harnery 0.31.5 → 0.32.0

package/src/commands/docs.ts

@@ -6,6 +6,7 @@ import {
   runFrontmatterMigration,
 } from "../lib/docs-frontmatter-migrate.ts";
 import { initDocsContext as initDocsIndex, runIndex } from "../lib/docs-index.ts";
+import { initDocsContext as initDocsLinks, runLinks } from "../lib/docs-links.ts";
 import { initDocsContext as initDocsLint, runLint } from "../lib/docs-lint.ts";
 import { readDocsMetadata, readDocsMetadataKey } from "../lib/docs-meta.ts";
 import {
@@ -27,6 +28,7 @@ function ensureContext(context: HarneryProgramContext | undefined): void {
     extraExcludedPrefixes: context.extraDocsExcludedPrefixes,
     docsRootAllowlist: context.docsRootAllowlist,
   });
+  initDocsLinks({ ...opts, extraExcludedPrefixes: context.extraDocsExcludedPrefixes });
   initDocsSweep(opts);
 }
 
@@ -115,6 +117,34 @@ export function registerDocsCommand(
       }
     });
 
+  docs
+    .command("links")
+    .description("Check internal Markdown link targets and heading fragments")
+    .option("--repo <name>", "Limit to one submodule or '.' for parent")
+    .option("--no-fragments", "Check target existence only; skip heading-fragment validation")
+    .option("--strict", "Report findings in archive/audit/changelog docs as errors, not warnings")
+    .option("--check-escapes", "Also flag links that resolve outside their own repo root")
+    .option("--fail", "Exit non-zero when errors are found (advisory by default)")
+    .option("--format <type>", "Output format: human, json", "human")
+    .action(
+      async (opts: {
+        repo?: string;
+        fragments?: boolean;
+        strict?: boolean;
+        checkEscapes?: boolean;
+        fail?: boolean;
+        format: string;
+      }) => {
+        try {
+          ensureContext(context);
+          await handleLinks(opts);
+        } catch (err: unknown) {
+          const msg = err instanceof Error ? err.message : String(err);
+          emit.error({ code: "docs_error", message: msg });
+        }
+      },
+    );
+
   docs
     .command("sweep")
     .description(
@@ -232,6 +262,32 @@ async function handleLint(opts: { fast?: boolean; repo?: string; format: string
   if (errors.length > 0) emit.setExitCode(1);
 }
 
+// --- `harn docs links` ---
+
+/**
+ * Advisory by default: a clean exit code even with findings, because turning
+ * link health into a gate is an enforcement policy decision for the host, not
+ * something this command should assume. `--fail` is the opt-in for CI or a hook.
+ */
+async function handleLinks(opts: {
+  repo?: string;
+  fragments?: boolean;
+  strict?: boolean;
+  checkEscapes?: boolean;
+  fail?: boolean;
+  format: string;
+}): Promise<void> {
+  if (opts.format === "json") emit.config({ format: "json" });
+  const report = await runLinks({
+    repo: opts.repo,
+    noFragments: opts.fragments === false,
+    strict: opts.strict,
+    checkEscapes: opts.checkEscapes,
+  });
+  emit.data({ ...report, advisory: !opts.fail });
+  if (opts.fail && report.error_count > 0) emit.setExitCode(1);
+}
+
 // --- `harn docs sweep` ---
 
 async function handleSweep(opts: { repo?: string; format: string }): Promise<void> {

package/src/commands/doctor.ts

@@ -19,7 +19,9 @@ import type { Command } from "commander";
 import type { EmitContext } from "../commander.ts";
 import { BUILTIN_ADAPTER_IDS } from "../core/adapters/index.ts";
 import { resolveBinName, ripgrepAutoInstall } from "../core/config.ts";
-import { loadAdapterWiring } from "../core/hooks/adapter/wiring.ts";
+import { ADAPTER_SPECS, type AdapterId } from "../core/hooks/adapter/events.ts";
+import { loadAdapterWiring, summarizeAdapterWiring } from "../core/hooks/adapter/wiring.ts";
+import { inspectCodexWslBridge } from "../core/hooks/codex-wsl-bridge.ts";
 import {
   ADAPTER_BINARIES,
   ADAPTER_INSTALL_HINTS,
@@ -27,6 +29,7 @@ import {
 } from "../core/workflow/adapters.ts";
 import { probeBilling } from "../core/workflow/billing.ts";
 import type { AdapterName } from "../core/workflow/types.ts";
+import { checkGitHooks, gitHooksInstalled } from "../lib/instructions/git-hooks.ts";
 import { findRg, installRg, managedRgPath, rgInstallSupported } from "../lib/tools/ripgrep.ts";
 
 type Severity = "ok" | "warn" | "fail";
@@ -97,14 +100,22 @@ export function registerDoctorCommand(program: Command, emit: EmitContext): void
 }
 
 export function runChecks(): Check[] {
+  const codexWslBridge = checkCodexWslBridge();
+  // Probe the adapter CLIs before the hook check runs, not in output order:
+  // an unwired adapter only matters if its CLI is actually installed, and
+  // probing once here keeps that join to one spawn per CLI.
+  const workflow = BUILTIN_ADAPTER_IDS.map((id) => ({ id, ...checkWorkflowAdapter(id) }));
+  const installed = workflow.filter((w) => w.installed).map((w) => w.id as AdapterId);
   return [
     checkNode(),
     checkGit(),
     checkBun(),
     checkRipgrep(),
     checkHarneryDir(),
-    checkAdapterHooks(),
-    ...BUILTIN_ADAPTER_IDS.map(checkWorkflowAdapter),
+    checkAdapterHooks(installed),
+    checkGitHookRegions(),
+    ...(codexWslBridge ? [codexWslBridge] : []),
+    ...workflow.map((w) => w.check),
     checkRestic(),
     checkRclone(),
     checkPlaywright(),
@@ -112,6 +123,49 @@ export function runChecks(): Check[] {
   ];
 }
 
+function checkGitHookRegions(): Check {
+  const root = findCoordProjectRoot();
+  if (!root) {
+    return { name: "git hooks", severity: "ok", detail: "n/a (no .harnery/ above cwd)" };
+  }
+  try {
+    if (!gitHooksInstalled(root)) {
+      const bin = resolveBinName(root);
+      return {
+        name: "git hooks",
+        severity: "warn",
+        detail:
+          `not installed - commits are not guarded against peer-claim conflicts and ` +
+          `claims never auto-release on commit/checkout; run \`${bin} init\` to install`,
+      };
+    }
+    const { status, issues } = checkGitHooks(root);
+    if (status === "fresh") {
+      return { name: "git hooks", severity: "ok", detail: "managed regions current" };
+    }
+    return { name: "git hooks", severity: "warn", detail: issues.join("; ") };
+  } catch (err) {
+    return {
+      name: "git hooks",
+      severity: "warn",
+      detail: `check failed: ${(err as Error).message}`,
+    };
+  }
+}
+
+function checkCodexWslBridge(): Check | null {
+  const status = inspectCodexWslBridge();
+  if (!status) return null;
+  return {
+    name: "codex:WSL bridge",
+    severity: status.ok ? "ok" : "warn",
+    detail: status.detail,
+    hint: status.ok
+      ? undefined
+      : "forward CODEX_THREAD_ID through WSLENV in the Codex shell environment policy, then start a fresh task",
+  };
+}
+
 function checkRipgrep(): Check {
   const found = findRg();
   if (found) {
@@ -157,26 +211,35 @@ function whichVersion(bin: string, args: string[] = ["--version"]): { ok: boolea
  * One workflow spawn target: is the adapter CLI installed, and how will its
  * headless children bill (subscription login vs API key — see billing.ts)?
  * Missing is a warn, not a fail: workflows degrade to the adapters you have.
+ *
+ * Reports `installed` alongside the check so `checkAdapterHooks` can reuse the
+ * probe instead of spawning every adapter CLI a second time.
  */
-function checkWorkflowAdapter(adapter: AdapterName): Check {
+function checkWorkflowAdapter(adapter: AdapterName): { check: Check; installed: boolean } {
   const bin = ADAPTER_BINARIES[adapter];
   const name = `workflow:${adapter}`;
   const r = whichVersion(bin);
   if (!r.ok) {
     return {
-      name,
-      severity: "warn",
-      detail: `${bin} missing (workflow --adapter ${adapter} unavailable)`,
-      hint: `${ADAPTER_INSTALL_HINTS[adapter]}  then: ${ADAPTER_LOGIN_HINTS[adapter]}`,
+      check: {
+        name,
+        severity: "warn",
+        detail: `${bin} missing (workflow --adapter ${adapter} unavailable)`,
+        hint: `${ADAPTER_INSTALL_HINTS[adapter]}  then: ${ADAPTER_LOGIN_HINTS[adapter]}`,
+      },
+      installed: false,
     };
   }
   const probe = probeBilling(adapter);
   if (probe.login === "absent" && !probe.apiKeyPresent) {
     return {
-      name,
-      severity: "warn",
-      detail: `${r.out} — installed, but no stored login or API key detected`,
-      hint: ADAPTER_LOGIN_HINTS[adapter],
+      check: {
+        name,
+        severity: "warn",
+        detail: `${r.out} — installed, but no stored login or API key detected`,
+        hint: ADAPTER_LOGIN_HINTS[adapter],
+      },
+      installed: true,
     };
   }
   const billing =
@@ -185,7 +248,7 @@ function checkWorkflowAdapter(adapter: AdapterName): Check {
         ? "billing: subscription"
         : "billing: subscription (login unverifiable, CLI is the authority)"
       : `billing: ${probe.mode} (${probe.apiKeySource})`;
-  return { name, severity: "ok", detail: `${r.out} — ${billing}` };
+  return { check: { name, severity: "ok", detail: `${r.out} — ${billing}` }, installed: true };
 }
 
 function checkNode(): Check {
@@ -331,13 +394,22 @@ function checkHarneryDir(): Check {
  * loadAdapterWiring — so a bare settings file never false-warns. The remedy is
  * always the same: re-run `<bin> init` (idempotent, additive).
  */
-function checkAdapterHooks(): Check {
+function checkAdapterHooks(installedAdapters: AdapterId[] = []): Check {
   const root = findCoordProjectRoot();
   if (!root) {
     return { name: "adapter hooks", severity: "ok", detail: "n/a (no .harnery/ above cwd)" };
   }
   const drift = loadAdapterWiring(root);
-  if (drift.length === 0) {
+  // A adapter with zero harnery hooks is only worth flagging when the project
+  // plainly uses harnery hooks (something else is wired) AND that adapter's CLI
+  // is installed. Both conditions matter: the first keeps a project that has
+  // never run init quiet, the second keeps a project that simply doesn't have
+  // Codex quiet. What's left is the case that reads as healthy but isn't — an
+  // agent can start a session through that adapter and register nothing.
+  const summary = summarizeAdapterWiring(root);
+  const unwired =
+    summary.wired.length > 0 ? summary.unwired.filter((id) => installedAdapters.includes(id)) : [];
+  if (drift.length === 0 && unwired.length === 0) {
     return { name: "adapter hooks", severity: "ok", detail: "wired + current" };
   }
   const bin = resolveBinName(root);
@@ -356,12 +428,22 @@ function checkAdapterHooks(): Check {
     }
     return `${d.settingsFile}: ${bits.join("; ")}`;
   });
+  for (const id of unwired) {
+    parts.push(`${ADAPTER_SPECS[id].settingsFile}: ${id} CLI installed, no harnery hooks wired`);
+  }
   const needsManualRepair = drift.some(
     (d) => d.parseError || d.invalidTopLevelKeys.length > 0 || d.invalidEventKeys.length > 0,
   );
-  const hint = needsManualRepair
-    ? `repair the invalid adapter settings, then run \`${bin} init\` to migrate harnery hooks`
-    : `run \`${bin} init\` to migrate the hook set (idempotent)`;
+  const wireHints = unwired.map((id) => `\`${bin} init --adapter ${id}\``);
+  let hint: string;
+  if (needsManualRepair) {
+    hint = `repair the invalid adapter settings, then run \`${bin} init\` to migrate harnery hooks`;
+  } else if (drift.length > 0) {
+    hint = `run \`${bin} init\` to migrate the hook set (idempotent)`;
+    if (wireHints.length > 0) hint += `; ${wireHints.join(" and ")} to wire the rest`;
+  } else {
+    hint = `run ${wireHints.join(" and ")} (idempotent, additive)`;
+  }
   return { name: "adapter hooks", severity: "warn", detail: parts.join("  |  "), hint };
 }
 

package/src/commands/init.ts

@@ -36,12 +36,9 @@ import {
   applyInstructions,
   checkInstructions,
 } from "../lib/instructions/apply.ts";
+import { applyGitHooks, checkGitHooks } from "../lib/instructions/git-hooks.ts";
 import { HostAddendumError } from "../lib/instructions/host-addendum.ts";
 
-// Re-exported for back-compat: callers (deinit, tests) import these names
-// from init.ts. The definitions now live in core/hooks/adapter/wiring.ts.
-export type { HookGroup, SettingsFile };
-
 // This file is src/commands/init.ts → harnery package root is two levels up.
 const HARNERY_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
 
@@ -85,15 +82,19 @@ export function registerInitCommand(program: Command, emit: EmitContext, binName
       // ── --check: read-only drift report on the block + skills ──────────────
       if (opts.check === true) {
         const { status, issues } = checkInstructions(projectRoot, { binName: bin, adapter });
+        const gitHooks = checkGitHooks(projectRoot);
+        if (gitHooks.status !== "fresh") issues.push(...gitHooks.issues);
+        const merged =
+          status === "error" ? "error" : gitHooks.status !== "fresh" ? "drift" : status;
         const head =
-          status === "fresh"
-            ? "harn init --check: instructions + skills are current"
-            : status === "drift"
+          merged === "fresh"
+            ? "harn init --check: instructions + skills + git hooks are current"
+            : merged === "drift"
               ? "harn init --check: drift found (re-run `init` to refresh)"
               : "harn init --check: error";
         const lines = issues.length ? `\n${issues.map((i) => `  ✗ ${i}`).join("\n")}` : "";
         emit.text(`${head}${lines}`);
-        emit.setExitCode(status === "fresh" ? 0 : status === "drift" ? 2 : 1);
+        emit.setExitCode(merged === "fresh" ? 0 : merged === "drift" ? 2 : 1);
         return;
       }
 
@@ -190,7 +191,14 @@ export function registerInitCommand(program: Command, emit: EmitContext, binName
       }
       actions.push(...applied.actions);
 
-      emit.text(render(projectRoot, dryRun, actions, applied.warnings));
+      // ── 4. git-hook managed regions ────────────────────────────────────────
+      // Same lifecycle contract as the instructions block: the coordination
+      // content of the consumer's git hooks is machine-owned and versioned;
+      // everything else in those files belongs to the host.
+      const gitHooks = applyGitHooks(projectRoot, { dryRun });
+      actions.push(...gitHooks.actions);
+
+      emit.text(render(projectRoot, dryRun, actions, [...applied.warnings, ...gitHooks.warnings]));
     });
 }
 

package/src/commands/tunnel.ts

@@ -76,7 +76,6 @@ interface LogsOpts {
   name?: string;
   follow?: boolean;
   gate?: boolean;
-  cloudflared?: boolean;
   provider?: boolean;
 }
 
@@ -916,7 +915,7 @@ function status(opts: StatusOpts): void {
     return;
   }
   if (states.length === 1) {
-    // Single tunnel: show the full detail block (backward-compatible).
+    // A single tunnel is clearer as a detail block than as a one-row table.
     statusDetail(states[0]);
     return;
   }
@@ -953,8 +952,7 @@ function logs(opts: LogsOpts): void {
   const name = resolveName(opts.name);
   const state = readState(name);
   const provider = state?.provider ?? "cloudflare";
-  const which =
-    opts.cloudflared || opts.provider ? providerLogFile(name, provider) : gateLogFile(name);
+  const which = opts.provider ? providerLogFile(name, provider) : gateLogFile(name);
   const path = cachePath("tunnel", which);
   if (!existsSync(path)) {
     emit.error({ code: "tunnel_no_log", message: `No log file at ${path}` });
@@ -1089,7 +1087,6 @@ export function registerTunnelCommand(
     .option("-f, --follow", "follow the log")
     .option("--gate", "tail the gate log (default)")
     .option("--provider", "tail the provider log instead")
-    .option("--cloudflared", "tail the Cloudflare provider log instead (legacy alias)")
     .action(logs);
 
   const allow = cmd

package/src/core/agents/canonical-emit.ts

@@ -78,8 +78,7 @@ export function emitCanonical(input: CanonicalEmitInput): void {
 }
 
 /**
- * Normalize the heartbeat's `platform` field (which uses snake_case
- * `claude_code`) to the canonical kebab-case Adapter type.
+ * Normalize the heartbeat's `platform` field to the canonical Adapter type.
  */
 export function normalizeAdapter(platform: string | undefined): "claude-code" | "cursor" | "codex" {
   if (platform === "cursor") return "cursor";

package/src/core/agents/cli.ts

@@ -96,23 +96,11 @@ async function handleVerdict(root: string): Promise<number> {
   } else if (parsed.rule === "claim") {
     const { evaluateClaim } = await import("./rules/claim-conflict.ts");
     verdict = evaluateClaim(root, parsed as unknown as Parameters<typeof evaluateClaim>[1]);
-  } else if (parsed.rule === "commit") {
-    const { evaluateCommit } = await import("./rules/commit-conflict.ts");
-    const result = evaluateCommit(root, parsed as unknown as Parameters<typeof evaluateCommit>[1]);
-    // Map CommitVerdictResult → the standard verdict envelope, stash details
-    // on extra fields so the bash caller can pull conflicts + log_lines.
-    verdict = {
-      allow: result.allow,
-      exit_code: result.exit_code,
-      rule: result.rule,
-      reason: result.message,
-      // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
-    } as typeof verdict;
-    (verdict as Record<string, unknown>).conflicts = result.conflicts;
-    (verdict as Record<string, unknown>).log_lines = result.log_lines;
-    (verdict as Record<string, unknown>).suppressed_self_attribution =
-      result.suppressed_self_attribution ?? false;
   } else {
+    // NB: rule === "commit" was served here until 2026-08-09; the commit
+    // guard now enters through `git-hook pre-commit`, which runs the same
+    // evaluateCommit in-process. A straggler host lands in this fail-open
+    // branch, which is the pre-migration behavior for a malformed request.
     verdict = {
       allow: true,
       exit_code: 0,
@@ -261,14 +249,6 @@ async function handleStateAction(root: string, action: string, rest: string[]):
       );
       return 0;
     }
-    case "stamp-status-call": {
-      const hb = writer.stampStatusCheck(root, owner);
-      if (!hb) return 1;
-      process.stdout.write(
-        `${JSON.stringify({ instance_id: owner, last_status_at: hb.last_status_at })}\n`,
-      );
-      return 0;
-    }
     case "set-turn-summary": {
       const summary = args.join(" ");
       const hb = writer.setTurnSummary(root, owner, summary);
@@ -344,10 +324,20 @@ async function handleStateAction(root: string, action: string, rest: string[]):
       // fragility. Positionals (sessionId, model) stay as-is once flags are
       // filtered out.
       const adapter = args.find((a) => a.startsWith("--adapter="))?.slice("--adapter=".length);
+      const forkedFrom = args
+        .find((a) => a.startsWith("--forked-from="))
+        ?.slice("--forked-from=".length);
       const positional = args.filter((a) => !a.startsWith("--"));
       const sessionId = positional[0];
       const model = positional[1];
-      const hb = writer.healHeartbeat(root, owner, sessionId, model, adapter);
+      const hb = writer.healHeartbeat(
+        root,
+        owner,
+        sessionId,
+        model,
+        adapter,
+        forkedFrom ? { forkedFrom } : undefined,
+      );
       process.stdout.write(`${JSON.stringify({ instance_id: owner, recreated: !!hb })}\n`);
       return hb ? 0 : 1;
     }
@@ -497,69 +487,39 @@ async function handleCouncilAction(root: string, action: string, rest: string[])
 
 async function handleAssignName(root: string, rest: string[]): Promise<number> {
   const { assignName } = await import("./state/names.ts");
-  const [owner, kindArg] = rest;
+  // Optional recorded-fork-lineage flag: --forked-from <parent_instance_id>.
+  // Supplied by an adapter layer that knows (or detected) that this session
+  // was branched from another conversation. Inert on resume: assignName only
+  // stamps lineage on the row that first assigns the instance.
+  let forkedFrom: string | undefined;
+  const positional: string[] = [];
+  for (let i = 0; i < rest.length; i++) {
+    if (rest[i] === "--forked-from") {
+      forkedFrom = rest[++i];
+      continue;
+    }
+    positional.push(rest[i]!);
+  }
+  const [owner, kindArg] = positional;
   if (!owner || !kindArg) {
-    process.stderr.write("agent-coord assign-name <instance_id> <session|subagent|transient>\n");
+    process.stderr.write(
+      "agent-coord assign-name <instance_id> <session|subagent|transient> [--forked-from <instance_id>]\n",
+    );
     return 2;
   }
   if (kindArg !== "session" && kindArg !== "subagent" && kindArg !== "transient") {
     process.stderr.write(`agent-coord assign-name: invalid kind ${kindArg}\n`);
     return 2;
   }
-  const name = assignName(root, owner, kindArg);
-  process.stdout.write(`${JSON.stringify({ instance_id: owner, name, kind: kindArg })}\n`);
-  return 0;
-}
-
-async function handlePostCommit(root: string): Promise<number> {
-  const raw = await readStdin();
-  let req: { owner?: string; prune?: string[] } = {};
-  try {
-    req = JSON.parse(raw);
-  } catch {
-    return 0;
-  }
-  const { groupUnclaim } = await import("./state/heartbeat-writer.ts");
-
-  // Session-group-wide unclaim. `owner` is the parent's session_id which is
-  // also the group key (parent + subagents share session_id). Each actual
-  // removal also emits a durable claim.release event — the projector rebuilds
-  // files_touched from the permanent Edit/Write events, so a file-only prune
-  // would resurrect on the next replay.
-  if (req.owner && Array.isArray(req.prune)) {
-    for (const path of req.prune) {
-      try {
-        for (const hit of groupUnclaim(root, req.owner, path)) {
-          await emitClaimRelease(root, hit.instance_id, hit, path, "commit");
-        }
-      } catch {
-        /* best-effort */
-      }
-    }
-  }
-  return 0;
-}
-
-async function handlePostCheckout(root: string, _rest: string[]): Promise<number> {
-  const raw = await readStdin();
-  let req: { owner?: string; removed?: string[] } = {};
-  try {
-    req = JSON.parse(raw);
-  } catch {
-    return 0;
-  }
-  const { groupUnclaim } = await import("./state/heartbeat-writer.ts");
-  if (req.owner && Array.isArray(req.removed)) {
-    for (const path of req.removed) {
-      try {
-        for (const hit of groupUnclaim(root, req.owner, path)) {
-          await emitClaimRelease(root, hit.instance_id, hit, path, "checkout");
-        }
-      } catch {
-        /* best-effort */
-      }
-    }
-  }
+  const name = assignName(root, owner, kindArg, forkedFrom ? { forkedFrom } : undefined);
+  process.stdout.write(
+    `${JSON.stringify({
+      instance_id: owner,
+      name,
+      kind: kindArg,
+      ...(forkedFrom ? { forked_from: forkedFrom } : {}),
+    })}\n`,
+  );
   return 0;
 }
 
@@ -841,6 +801,100 @@ async function handleEmitEvent(root: string, rest: string[]): Promise<number> {
   return 0;
 }
 
+/**
+ * `agent-coord git-hook <event> [args]` — the single entry a host git hook
+ * invokes. Owns ALL of the coordination git plumbing that hosts used to carry
+ * as bash (staged/committed/checkout-removed collection, submodule
+ * canonicalization, gitlink probe, verdict, claim pruning), so a harnery
+ * upgrade upgrades hook behavior with no change to the host's hook file.
+ *
+ * Events: pre-commit (E-guard verdict; exit 1 blocks the commit),
+ * post-commit (prune committed paths' claims), post-checkout <old> <new>
+ * (release claims on paths the ref move rewrote).
+ *
+ * Fail-open by design: an internal error never blocks a commit (parity with
+ * the bash era, where a crashed verdict read as empty and the hook moved on).
+ * A clean conflict verdict still blocks.
+ */
+async function handleGitHook(fallbackRoot: string, rest: string[]): Promise<number> {
+  const event = rest[0];
+  if (process.env.HARNERY_AGENT_COORD_OFF === "1") return 0;
+  const cwd = process.cwd();
+
+  try {
+    const gh = await import("./git-hook.ts");
+    // Pin the coord root to the superproject: a submodule cwd may carry its
+    // own config-only .harnery that the generic root walk would land on.
+    const root = gh.discoverCoordRoot(cwd) ?? fallbackRoot;
+
+    if (event === "pre-commit") {
+      const { staged, gitlinks } = gh.collectStaged(cwd);
+      if (staged.length === 0) return 0;
+      const { evaluateCommit } = await import("./rules/commit-conflict.ts");
+      const result = evaluateCommit(root, {
+        staged_paths: staged,
+        staged_gitlinks: gitlinks,
+        bypass: process.env.HARNERY_AGENT_COORD_BYPASS === "1",
+      });
+      // Forensics channel shared with the stdin `verdict` path.
+      try {
+        const logPath = join(root, ".harnery", "debug", "agent-coord-verdict.ndjson");
+        await mkdir(dirname(logPath), { recursive: true });
+        await appendFile(
+          logPath,
+          `${JSON.stringify({ ts: new Date().toISOString(), via: "git-hook", staged, verdict: result })}\n`,
+        );
+      } catch {
+        /* diagnostics never break a verdict */
+      }
+      if (result.rule !== "commit.pass") {
+        if (result.message) process.stdout.write(`\n${result.message}\n\n`);
+        for (const c of result.conflicts) {
+          process.stdout.write(`    ${c.staged_path}  (held by ${c.short_name})\n`);
+        }
+        process.stdout.write("\n");
+      }
+      if (!result.allow) {
+        process.stdout.write(
+          "  Wait for them to finish, split the commit, or set\n" +
+            "  HARNERY_AGENT_COORD_BYPASS=1 to force this commit through.\n\n",
+        );
+        return result.exit_code || 1;
+      }
+      return 0;
+    }
+
+    if (event === "post-commit" || event === "post-checkout") {
+      const paths =
+        event === "post-commit"
+          ? gh.collectCommitted(cwd)
+          : gh.collectCheckoutRemoved(cwd, rest[1] ?? "", rest[2] ?? "");
+      if (paths.length === 0) return 0;
+      const { resolveOwner } = await import("../hooks/resolve/owner.ts");
+      const owner = resolveOwner({ payload: null, coordRoot: root })?.instance_id;
+      if (!owner) return 0;
+      const { groupUnclaim } = await import("./state/heartbeat-writer.ts");
+      const reason = event === "post-commit" ? ("commit" as const) : ("checkout" as const);
+      for (const path of paths) {
+        try {
+          for (const hit of groupUnclaim(root, owner, path)) {
+            await emitClaimRelease(root, hit.instance_id, hit, path, reason);
+          }
+        } catch {
+          /* best-effort */
+        }
+      }
+      return 0;
+    }
+
+    process.stderr.write(`agent-coord git-hook: unknown event ${event ?? "(none)"}\n`);
+    return 0;
+  } catch {
+    // Fail open: coordination must never brick git.
+    return 0;
+  }
+}
+
 async function main(): Promise<number> {
   const [subcommand, ...rest] = process.argv.slice(2);
   const root = findCoordRoot(process.cwd());
@@ -860,7 +914,6 @@ async function main(): Promise<number> {
 
   if (
     subcommand === "set-task" ||
-    subcommand === "stamp-status-call" ||
     subcommand === "set-turn-summary" ||
     subcommand === "release-claim" ||
     subcommand === "kill-heartbeat" ||
@@ -918,12 +971,8 @@ async function main(): Promise<number> {
     return handleShellMutationClaimLog(root, rest);
   }
 
-  if (subcommand === "post-commit") {
-    return handlePostCommit(root);
-  }
-
-  if (subcommand === "post-checkout") {
-    return handlePostCheckout(root, rest);
+  if (subcommand === "git-hook") {
+    return handleGitHook(root, rest);
   }
 
   await logNoop(root, subcommand ?? "(none)", rest);