luciazero 2.5.0 → 2.6.0

package/claude/hooks/luciazero-verify.sh

@@ -5,7 +5,8 @@
 # ("done is proven by a command") at the exact moment it is most violated.
 #
 # Subcommands (wired in settings.json):
-#   prompt  — UserPromptSubmit: start privacy-preserving turn telemetry
+#   prompt  — UserPromptSubmit: start privacy-preserving turn telemetry (a
+#             prompt inside an open turn is a background-task notice: kept)
 #   bash-start — PreToolUse on Bash: start shell-command timing
 #   edit    — PostToolUse on Edit|Write|NotebookEdit : record "an edit happened"
 #   bash    — PostToolUse on Bash: record duration, verify runs, and status
@@ -28,14 +29,17 @@
 # A blocked stop's continuation is never re-blocked (stop_hook_active),
 # so this is a speed bump with evidence attached, not a wall.
 #
-# Requires python3 (for JSON parsing). FAILS OPEN: any internal error exits 0,
+# Requires python3 (one run per event: JSON fields, hashes, the settings scan).
+# FAILS OPEN: any internal error exits 0,
 # so a broken hook can never block real work. Per-project state lives under
 # $TMPDIR and never touches the repo. One exception, documented honestly: the
 # stop hook appends one schema-versioned JSON line per stop outcome
 # (stop-clean / nudge / strict-block) to luciazero-stats.log in the harness
 # config dir — local only, capped at ~250 lines, fail-open. It records a
-# privacy-preserving project hash, verify mode, and aggregate latency/counts;
-# never the project path, command, or skill name. Uninstall keeps it.
+# privacy-preserving project hash, verify mode, and aggregate latency/counts —
+# including how long verify commands ran and how many came back green with no
+# edit since the previous green (schema 3) — never the project path, command,
+# or skill name. Uninstall keeps it.
 set -u
 
 MODE="${1:-}"
@@ -63,20 +67,6 @@ hook_path() { # canonical path of $1; empty when its directory does not exist
 # do not hang waiting for EOF that never comes.
 if [ -t 0 ]; then IN=""; else IN="$(cat 2>/dev/null || true)"; fi
 
-pyfield() { # pyfield '<python expr over dict d>' — empty string on any error
-  printf '%s' "${IN}" | python3 -c "
-import json, sys
-try:
-    d = json.load(sys.stdin)
-    v = ${1}
-    print('' if v is None else v)
-except Exception:
-    print('')" 2>/dev/null || true
-}
-
-CWD="$(pyfield "d.get('cwd')")"
-[ -n "${CWD}" ] || CWD="${PWD}"
-
 # A repository's COMMITTED .claude/settings.json can put anything in its `env`
 # block, and that env reaches this hook — so NO LUCIAZERO_* knob is accepted
 # from that scope. Each one is a way to disable enforcement while the
@@ -97,10 +87,19 @@ CWD="$(pyfield "d.get('cwd')")"
 # Refusal only ever falls back to this file's own defaults, never to a block,
 # and a parse error leaves the configured values untouched. Only the modes that
 # consume a knob pay for the lookup.
-# The scanner program lives in a variable, not a here-document inside
-# $( ): bash 3.2 (still the /bin/bash on macOS) cannot parse that
-# combination and fails the whole file at load time.
-REFUSED_SCAN_PY='import json, os, stat, sys
+#
+# The scan runs inside the ONE python3 program this hook starts per event.
+# Every field derived from stdin — cwd, the state key, session and tool keys,
+# the command and its digest, the tool status, the relay age — comes out of
+# this program as one value per line in a fixed order, the (possibly
+# multi-line) Bash command last. A python3 start costs ~40 ms; one field per
+# process spent 5–9 of them on every tool call. Any error leaves a field
+# empty, and an empty state key fails the hook open below.
+# The program lives in a variable, not a here-document inside $( ): bash 3.2
+# (still the /bin/bash on macOS) cannot parse that combination and fails the
+# whole file at load time.
+PRELUDE_PY='import hashlib, json, os, stat, sys, time
+ppid, mode = sys.argv[1], sys.argv[2]
 LIMIT = 1000000    # a settings file is kilobytes; this runs on every tool call
 MAX_DEPTH = 40     # ancestor walk is bounded, never unbounded I/O
 
@@ -135,63 +134,139 @@ def real(path):
     except OSError:
         return path
 
-home = real(os.path.expanduser("~"))
-# Only the DEFAULT config directory counts as user scope. CLAUDE_CONFIG_DIR is
-# attacker-reachable: pointed at the project itself, it would mark the
-# repository settings file as user scope and skip the very file that declares
-# it, and the dedupe below would then trust a classic install inside the repo.
-user_config = real(os.path.join(home, ".claude"))
-project_dir = os.environ.get("CLAUDE_PROJECT_DIR")
-project_dir = real(project_dir) if project_dir else None
+def refused_keys(start):
+    home = real(os.path.expanduser("~"))
+    # Only the DEFAULT config directory counts as user scope. CLAUDE_CONFIG_DIR
+    # is attacker-reachable: pointed at the project itself, it would mark the
+    # repository settings file as user scope and skip the very file that
+    # declares it, and the dedupe below would then trust a classic install
+    # inside the repo.
+    user_config = real(os.path.join(home, ".claude"))
+    project_dir = os.environ.get("CLAUDE_PROJECT_DIR")
+    project_dir = real(project_dir) if project_dir else None
+    found, seen = [], set()
+    directory = real(start or ".")
+    for _ in range(MAX_DEPTH):
+        claude_dir = os.path.join(directory, ".claude")
+        if directory != home and real(claude_dir) != user_config:
+            for key in keys_in(os.path.join(claude_dir, "settings.json")):
+                if key not in seen:
+                    seen.add(key)
+                    found.append(key)
+        if directory == home:
+            break
+        if os.path.exists(os.path.join(directory, ".git")):
+            break  # repository root: project scope ends here
+        if project_dir is not None and directory == project_dir:
+            break
+        parent = os.path.dirname(directory)
+        if parent == directory:
+            break
+        directory = parent
+    return found
+
+json_ok = "no"
+try:
+    d = json.load(sys.stdin)
+    json_ok = "yes"
+except Exception:
+    d = None
+
+def field(*path):
+    # the value at d[path...] as text; empty on any missing or mis-shaped level
+    v = d
+    try:
+        for p in path:
+            v = v.get(p)
+        return "" if v is None else str(v).rstrip("\n")
+    except Exception:
+        return ""
+
+def digest(v, size):
+    return hashlib.sha256(v.encode("utf-8", "replace")).hexdigest()[:size]
 
-found, seen = [], set()
-directory = real(sys.argv[1] or ".")
-for _ in range(MAX_DEPTH):
-    claude_dir = os.path.join(directory, ".claude")
-    if directory != home and real(claude_dir) != user_config:
-        for key in keys_in(os.path.join(claude_dir, "settings.json")):
-            if key not in seen:
-                seen.add(key)
-                found.append(key)
-    if directory == home:
-        break
-    if os.path.exists(os.path.join(directory, ".git")):
-        break  # repository root: project scope ends here
-    if project_dir is not None and directory == project_dir:
-        break
-    parent = os.path.dirname(directory)
-    if parent == directory:
-        break
-    directory = parent
-print("\n".join(found))
+cwd = field("cwd") or os.environ.get("PWD") or os.getcwd()
+# md5 here names a state directory; it is never a security decision. Saying so
+# explicitly keeps the hook alive on a FIPS-enforcing python3, where a bare
+# md5() call raises and the tracker would fail open (silently doing nothing).
+key = hashlib.md5(cwd.encode("utf-8", "replace"), usedforsecurity=False).hexdigest()[:12]
+session = field("session_id") or "parent-" + ppid
+# stable opaque tool key; raw tool input never leaves temporary state
+raw = (field("tool_use_id") or field("tool_input", "command") or field("tool_input", "skill")
+       or field("command_name") or field("prompt") or field("command") or "unknown")
+cmd = field("tool_input", "command")
+# best-effort red/green from the tool response. The Bash response of Claude
+# Code carries no exit code (stdout, stderr, interrupted, isImage): PostToolUse
+# only fires for a command that finished with exit 0, a non-zero exit reaches
+# PostToolUseFailure (mode bash-failure) instead, so a completed, uninterrupted
+# response in mode bash is a green. An explicit exit code still wins.
+try:
+    r = d.get("tool_response") or {}
+    c = r.get("exit_code", r.get("exitCode"))
+    if isinstance(c, int) and not isinstance(c, bool):
+        status = "ok" if c == 0 else "fail"
+    elif r.get("is_error") is True:
+        status = "fail"
+    elif r.get("interrupted") is True:
+        status = "ran"
+    else:
+        status = "ok" if mode == "bash" else "ran"
+except Exception:
+    status = ""
+refused = refused_keys(cwd) if mode in ("edit", "bash", "bash-failure", "stop", "session") else []
+age = ""
+if mode == "session":
+    try:
+        age = str(int((time.time() - os.path.getmtime(os.path.join(cwd, "LUCIA_RELAY.json"))) // 86400))
+    except OSError:
+        pass
+tool_input = d.get("tool_input")
+fp_state = ("missing" if not isinstance(tool_input, dict) or "file_path" not in tool_input
+            else "empty" if tool_input["file_path"] in ("", None) else "present")
+lines = [cwd, key, digest(session, 16), digest(raw, 16), str(int(time.time() * 1000)),
+         " ".join(refused), field("tool_input", "file_path"), field("expansion_type"),
+         field("stop_hook_active"), status, json_ok, digest(cmd, 64) if cmd else "", age,
+         field("source"), field("tool_name"), fp_state]
+sys.stdout.write("\n".join(v.replace("\n", " ") for v in lines) + "\n" + cmd)
 '
-REFUSED_ENV_KEYS=""
-case "${MODE}" in
-  edit|bash|bash-failure|stop|session)
-    REFUSED_ENV_KEYS="$(printf '%s' "${REFUSED_SCAN_PY}" \
-      | python3 - "${CWD}" 2>/dev/null || true)"
-    ;;
-esac
+PRE="$(printf '%s' "${IN}" | python3 -c "${PRELUDE_PY}" "${PPID}" "${MODE}" 2>/dev/null || true)"
+{
+  IFS= read -r CWD
+  IFS= read -r KEY
+  IFS= read -r SESSION_KEY
+  IFS= read -r TK
+  IFS= read -r NOW_MS
+  IFS= read -r REFUSED_ENV_KEYS
+  IFS= read -r FP
+  IFS= read -r EXPANSION_TYPE
+  IFS= read -r ACTIVE
+  IFS= read -r STATUS
+  IFS= read -r JSON_OK
+  IFS= read -r CMD_HASH
+  IFS= read -r RELAY_AGE
+  IFS= read -r SESSION_SOURCE
+  IFS= read -r TOOL_NAME
+  IFS= read -r FP_STATE
+  CMD="$(cat)"
+} <<EOF
+${PRE}
+EOF
+[ -n "${CWD}" ] || CWD="${PWD}"
 if [ -n "${REFUSED_ENV_KEYS}" ]; then
   # `LUCIAZERO_*` is the oversized-file marker: drop every knob this hook reads
   case "${REFUSED_ENV_KEYS}" in
     *'LUCIAZERO_*'*)
-      REFUSED_ENV_KEYS='LUCIAZERO_VERIFY_CMD
-LUCIAZERO_VERIFY_REGEX
-LUCIAZERO_DOC_REGEX
-LUCIAZERO_STRICT_VERIFY_CMD
-LUCIAZERO_STRICT_TIMEOUT
-LUCIAZERO_RELAY_STALE_DAYS
-LUCIAZERO_HANDOFF_STALE_DAYS
-CLAUDE_CONFIG_DIR' ;;
+      REFUSED_ENV_KEYS='LUCIAZERO_VERIFY_CMD LUCIAZERO_VERIFY_REGEX LUCIAZERO_DOC_REGEX LUCIAZERO_STRICT_VERIFY_CMD LUCIAZERO_STRICT_TIMEOUT LUCIAZERO_RELAY_STALE_DAYS LUCIAZERO_HANDOFF_STALE_DAYS LUCIAZERO_EDIT_DIAG CLAUDE_CONFIG_DIR' ;;
   esac
-  while IFS= read -r RK; do
+  # names are [A-Z_]* only, so splitting the line on spaces is exact; globbing
+  # is off for the loop so a key that carries a wildcard never names a file
+  set -f
+  for RK in ${REFUSED_ENV_KEYS}; do
     case "${RK}" in
       LUCIAZERO_[A-Z_]*|CLAUDE_CONFIG_DIR) unset "${RK}" 2>/dev/null || true ;;
     esac
-  done <<EOF
-${REFUSED_ENV_KEYS}
-EOF
+  done
+  set +f
 fi
 
 # Channel dedupe: when `install.sh --with-hooks` wiring is ALSO present, the
@@ -212,10 +287,7 @@ if [ -n "${CLASSIC_HOOK}" ] && [ "${SELF_HOOK}" != "${CLASSIC_HOOK}" ] \
   exit 0
 fi
 
-# md5 here names a state directory; it is never a security decision. Saying so
-# explicitly keeps the hook alive on a FIPS-enforcing python3, where a bare
-# md5() call raises and the tracker would fail open (silently doing nothing).
-KEY="$(printf '%s' "${CWD}" | python3 -c 'import sys,hashlib;print(hashlib.md5(sys.stdin.buffer.read(), usedforsecurity=False).hexdigest()[:12])' 2>/dev/null)" || exit 0
+# The state key is the prelude's md5 of cwd; empty means python3 failed.
 [ -n "${KEY}" ] || exit 0
 BASE="${TMPDIR:-/tmp}/luciazero-verify-state-$(id -u 2>/dev/null || echo unknown)"
 # The base name is predictable, so validate ownership/type before touching it.
@@ -229,18 +301,18 @@ chmod 700 "${BASE}" 2>/dev/null || exit 0
 STATE="${BASE}/${KEY}"
 mkdir -p "${STATE}" 2>/dev/null || exit 0
 chmod 700 "${STATE}" 2>/dev/null || exit 0
-SESSION_RAW="$(pyfield "d.get('session_id')")"
-[ -n "${SESSION_RAW}" ] || SESSION_RAW="parent-${PPID}"
-SESSION_KEY="$(printf '%s' "${SESSION_RAW}" | python3 -c 'import hashlib,sys; print(hashlib.sha256(sys.stdin.buffer.read()).hexdigest()[:16])' 2>/dev/null)" || exit 0
 TELEMETRY="${STATE}/telemetry/${SESSION_KEY}"
 
-tool_key() { # stable opaque key; raw tool input never leaves temporary state
-  RAW="$(pyfield "d.get('tool_use_id') or d.get('tool_input', {}).get('command') or d.get('tool_input', {}).get('skill') or d.get('command_name') or d.get('prompt') or d.get('command')")"
-  [ -n "${RAW}" ] || RAW=unknown
-  printf '%s' "${RAW}" | python3 -c 'import hashlib,sys; print(hashlib.sha256(sys.stdin.buffer.read()).hexdigest()[:16])' 2>/dev/null
-}
+# A turn is open from its first prompt until a stop lets it end. The harness
+# delivers a background task's completion (a forked skill, a subagent, a
+# run_in_background command) as one more UserPromptSubmit, and before this
+# marker every one of those wiped the turn's counters: a turn that waited on
+# a background job reported a few seconds and one Bash call. A stop that
+# blocks (nudge, strict red) keeps the turn open, because the model continues
+# it; every stop that lets the turn end closes it. Fail-open, like all state.
+end_turn() { rm -f "${TELEMETRY}/turn_open" 2>/dev/null || true; }
 
-now_ms() {
+now_ms() { # strict gate only; every other mode uses the prelude's NOW_MS
   python3 -c 'import time; print(int(time.time() * 1000))' 2>/dev/null
 }
 
@@ -270,7 +342,7 @@ path, cwd, event, mode, telemetry_dir = sys.argv[1:]
 os.makedirs(os.path.dirname(path), exist_ok=True)
 real = os.path.realpath(cwd)
 row = {
-    "schema": 2,
+    "schema": 3,
     "timestamp": datetime.datetime.now(datetime.timezone.utc).isoformat(timespec="seconds"),
     "event": event,
     "project_id": hashlib.sha256(real.encode()).hexdigest()[:12],
@@ -289,10 +361,19 @@ def count_files(name):
                    for item in os.listdir(os.path.join(telemetry_dir, name)))
     except OSError:
         return 0
+def merged_ms(intervals):
+    merged = []
+    for a, b in sorted((a, b) for a, b in intervals if a <= b):
+        if not merged or a > merged[-1][1]:
+            merged.append([a, b])
+        else:
+            merged[-1][1] = max(merged[-1][1], b)
+    return sum(b - a for a, b in merged)
 start = read_int(os.path.join(telemetry_dir, "turn_start_ms"))
 if start is not None:
     now = int(datetime.datetime.now(datetime.timezone.utc).timestamp() * 1000)
-    intervals = []
+    intervals, verify_intervals = [], []
+    verify_dir = os.path.join(telemetry_dir, "verify_count")
     try:
         interval_dir = os.path.join(telemetry_dir, "bash_intervals")
         for item in os.listdir(interval_dir):
@@ -302,21 +383,20 @@ if start is not None:
                 continue
             if 0 <= a <= b:
                 intervals.append((max(start, a), min(now, b)))
+                # the interval's tool key is the verify marker's name: same
+                # opaque digest, so no command is read to tell the two apart
+                if os.path.isfile(os.path.join(verify_dir, item)):
+                    verify_intervals.append(intervals[-1])
     except OSError:
         pass
-    merged = []
-    for a, b in sorted((a, b) for a, b in intervals if a <= b):
-        if not merged or a > merged[-1][1]:
-            merged.append([a, b])
-        else:
-            merged[-1][1] = max(merged[-1][1], b)
-    bash_ms = sum(b - a for a, b in merged)
     row["telemetry"] = {
         "turn_ms": max(0, now - start),
-        "bash_ms": bash_ms,
+        "bash_ms": merged_ms(intervals),
         "bash_count": count_files("bash_count"),
         "verify_count": count_files("verify_count"),
         "skill_count": count_files("skill_count"),
+        "verify_ms": merged_ms(verify_intervals),
+        "redundant_green_count": count_files("redundant_green"),
     }
 with open(path, "a", encoding="utf-8") as handle:
     handle.write(json.dumps(row, separators=(",", ":")) + "\n")
@@ -335,47 +415,69 @@ PY
 # When LUCIAZERO_VERIFY_CMD is set (the repo's exact verify command, e.g.
 # "./test.sh"), only commands that ARE it or START with it count — the broad
 # regex also marks `cat test.sh` or `grep pytest README` as a verify run,
-# flipping the state green without any test having run.
-VERIFY_RE="${LUCIAZERO_VERIFY_REGEX:-verify|test\.sh|pytest|npm (run )?test|pnpm test|yarn test|cargo test|go test|vitest|jest|make (test|check)|tox|rake test|mix test|dotnet test|gradlew? (test|check)}"
+# flipping the state green without any test having run. The default also
+# knows `python -m unittest` and this repository's timing collector,
+# scripts/test-timings.sh, which runs a tier -- except with --report, which
+# only reads the samples kept so far; that case is carved out of the default
+# below and is no concern of a regex somebody set themselves.
+VERIFY_RE="${LUCIAZERO_VERIFY_REGEX:-verify|test\.sh|python[0-9.]* -m unittest|test-timings\.sh|pytest|npm (run )?test|pnpm test|yarn test|cargo test|go test|vitest|jest|make (test|check)|tox|rake test|mix test|dotnet test|gradlew? (test|check)}"
 VERIFY_CMD="${LUCIAZERO_VERIFY_CMD:-}"
 
 case "${MODE}" in
   prompt)
     # Per-turn scratch data is ephemeral. Persistent rows keep aggregates only.
+    # Inside an open turn this prompt is a notification, not a new turn: the
+    # counters and turn_start_ms stay exactly as they are.
+    [ -f "${TELEMETRY}/turn_open" ] && exit 0
     rm -rf "${TELEMETRY}" 2>/dev/null || exit 0
     mkdir -p "${TELEMETRY}" 2>/dev/null || exit 0
-    now_ms > "${TELEMETRY}/turn_start_ms" 2>/dev/null || true
+    printf '%s\n' "${NOW_MS}" > "${TELEMETRY}/turn_start_ms" 2>/dev/null || true
+    : > "${TELEMETRY}/turn_open" 2>/dev/null || true
     ;;
   bash-start)
-    TK="$(tool_key)" || exit 0
     mkdir -p "${TELEMETRY}/bash_start_ms" "${TELEMETRY}/bash_count" 2>/dev/null || exit 0
-    now_ms > "${TELEMETRY}/bash_start_ms/${TK}" 2>/dev/null || true
+    printf '%s\n' "${NOW_MS}" > "${TELEMETRY}/bash_start_ms/${TK}" 2>/dev/null || true
     : > "${TELEMETRY}/bash_count/${TK}" 2>/dev/null || true
     ;;
   edit)
     # Documentation writes do not re-arm the nudge: the closeout skills
     # Closeout skills write docs AFTER the final green verify. Relay's JSON is
     # also a transient knowledge artifact, not implementation code.
-    FP="$(pyfield "d.get('tool_input', {}).get('file_path')")"
     DOC_RE="${LUCIAZERO_DOC_REGEX:-\.(md|markdown|rst|txt)\$}"
+    COUNTED=yes
     case "${FP}" in
-      */LUCIA_RELAY.json|*/LUCIA_RELAY.md) : ;;
+      */LUCIA_RELAY.json|*/LUCIA_RELAY.md) COUNTED=no ;;
       *)
         if [ -n "${FP}" ] && printf '%s' "${FP}" | grep -qE "${DOC_RE}"; then
-          :  # doc-only write; verify state unchanged
+          COUNTED=no  # doc-only write; verify state unchanged
         else
           touch "${STATE}/last_edit"
           rm -f "${STATE}/nudged"    # new code edits re-arm the one-shot nudge
         fi
         ;;
     esac
+    # Opt-in diagnostic (LUCIAZERO_EDIT_DIAG=1): one line per edit event in
+    # the state directory, next to last_edit, saying what the event carried
+    # and what the hook made of it -- the tool's name, the opaque tool key,
+    # whether file_path was missing, empty or present, its suffix, whether it
+    # lay under cwd, and whether the edit counted. Never the path, never the
+    # content. For finding out what touched last_edit when no visible edit did.
+    if [ "${LUCIAZERO_EDIT_DIAG:-}" = 1 ]; then
+      IN_CWD="-"; EXT="-"
+      if [ -n "${FP}" ]; then
+        case "${FP}" in "${CWD}"/*) IN_CWD=yes ;; *) IN_CWD=no ;; esac
+        case "${FP##*/}" in *.*) EXT="${FP##*.}" ;; esac
+      fi
+      printf 'ts=%s mode=%s tool=%s key=%s file_path=%s ext=%s in_cwd=%s counted=%s\n' \
+        "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${MODE}" "${TOOL_NAME:--}" "${TK}" "${FP_STATE:-unknown}" \
+        "${EXT}" "${IN_CWD}" "${COUNTED}" >> "${STATE}/edit-diag.log" 2>/dev/null || true
+    fi
     ;;
   bash|bash-failure)
-    TK="$(tool_key)" || TK=unknown
     mkdir -p "${TELEMETRY}/bash_count" "${TELEMETRY}/bash_intervals" 2>/dev/null || true
     : > "${TELEMETRY}/bash_count/${TK}" 2>/dev/null || true
     START_MS="$(cat "${TELEMETRY}/bash_start_ms/${TK}" 2>/dev/null || true)"
-    END_MS="$(now_ms || true)"
+    END_MS="${NOW_MS}"
     case "${START_MS}:${END_MS}" in
       *[!0-9:]*|:|*:|*::* ) : ;;
       *)
@@ -384,7 +486,6 @@ case "${MODE}" in
         fi
         ;;
     esac
-    CMD="$(pyfield "d.get('tool_input', {}).get('command')")"
     IS_VERIFY=no
     if [ -n "${CMD}" ]; then
       if [ -n "${VERIFY_CMD}" ]; then
@@ -394,38 +495,55 @@ case "${MODE}" in
         esac
       elif printf '%s' "${CMD}" | grep -qE "${VERIFY_RE}"; then
         IS_VERIFY=yes
+        if [ -z "${LUCIAZERO_VERIFY_REGEX:-}" ] && printf '%s' "${CMD}" | grep -qE 'test-timings\.sh +--report'; then
+          IS_VERIFY=no  # the collector's report runs nothing
+        fi
       fi
     fi
     if [ "${IS_VERIFY}" = yes ]; then
       mkdir -p "${TELEMETRY}/verify_count" 2>/dev/null || true
       : > "${TELEMETRY}/verify_count/${TK}" 2>/dev/null || true
-      # Best-effort red/green from the tool response; failure hooks are red.
-      if [ "${MODE}" = bash-failure ]; then
-        STATUS=fail
-      else
-        STATUS="$(pyfield "(lambda r, c=None: (lambda c: 'ok' if c == 0 else ('fail' if isinstance(c, int) else ('fail' if r.get('is_error') is True else 'ran')))(r.get('exit_code', r.get('exitCode'))))(d.get('tool_response') or {})")"
+      # Red/green came from the tool response in the prelude; failure hooks are red.
+      [ "${MODE}" = bash-failure ] && STATUS=fail
+      # A green that follows a green with no code edit between them proved
+      # nothing new: count it (schema 3 `redundant_green_count`) before the
+      # state below overwrites the previous result. Float mtimes for the
+      # same sub-second reason as the stop nudge; one python3, verify runs only.
+      if [ "${STATUS}" = ok ] && [ "$(python3 -c '
+import os, sys
+state = sys.argv[1]
+def m(name):
+    try:
+        return os.path.getmtime(os.path.join(state, name))
+    except OSError:
+        return None
+try:
+    last = open(os.path.join(state, "last_verify")).read().strip()
+except OSError:
+    last = ""
+e, v = m("last_edit"), m("last_verify")
+print("yes" if last == "ok" and v is not None and (e is None or e <= v) else "no")' "${STATE}" 2>/dev/null || echo no)" = yes ]; then
+        mkdir -p "${TELEMETRY}/redundant_green" 2>/dev/null || true
+        : > "${TELEMETRY}/redundant_green/${TK}" 2>/dev/null || true
       fi
       printf '%s\n' "${STATUS:-ran}" > "${STATE}/last_verify"
       # Keep only an opaque digest for strict-gate equality; raw commands may
       # contain paths or secrets and must never persist in shared state.
-      printf '%s' "${CMD}" | python3 -c 'import hashlib,sys; print(hashlib.sha256(sys.stdin.buffer.read()).hexdigest())' \
-        > "${STATE}/last_verify_cmd_hash" 2>/dev/null || true
+      printf '%s\n' "${CMD_HASH}" > "${STATE}/last_verify_cmd_hash" 2>/dev/null || true
       rm -f "${STATE}/nudged"
     fi
     ;;
   skill|skill-prompt)
     if [ "${MODE}" = skill-prompt ]; then
-      EXPANSION_TYPE="$(pyfield "d.get('expansion_type')")"
       [ "${EXPANSION_TYPE}" = slash_command ] || exit 0
     fi
-    TK="$(tool_key)" || TK=unknown
     mkdir -p "${TELEMETRY}/skill_count" 2>/dev/null || true
     : > "${TELEMETRY}/skill_count/${TK}" 2>/dev/null || true
     ;;
   stop)
-    # Never re-block a continuation that a stop hook itself caused
-    ACTIVE="$(pyfield "d.get('stop_hook_active')")"
-    if [ "${ACTIVE}" = "True" ] || [ "${ACTIVE}" = "true" ]; then exit 0; fi
+    # Never re-block a continuation that a stop hook itself caused; that
+    # continuation is the turn ending, so the turn closes here.
+    if [ "${ACTIVE}" = "True" ] || [ "${ACTIVE}" = "true" ]; then end_turn; exit 0; fi
     # Strict gate (opt-in, see header): actually run the user's verify command
     # unless the tracked state is already green-after-last-edit. Any internal
     # error — timeout, missing command, unparseable state — degrades to the
@@ -434,7 +552,6 @@ case "${MODE}" in
     # Strict gate only on well-formed input: unparseable stdin means we know
     # neither cwd nor stop_hook_active — running a command on guesses would
     # break both the fail-open and the never-re-block guarantees.
-    JSON_OK="$(printf '%s' "${IN}" | python3 -c 'import json,sys; json.load(sys.stdin); print("yes")' 2>/dev/null || echo no)"
     if [ -n "${STRICT_CMD}" ] && [ "${JSON_OK}" = yes ]; then
       STRICT_START_MS="$(now_ms || true)"
       OUT="$(python3 -c '
@@ -476,7 +593,7 @@ else:
     print("\n".join(tail))
 ' "${STATE}" "${CWD}" "${STRICT_CMD}" "${LUCIAZERO_STRICT_TIMEOUT:-120}" 2>/dev/null || echo error)"
       case "${OUT%%$'\n'*}" in
-        green) stat_log stop-clean; exit 0 ;;
+        green) stat_log stop-clean; end_turn; exit 0 ;;
         ok)
           record_strict_telemetry "${STRICT_START_MS}"
           printf 'ok\n' > "${STATE}/last_verify" 2>/dev/null || true
@@ -484,6 +601,7 @@ else:
             > "${STATE}/last_verify_cmd_hash" 2>/dev/null || true
           rm -f "${STATE}/nudged"
           stat_log stop-clean
+          end_turn
           exit 0 ;;
         red)
           record_strict_telemetry "${STRICT_START_MS}"
@@ -517,15 +635,21 @@ print("yes" if e is not None and (v is None or e > v) else "no")' "${STATE}" 2>/
       exit 2
     fi
     # NUDGE=no -> genuinely clean stop; yes-but-already-nudged logs nothing
-    # (that nudge was counted when it fired)
+    # (that nudge was counted when it fired). Either way the turn ends here.
     [ "${NUDGE}" = no ] && stat_log stop-clean
+    end_turn
     ;;
   session)
+    # A marker left behind by a session that never reached its stop (crash,
+    # kill, resume) would make the first real prompt look like a notification
+    # and keep stale counters. Compaction is the one start that happens inside
+    # a live session, possibly mid-turn, so it leaves the marker alone.
+    [ "${SESSION_SOURCE}" = compact ] || end_turn
     # A committed settings env block that reconfigures this hook is worth one
     # loud line: the refusal above is silent, and a repository that ships these
     # keys is either mistaken or hostile. Names the keys, never their values.
     if [ -n "${REFUSED_ENV_KEYS}" ]; then
-      echo "This repository's committed .claude/settings.json sets $(printf '%s' "${REFUSED_ENV_KEYS}" | tr '\n' ' ')— Luciazero refuses those keys from project scope (they can disable verify tracking or run a command at every stop). Review that env block before trusting this repo."
+      echo "This repository's committed .claude/settings.json sets ${REFUSED_ENV_KEYS} — Luciazero refuses those keys from project scope (they can disable verify tracking or run a command at every stop). Review that env block before trusting this repo."
     fi
     # SessionStart emits ONE pointer, never the relay contents. A legacy
     # HANDOFF.md gets a migration warning but is not silently rewritten.
@@ -536,7 +660,7 @@ print("yes" if e is not None and (v is None or e > v) else "no")' "${STATE}" 2>/
       fi
       exit 0
     fi
-    AGE="$(python3 -c 'import os,sys,time;print(int((time.time()-os.path.getmtime(sys.argv[1]))//86400))' "${CAP}" 2>/dev/null || echo '')"
+    AGE="${RELAY_AGE}"
     STALE="${LUCIAZERO_RELAY_STALE_DAYS:-${LUCIAZERO_HANDOFF_STALE_DAYS:-7}}"
     if [ -n "${AGE}" ] && [ "${AGE}" -ge "${STALE}" ] 2>/dev/null; then
       echo "LUCIA_RELAY.json exists but is ${AGE} days old — likely stale. Run /lucia-relay inspect, verify its claims with extra suspicion, then consume or replace it."

package/install.sh

@@ -78,6 +78,18 @@ version_of() {
   awk -F '"' '/^[[:space:]]*"version"[[:space:]]*:/ { print $4; exit }' \
     "${SRC}/package.json" 2>/dev/null || true
 }
+# A plugin install of Luciazero beside this classic one loads every skill and
+# the reviewer agent twice in each session, as `/x` and `/luciazero:x` (the
+# hook and the doctrine dedupe themselves; skills and agents cannot). Only the
+# harness's own registry is consulted, read-only; when it is absent or says
+# nothing, nothing is printed.
+plugin_double_install_note() {
+  REGISTRY="${CLAUDE_DIR}/plugins/installed_plugins.json"
+  [ -f "${REGISTRY}" ] && grep -q '"luciazero@' "${REGISTRY}" 2>/dev/null || return 0
+  echo "  !!    Luciazero is also installed as a Claude Code plugin: every skill and the"
+  echo "        reviewer agent load twice per session. Keep one channel — /plugin uninstall"
+  echo "        luciazero@luciazero for the plugin, or ./uninstall.sh for this copy."
+}
 
 if [ "${STATUS_ONLY}" = 1 ]; then
   echo "Status of ${CLAUDE_DIR} (read-only)"
@@ -132,6 +144,7 @@ if [ "${STATUS_ONLY}" = 1 ]; then
   else
     echo "  MISS  CLAUDE.md import line (${IMPORT_LINE} exactly once; found ${N:-0})"; STATUS_RC=1
   fi
+  plugin_double_install_note
   V_SRC="$(version_of)"
   V_INST="$(cat "${CLAUDE_DIR}/.luciazero-version" 2>/dev/null || true)"
   if [ -z "${V_INST}" ]; then
@@ -631,4 +644,5 @@ if [ "${WITH_HOOKS}" = 1 ]; then
 else
   echo "Optional: ./install.sh --with-hooks adds the verify-nudge hooks + statusline."
 fi
+plugin_double_install_note
 echo "The doctrine applies from the next Claude Code session."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "luciazero",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "description": "Verification-first discipline for coding agents (Claude Code + Codex CLI): 9-rule doctrine, 13 skills, risk-routed reviewer, fail-open enforcement hooks. npx luciazero installs it.",
   "repository": {
     "type": "git",