create-byan-agent 2.49.0 → 2.50.0

package/CHANGELOG.md

@@ -9,6 +9,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.50.0] - 2026-07-17
+
+### Added — BYAN souverainete (les concepts BYAN pilotent Claude, ne se font plus doubler)
+- **WI-1 dent delegation Codex** : hook PreToolUse `codex-delegate-guard.js` (+ coeur pur `lib/codex-delegate-gate.js`) qui refuse-une-fois le premier Write/Edit de code delegable quand la voie Codex est armee (option + Codex linke) et qu'aucune delegation n'a eu lieu ce tour. Speed-bump, pas un mur : escape `.byan-codex-autodelegate/off`, marque `// BYAN-DELEGATE: reviewed`, fenetre de grace. Corrige la racine de l'incident (Claude codait lui-meme malgre la directive).
+- **WI-2 filet de conformite de voix** : hook Stop `voice-conformance-check.js` (+ `lib/voice-conformance.js`) qui repere les signaux objectifs de derive (emoji, vouvoiement en grappe) et pose un drapeau relaye au tour suivant. Non bloquant (le registre reste semantique).
+- **WI-3 filet dispatch runtime** : drapeau quand un tour ecrit du code sans avoir consulte `byan_dispatch`, hors FD.
+- **WI-4 garde de porte d'entree renforce** : le signal visuel party-mode (`TaskCreate`/`TaskUpdate`) tient desormais la posture d'entree — plus de faux drapeau sur un tour party-mode.
+- **WI-7 rapport d'armement** : `bin/byan-armament-report.js` (+ `lib/armament-report.js`) lit les registres autobench/punt/completeness et reporte le taux de declenchement (indicateur de risque de faux positif) avant toute decision d'armement. Verdict mesure : les 3 gardes restent DESARMEES (punt 42%, autobench 1%, completeness echantillon trop petit).
+
+### Changed
+- **WI-6 fuite Bash du strict-scope-guard** : `decideScope` couvre desormais les redirections d'ecriture Bash (`>`, `>>`, `tee`, heredoc) hors `allowedPaths`. Parseur resserre (cible en forme de chemin uniquement) pour eviter les faux positifs sur les operateurs de comparaison/arithmetique et les variables non resolues.
+- **WI-5 fact-check-absolutes elargi** : plus d'absolus/superlatifs/best-practice/certitudes couverts (alignes sur `.claude/rules/fact-check.md`) ; `optimal` ecarte (trop courant) et strip d'exemples resserre a une puce (une phrase de prose commencant par un absolu reste policee). Le plafond des mantras semantiques (IA-16, #37...) est assume : doctrine + `byan-mantra-audit`, pas de fausse dent regex.
+
+### Docs
+- `docs/byan-sovereignty-chantier.md` : le chantier complet (constat, patron des 4 dents, plafond honnete, work items, risques) adosse a l'audit `byan-sovereignty-audit`.
+
+### Tests
+- +9 tests MCP (armament report + parite shipping anti-derive) ; +47 tests jest (dents + filets + fact-check + strict-scope Bash). jest 2699/0, MCP 855/0.
+
 ## [2.49.0] - 2026-07-16
 
 ### Added

package/install/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-byan-agent",
-  "version": "2.49.0",
+  "version": "2.50.0",
   "description": "BYAN - Intelligent AI agent installer with multi-platform native support (Claude Code, Codex/OpenCode)",
   "bin": {
     "create-byan-agent": "bin/create-byan-agent-v2.js"

package/install/templates/.claude/hooks/agent-gate-check.js

@@ -20,12 +20,24 @@ const gate = require('./lib/agent-gate');
 function detect(payload, projectDir) {
   const text = extractLastAssistantText(payload);
   const messages = extractRecentMessages(payload, 8) || [];
+  const wroteFiles = gate.hasWriteActivity(messages);
+  const fdActive = gate.fdIsActive(projectDir);
   const assessment = gate.assessTurn({
-    wroteFiles: gate.hasWriteActivity(messages),
+    wroteFiles,
     proposedAgent: gate.hasProposalMarker(text),
-    fdActive: gate.fdIsActive(projectDir),
+    taskVisualSeen: gate.hasTaskActivity(messages), // WI-4: a live task list holds the entry posture
+    fdActive,
   });
   if (assessment.slip) gate.writeSlip(projectDir, assessment.reason);
+  // WI-3: dispatch net, its own slip. Same signals, different question (was the
+  // runtime routeur consulted?).
+  const dispatch = gate.assessDispatch({
+    wroteFiles,
+    dispatchConsulted: gate.hasDispatchActivity(messages),
+    fdActive,
+  });
+  if (dispatch.slip) gate.writeDispatchSlip(projectDir, dispatch.reason);
+  assessment.dispatch = dispatch; // backward-compatible: .slip stays primary
   return assessment;
 }
 

package/install/templates/.claude/hooks/codex-delegate-guard.js

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+'use strict';
+
+// PreToolUse hook — WI-1, the DENT for the armed Codex-delegation lane.
+//
+// When the Codex lane is ARMED (yanstaller option on AND Codex linked) and the
+// current turn is about to WRITE delegable code without having delegated to Codex
+// first, DENY ONCE with the exact instruction to delegate. This is the tooth that
+// makes "delegate to Codex when armed" govern instead of being prose Claude can
+// double with a polite excuse (the session incident).
+//
+// Speed-bump, not a wall (the user's red line) :
+//   - escape-hatch : `.byan-codex-autodelegate/off` silences it (shared with the
+//     nudge hook — one switch for the whole Codex-delegation posture).
+//   - `// BYAN-DELEGATE: reviewed` in the file acknowledges a deliberate
+//     Claude-lane choice (Codex unavailable, judgment/verify) and passes.
+//   - deny-once : an identical resubmission passes, and a grace window after a
+//     deny lets a multi-file build proceed without nagging on every file.
+//
+// Never traps a turn, always exits 0. Pure decision in lib/codex-delegate-gate.js;
+// armed/linked detection reused from codex-autodelegate.js; delegability from
+// autodelegate-decision.js; the turn transcript via transcript-read.js.
+
+const fs = require('fs');
+const path = require('path');
+const gate = require('./lib/codex-delegate-gate');
+const { loadConfig, codexLinked, toggledOff } = require('./codex-autodelegate');
+const { looksDelegable } = require('./lib/autodelegate-decision');
+const { extractRecentMessages, extractLastAssistantText, contentToText } = require('./lib/transcript-read');
+
+const ROOT = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+const GRACE_MS = 120000;
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let data = '';
+    process.stdin.on('data', (c) => (data += c));
+    process.stdin.on('end', () => resolve(data));
+    process.stdin.on('error', () => resolve(''));
+  });
+}
+
+function allow() {
+  return { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow' } };
+}
+
+function deny(reason) {
+  return {
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'deny',
+      permissionDecisionReason: reason,
+    },
+  };
+}
+
+function sidecarPath(root) {
+  return path.join(root, '.byan-codex-delegate', 'last-deny.json');
+}
+
+function readPriorDeny(root) {
+  try {
+    const p = JSON.parse(fs.readFileSync(sidecarPath(root), 'utf8'));
+    return p && typeof p === 'object' ? p : null;
+  } catch (_e) {
+    return null;
+  }
+}
+
+function writePriorDeny(root, entry) {
+  try {
+    fs.mkdirSync(path.dirname(sidecarPath(root)), { recursive: true });
+    fs.writeFileSync(sidecarPath(root), JSON.stringify(entry));
+  } catch (_e) {
+    // best-effort : losing the deny memory only costs one extra deny, never a trap
+  }
+}
+
+// The last user message text this turn, for the delegability signal (a code
+// target already suffices, this only broadens it).
+function lastUserText(payload) {
+  const msgs = extractRecentMessages(payload, 12);
+  if (!Array.isArray(msgs)) return '';
+  for (let i = msgs.length - 1; i >= 0; i--) {
+    if (msgs[i] && msgs[i].role === 'user') return contentToText(msgs[i].content);
+  }
+  return '';
+}
+
+// Pure-ish assembly of the decision from a payload (exported for tests, fs
+// injected via opts.root + opts.now).
+function runGuard(payload, { root = ROOT, now = Date.now() } = {}) {
+  const toolName = payload.tool_name || payload.toolName || '';
+  if (toolName !== 'Write' && toolName !== 'Edit') return allow();
+
+  const config = loadConfig(root);
+  const armed = config.enabled === true && codexLinked();
+  const escaped = toggledOff(root);
+
+  const input = payload.tool_input || payload.toolInput || {};
+  const filePath = input.file_path || input.filePath || '';
+  const content = toolName === 'Edit'
+    ? String(input.new_string || input.newString || '')
+    : String(input.content || '');
+
+  const userText = lastUserText(payload);
+  const delegable = gate.targetIsCode(filePath) || looksDelegable(userText);
+  const reviewedMarker = gate.hasReviewedMarker(content) || gate.hasReviewedMarker(extractLastAssistantText(payload));
+  const delegationSeen = gate.delegationSeenThisTurn(extractRecentMessages(payload, 12) || []);
+  const turnHash = gate.hashTurn(filePath, content);
+
+  const decision = gate.decideDelegateGate({
+    armed,
+    delegable,
+    delegationSeen,
+    escaped,
+    reviewedMarker,
+    priorDeny: readPriorDeny(root),
+    turnHash,
+    now,
+    graceMs: GRACE_MS,
+  });
+
+  if (decision.decision === 'deny') {
+    writePriorDeny(root, { hash: turnHash, ts: now });
+    return deny(decision.reason);
+  }
+  return allow();
+}
+
+if (require.main === module) {
+  (async () => {
+    let out;
+    try {
+      const payload = JSON.parse((await readStdin()) || '{}');
+      out = runGuard(payload);
+    } catch (_e) {
+      out = allow();
+    }
+    process.stdout.write(JSON.stringify(out));
+    process.exit(0);
+  })();
+}
+
+module.exports = { runGuard, sidecarPath, readPriorDeny, writePriorDeny, lastUserText };

package/install/templates/.claude/hooks/inject-voice-anchor.js

@@ -28,6 +28,7 @@ const path = require('path');
 const { buildTaoContext, turnCounterPath } = require('./inject-tao');
 const pl = require('./lib/plain-language');
 const gate = require('./lib/agent-gate');
+const voice = require('./lib/voice-conformance');
 
 const ANCHOR = [
   'Voix BYAN (rappel par tour ; tao complet chargé au démarrage de session) :',
@@ -96,6 +97,20 @@ function withGateReminder(baseContext, slip) {
   return reminder ? `${baseContext}\n${reminder}` : baseContext;
 }
 
+// Append the dispatch reminder (WI-3) when the previous turn wrote code without
+// consulting byan_dispatch. Pure; fs read + clear stays in require.main.
+function withDispatchReminder(baseContext, slip) {
+  const reminder = gate.formatDispatchReminder(slip);
+  return reminder ? `${baseContext}\n${reminder}` : baseContext;
+}
+
+// Append the voice-conformance reminder (WI-2) when the previous turn drifted from
+// the BYAN voice (emoji / vouvoiement). Pure; fs read + clear stays in require.main.
+function withVoiceReminder(baseContext, hits) {
+  const reminder = voice.formatReminder(hits);
+  return reminder ? `${baseContext}\n${reminder}` : baseContext;
+}
+
 if (require.main === module) {
   const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
   const every = refreshEvery();
@@ -110,8 +125,16 @@ if (require.main === module) {
   // Forward net #2 (F4): agent entry-gate slip. Read + clear one-shot.
   const gateSlip = gate.readSlip(projectDir);
   if (gateSlip) gate.clearSlip(projectDir);
+  // Forward net #3 (WI-3): dispatch-runtime slip. Read + clear one-shot.
+  const dispatchSlip = gate.readDispatchSlip(projectDir);
+  if (dispatchSlip) gate.clearDispatchSlip(projectDir);
+  // Forward net #4 (WI-2): voice-conformance slip. Read + clear one-shot.
+  const voiceHits = voice.readSlip(projectDir);
+  if (voiceHits && voiceHits.length) voice.clearSlip(projectDir);
   let ctx = withSlipReminder(additionalContext, slipHits);
   ctx = withGateReminder(ctx, gateSlip);
+  ctx = withDispatchReminder(ctx, dispatchSlip);
+  ctx = withVoiceReminder(ctx, voiceHits);
   process.stdout.write(
     JSON.stringify({
       hookSpecificOutput: {
@@ -131,5 +154,7 @@ module.exports = {
   decideAnchor,
   withSlipReminder,
   withGateReminder,
+  withDispatchReminder,
+  withVoiceReminder,
   DEFAULT_REFRESH_EVERY,
 };

package/install/templates/.claude/hooks/lib/agent-gate.js

@@ -32,6 +32,33 @@ function hasProposalMarker(text) {
   return PROPOSAL_MARKERS.some((m) => t.includes(m));
 }
 
+// hasToolActivity(messages, predicate) — true if any assistant tool_use block in
+// the recent messages matches the predicate(block). The shared scan used by the
+// write / task-visual / dispatch detectors.
+function hasToolActivity(messages, predicate) {
+  if (!Array.isArray(messages)) return false;
+  for (const m of messages) {
+    if (!m || m.role !== 'assistant' || !Array.isArray(m.content)) continue;
+    for (const block of m.content) {
+      if (block && block.type === 'tool_use' && predicate(block)) return true;
+    }
+  }
+  return false;
+}
+
+// WI-4 — the party-mode live visual signal : did the turn create a native task
+// (TaskCreate) ? A task list IS the visual the entry chain promises, so its
+// presence means the porte d'entree posture held even without a text proposal.
+function hasTaskActivity(messages) {
+  return hasToolActivity(messages, (b) => b.name === 'TaskCreate' || b.name === 'TaskUpdate');
+}
+
+// WI-3 — the dispatch-consulted signal : was the routeur (byan_dispatch) called
+// this turn ? Matches the MCP tool name in any namespaced form.
+function hasDispatchActivity(messages) {
+  return hasToolActivity(messages, (b) => /byan_dispatch/.test(String(b.name || '')));
+}
+
 // hasWriteActivity(messages) — true if any recent assistant message carried a
 // tool_use block that writes to the repo. `messages` is an array of
 // { role, content } where content is a string or a block array.
@@ -47,14 +74,28 @@ function hasWriteActivity(messages) {
 }
 
 // assessTurn — the decision. A slip is a task done directly (files written) with
-// no agent proposal AND no active FD cycle. When an FD is engaged, the gate is
-// already in play (DISPATCH is part of it), so it is never a slip.
-function assessTurn({ wroteFiles = false, proposedAgent = false, fdActive = false } = {}) {
-  const slip = Boolean(wroteFiles && !proposedAgent && !fdActive);
+// no agent proposal, NO party-mode task visual (WI-4), AND no active FD cycle.
+// When an FD is engaged, the gate is already in play (DISPATCH is part of it), so
+// it is never a slip ; likewise a live task list is proof the entry posture held.
+function assessTurn({ wroteFiles = false, proposedAgent = false, taskVisualSeen = false, fdActive = false } = {}) {
+  const slip = Boolean(wroteFiles && !proposedAgent && !taskVisualSeen && !fdActive);
   return {
     slip,
     reason: slip
-      ? 'files written directly without an agent proposal and no active FD cycle'
+      ? 'files written directly without an agent proposal, no task visual, and no active FD cycle'
+      : 'ok',
+  };
+}
+
+// WI-3 — dispatch net. A slip is code written this turn without the runtime
+// routeur (byan_dispatch) ever consulted, outside an FD cycle. Non-blocking : the
+// engine choice is a decision, not a binary invariant, so this only flags.
+function assessDispatch({ wroteFiles = false, dispatchConsulted = false, fdActive = false } = {}) {
+  const slip = Boolean(wroteFiles && !dispatchConsulted && !fdActive);
+  return {
+    slip,
+    reason: slip
+      ? 'code written without consulting byan_dispatch (runtime routing) and no active FD cycle'
       : 'ok',
   };
 }
@@ -100,6 +141,46 @@ function formatReminder(slip) {
   ].join(' ');
 }
 
+// --- dispatch slip (WI-3, its own sidecar, same forward-net mechanics) --------
+
+function dispatchSlipPath(projectDir) {
+  return path.join(projectDir, '_byan-output', '.dispatch-slip.json');
+}
+
+function writeDispatchSlip(projectDir, detail) {
+  try {
+    const p = dispatchSlipPath(projectDir);
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, JSON.stringify({ detail: String(detail || '') }));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function readDispatchSlip(projectDir) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(dispatchSlipPath(projectDir), 'utf8'));
+    return parsed && typeof parsed === 'object' ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+function clearDispatchSlip(projectDir) {
+  try { fs.rmSync(dispatchSlipPath(projectDir), { force: true }); } catch { /* never block */ }
+}
+
+function formatDispatchReminder(slip) {
+  if (!slip) return '';
+  return [
+    'Rappel dispatch runtime (BYAN) : au dernier tour du code a ete ecrit sans',
+    'consulter byan_dispatch (le routeur moteur/modele/effort). La chaine d\'entree',
+    'route avant d\'executer : passe par byan_dispatch pour choisir Codex ou Claude,',
+    'le modele et l\'effort. Applique-le ce tour-ci.',
+  ].join(' ');
+}
+
 // fdIsActive(projectDir) — reads _byan-output/fd-state.json ; active means a live
 // phase (not COMPLETED / ABORTED / absent). Read-only, best-effort.
 function fdIsActive(projectDir) {
@@ -117,11 +198,20 @@ module.exports = {
   WRITE_TOOLS,
   hasProposalMarker,
   hasWriteActivity,
+  hasToolActivity,
+  hasTaskActivity,
+  hasDispatchActivity,
   assessTurn,
+  assessDispatch,
   slipPath,
   writeSlip,
   readSlip,
   clearSlip,
   formatReminder,
+  dispatchSlipPath,
+  writeDispatchSlip,
+  readDispatchSlip,
+  clearDispatchSlip,
+  formatDispatchReminder,
   fdIsActive,
 };

package/install/templates/.claude/hooks/lib/fact-check-core.js

@@ -8,7 +8,14 @@
 
 'use strict';
 
+// WI-5 — the absolute-claim patterns. Kept HIGH-SIGNAL on purpose : this gate
+// hard-blocks a doc write, so a false positive costs the user a block. Every
+// entry is either a plain absolute, a comparative superlative, an unsourced
+// best-practice claim, or a certainty phrase — the exact trigger families named
+// in .claude/rules/fact-check.md. Noisy bare words ("mieux", "the best",
+// "impossible", "bien sur") are deliberately excluded.
 const ABSOLUTES = [
+  // plain absolutes
   /\btoujours\b/i,
   /\bjamais\b/i,
   /\bforc[eé]ment\b/i,
@@ -17,10 +24,31 @@ const ABSOLUTES = [
   /\bnever\b/i,
   /\bclearly\b/i,
   /\bundoubtedly\b/i,
+  /\b[ée]videmment\b/i,
+  /\bcertainly\b/i,
+  /\bwithout a doubt\b/i,
+  /\bsans aucun doute\b/i,
+  /\bguaranteed\b/i,
+  // comparative superlatives (a claim, not phrasing)
   /\bfaster than\b/i,
   /\bbetter than\b/i,
   /\bplus rapide que\b/i,
   /\bmeilleur que\b/i,
+  /\bthe fastest\b/i,
+  /\ble plus rapide\b/i,
+  /\bsuperior to\b/i,
+  // ("optimal" alone was dropped in WI-5 review : too common in legit doc prose
+  //  ("the optimal layout") to hard-block a doc write without a false positive.)
+  // unsourced best-practice / authority claims
+  /\bbest practice\b/i,
+  /\bbonne pratique\b/i,
+  /\bindustry standard\b/i,
+  /\bstandard de l['’]industrie\b/i,
+  // certainty framing
+  /\bil est clair que\b/i,
+  /\bit is well[- ]known\b/i,
+  /\bwell[- ]known that\b/i,
+  /\bprouv[eé] que\b/i,
 ];
 
 const SOURCE_MARKERS = [
@@ -37,14 +65,18 @@ const SOURCE_MARKERS = [
 //   - fenced code blocks ``` ... ```
 //   - inline backticks `...`
 //   - block quotes (lines starting with >)
-//   - list-of-pattern lines (e.g. "- toujours")
+//   - BULLET list-example lines (e.g. "- toujours") — a doc listing the trigger
+//     words as examples, not asserting them. WI-5 review fix : this REQUIRES a
+//     bullet marker (- or *), so a prose sentence merely STARTING with an
+//     absolute ("Never mutate state directly.") is NOT stripped and stays policed
+//     (the old `^[\s-]*` matched any leading whitespace -> a false negative).
 function stripNonClaimZones(text) {
   if (!text) return '';
   return text
     .replace(/```[\s\S]*?```/g, '')
     .replace(/`[^`\n]+`/g, '')
     .replace(/^> .*$/gm, '')
-    .replace(/^[\s-]*['"]?\b(toujours|jamais|forc[eé]ment|obviously|always|never|clearly|undoubtedly)\b['"]?/gim, '');
+    .replace(/^\s*[-*]\s+['"]?\b(toujours|jamais|forc[eé]ment|obviously|always|never|clearly|undoubtedly|[ée]videmment|certainly|guaranteed)\b['"]?/gim, '');
 }
 
 // Return the first unsourced absolute (with surrounding context) or null when

package/install/templates/.claude/hooks/lib/voice-conformance.js

@@ -0,0 +1,97 @@
+'use strict';
+
+// WI-2 core — the reactive net for BYAN voice conformance (soul/tao).
+//
+// The tao is injected as context (inject-tao / voice-anchor) but nothing checks
+// that a reply actually holds the voice : it is prose Claude can drift from. This
+// net scans the finished reply for the OBJECTIVE, low-false-positive voice
+// signals and flags a slip carried to the next turn — the same forward-net
+// mechanics as plain-language / agent-gate. It is NON-BLOCKING by design : the
+// register/timbre of the tao is semantic and cannot be a hard wall without
+// constant false positives (honest ceiling ; deep audit stays byan-mantra-audit).
+//
+// Two objective signals only :
+//   1. emoji in the reply (Mantra IA-23 : zero emoji — hard, unambiguous).
+//   2. vouvoiement (BYAN tutoies always, per tao) — flagged only on a CLUSTER
+//      (>= 2 occurrences) so a single quoted "vous" does not trip it.
+//
+// Pure (no I/O beyond the slip flag). Code spans are stripped before scanning so
+// a quoted `vous` variable or an emoji inside a code sample is not policed.
+
+const fs = require('fs');
+const path = require('path');
+const { stripCode } = require('./plain-language');
+
+// True pictographic emoji (Mantra IA-23). Excludes plain arrows (U+2190-21FF)
+// which BYAN uses legitimately in prose ("->", "→").
+const EMOJI_RE = /[\u{1F000}-\u{1FAFF}\u{2600}-\u{26FF}\u{2700}-\u{27BF}\u{2B00}-\u{2BFF}\u{1F1E6}-\u{1F1FF}\u{FE0F}]/u;
+
+// Second-person-plural address. French-aware boundaries so "nous"/"vousXYZ" and
+// accented neighbours do not false-match.
+const VOUS_RE = /(?<![A-Za-zÀ-ÿ0-9_])(vous|votre|vos|vôtre|vôtres)(?![A-Za-zÀ-ÿ0-9_])/gi;
+
+// scanVoice(text) -> [{ kind, good }]. Empty when the reply holds the voice.
+function scanVoice(text) {
+  const prose = stripCode(text);
+  if (!prose) return [];
+  const hits = [];
+  if (EMOJI_RE.test(prose)) {
+    hits.push({ kind: 'emoji', good: 'zero emoji (Mantra IA-23) — retire-les' });
+  }
+  const vousCount = (prose.match(VOUS_RE) || []).length;
+  if (vousCount >= 2) {
+    hits.push({ kind: 'vouvoiement', good: 'BYAN tutoie toujours (tao) — dis "tu", pas "vous"' });
+  }
+  return hits;
+}
+
+function formatReminder(hits) {
+  if (!Array.isArray(hits) || hits.length === 0) return '';
+  const shown = hits.map((h) => `${h.kind} (${h.good})`).join(' ; ');
+  return [
+    'Rappel voix (tao / soul) : au dernier tour la voix BYAN a glisse ->', `${shown}.`,
+    'Reformule ce tour-ci dans la voix BYAN (tutoiement, zero emoji), sans refaire',
+    'la reponse precedente.',
+  ].join(' ');
+}
+
+// --- slip flag (isolated I/O, same family as the other forward nets) ----------
+
+function slipPath(projectDir) {
+  return path.join(projectDir, '_byan-output', '.voice-slip.json');
+}
+
+function writeSlip(projectDir, hits) {
+  try {
+    const p = slipPath(projectDir);
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, JSON.stringify({ hits }));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function readSlip(projectDir) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(slipPath(projectDir), 'utf8'));
+    return Array.isArray(parsed.hits) ? parsed.hits : null;
+  } catch {
+    return null;
+  }
+}
+
+function clearSlip(projectDir) {
+  try { fs.rmSync(slipPath(projectDir), { force: true }); } catch { /* never block */ }
+}
+
+module.exports = {
+  EMOJI_RE,
+  VOUS_RE,
+  scanVoice,
+  formatReminder,
+  slipPath,
+  writeSlip,
+  readSlip,
+  clearSlip,
+};

package/install/templates/.claude/hooks/strict-scope-guard.js

@@ -57,9 +57,48 @@ function matchesPrefix(rel, prefix) {
   return rel === p || rel.startsWith(p + '/');
 }
 
-// Pure decision : returns { deny, reason }.
-function decideScope({ state, config, toolName, filePath }) {
-  if (!['Write', 'Edit'].includes(toolName)) return { deny: false };
+// WI-6 — the Bash write-redirection leak.
+//
+// The Write/Edit deny is bypassable : `cat > src/x.js`, `echo >> a`, `tee f`,
+// `cmd <<EOF > f` write files through Bash, which the tool-name check missed.
+// bashWriteTargets extracts the file targets of write-redirections from a Bash
+// command so the SAME allowed-paths rule applies. Deliberately conservative to
+// avoid denying legit Bash : it skips fd-dups (`2>&1`, `>&2`), process
+// substitution (`>(...)`), and the /dev/* sinks. It is not a hermetic sandbox
+// (pipes, `python -c open()`, variables escape) — it closes the COMMON reflex
+// leak, honestly bounded (see docs).
+function bashWriteTargets(command) {
+  const cmd = String(command || '');
+  const out = [];
+  // A redirection target only counts when it LOOKS like a file path : it contains
+  // a "/" or a file extension. This is the false-positive kill switch : it drops
+  // comparison / arithmetic / here-string operands (`[ 5 > 3 ]`, `(( a > 2 ))`,
+  // `<<< "a > b"` -> "3", "2", "b") which are numbers or bare words, and drops an
+  // unexpanded variable target (`> $F`) which we cannot resolve — denying it would
+  // be a false positive on a possibly in-scope path. Honest ceiling : a bare
+  // filename with no extension (`> outfile`) or a variable target is NOT caught.
+  const consider = (t) => {
+    if (!t) return;
+    if (t.startsWith('$') || t.startsWith('&') || t.startsWith('-')) return; // variable / fd-dup / flag
+    if (/^\/dev\//.test(t)) return; // /dev sinks
+    const pathShaped = t.includes('/') || /\.[A-Za-z0-9]+$/.test(t);
+    if (pathShaped) out.push(t);
+  };
+  // > , >> , &> , &>> , and fd-prefixed (2>) redirections. The lookahead (?![&(])
+  // drops `>&1` (fd dup) and `>(` (process substitution).
+  const redir = /(?:^|[\s;|&(])\d*(?:>>?|&>>?)\s*(?![&(])("?)([^\s"'`|;&<>()]+)\1/g;
+  let m;
+  while ((m = redir.exec(cmd)) !== null) consider(m[2]);
+  // tee [flags] file...
+  const tee = /\btee\b((?:\s+-\S+)*)\s+("?)([^\s"'`|;&<>()]+)\2/g;
+  while ((m = tee.exec(cmd)) !== null) consider(m[3]);
+  return out;
+}
+
+// Pure decision : returns { deny, reason }. Handles Write/Edit (file_path) and,
+// since WI-6, Bash (write-redirection targets that land INSIDE the repo).
+function decideScope({ state, config, toolName, filePath, command }) {
+  if (!['Write', 'Edit', 'Bash'].includes(toolName)) return { deny: false };
   if (!isEngaged(state)) return { deny: false };
 
   const guard = (config && config.scope_guard) || {};
@@ -69,25 +108,42 @@ function decideScope({ state, config, toolName, filePath }) {
   if (!Array.isArray(allowed) || allowed.length === 0) return { deny: false };
 
   const root = projectRoot();
-  const rel = toRelative(filePath, root);
-  if (!rel) return { deny: false };
-
   const exempt = guard.exempt_globs || [];
-  if (exempt.some((g) => matchesPrefix(rel, g))) return { deny: false };
-
-  if (allowed.some((a) => matchesPrefix(rel, a))) return { deny: false };
-
   const base =
     (config && config.banners && config.banners.scope_deny) ||
     'Strict mode: this write targets a path outside the locked scope.';
-  const reason =
+
+  // Returns the offending rel path, or null when the target is allowed/exempt.
+  const offending = (rawTarget, { repoOnly = false } = {}) => {
+    const rel = toRelative(rawTarget, root);
+    if (!rel) return null;
+    // repoOnly (Bash): a target outside the repo (../, /tmp, absolute elsewhere)
+    // is transient, not a repo change under cover of the locked task -> ignore.
+    if (repoOnly && rel.startsWith('..')) return null;
+    if (exempt.some((g) => matchesPrefix(rel, g))) return null;
+    if (allowed.some((a) => matchesPrefix(rel, a))) return null;
+    return rel;
+  };
+
+  const buildReason = (rel) =>
     `${base}\n` +
     `Target: ${rel}\n` +
     `Locked paths: ${allowed.join(', ')}\n` +
     `Either this file belongs to the scope (re-lock with byan_strict_lock_scope ` +
     `including the corrected paths) or it does not (do not write it).`;
 
-  return { deny: true, reason };
+  if (toolName === 'Write' || toolName === 'Edit') {
+    const bad = offending(filePath);
+    return bad ? { deny: true, reason: buildReason(bad) } : { deny: false };
+  }
+
+  // Bash : deny if any in-repo write-redirection target is out of scope.
+  const targets = bashWriteTargets(command);
+  for (const t of targets) {
+    const bad = offending(t, { repoOnly: true });
+    if (bad) return { deny: true, reason: buildReason(bad) };
+  }
+  return { deny: false };
 }
 
 function allow() {
@@ -106,8 +162,9 @@ if (require.main === module) {
     const toolName = payload.tool_name || payload.toolName || '';
     const input = payload.tool_input || payload.toolInput || {};
     const filePath = input.file_path || '';
+    const command = input.command || '';
 
-    const decision = decideScope({ state, config, toolName, filePath });
+    const decision = decideScope({ state, config, toolName, filePath, command });
     if (!decision.deny) {
       process.stdout.write(JSON.stringify(allow()));
       process.exit(0);
@@ -125,4 +182,4 @@ if (require.main === module) {
   })();
 }
 
-module.exports = { decideScope, toRelative, matchesPrefix };
+module.exports = { decideScope, toRelative, matchesPrefix, bashWriteTargets };

package/install/templates/.claude/hooks/voice-conformance-check.js

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+'use strict';
+
+// Stop hook — WI-2, the reactive net for BYAN voice conformance (soul/tao).
+//
+// At end of turn it scans the finished reply for the objective voice slips (emoji,
+// vouvoiement cluster) and, on a slip, writes a one-turn flag under _byan-output/.
+// The next-turn voice anchor surfaces it in plain French. It NEVER blocks the turn
+// (the register is semantic — a hard wall would false-positive) : always exits 0.
+//
+// The judgment lives in lib/voice-conformance.js (pure) ; this shell only pulls
+// the reply text from the transcript.
+
+const { extractLastAssistantText } = require('./lib/transcript-read');
+const voice = require('./lib/voice-conformance');
+
+function detect(payload, projectDir) {
+  const text = extractLastAssistantText(payload);
+  const hits = voice.scanVoice(text);
+  if (hits.length) voice.writeSlip(projectDir, hits);
+  return hits;
+}
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let data = '';
+    process.stdin.on('data', (c) => (data += c));
+    process.stdin.on('end', () => resolve(data));
+    process.stdin.on('error', () => resolve(''));
+  });
+}
+
+if (require.main === module) {
+  (async () => {
+    const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+    let payload = {};
+    try {
+      const raw = await readStdin();
+      if (raw && raw.trim()) payload = JSON.parse(raw);
+    } catch {
+      payload = {};
+    }
+    try {
+      detect(payload, projectDir);
+    } catch {
+      // never block end-of-turn
+    }
+    process.stdout.write('{}');
+    process.exit(0);
+  })();
+}
+
+module.exports = { detect };

package/install/templates/.claude/settings.json

@@ -90,6 +90,10 @@
             "type": "command",
             "command": "p=\"$CLAUDE_PROJECT_DIR/.claude/hooks/agent-gate-check.js\"; [ -f \"$p\" ] || exit 0; exec node \"$p\""
           },
+          {
+            "type": "command",
+            "command": "p=\"$CLAUDE_PROJECT_DIR/.claude/hooks/voice-conformance-check.js\"; [ -f \"$p\" ] || exit 0; exec node \"$p\""
+          },
           {
             "type": "command",
             "command": "p=\"$CLAUDE_PROJECT_DIR/.claude/hooks/drain-advisory.js\"; [ -f \"$p\" ] || exit 0; exec node \"$p\""
@@ -112,6 +116,10 @@
           {
             "type": "command",
             "command": "p=\"$CLAUDE_PROJECT_DIR/.claude/hooks/strict-scope-guard.js\"; [ -f \"$p\" ] || exit 0; exec node \"$p\""
+          },
+          {
+            "type": "command",
+            "command": "p=\"$CLAUDE_PROJECT_DIR/.claude/hooks/codex-delegate-guard.js\"; [ -f \"$p\" ] || exit 0; exec node \"$p\""
           }
         ]
       },

package/install/templates/_byan/mcp/byan-mcp-server/bin/byan-armament-report.js

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+// WI-7 — the armament observation report (CLI, ESM).
+//
+// Reads the observation ledgers under _byan-output/, reads the CURRENT armed
+// flags from config, and prints per-guard : sample size, would-fire count (the
+// false-positive risk proxy), current armed state, and a calibrated
+// recommendation. It NEVER arms anything — arming is a deliberate config flip the
+// human makes after reading this.
+//
+// Usage : node bin/byan-armament-report.js [--json] [--root <dir>]
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { buildReport } from '../lib/armament-report.js';
+
+function parseArgs(argv) {
+  const a = { json: false, root: process.env.CLAUDE_PROJECT_DIR || process.cwd() };
+  for (let i = 2; i < argv.length; i++) {
+    if (argv[i] === '--json') a.json = true;
+    else if (argv[i] === '--root') a.root = argv[++i];
+  }
+  return a;
+}
+
+function readLedger(root, name) {
+  try {
+    const p = path.join(root, '_byan-output', name);
+    return fs.readFileSync(p, 'utf8').split('\n').filter(Boolean).map((l) => {
+      try { return JSON.parse(l); } catch { return null; }
+    }).filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+
+// Best-effort read of the current armed flags from config (absent -> false).
+function readArmedFlags(root) {
+  const flags = { autobench: false, punt: false, completeness: false };
+  try {
+    const a = JSON.parse(fs.readFileSync(path.join(root, '.claude', 'hooks', 'lib', 'autobench-config.json'), 'utf8'));
+    flags.autobench = Boolean(a && a.enforcement && a.enforcement.armed);
+  } catch { /* absent -> false */ }
+  try {
+    const d = JSON.parse(fs.readFileSync(path.join(root, '_byan', '_config', 'delivery-default.json'), 'utf8'));
+    flags.punt = Boolean(d && d.puntGuard && d.puntGuard.armed);
+    flags.completeness = Boolean(d && d.completenessGate && d.completenessGate.armed);
+  } catch { /* absent -> false */ }
+  return flags;
+}
+
+function render(report) {
+  const lines = ['BYAN armament report (observe first, arm on evidence) :', ''];
+  const label = { autobench: 'Auto-Benchmark', punt: 'Punt guard', completeness: 'Completeness gate' };
+  for (const key of Object.keys(report)) {
+    const g = report[key];
+    const s = g.summary;
+    lines.push(`- ${label[key] || key} : armed=${g.armed} | observations=${s.total} | would-fire=${s.wouldFire} (${Math.round(s.fireRate * 100)}%)`);
+    lines.push(`    -> ${g.recommend.arm ? 'ARM' : 'HOLD'} : ${g.recommend.reason}`);
+  }
+  lines.push('');
+  lines.push('Note : "would-fire" est un indicateur de risque a relire, pas un compte prouve de faux positifs.');
+  lines.push('Armer reste une decision manuelle (autobench-config.json enforcement.armed, delivery-default.json puntGuard/completenessGate.armed).');
+  return lines.join('\n');
+}
+
+function main() {
+  const args = parseArgs(process.argv);
+  const report = buildReport(
+    {
+      benchmark: readLedger(args.root, 'benchmark-ledger.jsonl'),
+      punt: readLedger(args.root, 'punt-ledger.jsonl'),
+      completeness: readLedger(args.root, 'completeness-ledger.jsonl'),
+    },
+    readArmedFlags(args.root)
+  );
+  if (args.json) process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+  else process.stdout.write(render(report) + '\n');
+}
+
+main();
+
+export { readLedger, readArmedFlags, render };

package/install/templates/_byan/mcp/byan-mcp-server/lib/armament-report.js

@@ -0,0 +1,80 @@
+// WI-7 core — the armament observation report (ESM, matches this package's type).
+//
+// Two BYAN teeth are BUILT but DISARMED by config : the auto-benchmark Stop guard
+// and the punt / completeness guards. They only observe + ledger today. Arming
+// one turns it into a refuse-once, which costs a regeneration on every FALSE
+// positive — the risk the user rejected for a hard wall. So arming must be a
+// measured decision, not a blind flip.
+//
+// This pure core reads the observation ledgers and, per guard, reports : how many
+// entries the guard WOULD have acted on if armed (the false-positive risk proxy),
+// over how large a sample, and a recommendation. It NEVER arms anything — the
+// human flips the config after reading this. Honest limit : the ledger has no
+// ground truth, so "wouldFire" is a risk proxy to eyeball, not a proven
+// false-positive count.
+
+// Per-ledger classifiers : does this entry represent the guard ACTING (a block /
+// refuse-once) if it were armed ?
+export function classifyBenchmark(e) {
+  if (!e || typeof e !== 'object') return 'skip';
+  if (typeof e.event === 'string' && /block|regen|unmarked/i.test(e.event)) return 'wouldFire';
+  // a real choice presented (choice-language + an artifact) without a marker and
+  // not on the never-list is exactly what the armed guard blocks.
+  if (e.choiceLang && e.artifact && !e.marker && !e.neverHit) return 'wouldFire';
+  return 'satisfied';
+}
+
+export function classifyPunt(e) {
+  if (!e || typeof e !== 'object') return 'skip';
+  if (e.punt === true) return 'wouldFire';
+  if (typeof e.event === 'string' && /punt/i.test(e.event)) return 'wouldFire';
+  return 'satisfied';
+}
+
+export function classifyCompleteness(e) {
+  if (!e || typeof e !== 'object') return 'skip';
+  if (Array.isArray(e.missing) && e.missing.length > 0) return 'wouldFire';
+  if (typeof e.event === 'string' && /block|gap|fire/i.test(e.event)) return 'wouldFire';
+  return 'satisfied';
+}
+
+export function summarize(entries, classify) {
+  const s = { total: 0, wouldFire: 0, satisfied: 0, armedSeen: false };
+  for (const e of Array.isArray(entries) ? entries : []) {
+    const c = classify(e);
+    if (c === 'skip') continue;
+    s.total += 1;
+    if (e && e.armed === true) s.armedSeen = true;
+    if (c === 'wouldFire') s.wouldFire += 1;
+    else s.satisfied += 1;
+  }
+  s.fireRate = s.total ? s.wouldFire / s.total : 0;
+  return s;
+}
+
+// recommend — the calibrated arming call. Never arm on a small sample ; arm only
+// on a clean record ; otherwise send the human to review the contexts first.
+export function recommend(summary, { minSample = 20 } = {}) {
+  if (!summary || summary.total < minSample) {
+    return { arm: false, reason: `echantillon trop petit (${summary ? summary.total : 0} < ${minSample}) — continuer d'observer avant de decider` };
+  }
+  if (summary.wouldFire === 0) {
+    return { arm: true, reason: `0 declenchement sur ${summary.total} observations — armement sur (aucun faux positif observe)` };
+  }
+  const pct = Math.round(summary.fireRate * 100);
+  return { arm: false, reason: `${summary.wouldFire}/${summary.total} declenchements (${pct}%) — relire ces contextes avant d'armer (chaque faux positif coute une regeneration)` };
+}
+
+// buildReport — the whole picture. `armedFlags` carries the CURRENT config state
+// (read by the bin) so the report shows observed-vs-armed side by side.
+export function buildReport({ benchmark = [], punt = [], completeness = [] } = {}, armedFlags = {}) {
+  const guards = {
+    autobench: { summary: summarize(benchmark, classifyBenchmark), armed: Boolean(armedFlags.autobench) },
+    punt: { summary: summarize(punt, classifyPunt), armed: Boolean(armedFlags.punt) },
+    completeness: { summary: summarize(completeness, classifyCompleteness), armed: Boolean(armedFlags.completeness) },
+  };
+  for (const k of Object.keys(guards)) {
+    guards[k].recommend = recommend(guards[k].summary);
+  }
+  return guards;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-byan-agent",
-  "version": "2.49.0",
+  "version": "2.50.0",
   "description": "BYAN v2.8 - Intelligent AI agent creator with ELO trust system + scientific fact-check + Hermes universal dispatcher + native Claude Code integration (hooks, skills, MCP server). Multi-platform (Claude Code, Codex). Merise Agile + TDD + 71 Mantras. ~54% LLM cost savings.",
   "main": "src/index.js",
   "bin": {