crewforth 3.1.0-rc.5 → 3.1.0-rc.7

package/kit/hooks/guard-bash.sh

@@ -1375,7 +1375,7 @@ fi
 # the shell is Turing-complete, so this is defence-in-depth — guard-write.sh covers the Write/Edit tools (the
 # model's natural path to a file), and install-time read-only hook files would be the airtight layer.
 _GP='[/\\]+(\.[/\\]+)*'      # a path separator as the shell and the filesystem take it: `/`, `\`, doubled, with `/./` between
-GATE='(\.(claude'"$_GP"'(hooks|git-shim|settings\.json|DISCIPLINE\.md|eval'"$_GP"'lib'"$_GP"'crew-env\.sh)|git'"$_GP"'hooks|git'"$_GP"'(config|worktrees'"$_GP"'[^/\\[:space:]]+'"$_GP"'config|modules'"$_GP"'[^[:space:]]+'"$_GP"'config))|\.gitconfig([^A-Za-z0-9_.-]|$)|\.config'"$_GP"'git'"$_GP"'config([^A-Za-z0-9_.-]|$))'
+GATE='(\.(claude'"$_GP"'(hooks|git-shim|settings\.json|settings\.local\.json|DISCIPLINE\.md|eval'"$_GP"'lib'"$_GP"'crew-env\.sh)|git'"$_GP"'hooks|git'"$_GP"'(config|worktrees'"$_GP"'[^/\\[:space:]]+'"$_GP"'config|modules'"$_GP"'[^[:space:]]+'"$_GP"'config))|\.gitconfig([^A-Za-z0-9_.-]|$)|\.config'"$_GP"'git'"$_GP"'config([^A-Za-z0-9_.-]|$))'
 # .git/config (with a worktree's and a submodule's own) is on the list because core.hooksPath LIVES there: the rules
 # above stop `git config core.hooksPath …`, and a plain `printf '[core]\n\thooksPath = /dev/null\n' >> .git/config`
 # walked past them — after it a commit from the user's own terminal skips the trace and secret scans (measured, 3.1.0
@@ -1823,7 +1823,7 @@ _appr_named(){  # sets _APN: 1 = the record is named, 2 = the hook is fed, 3 = a
   t="$CMD_UQ"; _APN=0
   shopt -q nocasematch && nc=1; shopt -s nocasematch
   case "$t" in
-    *crewforth-appr*) _APN=1 ;;
+    *crewforth-appr*|*crew-approval-pending*) _APN=1 ;;
   esac
   [ "$nc" = 0 ] && shopt -u nocasematch
   # FED means the hook is what the input goes INTO: it stands after a pipe, or shares its command with an input
@@ -1857,9 +1857,13 @@ _appr_named
 _appr_word(){  # $1 = a word of the command -> 0 when it, or what follows its first `=`, is an approval
   local w="$1"
   [ "${#w}" -le 160 ] || return 1
-  _crew_appr_op "$w"; [ -n "$OP" ] && return 0
-  case "$w" in *=*) _crew_appr_op "${w#*=}"; [ -n "$OP" ] && return 0 ;; esac
-  return 1
+  _crew_appr_op "$w"; [ -z "$OP" ] && case "$w" in *=*) _crew_appr_op "${w#*=}" ;; esac
+  [ -n "$OP" ] || return 1
+  # `/crew-approve` with nothing after it is a single word, and a single word turns up where nothing is started:
+  # `grep -rn /crew-approve .claude/hooks`. It counts only in a command one of whose words IS claude (also
+  # claude.exe, a path that ends in it, the package's name): then it is a prompt, or about to be piped into one.
+  if [ "$OP" = pending ] && [ "$_AWC" != 1 ]; then OP=""; return 1; fi
+  return 0
 }
 _appr_in_claude_call(){  # 0 = a word of this command is an approval (OP names it)
   # The command AS IT WAS SENT: the prompt of a plain `claude -p "…"` has been taken out of CMD by now (it is text for
@@ -1871,7 +1875,10 @@ _appr_in_claude_call(){  # 0 = a word of this command is an approval (OP names i
   [ -f "$here/prompt-approval.sh" ] || return 1          # no recording hook: no approval can be recorded at all
   declare -F _crew_appr_op >/dev/null 2>&1 || . "$here/prompt-approval.sh"
   declare -F _crew_appr_op >/dev/null 2>&1 || return 1
-  OP=""
+  OP=""; _AWC=0
+  case " ${CMD_UQ//[;|&()]/ } " in
+    *[[:space:]]claude[[:space:]]*|*[[:space:]]claude.exe[[:space:]]*|*[[:space:]]claude.cmd[[:space:]]*|*/claude[[:space:]]*|*/claude.exe[[:space:]]*|*claude-code*) _AWC=1 ;;
+  esac
   while :; do
     pre="${s%%[\"\'\\$' \t\n;|&()<>']*}"
     [ -n "$pre" ] && { w="$w$pre"; inw=1; }
@@ -1897,6 +1904,31 @@ _appr_in_claude_call(){  # 0 = a word of this command is an approval (OP names i
   [ "$inw" = 1 ] && _appr_word "$w" && return 0
   return 1
 }
+# What model routing decides from is written by the user and by Crewforth's own hooks (guard-write.sh has the same rule
+# for the file tools): the user's rules, the floors, the list of critical paths, and the records of calls and results.
+# A command that NAMES one is refused, reading included; model-outcomes.tsv, the plain record, may be read. The
+# name is `crew-model…` for all of them (the rules, the floors, the user's lowerings, the records of calls).
+# HONEST SCOPE: this stops an accident and a plain attempt, not a determined one. A command that builds the name
+# from pieces (`f=crew-mo; … ${f}del-loosened.tsv`), writes through an interpreter (`python3 -c`), or moves a
+# folder above it (`cd .claude && mv state x`) spells none of what is matched here and is past this rule.
+_mr_named(){ local nc=0 rc=1; shopt -q nocasematch && nc=1; shopt -s nocasematch
+  case "$CMD_UQ" in *crew-model*|*crew-critical-paths*) rc=0 ;; esac
+  # ...and by a glob that could reach one, or the folder itself in a command that moves, copies or removes: a word
+  # that holds `.claude/state` and a wildcard, or that IS that folder beside rm, mv, cp, rmdir, rsync, tar or ln.
+  if [ "$rc" = 1 ]; then
+    local w unglob=0 verb=0
+    case "$-" in *f*) ;; *) unglob=1; set -f ;; esac
+    for w in $CMD_UQ; do case "$w" in rm|mv|cp|rmdir|rsync|tar|ln|*/rm|*/mv|*/cp) verb=1 ;; esac; done
+    for w in $CMD_UQ; do
+      case "$w" in
+        *.claude[/\\]state[/\\]*[\*\?\[]*|*.claude[/\\]state[\*\?\[]*) rc=0 ;;
+        *.claude[/\\]state|*.claude[/\\]state[/\\]) [ "$verb" = 1 ] && rc=0 ;;
+      esac
+    done
+    [ "$unglob" = 1 ] && set +f
+  fi
+  [ "$nc" = 0 ] && shopt -u nocasematch; return "$rc"; }
+_mr_named && block "a model routing record named in a command (the user and Crewforth's hooks write it)" "4.5" tamper
 _appr_in_claude_call && block "a command that hands a Claude Code session an approval as its prompt (only the user's own message approves)" "4.4" tamper
 
 # §4.5-adjacent: a .env file holds secrets. The settings.json Read-tool deny does NOT cover the Bash tool, so a
@@ -3229,10 +3261,39 @@ ${BRANCH_WARN}Approve only if the commit message above was shown to you and you
         exit 2
       fi
       _aps=push; git_has "$CMD_SEEN" 'commit' && _aps=commit
+      # WHAT WAS REFUSED IS WRITTEN DOWN, so that the user can approve it with `/crew-approve` and nothing after it:
+      # the session, the operation and the second, in .claude/state/crew-approval-pending. The operation is what
+      # THIS gate saw in the command it refused; a commit refused and then a push refused in the same session
+      # within 30 minutes are one thing waiting, commit+push. The file is closed to the session (guard-write.sh,
+      # and the name rule above): a session that could write it would choose what the user's approval covers.
+      _pw=""
+      if ! { git_has "$CMD_SEEN" 'commit' && git_has "$CMD_SEEN" 'push'; }; then
+        _pd="${CLAUDE_PROJECT_DIR:-${_CWD:-.}}"; _pd="${_pd//\\//}"; _pd="${_pd%/}/.claude/state"
+        _json_slice "$INPUT" session_id >/dev/null; _psid="$_JS"
+        case "$_psid" in ''|*[!A-Za-z0-9._-]*) _psid="" ;; esac
+        if [ -n "$_psid" ] && mkdir -p "$_pd" 2>/dev/null; then
+          if [ "${BASH_VERSINFO[0]}" -ge 5 ] || { [ "${BASH_VERSINFO[0]}" -eq 4 ] && [ "${BASH_VERSINFO[1]}" -ge 2 ]; }; then printf -v _pn '%(%s)T' -1; else _pn="$(date +%s)"; fi
+          _po=""; _ps=""; _pt=""
+          if [ -f "$_pd/crew-approval-pending" ]; then
+            while IFS= read -r _pl || [ -n "$_pl" ]; do case "$_pl" in sid=*) _ps="${_pl#sid=}" ;; op=*) _po="${_pl#op=}" ;; ts=*) _pt="${_pl#ts=}" ;; esac; done < "$_pd/crew-approval-pending"
+          fi
+          _pw="$_aps"
+          case "$_pt" in ''|*[!0-9]*) _pt=0 ;; esac
+          if [ "$_ps" = "$_psid" ] && [ $((_pn - _pt)) -ge 0 ] && [ $((_pn - _pt)) -le 1800 ]; then
+            case "$_po:$_aps" in commit:push|push:commit|commit+push:*) _pw="commit+push" ;; esac
+          fi
+          { printf 'sid=%s\nop=%s\nts=%s\n' "$_psid" "$_pw" "$_pn" > "$_pd/crew-approval-pending"; } 2>/dev/null || _pw=""
+        fi
+      fi
       echo "ASK THE USER NOW, in their language, in this shape and with nothing after it (stage first: the approval covers what is staged at that moment):" >&2
       echo "  1. the commit message, whole, in ONE code block;" >&2
-      echo "  2. under it ONE line, the sentence in their language and the command as it is (only the user can type it):  If you approve, send only this: /crew-approve $_aps" >&2
-      echo "     Name the one the user can type for this call: /crew-approve commit, /crew-approve push, or /crew-approve commit+push when a push follows the commit." >&2
+      if [ -n "$_pw" ]; then
+        echo "  2. under it one sentence in their language (If you approve, send only this:), and then the command on a line of its own, exactly as it is:" >&2
+        echo "/crew-approve"$'\n'"     That line is the whole message, and only the user can type it. It approves what was just refused here: $_pw. (Spelled out, the user can type /crew-approve commit, push or commit+push instead.)" >&2
+      else
+        echo "  2. under it ONE line, the sentence in their language and the command as it is (only the user can type it):  If you approve, send only this: /crew-approve $_aps" >&2
+        echo "     Name the one the user can type for this call: /crew-approve commit, /crew-approve push, or /crew-approve commit+push when a push follows the commit." >&2
+      fi
       echo "Their message has to be that command alone, typed by them: a sentence such as 'go ahead and commit' is not an approval, and you cannot run the command for them. It is tied to the staged tree and HEAD, lasts 30 minutes and ends at their next message." >&2
       echo "Then run the command ALONE in its call (no cd, no pipe, nothing chained): git commit -m '…', or git push <remote> <branch>." >&2
       echo "The other ways: Shift+Tab to default/acceptEdits (this gate then asks them directly), or the command in their own terminal." >&2

package/kit/hooks/guard-schedule.sh

@@ -81,8 +81,14 @@ while IFS= read -r sv; do
   [ -n "$sv" ] || continue
   _json_unescape "$sv" >/dev/null; _crew_appr_op "$_JU"
   if [ -n "$OP" ]; then
-    echo "GUARD (§4.4): this call schedules a prompt that is an approval for a commit or a push ($OP). An approval is what the user types; a prompt a tool schedules would approve in their place, so the call is refused." >&2
-    echo "Schedule the work without it. For the approval itself, show the commit message and ask: the user can type /crew-approve $OP when they agree." >&2
+    if [ "$OP" = loosen ]; then
+      echo "GUARD (§4.4): this call schedules a prompt that lowers a model floor. Only the user can type /crew-loosen; a prompt a tool schedules would lower the floor in their place, so the call is refused." >&2
+      echo "Schedule the work without it. If a floor looks too high, say so: the user can type /crew-loosen $LO_AGENT $LO_CHANGE $LO_RISK themselves." >&2
+    else
+      echo "GUARD (§4.4): this call schedules a prompt that is an approval for a commit or a push ($OP). An approval is what the user types; a prompt a tool schedules would approve in their place, so the call is refused." >&2
+      _so=" $OP"; [ "$OP" = pending ] && _so=""
+      echo "Schedule the work without it. For the approval itself, show the commit message and ask: the user can type /crew-approve$_so when they agree." >&2
+    fi
     exit 2
   fi
 done <<< "$strs"

package/kit/hooks/guard-write.sh

@@ -387,6 +387,7 @@ block(){  # $1 = rule name for the log (must keep the `gate-file edit` prefix
 WHY_SCRIPT="This file is a gate script — rewriting it would disarm the trace/secret/approval gates."
 WHY_DISC="This file is Crewforth's discipline document — it IS the text of §4.1-§4.5, so editing it empties the rules the gates enforce."
 WHY_LINK="A parent directory of this path is a symlink and it resolves into a gate directory, so the write would land on a gate file."
+WHY_MODEL="This file is what model routing decides from: the user's rules, a class's floor, the critical paths, or the record of a call and its result. Only the user and Crewforth's own hooks write it, so a session cannot lower its own floor or erase its own failure."
 WHY_APPR="This file records the user's own approval for a commit or a push (§4.4). Only the user's message writes it, so a session cannot approve its own commit."
 WHY_GITCFG="This file holds core.hooksPath: writing it can switch the git hooks off without touching one of them. Settings go through git config, which the Bash guard reads."
 WHY_LONG="The path in this payload is longer than any filesystem accepts. It is refused rather than parsed, because parsing it is the slow path an attacker would aim at."
@@ -544,6 +545,13 @@ _is_gate(){   # 0 = gate file; sets GATE_RULE and GATE_WHY
     # Matched by name wherever it is: a linked worktree keeps its git directory elsewhere.
     */[Cc][Rr][Ee][Ww][Ff][Oo][Rr][Tt][Hh]-[Aa][Pp][Pp][Rr][Oo][Vv][Aa][Ll]|[Cc][Rr][Ee][Ww][Ff][Oo][Rr][Tt][Hh]-[Aa][Pp][Pp][Rr][Oo][Vv][Aa][Ll])
       GATE_RULE="approval-record edit (Write/Edit tools)"; GATE_WHY="$WHY_APPR"; return 0 ;;
+    # What model routing decides from (hooks/guard-agent-model.sh, hooks/agent-outcome.sh): the user's own rules,
+    # the floors raised from the record of outcomes, the list of critical paths, and the records of calls and
+    # results. A session that writes one lowers its own floor or wipes its own failure.
+    */.[Cc][Ll][Aa][Uu][Dd][Ee]/[Cc][Rr][Ee][Ww]-[Mm][Oo][Dd][Ee][Ll]-[Rr][Uu][Ll][Ee][Ss]|.[Cc][Ll][Aa][Uu][Dd][Ee]/[Cc][Rr][Ee][Ww]-[Mm][Oo][Dd][Ee][Ll]-[Rr][Uu][Ll][Ee][Ss]\
+    |*/.[Cc][Ll][Aa][Uu][Dd][Ee]/[Ss][Tt][Aa][Tt][Ee]/[Cc][Rr][Ee][Ww]-*|.[Cc][Ll][Aa][Uu][Dd][Ee]/[Ss][Tt][Aa][Tt][Ee]/[Cc][Rr][Ee][Ww]-*\
+    |*/.[Cc][Ll][Aa][Uu][Dd][Ee]/[Ss][Tt][Aa][Tt][Ee]/[Mm][Oo][Dd][Ee][Ll]-[Oo][Uu][Tt][Cc][Oo][Mm][Ee][Ss].[Tt][Ss][Vv]|.[Cc][Ll][Aa][Uu][Dd][Ee]/[Ss][Tt][Aa][Tt][Ee]/[Mm][Oo][Dd][Ee][Ll]-[Oo][Uu][Tt][Cc][Oo][Mm][Ee][Ss].[Tt][Ss][Vv])
+      GATE_RULE="gate-file edit (model routing record)"; GATE_WHY="$WHY_MODEL"; return 0 ;;
   esac
   # core.hooksPath lives in git's configuration files: the repository's (.git/config, with a linked worktree's and a
   # submodule's own) and the user's (~/.gitconfig, ~/.config/git/config). Writing one switches the git hooks off without
@@ -602,6 +610,29 @@ while case "$_anc" in */*) true ;; *) false ;; esac; do
   fi
 done
 
+# ---- model routing: an agent that is not on opus does not write to a critical path ------------------------------
+# The card a crew agent is called with can leave a file out, so the files it names are not the last word: the
+# write itself is checked. Asked only of a call that comes from inside an agent (the payload then carries agent_id;
+# measured on Claude Code 2.1.294), so the session's own writes pay one test of the payload's text and nothing else.
+# One definition of "critical path" and of "which model is this agent on": hooks/guard-agent-model.sh, sourced.
+case "$INPUT" in *'"agent_id"'*)
+  if [ "${CREW_MODEL_ROUTING:-}" != off ]; then
+    _gwm="${BASH_SOURCE%/*}"; [ "$_gwm" = "${BASH_SOURCE}" ] && _gwm=.
+    if [ -f "$_gwm/guard-agent-model.sh" ]; then
+      . "$_gwm/guard-agent-model.sh"
+      declare -F _am_write_check >/dev/null 2>&1 && _am_write_check "$INPUT" "$FP"
+      # An agent does not write the settings files either: a Bash(...) rule in permissions.allow is one of the two
+      # ways the USER allows a verify command by name, and an agent that could add one would allow its own.
+      case "${FP//\\//}" in
+        */.claude/settings.json|.claude/settings.json|*/.claude/settings.local.json|.claude/settings.local.json)
+          declare -F _am_log >/dev/null 2>&1 && _am_log "a settings file written from inside an agent"
+          echo "GUARD (agent model): an agent does not write ${FP##*/}: a permission rule there decides which verify command a hook may run, and that is the user's to give. Stop, say what you wanted to change, and end your report with confidence: low" >&2
+          exit 2 ;;
+      esac
+    fi
+  fi ;;
+esac
+
 # ---- team board: you may not start work nobody knows you started -----------------------------------------------
 # The claim lock already makes it impossible for two people to HOLD the same item — a losing claim is refused in
 # under a second, before any code exists. The hole this closes is the other one: somebody who never claims at all.

package/kit/hooks/prompt-approval.sh

@@ -358,20 +358,28 @@ _crew_appr_path(){  # $1 = a directory -> _AP: the record's path in that worktre
 
 # ---- WHICH TEXT IS AN APPROVAL: one function, asked here of the user's prompt and by guard-schedule.sh of a
 # prompt a tool is about to schedule ---------------------------------------------------------------------------
-_crew_appr_op(){  # $1 = a text, decoded -> OP: commit | push | commit+push, or "" when the text is not an approval
-  local P="$1" _k _v LC_ALL=C
-  OP=""
+_crew_appr_op(){  # $1 = a text, decoded -> OP: commit | push | commit+push | pending | loosen, or "" when the text is none
+  # `loosen` is the other thing only the user's own message does: `/crew-loosen <agent> <change> <risk>` lowers a
+  # floor that model routing raised (3.1.0). It is matched HERE so that everything that refuses to hand a session
+  # an approval (a scheduled prompt, a `claude -p` call) refuses to hand it this as well: one question, one answer.
+  local P="$1" _k _v _vr LC_ALL=C
+  OP=""; LO_AGENT=""; LO_CHANGE=""; LO_RISK=""
   P="${P//$'\r'/}"
   while :; do case "$P" in [$' \t\n']*) P="${P:1}" ;; *) break ;; esac; done
   while :; do case "$P" in *[$' \t\n']) P="${P%?}" ;; *) break ;; esac; done
-  [ "${#P}" -le 40 ] || return 0
+  [ "${#P}" -le 90 ] || return 0
+  _vr=""
   case "$P" in
     *$'\n'*) return 0 ;;
     # THE COMMAND: `/crew-approve <what>`, or `/<plugin>:crew-approve <what>` as a plugin names its commands. Measured
     # on Claude Code 2.1.284: a command the user types reaches UserPromptSubmit with `prompt` as typed, and a skill
     # the model starts with the Skill tool raises PreToolUse and PostToolUse only, never that event.
-    /*) _k="${P%%[$' \t']*}"; [ "$_k" != "$P" ] || return 0
-        _v="${P:${#_k}}"; _k="${_k#/}"; _k="@${_k##*:}" ;;      # `@`: a command, so `crew-approve: commit` as text is not one
+    # With NOTHING after it, `/crew-approve` approves what this session was last refused (3.1.0): OP is `pending`
+    # here, and the hook's own flow looks up what that is. It is an approval like the others to everything that
+    # asks this function, so a scheduled or handed-over `/crew-approve` is refused the same way.
+    /*) _k="${P%%[$' \t']*}"
+        if [ "$_k" = "$P" ]; then _k="${_k#/}"; [ "${_k##*:}" = crew-approve ] && OP=pending; return 0; fi
+        _v="${P:${#_k}}"; _vr="$_v"; _k="${_k#/}"; _k="@${_k##*:}" ;;      # `@`: a command, so `crew-approve: commit` as text is not one
     # The text form of 3.1.0's release candidates, kept: `approve: <what>` and `onay: <what>`.
     *:*) _k="${P%%:*}"; _v="${P#*:}" ;;
     *) return 0 ;;
@@ -384,6 +392,15 @@ _crew_appr_op(){  # $1 = a text, decoded -> OP: commit | push | commit+push, or
       case "$_v" in commit) OP=commit ;; push) OP=push ;; commit+push) OP=commit+push ;; esac ;;
   esac
   shopt -u nocasematch
+  # The second command is read as it is written, lower case, with exactly three words after it.
+  if [ "$_k" = "@crew-loosen" ]; then
+    local a b c d
+    IFS=$' \t' read -r a b c d <<< "$_vr"
+    [ -n "${c:-}" ] && [ -z "${d:-}" ] || return 0
+    case "$a" in crew-*) ;; *) return 0 ;; esac; case "$a$b" in *[!a-z0-9-]*) return 0 ;; esac
+    case "$c" in critical|normal) ;; *) return 0 ;; esac
+    OP=loosen; LO_AGENT="$a"; LO_CHANGE="$b"; LO_RISK="$c"
+  fi
 }
 
 [ "$_PA_LIB" = 1 ] && return 0
@@ -433,6 +450,72 @@ say(){  # $1 = for the user, $2 = for the model. Both are built from fixed text
 }
 no(){ say "Crewforth: approval NOT recorded - $1" "The user's message is an approval for $OP, but Crewforth could not record it: $1 Tell the user exactly that; the commit/push gate stays closed until they approve again."; }
 
+# ---- /crew-loosen: a floor model routing raised is lowered by the user, and by nobody else ----------------------
+# hooks/agent-outcome.sh raises a class's floor when its first try fails too often, and nothing lowers it again but
+# this. The same proof as for an approval that a person is typing into their own session: the turn is not a
+# notice or another session's message (above), the session is not a headless one, and it has a transcript already,
+# so this is not the prompt a command or a schedule started a session with. In every permission mode: this is not
+# a commit. ONE model down, ONCE for each time the floor was raised; the record of outcomes is counted afresh for
+# that class from here, so the old failures do not raise it straight back.
+if [ "$OP" = loosen ]; then
+  nol(){ say "Crewforth: floor NOT lowered - $1" "The user sent the command only the user can type /crew-loosen, for $LO_AGENT $LO_CHANGE $LO_RISK, and Crewforth did not lower anything: $1 Tell the user exactly that."; }
+  case "${CLAUDE_CODE_SESSION_ATTENDED-}" in 0) nol "this session has nobody in front of it (it was started with -p, or by a program)." ;; esac
+  _json_slice "$INPUT" transcript_path >/dev/null; _json_unescape "$_JS" >/dev/null; TP="${_JU//\\//}"
+  { [ -n "$TP" ] && [ -s "$TP" ]; } || nol "this is the first message of this session, or the session keeps no transcript."
+  _lh="${BASH_SOURCE%/*}"; [ "$_lh" = "${BASH_SOURCE}" ] && _lh=.
+  [ -f "$_lh/guard-agent-model.sh" ] || nol "model routing is not installed beside this hook."
+  [ "${CREW_MODEL_ROUTING:-}" = off ] && nol "model routing is switched off (CREW_MODEL_ROUTING=off), so no floor is in force."
+  CLAUDE_PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$CWD}"; . "$_lh/guard-agent-model.sh"
+  declare -F _am_floor_now >/dev/null 2>&1 || nol "model routing beside this hook is an older one."
+  _am_state
+  _am_floor_now "$LO_AGENT" "$LO_CHANGE" "$LO_RISK"
+  [ -n "$_AMF_TIER" ] || nol "no raised floor is on record for $LO_AGENT / $LO_CHANGE / $LO_RISK (.claude/state/crew-model-floors.auto has no line for it)."
+  [ "$_AMF_LOOSE" = 0 ] || nol "that floor was already lowered once ($_AMF_TIER to $_AMF_TO, $_AMF_LTS). It is lowered once for each time it is raised."
+  _am_rank "$_AMF_TIER"; [ "$_AMR" -ge 2 ] || nol "the floor on record is $_AMF_TIER, and there is no model below it."
+  _am_name $((_AMR-1)); LTO="$_AMN"
+  LTS="$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null)"; case "$LTS" in [0-9][0-9][0-9][0-9]-*Z) ;; *) nol "the clock could not be read." ;; esac
+  LF="$_AMS/crew-model-loosened.tsv"
+  mkdir -p "$_AMS" 2>/dev/null || nol "the state folder could not be made."
+  [ -s "$LF" ] || { printf 'ts\tagent\tchange\trisk\tfrom\tto\n' > "$LF"; } 2>/dev/null || nol "the record could not be written."
+  LFROM="$_AMF_TIER"
+  { printf '%s\t%s\t%s\t%s\t%s\t%s\n' "$LTS" "$LO_AGENT" "$LO_CHANGE" "$LO_RISK" "$LFROM" "$LTO" >> "$LF"; } 2>/dev/null || nol "the record could not be written."
+  # Said only when it is TRUE: the floor is read back the way the gate will read it. A line that was written and
+  # does not count (a clock that went backwards, a floors file that changed underneath) is not a lowering.
+  _am_floor_now "$LO_AGENT" "$LO_CHANGE" "$LO_RISK"
+  { [ "$_AMF_LOOSE" = 1 ] && [ "$_AMF_EFF" = "$LTO" ]; } || nol "the line was written but the floor read back is still ${_AMF_EFF:-$LFROM}, so it is not in force (is the clock behind the time the floor was raised, $_AMF_WHEN?)."
+  say "Crewforth: floor lowered - $LO_AGENT / $LO_CHANGE / $LO_RISK from $LFROM to $LTO. Its outcomes are counted afresh from now." \
+      "The user lowered the calibration floor of $LO_AGENT / $LO_CHANGE / $LO_RISK from $LFROM to $LTO with their own command. The card's own rules still hold (critical work on opus, no verify command on sonnet or above, the agent's floor). If the class fails its first try too often again, the floor rises again."
+fi
+
+# ---- `/crew-approve` with nothing after it: what this session was last refused ---------------------------------
+# guard-bash.sh, when it refuses a commit or a push in auto / dontAsk, writes down what it refused
+# (.claude/state/crew-approval-pending: the session, commit | push | commit+push, the second). The bare command
+# approves THAT and nothing else: the same session's, not older than 30 minutes. What is approved is therefore
+# never read from the message and never from the model: the gate wrote it, from the command it refused. From here
+# on the flow is the one a spelled-out approval takes, with every proof it asks for (the mode, a session that is
+# attended, a transcript on disk) and the same record at the end.
+BARE=0
+if [ "$OP" = pending ]; then
+  BARE=1
+  _json_slice "$INPUT" permission_mode >/dev/null
+  case "$_JS" in auto|dontAsk) ;; *) exit 0 ;; esac          # elsewhere the gate asks the user itself; nothing waits here
+  _json_slice "$INPUT" session_id >/dev/null; _bsid="$_JS"
+  _bp="${CLAUDE_PROJECT_DIR:-$CWD}"; _bp="${_bp//\\//}"; _bp="${_bp%/}/.claude/state/crew-approval-pending"
+  _bs=""; _bo=""; _bt=""
+  if [ -f "$_bp" ]; then
+    while IFS= read -r _bl || [ -n "$_bl" ]; do
+      case "$_bl" in sid=*) _bs="${_bl#sid=}" ;; op=*) _bo="${_bl#op=}" ;; ts=*) _bt="${_bl#ts=}" ;; esac
+    done < "$_bp"
+  fi
+  if [ "${BASH_VERSINFO[0]}" -ge 5 ] || { [ "${BASH_VERSINFO[0]}" -eq 4 ] && [ "${BASH_VERSINFO[1]}" -ge 2 ]; }; then printf -v _bn '%(%s)T' -1; else _bn="$(date +%s)"; fi
+  OP="a commit or a push"
+  case "$_bo" in commit|push|commit+push) ;; *) no "nothing is waiting for approval in this session: no commit or push was refused. Have the commit message shown and the commit tried first; or name it: the user can type /crew-approve commit, push or commit+push." ;; esac
+  { [ -n "$_bsid" ] && [ "$_bs" = "$_bsid" ]; } || no "what is waiting for approval was refused in another session, not this one. Nothing is approved; have it tried here first."
+  case "$_bt$_bn" in *[!0-9]*|'') no "the time of what is waiting could not be read." ;; esac
+  [ $((_bn - _bt)) -ge 0 ] && [ $((_bn - _bt)) -le 1800 ] || no "what was waiting for approval ($_bo) is more than 30 minutes old. Nothing is approved; have it tried again first."
+  OP="$_bo"                                                 # used up further down, once the approval is on record
+fi
+
 _json_slice "$INPUT" permission_mode >/dev/null; PM="$_JS"
 case "$PM" in
   auto|dontAsk) ;;
@@ -509,6 +592,9 @@ case "$TS" in ''|*[!0-9]*) no "the clock could not be read." ;; esac
 
 { printf 'v=1\nop=%s\ntree=%s\nhead=%s\nbranch=%s\nremote=%s\nurl=%s\nsid=%s\nts=%s\n' "$OP" "$TREE" "$HEAD_NOW" "$BR" "$RM" "$URL" "$SID" "$TS" > "$REC"; } 2>/dev/null \
   || no "the record could not be written in the git directory."
+# What was waiting has been approved: it is not approved a second time. Only here, after every proof and the record
+# itself: a bare command that recorded nothing (a headless session, a first message) leaves it for the user.
+[ "$BARE" = 1 ] && { : > "$_bp"; } 2>/dev/null
 
 _h="${HEAD_NOW:0:7}"; _d="${TREE:0:7}"
 # THE ADDRESS IS SHOWN TO THE USER, not only compared: a rewrite set BEFORE the approval (`url.<x>.insteadOf`) is
@@ -527,5 +613,6 @@ case "$OP" in
                HOW="Run git commit -m with the message, alone in its call (no other option than -q, -s or -v, no paths, no cd, no pipe, nothing chained; single-quote the message; §4.6 still applies), then in a separate call exactly: git push $RM $BR" ;;
 esac
 [ -n "$_u" ] && _u=" ($RM pushes to $_u)"
-say "Crewforth: approval recorded - $WHAT$_u. Valid for 30 minutes; your next message ends it." \
+_bw=""; [ "$BARE" = 1 ] && _bw="approved: $OP (what this session was refused). "
+say "Crewforth: ${_bw}approval recorded - $WHAT$_u. Valid for 30 minutes; your next message ends it." \
     "The user approved this in their own message and Crewforth recorded it: $WHAT. $HOW The approval covers what was staged and where HEAD was at that moment, in this session: if either changes it no longer applies and the user approves again. It ends in 30 minutes or at the user's next message. Force-push and the rest of §4.5 are not opened by it."

package/kit/settings.json

@@ -146,6 +146,43 @@
         ]
       }
     ],
+    "SubagentStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "shell": "bash",
+            "command": "cd \"$CLAUDE_PROJECT_DIR\" 2>/dev/null; bash .claude/hooks/agent-outcome.sh",
+            "timeout": 60
+          }
+        ]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "shell": "bash",
+            "command": "cd \"$CLAUDE_PROJECT_DIR\" 2>/dev/null; bash .claude/hooks/agent-outcome.sh",
+            "timeout": 600
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Agent|Task",
+        "hooks": [
+          {
+            "type": "command",
+            "shell": "bash",
+            "command": "cd \"$CLAUDE_PROJECT_DIR\" 2>/dev/null; bash .claude/hooks/agent-outcome.sh",
+            "timeout": 60
+          }
+        ]
+      }
+    ],
     "SessionStart": [
       {
         "matcher": "startup|resume|clear|compact|fork",
@@ -172,6 +209,12 @@
             "shell": "bash",
             "command": "cd \"$CLAUDE_PROJECT_DIR\" 2>/dev/null; bash .claude/hooks/board-sync.sh",
             "timeout": 60
+          },
+          {
+            "type": "command",
+            "shell": "bash",
+            "command": "cd \"$CLAUDE_PROJECT_DIR\" 2>/dev/null; bash .claude/hooks/agent-outcome.sh",
+            "timeout": 60
           }
         ]
       },

package/kit/skills/crew-approve/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: crew-approve
 description: Approve the commit or push Claude just showed you (auto and dontAsk modes).
-argument-hint: "[commit | push | commit+push]"
+argument-hint: "[commit | push | commit+push]  (nothing: what was just refused)"
 disable-model-invocation: true
 metadata:
   kind: command
@@ -19,6 +19,9 @@ Read the line Crewforth added to this turn and do what it says:
   `git commit -m '…'` with the message you showed (single-quoted, or from a here-document with a quoted delimiter);
   a push is `git push <remote> <branch>`. The review record of §4.6 is still required.
 - **"approval NOT recorded"**: tell the user the reason it gives, and run nothing.
+- **With no argument** the command approves what the gate last refused in this session (the line says which:
+  "approved: commit+push"); when nothing was refused, or it was more than 30 minutes ago, nothing is recorded and
+  the line says so.
 - **No such line**: the session is in a mode where the gate asks the user itself (`default`, `acceptEdits`), or
   the argument was not `commit`, `push` or `commit+push`. Say which, and in the first case run the command and let
   the gate's own prompt ask.

package/kit/skills/crew-loosen/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: crew-loosen
+description: Lower a model floor that Crewforth raised for a class of work (one model, once).
+argument-hint: "<agent> <change> <risk>"
+disable-model-invocation: true
+metadata:
+  kind: command
+---
+# /crew-loosen
+Argument: $ARGUMENTS
+
+The user typed this command. Typing it is the decision: `hooks/prompt-approval.sh` read the message itself and
+lowered the calibration floor of that class of work (agent × change × risk) by one model, in
+`.claude/state/crew-model-loosened.tsv`. Nothing in this text lowers anything, and you cannot do this for the user:
+the file is closed to you, and a prompt you schedule or hand to another session is refused.
+
+Read the line Crewforth added to this turn and say what it says:
+
+- **"floor lowered"**: tell the user from which model to which, and that the class is counted afresh: if its first
+  try fails too often again, the floor rises again.
+- **"floor NOT lowered"**: tell the user the reason it gives (no raised floor on record for that class, already
+  lowered once, the first message of a session, a headless session).
+- **No such line**: the arguments were not `<agent> <change> <risk>`: a `crew-…` agent, a kind of change from the
+  card (`feature`, `fix-known`, `test-write` …) and `critical` or `normal`. Say that, with the three as they stand
+  in `.claude/state/crew-model-floors.auto`.
+
+What this does not touch: critical work still runs on opus, work with no verify command on sonnet or above, and
+an agent's own floor stays. Only the floor that the record of outcomes raised is lowered.

package/kit/studio/server/hooks/studio-gate.sh

@@ -51,8 +51,17 @@ _field() {                                 # _field <key>  -> value on stdout
 #
 # This approves the call the viewer was shown. It does not unblock anything:
 # another hook that exits 2 still blocks, and this hook's own denials are exit 2.
+# The mode is the spool's `mode` file when there is one, and the mode the hook was configured with otherwise. The
+# file starts as the mode the session started in and changes in exactly one way: the viewer approves a plan, in
+# the panel, into acceptEdits or default (permissions.js `decide`). A session that started in plan mode could not
+# otherwise ever have an allowance said out loud, plan approved or not. The check against what the harness itself
+# reports, below, stays: a file that says `default` approves nothing while the session is still in `plan`.
 _grant() {
-  case "${CREW_GATE_MODE:-}" in
+  local gm="${CREW_GATE_MODE:-}"
+  if [ -f "$SPOOL/mode" ]; then
+    read -r gm < "$SPOOL/mode" 2>/dev/null || gm=""
+  fi
+  case "$gm" in
     acceptEdits|default) ;;
     *) exit 0 ;;
   esac
@@ -69,6 +78,57 @@ TUID="$(_field tool_use_id || true)"
 SID="$(_field session_id || true)"
 [ -n "$TOOL" ] || exit 0                   # nothing to ask about
 
+# ---- two calls the viewer is not asked about ---------------------------------
+# Silence here is not an approval. The hook says nothing, and Claude Code decides the call as it would with no
+# panel: its own mode rules and every other hook still apply.
+#
+# ToolSearch looks up a tool's definition and changes nothing. A session reaches for it before the tools it has
+# to load first, ExitPlanMode among them, and asking the viewer to allow a lookup taught them to click through.
+[ "$TOOL" = "ToolSearch" ] && exit 0
+
+# The plan file. In plan mode Claude Code writes its plan to a file of its own before it asks to leave the mode,
+# and plan mode lets it write that file and no other. The viewer could only refuse it, and a plan they have not
+# been shown yet is not something to refuse: the plan itself comes to the panel with ExitPlanMode.
+#
+# Every condition has to hold, and anything that cannot be checked is asked about as before:
+#   - the session is in plan mode, by Claude Code's own report in this call
+#   - the tool is Write (an Edit is asked about)
+#   - the file is named *.md (as written: not .MD, not "x.md/" or "x.md."), and the path has no ".." in it
+#   - the path is spelled the way this platform spells one: "\" separates directories on Windows (MSYS, Cygwin)
+#     and nowhere else, so on any other system a path with a "\" in it is asked about
+#   - the file is not a symbolic link
+#   - the directory it is in, resolved, IS Claude Code's plans directory, resolved: not a directory under it
+# The two directories are resolved by the same builtin (cd -P) and compared as it reports them, so how a path is
+# spelled (C:\… or /c/…, a link on the way) does not matter. No process is started.
+_plan_file() {
+  [ "$TOOL" = "Write" ] || return 1
+  [ "$(_field permission_mode || true)" = "plan" ] || return 1
+  local fp; fp="$(_field file_path || true)"
+  [ -n "$fp" ] || return 1
+  case "$fp" in *..*) return 1 ;; esac
+  case "$fp" in *.md) ;; *) return 1 ;; esac
+  local dir
+  case "${OSTYPE:-}" in
+    msys*|cygwin*)
+      fp="${fp//\\\\/\\}"                   # JSON writes one backslash as two
+      dir="${fp%[/\\]*}" ;;
+    *)
+      case "$fp" in *\\*) return 1 ;; esac    # not a separator here: a name with one in it is not the plan file
+      dir="${fp%/*}" ;;
+  esac
+  [ "$dir" != "$fp" ] && [ -n "$dir" ] || return 1
+  [ -L "$fp" ] && return 1
+  [ -e "$fp" ] && [ ! -f "$fp" ] && return 1
+  local plans="${CLAUDE_CONFIG_DIR:-${HOME:-}/.claude}/plans" was="$PWD" at want
+  cd -P -- "$dir" 2>/dev/null || return 1
+  at="$PWD"
+  if ! cd -P -- "$plans" 2>/dev/null; then cd -- "$was" 2>/dev/null; return 1; fi
+  want="$PWD"
+  cd -- "$was" 2>/dev/null
+  [ -n "$at" ] && [ "$at" = "$want" ]
+}
+_plan_file && exit 0
+
 # Ids become filenames; anything unexpected is refused rather than sanitised
 # into something that might escape the spool.
 case "$TUID" in
@@ -76,6 +136,21 @@ case "$TUID" in
 esac
 
 REQ="$SPOOL/req"; ANS="$SPOOL/ans"; ALWAYS="$SPOOL/always"
+
+# The two tools that need a person. Claude Code offers them in a headless session only because Studio names a
+# permission host for it (studio-host.mjs); what answers them is this hook, from what the viewer chose in the
+# panel. A question and a plan take longer to read than one command, so they wait longer before the denial.
+ASK=0
+case "$TOOL" in
+  AskUserQuestion|ExitPlanMode) ASK=1; WAIT="${CREW_GATE_WAIT_ASK:-$WAIT}" ;;
+esac
+# The hook is wired twice: once for every tool, with the harness's ordinary limit, and once for these two alone,
+# with the longer one they need. Each copy answers its own and leaves the other's at once, in silence: silence is
+# no decision, so the copy that does answer decides. With no role (a settings file from before there were two)
+# this copy answers everything.
+case "${CREW_GATE_ROLE:-}:$ASK" in
+  general:1|ask:0) exit 0 ;;
+esac
 mkdir -p "$REQ" "$ANS" "$ALWAYS" 2>/dev/null || exit 0
 
 # A tool the panel already blanket-approved for this session skips the round trip.
@@ -187,10 +262,21 @@ esac
 START=$SECONDS
 while :; do
   if [ -f "$ANS/$TUID" ]; then
-    read -r VERDICT < "$ANS/$TUID" 2>/dev/null || VERDICT=deny
+    VERDICT=deny; OUT=""
+    # Two lines at most: the verdict, and for an answered question or an approved plan the output to print.
+    { IFS= read -r VERDICT; IFS= read -r OUT; } < "$ANS/$TUID" 2>/dev/null || :
     rm -f "$ANS/$TUID" "$REQ/$TUID.json" 2>/dev/null
-    case "$VERDICT" in
-      allow|always) _grant ;;
+    case "$ASK:$VERDICT" in
+      0:allow|0:always) _grant ;;
+      # The viewer's answers, or their approval of the plan, exactly as the server wrote them: `allow` with the
+      # tool's input, which is how the hooks reference says a hook answers these two tools. Printed only for them,
+      # and only when there is something to print.
+      1:output) [ -n "$OUT" ] || { printf 'studio: the answer could not be read — denied\n' >&2; exit 2; }
+                printf '%s\n' "$OUT"; exit 0 ;;
+      # A plan approved with a change of mode. The hook cannot change the mode, so it says nothing and the
+      # permission host, which can, answers from what the viewer chose.
+      1:host) [ "$TOOL" = ExitPlanMode ] && exit 0
+              printf 'studio: denied in the panel\n' >&2; exit 2 ;;
       *) printf 'studio: denied in the panel\n' >&2; exit 2 ;;
     esac
   fi