devlyn-cli 2.10.0 → 2.10.1

package/AGENTS.md

@@ -36,7 +36,7 @@ ideate (optional)  ->  resolve  ->  ship
 
 Each skill's `SKILL.md` is the source of truth for flags and workflow. Do not duplicate.
 
-Engine roles: orchestrator = whichever CLI the user opened (this contract is symmetric with CLAUDE.md; measured status 2026-07-05: Claude Code + omp run the full phase-gated pipeline; in the iter-0061 minimal-repo trivial-add shape on this machine, Codex CLI also ran it when this AGENTS.md was present in the project (ordinary invocation, 4/4); without project AGENTS.md, the same shape silently skipped the pipeline (iter-0040 F6, 4/4). If you are Codex orchestrating `/devlyn:resolve`, the phase machinery is mandatory regardless of task size; if you will not run it, say so explicitly and stop — do not silently degrade to ad-hoc execution); executor (PLAN/IMPLEMENT/CLEANUP) defaults to `claude`, overridable per run with `--engine <name>` or durably via machine-local `.devlyn/engines.json` `{"executor": "<name>", "pair_judge_priority": ["<name>", ...]}`; pair judge = first available OTHER engine, default for VERIFY whenever available; risk probes remain conditional and --no-pair opts out. Pins fail closed (`BLOCKED:<engine>-unavailable` / `BLOCKED:invalid-engine-config`); new engines plug in by shipping `_shared/adapters/<name>.md`. `/devlyn:engines` (no args) shows the role table + detected engines; `executor <name>` / `pair <name>,...` / `clear` manage the pins. The executor pin binds the orchestrator in plain conversation too, not only inside a skill run: when you would implement directly and executor is pinned to a non-default engine, route that work through the pin — via `/devlyn:resolve` (reads it at PHASE 0) or by delegating to that engine — instead of editing as `claude`; no pin / no file → unchanged (`claude`). The pair-judge pin stays pipeline-scoped.
+Engine roles: orchestrator = whichever CLI the user opened (this contract is symmetric with CLAUDE.md; measured status 2026-07-05: Claude Code + omp run the full phase-gated pipeline; in the iter-0061 minimal-repo trivial-add shape on this machine, Codex CLI also ran it when this AGENTS.md was present in the project (ordinary invocation, 4/4); without project AGENTS.md, the same shape silently skipped the pipeline (iter-0040 F6, 4/4). If you are Codex orchestrating `/devlyn:resolve`, the phase machinery is mandatory regardless of task size; if you will not run it, say so explicitly and stop — do not silently degrade to ad-hoc execution); executor (IMPLEMENT/CLEANUP + primary VERIFY judge) defaults to `claude`, overridable per run with `--engine <name>` or durably via machine-local `.devlyn/engines.json` `{"executor": "<name>", "pair_judge_priority": ["<name>", ...]}`; PLAN is orchestrator-fixed and never inherits `--engine` or the executor pin; pair judge = first available OTHER engine, default for VERIFY whenever available; risk probes remain conditional and --no-pair opts out. Pins fail closed (`BLOCKED:<engine>-unavailable` / `BLOCKED:invalid-engine-config`); new engines plug in by shipping `_shared/adapters/<name>.md`. `/devlyn:engines` (no args) shows the role table + detected engines; `executor <name>` / `pair <name>,...` / `clear` manage the pins. The executor pin binds the orchestrator in plain conversation too, not only inside a skill run: when you would implement directly and executor is pinned to a non-default engine, route that work through the pin — via `/devlyn:resolve` (reads it at PHASE 0) or by delegating to that engine — instead of editing as `claude`; no pin / no file → unchanged (`claude`). The pair-judge pin stays pipeline-scoped.
 
 Conversational handoff + loop engineering (default entry): the orchestrating model — not the user — invokes the skills. `/devlyn:queue` fronts the intent queue (`docs/specs/queue.md`): no args = status, `add <intent>`, `drain` = serial unattended drain per the contract below. Large agreed work is written to `docs/specs/<id>/spec.md` (always a spec file — the user's reviewed contract; free-form large assumes-and-logs instead of halting, zero-scope-signal goals still halt to ideate), summarized once for user review, then run hands-free via `--spec`. Outer loop per task: findings-backed verdicts (NEEDS_WORK, verify/build-gate exhaustion) get spec amendment + re-run, max 3 iterations; infrastructure / invalid-input / engine-availability / implement-empty BLOCKED verdicts surface immediately. Unattended queue drain (`docs/specs/queue.md`, strictly serial): assumptions may only take scope-narrowing, reversible, non-user-visible defaults — material ambiguity marks the item `[F] needs-review` and the drain continues.
 

package/CLAUDE.md

@@ -40,7 +40,7 @@ Each skill's `SKILL.md` is the source of truth for its flags and workflow — do
 | Role | Default | Manual override |
 |---|---|---|
 | Orchestrator — conversation, handoff, loop driving | whichever CLI you open (contract is symmetric: CLAUDE.md ↔ AGENTS.md). Measured status 2026-07-05: Claude Code + omp run the full phase-gated pipeline; in the iter-0061 minimal-repo trivial-add shape on this machine, Codex CLI also ran it when the project carried the devlyn AGENTS.md (ordinary invocation, 4/4); without project AGENTS.md, the same shape silently skipped the pipeline (iter-0040 F6, 4/4) | switch CLIs; the file artifacts (spec/queue/state) carry over |
-| Executor — PLAN/IMPLEMENT/CLEANUP + primary VERIFY judge | `claude` | `--engine <name>` per run, or `/devlyn:engines executor <name>` (durable pin) |
+| Executor — IMPLEMENT/CLEANUP + primary VERIFY judge; PLAN is orchestrator-fixed and never inherits `--engine` or an executor pin | `claude` | `--engine <name>` per run, or `/devlyn:engines executor <name>` (durable pin) |
 | Pair judge — default for VERIFY; conditional for risk probes | first available OTHER engine (claude↔codex) | `/devlyn:engines pair <name>,...`; `--no-pair` opts out |
 
 `/devlyn:engines` with no args shows the current role table, detected engines, and how to pin or clear — the pins live in `.devlyn/engines.json`.

package/README.md

@@ -106,10 +106,10 @@ Stack tasks to run back-to-back without supervision. `/devlyn:queue add "<intent
 devlyn separates three engine roles:
 
 - **Orchestrator** — the CLI you opened (Claude Code, Codex, or omp) that drives the conversation and loop. The contract is symmetric (`CLAUDE.md` ↔ `AGENTS.md`), so the same phase-gated pipeline runs whichever you launch; the file artifacts (spec, queue, state) carry over if you switch.
-- **Executor** — PLAN / IMPLEMENT / CLEANUP plus the primary VERIFY judge. Defaults to `claude`.
+- **Executor** — IMPLEMENT / CLEANUP plus the primary VERIFY judge. Defaults to `claude`. PLAN is orchestrator-fixed and never inherits `--engine` or an executor pin.
 - **Pair judge** — the first available *other* engine, default for VERIFY and conditional for risk probes.
 
-`--engine claude` (default) is the canonical implementation surface for PLAN, IMPLEMENT, BUILD_GATE, and CLEANUP. VERIFY/JUDGE runs pair mode by default when the OTHER engine is available.
+`--engine claude` (default) is the canonical implementation surface for IMPLEMENT, BUILD_GATE, and CLEANUP; PLAN always runs on the orchestrator's native worker. VERIFY/JUDGE runs pair mode by default when the OTHER engine is available.
 
 Pin roles durably with `/devlyn:engines` (no args shows the role table + detected engines; `executor <name>` / `pair <name>,...` / `clear` manage the pins, stored machine-local in `.devlyn/engines.json`). Pins fail closed: an unavailable pinned engine stops with `BLOCKED:<engine>-unavailable`, and a name with no `_shared/adapters/<name>.md` adapter stops with `BLOCKED:invalid-engine-config`. New engines plug in by shipping an adapter file — no skill changes.
 

package/benchmark/auto-resolve/scripts/run-fixture.sh

@@ -744,8 +744,18 @@ verify = {"commands": [], "forbidden_pattern_hits": [], "deps_added": 0,
 
 for vc in expected.get("verification_commands", []):
     try:
+        timeout_sec = vc.get("timeout_sec", 60)
+        if (
+            isinstance(timeout_sec, bool)
+            or not isinstance(timeout_sec, int)
+            or not 1 <= timeout_sec <= 600
+        ):
+            raise ValueError(
+                "timeout_sec must be an integer from 1 to 600 (bool is not allowed)"
+            )
         proc = subprocess.run(vc["cmd"], cwd=work, shell=True, env=verify_env,
-                              capture_output=True, text=True, timeout=60)
+                              capture_output=True, text=True,
+                              timeout=timeout_sec)
         out = (proc.stdout or "") + (proc.stderr or "")
         ok_exit = proc.returncode == vc.get("exit_code", 0)
         ok_contains = all(s in out for s in vc.get("stdout_contains", []))

package/benchmark/auto-resolve/scripts/test-benchmark-arg-parsing.sh

@@ -5,7 +5,7 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
 TMP="$(mktemp -d)"
 BENCH_ROOT="$ROOT/benchmark/auto-resolve"
-trap 'rm -rf "$TMP"; rm -rf "$BENCH_ROOT/results/arg-parse-command-test" "$BENCH_ROOT/results/arg-parse-discovery-test" "$BENCH_ROOT/results/arg-parse-shadow-suite-dry-run" "$BENCH_ROOT/results/arg-parse-shadow-cli-suite-dry-run" "$BENCH_ROOT/results/arg-parse-variant-path" "$BENCH_ROOT/results/arg-parse-headroom-cli-replay" "$BENCH_ROOT/results/arg-parse-pair-cli-replay" "$BENCH_ROOT/results/arg-parse-shadow-judge" "$BENCH_ROOT/results/arg-parse-opus-bad-mapping" "$BENCH_ROOT/results/arg-parse-opus-malformed-mapping" "$BENCH_ROOT/results/arg-parse-opus-malformed-score" "$BENCH_ROOT/results/arg-parse-opus-invalid-generated-score" "$BENCH_ROOT/results/arg-parse-opus-invalid-generated-dq" "$BENCH_ROOT/results/arg-parse-opus-summary-mapping" "$BENCH_ROOT/results/arg-parse-opus-summary-null-margin"; rm -rf /tmp/bench-arg-parse-variant-path-* /tmp/bench-arg-parse-headroom-cli-replay-*' EXIT
+trap 'rm -rf "$TMP"; rm -rf "$BENCH_ROOT/results/arg-parse-command-test" "$BENCH_ROOT/results/arg-parse-discovery-test" "$BENCH_ROOT/results/arg-parse-shadow-suite-dry-run" "$BENCH_ROOT/results/arg-parse-shadow-cli-suite-dry-run" "$BENCH_ROOT/results/arg-parse-variant-path" "$BENCH_ROOT/results/arg-parse-timeout-budget" "$BENCH_ROOT/results/arg-parse-headroom-cli-replay" "$BENCH_ROOT/results/arg-parse-pair-cli-replay" "$BENCH_ROOT/results/arg-parse-shadow-judge" "$BENCH_ROOT/results/arg-parse-opus-bad-mapping" "$BENCH_ROOT/results/arg-parse-opus-malformed-mapping" "$BENCH_ROOT/results/arg-parse-opus-malformed-score" "$BENCH_ROOT/results/arg-parse-opus-invalid-generated-score" "$BENCH_ROOT/results/arg-parse-opus-invalid-generated-dq" "$BENCH_ROOT/results/arg-parse-opus-summary-mapping" "$BENCH_ROOT/results/arg-parse-opus-summary-null-margin" "$BENCH_ROOT/shadow-fixtures/arg-parse-timeout-budget"; rm -rf /tmp/bench-arg-parse-variant-path-* /tmp/bench-arg-parse-timeout-budget-* /tmp/bench-arg-parse-headroom-cli-replay-*' EXIT
 
 expect_fail_contains() {
   local name="$1"
@@ -849,6 +849,88 @@ if grep -Fq -- '--engine auto' \
   exit 1
 fi
 mkdir -p "$BENCH_ROOT/shadow-fixtures"
+rm -rf "$BENCH_ROOT/shadow-fixtures/arg-parse-timeout-budget" \
+  "$BENCH_ROOT/results/arg-parse-timeout-budget"
+cp -R "$BENCH_ROOT/fixtures/F1-cli-trivial-flag" \
+  "$BENCH_ROOT/shadow-fixtures/arg-parse-timeout-budget"
+python3 - "$BENCH_ROOT/shadow-fixtures/arg-parse-timeout-budget/expected.json" <<'PY'
+import json
+import pathlib
+import sys
+
+path = pathlib.Path(sys.argv[1])
+expected = json.loads(path.read_text())
+expected["verification_commands"] = [
+    {"cmd": "true"},
+    {"cmd": "true", "timeout_sec": 1},
+    {"cmd": "true", "timeout_sec": 600},
+    {"cmd": "true", "timeout_sec": True},
+    {"cmd": "true", "timeout_sec": 601},
+    {
+        "cmd": "python3 -c \"import time; time.sleep(2)\"",
+        "timeout_sec": 1,
+    },
+    {
+        "cmd": "python3 -c \"import time; time.sleep(1)\"",
+        "timeout_sec": 5,
+    },
+]
+path.write_text(json.dumps(expected, indent=2) + "\n")
+PY
+bash "$ROOT/benchmark/auto-resolve/scripts/run-fixture.sh" \
+  --fixture arg-parse-timeout-budget \
+  --arm bare \
+  --run-id arg-parse-timeout-budget \
+  --dry-run > "$TMP/timeout-budget-dry-run.out" 2>&1
+python3 - "$BENCH_ROOT/results/arg-parse-timeout-budget/arg-parse-timeout-budget/bare/verify.json" <<'PY'
+import json
+import pathlib
+import sys
+
+commands = json.loads(pathlib.Path(sys.argv[1]).read_text())["commands"]
+assert commands[0]["pass"] is True, commands
+assert commands[1]["pass"] is True, commands
+assert commands[2]["pass"] is True, commands
+expected_error = (
+    "error:ValueError:timeout_sec must be an integer from 1 to 600 "
+    "(bool is not allowed)"
+)
+assert commands[3]["pass"] is False and commands[3]["reason"] == expected_error, commands
+assert commands[4]["pass"] is False and commands[4]["reason"] == expected_error, commands
+assert commands[5]["reason"] == "timeout", commands
+assert commands[6]["pass"] is True, commands
+PY
+
+TIMEOUT_LINT_ROOT="$TMP/timeout-lint-fixtures"
+mkdir -p "$TIMEOUT_LINT_ROOT"
+cp -R "$BENCH_ROOT/fixtures/F1-cli-trivial-flag" \
+  "$TIMEOUT_LINT_ROOT/F1-cli-trivial-flag"
+python3 - "$TIMEOUT_LINT_ROOT/F1-cli-trivial-flag/expected.json" <<'PY'
+import json
+import pathlib
+import sys
+
+path = pathlib.Path(sys.argv[1])
+expected = json.loads(path.read_text())
+expected["verification_commands"][0]["timeout_sec"] = 600
+path.write_text(json.dumps(expected, indent=2) + "\n")
+PY
+DEVLYN_FIXTURES_DIR="$TIMEOUT_LINT_ROOT" DEVLYN_LINT_FIXTURES_NO_JSONSCHEMA=1 \
+  bash "$ROOT/scripts/lint-fixtures.sh" > "$TMP/timeout-lint-pass.out" 2>&1
+python3 - "$TIMEOUT_LINT_ROOT/F1-cli-trivial-flag/expected.json" <<'PY'
+import json
+import pathlib
+import sys
+
+path = pathlib.Path(sys.argv[1])
+expected = json.loads(path.read_text())
+expected["verification_commands"][0]["timeout_sec"] = True
+path.write_text(json.dumps(expected, indent=2) + "\n")
+PY
+expect_fail_contains timeout-lint-bool \
+  "timeout_sec must be an integer from 1 to 600" \
+  env DEVLYN_FIXTURES_DIR="$TIMEOUT_LINT_ROOT" DEVLYN_LINT_FIXTURES_NO_JSONSCHEMA=1 \
+    bash "$ROOT/scripts/lint-fixtures.sh"
 rm -rf "$BENCH_ROOT/shadow-fixtures/arg-parse-nan-metadata" \
   "$BENCH_ROOT/shadow-fixtures/arg-parse-nan-expected" \
   "$BENCH_ROOT/results/arg-parse-nan-metadata" \

package/bin/devlyn.js

@@ -16,6 +16,7 @@ const PKG = require('../package.json');
 // ui-*) stay Claude-core-only, matching the pre-existing Codex bundle.
 const DEVLYN_CORE_SKILLS = ['devlyn:resolve', 'devlyn:ideate', 'devlyn:design-ui', 'devlyn:engines', 'devlyn:queue', '_shared'];
 const DEVLYN_SKILL_DIR_STAMP = '__DEVLYN_SKILL_DIR__';
+const DEVLYN_INSTALL_MARKER = '.devlyn-install.json';
 
 // Cross-agent shared skills directory read by BOTH oh-my-pi and Pi. Verified
 // from the omp binary's skill-provider strings ("skills from .agents/skills —
@@ -354,6 +355,39 @@ function copyRecursive(src, dest, baseDir) {
   }
 }
 
+function clearInstallMarker(skillsDir) {
+  fs.rmSync(path.join(skillsDir, DEVLYN_INSTALL_MARKER), { force: true });
+}
+
+function assertCompleteSkillInstall(sourceSkillsDir, skillsDir, skillNames) {
+  const missing = skillNames.filter((skillName) =>
+    !fs.existsSync(path.join(sourceSkillsDir, skillName))
+      || !fs.existsSync(path.join(skillsDir, skillName)));
+  if (missing.length > 0) {
+    throw new Error(`Incomplete devlyn skill install; missing: ${missing.join(', ')}`);
+  }
+}
+
+function writeInstallMarker(skillsDir) {
+  const markerPath = path.join(skillsDir, DEVLYN_INSTALL_MARKER);
+  const tempPath = `${markerPath}.${process.pid}.tmp`;
+  const marker = {
+    schemaVersion: 1,
+    package: PKG.name,
+    version: PKG.version,
+  };
+  try {
+    fs.writeFileSync(tempPath, JSON.stringify(marker, null, 2) + '\n', {
+      encoding: 'utf8',
+      flag: 'wx',
+      mode: 0o600,
+    });
+    fs.renameSync(tempPath, markerPath);
+  } finally {
+    fs.rmSync(tempPath, { force: true });
+  }
+}
+
 function shellDoubleQuoteDefault(value) {
   if (value.includes('\n')) {
     throw new Error(`Cannot stamp skill path with newline: ${value}`);
@@ -594,10 +628,10 @@ function installSkillsForCLI(cliKey) {
   if (!cli || !cli.skillsDir || !cli.skillsToInstall) return 0;
 
   const sourceSkillsDir = path.join(CONFIG_SOURCE, 'skills');
-  if (!fs.existsSync(sourceSkillsDir)) return 0;
   if (!fs.existsSync(cli.skillsDir)) {
     fs.mkdirSync(cli.skillsDir, { recursive: true });
   }
+  clearInstallMarker(cli.skillsDir);
 
   const removed = cleanupDeprecated(path.dirname(cli.skillsDir));
   if (removed > 0) {
@@ -619,6 +653,8 @@ function installSkillsForCLI(cliKey) {
     copied++;
     log(`  → ${cli.skillsDir.replace(os.homedir(), '~')}/${skillName}`, 'dim');
   }
+  assertCompleteSkillInstall(sourceSkillsDir, cli.skillsDir, cli.skillsToInstall);
+  writeInstallMarker(cli.skillsDir);
   return copied;
 }
 
@@ -726,15 +762,20 @@ function installAgentsForAllDetected() {
 // is chosen. Behavior is unchanged from the previous unconditional core install.
 function installClaudeCore() {
   const targetDir = getTargetDir();
+  const skillsDir = path.join(targetDir, 'skills');
   log('\n📁 Installing Claude Code config to .claude/', 'green');
+  if (!fs.existsSync(skillsDir)) fs.mkdirSync(skillsDir, { recursive: true });
+  clearInstallMarker(skillsDir);
   const refreshed = cleanManagedSkillDirs(
     path.join(CONFIG_SOURCE, 'skills'),
-    path.join(targetDir, 'skills'),
+    skillsDir,
   );
   if (refreshed > 0) {
     log(`  🔄 Refreshing ${refreshed} managed skill director${refreshed === 1 ? 'y' : 'ies'}`, 'dim');
   }
   copyRecursive(CONFIG_SOURCE, targetDir, targetDir);
+  assertCompleteSkillInstall(path.join(CONFIG_SOURCE, 'skills'), skillsDir, DEVLYN_CORE_SKILLS);
+  writeInstallMarker(skillsDir);
 
   // Remove deprecated files from previous versions
   const removed = cleanupDeprecated(targetDir);
@@ -751,17 +792,21 @@ function installClaudeCore() {
     log('  → CLAUDE.md', 'dim');
   }
 
-  // Add .devlyn/ (pipeline state directory) to .gitignore
+  // Keep installer-managed pipeline state and install metadata out of git.
   const gitignorePath = path.join(process.cwd(), '.gitignore');
-  const gitignoreEntry = '.devlyn/';
+  const gitignoreEntries = ['.devlyn/', '.claude/skills/.devlyn-install.json'];
   let gitignoreContent = fs.existsSync(gitignorePath)
     ? fs.readFileSync(gitignorePath, 'utf8')
     : '';
-  if (!gitignoreContent.split('\n').some((line) => line.trim() === gitignoreEntry || line.trim() === '.devlyn')) {
+  const gitignoreLines = gitignoreContent.split('\n').map((line) => line.trim());
+  const missingGitignoreEntries = gitignoreEntries.filter((entry) =>
+    !gitignoreLines.includes(entry) && !(entry === '.devlyn/' && gitignoreLines.includes('.devlyn')));
+  if (missingGitignoreEntries.length > 0) {
     const prefix = gitignoreContent && !gitignoreContent.endsWith('\n') ? '\n' : '';
-    const header = gitignoreContent ? '\n# devlyn-cli pipeline state\n' : '# devlyn-cli pipeline state\n';
-    fs.writeFileSync(gitignorePath, gitignoreContent + prefix + header + gitignoreEntry + '\n');
-    log('  → .gitignore (added .devlyn/)', 'dim');
+    const hasManagedHeader = gitignoreLines.includes('# devlyn-cli pipeline state');
+    const header = hasManagedHeader ? '' : gitignoreContent ? '\n# devlyn-cli pipeline state\n' : '# devlyn-cli pipeline state\n';
+    fs.writeFileSync(gitignorePath, gitignoreContent + prefix + header + missingGitignoreEntries.join('\n') + '\n');
+    log(`  → .gitignore (added ${missingGitignoreEntries.join(', ')})`, 'dim');
   }
 
   // Enable agent teams in project settings

package/config/skills/_shared/adapters/grok.md

@@ -5,7 +5,7 @@
 executor: no
 pair_judge: yes
 
-Certification status: the pair-judge seat is wired, isolated, reachable, and probe-capable, but not emission-certified; P-0079-B measured 4/6, and P-0079-F failed emission because a narration preamble was welded to output line 1; a durable `pair grok` pin remains gated on follow-up emission registration and the standing seat-fitness rule.
+Certification status: the pair-judge seat is wired, reachable, and probe-capable, but not emission-certified; isolation has three independent invariants — tool callability, MCP connection/enumeration, and context injection — and only P-0080-C can certify them; the doctor cannot. Before this change, the shipped recipe connected 65 MCP tools and injected both an MCP reminder and a plugin-skills reminder into the judge's conversation; a durable `pair grok` pin remains gated on follow-up emission registration and the standing seat-fitness rule.
 
 ## Invocation
 
@@ -24,10 +24,15 @@ escalation remains a reported solo skip).
 #
 #   [skills]
 #   ignore = ["~/.agents", "~/.claude", "~/.cursor"]
+#   plus $ISO_HOME/hooks/anchor-guard.json. grok reads that file as JSON, not
+#   through a shell, so its "command" must carry an ALREADY-EXPANDED path:
+#   {"hooks":{"PreToolUse":[{"hooks":[{"type":"command",
+#     "command":"python3 /abs/path/to/_shared/grok-anchor-guard.py","timeout":10}]}]}}
 # $NEUTRAL  = empty dir outside any git repo
 # $REPO     = absolute repo root (redirects MUST be absolute — cwd is $NEUTRAL)
 cd "$NEUTRAL"
-GROK_HOME="$ISO_HOME" \
+HOME="$NEUTRAL" ZDOTDIR="$NEUTRAL" GROK_HOME="$ISO_HOME" \
+DEVLYN_PROBE_ANCHOR="<the bare anchor, derived exactly as the --allow rule below>" \
 GROK_CLAUDE_MCPS_ENABLED=false GROK_CURSOR_MCPS_ENABLED=false \
 GROK_CLAUDE_SKILLS_ENABLED=false GROK_CURSOR_SKILLS_ENABLED=false \
 GROK_CLAUDE_HOOKS_ENABLED=false GROK_CURSOR_HOOKS_ENABLED=false \
@@ -37,13 +42,18 @@ python3 "$DEVLYN_SHARED_DIR/run-bounded.py" 600 -- grok -p "<judge prompt>" \
   --permission-mode dontAsk --no-memory \
   --tools "read_file,grep,list_dir,run_terminal_cmd" \
   --disallowed-tools "Agent,use_tool,search_tool" \
-  --allow 'Bash(<repo probe command family>)' \
+  --allow 'Bash(<the bare anchor>)' \
   --reasoning-effort medium \
+  --output-format json \
   > "$REPO/.devlyn/grok-judge.stdout" 2> "$REPO/.devlyn/grok-judge.stderr"
 ```
 
 Copy `auth.json` into `$ISO_HOME` for every run and seed its `config.toml` with
-the shown `[plugins]` and `[skills] ignore` entries.
+the shown `[plugins]` and `[skills] ignore` entries and its
+`hooks/anchor-guard.json` with the shown `PreToolUse` entry. Before launch, create
+`$NEUTRAL/.zshenv` containing `export HOME=<the operator's real home>`.
+Both overrides are needed because grok scans `~/.claude.json` from `$HOME`,
+while zsh reads rc files from `$ZDOTDIR`, which is exported in some environments.
 `$NEUTRAL` and `$ISO_HOME` must be on paths that do not embed a project or repo identifier.
 `--permission-mode plan` is forbidden headless because it silently blocks
 all tools and returns an empty review; `--always-approve` is banned because it
@@ -51,8 +61,11 @@ auto-approves writes. `--tools` and `--disallowed-tools` are headless-only (the
 TUI warns and ignores them); when both are present, the disallow list wins and
 removes tools entirely rather than merely gating execution.
 
-The `--allow` rule must cover the full probe-command family the judge may need,
-and the judge prompt must name the exact permitted command(s). Derive the prompt
+Never use `--json-schema` for the pair judge: measured runs degraded the
+tool-use loop (2/3 made zero tool calls and fabricated findings), and a
+`Cancelled` run emitted a PASS-shaped payload after its schema had failed.
+
+The judge prompt must name the exact permitted command(s). Derive the prompt
 anchor and allow-list string identically from one source, in this precedence:
 the solo-headroom hypothesis's backticked observable command when present;
 otherwise the backticked commands in the spec's `## Verification` bullets;
@@ -60,17 +73,26 @@ otherwise the repo's existing test/CLI runner. If none exists, the probe
 obligation does not arise and a static review is correct for that spec.
 The documented `Bash(<command>)` form matches the exact command or its prefix;
 the trailing ` *` form fails a no-argument command.
+Under `dontAsk`, every allow shape tested for a chained command — including an
+exact full-string rule for the chain — returned `PermissionCancelled`, so the
+mandatory dominance-loss anchor must run unchained with the allow rule scoped
+to that bare anchor.
 
-Grok's deny semantics are not Claude-parity: an out-of-allowlist command silently
-truncates the review at exit 0. Treat the resulting collector rejection as
-`BLOCKED` for `verify.pair.emission-contract`, never PASS. After a non-timeout
-spawn, run:
+Grok's deny semantics are not Claude-parity: reaching the permission mode's
+auto-deny silently truncates the review at exit 0. On the configured, measured
+path the `PreToolUse` hook above keeps the judge from reaching it — the hook runs
+at step 1, before the rules and before the mode policy, and returns the denial as
+a model-visible `tool_result`.
+It admits the bare anchor and anchor-plus-argv, and vetoes any character that
+could start a second command, so `verify.md`'s bounded input variations survive
+while chaining does not. The hook fails open, so the collector rejection remains
+the fail-closed floor: treat it as `BLOCKED` for
+`verify.pair.emission-contract`, never PASS. After a non-timeout spawn, run:
 
 ```bash
 python3 "$DEVLYN_SHARED_DIR/collect-codex-findings.py" \
   --devlyn-dir "$REPO/.devlyn" \
-  --stdout-file grok-judge.stdout \
-  --summary-out grok-judge.summary.json
+  --stdout-file grok-judge.stdout
 ```
 
 On exit 124, write `.devlyn/verify.pair.timeout.json` with