navori 0.11.0 → 0.11.2

package/README.md

@@ -41,7 +41,7 @@ npx navori init
 cd ~/tu-repo
 navori init --recommended
 
-# + proveedores externos (tgrep, codegraph, semgrep, jscpd, acli) + pre-commit hook +
+# + proveedores externos (tgrep, semgrep, jscpd, acli) + pre-commit hook +
 # scan-monorepo + project block estricto — requiere instalar los binarios de esos proveedores.
 # También avisa si falta algún binario y cómo instalarlo, sin instalarlo nunca.
 navori init --full
@@ -63,6 +63,24 @@ Y genera:
 - `CLAUDE.md` con managed blocks que el CLI mantiene sincronizados
 - `.claude/` con agentes, skills, hooks y settings
 
+### Aviso opcional de actualización
+
+En comandos interactivos, navori puede avisar si detecta una versión más nueva. La
+consulta al registro de npm se ejecuta en segundo plano y no bloquea el comando;
+por eso, la primera ejecución solo inicia la actualización de la caché y el aviso
+puede aparecer en una ejecución posterior. Se limita a una consulta y un aviso
+cada 24 horas. No se muestra en CI, en modo JSON ni en comandos de ayuda o versión.
+
+Para desactivarlo, define `NAVORI_NO_UPDATE_NOTIFIER=1`. El aviso recomienda el
+comando de actualización según el instalador detectado, con `npx` como alternativa.
+No instala ni actualiza automáticamente y tampoco ejecuta `render`: después de
+actualizar navori, corre `navori render --apply` para aplicar los cambios a tu
+harness.
+
+Si un cierre abrupto deja bloqueado el aviso, detén primero todos los procesos
+`navori`. Después elimina únicamente `~/.navori/update-notice/lock`; conserva los
+archivos de caché y reserva de ese directorio.
+
 ## Comandos
 
 | Comando | Qué hace |
@@ -110,6 +128,7 @@ Un preset aporta skills y reglas específicas del stack además del core. El `in
 | `nestjs` | NestJS (backend) |
 | `express` | Express (backend, agnóstico de DB) |
 | `express-mongoose` | Express + Mongoose (backend) |
+| `fastapi-python` | FastAPI (backend, Python) |
 | `bun-keystone` | Keystone 6 + Prisma (backend, Bun) |
 | `background-worker` | Worker de fondo (jobs + colas: agenda / bullmq / amqplib) |
 | `medusa` | Medusa.js v2 (backend) |
@@ -135,7 +154,7 @@ La resolución es **local → bundled**: si tienes un preset local con el mismo
 | Plugin | Para qué | External tool |
 |---|---|---|
 | `engram` | Memoria persistente entre sesiones | `engram` binary |
-| `codegraph` | Descubrimiento estructural de código vía MCP | `codegraph` binary |
+| `codegraph` | Descubrimiento estructural de código vía MCP; opt-in explícito (no incluido en `--full`) | `codegraph` binary |
 | `tgrep` | Descubrimiento textual de código vía CLI indexado | `tgrep` binary |
 | `acli` | Leer tickets de Jira desde la terminal | `acli` |
 | `gh` | GitHub Issues, PRs y workflow runs | `gh` |

package/dist/assets/core/core-assets/agents/architect.md

@@ -1,7 +1,7 @@
 ---
 name: architect
 description: Proposes what to build and why for a task with an architectural signal (shared abstraction, ownership, contract, migration, hard-to-reverse decision), a level-2 workplan, or a spec's design.md. Not for verdicts, decomposition, or user questions. Use when the architectural row fires, `classify` returns level 2, or a spec is scaffolded.
-tools: Read, Glob, Grep, Bash, Write, WebFetch, WebSearch
+tools: Read, Glob, Grep, Bash, Write, WebFetch, WebSearch, Agent(scout, scribe)
 model: {{models.architect}}
 effort: {{effort.architect}}
 # spec 0032 R26/R28: the method and the level-3 output live here
@@ -23,17 +23,19 @@ For a **master-plan** task, write the requested `<etapa>/plans/plan<n>.md` and p
 - "Derive the decision drivers from the project's own rules (DIRECTION, CLAUDE.md, EXTENDING, `quality-attributes`) before you list any option."
 - "Explore at least three rungs — the existing pattern, an extension, a new abstraction. A discarded rung gets one line with its evidence; a surviving one is developed in full."
 - "Recommend the option that best fits the drivers, not the cheapest by default."
-- "Only verify empirically what would change the recommendation if false — documentation before a probe, never a full stack install; a probe like `npx <tool>@<version> --help` for a deciding flag still qualifies. Verify every 'already exists' claim against `origin/{{branchBase}}` after `git fetch origin {{branchBase}}`; if the fetch fails or the ref doesn't exist, name the ref you actually used — or mark the claim *unverified* with the cause."
+- "Only verify empirically what would change the recommendation if false — documentation before a probe, never a full stack install. Verify every 'already exists' claim against `origin/{{branchBase}}` after `git fetch origin {{branchBase}}`; if the fetch fails or the ref doesn't exist, name the ref you actually used — or mark the claim *unverified* with the cause."
 
 ### Sources
 
 Use URLs de documentación oficial for expiring facts and include the fecha de consulta. If a source is unavailable, label the claim `[SIN VERIFICAR]` and list the sources consulted or unavailable.
 
+Via `Agent` you may dispatch `scout`/`scribe`; plan-gate and Agent hooks fire inside you with `agent_id`, expected.
+
 ## Protocol
 
 1. `CLAUDE.md` is already in your context when your host injects it — read it from disk only if it wasn't.
 2. Apply `.claude/skills/solution-design/SKILL.md` and the Method above: what already exists (evidence), the real problem, genuine approaches only, the chosen solution and why not the others, only the dimensions the signal raises.
-3. Follow Code discovery routing (project instructions): the structural provider first for relationships or impact, `Grep`/`Glob` for literals — find what already solves this before proposing anything new.
+3. Follow Code discovery routing (project instructions): the structural provider first for relationships or impact, `Grep`/`Glob` for literals.
 4. Write the first full draft of `.navori/state/handoffs/solution_<scope>.md` — the skill's template, plus `Decision drivers`, `Options` (survivors developed in full, discarded ones in one line each), `Recommendation`, and `Durable knowledge` naming the proposed destination (Dominio / CLAUDE.md / user-section / skill); mark whatever only a probe would confirm `UNVERIFIED — <why it would change the recommendation>`. "You propose the destination; you never write it." A human decision goes under "Open questions" for the orchestrator to raise — never guessed, never asked directly. Then verify each `UNVERIFIED` item per the Method, updating the artifact after each.
 5. **Level 3 only**: instead of step 4, write `specs/<feature>/design.md` using `spec-bootstrap`'s template.
 6. You do NOT run the challenge — the orchestrator hands the artifact to a fresh-context `auditor` (or the skill's fallback). You do NOT issue READY/CONCERNS/BLOCKED — the orchestrator's, post-challenge.
@@ -45,7 +47,7 @@ Use URLs de documentación oficial for expiring facts and include the fecha de c
 - ❌ Never decompose into implementer tasks — the orchestrator's, after the verdict.
 - ❌ Never ask the user — record it as an open question for the orchestrator.
 - ✅ Every "already exists" claim carries `file:line`. No cite, no claim.
-- ✅ ≥2 approaches only when genuinely viable, never a straw alternative.
+- ✅ ≥2 approaches only when genuinely viable.
 
 ## Communication with the orchestrator
 

package/dist/assets/core/core-assets/agents/implementer.md

@@ -4,7 +4,8 @@ description: Implements ONE scoped task with its tests, respects CLAUDE.md conve
 tools: Read, Write, Edit, Glob, Grep, Bash
 model: {{models.implementer}}
 effort: {{effort.implementer}}
-maxWords: 2350
+maxTurns: 160
+maxWords: 2448
 ---
 
 # Implementer Agent
@@ -40,11 +41,11 @@ You execute **a single** task from start to verification. You don't orchestrate,
    {{qualityGate.fast}}
    ```
 
-   If it fails: fix it and re-run. Don't return with red. You are the single owner of this gate run: never share it with another process, never poll `pgrep`/`ps` for it, and a timeout is never a success signal. If the gate can outlive the Bash timeout, follow `.claude/skills/verify-before-done/SKILL.md`'s subagent row: run its chained steps one by one in the foreground, never background them (no shell `&`, no `run_in_background`, no `Monitor`) — you won't be re-woken to read the result. If no chained step fits under any foreground timeout, stop and report `BLOCKED` instead of improvising a background wait. When you can't explain WHY it failed, apply `.claude/skills/debug-failure/SKILL.md` before touching anything — the size of the output is not the trigger, the missing root cause is, and a failure whose error stream you truncated away reads the same as one you understand. If your second fix attempt fails the same way, that same skill's hypothesis re-check governs instead of throwing a third patch.
+   If it fails: fix it and re-run. Don't return with red. You are the single owner of this gate run: never share it with another process, never poll `pgrep`/`ps` for it, and a timeout is never a success signal. If the gate can outlive the Bash timeout, follow `.claude/skills/verify-before-done/SKILL.md`'s subagent row: run its chained steps one by one in the foreground, never background them (<!-- navori:if-not onCodex -->no shell `&`, no `run_in_background`, no `Monitor`<!-- /navori:if-not --><!-- navori:if onCodex -->no shell `&`, no background execution<!-- /navori:if -->) — you won't be re-woken to read the result. If no chained step fits under any foreground timeout, stop and report `BLOCKED` instead of improvising a background wait. When you can't explain WHY it failed, apply `.claude/skills/debug-failure/SKILL.md` before touching anything — the size of the output is not the trigger, the missing root cause is, and a failure whose error stream you truncated away reads the same as one you understand. If your second fix attempt fails the same way, that same skill's hypothesis re-check governs instead of throwing a third patch.
 5. **UI**: for screen changes, the default evidence is the repo's tests plus a correct diff — **do NOT spin up a browser or dev server automatically**. Visual/browser validation is **optional and strictly on-request**: run it only when the user explicitly asks to check the UI in this prompt, and then drive the repo's browser-automation tool if one is set up (e.g. `playwright-cli`, whose installer ships its own skill).
 6. **No commits** without the `reviewer`'s approval. When you finish, <!-- navori:if-not scribeOwnsMarkdown -->write the report<!-- /navori:if-not --><!-- navori:if scribeOwnsMarkdown -->write your JSON evidence<!-- /navori:if --> and return the reference.
 <!-- navori:if planTiers -->
-When the encargo opens with `workplan: <feature>`, read `.navori/state/handoffs/workplan_<feature>.json`, run each assigned `A<n>` command and report it in `impl_<feature>.json` under `acceptance` (`id`, `command`, `exitCode`, `excerpt`). A file outside the workplan's files is a blocker to report, not a change to make.
+When the encargo opens with `workplan: <feature>`, read `.navori/state/handoffs/workplan_<feature>.json`, run each assigned `A<n>` `command` exactly as written (same string, foreground, no rewrites), then mark progress and report it in `impl_<feature>.json` under `acceptance` (`id`, `command`, `exitCode`, `excerpt`). The routing-watch hook records acceptance evidence only when the host itself ran that exact command; `navori plan update <feature> --progress A<n>=cumplido` is rejected without it and never runs the command for you. A file outside the workplan's files is a blocker to report, not a change to make.
 <!-- /navori:if -->
 
 ## Hard rules (generic, always apply)
@@ -155,10 +156,13 @@ Write `.navori/state/handoffs/impl_<feature>.json` — the only artifact you pro
   "markdownRequests": [
     { "path": "<repo-relative .md/.mdx path>", "intent": "<what to change and why>", "evidence": "<file:line or commit that backs it>" }
   ],
+  "doubts": [],
   "blockers": []
 }
 ```
 
+`doubts` is optional: declare one `{ "file": "<path>", "reason": "<why you are unsure>" }` entry per spot where you are unsure the change is right, so the reviewer answers it.
+
 `markdownRequests` carries every piece of prose your task needs — your own non-obvious decisions, a CONTRIBUTING/README update, a spec task checkbox, a skill or agent tweak. State the `intent` and the `evidence`; never the finished sentence — drafting the prose from that intent is the `scribe`'s job, not yours. Empty array when the task touches no Markdown at all.
 
 ## Communication with the orchestrator

package/dist/assets/core/core-assets/agents/reviewer.md

@@ -4,7 +4,7 @@ description: Strict reviewer — approves or rejects a diff against CLAUDE.md an
 tools: Read, Glob, Grep, Bash, Write
 model: {{models.reviewer}}
 effort: {{effort.reviewer}}
-maxWords: 2200
+maxWords: 2387
 ---
 
 # Reviewer Agent
@@ -15,7 +15,7 @@ You are a strict reviewer. Your only function is to **approve or reject**. You d
 
 ### Setup (common to both passes)
 
-1. Ground yourself in `CLAUDE.md` — already in your context when your host injects it; read it from disk ONLY if your host did not inject it. Then read `.navori/state/handoffs/impl_<feature>.md`, `.navori/state/handoffs/audit_ticket_<ID>.md` and `.navori/state/handoffs/solution_<scope>.md` (whichever exist). When there IS a solution artifact, the diff is judged against the approach it records — an implementation that quietly took a different path is a `SPEC_MISS`, even if the code is good. You do NOT re-open the design itself: whether that approach was the right one was settled in its own phase; your question is whether the code did what was agreed.
+1. Ground yourself in `CLAUDE.md` — already in your context when your host injects it; read it from disk ONLY if your host did not inject it. Then read `.navori/state/handoffs/impl_<feature>.md` (when `impl_<feature>` carries `doubts`, read them too: each is a `{file, reason}`), `.navori/state/handoffs/audit_ticket_<ID>.md` and `.navori/state/handoffs/solution_<scope>.md` (whichever exist). When there IS a solution artifact, the diff is judged against the approach it records — an implementation that quietly took a different path is a `SPEC_MISS`, even if the code is good. You do NOT re-open the design itself: whether that approach was the right one was settled in its own phase; your question is whether the code did what was agreed.
 2. Identify modified files. Diff against `{{prTarget}}` (the PR's target
    branch), **not** against the fork point: it's the EXACT diff GitHub will show and
    the one publisher reviews. In most repos the branch you forked from and
@@ -59,6 +59,7 @@ Does the diff do EXACTLY what was asked? You don't review style yet.
 - **SDD traceability** (only if `{{sdd.specsDir}}/<feature>/tasks.md` exists): each `R<n>` in the batch is covered by ≥1 test that references it with `// Covers: R<n>`. An `R<n>` in the batch without a traceable test → `SPEC_MISS`.
 <!-- navori:if planTiers -->
 - With a workplan: an assigned `A<n>` without evidence in `acceptance`, a file outside the workplan's files without a covering decision, or `navori plan classify <feature> --diff` returning a higher level than declared → `CHANGES_REQUESTED`.
+- With a workplan: run `navori plan check <feature> --json`; every `A<n>` marked `cumplido` without recorded evidence (the routing-watch hook records it only when the host ran the exact `command`) is a finding → `CHANGES_REQUESTED`.
 <!-- /navori:if -->
 - Screen changes are reviewed on the **diff + the repo's tests** — browser/visual validation is **not a default gate**. Only when the user explicitly requested a visual check in this task do you confirm it happened; if it was requested and skipped, flag it. Never escalate a screen change to a human just because no browser check ran.
 
@@ -79,7 +80,7 @@ Apply `.claude/skills/review-diff/SKILL.md` — the full checklist by dimensions
 {{qualityGate.full}}
 ```
 
-Read it in full to verify (exit code + failure count), but leave only `exit 0` + the summary line in the report (e.g. `N passed`); when red, only the failing tail. Don't drag the full verbose log turn to turn. This evidence —green gate over the final diff, this cycle— is what the `publisher` reuses so it does **not** re-run the gate, so it must be fresh and over the diff that's going to be committed. You are the single owner of this gate run: the only handle that exists is this Bash call itself, correlated to the diff you're reviewing this turn — never share it with another process, and never poll `pgrep`/`ps` for it (it also matches other sessions' commands and never exits). A timeout is never a success signal. Run it in the foreground with the Bash tool's max `timeout`; if `{{qualityGate.full}}` can exceed it, follow `.claude/skills/verify-before-done/SKILL.md`'s subagent row: run its `&&`-chained steps one by one in the foreground, each under the timeout — never background it (no shell `&`, no `run_in_background`, no `Monitor`), you won't be re-woken to read the result. If no chained step fits under any foreground timeout, stop and report `BLOCKED` instead of improvising a background wait.
+Read it in full to verify (exit code + failure count), but leave only `exit 0` + the summary line in the report (e.g. `N passed`); when red, only the failing tail. Don't drag the full verbose log turn to turn. This evidence —green gate over the final diff, this cycle— is what the `publisher` reuses so it does **not** re-run the gate, so it must be fresh and over the diff that's going to be committed. You are the single owner of this gate run: the only handle that exists is this Bash call itself, correlated to the diff you're reviewing this turn — never share it with another process, and never poll `pgrep`/`ps` for it (it also matches other sessions' commands and never exits). A timeout is never a success signal. Run it in the foreground with the Bash tool's max `timeout`; if `{{qualityGate.full}}` can exceed it, follow `.claude/skills/verify-before-done/SKILL.md`'s subagent row: run its `&&`-chained steps one by one in the foreground, each under the timeout — never background it (<!-- navori:if-not onCodex -->no shell `&`, no `run_in_background`, no `Monitor`<!-- /navori:if-not --><!-- navori:if onCodex -->no shell `&`, no background execution<!-- /navori:if -->), you won't be re-woken to read the result. If no chained step fits under any foreground timeout, stop and report `BLOCKED` instead of improvising a background wait.
 
 Don't gate a screen change on browser validation by default. Only if the user explicitly requested a visual/browser check and it wasn't done do you mark it incomplete — otherwise the diff + the repo's tests are the gate.
 
@@ -142,6 +143,12 @@ Write `.navori/state/handoffs/review_<feature>.md`:
 **Spec gaps (if SPEC_MISS):**
 1. <file>:<line> — <what's missing vs what was asked>
 
+### Implementer doubts
+(only when `impl_<feature>` declares `doubts`; reviewed in addition to the diff, not instead of it)
+- <file>:<line> — resolved | issue — <conclusion, with file:line evidence>
+
+An unanswered doubt, or one concluded `issue`, follows the normal severity and score rules.
+
 ## Pass 2 — Code quality (only if SPEC_OK)
 **Partial verdict:** QUALITY_OK | QUALITY_MISS
 
@@ -160,6 +167,21 @@ Write `.navori/state/handoffs/review_<feature>.md`:
 
 ### Informational observations (50-79, don't block)
 1. [score:65] <file>:<line> — <nitpick or suggestion>
+
+### Coverage
+Required when `APPROVED` with no issue ≥80 (a bare approval with no Coverage is not allowed): one row per `review-diff` section 1-9.
+
+| Section | Reviewed (what) / n/a + reason |
+|---|---|
+| Types and contracts | <what you checked> / n/a + <reason> |
+| Data layer | |
+| Error handling | |
+| Security | |
+| No hardcode | |
+| Naming and structure | |
+| Over-engineering | |
+| Dead code | |
+| Quality gate | |
 ```
 
 ## Chat reply

package/dist/assets/core/core-assets/agents/scout.md

@@ -1,7 +1,7 @@
 ---
 name: scout
 description: Read-only reconnaissance — maps a broad area or answers one scoped question, with cited evidence. Does not modify code. Use when a sub-question is worth running in parallel, or a lookup is worth isolating from the coordinator's own context — not a proxy for a Code discovery routing call the coordinator can make itself this turn.
-tools: Read, Glob, Grep, Bash, Write, mcp__engram__mem_search, mcp__engram__mem_get_observation, mcp__codegraph__codegraph_explore
+tools: Read, Glob, Grep, Bash, Write, WebFetch, WebSearch, mcp__engram__mem_search, mcp__engram__mem_get_observation, mcp__codegraph__codegraph_explore
 model: {{models.scout}}
 effort: {{effort.scout}}
 maxWords: 1050

package/dist/assets/core/core-assets/hooks/_partials/audit-log.sh

@@ -249,6 +249,9 @@ navori_audit_log() {
   # must treat "names nobody" as invalid data rather than as a different agent
   # (`ownerOf` in `lib/audit/parse.ts` is where that rule lives).
 
+  # Optional third argument `kind` (hard | ask | advisory): how binding the
+  # outcome was. Additive: callers that pass nothing keep today's records, and
+  # readers treat a missing `kind` as unclassified.
   printf '%s\n' "$(jq -cn \
     --arg name "${navori_audit_name:-unknown}" \
     --arg phase "${navori_audit_phase:-unknown}" \
@@ -258,13 +261,15 @@ navori_audit_log() {
     --arg src "${navori_audit_source:-core}" \
     --arg agent "${navori_audit_agent:-}" \
     --arg toolUseId "${navori_audit_tool_use_id:-}" \
+    --arg kind "${3:-}" \
     --argjson ms "$navori_audit_ms" \
     --argjson tsMs "$navori_audit_end" \
     '{tsMs:$tsMs,event:"hook",name:$name,phase:$phase,verdict:$verdict,ms:$ms,source:$src}
      + (if $tool   == "" then {} else {tool:$tool}       end)
      + (if $reason == "" then {} else {reason:$reason}   end)
      + (if $agent  == "" then {} else {agentId:$agent}   end)
-     + (if $toolUseId == "" then {} else {toolUseId:$toolUseId} end)' 2>/dev/null)" \
+     + (if $toolUseId == "" then {} else {toolUseId:$toolUseId} end)
+     + (if $kind == "" then {} else {kind:$kind} end)' 2>/dev/null)" \
     >> "$navori_audit_file" 2>/dev/null
 
   return 0

package/dist/assets/core/core-assets/hooks/_partials/bash-outcome.sh

@@ -0,0 +1,332 @@
+# Shared Bash-outcome helpers (spec 0039 R6/R7, carry-over 0038 D1) — inlined at
+# render time. Defines functions only: nothing runs on include, so a hook that
+# carries this partial pays parse time and no process.
+#
+# Depends on `payload`/`payload_field` (`extract-cmd`) and `nv_project_dir` /
+# `nv_progress_dir` (`hook-input`); include both in the same script.
+#
+# THE SUCCESS LANE. The host runs a criterion's `command` in its own Bash tool;
+# `PostToolUse` fires only on success, so this lane's very firing is the success
+# signal. It appends ONE line per matching pending criterion to
+# `<state dir>/workplan_<feature>.evidence.jsonl`, which `plan update` compares
+# against the criterion and the current tree (`lib/plan/evidence.ts`). It never
+# runs the criterion's command and never writes anything but that line.
+#
+# FAIL-OPEN, NO PARTIAL LINE. Every path returns 0. The line is built entirely in
+# memory and written by a single `printf >>` as the LAST step, so a kill at any
+# earlier point (the tree fingerprint is the slow part) leaves no line at all and
+# `plan update` rejects with "no run recorded".
+#
+# FAST PATH, BUILTINS ONLY. `acceptance-index` (rewritten by the CLI) holds
+# `<command JSON-escaped>\t<feature>\t<A<n>>\t<state dir>` per pending
+# criterion. The command is matched as the EXACT JSON string value of
+# `"command"` in the raw payload — no decoding, no normalization, no process.
+# A `tool_response` cannot forge a match: inside it every quote is `\"`.
+
+# Git with the repo-controlled code paths neutralized (invariant 9): fsmonitor is
+# a command git runs on index refresh, hooksPath redirects hooks. Same flags as
+# `GIT_HARDENING` in `lib/plan/evidence.ts`.
+navori_git() {
+  git -c core.fsmonitor=false -c core.hooksPath=/dev/null "$@"
+}
+
+# Content hash of the whole working tree — the SAME procedure as
+# `fingerprintTree` in `lib/plan/evidence.ts`, which `plan update` re-runs to
+# compare (change one, change both): no `git add` (filters/fsmonitor), blobs by
+# `hash-object --no-filters`, a scratch index, `write-tree`. Prints the tree hash
+# or returns 1. Exec bit is `[ -x ]` where the TypeScript side tests
+# `mode & 0o111`; they differ only for a file executable by group/other but not
+# by its owner, which then fails safe (plan update asks for a rerun).
+navori_tree_fingerprint() {
+  (
+    cd "$1" 2>/dev/null || exit 1
+    scratch=$(navori_git rev-parse --path-format=absolute --git-path navori-fp-index 2>/dev/null) || exit 1
+    [ -n "$scratch" ] || exit 1
+    [ ! -e "$scratch.lock" ] || exit 1
+    work=$(mktemp -d "${TMPDIR:-/tmp}/navori-fp.XXXXXX" 2>/dev/null) || exit 1
+    trap 'rm -f "$work"/list "$work"/files "$work"/links "$work"/paths "$work"/shas; rmdir "$work" 2>/dev/null' EXIT
+    navori_git ls-files -z --cached --others --exclude-standard --deduplicate -- . \
+      ':(exclude).navori/state' ':(exclude).claude/progress' ':(exclude).codex/progress' \
+      ':(exclude).claude/worktrees' > "$work/list" 2>/dev/null || exit 1
+    : > "$work/links"
+    while IFS= read -r -d '' p; do
+      case "$p" in *$'\n'*) exit 1 ;; esac
+      if [ -L "$p" ]; then
+        target=$(readlink "./$p") || exit 1
+        sha=$(printf '%s' "$target" | navori_git hash-object -w --no-filters --stdin 2>/dev/null) || exit 1
+        [ -n "$sha" ] || exit 1
+        printf '120000 %s\t%s\n' "$sha" "$p" >&3
+      elif [ -f "$p" ]; then
+        if [ -x "$p" ]; then mode=100755; else mode=100644; fi
+        printf '%s\t%s\n' "$mode" "$p"
+      fi
+    done < "$work/list" > "$work/files" 3>> "$work/links"
+    if [ -s "$work/files" ]; then
+      cut -f2- "$work/files" > "$work/paths"
+      navori_git hash-object -w --no-filters --stdin-paths < "$work/paths" > "$work/shas" 2>/dev/null || exit 1
+      [ "$(wc -l < "$work/paths" | tr -d ' ')" = "$(wc -l < "$work/shas" | tr -d ' ')" ] || exit 1
+      awk -F'\t' 'NR==FNR { m[FNR]=$1; p[FNR]=substr($0, index($0, "\t")+1); next } { printf "%s %s\t%s\n", m[FNR], $0, p[FNR] }' \
+        "$work/files" "$work/shas" >> "$work/links" || exit 1
+    fi
+    export GIT_INDEX_FILE=$scratch
+    navori_git read-tree --empty >/dev/null 2>&1 || exit 1
+    if [ -s "$work/links" ]; then
+      tr '\n' '\0' < "$work/links" | navori_git update-index --add -z --index-info >/dev/null 2>&1 || exit 1
+    fi
+    navori_git write-tree 2>/dev/null
+  )
+}
+
+# Escapes backslash and double quote for a JSON string value; prints it.
+navori_json_str() {
+  local s=$1
+  s=${s//\\/\\\\}
+  s=${s//\"/\\\"}
+  printf '%s' "$s"
+}
+
+# Repeat-failure state is shared by the PostToolUseFailure watcher and the
+# existing success lane. A successful Bash call only pays for Node when its
+# session already has a failure-state file; ordinary calls use builtins only.
+#
+# `action` is `reset`/`failure` (Claude: the event says which) or `codex`
+# (spec 0041 T12: Codex fires PostToolUse on failure too, so the OUTCOME is read
+# from the rollout, `$2` = its path, `$3` = the call's `tool_use_id`).
+navori_bash_failure_state() {
+  local action=$1 sid=${CLAUDE_CODE_SESSION_ID:-} dir file
+  if [ "$action" = codex ]; then
+    navori_plain_field session_id
+    sid=$navori_field
+  fi
+  case "$sid" in "" | *[!A-Za-z0-9._-]*) return 0 ;; esac
+  [ -n "${nv_project_dir:-}" ] || return 0
+  dir=$nv_project_dir/.navori/state/hooks/bash-outcome-watch
+  file=$dir/$sid
+  if [ "$action" = reset ]; then
+    [ -f "$file" ] && [ ! -L "$file" ] || return 0
+  fi
+  command -v node >/dev/null 2>&1 || return 0
+  NV_BASH_OUTCOME_ACTION=$action NV_BASH_OUTCOME_DIR=$dir NV_BASH_OUTCOME_FILE=$file \
+    NV_BASH_OUTCOME_SID=$sid NV_BASH_OUTCOME_TRANSCRIPT=${2:-} NV_BASH_OUTCOME_TOOL_USE=${3:-} \
+    NV_BASH_OUTCOME_ROOT=$nv_project_dir node -e '
+const fs = require("node:fs");
+const path = require("node:path");
+const crypto = require("node:crypto");
+const digest = (value) => crypto.createHash("sha256").update(value).digest("hex");
+const env = process.env;
+// Codex outcome (spec 0041 T12): the exit code of THIS call lives in the rollout
+// record `event_msg`/`item_completed` whose `item.id` is the `tool_use_id` of the call
+// (probe V4). Bounded to the tail of the file; only `exit_code` is read, never
+// the output fields. Anything missing or unreadable -> null -> silence.
+const codexExit = () => {
+  const max = 1048576;
+  const fd = fs.openSync(env.NV_BASH_OUTCOME_TRANSCRIPT, "r");
+  try {
+    const size = fs.fstatSync(fd).size;
+    const len = Math.min(size, max);
+    const buf = Buffer.alloc(len);
+    fs.readSync(fd, buf, 0, len, size - len);
+    const lines = buf.toString("utf8").split("\n");
+    for (let i = lines.length - 1; i >= 0; i--) {
+      const line = lines[i];
+      if (!line.includes(env.NV_BASH_OUTCOME_TOOL_USE) || !line.includes("item_completed")) continue;
+      let record;
+      try { record = JSON.parse(line); } catch { continue; }
+      const item = record?.payload?.item;
+      if (record?.type !== "event_msg" || record?.payload?.type !== "item_completed") continue;
+      if (item?.type !== "CommandExecution" || item?.id !== env.NV_BASH_OUTCOME_TOOL_USE) continue;
+      return Number.isInteger(item.exit_code) ? item.exit_code : null;
+    }
+    return null;
+  } finally { fs.closeSync(fd); }
+};
+let input = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => { input += chunk; });
+process.stdin.on("end", () => {
+  try {
+    const payload = JSON.parse(input);
+    if (payload.tool_name !== "Bash" || payload.session_id !== env.NV_BASH_OUTCOME_SID) return;
+    if (payload.is_interrupt === true || payload.tool_response?.is_interrupt === true) return;
+    const command = payload.tool_input?.command;
+    const cwd = payload.cwd;
+    if (typeof command !== "string" || !command.trim() || typeof cwd !== "string" || !cwd) return;
+    const agent = typeof payload.agent_id === "string" ? payload.agent_id : "";
+    let action = env.NV_BASH_OUTCOME_ACTION;
+    let exitCode = null;
+    if (action === "codex") {
+      exitCode = codexExit();
+      if (exitCode === null) return;
+      action = exitCode === 0 ? "reset" : "failure";
+    }
+    const key = digest(JSON.stringify([command.trim().replace(/\s+/g, " "), cwd, agent]));
+    const root = path.resolve(env.NV_BASH_OUTCOME_ROOT);
+    const dir = env.NV_BASH_OUTCOME_DIR;
+    const file = env.NV_BASH_OUTCOME_FILE;
+    if (dir !== path.join(root, ".navori/state/hooks/bash-outcome-watch")) return;
+    for (const component of [root, path.join(root, ".navori"), path.join(root, ".navori/state"), path.join(root, ".navori/state/hooks"), dir]) {
+      if (fs.existsSync(component)) {
+        if (!fs.lstatSync(component).isDirectory() || fs.lstatSync(component).isSymbolicLink()) return;
+      } else if (action === "failure") {
+        fs.mkdirSync(component);
+      } else return;
+    }
+    if (fs.existsSync(file) && (!fs.lstatSync(file).isFile() || fs.lstatSync(file).isSymbolicLink())) return;
+    let rows = fs.existsSync(file) ? fs.readFileSync(file, "utf8").split("\n").filter(Boolean).map((line) => JSON.parse(line)) : [];
+    if (!Array.isArray(rows) || rows.some((row) => typeof row.key !== "string" || typeof row.sig !== "string" || typeof row.count !== "number" || typeof row.epoch !== "number")) return;
+    if (action === "reset") {
+      const next = rows.filter((row) => row.key !== key);
+      if (next.length === rows.length) return;
+      rows = next;
+    } else {
+      const error = exitCode === null ? payload.error : "";
+      if (typeof error !== "string") return;
+      const match = exitCode === null ? /exit code\s+(\d+)/i.exec(error) : [null, String(exitCode)];
+      if (!match) return;
+      const code = match[1];
+      const escapedRoot = root.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const home = env.HOME ? env.HOME.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") : null;
+      const body = error.replace(/^.*exit code\s+\d+.*\r?\n?/im, "")
+        .replace(/\x1b\[[0-9;]*m/g, "")
+        .replace(new RegExp(escapedRoot, "g"), "<root>")
+        .replace(home ? new RegExp(home, "g") : /\b(?!x)x\b/g, "~")
+        .replace(/(?:\/tmp|\/private\/tmp|\/var\/folders)\/[^\s:]+/g, "<tmp>")
+        .replace(/\b\d{4}-\d\d-\d\d[T ]\d\d:\d\d:\d\d(?:\.\d+)?Z?\b/g, "<t>")
+        .replace(/\b\d\d:\d\d:\d\d(?:\.\d+)?\b/g, "<t>")
+        .replace(/\b\d+(?:\.\d+)?\s?(?:ms|seconds?|minutes?)\b/gi, "<d>")
+        .replace(/\b[0-9a-f]{8,}\b/gi, "<h>")
+        .split("\n").map((line) => line.trim()).filter(Boolean).slice(0, 20).join("\n");
+      if (!body && exitCode === null) return;
+      const sig = digest(code + "\n" + body);
+      const previous = rows.find((row) => row.key === key);
+      const count = previous?.sig === sig ? Math.min(previous.count + 1, 3) : 1;
+      const notified = previous?.sig === sig && previous.notified === true;
+      rows = rows.filter((row) => row.key !== key);
+      rows.push({ key, sig, count, notified: notified || count === 3, epoch: Date.now() });
+      if (count === 3 && !notified) {
+        const first = body.split("\n")[0].slice(0, 100);
+        const note = `navori: el comando ${command.trim().slice(0, 100)} falló 3 veces con la misma firma (exit ${code}${first ? ": " + first : ""}). Cambia de enfoque con debug-failure o escala al usuario. Si el rojo es intencional, ignora esta nota.`;
+        var output = note.slice(0, 400);
+      }
+    }
+    rows.sort((a, b) => b.epoch - a.epoch);
+    rows = rows.slice(0, 50);
+    const temp = file + "." + process.pid + ".tmp";
+    fs.writeFileSync(temp, rows.map((row) => JSON.stringify(row)).join("\n") + (rows.length ? "\n" : ""), { flag: "wx", mode: 0o600 });
+    fs.renameSync(temp, file);
+    if (output) process.stdout.write(output + "\n");
+  } catch { /* advisory: never change the tool result */ }
+});
+' <<< "$payload" 2>/dev/null || true
+  return 0
+}
+
+# A plain top-level string field of the raw payload, with builtins only (no
+# fork), into `navori_field`. Matches `"key":"value"` with an unescaped quote
+# before the colon, which a `tool_response` cannot forge (inside it every quote is
+# `\"`). Empty when absent, spaced or escaped: the caller treats that as silence.
+navori_plain_field() {
+  local needle="\"$1\":\"" rest
+  navori_field=
+  case "$payload" in *"$needle"*) ;; *) return 0 ;; esac
+  rest=${payload#*"$needle"}
+  navori_field=${rest%%\"*}
+  case "$navori_field" in *\\*) navori_field= ;; esac
+  return 0
+}
+
+# Spec 0041 T12 (R11): the Codex Bash outcome lane, run by `routing-watch.sh`
+# on `PostToolUse(Bash)` under Codex. Codex fires PostToolUse on failure too, so
+# the exit code is read from the rollout (`transcript_path`): a fixed-string grep
+# over the BOUNDED tail finds the `item_completed` record of this `tool_use_id`.
+# A success with no failure state costs no Node; everything else (a failure, or a
+# success that must reset a counter) goes through `navori_bash_failure_state`,
+# which parses only `exit_code`. FAIL-OPEN and silent: no rollout, no matching
+# record or an unreadable one means no advice. Prints the advice, if any.
+navori_bash_codex_outcome() {
+  local tid tp sid line
+  navori_plain_field tool_use_id
+  tid=$navori_field
+  navori_plain_field transcript_path
+  tp=$navori_field
+  navori_plain_field session_id
+  sid=$navori_field
+  case "$tid" in "" | *[!A-Za-z0-9._:-]*) return 0 ;; esac
+  case "$sid" in "" | *[!A-Za-z0-9._-]*) return 0 ;; esac
+  case "$tp" in *.jsonl) ;; *) return 0 ;; esac
+  [ -f "$tp" ] && [ -r "$tp" ] || return 0
+  line=$(tail -c 1048576 "$tp" 2>/dev/null | grep -F -- "$tid" 2>/dev/null | grep -F '"item_completed"' 2>/dev/null | tail -n 1)
+  [ -n "$line" ] || return 0
+  case "$line" in
+    *'"exit_code":0,'* | *'"exit_code":0}'*)
+      [ -f "${nv_project_dir:-}/.navori/state/hooks/bash-outcome-watch/$sid" ] || return 0
+      ;;
+  esac
+  navori_bash_failure_state codex "$tp" "$tid"
+  return 0
+}
+
+# Called by `routing-watch.sh` once it knows the tool is `Bash`, and only under
+# `claude-post-tool-use` (Codex fires PostToolUse on failure too, so no signal).
+navori_bash_success_lane() {
+  local idx=$nv_project_dir/$nv_progress_dir/acceptance-index
+  [ -s "$idx" ] || return 0
+  # A backgrounded call "succeeds" when it LAUNCHES, not when it finishes; an
+  # interrupted one did not complete.
+  case "$payload" in
+    *'"run_in_background":true'* | *'"interrupted":true'*) return 0 ;;
+  esac
+  local c f i d hits=
+  while IFS=$'\t' read -r c f i d; do
+    [ -n "$c" ] || continue
+    case "$payload" in
+      *'"command":"'"$c"'"'[,}]*) hits="$hits$c"$'\t'"$f"$'\t'"$i"$'\t'"$d"$'\n' ;;
+    esac
+  done < "$idx"
+  [ -n "$hits" ] || return 0
+
+  # Slow path: exactly one criterion command ran. Everything is computed first,
+  # the write is last.
+  local cwd tree head wt htree dirty sid agent ts root
+  cwd=$(payload_field cwd)
+  [ -n "$cwd" ] || return 0
+  tree=$(navori_git -C "$cwd" rev-parse --show-toplevel 2>/dev/null) || return 0
+  case "$cwd$tree" in *[[:cntrl:]]*) return 0 ;; esac
+  head=$(navori_git -C "$tree" rev-parse HEAD 2>/dev/null) || head=
+  wt=$(navori_tree_fingerprint "$tree") || return 0
+  [ -n "$wt" ] || return 0
+  htree=$(navori_git -C "$tree" rev-parse 'HEAD^{tree}' 2>/dev/null) || htree=
+  dirty=true
+  [ "$wt" = "$htree" ] && dirty=false
+  sid=$(payload_field session_id | tr -cd 'A-Za-z0-9._-')
+  agent=$(payload_field agent_id | tr -cd 'A-Za-z0-9._-')
+  ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+  root=$(pwd -P 2>/dev/null) || root=$nv_project_dir
+
+  local line extra file
+  while IFS=$'\t' read -r c f i d; do
+    [ -n "$f" ] || continue
+    # The index is CLI-written state, but the hook is the one that opens a path
+    # taken from it: slug and id shapes, an absolute directory inside this
+    # project, no symlinks.
+    case "$f" in *[!a-z0-9._-]* | [!a-z0-9]*) continue ;; esac
+    case "$i" in
+      A[0-9]*) case "${i#A}" in *[!0-9]*) continue ;; esac ;;
+      *) continue ;;
+    esac
+    case "$d" in "$root"/* | "$nv_project_dir"/*) ;; *) continue ;; esac
+    case "$d" in *[[:cntrl:]]* | */../* | */..) continue ;; esac
+    [ -d "$d" ] && [ ! -L "$d" ] || continue
+    file=$d/workplan_$f.evidence.jsonl
+    [ ! -L "$file" ] || continue
+    # `$c` is already JSON-escaped: it is the index's own field.
+    extra=
+    [ -z "$sid" ] || extra=$extra',"sessionId":"'$sid'"'
+    [ -z "$agent" ] || extra=$extra',"agentId":"'$agent'"'
+    line='{"ts":"'$ts'","feature":"'$f'","id":"'$i'","command":"'$c'","tree":"'$(navori_json_str "$tree")'","cwd":"'$(navori_json_str "$cwd")'","head":"'$head'","worktreeTree":"'$wt'","dirty":'$dirty$extra'}'
+    printf '%s\n' "$line" >> "$file" 2>/dev/null || true
+  done <<NAVORI_HITS
+$hits
+NAVORI_HITS
+  return 0
+}

package/dist/assets/core/core-assets/hooks/_partials/gate-ask.sh

@@ -0,0 +1,25 @@
+# Can this gate hand a no-verdict outcome to the user instead of blocking?
+# Inlined at render time (see lib/render/hook-includes.ts). Decides only; the
+# JSON that speaks to the host stays in each script (partials never carry host
+# output vocabulary — hook-output-contract.test.ts).
+#
+# WHY (#1117): when the TOOL failed (scanner missing a flag, declared runner not
+# on PATH) the gate has no verdict, and "run it yourself outside the agent" is a
+# dead end. Claude Code's PreToolUse can ask the human; that is the right exit.
+#
+# Returns 0 only when ALL hold; any doubt is "no", and "no" is today's block:
+#   - the script is not a Codex copy (Codex drops `permissionDecision`, so an
+#     ask there would let the call PROCEED unasked). Decided by WHERE THE SCRIPT
+#     LIVES, the same rule as the hook-input partial; hooks live in `.codex/hooks/`,
+#     plugin scripts in `.codex/scripts/`.
+#   - the payload is a real PreToolUse hook call. A git hook or the CLI
+#     (`</dev/null`) has no payload, so there is nobody to ask.
+#   - jq exists to build the reason JSON safely; without it, block.
+# Needs `payload`/`payload_field` from the extract-cmd partial.
+navori_can_ask() {
+  case "$0" in
+    *".codex/hooks/"* | *".codex/scripts/"*) return 1 ;;
+  esac
+  command -v jq >/dev/null 2>&1 || return 1
+  [ "$(payload_field hook_event_name)" = "PreToolUse" ]
+}

package/dist/assets/core/core-assets/hooks/_partials/hook-input.sh

@@ -90,6 +90,39 @@ nv_subagent_type() {
   fi
 }
 
+# The agent a spawn call TARGETS, never the one that makes the call (spec 0041
+# H16). Claude: `tool_input.subagent_type`. Codex PreToolUse/PostToolUse of a
+# spawn: `tool_input.agent_type` only — the top-level `agent_type` there is the
+# CALLER's. On `SubagentStop` the top-level `agent_type` IS the finishing
+# subagent, so that event reads it instead.
+nv_spawn_target_type() {
+  if [ "$nv_engine" = codex ]; then
+    case "$(payload_field hook_event_name)" in
+      SubagentStop) payload_field agent_type ;;
+      *) payload_field tool_input.agent_type ;;
+    esac
+  else
+    payload_field tool_input.subagent_type
+  fi
+}
+
+# The agent RUNNING the current event: the top-level `agent_type`, which the
+# host adds only inside a subagent (empty on the main thread). Never confuse it
+# with `nv_spawn_target_type` (H16). `nv_subagent_type` above keeps its legacy
+# mixed behaviour for existing hooks; new code uses these two helpers.
+nv_event_agent_type() {
+  payload_field agent_type
+}
+
+# True for the spawn tool: Codex V1 `spawn_agent`, or any V2 name that ends in
+# `spawn_agent` (V2 flattens the namespace into the tool name).
+nv_is_spawn_tool() {
+  case "$(payload_field tool_name)" in
+    *spawn_agent) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
 # Deliberately NO `nv_emit_context` helper here. `hook-output-contract.test.ts`
 # ("los partials no hablan con el host, solo escriben al log") holds every
 # `_partials/*.sh` file to zero host-output vocabulary — a partial is inlined