create-agent-rig 0.6.0 → 0.6.2

package/templates/agent-os/universal/.claude/hooks/guard-rulebook.mjs

@@ -2,11 +2,13 @@
 // PreToolUse hook: in an UNATTENDED run, the rulebook is never edited outside
 // the current item's allow-list (AR-51).
 //
-// The rulebook is the set of files that decide what this session may do — the
-// hooks, their wiring, the queue config and adapters, the router and the gate
-// sweep, the rules, `CLAUDE.md`. Every one of them was editable by the run it
-// governs: a Write to `.claude/hooks/dod-checks.json` with `[]` switched the
-// stop gate off, and nothing refused it until the merge sweep, long after.
+// The rulebook is the set of files that decide what this session may do — hooks
+// and settings wiring, the queue config and selector, all scripts, rules, skills
+// and agents, the `.codex/` configuration, the integrity manifest,
+// `.claude/doctor-exemptions.json`, `AGENTS.md` and `CLAUDE.md`. Every one of
+// them was editable by the run it governs: a
+// Write to `.claude/hooks/dod-checks.json` with `[]` switched the stop gate
+// off, and nothing refused it until the merge sweep, long after.
 //
 // How it decides — and it is deliberately dumb:
 //   1. No unattended flag on disk (`.claude/scripts/unattended-flag.mjs`) → an
@@ -14,8 +16,12 @@
 //      the rulebook on purpose.
 //   2. Flag present and readable → every edit fragment whose repo-relative path
 //      sits under a rulebook prefix is refused (exit 2) unless it also sits
-//      under one of the item's `allow` prefixes. Paths outside the rulebook are
-//      never judged.
+//      under one of the item's `allow` prefixes. A known path outside the
+//      rulebook is never judged — › "allows a MultiEdit beyond the fragment cap
+//      when its known path is outside the rulebook". A pathless global refusal
+//      for an oversized or unsupported `apply_patch` payload is blocked while
+//      armed because its scope cannot be proved — › "states the pathless
+//      global-refusal limit for oversized and unsupported apply_patch payloads".
 //   3. Flag present and UNREADABLE → a rulebook edit is refused and the reason
 //      names the flag; an edit outside the rulebook still passes. Refusing to
 //      inspect is not allowing (`.claude/rules/invariants.md`).
@@ -37,15 +43,12 @@
 //   - it judges paths, not content: a README that merely mentions
 //     `.claude/hooks/guard-bash.mjs` is not a rulebook edit — › "guards the
 //     path, not prose that mentions a guarded path";
-//   - it compares paths as text: the repo-relative tail is what is left after
-//     stripping `CLAUDE_PROJECT_DIR` (falling back to the working directory
-//     when the harness does not set it) from the front of the tool's absolute
-//     path, so a root spelled differently from the file path — a symlinked
-//     `/tmp` versus `/private/tmp`, a case difference on a case-insensitive
-//     disk — is not stripped, and the edit is not judged. Documented and
-//     measured, not fixed: the harness spells both from one root — › "compares
-//     paths as text: a root spelled differently from the file path is not
-//     judged (documented, fails open)";
+//   - it compares both roots and payload paths in their selected and canonical
+//     spellings, whether selection came from `CLAUDE_PROJECT_DIR` or the
+//     working-directory fallback — › "canonicalizes a differently spelled
+//     checkout root before guarding a canonical payload path", › "blocks when
+//     the checkout root and payload use the same symlink spelling", and
+//     › "blocks an existing rulebook file when only the payload path uses a symlink spelling";
 //   - an `allow` prefix is a string prefix of the repo-relative path and may
 //     not widen the rulebook — an entry that is itself a prefix of a rulebook
 //     prefix (`.`, `.claude/`, `.claude/scripts/`) makes the flag unreadable
@@ -58,9 +61,11 @@
 //     adversary.
 //
 // The rule it enforces is stated in `.claude/rules/autonomy.md`, "Never".
-import { readFileSync } from 'node:fs';
+import { realpathSync } from 'node:fs';
+import { basename, dirname, join, resolve } from 'node:path';
 import { editFragments } from './lib/edit-input.mjs';
 import { RULEBOOK_PREFIXES, isRulebookPath, readUnattended } from '../scripts/unattended-flag.mjs';
+import { readHookInput } from './lib/hook-input.mjs';
 
 export { RULEBOOK_PREFIXES, isRulebookPath };
 
@@ -68,6 +73,41 @@ const EDIT_TOOLS = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit', 'apply
 
 const toPosix = (value) => String(value ?? '').replaceAll('\\', '/');
 
+// RP-54: `.native`, never plain `realpathSync`. Both resolve symlinks and
+// normalise separators; only the native one expands a Windows 8.3 short name,
+// so `C:\Users\RUNNER~1\…` and `C:\Users\runneradmin\…` otherwise survive as
+// two spellings of one directory. The root arrives from
+// `git rev-parse --show-toplevel` (long) while a payload path arrives however
+// the tool spelled it (short under an 8.3 temp or home), and a root that
+// matches no spelling of the payload makes this fail-open guard allow the
+// rulebook edit it exists to refuse. Both sites take the same canonicaliser or
+// the comparison is between two different normalisations. Measured on Windows
+// by codex.test.ts (absent in a generated rig) › "anchors a nested-cwd Windows
+// Codex rulebook edit to the canonical repository root".
+const canonicalRoot = (root) => {
+  try {
+    return realpathSync.native(root);
+  } catch {
+    return root;
+  }
+};
+
+/** Resolve symlinks in the nearest existing ancestor, preserving a missing tail. */
+const canonicalPath = (filePath) => {
+  let cursor = resolve(filePath);
+  const tail = [];
+  for (;;) {
+    try {
+      return join(realpathSync.native(cursor), ...tail);
+    } catch {
+      const parent = dirname(cursor);
+      if (parent === cursor) return filePath;
+      tail.unshift(basename(cursor));
+      cursor = parent;
+    }
+  }
+};
+
 /** The repo-relative tail of an absolute path, or the path itself when it is not under the root. */
 export const relativeTo = (root, filePath) => {
   const dir = toPosix(root).replace(/\/+$/, '');
@@ -79,38 +119,67 @@ export const relativeTo = (root, filePath) => {
 export const isAllowed = (rel, allow) =>
   (Array.isArray(allow) ? allow : []).some((prefix) => prefix !== '' && (rel === prefix || rel.startsWith(prefix)));
 
+const protectedRelative = (roots, filePath) =>
+  [...new Set([filePath, canonicalPath(filePath)])]
+    .flatMap((spelling) => roots.map((root) => relativeTo(root, spelling)))
+    .find(isRulebookPath);
+
 function main() {
-  let input;
-  try {
-    input = JSON.parse(readFileSync(0, 'utf8'));
-  } catch {
-    return 0; // unparseable payload: not ours to judge
-  }
+  const input = readHookInput();
+  if (input === null) return 0; // unparseable payload: not ours to judge
   if (!EDIT_TOOLS.has(input?.tool_name)) return 0;
 
-  const root = process.env.CLAUDE_PROJECT_DIR ?? process.cwd();
+  const selectedRoot = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  const root = canonicalRoot(selectedRoot);
+  const comparisonRoots = [...new Set([root, selectedRoot])];
+  const unattendedEnv = { ...process.env, CLAUDE_PROJECT_DIR: root };
+  const fragments = editFragments(input);
+  const globalRefusal = fragments.find(
+    ({ inspectionRefusal, appliesToAll }) => appliesToAll && inspectionRefusal,
+  );
+  if (globalRefusal) {
+    if (globalRefusal.filePath) {
+      const rel = protectedRelative(comparisonRoots, globalRefusal.filePath);
+      if (rel === undefined) return 0;
+    }
+    const mode = readUnattended(unattendedEnv);
+    if (!mode.on) return 0;
+    process.stderr.write(
+      `BLOCKED — cannot safely inspect this unattended edit: ${globalRefusal.inspectionRefusal}\n` +
+        `${globalRefusal.remedy ?? 'Split it into a smaller edit and retry.'}\n`,
+    );
+    return 2;
+  }
   const paths = [];
-  for (const { filePath } of editFragments(input)) {
+  for (const { filePath } of fragments) {
     if (typeof filePath !== 'string' || filePath === '') continue;
-    const rel = relativeTo(root, filePath);
-    if (isRulebookPath(rel) && !paths.includes(rel)) paths.push(rel);
-    if (paths.length >= 64) break;
+    const rel = protectedRelative(comparisonRoots, filePath);
+    if (rel !== undefined && !paths.includes(rel)) paths.push(rel);
   }
   if (paths.length === 0) return 0; // nothing under the rulebook: never judged
 
-  const mode = readUnattended();
+  const mode = readUnattended(unattendedEnv);
   if (!mode.on) return 0; // attended session
 
   if (mode.unreadable) {
     process.stderr.write(
       `BLOCKED — "${paths[0]}" is part of the rulebook and the unattended flag at ${mode.path} is unreadable (${mode.why}). ` +
-        'Refusing to inspect is not allowing: fix or remove the flag (`node .claude/scripts/unattended-flag.mjs off`), then retry.\n',
+        'Refusing to inspect is not allowing: fix it, or clear this checkout with `node .claude/scripts/unattended-flag.mjs off --root "$PWD"`, then retry.\n',
     );
     return 2;
   }
 
-  const refused = paths.filter((rel) => !isAllowed(rel, mode.allow));
+  const refused = paths.filter(
+    (rel) => rel === '.claude/queue.board' || !isAllowed(rel, mode.allow),
+  );
   if (refused.length === 0) return 0;
+  if (refused[0] === '.claude/queue.board') {
+    process.stderr.write(
+      'BLOCKED — ".claude/queue.board" is the checkout board selector and cannot be changed while unattended, even through an item allow-list. ' +
+        'Disarm unattended mode before deliberately switching queues.\n',
+    );
+    return 2;
+  }
   process.stderr.write(
     `BLOCKED — "${refused[0]}" is part of the rulebook, and an unattended run never edits the rulebook outside its item's allow-list ` +
       `(item ${mode.item ?? '(none)'}; allowed prefixes: ${mode.allow.length === 0 ? 'none' : mode.allow.join(', ')}). ` +

package/templates/agent-os/universal/.claude/hooks/guard-secret-file.mjs

@@ -22,18 +22,25 @@
 // so plainly where none does — a limits comment nothing checks drifts into
 // overstatement, which is the direction that gets a reader hurt. ⚠ Those tests live in the GENERATOR this rig came from, not here;
 // `.claude/rules/invariants.md` ("About the hooks you were given") says the same
-// of this hook's own tests, and the moment you edit it they are yours.
+// of this hook's own tests. A manifest-backed generator upgrade remains inherited
+// while `.claude/.rig-manifest.json` matches; once the hash differs, the local test
+// is yours.
 //
-// There are FOUR:
+// There are FIVE:
 //
 //   - It sees ONE edit fragment, not the resulting file. A credential assembled
-//     across two edits is not seen — see guard-secret-file.test.ts › "does not
+//     across two edits is not seen — see guard-secret-file.test.ts (absent in a generated rig) › "does not
 //     see a credential split across two edits, because it is shown one fragment
 //     at a time". This is the same limit every guard in this directory has,
 //     stated in full in `.claude/rules/invariants.md`, "What the enforcement
 //     actually is — stated exactly".
+//   - A `MultiEdit` is capped at 256 fragments and REFUSES before mapping a
+//     longer list, so the tail is never silently dropped — see
+//     guard-secret-file.test.ts (absent in a generated rig) › "refuses a
+//     MultiEdit beyond the fragment cap instead of silently dropping the tail".
 //   - It sees only what the AGENT writes. The `toolName` branch in `main` below
-//     names the complete surface: `Write`, `Edit`, and `apply_patch`; every other
+//     names the complete surface: `Write`, `Edit`, `MultiEdit`, `NotebookEdit`,
+//     and `apply_patch`; every other
 //     tool returns before inspection. A human editing the file, or a
 //     `git commit` of something already on disk, never reaches a PreToolUse hook
 //     at all, and no test here can show that: it is a property of the harness,
@@ -51,15 +58,16 @@
 //     `findSecretValues` applies by default so a fail-open guard cannot be made
 //     to hang. A credential past that point is not seen. ⚠ No test here pins
 //     this one: the case is pinned one layer down, on the module, by
-//     secrets-lib.test.ts › "has a limit even when the caller names none". The CI sweep lifts the
+//     secrets-lib.test.ts (absent in a generated rig) › "has a limit even when the caller names none". The CI sweep lifts the
 //     cap; this hook cannot, and that asymmetry is the point.
 //   - It FAILS OPEN on what it cannot understand — see guard-secret-file.test.ts
+//     (absent in a generated rig)
 //     › "allows a payload that is not JSON at all" and its neighbours. An
 //     unparseable payload, a missing field, or an internal throw all allow the
 //     edit; a crashed guard that blocks everything gets deleted within the hour.
 //
 //     ⚠ **An `apply_patch` command that is PRESENT and is not a shape this guard
-//     reads is the other case, and it now REFUSES** — see codex.test.ts ›
+//     reads is the other case, and it now REFUSES** — see codex.test.ts (absent in a generated rig) ›
 //     "refuses, rather than failing open, when apply_patch command is supplied
 //     as %s". The line between them is whether the guard can tell: an absent
 //     field is a payload it does not understand, a container it detects and
@@ -74,10 +82,10 @@
 // by an explicit per-line candidate cap rather than running to exhaustion. Any
 // unbounded work in a fail-open guard is a total bypass of every rule at once,
 // not just of this one.
-import { readFileSync } from 'node:fs';
 
 import { findSecretValues, isCredentialPath } from '../scripts/lib/secrets.mjs';
 import { editFragments } from './lib/edit-input.mjs';
+import { readHookInput } from './lib/hook-input.mjs';
 
 /** Where a refusal points the agent, so the block is actionable rather than a wall. */
 const WHERE_CREDENTIALS_BELONG =
@@ -85,47 +93,30 @@ const WHERE_CREDENTIALS_BELONG =
   'and reach the process through the environment — see .claude/rules/autonomy.md, "Never".';
 
 function main() {
-  let input;
-  try {
-    input = JSON.parse(readFileSync(0, 'utf8'));
-  } catch {
-    return 0; // unparseable payload: not ours to judge
-  }
+  const input = readHookInput();
+  if (input === null) return 0; // unparseable payload: not ours to judge
 
-  const toolName = input?.tool_name;
-  if (toolName !== 'Write' && toolName !== 'Edit' && toolName !== 'apply_patch') return 0;
+  const editTools = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit', 'apply_patch']);
+  if (!editTools.has(input?.tool_name)) return 0;
 
-  if (toolName === 'apply_patch') {
-    let refused = false;
-    for (const { filePath, fragment, inspectionRefusal, remedy, appliesToAll } of editFragments(input)) {
-      if (inspectionRefusal) {
-        refused = true;
-        process.stderr.write(
-          `BLOCKED — cannot safely inspect this edit: ${inspectionRefusal}\n` +
-            // The remedy has to match the refusal: splitting cannot change a
-            // container shape, and a fixed line sent the agent into a retry loop
-            // on the one path it could not retry out of.
-            `${remedy ?? 'Split it into a smaller patch and retry.'}\n`,
-        );
-        continue;
-      }
-      if (isCredentialPath(filePath)) {
-        refused = true;
-        process.stderr.write(`BLOCKED — "${filePath}" is a credential file, and this repository never carries one.\n${WHERE_CREDENTIALS_BELONG}\n`);
-        continue;
-      }
-      const findings = findSecretValues(fragment);
-      if (findings.length > 0 || appliesToAll) {
-        refused = true;
-        if (findings.length > 0) process.stderr.write(`BLOCKED — this edit writes a credential value into "${filePath}".\n${WHERE_CREDENTIALS_BELONG}\n`);
-      }
-    }
-    return refused ? 2 : 0;
+  const fragments = editFragments(input);
+  const globalRefusal = fragments.find(
+    ({ inspectionRefusal, appliesToAll }) => appliesToAll && inspectionRefusal,
+  );
+  if (globalRefusal) {
+    const fallbackRemedy = input?.tool_name === 'apply_patch'
+      ? 'Split it into a smaller patch and retry.'
+      : 'Split it into a smaller edit and retry.';
+    process.stderr.write(
+      `BLOCKED — cannot safely inspect this edit: ${globalRefusal.inspectionRefusal}\n` +
+        `${globalRefusal.remedy ?? fallbackRemedy}\n`,
+    );
+    return 2;
   }
 
-  const toolInput = input?.tool_input ?? {};
-  const filePath = String(toolInput.file_path ?? '').replaceAll('\\', '/');
-  if (filePath === '') return 0; // nothing to judge; fail open
+  if (fragments.length === 0 || fragments.every(({ filePath }) => filePath === '')) {
+    return 0; // nothing to judge; fail open
+  }
 
   // The tool sends an absolute path. Judge the repo-relative tail so a checkout
   // living under a directory literally called `secrets` does not make every edit
@@ -134,41 +125,53 @@ function main() {
   // below never matches, every path stays absolute, and a checkout that happens
   // to live under a directory called `secrets` has EVERY edit refused. That is
   // the "deleted within the hour" outcome `.claude/rules/invariants.md` warns
-  // about — see guard-secret-file.test.ts › "judges the repo-relative path even
-  // when the project directory is given with a trailing slash".
+  // about — see guard-secret-file.test.ts (absent in a generated rig) ›
+  // "judges the repo-relative path even when the project directory is given %s".
   const projectDir = String(process.env.CLAUDE_PROJECT_DIR ?? '')
     .replaceAll('\\', '/')
     .replace(/\/+$/, '');
-  const relativePath =
-    projectDir !== '' && filePath.startsWith(`${projectDir}/`)
-      ? filePath.slice(projectDir.length + 1)
-      : filePath;
+  let refused = false;
+  for (const { filePath, fragment, inspectionRefusal } of fragments) {
+    const relativePath =
+      projectDir !== '' && filePath.startsWith(`${projectDir}/`)
+        ? filePath.slice(projectDir.length + 1)
+        : filePath;
+    if (relativePath === '') continue;
 
-  if (isCredentialPath(relativePath)) {
+    if (inspectionRefusal) {
+      refused = true;
+      process.stderr.write(
+        `BLOCKED — cannot safely inspect this edit to "${relativePath}": ${inspectionRefusal}\n` +
+          'Split it into a smaller edit and retry.\n',
+      );
+      continue;
+    }
+    if (isCredentialPath(relativePath)) {
+      refused = true;
+      process.stderr.write(
+        `BLOCKED — "${relativePath}" is a credential file, and this repository never carries one.\n` +
+          `${WHERE_CREDENTIALS_BELONG}\n` +
+          `If this file is a documented placeholder, name it .env.example — that form stays committable.\n`,
+      );
+      continue;
+    }
+
+    const findings = findSecretValues(fragment);
+    if (findings.length === 0) continue;
+    refused = true;
     process.stderr.write(
-      `BLOCKED — "${relativePath}" is a credential file, and this repository never carries one.\n` +
-        `${WHERE_CREDENTIALS_BELONG}\n` +
-        `If this file is a documented placeholder, name it .env.example — that form stays committable.\n`,
+      `BLOCKED — this edit writes a credential value into "${relativePath}":\n` +
+        findings
+          .map((finding) => `  - ${finding.id} on line ${finding.line} of the text being written`)
+          .join('\n') +
+        `\n${WHERE_CREDENTIALS_BELONG}\n` +
+        // Deliberately NOT the matched text. A guard that prints what it found has
+        // copied the credential into a hook transcript and a terminal scrollback —
+        // it has leaked the secret in the act of refusing it.
+        `The matched value is deliberately not shown; open the line above to see it.\n`,
     );
-    return 2;
   }
-
-  const fragment = String((toolName === 'Write' ? toolInput.content : toolInput.new_string) ?? '');
-  const findings = findSecretValues(fragment);
-  if (findings.length === 0) return 0;
-
-  process.stderr.write(
-    `BLOCKED — this edit writes a credential value into "${relativePath}":\n` +
-      findings
-        .map((finding) => `  - ${finding.id} on line ${finding.line} of the text being written`)
-        .join('\n') +
-      `\n${WHERE_CREDENTIALS_BELONG}\n` +
-      // Deliberately NOT the matched text. A guard that prints what it found has
-      // copied the credential into a hook transcript and a terminal scrollback —
-      // it has leaked the secret in the act of refusing it.
-      `The matched value is deliberately not shown; open the line above to see it.\n`,
-  );
-  return 2;
+  return refused ? 2 : 0;
 }
 
 let status;

package/templates/agent-os/universal/.claude/hooks/guard-web-boundary.mjs

@@ -8,8 +8,8 @@
 // Generator-owned coverage for the neutral bounded-inspection refusal lives upstream in
 // codex.test.ts › "$guard blocks with a neutral, actionable size-limit refusal"; generated
 // projects do not carry that suite, and a downstream edit requires a local replacement test.
-import { readFileSync } from 'node:fs';
 import { editFragments } from './lib/edit-input.mjs';
+import { readHookInput } from './lib/hook-input.mjs';
 
 const WEB_PATH = /(^|\/)apps\/web\//;
 const CODE_FILE = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
@@ -20,12 +20,8 @@ const FORBIDDEN_WORKSPACE = /^@[^/]+\/(db|api|worker)$/;
 const FORBIDDEN_RELATIVE = /(^|\/)(packages\/db|services)(\/|$)/;
 
 function main() {
-  let input;
-  try {
-    input = JSON.parse(readFileSync(0, 'utf8'));
-  } catch {
-    return 0; // unparseable payload: not ours to judge
-  }
+  const input = readHookInput();
+  if (input === null) return 0; // unparseable payload: not ours to judge
   const violations = [];
   const importRe =
     /(?:\bfrom\s*|\bimport\s*\(\s*|\brequire\s*\(\s*|^\s*import\s+)['"]([^'"]+)['"]/gm;

package/templates/agent-os/universal/.claude/hooks/inject-rules.mjs

@@ -30,6 +30,7 @@
 // is why every ambiguity resolves toward injecting more.
 import { readFileSync, realpathSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
+import { readHookInput } from './lib/hook-input.mjs';
 
 // Regions the rule file marks as not worth injecting. The marker is explicit
 // and lives in the rule file itself, where the person editing it can see it —
@@ -150,12 +151,8 @@ function invokedDirectly() {
 }
 
 function main() {
-  let input;
-  try {
-    input = JSON.parse(readFileSync(0, 'utf8'));
-  } catch {
-    return 0;
-  }
+  const input = readHookInput();
+  if (input === null) return 0;
   if (input.hook_event_name !== 'SessionStart') return 0;
 
   let rules;

package/templates/agent-os/universal/.claude/hooks/lib/edit-input.mjs

@@ -70,7 +70,17 @@ export function editFragments(input) {
   if (toolName === 'MultiEdit') {
     if (!Array.isArray(toolInput.edits)) return [];
     const filePath = normalisePath(toolInput.file_path);
-    return toolInput.edits.slice(0, MAX_MULTI_EDITS).map((edit) => ({
+    if (toolInput.edits.length > MAX_MULTI_EDITS) {
+      return [
+        {
+          filePath,
+          fragment: '',
+          inspectionRefusal: `MultiEdit carries more than the ${MAX_MULTI_EDITS}-fragment inspection limit`,
+          appliesToAll: true,
+        },
+      ];
+    }
+    return toolInput.edits.map((edit) => ({
       filePath,
       fragment: String(edit?.new_string ?? ''),
     }));

package/templates/agent-os/universal/.claude/hooks/lib/hook-input.mjs

@@ -0,0 +1,55 @@
+// The one place a hook reads its payload — `invariants.md`, "One mechanism,
+// one implementation". Eight hooks each parsing stdin is eight chances for one
+// of them to keep a defect the others fixed, and the one nobody looks at is the
+// one that will.
+//
+// 🔴 Why this module exists at all (RP-54). A hook that cannot parse its
+// payload allows the tool call — that is the documented fail-open, and it is
+// correct: a crashed guard must not make the session unusable. But it means an
+// unreadable payload silently disarms EVERY rule the hook carries, so what
+// counts as unreadable has to be as narrow as the format honestly allows.
+//
+// Measured on the hosted `windows-unit` runner, through the generated Codex
+// `commandWindows` wrapper (CI run 33281160544): the wrapper delivers stdin and
+// propagates the child's exit code, but the guard received **290 bytes for a
+// 287-byte payload**. PowerShell prepends a UTF-8 BOM on that host. `JSON.parse`
+// throws on a leading U+FEFF, so every guard resolved a well-formed payload to
+// "not ours to judge" and allowed the edit — including `guard-bash`, which
+// carries the Never tier and the kill switch. A Windows host whose PowerShell
+// does not add the BOM parses the same payload fine, which is why this looked
+// like a runner-only mystery for two days.
+//
+// A BOM is a byte-order mark, not content: stripping one leading U+FEFF is what
+// the format means, not a tolerance added to get a test green.
+//
+// Bounded work, because a fail-open reader is a total bypass if it can throw or
+// spin: one read, one character comparison, one slice, one parse. No loop, no
+// recursion, no rescanning.
+//
+// Limits, stated rather than implied:
+// - Only a BOM at position 0 is stripped. A payload with other leading bytes is
+//   still unreadable, and still resolves to `null`.
+// - `null` means "no payload this hook can judge" and every caller keeps its own
+//   fail-open on it. This module does not decide policy; it only removes the
+//   spelling difference between two hosts.
+// Pinned in hook-stdin.test.ts (absent in a generated rig) ›
+// "blocks the same command when PowerShell prepends a UTF-8 BOM" and ›
+// "reads stdin through the one shared reader, in every hook that reads it".
+
+import { readFileSync } from 'node:fs';
+
+/** The hook payload as an object, or `null` when there is none this hook can read. */
+export const readHookInput = () => {
+  let raw;
+  try {
+    raw = readFileSync(0, 'utf8');
+  } catch {
+    return null;
+  }
+  if (raw.charCodeAt(0) === 0xfeff) raw = raw.slice(1);
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+};

package/templates/agent-os/universal/.claude/rules/autonomy.md

@@ -95,10 +95,10 @@ own cost figures are read next to the lane they do not cover.
 - bypass pre-commit (`--no-verify` is hook-blocked anyway)
 - force-push a shared branch
 - put secrets in code, config, logs, or fixtures. One part of this is
-  **mechanical**: `guard-secret-file` refuses an edit through `Write`, `Edit`, or
-  `apply_patch` that names a credential file or carries a credential value,
+  **mechanical**: `guard-secret-file` refuses an edit through `Write`, `Edit`,
+  `MultiEdit`, `NotebookEdit`, or `apply_patch` that names a credential file or carries a credential value,
   reading its vocabulary from `.claude/scripts/lib/secrets.mjs`. ⚠ **Only that
-  part.** The hook sees what an agent writes through those three tools and
+  part.** The hook sees what an agent writes through those five tools and
   nothing else — its own header states the four blind spots — so whether a
   credential typed by a human, or committed from disk, is also refused depends
   on whether this project has a commit-time check. Look at `.husky/` and the CI
@@ -109,8 +109,10 @@ own cost figures are read next to the lane they do not cover.
   a leak.
 - touch production data outside a reviewed migration
 - edit the rulebook from an **unattended** run outside the item's allow-list — `guard-rulebook` refuses it.
-  The rulebook: the hooks, their wiring, `.claude/queue.json`, the queue
-  adapters, the router, the gate sweep, the rules, `CLAUDE.md`. Mechanical:
+  The rulebook is both harnesses' instruction, agent, skill, script and hook
+  trees (`CLAUDE.md`, `AGENTS.md`, `.claude/{agents,hooks,rules,scripts,skills}`,
+  `.agents/`, `.codex/`), plus `.claude/settings.json`, the queue config and its
+  always-refused board selector, and the integrity manifest. Mechanical:
   the hook refuses the edit while the unattended flag the `loop` skill writes
   at claim time is on disk (`.claude/scripts/unattended-flag.mjs`), and does
   nothing in an attended session. ⚠ It sees edit tool calls only — a

package/templates/agent-os/universal/.claude/rules/invariants.md

@@ -216,27 +216,25 @@ are guessing, and a guessed invariant is the one that will fire on honest work.
 
 ## About the hooks you were given
 
-They arrive with their tests **in the generator that produced this project**, not
-in this repository — so by the rule above, as they sit here, they are checks
-without tests. That is deliberate and it has a boundary: it holds only while they
-are untouched.
-
-This is the one narrow exception for a generator-authored hook: it may cite the
-generator's upstream tests **only while unchanged downstream**, and its hook
-header must identify the upstream generator tests as absent locally. That pointer
-records the evidence used to author the inherited snapshot; it does not turn the
-absent test into a local check.
-
-**The moment you edit one, its test is yours.** A guard whose behaviour has
-changed and whose test lives somewhere else is precisely the "quietly stopped
-matching" case this rule names, and nothing here would catch it. The same applies
-if you keep a hook whose invariant you have re-scoped.
+Generator-authored rulebook artifacts — rules, hooks, skills, scripts and agent
+specs — arrive with their tests **in the generator that produced this project**,
+not in this repository. There is one narrow inherited-snapshot exception: such
+an artifact may cite the generator's upstream tests, which are absent locally,
+only when the pointer says they are absent and `.claude/.rig-manifest.json`
+proves the current artifact's hash matches the installed manifest.
+
+A manifest-backed upgrade remains an inherited, generator-owned artifact even
+though the upgrade diff changes its bytes. The exception applies **only while the
+manifest hash matches**. A hash mismatch, missing manifest, or no evidence ends
+the exception and the local test is yours; an owned guard whose behaviour changed
+while its test lives elsewhere is precisely the "quietly stopped matching" case
+this rule names.
 
 If a hook matters enough to keep, it is worth ten minutes to copy the shape from
 `.claude/skills/new-invariant/guard-invariant.example.test.mjs` and pin the
 behaviour you actually rely on.
 
-**That boundary is audited, not remembered.** `node .claude/scripts/doctor.mjs`
+**For hooks, that ownership boundary is audited, not remembered.** `node .claude/scripts/doctor.mjs`
 reads `.claude/.rig-manifest.json` and asks of every hook in `.claude/hooks/` (and
 `.husky/`, when it exists) whether the project owns it — the bytes differ from
 what the generator installed, or the manifest has no entry — and, if so, whether

package/templates/agent-os/universal/.claude/scripts/decision-router.mjs

@@ -1,6 +1,7 @@
 /**
  * The decision router — which gate does this change deserve, and what does that
  * cost.
+ * All upstream test pointers in this script name the generator suite, absent in a generated rig.
  *
  * `pr-ship` is the merge-time gate and it always runs the expensive path: the
  * full suite, then `code-reviewer` on every diff. That is right for a change

package/templates/agent-os/universal/.claude/scripts/doctor.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+// All upstream test pointers in this script name the generator suite, absent in a generated rig.
 // doctor — the harness audits itself (AR-5).
 //
 //   node .claude/scripts/doctor.mjs                 # the report, ready to paste
@@ -10,7 +11,9 @@
 // `.claude/rules/invariants.md` — a stated rule, a mechanical check, a test for
 // the check — is decoration with any part missing, and the part a rig loses
 // first is the third: the shipped hooks arrive with their tests in the generator
-// that produced them, and the moment one is edited its test is the rig's own.
+// that produced them. A manifest-backed generator upgrade remains inherited;
+// the test becomes the rig's own when the current hash no longer matches the
+// manifest evidence below.
 //
 // Ownership is read from `.claude/.rig-manifest.json`, the install manifest the
 // generator writes (its `files` map is install-relative path → sha256 of the

package/templates/agent-os/universal/.claude/scripts/git-env.mjs

@@ -1,5 +1,6 @@
 /**
  * The environment a child `git` should run with — one implementation, imported.
+ * All upstream test pointers in this script name the generator suite, absent in a generated rig.
  *
  * 🔴 **Why this is not inlined at each call site.** A process started under a
  * git hook inherits `GIT_DIR` and `GIT_INDEX_FILE`, and any child then answers