tool_from_any_mcp_server() -> None:
+    assert gate.is_resolve_call("mcp__github_enterprise__resolve_review_thread")
+    assert not gate.is_resolve_call("mcp__github__resolve_review_threads")
+    assert not gate.is_resolve_call(None)
+
+
+def should_count_a_gh_api_reply_command_as_a_reply() -> None:
+    reply_command = "gh api repos/o/r/pulls/7/comments/99/replies -f body=Fixed."
+    assert gate.is_reply_call(TranscriptToolCall("Bash", {"command": reply_command}, True))
+    graphql_command = "gh api graphql -f query='mutation { addPullRequestReviewThreadReply(input: {}) { comment { id } } }'"
+    assert gate.is_reply_call(TranscriptToolCall("Bash", {"command": graphql_command}, True))
+    assert gate.is_reply_call(TranscriptToolCall(REPLY_TOOL_NAME, {}, True))
+    assert not gate.is_reply_call(TranscriptToolCall("mcp__github__add_issue_comment", {}, True))
+
+
+def should_report_a_posted_reply_from_transcript_lines() -> None:
+    all_lines = [_prompt("Go."), _call("reply-1", REPLY_TOOL_NAME), _result("reply-1")]
+    assert gate.has_posted_reply_since_last_resolve(all_lines)
+    assert not gate.has_posted_reply_since_last_resolve(all_lines[:2])
+
+
+def should_print_the_deny_when_run_as_a_hook(tmp_path: Path) -> None:
+    transcript_path = _write_transcript(
+        tmp_path,
+        [_prompt("Address the review threads."), _call("resolve-1", RESOLVE_TOOL_NAME)],
+    )
+    completed_process = subprocess.run(
+        [sys.executable, str(GATE_PATH)],
+        input=json.dumps(_resolve_payload(transcript_path)),
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    assert completed_process.returncode == 0
+    assert _deny_reason(json.loads(completed_process.stdout)) == MISSING_REPLY_REASON

package/hooks/features/conduct-gates.md

@@ -17,6 +17,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 - `blocking/step_note_gate.py` requires a status line before a tool call while its opt-in flag is on.
 - `blocking/verify_before_acting.py` blocks a completed mutating call when the agent's reasoning contains an unchecked claim.
 - `blocking/pr_lifecycle_skill_gate.py` denies a commit, push, pull request action, or merge until the `pr-lifecycle` skill appears in the transcript since the last compaction.
+- `blocking/resolve_thread_reply_gate.py` denies a review thread resolve until the agent's own transcript shows a reply on a thread that posted after the last user prompt and that no successful resolve has spent. Each successful resolve spends one posted reply. A reply is an `add_reply_to_pull_request_comment` call, or a `gh api` call to a comment's `replies` endpoint or to `addPullRequestReviewThreadReply`. A reply whose result is an error, such as a refusal from `blocking/reply_length_gate.py`, does not count. With no readable transcript, the resolve passes.
 - `blocking/verify_before_commit_gate.py` denies a `git commit` in a repository with a `.claude/skills/verify` or `.agents/skills/verify` directory until the `verify` skill loads after the last user prompt, through a Skill call or the `/verify` command in that prompt. It reads the committed paths from the staged diff, the tracked changes for `-a`, and the paths of each `git add` earlier in the same command, and passes a commit whose paths are all docs, images, or test files.
 - `blocking/build_eval_before_eval_write_gate.py` denies a write to an eval file until a Skill call named exactly `claude-api` with args `build-eval`, or the `/claude-api build-eval` command, appears in the transcript.
 - `blocking/merge_review_gate.py` denies an agent's merge until a review pass on the merged head reported zero findings, or ruled out every finding and linked the posted rulings. It reads the receipt `scripts/merge_review_receipt.py` writes, requires the merge, auto-merge or merge-queue entry to be pinned to that head, and skips repositories listed in `CLAUDE_MERGE_REVIEW_EXEMPT_REPOSITORIES`. Its deny reason names the review command `CLAUDE_MERGE_REVIEW_COMMAND` sets. The reason tells the agent to run that command for the first three passes and `/code-review low --fix <number>` for each later pass; the gate itself counts no passes.
@@ -39,6 +40,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 - `blocking/step_note_gate.py` runs on `PreToolUse`, matcher `*`, timeout `15` seconds in `hooks.json`.
 - `blocking/verify_before_acting.py` runs on `PostToolUse`, matcher `Write|Edit|MultiEdit|NotebookEdit|Agent|Task|apply_patch|Bash|PowerShell|mcp__.*`, timeout `10` seconds in `hooks.json`.
 - `blocking/pr_lifecycle_skill_gate.py` runs on `PreToolUse`, matcher `Bash|PowerShell|mcp__.*__(create_pull_request|merge_pull_request|enable_pr_auto_merge|update_pull_request|actions_run_trigger)`, timeout `10` seconds in `hooks.json`.
+- `blocking/resolve_thread_reply_gate.py` runs on `PreToolUse`, matcher `mcp__.*__resolve_review_thread`, timeout `10` seconds in `hooks.json`.
 - `blocking/verify_before_commit_gate.py` runs on `PreToolUse`, matcher `Bash|PowerShell`, timeout `30` seconds in `hooks.json`.
 - `blocking/build_eval_before_eval_write_gate.py` runs on `PreToolUse`, matcher `Write|Edit|MultiEdit|NotebookEdit|apply_patch`, timeout `10` seconds in `hooks.json`.
 - `blocking/merge_review_gate.py` runs on `PreToolUse`, matcher `Bash|PowerShell|mcp__.*__(merge_pull_request|enable_pr_auto_merge)`, timeout `10` seconds in `hooks.json`.
@@ -53,6 +55,7 @@ Preconditions:
 - Run each command from the repository root with Python and pytest available. The tests create transcript and payload fixtures.
 
 - **Reply length.** Input is a reply with four sentences, a plain pull request number, an abbreviation, two sentences with no widget this turn, or widget code with an anchor link. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_reply_length_gate.py -q`. The adjacent test observes a denial and its count, link, or mode reason. Widget code with no flowchart passes with a flowchart reminder in `additionalContext`.
+- **Resolve reply.** Input is a transcript where a thread reply came back refused, or with no reply, or with one reply already spent on a resolve, then a resolve call. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_resolve_thread_reply_gate.py -q`. The adjacent test observes a deny whose reason says to post the reply, confirm it posted, then resolve. A reply that posted before the resolve passes, and an unreadable transcript passes.
 - **Final reply.** Input is a closing reply that says "My guess is one to two hours." or cites a run no tool result shows. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_final_reply_gate.py -q`. The adjacent test observes a `block` decision that quotes the sentence or the citation; a reply that cites a run a tool result shows passes. A reply with a plain-text `D:\Reports\.claude\report.html` is blocked; the same path in backticks or a fenced block passes.
 - **Open tasks.** Input is a session whose task list still has "rotate the deploy key" pending and a closing reply of "Done.". Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_open_tasks_stop_gate.py -q`. The adjacent test observes a `block` decision that names the item; a reply line `Blocked: rotate the deploy key - <what the user must give>` passes. The same file covers an interrupted ask, a continuation plan list that leaves items out, `Done:` and `Dropped:` lines, and a carried item that a later list marks completed.
 - **Ask recorder.** Input is a `UserPromptSubmit` payload with a work prompt, a question, a `<task-notification>` envelope, and a polite request. Run `python -m pytest packages/claude-dev-env/hooks/session/test_open_task_ask_recorder.py -q`. The adjacent test observes `ask-1` and `ask-2` for the work prompt and the request, no ask for the other two, and empty stdout.

package/hooks/hooks.json

@@ -102,6 +102,16 @@
           }
         ]
       },
+      {
+        "matcher": "mcp__.*__resolve_review_thread",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/blocking/resolve_thread_reply_gate.py",
+            "timeout": 10
+          }
+        ]
+      },
       {
         "matcher": "Bash|PowerShell",
         "hooks": [

package/hooks/hooks_constants/artifact_template_pointer_constants.py

@@ -9,6 +9,7 @@ __all__ = [
     "ARTIFACT_QUICKSTART_ACTION",
     "ARTIFACT_TEMPLATE_PATH",
     "ARTIFACT_TOOL_NAME",
+    "PACKAGE_ROOT_DIRECTORY",
     "HTML_PLAN_TEMPLATE_README_PATH",
     "POINTER_TEXT_TEMPLATE",
     "SKILL_NAME_INPUT_KEY",
@@ -23,7 +24,8 @@ ARTIFACT_QUICKSTART_ACTION = "quickstart"
 SKILL_TOOL_NAME = "Skill"
 SKILL_NAME_INPUT_KEY = "skill"
 ALL_ARTIFACT_DESIGN_SKILL_NAMES = frozenset({"artifact-design"})
-TEMPLATES_DIRECTORY = Path(__file__).resolve().parents[2] / "docs" / "templates"
+PACKAGE_ROOT_DIRECTORY = Path(__file__).resolve().parents[2]
+TEMPLATES_DIRECTORY = PACKAGE_ROOT_DIRECTORY / "docs" / "templates"
 ARTIFACT_TEMPLATE_PATH = TEMPLATES_DIRECTORY / "artifact-page" / "README.md"
 HTML_PLAN_TEMPLATE_README_PATH = TEMPLATES_DIRECTORY / "html-plan" / "README.md"
 STATUS_FLOWCHART_TEMPLATE_PATH = TEMPLATES_DIRECTORY / "artifact-page" / "status-flowchart.html"

package/hooks/hooks_constants/resolve_thread_reply_gate_constants.py

@@ -0,0 +1,22 @@
+"""Constants for the gate that holds a review thread resolve until a reply on it posts."""
+
+import re
+
+from hooks_constants.reply_length_gate_constants import (
+    MAXIMUM_SENTENCE_COUNT,
+    MAXIMUM_WORDS_PER_SENTENCE,
+)
+
+RESOLVE_TOOL_NAME_PATTERN = re.compile(r"^mcp__.+__resolve_review_thread$")
+ALL_REPLY_TOOL_NAME_SUFFIXES = ("__add_reply_to_pull_request_comment",)
+SHELL_COMMAND_KEY = "command"
+SHELL_REPLY_COMMAND_PATTERN = re.compile(
+    r"\bgh\s+api\b.*(?:/comments/\d+/replies\b|addPullRequestReviewThreadReply)", re.DOTALL
+)
+MISSING_REPLY_REASON = (
+    "This review thread has no reply that posted since the last user prompt and the last resolve."
+    " Post the reply with add_reply_to_pull_request_comment, confirm its result came back without"
+    " an error, then resolve the thread. A reply that a hook refused did not post; shorten it to"
+    f" at most {MAXIMUM_SENTENCE_COUNT} sentences of at most {MAXIMUM_WORDS_PER_SENTENCE} words each,"
+    " footer included, and send it again."
+)

package/hooks/hooks_constants/test_artifact_template_pointer_constants.py

@@ -47,3 +47,15 @@ def test_every_exported_name_resolves_to_a_module_attribute() -> None:
     ]
 
     assert all_missing_names == []
+
+
+def test_every_template_path_sits_under_the_package_root() -> None:
+    package_root = artifact_template_pointer_constants.PACKAGE_ROOT_DIRECTORY
+
+    assert (package_root / "hooks" / "hooks_constants").is_dir()
+    for each_path in (
+        artifact_template_pointer_constants.ARTIFACT_TEMPLATE_PATH,
+        artifact_template_pointer_constants.HTML_PLAN_TEMPLATE_README_PATH,
+        artifact_template_pointer_constants.STATUS_FLOWCHART_TEMPLATE_PATH,
+    ):
+        assert each_path.relative_to(package_root).parts[:2] == ("docs", "templates")

package/hooks/hooks_constants/transcript_skill_scan_constants.py

@@ -8,3 +8,5 @@ USER_ENTRY_TYPE = "user"
 COMMAND_ARGUMENTS_PATTERN = r"<command-args>(.*?)</command-args>"
 META_ENTRY_FIELD = "isMeta"
 TOOL_RESULT_BLOCK_TYPE = "tool_result"
+IS_ERROR_FIELD = "is_error"
+TOOL_USE_ID_FIELD = "tool_use_id"

package/hooks/session/artifact_template_pointer.py

@@ -37,6 +37,7 @@ from hooks_constants.artifact_template_pointer_constants import (
     ARTIFACT_TEMPLATE_PATH,
     ARTIFACT_TOOL_NAME,
     HTML_PLAN_TEMPLATE_README_PATH,
+    PACKAGE_ROOT_DIRECTORY,
     POINTER_TEXT_TEMPLATE,
     SKILL_NAME_INPUT_KEY,
     SKILL_TOOL_NAME,
@@ -53,6 +54,28 @@ from hooks_constants.spawn_readiness_hook_constants import (
     TOOL_INPUT_KEY,
     TOOL_NAME_KEY,
 )
+from open_task_asks import claude_home
+
+
+def installed_template_path(package_template_path: Path) -> Path:
+    """Return the template path that exists where this hook runs.
+
+    A source checkout keeps ``docs`` beside ``hooks``. An install puts hooks
+    under the agents home and docs under the Claude home, so the same relative
+    path is read from the Claude home there::
+
+        <checkout>/packages/claude-dev-env/docs/templates/x.md  -> kept
+        ~/.agents/docs/templates/x.md (missing)                 -> ~/.claude/docs/templates/x.md
+
+    Args:
+        package_template_path: A template path under the package root.
+
+    Returns:
+        The package path when it exists, else the same relative path under the Claude home.
+    """
+    if package_template_path.exists():
+        return package_template_path
+    return claude_home() / package_template_path.relative_to(PACKAGE_ROOT_DIRECTORY)
 
 
 def starts_an_artifact_page(tool_name: object, tool_input: object) -> bool:
@@ -85,9 +108,9 @@ def decide_hook_output(all_hook_fields: dict[str, object]) -> dict[str, object]
         HOOK_SPECIFIC_OUTPUT_KEY: {
             HOOK_EVENT_NAME_KEY: PRE_TOOL_USE_EVENT_NAME,
             ADDITIONAL_CONTEXT_KEY: POINTER_TEXT_TEMPLATE.format(
-                path_of_status_flowchart=STATUS_FLOWCHART_TEMPLATE_PATH,
-                path_of_plan_readme=HTML_PLAN_TEMPLATE_README_PATH,
-                path_of_page_readme=ARTIFACT_TEMPLATE_PATH,
+                path_of_status_flowchart=installed_template_path(STATUS_FLOWCHART_TEMPLATE_PATH),
+                path_of_plan_readme=installed_template_path(HTML_PLAN_TEMPLATE_README_PATH),
+                path_of_page_readme=installed_template_path(ARTIFACT_TEMPLATE_PATH),
             ),
         }
     }

package/hooks/session/test_artifact_template_pointer.py

@@ -3,6 +3,8 @@ import subprocess
 import sys
 from pathlib import Path
 
+import pytest
+
 _SESSION_DIR = Path(__file__).resolve().parent
 _HOOKS_ROOT = _SESSION_DIR.parent
 for each_sys_path_entry in (str(_SESSION_DIR), str(_HOOKS_ROOT)):
@@ -99,3 +101,17 @@ def test_empty_stdin_stays_quiet() -> None:
         [sys.executable, str(HOOK_SCRIPT)], input="", capture_output=True, text=True, check=True
     )
     assert completed.stdout == ""
+
+
+def test_installed_template_path_should_keep_a_package_path_that_exists() -> None:
+    assert artifact_template_pointer.installed_template_path(ARTIFACT_TEMPLATE_PATH) == ARTIFACT_TEMPLATE_PATH
+
+
+def test_installed_template_path_should_read_the_claude_home_when_the_package_path_is_missing(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setenv("CLAUDE_CONFIG_DIR", str(tmp_path))
+    missing_package_path = artifact_template_pointer.PACKAGE_ROOT_DIRECTORY / "docs" / "templates" / "absent" / "README.md"
+    assert artifact_template_pointer.installed_template_path(missing_package_path) == (
+        tmp_path / "docs" / "templates" / "absent" / "README.md"
+    )

package/hooks/test_transcript_skill_scan.py

@@ -9,10 +9,12 @@ if str(HOOKS_DIRECTORY) not in sys.path:
     sys.path.insert(0, str(HOOKS_DIRECTORY))
 
 from transcript_skill_scan import (
+    TranscriptToolCall,
     invokes_skill_with_argument,
     is_skill_loaded_after_last_compaction,
     is_skill_loaded_since_last_prompt,
     skill_invocation_status,
+    tool_calls_since_last_prompt,
 )
 
 
@@ -158,3 +160,31 @@ def test_slash_command_prompt_loads_the_skill_for_its_own_turn() -> None:
     assert is_skill_loaded_since_last_prompt([_prompt_entry("First."), _prompt_entry(marker)], ("verify",), (marker,))
     compaction = json.dumps({"subtype": "compact_boundary"})
     assert not is_skill_loaded_since_last_prompt([_prompt_entry(marker), compaction], ("verify",), (marker,))
+
+
+def should_list_each_tool_call_since_the_last_prompt_with_its_outcome() -> None:
+    def _call(tool_use_id: str, name: str) -> str:
+        return json.dumps(
+            {"type": "assistant", "message": {"content": [{"type": "tool_use", "id": tool_use_id, "name": name, "input": {}}]}}
+        )
+
+    def _result(tool_use_id: str, is_error: bool) -> str:
+        tool_result = {"type": "tool_result", "tool_use_id": tool_use_id, "is_error": is_error, "content": "x"}
+        return json.dumps({"type": "user", "message": {"content": [tool_result]}})
+
+    lines = [
+        json.dumps({"type": "user", "message": {"content": "First."}}),
+        _call("old", "Read"),
+        _result("old", False),
+        json.dumps({"type": "user", "message": {"content": "Second."}}),
+        _call("ok", "Bash"),
+        _result("ok", False),
+        _call("denied", "Edit"),
+        _result("denied", True),
+        _call("pending", "Write"),
+    ]
+    assert tool_calls_since_last_prompt(lines) == [
+        TranscriptToolCall("Bash", {}, True),
+        TranscriptToolCall("Edit", {}, False),
+        TranscriptToolCall("Write", {}, False),
+    ]

package/hooks/transcript_skill_scan.py

@@ -1,23 +1,37 @@
-"""Find a skill invocation after the last transcript compaction, or one with a given first argument anywhere."""
+"""Find a skill invocation after the last transcript compaction, or one with a given first argument anywhere.
+
+It also lists the tool calls made since the last user prompt, each with whether its result came back without an error.
+"""
 
 from __future__ import annotations
 
 import json
 import re
 from collections.abc import Collection, Iterable, Iterator
+from typing import NamedTuple
 
 from hooks_constants.transcript_skill_scan_constants import (
     ASSISTANT_ENTRY_TYPE,
     COMMAND_ARGUMENTS_PATTERN,
     COMPACT_BOUNDARY_SUBTYPE,
+    IS_ERROR_FIELD,
     META_ENTRY_FIELD,
     SKILL_TOOL_NAME,
     TOOL_RESULT_BLOCK_TYPE,
     TOOL_USE_BLOCK_TYPE,
+    TOOL_USE_ID_FIELD,
     USER_ENTRY_TYPE,
 )
 
 
+class TranscriptToolCall(NamedTuple):
+    """One tool call in a transcript: its name, its input, and whether its result came back without an error."""
+
+    name: str
+    tool_input: dict[str, object]
+    succeeded: bool
+
+
 def _user_command_text(all_entry_fields: dict[str, object]) -> str | None:
     message = all_entry_fields.get("message")
     if all_entry_fields.get("type") != USER_ENTRY_TYPE or not isinstance(message, dict):
@@ -225,3 +239,60 @@ def invokes_skill_with_argument(
         if all_entry_fields and _invokes_skill_with_argument(all_entry_fields, skill_names, argument_word, command_marker):
             return True
     return False
+
+
+def _content_blocks(all_entry_fields: dict[str, object], entry_type: str) -> list[dict[str, object]]:
+    message = all_entry_fields.get("message")
+    if all_entry_fields.get("type") != entry_type or not isinstance(message, dict):
+        return []
+    content = message.get("content")
+    return [each_block for each_block in (content if isinstance(content, list) else []) if isinstance(each_block, dict)]
+
+
+def _tool_use_calls(all_entry_fields: dict[str, object]) -> list[tuple[object, str, dict[str, object]]]:
+    all_tool_use_calls: list[tuple[object, str, dict[str, object]]] = []
+    for each_block in _content_blocks(all_entry_fields, ASSISTANT_ENTRY_TYPE):
+        tool_name = each_block.get("name")
+        tool_input = each_block.get("input")
+        if each_block.get("type") == TOOL_USE_BLOCK_TYPE and isinstance(tool_name, str):
+            all_tool_use_calls.append((each_block.get("id"), tool_name, tool_input if isinstance(tool_input, dict) else {}))
+    return all_tool_use_calls
+
+
+def _succeeded_result_ids(all_entry_fields: dict[str, object]) -> set[object]:
+    return {
+        each_block.get(TOOL_USE_ID_FIELD)
+        for each_block in _content_blocks(all_entry_fields, USER_ENTRY_TYPE)
+        if each_block.get("type") == TOOL_RESULT_BLOCK_TYPE and each_block.get(IS_ERROR_FIELD) is not True
+    }
+
+
+def tool_calls_since_last_prompt(all_transcript_lines: Iterable[str]) -> list[TranscriptToolCall]:
+    """Return the tool calls after the last user prompt, in order, each marked by whether it succeeded.
+
+    ::
+
+        prompt, reply call, its result without an error  -> [reply succeeded]
+        prompt, reply call, its result with is_error     -> [reply failed]
+        prompt, resolve call with no result yet          -> [resolve failed]
+        reply call and result, then a new prompt         -> []
+
+    A hook that denies a call leaves an errored result, so a denied call does
+    not count as a success. A tool result leaves the turn open.
+
+    Args:
+        all_transcript_lines: JSON transcript entries, one per line.
+    """
+    all_calls: list[tuple[object, str, dict[str, object]]] = []
+    all_succeeded_ids: set[object] = set()
+    all_entries = (each_entry for each_entry in map(_parsed_entry, all_transcript_lines) if each_entry is not None)
+    for each_entry_fields in all_entries:
+        if _is_user_prompt(each_entry_fields):
+            all_calls, all_succeeded_ids = [], set()
+            continue
+        all_calls.extend(_tool_use_calls(each_entry_fields))
+        all_succeeded_ids.update(_succeeded_result_ids(each_entry_fields))
+    return [
+        TranscriptToolCall(each_name, each_input, each_id is not None and each_id in all_succeeded_ids)
+        for each_id, each_name, each_input in all_calls
+    ]

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.98.6",
+    "version": "8.98.7",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/scripts/durable_post_lint.py

@@ -18,6 +18,7 @@ from dev_env_scripts_constants.private_term_constants import (
     PRIVATE_TERM_MESSAGE_TEMPLATE,
 )
 from durable_post_lint_config.config.constants import (
+    ACTION_GITHUB_MCP_COMMENT,
     ACTION_PR_CREATE,
     ACTION_PR_EDIT,
     ALL_BARE_VOLATILE_PATH_MARKERS,
@@ -33,6 +34,7 @@ from durable_post_lint_config.config.constants import (
     BODY_MUST_NOT_BE_EMPTY_MESSAGE,
     BODY_REQUIRED_MESSAGE,
     CLEAN_EXIT_CODE,
+    COMMENT_LENGTH_FINDING_CODE,
     CONTENT_FINDING_EXIT_CODE,
     CONVENTIONAL_TITLE_PATTERN,
     EDIT_INPUT_REQUIRED_MESSAGE,
@@ -45,6 +47,8 @@ from durable_post_lint_config.config.constants import (
     MISSING_HEADING_MESSAGE_TEMPLATE,
     PATH_ANCHOR_CHARACTER,
     PATH_SEGMENT_START_CHARACTERS,
+    PROOF_GATE_CREATE_TOOL_NAME,
+    PULL_REQUEST_PROOF_FINDING_CODE,
     RELEASE_BRANCH_PREFIX,
     REPOSITORY_OWNER_SEPARATOR,
     REWRITTEN_RELEASE_BODY_CODE,
@@ -56,6 +60,17 @@ from durable_post_lint_config.config.constants import (
 )
 from private_terms import private_term_line_numbers
 
+_hooks_directory = str(Path(__file__).resolve().parents[1] / "hooks")
+if _hooks_directory not in sys.path:
+    sys.path.insert(0, _hooks_directory)
+
+from blocking.pull_request_proof import (
+    missing_eval_section_reason,
+    missing_existing_work_reason,
+    missing_proof_reason,
+)
+from blocking.reply_length_gate import comment_length_violation
+
 
 class DurablePostUsageError(ValueError):
     """Report an invalid GitHub post request shape."""
@@ -145,6 +160,32 @@ def _description_heading_findings(body_text: str) -> list[DurablePostFinding]:
     ]
 
 
+def _pull_request_proof_findings(
+    title: str | None, body_text: str
+) -> list[DurablePostFinding]:
+    create_payload = {
+        "tool_name": PROOF_GATE_CREATE_TOOL_NAME,
+        "tool_input": {"title": title, "body": body_text},
+    }
+    all_reasons = (
+        missing_proof_reason(create_payload),
+        missing_existing_work_reason(create_payload),
+        missing_eval_section_reason(create_payload),
+    )
+    return [
+        DurablePostFinding(code=PULL_REQUEST_PROOF_FINDING_CODE, message=each_reason)
+        for each_reason in all_reasons
+        if each_reason is not None
+    ]
+
+
+def _comment_length_findings(body_text: str) -> list[DurablePostFinding]:
+    violation = comment_length_violation(body_text)
+    if violation is None:
+        return []
+    return [DurablePostFinding(code=COMMENT_LENGTH_FINDING_CODE, message=violation)]
+
+
 def _contrast_framing_findings(text: str) -> list[DurablePostFinding]:
     all_lines = text.splitlines()
     return [
@@ -210,6 +251,7 @@ def _body_findings(
     action: str,
     body_text: str | None,
     head_branch: str | None = None,
+    title: str | None = None,
 ) -> list[DurablePostFinding]:
     if body_text is None:
         return []
@@ -226,6 +268,10 @@ def _body_findings(
     else:
         if action in ALL_PR_DESCRIPTION_ACTIONS:
             all_findings.extend(_description_heading_findings(body_text))
+        if action == ACTION_PR_CREATE:
+            all_findings.extend(_pull_request_proof_findings(title, body_text))
+        if action == ACTION_GITHUB_MCP_COMMENT:
+            all_findings.extend(_comment_length_findings(body_text))
         all_findings.extend(_contrast_framing_findings(body_text))
     if find_volatile_path_marker(body_text) is not None:
         all_findings.append(
@@ -263,7 +309,7 @@ def lint_durable_post(
     return (
         *_title_findings(title),
         *_private_term_findings(title, repository),
-        *_body_findings(action, body_text, head_branch),
+        *_body_findings(action, body_text, head_branch, title),
         *_private_term_findings(body_text, repository),
     )
 

package/scripts/durable_post_lint_config/config/constants.py

@@ -2,6 +2,7 @@
 
 import re
 
+ACTION_GITHUB_MCP_COMMENT = "github-mcp-comment"
 ACTION_GITHUB_MCP_POST = "github-mcp-post"
 ACTION_ISSUE_COMMENT = "issue-comment"
 ACTION_ISSUE_CREATE = "issue-create"
@@ -13,6 +14,7 @@ ACTION_PR_REVIEW = "pr-review"
 
 ALL_POST_ACTIONS: frozenset[str] = frozenset(
     {
+        ACTION_GITHUB_MCP_COMMENT,
         ACTION_GITHUB_MCP_POST,
         ACTION_ISSUE_COMMENT,
         ACTION_ISSUE_CREATE,
@@ -25,6 +27,7 @@ ALL_POST_ACTIONS: frozenset[str] = frozenset(
 )
 ALL_BODY_REQUIRED_ACTIONS: frozenset[str] = frozenset(
     {
+        ACTION_GITHUB_MCP_COMMENT,
         ACTION_GITHUB_MCP_POST,
         ACTION_ISSUE_COMMENT,
         ACTION_ISSUE_CREATE,
@@ -102,3 +105,6 @@ REWRITTEN_RELEASE_BODY_MESSAGE = (
     "keep the generated text whole"
 )
 REPOSITORY_OWNER_SEPARATOR = "/"
+PROOF_GATE_CREATE_TOOL_NAME = "mcp__github__create_pull_request"
+PULL_REQUEST_PROOF_FINDING_CODE = "pull-request-proof-section"
+COMMENT_LENGTH_FINDING_CODE = "github-comment-length"

package/scripts/durable_post_lint_config/config/test_constants.py

@@ -12,6 +12,7 @@ from durable_post_lint_config.config.constants import (
 
 def test_action_inventory_covers_pull_request_issue_and_tool_posts() -> None:
     assert ALL_POST_ACTIONS == {
+        "github-mcp-comment",
         "github-mcp-post",
         "issue-comment",
         "issue-create",

package/scripts/policy_lint/adapter_configuration.py

@@ -144,6 +144,7 @@ def _names_exempt_registration_path(registered_string: str) -> bool:
         hooks/blocking/open_tasks_stop_gate.py           -> exempt
         hooks/blocking/owned_pr_merge_stop_gate.py       -> exempt
         hooks/blocking/session_title_turn_gate.py        -> exempt
+        hooks/blocking/resolve_thread_reply_gate.py      -> exempt
         hooks/blocking/some_new_blocker.py               -> flagged
 
     The Bash PreToolUse dispatcher sits under ``blocking/`` for layout reasons
@@ -202,6 +203,10 @@ def _names_exempt_registration_path(registered_string: str) -> bool:
     closing reply names no ``Blocked:`` line for it. It decides when a turn may
     end and no code or safety policy.
 
+    The resolve reply gate denies a review thread resolve until a reply on the
+    thread has posted. It decides the order of two review calls and no code or
+    safety policy.
+
     Args:
         registered_string: One command, path, script, or entrypoint string.
     """

package/scripts/policy_lint/config/constants.py

@@ -83,6 +83,7 @@ ALL_ACTION_BOUNDARY_EXEMPT_REGISTRATION_PATHS = (
     "blocking/open_tasks_stop_gate.py",
     "blocking/owned_pr_merge_stop_gate.py",
     "blocking/session_title_turn_gate.py",
+    "blocking/resolve_thread_reply_gate.py",
 )
 ALL_TEST_DIRECTORY_NAMES = frozenset({"tests"})
 ALL_TEST_FILE_PREFIXES = ("test_",)

package/scripts/test_durable_post_lint.py

@@ -11,6 +11,11 @@ import pytest
 
 import durable_post_lint
 from dev_env_scripts_constants.private_term_constants import PrivateTermDigest
+from hooks_constants.pull_request_proof_constants import (
+    MISSING_EVAL_SECTION_REASON,
+    MISSING_EXISTING_WORK_REASON,
+    TEST_ONLY_PROOF_REASON,
+)
 
 SCRIPT_PATH = Path(__file__).resolve().parent / "durable_post_lint.py"
 VALID_PR_BODY = """## Why
@@ -32,7 +37,25 @@ Blast radius text.
 ## Verification
 
 Verification text.
+
+## Existing work
+
+`scripts/durable_post_lint.py:1` holds the post checks.
+
+## Proof in practice
+
+Ran `python scripts/durable_post_lint.py --action pr-create --body-file body.md` on the new body.
+
+## Eval
+
+`python scripts/durable_post_lint.py --action pr-create --body-file eval_body.md`
 """
+OVER_LONG_REPLY_BODY = (
+    "Fixed in `abc1234`.\n\n"
+    "The parser now rejects an empty header.\n\n"
+    "The test covers both cases.\n\n"
+    "---\nPosted by the review agent."
+)
 MINIMAL_PR_BODY = """## Why
 
 Why text.
@@ -54,6 +77,7 @@ Verification text.
         ("issue-edit", None, "Updated issue body."),
         ("issue-comment", None, "Issue comment."),
         ("github-mcp-post", None, "MCP body."),
+        ("github-mcp-comment", None, "Reply body."),
     ],
 )
 def test_all_actions_accept_valid_inputs(
@@ -112,6 +136,7 @@ def test_pr_edit_requires_one_edit_field() -> None:
         "issue-edit",
         "issue-comment",
         "github-mcp-post",
+        "github-mcp-comment",
     ],
 )
 def test_body_actions_require_body(action: str) -> None:
@@ -176,10 +201,9 @@ def test_pr_body_reports_each_missing_heading(missing_heading: str) -> None:
     ]
 
 
-@pytest.mark.parametrize("action", ["pr-create", "pr-edit"])
-def should_accept_a_body_carrying_only_the_two_required_headings(action: str) -> None:
+def should_accept_an_edit_body_carrying_only_the_two_required_headings() -> None:
     all_findings = durable_post_lint.lint_durable_post(
-        action=action,
+        action="pr-edit",
         title="fix(cli): tighten input handling",
         body_text=MINIMAL_PR_BODY,
     )
@@ -201,6 +225,155 @@ def should_still_accept_a_body_published_under_the_superseded_heading_set() -> N
     assert all_findings == ()
 
 
+def should_report_a_create_body_with_no_existing_work_section() -> None:
+    body_text = VALID_PR_BODY.replace(
+        "## Existing work\n\n`scripts/durable_post_lint.py:1` holds the post checks.\n\n", ""
+    )
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-create",
+        title="feat: add durable post linting",
+        body_text=body_text,
+    )
+    assert [each_finding.message for each_finding in all_findings] == [
+        MISSING_EXISTING_WORK_REASON
+    ]
+
+
+def should_report_a_create_body_whose_proof_runs_only_tests() -> None:
+    body_text = VALID_PR_BODY.replace(
+        "Ran `python scripts/durable_post_lint.py --action pr-create --body-file body.md` on the new body.",
+        "Ran `python -m pytest scripts`.",
+    )
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-create",
+        title="fix: tighten durable post linting",
+        body_text=body_text,
+    )
+    assert [each_finding.message for each_finding in all_findings] == [
+        TEST_ONLY_PROOF_REASON
+    ]
+
+
+def should_report_a_feature_create_body_with_no_eval_section() -> None:
+    body_text = VALID_PR_BODY.split("## Eval")[0]
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-create",
+        title="feat: add durable post linting",
+        body_text=body_text,
+    )
+    assert [each_finding.message for each_finding in all_findings] == [
+        MISSING_EVAL_SECTION_REASON
+    ]
+
+
+def should_leave_an_edit_body_with_no_existing_work_section_clean() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-edit",
+        title=None,
+        body_text=MINIMAL_PR_BODY,
+    )
+    assert all_findings == ()
+
+
+def should_exit_with_findings_for_a_create_body_with_no_existing_work_section(
+    tmp_path: Path,
+) -> None:
+    body_file = tmp_path / "body.md"
+    body_file.write_text(
+        VALID_PR_BODY.replace("## Existing work", "## Prior art"), encoding="utf-8"
+    )
+    completed_process = subprocess.run(
+        [
+            sys.executable,
+            str(SCRIPT_PATH),
+            "--action",
+            "pr-create",
+            "--title",
+            "feat: add durable post linting",
+            "--body-file",
+            str(body_file),
+        ],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+    assert completed_process.returncode == 1
+    assert completed_process.stderr == f"{MISSING_EXISTING_WORK_REASON}\n"
+
+
+def should_report_a_review_reply_over_three_sentences() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="github-mcp-comment",
+        title=None,
+        body_text=OVER_LONG_REPLY_BODY,
+    )
+    assert [each_finding.code for each_finding in all_findings] == [
+        "github-comment-length"
+    ]
+
+
+def should_report_a_review_reply_sentence_over_fifteen_words() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="github-mcp-comment",
+        title=None,
+        body_text=(
+            "This change moves the parser into its own module and keeps every"
+            " caller on the same import path."
+        ),
+    )
+    assert [each_finding.code for each_finding in all_findings] == [
+        "github-comment-length"
+    ]
+
+
+def should_accept_a_short_review_reply() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="github-mcp-comment",
+        title=None,
+        body_text="Fixed in `abc1234`.\n\nThe parser now rejects an empty header.",
+    )
+    assert all_findings == ()
+
+
+def should_exit_with_findings_for_an_over_long_review_reply(tmp_path: Path) -> None:
+    body_file = tmp_path / "reply.md"
+    body_file.write_text(OVER_LONG_REPLY_BODY, encoding="utf-8")
+    completed_process = subprocess.run(
+        [
+            sys.executable,
+            str(SCRIPT_PATH),
+            "--action",
+            "github-mcp-comment",
+            "--body-file",
+            str(body_file),
+        ],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+    assert completed_process.returncode == 1
+    assert "at most three short sentences" in completed_process.stderr
+
+
+def should_exit_clean_for_a_short_review_reply(tmp_path: Path) -> None:
+    body_file = tmp_path / "reply.md"
+    body_file.write_text("Fixed in `abc1234`.\n", encoding="utf-8")
+    completed_process = subprocess.run(
+        [
+            sys.executable,
+            str(SCRIPT_PATH),
+            "--action",
+            "github-mcp-comment",
+            "--body-file",
+            str(body_file),
+        ],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+    assert completed_process.returncode == 0
+
+
 def test_non_pr_body_needs_no_pr_headings() -> None:
     all_findings = durable_post_lint.lint_durable_post(
         action="issue-comment",

package/scripts/tests/test_adapter_configuration.py

@@ -58,6 +58,14 @@ def test_pull_request_lifecycle_gate_registration_is_clean(tmp_path: Path) -> No
     assert adapters.hook_configuration_diagnostics(current_document, tmp_path) == ()
 
 
+def test_new_resolve_thread_reply_gate_registration_is_clean(tmp_path: Path) -> None:
+    current_document = _hook_document(
+        ["hooks/blocking/resolve_thread_reply_gate.py"],
+        '{"hooks": {}}',
+    )
+    assert adapters.hook_configuration_diagnostics(current_document, tmp_path) == ()
+
+
 def test_new_merge_offer_gate_registration_is_clean(tmp_path: Path) -> None:
     current_document = _hook_document(
         ["hooks/blocking/merge_over_review_offer_gate.py"],