create-byan-agent 2.49.0 → 2.52.0

package/CHANGELOG.md

@@ -9,6 +9,84 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.52.0] - 2026-07-20
+
+### Changed — Delegation Codex v3 : pression-only + obeissance au routeur (F1, F2)
+- **F1 — la delegation ne se declenche plus que sous PRESSION budget.** La nature
+  d'une tache (code / mecanique) n'est plus un declencheur d'auto-delegation a elle
+  seule. Deleguer au Codex de l'abonnement (qui reste en dessous de Claude en
+  qualite) vaut le coup pour epargner le budget Claude, pas par tache de code. Hors
+  pression, le code tourne sur Claude sans rappel. Le seuil par defaut passe a 75 %
+  (`autodelegate-decision.js` + `codex-delegate-guard.js` alignes sur un seul
+  nombre). Sans jauge `budget`, la pression n'est pas calculee et rien n'est
+  propose (documente, non bloquant).
+- **F2 — le garde `codex-delegate-guard` obeit au routeur.** Le blocage ne mord
+  que pour une tache que le `dispatch-router` route lui-meme vers Codex (nature
+  execution / shell / deploiement / devops / navigateur). Une tache
+  architecture / refactor / qualite / planif — et toute verification — route vers
+  Claude, donc le garde reste silencieux. Le garde recalcule router + pression
+  uniquement dans la branche ou un blocage est encore possible (les chemins
+  d'autorisation courants ne paient rien) ; les deux signaux echouent en mode
+  ouvert (signal irresolu -> on autorise, sans blocage a tort).
+
+### Changed — Echelle de modele par complexite + Fable dernier recours (F3)
+- **Cote routeur (`dispatch-router.claudeModelForComplexity`)** : echelle a quatre
+  rungs — `haiku` (bas) -> `sonnet` (moyen) -> `opus` (haut) -> `fable` (extreme,
+  dernier recours, ~2x le prix d'Opus). C'est une RECOMMANDATION par tache, pas un
+  changement du modele de session en cours (Claude Code n'expose pas ce levier).
+- **Cote leaves de workflow (`native-tiers` + linter)** : un up-tier explicite
+  (`opus` / `fable`) devient un choix d'auteur AUTORISE sur n'importe quel leaf,
+  miroir de l'echelle du routeur. Le plancher anti-downgrade est conserve (haiku /
+  sonnet interdits sur un leaf protege) ; seul le plafond est ouvert (le pin-up
+  n'est plus une violation). Nouveaux : `UP_TIER_MODELS`, `isUpTierModel`.
+- **Revirement d'invariant assume** : l'ancienne ligne rouge "pas de Fable /
+  pas de pin-up" est levee cote Claude. Cote Codex elle tient (Codex ne peut pas
+  lancer un modele Claude) : `assertNoFable` garde le chemin Codex + `codex-bridge`.
+- Doctrine alignee : `native-workflows.md`, `native-workflows-contract.md`,
+  `intelligent-dispatch.md`, `codex-auto-delegation.md`, skill `byan-byan`.
+
+## [2.51.0] - 2026-07-20
+
+### Changed — Delegation Codex : fermeture de l'auto-esquive (option B)
+- Le blocage `codex-delegate-guard` ne peut plus etre contourne par BYAN lui-meme.
+  Retire : la marque de contenu auto-ecrite (`// BYAN-DELEGATE: reviewed`) et
+  l'auto-passe par re-soumission/fenetre de grace — les deux permettaient a Claude
+  de s'auto-accorder la sortie. Les seules sorties valides sont desormais : une
+  delegation Codex reelle ce tour, Codex indisponible (detecte via `codex --version`),
+  ou un opt-out HUMAIN ("reste sur claude" / "sans codex" dans la demande, ou le
+  fichier `.byan-codex-autodelegate/off`). Le motif "script court / latence / je
+  verifie" n'est plus une raison valide. Coeur pur `lib/codex-delegate-gate.js`
+  (`humanOptOutFromText`, `decideDelegateGate` durci) + `codex-delegate-guard.js`
+  (probe Codex, opt-out depuis la demande). Le rendu injecte (`autodelegate-decision`
+  renderNudge), le skill `byan-byan` et `docs/codex-auto-delegation.md` sont alignes.
+
+### Notes
+- Constat de session : le CLI Codex de l'abo ChatGPT est plafonne a gpt-5.5 (5.6
+  refuse). Recherche croisee : gpt-5.5 est sous le meilleur Claude sur tous les
+  domaines mesures. Donc la delegation Codex vaut pour economiser le budget Claude,
+  pas pour la qualite. Prochain chantier (FD dedie) : delegation declenchee par la
+  PRESSION budget (~75%) au lieu de par-nature ; le blocage obeit au routeur ;
+  echelle modele Claude par complexite (haiku/sonnet/opus) + Fable en dernier recours.
+
+## [2.50.0] - 2026-07-17
+
+### Added — BYAN souverainete (les concepts BYAN pilotent Claude, ne se font plus doubler)
+- **WI-1 dent delegation Codex** : hook PreToolUse `codex-delegate-guard.js` (+ coeur pur `lib/codex-delegate-gate.js`) qui refuse-une-fois le premier Write/Edit de code delegable quand la voie Codex est armee (option + Codex linke) et qu'aucune delegation n'a eu lieu ce tour. Speed-bump, pas un mur : escape `.byan-codex-autodelegate/off`, marque `// BYAN-DELEGATE: reviewed`, fenetre de grace. Corrige la racine de l'incident (Claude codait lui-meme malgre la directive).
+- **WI-2 filet de conformite de voix** : hook Stop `voice-conformance-check.js` (+ `lib/voice-conformance.js`) qui repere les signaux objectifs de derive (emoji, vouvoiement en grappe) et pose un drapeau relaye au tour suivant. Non bloquant (le registre reste semantique).
+- **WI-3 filet dispatch runtime** : drapeau quand un tour ecrit du code sans avoir consulte `byan_dispatch`, hors FD.
+- **WI-4 garde de porte d'entree renforce** : le signal visuel party-mode (`TaskCreate`/`TaskUpdate`) tient desormais la posture d'entree — plus de faux drapeau sur un tour party-mode.
+- **WI-7 rapport d'armement** : `bin/byan-armament-report.js` (+ `lib/armament-report.js`) lit les registres autobench/punt/completeness et reporte le taux de declenchement (indicateur de risque de faux positif) avant toute decision d'armement. Verdict mesure : les 3 gardes restent DESARMEES (punt 42%, autobench 1%, completeness echantillon trop petit).
+
+### Changed
+- **WI-6 fuite Bash du strict-scope-guard** : `decideScope` couvre desormais les redirections d'ecriture Bash (`>`, `>>`, `tee`, heredoc) hors `allowedPaths`. Parseur resserre (cible en forme de chemin uniquement) pour eviter les faux positifs sur les operateurs de comparaison/arithmetique et les variables non resolues.
+- **WI-5 fact-check-absolutes elargi** : plus d'absolus/superlatifs/best-practice/certitudes couverts (alignes sur `.claude/rules/fact-check.md`) ; `optimal` ecarte (trop courant) et strip d'exemples resserre a une puce (une phrase de prose commencant par un absolu reste policee). Le plafond des mantras semantiques (IA-16, #37...) est assume : doctrine + `byan-mantra-audit`, pas de fausse dent regex.
+
+### Docs
+- `docs/byan-sovereignty-chantier.md` : le chantier complet (constat, patron des 4 dents, plafond honnete, work items, risques) adosse a l'audit `byan-sovereignty-audit`.
+
+### Tests
+- +9 tests MCP (armament report + parite shipping anti-derive) ; +47 tests jest (dents + filets + fact-check + strict-scope Bash). jest 2699/0, MCP 855/0.
+
 ## [2.49.0] - 2026-07-16
 
 ### Added

package/install/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-byan-agent",
-  "version": "2.49.0",
+  "version": "2.51.0",
   "description": "BYAN - Intelligent AI agent installer with multi-platform native support (Claude Code, Codex/OpenCode)",
   "bin": {
     "create-byan-agent": "bin/create-byan-agent-v2.js"

package/install/templates/.claude/hooks/agent-gate-check.js

@@ -20,12 +20,24 @@ const gate = require('./lib/agent-gate');
 function detect(payload, projectDir) {
   const text = extractLastAssistantText(payload);
   const messages = extractRecentMessages(payload, 8) || [];
+  const wroteFiles = gate.hasWriteActivity(messages);
+  const fdActive = gate.fdIsActive(projectDir);
   const assessment = gate.assessTurn({
-    wroteFiles: gate.hasWriteActivity(messages),
+    wroteFiles,
     proposedAgent: gate.hasProposalMarker(text),
-    fdActive: gate.fdIsActive(projectDir),
+    taskVisualSeen: gate.hasTaskActivity(messages), // WI-4: a live task list holds the entry posture
+    fdActive,
   });
   if (assessment.slip) gate.writeSlip(projectDir, assessment.reason);
+  // WI-3: dispatch net, its own slip. Same signals, different question (was the
+  // runtime routeur consulted?).
+  const dispatch = gate.assessDispatch({
+    wroteFiles,
+    dispatchConsulted: gate.hasDispatchActivity(messages),
+    fdActive,
+  });
+  if (dispatch.slip) gate.writeDispatchSlip(projectDir, dispatch.reason);
+  assessment.dispatch = dispatch; // backward-compatible: .slip stays primary
   return assessment;
 }
 

package/install/templates/.claude/hooks/codex-delegate-guard.js

@@ -0,0 +1,137 @@
+#!/usr/bin/env node
+'use strict';
+
+// PreToolUse hook — the armed Codex-delegation guard (v3 : router-obedient +
+// pressure-gated). See lib/codex-delegate-gate.js for the policy.
+//
+// It DENIES a code Write/Edit only when ALL hold : the lane is armed (yanstaller
+// option on AND Codex linked), the ROUTER routes the task to Codex, we are under
+// Claude budget PRESSURE, Codex is available, and no delegation happened this turn
+// — and the human has not opted out. Otherwise it allows. Never traps a turn on an
+// internal error (fails open), always exits 0.
+//
+// The two computed signals (router decision, budget pressure) are only evaluated
+// in the would-deny branch, so the common allow paths pay nothing. Both fail open
+// (an unresolvable signal -> allow, never a wrong block).
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { pathToFileURL } = require('url');
+const gate = require('./lib/codex-delegate-gate');
+const { loadConfig, codexLinked, toggledOff } = require('./codex-autodelegate');
+const { estimateClaudeUsage } = require('./lib/usage-estimator');
+const { extractRecentMessages, contentToText } = require('./lib/transcript-read');
+
+const ROOT = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+const ROUTER_PATH = path.resolve(__dirname, '../../_byan/mcp/byan-mcp-server/lib/dispatch-router.js');
+const DEFAULT_PRESSURE_THRESHOLD = 75; // % of the Claude budget window
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let data = '';
+    process.stdin.on('data', (c) => (data += c));
+    process.stdin.on('end', () => resolve(data));
+    process.stdin.on('error', () => resolve(''));
+  });
+}
+
+const allow = () => ({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow' } });
+const deny = (reason) => ({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } });
+
+// Codex availability probe : `codex --version` exits 0. Absent/broken -> false ->
+// the guard must NOT deny (staying on Claude is the legit fallback).
+function probeCodexAvailable(runner = spawnSync) {
+  try {
+    const res = runner('codex', ['--version'], { timeout: 8000, encoding: 'utf8' });
+    return res && res.status === 0;
+  } catch (_e) {
+    return false;
+  }
+}
+
+// routerSaysCodex(text) : does dispatch-router route this task's text to Codex?
+// The router keyword-matches on the text (execution/shell/deploy/script...). ESM
+// module dynamically imported from this CJS hook. Fails open (false = don't block)
+// if the router cannot be loaded.
+async function defaultRouteProbe(text) {
+  try {
+    const mod = await import(pathToFileURL(ROUTER_PATH).href);
+    return mod.routeRuntime(String(text || '')) === 'codex';
+  } catch (_e) {
+    return false;
+  }
+}
+
+// underPressure : Claude budget usage >= threshold. Needs a budget in the config
+// (no budget -> pct null -> not under pressure -> no delegation, documented).
+function computeUnderPressure(config) {
+  try {
+    const budget = config && config.budget ? config.budget : null;
+    if (!budget) return false;
+    const threshold = typeof config.threshold === 'number' ? config.threshold : DEFAULT_PRESSURE_THRESHOLD;
+    const usage = estimateClaudeUsage({ budget });
+    return typeof usage.pct === 'number' && usage.pct >= threshold;
+  } catch (_e) {
+    return false;
+  }
+}
+
+function lastUserText(payload) {
+  const msgs = extractRecentMessages(payload, 12);
+  if (!Array.isArray(msgs)) return '';
+  for (let i = msgs.length - 1; i >= 0; i--) {
+    if (msgs[i] && msgs[i].role === 'user') return contentToText(msgs[i].content);
+  }
+  return '';
+}
+
+// runGuard — async (the router import is async). opts inject the probes for tests.
+async function runGuard(payload, {
+  root = ROOT,
+  codexProbe = probeCodexAvailable,
+  routeProbe = defaultRouteProbe,
+  pressureProbe = computeUnderPressure,
+} = {}) {
+  const toolName = payload.tool_name || payload.toolName || '';
+  if (toolName !== 'Write' && toolName !== 'Edit') return allow();
+
+  const config = loadConfig(root);
+  const armed = config.enabled === true && codexLinked();
+  if (!armed) return allow(); // fast path, no transcript/probe work when off
+
+  const escaped = toggledOff(root);
+  const input = payload.tool_input || payload.toolInput || {};
+  const filePath = input.file_path || input.filePath || '';
+  const isCode = gate.targetIsCode(filePath);
+  const humanOptOut = gate.humanOptOutFromText(lastUserText(payload));
+  const delegationSeen = gate.delegationSeenThisTurn(extractRecentMessages(payload, 12) || []);
+
+  // Only compute the two expensive signals when a deny is otherwise possible.
+  const maybeDeny = !escaped && !humanOptOut && isCode && !delegationSeen;
+  const routerSaysCodex = maybeDeny ? await routeProbe(lastUserText(payload)) : false;
+  const underPressure = (maybeDeny && routerSaysCodex) ? pressureProbe(config) : false;
+  const codexAvailable = (maybeDeny && routerSaysCodex && underPressure) ? codexProbe() : true;
+
+  const decision = gate.decideDelegateGate({
+    armed, routerSaysCodex, targetIsCode: isCode, underPressure,
+    delegationSeen, escaped, humanOptOut, codexAvailable,
+  });
+  return decision.decision === 'deny' ? deny(decision.reason) : allow();
+}
+
+if (require.main === module) {
+  (async () => {
+    let out;
+    try {
+      const payload = JSON.parse((await readStdin()) || '{}');
+      out = await runGuard(payload);
+    } catch (_e) {
+      out = allow();
+    }
+    process.stdout.write(JSON.stringify(out));
+    process.exit(0);
+  })();
+}
+
+module.exports = { runGuard, probeCodexAvailable, defaultRouteProbe, computeUnderPressure, lastUserText };

package/install/templates/.claude/hooks/inject-voice-anchor.js

@@ -28,6 +28,7 @@ const path = require('path');
 const { buildTaoContext, turnCounterPath } = require('./inject-tao');
 const pl = require('./lib/plain-language');
 const gate = require('./lib/agent-gate');
+const voice = require('./lib/voice-conformance');
 
 const ANCHOR = [
   'Voix BYAN (rappel par tour ; tao complet chargé au démarrage de session) :',
@@ -96,6 +97,20 @@ function withGateReminder(baseContext, slip) {
   return reminder ? `${baseContext}\n${reminder}` : baseContext;
 }
 
+// Append the dispatch reminder (WI-3) when the previous turn wrote code without
+// consulting byan_dispatch. Pure; fs read + clear stays in require.main.
+function withDispatchReminder(baseContext, slip) {
+  const reminder = gate.formatDispatchReminder(slip);
+  return reminder ? `${baseContext}\n${reminder}` : baseContext;
+}
+
+// Append the voice-conformance reminder (WI-2) when the previous turn drifted from
+// the BYAN voice (emoji / vouvoiement). Pure; fs read + clear stays in require.main.
+function withVoiceReminder(baseContext, hits) {
+  const reminder = voice.formatReminder(hits);
+  return reminder ? `${baseContext}\n${reminder}` : baseContext;
+}
+
 if (require.main === module) {
   const projectDir = process.env.CLAUDE_PROJECT_DIR || process.cwd();
   const every = refreshEvery();
@@ -110,8 +125,16 @@ if (require.main === module) {
   // Forward net #2 (F4): agent entry-gate slip. Read + clear one-shot.
   const gateSlip = gate.readSlip(projectDir);
   if (gateSlip) gate.clearSlip(projectDir);
+  // Forward net #3 (WI-3): dispatch-runtime slip. Read + clear one-shot.
+  const dispatchSlip = gate.readDispatchSlip(projectDir);
+  if (dispatchSlip) gate.clearDispatchSlip(projectDir);
+  // Forward net #4 (WI-2): voice-conformance slip. Read + clear one-shot.
+  const voiceHits = voice.readSlip(projectDir);
+  if (voiceHits && voiceHits.length) voice.clearSlip(projectDir);
   let ctx = withSlipReminder(additionalContext, slipHits);
   ctx = withGateReminder(ctx, gateSlip);
+  ctx = withDispatchReminder(ctx, dispatchSlip);
+  ctx = withVoiceReminder(ctx, voiceHits);
   process.stdout.write(
     JSON.stringify({
       hookSpecificOutput: {
@@ -131,5 +154,7 @@ module.exports = {
   decideAnchor,
   withSlipReminder,
   withGateReminder,
+  withDispatchReminder,
+  withVoiceReminder,
   DEFAULT_REFRESH_EVERY,
 };

package/install/templates/.claude/hooks/lib/agent-gate.js

@@ -32,6 +32,33 @@ function hasProposalMarker(text) {
   return PROPOSAL_MARKERS.some((m) => t.includes(m));
 }
 
+// hasToolActivity(messages, predicate) — true if any assistant tool_use block in
+// the recent messages matches the predicate(block). The shared scan used by the
+// write / task-visual / dispatch detectors.
+function hasToolActivity(messages, predicate) {
+  if (!Array.isArray(messages)) return false;
+  for (const m of messages) {
+    if (!m || m.role !== 'assistant' || !Array.isArray(m.content)) continue;
+    for (const block of m.content) {
+      if (block && block.type === 'tool_use' && predicate(block)) return true;
+    }
+  }
+  return false;
+}
+
+// WI-4 — the party-mode live visual signal : did the turn create a native task
+// (TaskCreate) ? A task list IS the visual the entry chain promises, so its
+// presence means the porte d'entree posture held even without a text proposal.
+function hasTaskActivity(messages) {
+  return hasToolActivity(messages, (b) => b.name === 'TaskCreate' || b.name === 'TaskUpdate');
+}
+
+// WI-3 — the dispatch-consulted signal : was the routeur (byan_dispatch) called
+// this turn ? Matches the MCP tool name in any namespaced form.
+function hasDispatchActivity(messages) {
+  return hasToolActivity(messages, (b) => /byan_dispatch/.test(String(b.name || '')));
+}
+
 // hasWriteActivity(messages) — true if any recent assistant message carried a
 // tool_use block that writes to the repo. `messages` is an array of
 // { role, content } where content is a string or a block array.
@@ -47,14 +74,28 @@ function hasWriteActivity(messages) {
 }
 
 // assessTurn — the decision. A slip is a task done directly (files written) with
-// no agent proposal AND no active FD cycle. When an FD is engaged, the gate is
-// already in play (DISPATCH is part of it), so it is never a slip.
-function assessTurn({ wroteFiles = false, proposedAgent = false, fdActive = false } = {}) {
-  const slip = Boolean(wroteFiles && !proposedAgent && !fdActive);
+// no agent proposal, NO party-mode task visual (WI-4), AND no active FD cycle.
+// When an FD is engaged, the gate is already in play (DISPATCH is part of it), so
+// it is never a slip ; likewise a live task list is proof the entry posture held.
+function assessTurn({ wroteFiles = false, proposedAgent = false, taskVisualSeen = false, fdActive = false } = {}) {
+  const slip = Boolean(wroteFiles && !proposedAgent && !taskVisualSeen && !fdActive);
   return {
     slip,
     reason: slip
-      ? 'files written directly without an agent proposal and no active FD cycle'
+      ? 'files written directly without an agent proposal, no task visual, and no active FD cycle'
+      : 'ok',
+  };
+}
+
+// WI-3 — dispatch net. A slip is code written this turn without the runtime
+// routeur (byan_dispatch) ever consulted, outside an FD cycle. Non-blocking : the
+// engine choice is a decision, not a binary invariant, so this only flags.
+function assessDispatch({ wroteFiles = false, dispatchConsulted = false, fdActive = false } = {}) {
+  const slip = Boolean(wroteFiles && !dispatchConsulted && !fdActive);
+  return {
+    slip,
+    reason: slip
+      ? 'code written without consulting byan_dispatch (runtime routing) and no active FD cycle'
       : 'ok',
   };
 }
@@ -100,6 +141,46 @@ function formatReminder(slip) {
   ].join(' ');
 }
 
+// --- dispatch slip (WI-3, its own sidecar, same forward-net mechanics) --------
+
+function dispatchSlipPath(projectDir) {
+  return path.join(projectDir, '_byan-output', '.dispatch-slip.json');
+}
+
+function writeDispatchSlip(projectDir, detail) {
+  try {
+    const p = dispatchSlipPath(projectDir);
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, JSON.stringify({ detail: String(detail || '') }));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function readDispatchSlip(projectDir) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(dispatchSlipPath(projectDir), 'utf8'));
+    return parsed && typeof parsed === 'object' ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+function clearDispatchSlip(projectDir) {
+  try { fs.rmSync(dispatchSlipPath(projectDir), { force: true }); } catch { /* never block */ }
+}
+
+function formatDispatchReminder(slip) {
+  if (!slip) return '';
+  return [
+    'Rappel dispatch runtime (BYAN) : au dernier tour du code a ete ecrit sans',
+    'consulter byan_dispatch (le routeur moteur/modele/effort). La chaine d\'entree',
+    'route avant d\'executer : passe par byan_dispatch pour choisir Codex ou Claude,',
+    'le modele et l\'effort. Applique-le ce tour-ci.',
+  ].join(' ');
+}
+
 // fdIsActive(projectDir) — reads _byan-output/fd-state.json ; active means a live
 // phase (not COMPLETED / ABORTED / absent). Read-only, best-effort.
 function fdIsActive(projectDir) {
@@ -117,11 +198,20 @@ module.exports = {
   WRITE_TOOLS,
   hasProposalMarker,
   hasWriteActivity,
+  hasToolActivity,
+  hasTaskActivity,
+  hasDispatchActivity,
   assessTurn,
+  assessDispatch,
   slipPath,
   writeSlip,
   readSlip,
   clearSlip,
   formatReminder,
+  dispatchSlipPath,
+  writeDispatchSlip,
+  readDispatchSlip,
+  clearDispatchSlip,
+  formatDispatchReminder,
   fdIsActive,
 };

package/install/templates/.claude/hooks/lib/autodelegate-decision.js

@@ -22,7 +22,7 @@
 
 const { perfFavors } = require('./perf-routing');
 
-const DEFAULT_THRESHOLD = 80;
+const DEFAULT_THRESHOLD = 75;
 const DEFAULT_INVOCATION = 'codex:codex-rescue --model gpt-5.4';
 const RED_LINE = 'delegable work only (code / mechanical) — judgment, analysis, soul and verification stay on Claude';
 
@@ -71,16 +71,12 @@ function decideAutodelegation({ requestText = '', usage = null, config = {} } =
     };
   }
 
-  if (delegable) {
-    return {
-      delegate: true,
-      mode: 'delegable-only',
-      pct,
-      reason: 'request looks like delegable coding work — propose handing it to Codex to spare the Claude 5h budget',
-      redLine: RED_LINE,
-      invocation,
-    };
-  }
+  // v3 : NATURE alone is no longer an auto-delegate trigger. The user's decision
+  // is PRESSURE-only — delegating to the subscription Codex (which trails Claude
+  // on quality) is worth it to spare the Claude budget, not per coding task. So a
+  // delegable task off-pressure does NOT propose Codex. `delegable` is kept only as
+  // a signal the perf-routing opt-in below can still use.
+  void delegable;
 
   // PERF (opt-in): the forces table (user-populated) may favor Codex for this
   // kind of task even at low pressure. Off by default; always heuristic.
@@ -141,8 +137,10 @@ function renderNudge(decision) {
     `[BYAN auto-delegate]${gauge}: ${scope} via \`${invocation}\` `
       + '(runs on the ChatGPT subscription, no API credit).',
     `Red line: ${decision.redLine}. The lane is ARMED (option on AND Codex linked), so this is a `
-      + 'DIRECTIVE, not a mere suggestion: delegate the delegable part unless you have a specific reason '
-      + "not to, fall back to Claude only if Codex is unavailable, and verify Codex's output before commit.",
+      + 'DIRECTIVE, not a suggestion: delegate the delegable part. The ONLY valid reasons to stay on '
+      + 'Claude are (1) Codex unavailable, or (2) the user asked to stay on Claude. "Small script / '
+      + 'latency / I verify anyway" is NOT a valid reason — the codex-delegate-guard denies a delegable '
+      + "code write that skips Codex. Verify Codex's output before commit.",
   ].join(' ');
 }
 

package/install/templates/.claude/hooks/lib/codex-delegate-gate.js

@@ -0,0 +1,130 @@
+'use strict';
+
+// Core of the armed Codex-delegation guard (v3 : router-obedient + pressure-gated).
+//
+// History : v1 blocked every code Write when the lane was armed (blunt). v2
+// (option B) closed BYAN's self-dodge (no content marker, no resubmit auto-pass).
+// v3 makes the block match the actual delegation policy the user chose :
+//   - it OBEYS the router : it only bites when dispatch-router routes the task to
+//     Codex (execution / shell / deploy). A refactor / architecture / judgment
+//     task routes to Claude, so the block stays silent.
+//   - it is PRESSURE-gated : delegation to Codex is worth it to spare the Claude
+//     budget, not for quality (the subscription Codex trails Claude). So the block
+//     only bites when the Claude usage is under budget PRESSURE (>= threshold).
+//     Off-pressure, code runs on Claude with no nag.
+//
+// Still true from v2 : the only per-turn escape is the HUMAN's (escape file or an
+// opt-out phrase in the request) — BYAN cannot self-grant a bypass. Codex genuinely
+// unavailable is a legit fallback. A real delegation already done this turn passes
+// (Claude applies the diff).
+//
+// Pure (no I/O) : the hook shell computes the signals (armed, routerSaysCodex,
+// targetIsCode, underPressure, delegationSeen, escaped, humanOptOut, codexAvailable)
+// and feeds them here.
+
+const CODE_EXT = new Set([
+  '.sh', '.bash', '.zsh', '.js', '.mjs', '.cjs', '.jsx', '.ts', '.tsx',
+  '.py', '.rb', '.go', '.rs', '.java', '.kt', '.c', '.h', '.cpp', '.hpp',
+  '.cc', '.php', '.pl', '.lua', '.sql', '.swift', '.scala', '.dart',
+]);
+const CODE_BASENAMES = new Set(['Dockerfile', 'Makefile', 'makefile', 'Rakefile']);
+
+function extOf(filePath) {
+  const s = String(filePath || '');
+  const slash = Math.max(s.lastIndexOf('/'), s.lastIndexOf('\\'));
+  const base = slash >= 0 ? s.slice(slash + 1) : s;
+  const dot = base.lastIndexOf('.');
+  return dot > 0 ? base.slice(dot).toLowerCase() : '';
+}
+
+function baseOf(filePath) {
+  const s = String(filePath || '');
+  const slash = Math.max(s.lastIndexOf('/'), s.lastIndexOf('\\'));
+  return slash >= 0 ? s.slice(slash + 1) : s;
+}
+
+// targetIsCode(filePath) — the write is delegable EXECUTABLE code (a doc/config is
+// not). A CI workflow path also counts.
+function targetIsCode(filePath) {
+  if (!filePath) return false;
+  const norm = String(filePath).split('\\').join('/');
+  if (/(^|\/)\.github\/workflows\//.test(norm) && /\.(ya?ml)$/i.test(norm)) return true;
+  if (CODE_BASENAMES.has(baseOf(norm))) return true;
+  return CODE_EXT.has(extOf(norm));
+}
+
+// The HUMAN opt-out : the only per-turn way to keep a delegable write on Claude is
+// the human saying so in the request. Matched on the user's OWN text.
+const HUMAN_OPTOUT_RE = /\b(reste sur claude|sans codex|pas de codex|no codex|pas de delegation|don'?t delegate|skip codex)\b/i;
+
+function humanOptOutFromText(text) {
+  return HUMAN_OPTOUT_RE.test(String(text == null ? '' : text));
+}
+
+// delegationSeenThisTurn(messages) — did a real Codex delegation happen this turn?
+// (Bash `codex exec`, a codex:* Task/Agent, or an MCP codex-bridge call.) If so,
+// Claude applying the result is legitimate.
+function delegationSeenThisTurn(messages) {
+  if (!Array.isArray(messages)) return false;
+  for (const m of messages) {
+    if (!m || m.role !== 'assistant' || !Array.isArray(m.content)) continue;
+    for (const block of m.content) {
+      if (!block || block.type !== 'tool_use') continue;
+      const name = String(block.name || '');
+      const input = block.input || {};
+      if (name === 'Bash' && /\bcodex\s+exec\b/i.test(String(input.command || ''))) return true;
+      if ((name === 'Task' || name === 'Agent') && /codex/i.test(String(input.subagent_type || input.subagentType || ''))) return true;
+      if (/codex[_-]?bridge|codex[_-]?rescue/i.test(name)) return true;
+    }
+  }
+  return false;
+}
+
+const DENY_REASON = [
+  'BYAN souverainete : le routeur (dispatch-router) a route cette tache vers CODEX',
+  '(nature execution / shell / script / deploiement), tu es SOUS PRESSION budget',
+  'Claude (usage proche de la limite), Codex est disponible, mais tu ecris le code',
+  'toi-meme sans avoir delegue ce tour. Delegue a Codex pour epargner le budget',
+  'Claude : agent codex:codex-rescue, ou `codex exec` via codex-bridge, puis applique',
+  'le diff. Les SEULES raisons valides de rester sur Claude : (1) Codex indisponible,',
+  'ou (2) l\'utilisateur a demande de rester sur Claude ("reste sur claude" / "sans',
+  'codex", ou le fichier .byan-codex-autodelegate/off). "Script court / latence / je',
+  'verifie" n\'est PAS valide. BYAN ne peut pas s\'auto-accorder la sortie.',
+].join(' ');
+
+// decideDelegateGate — the pure decision (v3). Order : cheap allows short-circuit
+// before the deny. The block bites ONLY when every condition holds : armed, the
+// ROUTER routes to Codex, the target is code, we are under budget PRESSURE, Codex
+// is available, and no delegation happened this turn. Any miss -> allow. The human
+// always keeps the escape switch / opt-out, so it is never a trap for the user.
+function decideDelegateGate({
+  armed = false,
+  routerSaysCodex = false,
+  targetIsCode: isCode = false,
+  underPressure = false,
+  delegationSeen = false,
+  escaped = false,
+  humanOptOut = false,
+  codexAvailable = true,
+} = {}) {
+  if (!armed) return { decision: 'allow', code: 'lane-not-armed' };
+  if (escaped) return { decision: 'allow', code: 'escape-hatch' };        // human switch
+  if (humanOptOut) return { decision: 'allow', code: 'human-opt-out' };   // human asked Claude
+  if (!routerSaysCodex) return { decision: 'allow', code: 'router-claude' }; // brain routed to Claude (F2)
+  if (!isCode) return { decision: 'allow', code: 'not-code' };            // codex-nature task but a doc/config write
+  if (!underPressure) return { decision: 'allow', code: 'no-pressure' };  // budget not tight (F1) -> Claude is fine
+  if (!codexAvailable) return { decision: 'allow', code: 'codex-unavailable' }; // legit fallback
+  if (delegationSeen) return { decision: 'allow', code: 'delegation-seen' };    // Codex already run
+  return { decision: 'deny', code: 'delegate-first', reason: DENY_REASON };
+}
+
+module.exports = {
+  CODE_EXT,
+  CODE_BASENAMES,
+  targetIsCode,
+  HUMAN_OPTOUT_RE,
+  humanOptOutFromText,
+  delegationSeenThisTurn,
+  decideDelegateGate,
+  DENY_REASON,
+};