litclaude-ai 0.3.30 → 0.3.32

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.3.32 - 2026-07-23 — bounded-authority start-work lifecycle
+
+- Added a code-owned schema-3 start-work runtime with canonical authority roots,
+  semantic grants, monotonic revisions, idempotency, lock ownership, and durable
+  ledger reconciliation.
+- Enforced active authority through Claude Code PreToolUse, exact single-use
+  UserPromptSubmit resume grants, and fail-closed forbidden release boundaries.
+- Bound root sessions, subagent lanes, Claude-owned worktrees, fenced-safe plan
+  progress, and bounded Stop continuation receipts into completion checks.
+- Kept zero-dependency CI executable without lockfile-only npm setup, made Stop
+  re-entry non-blocking with fresh normal-event progress checks, and made invalid
+  no-state resume attempts side-effect-free.
+
+## 0.3.31 - 2026-07-22 — litgoal lifecycle and visual QA hardening
+
+- Made duplicate litgoal creation byte-preserving, required explicit replacement
+  for a different active objective, and rejected completion with empty criteria.
+- Made all-pass autoloops complete and disarm durably with idempotent completion
+  receipts, repairable ledger writes, and fail-open preservation of corrupt counters.
+- Clarified visual QA backend ownership, authentication boundaries, bounded waits,
+  advisory metrics, blocked states, and observed cleanup receipts.
+
 ## 0.3.30 - 2026-07-19 — LitResearch scientific records and public-reader hardening
 
 - Added root-owned append-only claim/evidence records, bounded expansion and

package/README.md

@@ -9,7 +9,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litclaude--ai-cb3837" />
-  <img src="https://img.shields.io/badge/version-0.3.30-2ea44f" />
+  <img src="https://img.shields.io/badge/version-0.3.32-2ea44f" />
   <img src="https://img.shields.io/badge/Claude%20Code-plugin-blueviolet" />
   <img src="https://img.shields.io/badge/license-MIT-blue" />
 </p>
@@ -22,10 +22,10 @@
 > `litclaude@litclaude-ai`, so normal `claude` launches can load the
 > LitClaude skills and hooks without a long `--plugin-dir` command.
 
-This checkout is prepared as `litclaude-ai@0.3.30` for personal install
+This checkout is prepared as `litclaude-ai@0.3.32` for personal install
 convenience. The repo can remain quiet; preparing npm package metadata here does
 not imply public repo promotion, marketplace publication, or advertisement.
-Future package releases still require explicit user approval. The v0.3.30 release material strengthens LitResearch with root-owned scientific evidence records, DOI/PDF lifecycle receipts, bounded route coverage, and a connection-pinned public-source reader with inert-content and secret-redaction guarantees. The v0.3.29 release material bundles exact-source `lit-handoff` and `lit-scientific-visualization` skills with Claude-native commands, exact-bare hook invocation, visible LITBURN banners, installed-payload integrity checks, and read-only scientific dependency diagnostics. The v0.3.28 release material requires explicit leading start-work invocations so diagnostic or copied mentions remain inert. The v0.3.27 release material adds a structured, animated five-stage installer with a success or failure receipt while preserving deterministic automation output. The v0.3.26 release material adds adaptive objective-achievable planning, draft-plan review, and orchestration readiness hardening. The v0.3.25 release material aligns portable details, public-read, litgoal status JSON, and evidence wording. The v0.3.24 release material aligns auxiliary skill inventories and advisory probes. The v0.3.23
+Future package releases still require explicit user approval. The v0.3.32 release material adds the code-owned schema-3 start-work lifecycle with canonical bounded authority, explicit single-use resume grants, PreToolUse enforcement, root/subagent lane identity, progress-bound Stop continuation receipts, and fail-closed release boundaries. The v0.3.31 release material hardens litgoal creation, replacement, completion, and autoloop receipts while making visual QA browser ownership, bounded waits, blocked states, and cleanup evidence explicit. The v0.3.30 release material strengthens LitResearch with root-owned scientific evidence records, DOI/PDF lifecycle receipts, bounded route coverage, and a connection-pinned public-source reader with inert-content and secret-redaction guarantees. The v0.3.29 release material bundles exact-source `lit-handoff` and `lit-scientific-visualization` skills with Claude-native commands, exact-bare hook invocation, visible LITBURN banners, installed-payload integrity checks, and read-only scientific dependency diagnostics. The v0.3.28 release material requires explicit leading start-work invocations so diagnostic or copied mentions remain inert. The v0.3.27 release material adds a structured, animated five-stage installer with a success or failure receipt while preserving deterministic automation output. The v0.3.26 release material adds adaptive objective-achievable planning, draft-plan review, and orchestration readiness hardening. The v0.3.25 release material aligns portable details, public-read, litgoal status JSON, and evidence wording. The v0.3.24 release material aligns auxiliary skill inventories and advisory probes. The v0.3.23
 release materials inject the bundled skill bodies for bare `hyperplan`,
 `litresearch`, `lit research`, `init-deep`, and explicit `$start-work` prompt-hook routes while
 preserving the v0.3.19 adversarial planning skill, the v0.3.18 read-only `lit-recap` session recap surface, the v0.3.17 separate-worker native `/goal` launcher, the v0.3.16
@@ -131,7 +131,7 @@ directory, the normal install command works:
 
 ```bash
 cd /tmp
-npx --yes litclaude-ai@0.3.30 install
+npx --yes litclaude-ai@0.3.32 install
 ```
 
 Validate the installed plugin:
@@ -144,7 +144,7 @@ The installer also sets Claude Code's `statusLine` command to the packaged
 LitClaude HUD. A typical no-color render starts like:
 
 ```text
-[🔥LITCLAUDE v0.3.30] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
+[🔥LITCLAUDE v0.3.32] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
 ```
 
 The `↻` suffix is a compact rate-limit reset countdown. It is separated from
@@ -332,12 +332,48 @@ When a long `$start-work` run is interrupted, compacted, or resumed in a new
 terminal pane, use the continuation helper from the checkout:
 
 ```bash
-litclaude-ai start-work-next --json
+litclaude-ai start-work-next --session-id <claude-session> --json
 ```
 
 It reads `.litclaude/boulder.json` and `.litclaude/start-work/ledger.jsonl`, then prints the
-active plan, ledger path, and first unchecked top-level task. If the plan is
-complete, it returns `{"status":"idle","directive":null}`.
+active plan, ledger path, and first unchecked top-level task. Schema-3 state
+requires the owning Claude session id and otherwise fails closed to idle. If the
+plan is complete, it returns `{"status":"idle","directive":null}`.
+
+Start-work now has a code-owned schema-3 bounded-authority lifecycle:
+
+```bash
+litclaude-ai start-work init --plan plans/example-plan.md --work-id work-1 --session-id <claude-session> --grant read:"$PWD" --grant write:"$PWD" --grant execute:"$PWD" --grant test:"$PWD" --idempotency-key init-1 --json
+litclaude-ai start-work status --json
+litclaude-ai start-work progress --work-id work-1 --session-id <claude-session> --expected-revision <n> --idempotency-key progress-1 --json
+```
+
+The runtime owns monotonic revisions, nonce/PID-owned locks, strict reconciliation,
+canonical plan/worktree/authority roots, bounded state history, fenced-safe
+top-level checkbox progress, and semantic action/root grants. Null worktree is
+cwd only when cwd is authorized. A new non-forbidden authority boundary pauses
+the work; forbidden release, registry, host-config, destructive VCS, commit,
+push, publish, tag, and version-bump boundaries fail closed. Paused work cannot
+complete.
+
+Resume has no generic CLI or agent approval route. The trusted user submits exactly:
+
+```text
+/litclaude:start-work resume --work-id <id> --revision <n> --boundary-id <id> --prompt-id <id> --grant-id <id>
+```
+
+`UserPromptSubmit` validates the active Claude session, origin prompt, and exact
+pending boundary, records the single-use consumed grant durably, and injects
+bounded structured context without echoing prompt text. Official `PreToolUse`
+enforces semantic action/root grants before execution; `PostToolUse` only
+observes. Bash paths are canonicalized against their effective grant, while
+outside operands, relocation flags, and shell forms requiring speculative
+parsing are denied. Stop uses `prompt_id` and strict boolean `stop_hook_active`:
+each normal Stop event re-evaluates current plan progress and emits once for a
+new fingerprint, while host re-entry with `stop_hook_active: true` stays silent
+instead of replaying stale blocking output. Subagent hooks
+bind root-session, child-lane, and Claude-owned worktree identity; active lanes
+gate completion.
 
 For v0.2.0 workflow parity, `review-work` is the dedicated review route. It is a
 5-lane review: scope/diff verification, tests/evidence execution,
@@ -470,6 +506,7 @@ unavailable capabilities are reported as `DEGRADED` with the affected workflow.
 | `npx --yes litclaude-ai --version` | Print the packaged LitClaude version |
 | `npx --yes litclaude-ai doctor` | Validate files, Claude plugin validation, and plugin details |
 | `npx --yes litclaude-ai path` | Print the installed Claude plugin path |
+| `npx --yes litclaude-ai start-work <command> --json` | Manage schema-3 bounded-authority work state |
 | `npx --yes litclaude-ai public-read <url> --json` | Read a public source with SSRF/auth safety stops |
 | `npx --yes litclaude-ai run -- --help` | Run plain `claude` after verifying install state |
 | `npx --yes litclaude-ai update` | Reinstall the current package version |

package/README_ko-KR.md

@@ -9,7 +9,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litclaude--ai-cb3837" />
-  <img src="https://img.shields.io/badge/version-0.3.30-2ea44f" />
+  <img src="https://img.shields.io/badge/version-0.3.32-2ea44f" />
   <img src="https://img.shields.io/badge/Claude%20Code-plugin-blueviolet" />
   <img src="https://img.shields.io/badge/license-MIT-blue" />
 </p>
@@ -26,11 +26,11 @@
 > 설치되므로, 매번 긴 `--plugin-dir` 없이 일반 `claude` 실행에서
 > LitClaude skill과 hook을 불러올 수 있습니다.
 
-현재 checkout은 `litclaude-ai@0.3.30` 배포 준비용으로 정리되어 있습니다. 목적은
+현재 checkout은 `litclaude-ai@0.3.32` 배포 준비용으로 정리되어 있습니다. 목적은
 다른 PC에서도 빠르게 설치하기 위한 개인용 package metadata를 갖추는 것입니다.
 npm package metadata를 준비했다고 해서 홍보, 공개 저장소 운영, Claude
 marketplace 등록을 의미하지는 않습니다. 새 버전 배포는 항상 별도의 명시적
-승인 후에 진행합니다. v0.3.30 release material은 root-owned scientific evidence record, DOI/PDF lifecycle receipt, bounded route coverage, connection-pinned public-source reader, inert-content 및 secret-redaction 보장을 포함하는 LitResearch 강화판입니다. v0.3.29 release material은 exact-source `lit-handoff`와 `lit-scientific-visualization` skill, Claude-native command, exact-bare hook invocation, visible LITBURN banner, installed-payload integrity check, read-only scientific dependency diagnostic을 함께 포함합니다. v0.3.28 release material은 start-work 호출을 prompt 선두의 명시적 invocation으로 제한해 진단문이나 복사된 언급을 비활성 상태로 유지합니다. v0.3.27 release material은 success/failure receipt와 deterministic automation output을 갖춘 5-stage animated installer를 추가합니다. v0.3.26 release material은 adaptive objective-achievable planning, draft-plan review, orchestration readiness hardening을 추가합니다. v0.3.25 release material은 portable details, public-read, litgoal status JSON, evidence wording을 정렬합니다. v0.3.24 release material은 auxiliary skill inventory와 advisory probe를 정렬합니다. v0.3.23 release material은 bare `hyperplan`,
+승인 후에 진행합니다. v0.3.32 release material은 canonical bounded authority, single-use resume grant, PreToolUse enforcement, root/subagent lane identity, progress-bound Stop continuation receipt, fail-closed release boundary를 갖춘 code-owned schema-3 start-work lifecycle을 추가합니다. v0.3.31 release material은 litgoal 생성·교체·완료와 autoloop receipt를 강화하고 visual QA의 browser ownership, bounded wait, blocked state, cleanup evidence를 명확히 합니다. v0.3.30 release material은 root-owned scientific evidence record, DOI/PDF lifecycle receipt, bounded route coverage, connection-pinned public-source reader, inert-content 및 secret-redaction 보장을 포함하는 LitResearch 강화판입니다. v0.3.29 release material은 exact-source `lit-handoff`와 `lit-scientific-visualization` skill, Claude-native command, exact-bare hook invocation, visible LITBURN banner, installed-payload integrity check, read-only scientific dependency diagnostic을 함께 포함합니다. v0.3.28 release material은 start-work 호출을 prompt 선두의 명시적 invocation으로 제한해 진단문이나 복사된 언급을 비활성 상태로 유지합니다. v0.3.27 release material은 success/failure receipt와 deterministic automation output을 갖춘 5-stage animated installer를 추가합니다. v0.3.26 release material은 adaptive objective-achievable planning, draft-plan review, orchestration readiness hardening을 추가합니다. v0.3.25 release material은 portable details, public-read, litgoal status JSON, evidence wording을 정렬합니다. v0.3.24 release material은 auxiliary skill inventory와 advisory probe를 정렬합니다. v0.3.23 release material은 bare `hyperplan`,
 `litresearch`, `lit research`, `init-deep`, explicit `$start-work` prompt-hook route에
 bundled skill body를 주입하면서, v0.3.19 adversarial planning
 skill, v0.3.18 read-only `lit-recap` session recap surface, v0.3.17 별도 worker 기반 native `/goal`
@@ -131,7 +131,7 @@ checkout을 먼저 해석해서 `sh: litclaude-ai: command not found`로 실패
 
 ```bash
 cd /tmp
-npx --yes litclaude-ai@0.3.30 install
+npx --yes litclaude-ai@0.3.32 install
 ```
 
 설치 상태를 확인합니다.
@@ -144,7 +144,7 @@ installer는 Claude Code의 `statusLine` command도 packaged LitClaude HUD로
 설정합니다. 색상을 제거한 예시는 다음처럼 시작합니다.
 
 ```text
-[🔥LITCLAUDE v0.3.30] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
+[🔥LITCLAUDE v0.3.32] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
 ```
 
 `↻` 표시는 rate-limit reset까지 남은 시간을 짧게 보여주는 countdown입니다.
@@ -307,7 +307,7 @@ litclaude-ai workflow-check --json
 checkout에서 continuation helper를 실행합니다.
 
 ```bash
-litclaude-ai start-work-next --json
+litclaude-ai start-work-next --session-id <claude-session> --json
 ```
 
 이 명령은 `.litclaude/boulder.json`과 `.litclaude/start-work/ledger.jsonl`을 읽고 active

package/RELEASE_CHECKLIST.md

@@ -1,7 +1,12 @@
 # LitClaude Release Checklist
 
-Status: `litclaude-ai@0.3.30` is the current release candidate — root-owned
-scientific evidence records, DOI/PDF lifecycle receipts, bounded route coverage,
+Status: `litclaude-ai@0.3.32` is the current release candidate — a code-owned
+schema-3 start-work lifecycle with canonical bounded authority, single-use
+resume grants, PreToolUse enforcement, root/subagent lane identity, bounded Stop
+continuation receipts, and fail-closed release boundaries, plus guarded litgoal
+creation and replacement, durable idempotent autoloop completion, and explicit
+visual QA backend ownership, bounded waits, blocked states, and cleanup receipts,
+plus root-owned scientific evidence records, DOI/PDF lifecycle receipts, bounded route coverage,
 connection-pinned public-source reads, inert-content receipts, and deep secret
 redaction, plus bundled
 exact-source `lit-handoff` and `lit-scientific-visualization` skills with
@@ -23,9 +28,9 @@ side-effect-free, the launcher starts only a separate Claude Code
 print/background worker, and the release preserves the Korean polishing
 command, strict multi-agent review pipeline, fidelity guardrails, package
 hygiene checks, native route gates, and safe start-work handoff behavior.
-`package.json` is aligned to `0.3.30`,
-`plugins/litclaude/.claude-plugin/plugin.json` is aligned to `0.3.30`, and the
-plugin-local MCP server reports `0.3.30`.
+`package.json` is aligned to `0.3.32`,
+`plugins/litclaude/.claude-plugin/plugin.json` is aligned to `0.3.32`, and the
+plugin-local MCP server reports `0.3.32`.
 
 This release carries the v0.2.2 Dynamic workflow hardening surfaces:
 `/dynamic-workflow`, `workflow-check --json`, native `/goal` fallback guidance,
@@ -69,6 +74,28 @@ Use this track when testing from the current checkout:
 
 No npm publication is required for this track.
 
+## v0.3.32 Bounded-Authority Start-Work Gates
+
+Before requesting publication approval, confirm schema-3 state remains
+monotonic and reconciled, semantic action/root grants are canonicalized,
+forbidden release actions fail closed, and only the exact single-use
+`/litclaude:start-work resume` UserPromptSubmit route can resume paused work.
+Confirm PreToolUse denies unauthorized tools before execution, root/subagent
+lane identity gates completion, fenced examples do not count as plan progress,
+normal Stop events re-evaluate progress while `stop_hook_active: true` re-entry
+never replays a stale block, and an exact invalid no-state resume creates no
+`.litclaude` state. Confirm the zero-dependency GitHub Actions path uses neither
+lockfile-only npm caching nor a dependency-install step.
+
+## v0.3.31 Litgoal Lifecycle and Visual QA Gates
+
+Before requesting publication approval, confirm duplicate objectives remain
+byte-preserving, different active objectives require explicit replacement, and
+empty criteria cannot complete. Confirm all-pass autoloops complete and disarm
+once with repairable ledger receipts, corrupt counters remain untouched on the
+fail-open path, and visual QA uses only an owned project Playwright setup or an
+explicit current-session Chrome binding with bounded waits and observed cleanup.
+
 ## v0.3.30 LitResearch and Public Reader Gates
 
 Before requesting publication approval, confirm the installed LitResearch body
@@ -111,9 +138,9 @@ checkout and from an isolated install of the packed tarball:
 Before requesting publication approval, confirm these artifacts from the current
 checkout:
 
-- `package.json` version is `0.3.30`.
-- `plugins/litclaude/.claude-plugin/plugin.json` version is `0.3.30`.
-- `plugins/litclaude/bin/litclaude-mcp.js` reports server version `0.3.30`.
+- `package.json` version is `0.3.32`.
+- `plugins/litclaude/.claude-plugin/plugin.json` version is `0.3.32`.
+- `plugins/litclaude/bin/litclaude-mcp.js` reports server version `0.3.32`.
 - Prompt-hook tests cover bundled `SKILL.md` body injection for bare `hyperplan`, `litresearch`, `lit research`, `init-deep`, and explicit leading `$start-work`; diagnostic/copy mentions stay inert while leading natural-language `lit start work` stays BLOCKED.
 - `lit search` and `lit query` route to `/litclaude:litresearch` without activating on slash mentions, code spans, or non-lit prompts.
 - Litresearch web lanes require public API/feed preference, validator-first checks, route traces, prompt-injection quarantine, and honest auth/paywall/private-data stop reasons.
@@ -123,7 +150,7 @@ checkout:
 - `node bin/litclaude-ai.js workflow-check --json` reports `status: pass`.
 - `node bin/litclaude-ai.js workflow-check --json` reports
   `subagentReliability` and `commandHookAgreement` as true.
-- `node bin/litclaude-ai.js start-work-next --json` is available for active
+- `node bin/litclaude-ai.js start-work-next --session-id <claude-session> --json` is available for active
   `.litclaude/boulder.json` continuation state and returns idle when no task remains.
 - PostToolUse hook tests cover patch-shaped mutated-file extraction.
 - SessionStart hook tests cover context-pressure resume guidance.

package/bin/litclaude-ai.js

@@ -19,6 +19,7 @@ import { HUD_ACCENT_THEMES, normalizeHudAccent, themeForAccent } from "../plugin
 import { readPublicSource } from "../plugins/litclaude/lib/public-source-reader/reader.mjs";
 import { verifyBundledSkillsIntegrity } from "../plugins/litclaude/lib/bundled-skills-integrity.mjs";
 import { runStartWorkContinuationCli } from "../plugins/litclaude/lib/start-work-continuation.mjs";
+import { runStartWorkCli } from "../plugins/litclaude/lib/start-work-cli.mjs";
 import { runLitgoalCli } from "../plugins/litclaude/lib/litgoal/cli.mjs";
 import { runWorkflowCheckCli } from "../plugins/litclaude/lib/workflow-check.mjs";
 
@@ -26,7 +27,7 @@ const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const packageJson = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
 const version = packageJson.version;
 
-const usage = `Usage: litclaude-ai [--dry-run] <install|doctor|path|run|update|uninstall|litgoal|workflow-check|start-work-next|public-read> [...args]
+const usage = `Usage: litclaude-ai [--dry-run] <install|doctor|path|run|update|uninstall|litgoal|workflow-check|start-work|start-work-next|public-read> [...args]
        litclaude-ai --version
 
 Commands:
@@ -36,6 +37,7 @@ Commands:
   run -- ...    Run Claude Code after the global plugin install.
   litgoal       Manage litgoal runtime state and evidence.
   workflow-check Verify Dynamic workflow, /goal, and subagent delegation readiness.
+  start-work    Manage schema-3 bounded-authority lifecycle state.
   start-work-next Print the next active start-work continuation directive.
   public-read   Read a public http(s) source with FetchAttempt/FetchVerdict JSON.
   update        Reinstall this package version and refresh the Claude plugin registry.
@@ -638,6 +640,10 @@ const verifyInstalledPayload = ({ home, litClaudeHome, targetPlugin }) => {
     ".claude-plugin/plugin.json",
     "hooks/hooks.json",
     "bin/litclaude-hook.js",
+    "lib/start-work-lifecycle.mjs",
+    "lib/start-work-cli.mjs",
+    "skills/start-work/SKILL.md",
+    "commands/start-work.md",
     "bin/litclaude-scientific-visualization-doctor.js",
     "skills/lit-handoff/SKILL.md",
     "commands/lit-handoff.md",
@@ -793,6 +799,10 @@ const doctor = ({ dryRun }) => {
     "hooks/hooks.json",
     "bin/litclaude-hook.js",
     "bin/litclaude-mcp.js",
+    "lib/start-work-lifecycle.mjs",
+    "lib/start-work-cli.mjs",
+    "skills/start-work/SKILL.md",
+    "commands/start-work.md",
     "skills/lit-loop/SKILL.md",
     "skills/lit-plan/SKILL.md",
     "skills/lit-handoff/SKILL.md",
@@ -973,6 +983,9 @@ const main = async () => {
     case "start-work-next":
       process.exit(runStartWorkContinuationCli(root, parsed.rest));
       break;
+    case "start-work":
+      process.exit(runStartWorkCli(parsed.rest, undefined, process.cwd()));
+      break;
     case "uninstall":
       uninstall(parsed);
       break;

package/docs/hooks.md

@@ -10,7 +10,7 @@ contract_schema_version: litclaude.llm-contract.v1
 artifact_type: hook-doc
 surface: Claude Code plugin hooks
 runtime: plugins/litclaude/bin/litclaude-hook.js
-events: [SessionStart, UserPromptSubmit, PostToolUse, PostCompact, Stop]
+events: [SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, PostCompact, Stop, SubagentStart, SubagentStop, SessionEnd]
 verdicts: [PASS, FAIL, BLOCKED]
 ```
 
@@ -31,10 +31,13 @@ verdicts: [PASS, FAIL, BLOCKED]
 | Event or route | Contract mode | Hard boundary |
 | --- | --- | --- |
 | `SessionStart` | rules bootstrap | Adds context only; no file mutation. |
-| `UserPromptSubmit` | route classifier | Adds guidance only; never runs prompt text or slash commands. |
+| `UserPromptSubmit` | route classifier and explicit resume gate | Adds guidance; only the exact start-work resume route may mutate code-owned lifecycle state. |
+| `PreToolUse` | bounded-authority enforcement | Allows normal Claude permission handling only for classified, authorized action/root pairs; otherwise denies before execution. |
 | `PostToolUse` | post-edit reminder | Names touched paths and asks for checks; does not claim completion. |
 | `PostCompact` | context reset | Emits a compact cache reminder only. |
-| `Stop` | litgoal autoloop gate | Default-off and fail-safe; no unbounded loop. |
+| `Stop` | start-work continuation, then litgoal autoloop gate | Root-session and progress-bound; no unbounded loop. |
+| `SubagentStart` / `SubagentStop` | lane identity observation | Records the root session, child lane, and Claude-owned worktree without emitting child continuation. |
+| `SessionEnd` | root-session receipt | Records the observed end and emits no continuation. |
 
 ## #contract.procedure
 
@@ -60,7 +63,7 @@ verdicts: [PASS, FAIL, BLOCKED]
 
 - Do not echo dangerous prompt substrings, secrets, or command text into hook output.
 - Do not claim native `/goal`, Dynamic workflow, EnterWorktree, MCP, LSP, or agent-team success unless Claude Code exposes and confirms that surface.
-- Do not mutate files, ledgers, host settings, registries, or remote state from UserPromptSubmit context.
+- Do not mutate files, host settings, registries, or remote state from UserPromptSubmit. The sole ledger exception is the exact trusted start-work resume route, which mutates only code-owned schema-3 lifecycle state after identity checks.
 
 ## #contract.anti_patterns
 
@@ -75,8 +78,52 @@ verdicts: [PASS, FAIL, BLOCKED]
 | --- | --- | --- |
 | `SessionStart` | `plugins/litclaude/bin/litclaude-hook.js session-start` | Adds a compact rules-loaded context line. |
 | `UserPromptSubmit` | `plugins/litclaude/bin/litclaude-hook.js user-prompt-submit` | Detects litwork/lit prompts and injects workflow context. |
+| `PreToolUse` | `plugins/litclaude/bin/litclaude-hook.js pre-tool-use` | Enforces semantic action/root grants before Write, Edit, MultiEdit, NotebookEdit, Bash, Agent, and bounded read tools execute. |
 | `PostToolUse` | `plugins/litclaude/bin/litclaude-hook.js post-tool-use` | Reminds the session to run post-edit checks. |
 | `PostCompact` | `plugins/litclaude/bin/litclaude-hook.js post-compact` | Resets compacted rule context after summarization. |
+| `Stop` | `plugins/litclaude/bin/litclaude-hook.js stop` | Emits bounded start-work continuation on new progress, otherwise applies the opt-in litgoal autoloop gate. |
+| `SubagentStart` | `plugins/litclaude/bin/litclaude-hook.js subagent-start` | Registers child-lane and Claude-owned worktree identity. |
+| `SubagentStop` | `plugins/litclaude/bin/litclaude-hook.js subagent-stop` | Finalizes the lane without child continuation. |
+| `SessionEnd` | `plugins/litclaude/bin/litclaude-hook.js session-end` | Records root-session end without blocking Claude. |
+
+## Bounded-authority start-work lifecycle
+
+The hook and CLI share `plugins/litclaude/lib/start-work-lifecycle.mjs`.
+Schema-3 `.litclaude/boulder.json` owns active work/session identity, monotonic
+revision, canonical roots, semantic action/root grants, consumed grants,
+fenced-safe progress, bounded events/history, and terminal state. CLI mutations
+use exact idempotency keys, exclusive locks, and ledger reconciliation.
+PreToolUse Bash handling recognizes only a small command grammar: every
+permitted path operand is canonicalized and checked against the matching
+semantic grant, while relocation flags, shell syntax that would require a
+speculative parser, and unverified or outside targets are denied without
+creating an approval boundary.
+
+Resume is the only mutating `UserPromptSubmit` exception. It accepts only the
+complete prompt below, with no surrounding explanation or extra arguments:
+
+```text
+/litclaude:start-work resume --work-id <id> --revision <n> --boundary-id <id> --prompt-id <id> --grant-id <id>
+```
+
+The hook matches the owning Claude session and exact paused boundary before
+recording the grant. There is no generic CLI resume or agent-callable approval
+bypass. Returned `<litclaude-start-work-context>` JSON is bounded structured
+data and contains no raw prompt. Stop ignores subagents and stale work/revision
+events; each normal Stop re-evaluates progress, a new fingerprint emits once,
+and `stop_hook_active: true` re-entry stays silent so stale output cannot block
+again. Later unchanged turns are silent. Transcript pressure checks read only regular,
+non-symlink files at or below 256 KiB.
+Continuation receipts use the same bounded window as retained state events.
+They remain bounded audit receipts, not re-entry instructions; neither retained
+nor evicted receipts reconstructs a blocking continuation.
+
+LitClaude intentionally does not register `WorktreeCreate` or `WorktreeRemove`.
+Registering `WorktreeCreate` replaces Claude Code's native git-worktree
+implementation and obligates the hook to create and return the worktree itself.
+Instead, `SubagentStart.cwd` observes each Claude-owned worktree and binds it to
+the root session and lane; `SubagentStop` marks host removal as expected without
+pretending LitClaude owns creation or deletion.
 
 ## Workflow Trigger Phrases
 

package/docs/migration.md

@@ -95,7 +95,7 @@ agreement. Operators can verify availability with:
 litclaude-ai workflow-check --json
 ```
 
-Long `$start-work` runs can also use `litclaude-ai start-work-next --json` to
+Long `$start-work` runs can also use `litclaude-ai start-work-next --session-id <claude-session> --json` to
 recover the active plan, ledger path, and first unchecked top-level task from
 local `.litclaude` state after a compacted or interrupted session.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "litclaude-ai",
-  "version": "0.3.30",
+  "version": "0.3.32",
   "description": "Claude Code-native workflow distribution.",
   "type": "module",
   "bin": {

package/plugins/litclaude/.claude-plugin/plugin.json

@@ -1,14 +1,14 @@
 {
   "name": "litclaude",
-  "description": "Claude Code-native workflow plugin.",
-  "version": "0.3.30",
+  "description": "Claude Code-native workflow plugin with a bounded-authority start-work lifecycle.",
+  "version": "0.3.32",
   "author": {
     "name": "LitClaude contributors"
   },
   "homepage": "https://github.com/wjgoarxiv/litclaude",
   "repository": "https://github.com/wjgoarxiv/litclaude",
   "license": "MIT",
-  "keywords": ["claude-code", "hooks", "skills", "agents", "lsp", "workflow"],
+  "keywords": ["claude-code", "hooks", "skills", "agents", "lsp", "workflow", "start-work-lifecycle"],
   "skills": "./skills",
   "mcpServers": "./.mcp.json",
   "lspServers": "./.lsp.json",

package/plugins/litclaude/agents/boulder-executor.md

@@ -79,3 +79,21 @@ replace the approved plan unless evidence proves a blocker or stale state. Write
 the failing test first, make the smallest change, run verification, capture
 real-surface evidence, and report cleanup. Your DoneClaim must name changed
 files, exact tests, real-surface evidence, risks, and cleanup receipt.
+
+The code-owned start-work lifecycle is the executor's authority boundary. Read
+schema-3 `.litclaude/boulder.json`; match the active work, Claude session, and
+revision before mutation; and act only under semantic action/root grants in its
+bounded-authority envelope. The official `PreToolUse` hook classifies native
+Write/Edit/MultiEdit/NotebookEdit/Bash/Agent calls and denies forbidden, unknown, paused,
+wrong-session, or unauthorized mutations before execution; `PostToolUse` is
+observation-only. A new non-forbidden boundary is paused by that hook. Resume
+exists only through the user's exact
+`/litclaude:start-work resume --work-id <id> --revision <n> --boundary-id <id> --prompt-id <id> --grant-id <id>` UserPromptSubmit route: there is no generic resume bypass
+or agent-callable approval route, and the generated grant token is single-use.
+A paused work cannot complete, and commit, push, publish, tag,
+release, version bump, registry write, host-config write, and destructive VCS
+remain fail-closed.
+
+When Claude starts this executor as a child, `SubagentStart` binds its agent id,
+root session, and observed Claude-owned worktree. `SubagentStop` finalizes that
+lane without continuation; completion remains blocked while any lane is active.