continuous-improvement 3.22.1 → 3.24.0

package/commands/reconcile.md

@@ -95,7 +95,7 @@ git branch -d <type>/<slug>            # delete the merged feature branch (safe
 ## Pairs with
 
 - **`reconcile`** skill — the discipline this command runs.
-- **`gateguard`** / **`safety-guard`** — runtime + destructive-op guardrails.
+- **`gateguard`** — the runtime gate for mutating tool calls and destructive shell.
 - **`recall`** — recall whether the same git op failed here before.
 - **`audit`** — the loop that often produces the fix `/reconcile` then ships.
 - **`/ship`** — the TDD-gated single-defect variant; `commit-commands:commit-push-pr` is the external-plugin equivalent of the commit → PR tail.

package/commands/ship.md

@@ -1,57 +1,13 @@
 ---
 name: ship
-description: "Single-defect fast path — walk one bug from ground-truth audit through a TDD fix, full verification, a single-concern commit, and an open PR, then stop. Never auto-merges, never deploys. For multi-PR rollouts use /release-train instead."
+description: "Compatibility entry point for the native ship skill. Passes one defect request through unchanged."
+argument-hint: "[one-line defect description]"
 ---
 
 # /ship
 
-The one-defect fast path. `/release-train` is for stacked multi-PR rollouts and `/proceed-with-the-recommendation` walks an arbitrary recommendation list; `/ship` is the common case: fix one defect, open one PR, hand it back for review.
+Invoke the native `ship` skill with this complete defect request:
 
-Pure routing over existing skills. It adds no new orchestration logic and it does NOT bypass branch protection, force-push, auto-merge, or deploy.
+$ARGUMENTS
 
-## Usage
-
-```
-/ship <one-line description of the defect>
-```
-
-If the description is ambiguous or names more than one concern, `/ship` halts and asks you to narrow it — one defect per run.
-
-## Behavior
-
-In order, for the single defect:
-
-1. **Ground truth** — `reconcile` (or its inline fallback): confirm the working tree is clean and on a feature branch cut from an up-to-date `origin/<base>`. If on a protected branch or a stale base, halt and ask.
-2. **Reproduce (RED)** — `tdd-workflow`: write a failing test that reproduces the defect; watch it fail. Pre-test implementation code is deleted, not kept.
-3. **Fix (GREEN)** — write the minimal change that makes the test pass; watch it pass. One concern only.
-4. **Verify** — `verification-loop`: run the project's verify ladder (build, types, tests). Build-green is evidence of mechanism, not of the fix — confirm the defect itself no longer reproduces.
-5. **Commit** — one commit, one concern, staged by explicit filename (never `git add -A`). Use a Windows-safe commit message: a single-line `-m` (repeat `-m` for paragraphs) or `git commit -F <tempfile>` — no multi-line here-docs/here-strings.
-6. **Open PR** — `commit-commands:commit-push-pr` (or `gh pr create`): push the branch and open a single-concern PR that cites the plan or issue. **Stop here.** The merge is yours.
-7. **Deploy receipt (advisory)** — after you merge, `deploy-receipt` verifies the deployed SHA matches the merge SHA. Advisory only; `/ship` does not deploy.
-
-## Hard stops (halt and ask, never improvise)
-
-- Ambiguous or multi-concern defect description.
-- Working tree not clean, or branch is protected / cut from a stale base.
-- Any verification step fails with a non-obvious fix.
-- The fix would touch more than 15 non-generated files (that is no longer one concern — split it, or use `/release-train`).
-- Push would target a protected branch.
-
-## Anti-patterns this command refuses
-
-- **Auto-merge.** Never merges the PR it opens, even when CI is green.
-- **Deploy.** Never runs a deploy; `deploy-receipt` only verifies after you merge.
-- **Bypass.** No `--admin`, `--force`, `--no-verify`.
-- **Bundled concerns.** Will not fold an unrelated fix into the same commit; logs it as a deferred follow-up instead.
-
-## Composition
-
-Routes through, in order: `reconcile` → `tdd-workflow` → `verification-loop` → `commit-commands:commit-push-pr` → `deploy-receipt`. Each step falls back to its inline behavior when the preferred skill is not installed.
-
-## Example
-
-```
-/ship registration form accepts a negative deposit amount
-```
-
-Reconciles git state, writes a failing test asserting deposits must be positive, implements the guard, runs the verify ladder, commits one concern with a single-line message, opens the PR, and stops for your review.
+Follow that skill exactly. Do not reconstruct or duplicate its Git, worktree, TDD, return, cleanup, merge, or deploy rules here. If the native skill is unavailable, stop and tell the operator to update or reinstall `continuous-improvement`.

package/commands/superpowers.md

@@ -13,7 +13,7 @@ The 7 Laws define *what* discipline must be applied. `/superpowers` decides *whi
 
 | Source | Where it lives | Examples of what it routes to |
 |---|---|---|
-| `continuous-improvement` (this plugin) | bundled — always present | `gateguard` (Law 1), `tdd-workflow` (Law 3+4), `verification-loop` (Law 4), `wild-risa-balance` (Law 2), `safety-guard` (Law 3), `proceed-with-the-recommendation` (all 7), `ralph` (Law 6), `workspace-surface-audit` (Law 1) |
+| `continuous-improvement` (this plugin) | bundled — always present | `gateguard` (Law 1), `tdd-workflow` (Law 3+4), `verification-loop` (Law 4), `wild-risa-balance` (Law 2), `proceed-with-the-recommendation` (all 7), `ralph` (Law 6), `workspace-surface-audit` (Law 1) |
 | `obra/superpowers` (Jesse Vincent) | vendored at `third-party/superpowers/`, pinned SHA `f2cbfbe` (v5.1.0) | `superpowers:brainstorming`, `:writing-plans`, `:executing-plans`, `:test-driven-development`, `:systematic-debugging`, `:requesting-code-review`, `:receiving-code-review`, `:verification-before-completion`, `:dispatching-parallel-agents`, `:using-git-worktrees`, `:finishing-a-development-branch`, `:subagent-driven-development`, `:writing-skills`, `:using-superpowers` |
 | `addyosmani/agent-skills` | vendored at `third-party/addy-agent-skills/`, pinned SHA `742dca5` (v1.0.0) | `spec-driven-development`, `source-driven-development`, `context-engineering`, `idea-refine`, `incremental-implementation`, `code-review-and-quality`, `code-simplification`, `security-and-hardening`, `debugging-and-error-recovery`, `performance-optimization`, `api-and-interface-design`, `frontend-ui-engineering`, `browser-testing-with-devtools`, `ci-cd-and-automation`, `deprecation-and-migration`, `documentation-and-adrs`, `git-workflow-and-versioning`, `planning-and-task-breakdown`, `shipping-and-launch` |
 | `ruflo-swarm` (ruvnet) | vendored at `third-party/ruflo-swarm/`, pinned SHA `addb5cd` (v0.2.0) | `swarm-init`, `monitor-stream`; `swarm_*` and `agent_*` MCP tools; `/swarm`, `/watch` |

package/commands/verify-install.md

@@ -29,9 +29,14 @@ with the text `probe`) **without presenting any research first**.
 
 - If the hook **blocks** the write with a fact-list reason — the runtime layer is
   wired. Record `gateguard: ✓`. Do not retry the write; the block is the pass.
-- If the write **goes through** with no pause — the hook did not load. Record
-  `gateguard: ✗ (hooks/gateguard.mjs not wired — see README → Troubleshooting install)`.
-  Delete the probe file if it was created.
+- If the write **goes through** with no pause — either the hook did not load, or
+  `CI_GATEGUARD_EXCLUDE` is set to a fragment that matches the probe path (a
+  catch-all such as `/` or `.` matches every path and switches the file gate off;
+  the hook prints a one-line stderr notice when an exclusion fires). Run
+  `echo "$CI_GATEGUARD_EXCLUDE"` first. If it is empty, record
+  `gateguard: ✗ (hooks/gateguard.mjs not wired — see README → Troubleshooting install)`;
+  if it is set, record `gateguard: ✗ (excluded by CI_GATEGUARD_EXCLUDE=<value>; unset it or
+  narrow the fragment)`. Delete the probe file if it was created.
 
 ## Check 3 — observation capture recording
 

package/hooks/companion-preference.mjs

@@ -30,10 +30,10 @@
  * suite or a follow-up audit walks the table against this map.
  */
 import { execFileSync } from "node:child_process";
-import { createHash } from "node:crypto";
 import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { hashProjectRoot } from "../lib/gateguard-state.mjs";
 const OVERRIDES = {
     "tdd-workflow": {
         companion: "superpowers:test-driven-development",
@@ -125,10 +125,7 @@ function resolveProjectRoot() {
     return "global";
 }
 function telemetryPath(home) {
-    const hash = createHash("sha256")
-        .update(resolveProjectRoot())
-        .digest("hex")
-        .slice(0, 12);
+    const hash = hashProjectRoot(resolveProjectRoot());
     return join(home, ".claude", "instincts", hash, "companion-preference.jsonl");
 }
 /**

package/hooks/config-guard.mjs

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+/**
+ * Runtime PreToolUse config-guard hook.
+ *
+ * Stdin  : JSON { tool_name, tool_input }
+ * Stdout : empty on allow / warn (warn prints to stderr); on block, the
+ *          documented PreToolUse shape:
+ *          { hookSpecificOutput: { hookEventName: "PreToolUse",
+ *            permissionDecision: "deny", permissionDecisionReason } }
+ * Exit   : 0 always (decision is in stdout; fail-open on any error).
+ *
+ * Guards the files that wire the guardrails: `.claude/settings*.json`,
+ * `.mcp.json`, `hooks.json`, `.claude/hooks/`, `.claude/plugins/`,
+ * `.claude-plugin/`, and the `claude plugin|mcp|config` CLI forms that edit
+ * them. Pure logic in ../lib/config-guard-gate.mjs.
+ *
+ * Mode via CI_CONFIG_GUARD: "warn" (default) | "block" | "off".
+ *   warn  : print a one-line notice to stderr; never blocks.
+ *   block : emit the PreToolUse deny shape.
+ *   off   : no-op.
+ * One-call bypass: CI_CONFIG_GUARD_ALLOW=true allows the call and says so.
+ *
+ * Registered with a tool matcher (Bash|Edit|MultiEdit|Write|NotebookEdit) so
+ * read-only tools never spawn it. No network. No git. Fail-open.
+ */
+import { readFileSync } from "node:fs";
+import { classifyMutation, decide, parseMode } from "../lib/config-guard-gate.mjs";
+function readStdinSync() {
+    try {
+        return readFileSync(0, "utf8");
+    }
+    catch {
+        return "";
+    }
+}
+function safeJsonParse(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+function buildReason(toolName, hit, mode) {
+    const what = hit.via === "claude-cli"
+        ? `\`${hit.target}\` edits the plugin / MCP / settings configuration`
+        : `${toolName} would modify ${hit.target} (matches "${hit.pattern}")`;
+    return [
+        `config-guard: ${what}, one of the files that wires the guardrails (settings, MCP config, hooks, installed plugins).`,
+        "If this is intended, rerun this one call with CI_CONFIG_GUARD_ALLOW=true, or set CI_CONFIG_GUARD=off for the session.",
+        mode === "block"
+            ? "You are seeing a deny because CI_CONFIG_GUARD=block; the default is warn."
+            : "This is a warning (CI_CONFIG_GUARD=warn, the default); set CI_CONFIG_GUARD=block to deny instead.",
+    ].join("\n");
+}
+function main() {
+    const mode = parseMode(process.env.CI_CONFIG_GUARD);
+    if (mode === "off")
+        return;
+    const payload = safeJsonParse(readStdinSync());
+    if (!payload || typeof payload !== "object")
+        return;
+    const obj = payload;
+    const toolName = typeof obj.tool_name === "string" ? obj.tool_name : "";
+    const toolInput = obj.tool_input && typeof obj.tool_input === "object" ? obj.tool_input : {};
+    const hit = classifyMutation(toolName, toolInput);
+    if (!hit)
+        return;
+    if (String(process.env.CI_CONFIG_GUARD_ALLOW ?? "").trim().toLowerCase() === "true") {
+        process.stderr.write(`[continuous-improvement] config-guard: CI_CONFIG_GUARD_ALLOW=true let ${toolName} touch ${hit.target} on this call.\n`);
+        return;
+    }
+    const decision = decide(mode, true, buildReason(toolName, hit, mode));
+    if (decision.action === "block") {
+        process.stdout.write(`${JSON.stringify({
+            hookSpecificOutput: {
+                hookEventName: "PreToolUse",
+                permissionDecision: "deny",
+                permissionDecisionReason: decision.reason,
+            },
+        })}\n`);
+        return;
+    }
+    if (decision.action === "warn") {
+        process.stderr.write(`[continuous-improvement] ${decision.reason.split("\n")[0]}\n`);
+    }
+}
+try {
+    main();
+}
+catch {
+    // fail-open: never block a session on a hook error
+}
+process.exit(0);

package/hooks/gateguard.mjs

@@ -35,6 +35,7 @@
 import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { classifyDestructiveBash } from "../lib/destructive-bash.mjs";
 import { MAX_CLEARED_FILES, canonicalizeFileKey, canonicalizeProjectRoot, isCapReached, isFileCleared, loadState, markFileCleared, resolveProjectRoot, resolveSessionDir, saveState, } from "../lib/gateguard-state.mjs";
 const TOOL_ROUTE = {
     Read: "allow",
@@ -48,42 +49,14 @@ const TOOL_ROUTE = {
     NotebookEdit: "mutating-file",
     Bash: "allow",
 };
-const DESTRUCTIVE_PATTERNS = [
-    "rm -rf",
-    "rm -fr",
-    "git reset --hard",
-    "git push --force",
-    "git push -f",
-    "--force-with-lease",
-    "git branch -D",
-    "drop table",
-    "drop database",
-    "drop schema",
-    "truncate ",
-    "mkfs",
-    "dd if=",
-    "format ",
-    "rmdir /s",
-    "del /f /q",
-    "del /q /f",
-    "Remove-Item -Recurse",
-    "Remove-Item -Force",
-];
-// Flags whose VALUE is human prose (a commit message, a PR body) or a filename —
-// never a command to execute. Their contents must not trip the destructive scan:
-// `git commit -m "drop the stale format helper"` and `gh pr create --body "…"`
-// were stranding finished work on their own wording. `-c` is deliberately
-// EXCLUDED — `bash -c "rm -rf /"` carries a real command and must still gate.
-const MESSAGE_FLAG_RE = /(^|\s)(-m|--message|-F|--file|--body|--body-file|--title|--notes|-C|--reuse-message)(=|\s+)('[^']*'|"[^"]*"|\S+)/g;
-// Blank the value of every message/body flag so only executable command syntax
-// remains for the destructive-pattern scan. The flag itself is preserved so a
-// flag like `-F` never accidentally merges with its neighbours.
-function stripMessageArgs(command) {
-    return command.replace(MESSAGE_FLAG_RE, (_match, lead, flag) => `${lead}${flag} `);
-}
+// The destructive-Bash classifier lives in lib/destructive-bash.mjs: structured
+// rules (flag order and spelling do not matter: `rm -r -f`, `git clean -fdx`,
+// `git checkout -- .`, `git restore .`, `find -delete`, `git push +ref`,
+// `git stash drop`) plus the original substring list as the fallback. The
+// message-flag carve-out (`git commit -m "…"`) lives there too. Each rule has
+// a stable id the deny reason prints, so a block is explainable.
 function isDestructiveBash(command) {
-    const lower = stripMessageArgs(command).toLowerCase();
-    return DESTRUCTIVE_PATTERNS.some((p) => lower.includes(p.toLowerCase()));
+    return classifyDestructiveBash(command).destructive;
 }
 function classifyTool(toolName, toolInput) {
     const route = TOOL_ROUTE[toolName] ?? "allow";
@@ -119,12 +92,34 @@ const EXCLUDE_FRAGMENTS = String(process.env.CI_GATEGUARD_EXCLUDE ?? "")
     .split(",")
     .map((fragment) => fragment.trim().replace(/\\/g, "/").toLowerCase())
     .filter((fragment) => fragment !== "");
-function isExcludedPath(filePath) {
+function matchedExcludeFragment(filePath) {
     if (EXCLUDE_FRAGMENTS.length === 0 || typeof filePath !== "string" || filePath === "") {
-        return false;
+        return null;
     }
     const normalized = filePath.replace(/\\/g, "/").toLowerCase();
-    return EXCLUDE_FRAGMENTS.some((fragment) => normalized.includes(fragment));
+    return EXCLUDE_FRAGMENTS.find((fragment) => normalized.includes(fragment)) ?? null;
+}
+function isExcludedPath(filePath) {
+    return matchedExcludeFragment(filePath) !== null;
+}
+// A fragment every path contains ("/", ".", any single character) is not an
+// exclusion, it is an off switch for the whole file gate. It is still honoured —
+// the operator set it — but silently honouring it is how a host ends up with the
+// headline feature off and nobody noticing (this repo's own author's shell had
+// CI_GATEGUARD_EXCLUDE="/,." for weeks). So every exclusion prints one stderr
+// line, and a catch-all says plainly that the gate is off. stderr never changes
+// the decision: allow stays empty stdout + exit 0.
+function isCatchAllFragment(fragment) {
+    return fragment.length <= 1 || fragment === "./" || fragment === "..";
+}
+function buildExcludeNotice(paths, fragment) {
+    const shown = paths.map((p) => p.replace(/\\/g, "/")).join(", ");
+    if (isCatchAllFragment(fragment)) {
+        return (`[continuous-improvement] gateguard: CI_GATEGUARD_EXCLUDE fragment "${fragment}" matches every path, ` +
+            `so the file gate is off for this session (skipped ${shown}). ` +
+            "Narrow it to a directory, e.g. CI_GATEGUARD_EXCLUDE=docs/wiki, to get the gate back.");
+    }
+    return `[continuous-improvement] gateguard: skipped by CI_GATEGUARD_EXCLUDE (fragment "${fragment}" matched ${shown}).`;
 }
 // --- Target lock (opt-in) --------------------------------------------------
 // A fact-list can't catch a wrong-repo / wrong-worktree write — you can present
@@ -271,6 +266,7 @@ function buildBraceRefReason(hit) {
     ].join("\n");
 }
 function buildDestructiveBashReason(command) {
+    const rule = classifyDestructiveBash(command).rule ?? "unknown";
     return [
         `Destructive command requested: ${command}`,
         "",
@@ -278,6 +274,7 @@ function buildDestructiveBashReason(command) {
         "  2. Write a one-line rollback procedure",
         "  3. Quote the user's current instruction verbatim",
         "",
+        `Matched rule: ${rule}`,
         "Destructive Bash gates EVERY call — clearance is not cached.",
     ].join("\n");
 }
@@ -354,7 +351,10 @@ function main() {
     const allTargetPaths = extractFilePaths(toolInput);
     const filePaths = allTargetPaths.filter((path) => !isExcludedPath(path));
     if (allTargetPaths.length > 0 && filePaths.length === 0) {
-        emitAllow(); // every target is under a CI_GATEGUARD_EXCLUDE path; skip the gate
+        // Every target is under a CI_GATEGUARD_EXCLUDE path; skip the gate, but say so.
+        const fragment = matchedExcludeFragment(allTargetPaths[0]) ?? EXCLUDE_FRAGMENTS[0];
+        process.stderr.write(`${buildExcludeNotice(allTargetPaths, fragment)}\n`);
+        emitAllow();
         return;
     }
     // Target lock runs before the fact gate and independent of clearance: a

package/hooks/goal-drift-stop.mjs

@@ -17,10 +17,10 @@
 // construction: any error / missing goal / unreadable observations exits 0 and
 // never blocks. No network. 5s hook budget.
 import { execFileSync } from "node:child_process";
-import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { evaluateGoalDrift } from "../lib/goal-drift-gate.mjs";
+import { hashProjectRoot } from "../lib/gateguard-state.mjs";
 import { resolveHomeDir } from "../lib/resolve-home-dir.mjs";
 function readStdinSync() {
     try {
@@ -62,7 +62,7 @@ function resolveProjectRoot() {
     return "global";
 }
 function projectHash(root) {
-    return createHash("sha256").update(root).digest("hex").slice(0, 12);
+    return hashProjectRoot(root);
 }
 function readGoalMarkdown(projectRoot, instinctsProjectDir) {
     const candidates = [join(projectRoot, "task_plan.md"), join(instinctsProjectDir, "goal.md")];

package/hooks/query-cost-nudge.mjs

@@ -16,7 +16,7 @@
  * the DB files stay dirty. Never blocks; fail-open on any error.
  */
 import { execFileSync } from "node:child_process";
-import { createHash } from "node:crypto";
+import { hashProjectRoot } from "../lib/gateguard-state.mjs";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
@@ -71,7 +71,7 @@ function markerKey(sessionId) {
     return sanitized || `day-${new Date().toISOString().slice(0, 10)}`;
 }
 function markerPath(home, projectRoot, sessionId) {
-    const hash = createHash("sha256").update(projectRoot).digest("hex").slice(0, 12);
+    const hash = hashProjectRoot(projectRoot);
     return join(home, ".claude", "instincts", hash, "query-cost-nudge", `${markerKey(sessionId)}.nudged`);
 }
 function main() {

package/hooks/recall-briefing.mjs

@@ -23,13 +23,13 @@
  * ~/.claude/instincts/<project-hash>/recall-briefing-session.json records which
  * session_ids have been briefed so each session is briefed at most once.
  */
-import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { execFileSync } from "node:child_process";
 import { buildIndex, query } from "../lib/recall-index.mjs";
 import { DEFAULT_MAX_HITS, decideBriefing } from "../lib/recall-briefing.mjs";
+import { hashProjectRoot } from "../lib/gateguard-state.mjs";
 const ENABLED_VALUES = new Set(["1", "on", "true", "yes"]);
 const MAX_BRIEFED_KEYS = 1000;
 function isEnabled() {
@@ -65,7 +65,7 @@ function resolveProjectRoot() {
     return "global";
 }
 function instinctsDir(home) {
-    const hash = createHash("sha256").update(resolveProjectRoot()).digest("hex").slice(0, 12);
+    const hash = hashProjectRoot(resolveProjectRoot());
     return join(home, ".claude", "instincts", hash);
 }
 function readObservations(dir) {

package/hooks/route-prompt.mjs

@@ -30,12 +30,12 @@
  *   }
  * Rows are evaluated in order; first match wins.
  */
-import { createHash } from "node:crypto";
 import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import { hashProjectRoot } from "../lib/gateguard-state.mjs";
 function readStdin() {
     try {
         return readFileSync(0, "utf8");
@@ -65,10 +65,7 @@ function resolveProjectRoot() {
     return "global";
 }
 function telemetryPath(home) {
-    const hash = createHash("sha256")
-        .update(resolveProjectRoot())
-        .digest("hex")
-        .slice(0, 12);
+    const hash = hashProjectRoot(resolveProjectRoot());
     return join(home, ".claude", "instincts", hash, "route-prompt.jsonl");
 }
 function writeTelemetry(home, event) {

package/hooks/session.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { execFileSync } from "node:child_process";
-import { createHash } from "node:crypto";
 import { readFileSync, readdirSync } from "node:fs";
 import { join } from "node:path";
+import { hashProjectRoot } from "../lib/gateguard-state.mjs";
 import { resolveHomeDir } from "../lib/resolve-home-dir.mjs";
 function read(path) {
     try {
@@ -62,7 +62,7 @@ function main() {
     if (!home)
         return;
     const instinctsRoot = join(home, ".claude", "instincts");
-    const hash = createHash("sha256").update(projectRoot()).digest("hex").slice(0, 12);
+    const hash = hashProjectRoot(projectRoot());
     const projectDir = join(instinctsRoot, hash);
     const files = [...yamlFiles(projectDir), ...yamlFiles(join(instinctsRoot, "global"))];
     const observations = read(join(projectDir, "observations.jsonl")).split(/\r?\n/).filter(Boolean).length;

package/hooks/workflow-distill.mjs

@@ -24,9 +24,9 @@
 // name + verify command, so a run is nudged at most once. Fail-open by
 // construction: any error exits 0 and never blocks. No network. 5s hook budget.
 import { execFileSync } from "node:child_process";
-import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { hashProjectRoot } from "../lib/gateguard-state.mjs";
 import { resolveHomeDir } from "../lib/resolve-home-dir.mjs";
 import { workflowRunFromObservations } from "../lib/skill-distill.mjs";
 function safeJsonParse(text) {
@@ -60,7 +60,7 @@ function resolveProjectRoot() {
     return "global";
 }
 function projectHash(root) {
-    return createHash("sha256").update(root).digest("hex").slice(0, 12);
+    return hashProjectRoot(root);
 }
 function readObservations(instinctsProjectDir) {
     const file = join(instinctsProjectDir, "observations.jsonl");