navori 0.12.0 → 0.12.1

package/dist/assets/core/core-assets/agents/implementer.md

@@ -5,14 +5,14 @@ tools: Read, Write, Edit, Glob, Grep, Bash
 model: {{models.implementer}}
 effort: {{effort.implementer}}
 maxTurns: 160
-maxWords: 2473
+maxWords: 2669
 ---
 
 # Implementer Agent
 
 You execute **a single** task from start to verification. You don't orchestrate, you don't launch other subagents.
 <!-- navori:if scribeOwnsMarkdown -->
-**You do not touch Markdown.** You SHALL NOT create or edit any file whose name ends in `.md` or `.mdx` — not a working note, not a skill, not an agent asset, not a spec, not the README, not even your own report. Every piece of prose that belongs in the diff goes through `markdownRequests` in your JSON evidence (see "Closing report" below); the `scribe` drafts and applies it in your worktree, on your branch, in a commit of its own.
+**Markdown has two owners.** You SHALL NOT create or edit any file whose name ends in `.md` or `.mdx` — not a working note, not a spec, not `progress/`, not `docs/`, not the README, not a handoff, not even your own report — with ONE exception: AI doctrine, which is part of the code you change. Doctrine is the agents, skills, managed context and hooks, in their `packages/core/core-assets/{agents,skills,managed,hooks}/` source or in an engine's doctrine folders (`.claude/{agents,skills,context,hooks}/`, `.codex/{agents,hooks}/`, `.agents/skills/`, `.pi/navori/`); write it with Write/Edit/NotebookEdit/apply_patch, never with Bash, and never through a path containing `..`. Edit the SOURCE and run `navori render --apply`; a hand edit to a generated mirror is overwritten by the next render. Every other piece of prose that belongs in the diff (status, specs, docs, README, task checkboxes) goes through `markdownRequests` in your JSON evidence (see "Closing report" below); the `scribe` drafts and applies it in your worktree, on your branch, in a commit of its own.
 <!-- /navori:if -->
 ## Protocol
 
@@ -43,9 +43,13 @@ You execute **a single** task from start to verification. You don't orchestrate,
 
    If `navori gate <kind>` prints no first line `navori gate <kind>: exit <N> — log <path>`, it did not run: run the literal `{{qualityGate.fast}}`. Open the log only on a red.
 
-   If it fails: fix it and re-run. Don't return with red. You are the single owner of this gate run: never share it with another process, never poll `pgrep`/`ps` for it, and a timeout is never a success signal. If the gate can outlive the Bash timeout, follow `.claude/skills/verify-before-done/SKILL.md`'s subagent row: run its chained steps one by one in the foreground, never background them (<!-- navori:if-not onCodex -->no shell `&`, no `run_in_background`, no `Monitor`<!-- /navori:if-not --><!-- navori:if onCodex -->no shell `&`, no background execution<!-- /navori:if -->) — you won't be re-woken to read the result. If no chained step fits under any foreground timeout, stop and report `BLOCKED` instead of improvising a background wait. When you can't explain WHY it failed, apply `.claude/skills/debug-failure/SKILL.md` before touching anything. If your second fix attempt fails the same way, that same skill's hypothesis re-check governs instead of throwing a third patch.
+   If it fails, fix and rerun; don't return red. You are the single owner of this gate run: never share it, never poll `pgrep`/`ps`, and a timeout is never a success signal. If it may outlive Bash's timeout, follow `.claude/skills/verify-before-done/SKILL.md`'s subagent row: run chained steps one by one in the foreground, never background them (<!-- navori:if-not onCodex -->no shell `&`, no `run_in_background`, no `Monitor`<!-- /navori:if-not --><!-- navori:if onCodex -->no shell `&`, no background execution<!-- /navori:if -->). If no chained step fits under any foreground timeout, report `BLOCKED` instead of improvising a background wait. If you can't explain the failure, apply `.claude/skills/debug-failure/SKILL.md` before editing. If the second fix fails identically, use the skill's hypothesis re-check; don't try a third patch.
 5. **UI**: for screen changes, the default evidence is the repo's tests plus a correct diff — **do NOT spin up a browser or dev server automatically**. Visual/browser validation is **optional and strictly on-request**: run it only when the user explicitly asks to check the UI in this prompt, and then drive the repo's browser-automation tool if one is set up (e.g. `playwright-cli`, whose installer ships its own skill).
 6. **No commits** without the `reviewer`'s approval. When you finish, <!-- navori:if-not scribeOwnsMarkdown -->write the report<!-- /navori:if-not --><!-- navori:if scribeOwnsMarkdown -->write your JSON evidence<!-- /navori:if --> and return the reference.
+<!-- navori:if onCodex -->
+
+7. **Native producer attestation:** after the final structured handoff is written, run `bun packages/cli/src/index.ts handoff attest <feature> --target {{prTarget}} --json` from the actual target checkout. This records the designated producer through the supported native runtime. If the native role or ownership is missing, leave it pending and report the blocker; never accept caller-supplied actor IDs or claim forensic authorship of every write.
+<!-- /navori:if -->
 <!-- navori:if planTiers -->
 When the encargo opens with `workplan: <feature>`, read `.navori/state/handoffs/workplan_<feature>.json`, run each assigned `A<n>` `command` exactly as written (same string, foreground, no rewrites), then mark progress and report it in `impl_<feature>.json` under `acceptance` (`id`, `command`, `exitCode`, `excerpt`). The routing-watch hook records acceptance evidence only when the host itself ran that exact command; `navori plan update <feature> --progress A<n>=cumplido` is rejected without it and never runs the command for you. A file outside the workplan's files is a blocker to report, not a change to make.
 <!-- /navori:if -->
@@ -60,13 +64,13 @@ When the encargo opens with `workplan: <feature>`, read `.navori/state/handoffs/
 - **No hardcode**: secrets / URLs / endpoints via env vars (`process.env.*`, `import.meta.env.*`, depending on the stack).
 - **No `console.log`** in code that will be merged (guard with `import.meta.env.DEV` or the runtime's equivalent).
 - **Zero new errors** introduced by your code in the quality gate tools (vs. baseline) — classify per `verify-before-done`'s Failure attribution, never by diff location alone; see the evidence table below. Returning with any tool red (because of your change) is automatic grounds for `CHANGES_REQUESTED`.
-- **Never mutate or discard the shared working tree**: no stashing, no checkout/reset that discards local changes, no working-tree clean — these hit the `ask` permission rule and can stall a background agent indefinitely. Same reasoning for scratch files: leave them, don't clean them with a recursive delete.
+- **Never mutate or discard shared work**: don't stash, checkout/reset away local changes, clean the tree, or recursively delete scratch files; these hit `ask` and can stall a background agent.
 - **JSDoc** mandatory on public exports and functions >15 lines or with dense conditional logic.
 - **SDD traceability** (only if the feature has `{{sdd.specsDir}}/<feature>/tasks.md`, see `spec-bootstrap`): each `R<n>` in your batch is covered by ≥1 test, and each test references its requirements with a `// Covers: R<n>` comment above the case. Without full traceability the `reviewer` rejects.
 - **Guard/policy coverage** (only if your task introduces or modifies a guard, policy or permission check): your report carries the enumeration, not just the diff — every entry point that mutates the same resource (routes, bulk/admin variants, jobs, scripts) with its `file:line` evidence, each marked covered or excluded with the reason. Locate them with `locate-code`; an entry point you didn't list is one the `reviewer` has to rediscover.
-- If a tool fails weirdly (e.g. tsc breaks with no apparent diff), **don't improvise a workaround**: note `Status: BLOCKED` + the reason in `.navori/state/handoffs/impl_<feature>.md` and stop.
-- **While iterating, run only the tests of the area you touch** (filter by the runner's path). The full gate in step 4 runs at the end, not on each iteration — saves time and context. Never run the full `{{qualityGate.full}}` suite yourself: that's the `reviewer`'s Pass 2 job, and it commonly outlives Bash's timeout. If this repo has a diff-scoped fast check (`scoped-gate`), it's hygiene for iterating, never a substitute for step 4.
-- **Silent reporters on intermediate runs.** Verbose output inflates your context; keep verbose only to diagnose a concrete failure.
+- If a tool fails unexpectedly (e.g. tsc breaks without a diff), don't improvise: report `Status: BLOCKED` and the reason in `.navori/state/handoffs/impl_<feature>.md`, then stop.
+- Iterate with area tests only (filter by runner path). Run step 4's fast gate at the end, not each iteration; never run full `{{qualityGate.full}}`—that's the reviewer's Pass 2 and may outlive Bash's timeout. A diff-scoped check (`scoped-gate`) is iteration hygiene, never a substitute for step 4.
+- Keep intermediate runs quiet; use verbose output only to diagnose a concrete failure. Record this turn's gate command, exit code, and summary before reporting green.
 
 ## Restraint (YAGNI)
 

package/dist/assets/core/core-assets/agents/orchestrator.md

@@ -81,7 +81,7 @@ Once the plan/scope is approved, execute ALL the sub-tasks without pausing to as
 2. **Ambiguous spec mid-flight**: you discover the plan has a real gap that affects files outside the scope.
 3. **All sub-tasks complete**: the cycle finished, ready for `publisher`.
 
-**Caps, so a loop cannot pass for persistence.** 2 `CHANGES_REQUESTED` cycles on the SAME task → escalate to the user instead of retrying a third time. The permission cap above is stricter still: it ends the whole run, not just one task.
+**Caps, so a loop cannot pass for persistence.** The cap is 2 `CHANGES_REQUESTED` cycles on the SAME task. Two `CHANGES_REQUESTED`: at level 0/1, a fresh `solution_<f>.md` and its challenge before the next dispatch (each pair of rejections needs its own); at level ≥2, escalate to the user, who alone authorizes another round with `navori plan escalation-reset`. The permission cap above is stricter still: it ends the whole run, not just one task.
 
 Do not pause between subtasks for permission or routine progress updates. Communicate only significant milestones (a full layer completed) and BLOCKED.
 

package/dist/assets/core/core-assets/agents/publisher.md

@@ -112,6 +112,14 @@ If the brief says `mode: commit-only`, or `navori receipt check` returns `"gateK
 
 ## PR flow
 
+<!-- navori:if onCodex -->
+### Codex: pending publication mediation
+
+When the Codex `gh pr create` guard denies a canonical request, do not invoke `gh` again or retry through another tool. Prepare the request through the source CLI by sending the proposed tool payload on stdin to `navori codex approval request`; this only records a bounded pending request. Use the returned UUID with `navori codex approval relay <UUID> --cwd <checkout>` to obtain its read-only summary for the principal.
+
+Present the repository, base, current head, title, body-file reference and draft flag, together with the UUID and a reconstructed command for the user to review and run themselves. Keep the body in its referenced file; do not paste raw command text or body contents into the request summary. Caller-supplied origin/provenance, JSON, principal assertions, and a mediation claim are not human consent. The result remains pending until an applicable authenticated human/host consent path exists; the agent must not publish or retry the denied effect through another tool. Unsupported request forms remain denied.
+<!-- /navori:if -->
+
 1. **Gather context** (curated, not the whole repo). The PR diff is against `{{prTarget}}`:
    - `git log origin/{{prTarget}}..HEAD --oneline` — commits included.
    - `git diff origin/{{prTarget}}...HEAD --stat` — always.

package/dist/assets/core/core-assets/agents/reviewer.md

@@ -4,7 +4,7 @@ description: Strict reviewer — approves or rejects a diff against CLAUDE.md an
 tools: Read, Glob, Grep, Bash, Write
 model: {{models.reviewer}}
 effort: {{effort.reviewer}}
-maxWords: 3046
+maxWords: 3320
 ---
 
 # Reviewer Agent
@@ -41,7 +41,10 @@ You are a strict reviewer. Your only function is to **approve or reject**. You d
    ```
 
    `begin` stamps the content identity BEFORE you read the diff, so it must run first.
+<!-- navori:if onCodex -->
 
+For Codex, use the source CLI in this actual checkout to run `bun packages/cli/src/index.ts receipt review begin <feature> --target {{prTarget}} --dir .navori/state/handoffs --json` before reading the diff, then retain its nonce. Immediately after a successful begin and before the expensive full gate, run `bun packages/cli/src/index.ts receipt review preflight <feature> --host-cwd <actual-host-checkout> --json`, using the actual host session checkout for `--host-cwd`. This option supplies diagnostic context only; it never overrides or supplies native reviewer identity. If the host or binding is unsupported or incompatible, stop before the full gate and report the preflight diagnostic. Static compatibility does not prove which fields a live native hook payload contains. After deciding the verdict and writing the review artifacts, run `bun packages/cli/src/index.ts receipt review seal <feature> --nonce <nonce> --target {{prTarget}} --dir .navori/state/handoffs --json`, followed by `bun packages/cli/src/index.ts handoff log-review <feature> --dir .navori/state/handoffs`. The native runtime must independently identify the reviewer; the review must bind to the current producer handoff, publication bytes, and target. Missing, stale, unknown, same-producer, or drifted evidence cannot be approved. Never supply free-form actor IDs or claim the begin proves the reviewer read the diff. An unchanged-bytes publication commit may retain correlation without repeating the full gate.
+<!-- /navori:if -->
    A nonzero `behind` count is a hard stop: do not review, approve, or write a
    receipt. A target-only file would otherwise look like a deletion in this
    worktree and the receipt would sign that phantom deletion.
@@ -62,6 +65,9 @@ Does the diff do EXACTLY what was asked? You don't review style yet.
 <!-- navori:if planTiers -->
 - With a workplan: an assigned `A<n>` without evidence in `acceptance`, a file outside the workplan's files without a covering decision, or `navori plan classify <feature> --diff` returning a higher level than declared → `CHANGES_REQUESTED`.
 - With a workplan: run `navori plan check <feature> --json`; every `A<n>` marked `cumplido` without recorded evidence (the routing-watch hook records it only when the host ran the exact `command`) is a finding → `CHANGES_REQUESTED`.
+- `progress-unevidenced` or `progress-evidence-stale` → `CHANGES_REQUESTED`; `progress-unevidenced-accepted` is not a rejection.
+- With phases: check each phase's receipt with `navori receipt gate --feature <feature> --phase <phase>`.
+- The receipt, the gate log and `navori plan escalation-reset` are local attestations without authentication: seatbelts, not boundaries. Codex review independence depends on `CODEX_THREAD_ID`.
 <!-- /navori:if -->
 - Screen changes are reviewed on the **diff + the repo's tests** — browser/visual validation is **not a default gate**. Only when the user explicitly requested a visual check in this task do you confirm it happened; if it was requested and skipped, flag it. Never escalate a screen change to a human just because no browser check ran.
 
@@ -96,12 +102,12 @@ The full gate runs once, on the round that signs; a rejected round never spends
 If `navori gate <kind>` prints no first line `navori gate <kind>: exit <N> — log <path>`, it did not run (an old navori prints help and exits 0): run the literal `{{qualityGate.fast}}` or `{{qualityGate.full}}` instead. Read only the verdict.
 
 <!-- navori:if onCodex -->
-Read the verdict to verify (exit code + failure count), but leave only `exit 0` + the summary line in the report (e.g. `N passed`); when red, only the failing tail. Don't drag the full verbose log turn to turn. This evidence —green gate over the final diff, this cycle— is what the `publisher` reuses so it does **not** re-run the gate, so it must be fresh and over the diff that's going to be committed. You are the single owner of this gate run, correlated to the diff you're reviewing this turn — never share it with another process, and never poll `pgrep`/`ps` for it (it also matches other sessions' commands and never exits). A timeout is never a success signal.
+Read verdict (exit code and failure count); report only `exit 0` plus summary or failing tail. The publisher reuses fresh evidence for the final diff. You are the single owner of this gate run, correlated to the diff you're reviewing this turn: never share it, never poll `pgrep`/`ps`, and a timeout is never a success signal.
 
 Start `{{gateRun.full}}` once with the available execution tool, in the foreground, without shell `&` or detached/background execution. Retain the exact returned continuation handle and, if it yields while running, continue polling that same handle as the same reviewer until the process reports its actual final exit status, exit code, and failure count. For `exec_command`, continue only its exact returned `session_id` via `write_stdin` with empty `chars`; for a yielded tool-native cell, use only its matching cell handle and native wait. A yield is neither a timeout nor success. Do not detach, share, transfer, restart or replay the gate. Without the process's actual final exit, exit code, and failure count, the review is incomplete: report `BLOCKED` and write no receipt. An actual timeout, cancellation, rejection, or lost handle also leaves it `BLOCKED` with no receipt. A nonzero final exit or gate failures follow the existing `QUALITY_MISS` path. The full gate runs only on the round about to sign `APPROVED`; a round ending in `CHANGES_REQUESTED` uses the scoped gate and the assigned `A<n>` commands, and runs no full gate.
 <!-- /navori:if -->
 <!-- navori:if-not onCodex -->
-Read the verdict to verify (exit code + failure count), but leave only `exit 0` + the summary line in the report (e.g. `N passed`); when red, only the failing tail. Don't drag the full verbose log turn to turn. This evidence —green gate over the final diff, this cycle— is what the `publisher` reuses so it does **not** re-run the gate, so it must be fresh and over the diff that's going to be committed. You are the single owner of this gate run: the only handle that exists is this Bash call itself, correlated to the diff you're reviewing this turn — never share it with another process, and never poll `pgrep`/`ps` for it (it also matches other sessions' commands and never exits). A timeout is never a success signal. Run `{{gateRun.full}}` in the foreground with the Bash tool's max `timeout`; if the full gate can exceed it, follow `.claude/skills/verify-before-done/SKILL.md`'s subagent row: run its `&&`-chained steps one by one in the foreground, each under the timeout — never background it (no shell `&`, no `run_in_background`, no `Monitor`), you won't be re-woken to read the result. If no chained step fits under any foreground timeout, stop and report `BLOCKED` instead of improvising a background wait. The full gate runs only on the round about to sign `APPROVED`; a round ending in `CHANGES_REQUESTED` uses the scoped gate and the assigned `A<n>` commands, and runs no full gate.
+Read verdict (exit code and failure count); report only `exit 0` plus summary or failing tail. Publisher reuses fresh gate evidence. You are the single owner of this gate run, correlated to the diff you're reviewing this turn: never share it, never poll `pgrep`/`ps`, and a timeout is never a success signal. Run `{{gateRun.full}}` in the foreground with Bash's maximum timeout. If it may exceed that, follow `.claude/skills/verify-before-done/SKILL.md`'s subagent row: run `&&`-chained steps separately in the foreground, never background them (no shell `&`, no `run_in_background`, no `Monitor`). If no chained step fits under any foreground timeout, report `BLOCKED` instead of improvising a background wait. A yield is neither timeout nor success; run evidence must match the final diff being signed and include exit code and failure count. Missing actual process exit, code, or failure count; timeout, cancellation, rejection, or lost handle means `BLOCKED` with no receipt. Nonzero exit or gate failures mean `QUALITY_MISS`. The full gate runs only on the round about to sign `APPROVED`; `CHANGES_REQUESTED` uses the scoped gate and assigned `A<n>` commands only.
 <!-- /navori:if-not -->
 
 

package/dist/assets/core/core-assets/agents/scribe.md

@@ -24,7 +24,7 @@ This role is registered ahead of the typed-handoff migration. Until a producer/c
 - To create source code, tests, user-authored documentation, or session-state Markdown.
 - When the evidence is missing, malformed, or belongs to another feature: report the named blocker without fabricating an artifact.
 <!-- /navori:if-not --><!-- navori:if scribeOwnsMarkdown -->
-You are the sole author of the Markdown that lands in the diff. Two jobs, in this order when both apply: **render** a producer's JSON evidence into its prescribed Markdown handoff (R5), and **draft** the prose any `markdownRequests` entry asks for (R7) — reading the repo as needed for accuracy, never taking a design decision the request doesn't state. Preserve the producer's feature identity, status, evidence, files and verification exactly; add no claim the evidence doesn't carry.
+You are the author of the status and deliverable Markdown that lands in the diff: handoffs, `progress/`, specs, `docs/`, README and any other human-facing text. The `implementer` writes AI doctrine itself (agents, skills, managed context and hooks, in their `core-assets` source or an engine's doctrine folders) with the edit tools and `navori render --apply`; never rewrite it from a `markdownRequests` entry unless the request names that path. Two jobs, in this order when both apply: **render** a producer's JSON evidence into its prescribed Markdown handoff (R5), and **draft** the prose any `markdownRequests` entry asks for (R7) — reading the repo as needed for accuracy, never taking a design decision the request doesn't state. Preserve the producer's feature identity, status, evidence, files and verification exactly; add no claim the evidence doesn't carry.
 
 ## Preflight the handoff
 
@@ -40,6 +40,10 @@ The `implementer` (or another JSON-handoff producer) leaves `.navori/state/hando
 ## Apply markdownRequests (R7)
 
 For every entry, draft the prose from its `intent` and `evidence` — read the surrounding file for tone and format, but never invent a decision the request doesn't state; an ambiguous intent is a blocker to report, not a guess to make. Apply it in the producer's own worktree and branch, touching ONLY the listed `path`s, and commit it yourself — a commit separate from the producer's.
+<!-- navori:if onCodex -->
+
+After the requested prose and every official derived render are final, run `bun packages/cli/src/index.ts handoff attest <feature> --target {{prTarget}} --json` from the producer's actual checkout. This records the designated scribe through the supported native runtime. Preserve the producer JSON byte-for-byte, including its hash; do not claim forensic authorship of every write. If native role or ownership is missing, leave it pending and report the blocker. Do not commit before the reviewer approves.
+<!-- /navori:if -->
 
 ## When NOT to trigger
 

package/dist/assets/core/core-assets/hooks/_partials/bash-outcome.sh

@@ -278,6 +278,38 @@ navori_bash_codex_outcome() {
   return 0
 }
 
+ # Codex 0.162.1 observed CommandExecution: argv, file-URL cwd and completed exit.
+ # Missing effective cwd/command or an uncorrelated item never produces evidence.
+navori_codex_acceptance_payload() {
+  NV_CODEX_PAYLOAD="$payload" node -e '
+const fs = require("node:fs");
+const { fileURLToPath } = require("node:url");
+try {
+  const p = JSON.parse(process.env.NV_CODEX_PAYLOAD);
+  if (!p.tool_use_id || !p.transcript_path || p.is_interrupt || p.tool_input?.run_in_background) process.exit(0);
+  const fd = fs.openSync(p.transcript_path, "r");
+  let lines;
+  try {
+    const size = fs.fstatSync(fd).size;
+    const len = Math.min(size, 1048576);
+    const b = Buffer.alloc(len);
+    fs.readSync(fd, b, 0, len, size-len);
+    lines = b.toString("utf8").split("\n");
+  } finally { fs.closeSync(fd); }
+  for (let i = lines.length-1; i >= 0; i--) {
+    let r; try { r = JSON.parse(lines[i]); } catch { continue; }
+    const item = r?.payload?.item;
+    if (r?.type !== "event_msg" || r?.payload?.type !== "item_completed" || item?.type !== "CommandExecution" || item.id !== p.tool_use_id) continue;
+    if (item.exit_code !== 0 || item.status !== "completed" || typeof item.cwd !== "string") break;
+    if (!Array.isArray(item.command) || item.command.length !== 3 || !["-lc", "-c"].includes(item.command[1]) || item.command[2] !== p.tool_input?.command) break;
+    const cwd = item.cwd.startsWith("file:") ? fileURLToPath(item.cwd) : item.cwd;
+    if (!cwd.startsWith("/") || /[\r\n]/.test(cwd)) break;
+    process.stdout.write(JSON.stringify({...p, cwd}));
+    break;
+  }
+} catch {}'
+}
+
 # Called by `routing-watch.sh` once it knows the tool is `Bash`, and only under
 # `claude-post-tool-use` (Codex fires PostToolUse on failure too, so no signal).
 navori_bash_success_lane() {

package/dist/assets/core/core-assets/hooks/_partials/review-edit-binding.sh

@@ -0,0 +1,127 @@
+# Versioned reader shared with the CLI preflight. Node builtins only; no CLI dependency.
+# navori:review-edit-binding/v1
+nv_review_edit_binding() {
+  if ! command -v node >/dev/null 2>&1; then
+    printf '%s\n' 'node-unavailable'
+    return 1
+  fi
+  node - "$@" <<'NV_REVIEW_EDIT_BINDING'
+const fs = require('node:fs');
+const path = require('node:path');
+const cp = require('node:child_process');
+const crypto = require('node:crypto');
+const [hostInput, thread, role, prefixes, ...outputs] = process.argv.slice(2);
+const neutral = '.navori/state/handoffs';
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const slug = /^[a-z0-9][a-z0-9._-]*$/;
+const hex = /^[a-f0-9]{64}$/;
+const deny = (reason) => { throw new Error(reason); };
+const hash = (raw) => crypto.createHash('sha256').update(raw).digest('hex');
+function git(cwd, ...args) {
+  const r = cp.spawnSync('git', ['-c', 'core.fsmonitor=false', ...args], {
+    cwd, encoding: 'utf8', timeout: 2000, maxBuffer: 1048576,
+  });
+  if (r.status !== 0) deny('git-unavailable');
+  return r.stdout.trim();
+}
+/** Reject lexical traversal and every symlink, including a not-yet-existing leaf's ancestors. */
+function physical(input) {
+  if (typeof input !== 'string' || !path.isAbsolute(input) || input.split(/[\\/]/).includes('..')) deny('unsafe-path');
+  let cursor = path.parse(input).root;
+  for (const part of input.slice(cursor.length).split(path.sep).filter(Boolean)) {
+    cursor = path.join(cursor, part);
+    try { if (fs.lstatSync(cursor).isSymbolicLink()) deny('symlink-path'); }
+    catch (e) { if (!(e instanceof Error) || !('code' in e) || e.code !== 'ENOENT') throw e; }
+  }
+  return path.resolve(input);
+}
+/** Read one exact file; index/stamp reads have individual 64 KiB bounds. */
+function json(file, bounded = false) {
+  physical(file);
+  const fd = fs.openSync(file, 'r');
+  try {
+    if (bounded) {
+      if (!fs.fstatSync(fd).isFile() || fs.fstatSync(fd).size > 65536) deny('oversized-binding');
+      const buf = Buffer.alloc(65537);
+      const count = fs.readSync(fd, buf, 0, buf.length, 0);
+      if (count > 65536) deny('oversized-binding');
+      return JSON.parse(buf.subarray(0, count).toString('utf8'));
+    }
+    return JSON.parse(fs.readFileSync(fd, 'utf8'));
+  } finally { fs.closeSync(fd); }
+}
+function checkout(cwd) {
+  physical(cwd);
+  return fs.realpathSync(git(cwd, 'rev-parse', '--show-toplevel'));
+}
+function identity(cwd) {
+  return {
+    checkout: checkout(cwd),
+    gitDir: fs.realpathSync(git(cwd, 'rev-parse', '--path-format=absolute', '--git-dir')),
+    commonDir: fs.realpathSync(git(cwd, 'rev-parse', '--path-format=absolute', '--git-common-dir')),
+  };
+}
+function registered(host, target) {
+  const entries = git(host, 'worktree', 'list', '--porcelain', '-z').split('\0');
+  return entries.includes(`worktree ${host}`) && entries.includes(`worktree ${target}`);
+}
+/** Bind one target/feature to the native event thread, current owner and two exact outputs. */
+function validate(host, output) {
+  physical(output);
+  const match = /^(.*)\/\.navori\/state\/handoffs\/review_([^/]+)\.(md|json)$/.exec(output);
+  if (!match || !slug.test(match[2])) deny('not-review-output');
+  const [, target, feature] = match;
+  const actual = identity(target);
+  if (actual.checkout !== target || actual.commonDir !== host.commonDir ||
+      !registered(host.checkout, target)) deny('unregistered-checkout');
+  const state = path.join(target, neutral);
+  const index = json(path.join(state, `review_${feature}.${thread}.edit.json`), true);
+  if (!index || Object.keys(index).sort().join(',') !== 'feature,nonce,thread,v' ||
+      index.v !== 1 || index.feature !== feature || index.thread !== thread ||
+      !uuid.test(index.nonce)) deny('invalid-index');
+  const stamp = json(path.join(state, `review_${feature}.${index.nonce}.begin.json`), true);
+  const b = stamp.editBinding;
+  const a = stamp.reviewer;
+  if (!b || b.v !== 1 || b.checkout !== target || b.gitDir !== actual.gitDir ||
+      b.commonDir !== actual.commonDir || b.stateDir !== neutral || typeof b.target !== 'string' ||
+      !b.target || stamp.v !== 1 || stamp.alg !== 'navori-content/v1' ||
+      stamp.feature !== feature || stamp.nonce !== index.nonce) deny('invalid-binding');
+  if (!a || a.host !== 'codex' || a.version !== '0.162.1' || a.role !== 'reviewer' ||
+      a.thread !== thread || !uuid.test(a.root) || !uuid.test(a.parent) ||
+      !hex.test(a.sourceHash) || checkout(a.sourceCwd) !== host.checkout) deny('wrong-native-actor');
+  const owner = json(path.join(state, `ownership_${feature}.json`));
+  if (!owner || owner.feature !== feature || owner.cwd !== target || owner.target !== b.target ||
+      owner.handoff !== stamp.ownership || !hex.test(stamp.ownership) ||
+      owner.fingerprint !== stamp.fingerprint || owner.base !== stamp.base ||
+      !Array.isArray(owner.actors) || !owner.actors.length ||
+      owner.actors.some((p) => p.host !== 'codex' || p.version !== '0.162.1' ||
+        !['implementer', 'scribe'].includes(p.role) || !uuid.test(p.thread) ||
+        p.root !== a.root || p.thread === thread)) deny('ownership-mismatch');
+  const handoff = path.join(state, `impl_${feature}.json`);
+  physical(handoff);
+  if (hash(fs.readFileSync(handoff)) !== owner.handoff) deny('handoff-changed');
+  return `${target}\0${feature}`;
+}
+try {
+  if (role !== 'reviewer' || !uuid.test(thread)) deny('native-agent-id-unavailable');
+  if (!prefixes.split('\n').some((p) => {
+    const prefix = p.replace(/\/$/, '');
+    return prefix && `${neutral}/review_output.json`.startsWith(`${prefix}/`);
+  })) deny('role-prefix-denied');
+  if (!outputs.length) deny('missing-output');
+  const host = identity(hostInput);
+  const checked = new Set();
+  for (const output of outputs) {
+    physical(output);
+    const match = /^(.*)\/\.navori\/state\/handoffs\/review_([^/]+)\.(md|json)$/.exec(output);
+    if (!match) deny('not-review-output');
+    const key = `${match[1]}\0${match[2]}`;
+    if (!checked.has(key)) checked.add(validate(host, output));
+  }
+  process.stdout.write('bound-review-output\n');
+} catch (e) {
+  process.stdout.write(`${e instanceof Error ? e.message : 'invalid-binding'}\n`);
+  process.exitCode = 1;
+}
+NV_REVIEW_EDIT_BINDING
+}

package/dist/assets/core/core-assets/hooks/implementer-no-markdown.sh

@@ -37,10 +37,25 @@
 # The contract in `implementer.md` is the rule; this catches the slip, not the
 # workaround.
 #
+# AI-DOCTRINE EXCEPTION (spec 0052, R49; decision by Ulises, 2026-10-14). The
+# doctrine of the harness (agents, skills, managed context, hooks) is part of the
+# code the implementer changes: routing it through the scribe cost an
+# implementer -> scribe -> implementer round per doctrine milestone for no gain.
+# So the EDIT TOOLS (Write/Edit/NotebookEdit/every apply_patch path) pass on a
+# `.md`/`.mdx` under the closed prefix list `navori_doctrine_prefixes` below,
+# relative to the repo root. This partly reverts 0030's "no .md at all"; the
+# scribe still owns status Markdown and human-facing deliverables. The Bash forms
+# are NOT relaxed: command text gives no trustworthy path. Absolute paths are
+# trimmed against the repo root; a `..` segment or a path outside the root blocks.
+# Symlinks: same accepted limitation as above. Editing a generated mirror
+# (`.claude/agents/...`) is overwritten by the next render; the contract tells the
+# implementer to edit the source and run `navori render --apply` (contract, not
+# barrier). Pi keeps the same list in `engines/pi/role-tools.ts`.
+#
 # The managed block below is regenerated by `navori render` and must NOT be
 # edited by hand.
 # Blocking classification (#1117):
-#   - implementer writing a Markdown file: hard — Markdown ownership; the message names the route (markdownRequests).
+#   - implementer writing a Markdown file outside the AI-doctrine prefixes: hard — Markdown ownership; the message names the allowed prefixes and the route (markdownRequests).
 set -euo pipefail
 
 # Command/field extraction (payload → $cmd, $payload). Shared body, single
@@ -96,12 +111,28 @@ fi
 
 navori_tool=$(nv_tool)
 
+# Closed list of AI-doctrine prefixes (R49), relative to the repo root.
+navori_doctrine_prefixes=(
+  packages/core/core-assets/agents/
+  packages/core/core-assets/skills/
+  packages/core/core-assets/managed/
+  packages/core/core-assets/hooks/
+  .claude/agents/
+  .claude/skills/
+  .claude/context/
+  .claude/hooks/
+  .codex/agents/
+  .codex/hooks/
+  .codex/orchestrator.md
+  .agents/skills/
+  .pi/navori/
+)
+
 block() {
   echo "[navori] BLOCKED by implementer-no-markdown: $1" >&2
-  # Both progress paths, never one alone: `placeHook` ships this byte-identical
-  # to Claude and Codex (#389), so a message hardcoding `.claude/progress`
-  # would misdirect a Codex implementer to a path that is not its own.
-  echo "[navori] the implementer does not write Markdown (spec 0030, R1). Put the change in \"markdownRequests\", inside .claude/progress/impl_<feature>.json (or .codex/progress/impl_<feature>.json under Codex) — the scribe applies it in this worktree." >&2
+  # `placeHook` ships this byte-identical to Claude and Codex (#389), so the
+  # message names the engine-neutral handoff home, never one engine's folder.
+  echo "[navori] the implementer writes Markdown only for AI doctrine (spec 0052, R49), with the edit tools, under: ${navori_doctrine_prefixes[*]}. Anything else (progress/, specs/, docs/, README, handoffs, paths with '..') goes in \"markdownRequests\", inside .navori/state/handoffs/impl_<feature>.json — the scribe applies it in this worktree. Bash never writes Markdown." >&2
   navori_audit_verdict="block"
   navori_audit_reason="$1"
   exit 2
@@ -116,6 +147,36 @@ is_md_path() {
   esac
 }
 
+# True when $1 (a `.md`/`.mdx` target of an EDIT tool) is AI doctrine: relative to
+# the repo root, or absolute and inside it; never with a `..` segment.
+is_doctrine_path() {
+  local p=$1 rel root candidate prefix
+  case "$p" in
+    .. | ../* | */.. | */../*) return 1 ;;
+  esac
+  case "$p" in
+    /*)
+      rel=""
+      for candidate in "${nv_project_dir:-}" "$(git -C "$(payload_field cwd)" rev-parse --show-toplevel 2>/dev/null || true)"; do
+        root=${candidate%/}
+        [ -n "$root" ] || continue
+        case "$p" in
+          "$root"/*) rel=${p#"$root"/}; break ;;
+        esac
+      done
+      [ -n "$rel" ] || return 1
+      ;;
+    *) rel=${p#./} ;;
+  esac
+  for prefix in "${navori_doctrine_prefixes[@]}"; do
+    case "$prefix" in
+      */) case "$rel" in "$prefix"?*) return 0 ;; esac ;;
+      *) [ "$rel" = "$prefix" ] && return 0 ;;
+    esac
+  done
+  return 1
+}
+
 case "$navori_tool" in
   Write | Edit)
     # Codex's `apply_patch` can touch several files in ONE call (Add/Update/
@@ -123,7 +184,7 @@ case "$navori_tool" in
     # line, so every one of them is checked, not just the first.
     while IFS= read -r navori_path; do
       [ -n "$navori_path" ] || continue
-      if is_md_path "$navori_path"; then
+      if is_md_path "$navori_path" && ! is_doctrine_path "$navori_path"; then
         block "$navori_tool sobre '$navori_path'"
       fi
     done <<EOF
@@ -135,7 +196,7 @@ EOF
     ;;
   NotebookEdit)
     navori_path=$(payload_field tool_input.notebook_path)
-    if is_md_path "$navori_path"; then
+    if is_md_path "$navori_path" && ! is_doctrine_path "$navori_path"; then
       block "NotebookEdit sobre '$navori_path'"
     fi
     navori_audit_verdict="allow"

package/dist/assets/core/core-assets/hooks/master-accept-confirm.sh

@@ -14,7 +14,7 @@ set -euo pipefail
 
 # Every matching command needs this literal token, so its absence from the raw
 # payload proves this hook cannot apply and avoids parsing the payload at all.
-TRIGGER_TOKENS='approved-by delivery-baseline delivery-queue navori master'
+TRIGGER_TOKENS='approved-by delivery-baseline delivery-queue escalation-reset navori master'
 # navori:include gate-trigger
 
 has_trigger_token "${payload:-}" || exit 0
@@ -56,12 +56,20 @@ QUEUE_RE="${NAVORI}[[:space:]]+master[[:space:]]+delivery-queue([[:space:]]|\$).
 DELIVERY_REVIEW_RE="${NAVORI}[[:space:]]+master[[:space:]]+delivery-(review|decision|publication|revoke)([[:space:];&|)<>]|\$)"
 DELIVERY_CRITERION_RE="${NAVORI}[[:space:]]+master[[:space:]]+delivery-criterion([[:space:]]|\$).*--approved-by([[:space:]=]|\$)"
 DELIVERY_REFRESH_RE="${NAVORI}[[:space:]]+master[[:space:]]+delivery-slice([[:space:]]|\$).*--refresh([[:space:]=]|\$)"
-TRIGGER_RE=".*${BOUND}(${PART_RE}|${CLOSE_RE}|${BASELINE_RE}|${QUEUE_RE}|${DELIVERY_REVIEW_RE}|${DELIVERY_CRITERION_RE}|${DELIVERY_REFRESH_RE})"
+RESET_RE="${NAVORI}[[:space:]]+plan[[:space:]]+escalation-reset([[:space:]]|\$).*--approved-by([[:space:]=]|\$)"
+TRIGGER_RE=".*${BOUND}(${PART_RE}|${CLOSE_RE}|${BASELINE_RE}|${QUEUE_RE}|${DELIVERY_REVIEW_RE}|${DELIVERY_CRITERION_RE}|${DELIVERY_REFRESH_RE}|${RESET_RE})"
 # A command substitution starts a new command: make it a segment of its own so
 # the `VAR=$(` prefix peeling in the shared scan cannot swallow it.
 navori_subst='$('
 navori_semi='; '
 cmd="${cmd//"$navori_subst"/$navori_semi}"
+# Quotes hide the boundary from `BOUND` in wrapped forms (`sh -c 'navori master
+# close'`, `eval "…"`, `navori master "close"`): delete ONLY `"` and `'`. Never
+# `\`: `navori_count_triggers` joins a `\<newline>` continuation first, and
+# removing the backslash here would split the segment (spec 0052 R36). The cost
+# is asking on `echo "navori master close"`, the safe direction. A word split by
+# quotes (`navo"ri`) is deliberate obfuscation this hook does not claim to catch.
+cmd="${cmd//[\"\']/}"
 is_scan_trigger "$cmd" || exit 0
 
 approval_description="a manual criterion"
@@ -71,6 +79,7 @@ case "$cmd" in
   *delivery-publication*) approval_description="the release or deploy reference for this exact accepted delivery; this records publication, it does not deploy" ;;
   *delivery-revoke*) approval_description="revocation of the active authority generation and prior effective proof" ;;
   *delivery-slice*) approval_description="the current-queue reverification refresh; pending criteria reset and normal plan approval is required again" ;;
+  *escalation-reset*) approval_description="another review round after two rejections at level 2 or higher" ;;
   *delivery-baseline*|*delivery-queue*) approval_description="the delivery baseline or bounded queue" ;;
 esac
 

package/dist/assets/core/core-assets/hooks/model-advisor.sh

@@ -1,21 +1,20 @@
 #!/usr/bin/env bash
 #
-# Advisory-only main-session model recommendation. The hook reads only payload
-# fields recorded in host-contracts.ts; `/model` remains the user's native,
-# explicit switch path. It never writes navori.config.json or agent profiles.
+# Startup/lifecycle modes advise the main session; `/model` remains the user's
+# explicit switch path. The fixed Codex PreToolUse mode rewrites future child
+# arguments or denies recoverable failures. No mode writes project config or profiles.
 set -euo pipefail
 
 payload=$(cat 2>/dev/null) || payload=""
 mode=${1:-}
 
-# The advisor has no effect on permissions or control flow, but its execution
-# must remain observable while audit mode is active. Its three Claude entry
-# points share one script, so derive the host phase from the explicit mode
-# rather than guessing from payload fields.
+# Lifecycle advice has no permission effect; the fixed native PreToolUse mode
+# does affect tool control flow. Audit both through their explicit host phase.
 case "$mode" in
   claude-session-start|codex-session-start) navori_audit_phase="SessionStart" ;;
   claude-post-model-switch) navori_audit_phase="PostModelSwitch" ;;
   claude-stop) navori_audit_phase="Stop" ;;
+  codex-pretool-profile) navori_audit_phase="PreToolUse" ;;
   *) navori_audit_phase="unknown" ;;
 esac
 navori_audit_name="model-advisor"
@@ -24,12 +23,100 @@ navori_audit_log() { :; }
 # navori:include audit-repo
 # navori:include audit-log
 navori_audit_begin
+navori_profile_verdict="skip"
 navori_audit_on_exit() {
-  navori_audit_log "skip" || true
+  navori_audit_log "$navori_profile_verdict" || true
   return 0
 }
 trap navori_audit_on_exit EXIT
 
+# Fixed native argument rewrite, before the advisory subagent skip. Recoverable
+# failures deny; an outer host timeout/crash can fail open and remains uncertain.
+if [ "$mode" = "codex-pretool-profile" ]; then
+  if [ "${#payload}" -gt 1048576 ]; then
+    printf '%s\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"profile-hook-input-too-large; effective-selection-pending"}}'
+    navori_profile_verdict="block"
+    exit 0
+  fi
+  profile_exit=0
+  profile_output=$(node 3<<<"$payload" <<'PROFILE_NODE'
+const { spawn } = require("node:child_process");
+const rawPayload = require("node:fs").readFileSync(3, "utf8");
+const deny = { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: "profile-hook-cli-unavailable-or-invalid; effective-selection-pending" } };
+let child;
+let timer;
+let finished = false;
+const finish = (value, code) => {
+  if (finished) return;
+  finished = true;
+  clearTimeout(timer);
+  if (child?.pid) {
+    try { process.kill(-child.pid, "SIGKILL"); } catch { child.kill("SIGKILL"); }
+  }
+  process.stdout.write(JSON.stringify(value) + "\n");
+  process.exitCode = code;
+};
+let original;
+try { original = JSON.parse(rawPayload); }
+catch { finish(deny, 2); }
+if (!finished) {
+  const bytes = Buffer.byteLength(rawPayload);
+  if (bytes > 1024 * 1024) finish(deny, 2);
+  else {
+    child = spawn("navori", ["codex", "profile", "hook"], { detached: true, stdio: ["pipe", "pipe", "pipe"] });
+    const chunks = [];
+    let size = 0;
+    timer = setTimeout(() => finish(deny, 2), 11_000);
+    child.once("error", () => finish(deny, 2));
+    child.stdin.on("error", () => finish(deny, 2));
+    child.stdout.on("data", chunk => {
+      size += chunk.length;
+      if (size > 1024 * 1024) finish(deny, 2);
+      else chunks.push(chunk);
+    });
+    // Audit belongs on stderr; do not forward untrusted CLI diagnostics/payloads.
+    child.stderr.on("data", () => {});
+    child.once("close", (code, signal) => {
+      if (finished) return;
+      if (code !== 0 || signal) return finish(deny, 2);
+      try {
+        const result = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        if (result !== null && typeof result === "object" && !Array.isArray(result) && Object.getPrototypeOf(result) === Object.prototype && Object.keys(result).length === 0) return finish({}, 3);
+        const output = result?.hookSpecificOutput;
+        if (output?.hookEventName !== "PreToolUse") return finish(deny, 2);
+        if (output.permissionDecision === "deny" && typeof output.permissionDecisionReason === "string") return finish(result, 2);
+        const updated = output.updatedInput;
+        const input = original?.tool_input;
+        if (output.permissionDecision !== "allow" || !updated || !input || Array.isArray(updated) || Array.isArray(input) || typeof updated !== "object" || typeof input !== "object" || typeof updated.model !== "string" || !updated.model || typeof updated.reasoning_effort !== "string" || !updated.reasoning_effort) return finish(deny, 2);
+        const keys = new Set([...Object.keys(input), ...Object.keys(updated)]);
+        for (const key of keys) {
+          if (key === "model" || key === "reasoning_effort") continue;
+          if (JSON.stringify(input[key]) !== JSON.stringify(updated[key])) return finish(deny, 2);
+        }
+        finish(result, 0);
+      } catch { finish(deny, 2); }
+    });
+    child.stdin.end(rawPayload);
+  }
+}
+PROFILE_NODE
+  ) || profile_exit=$?
+  # Capture first: a missing/fatal/signaled supervisor cannot leak a partial
+  # response or append a second JSON document after an already valid denial.
+  if [ -n "$profile_output" ] && { [ "$profile_exit" -eq 0 ] || [ "$profile_exit" -eq 2 ] || [ "$profile_exit" -eq 3 ]; }; then
+    printf '%s\n' "$profile_output"
+  else
+    printf '%s\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"profile-hook-supervisor-unavailable; effective-selection-pending"}}'
+    profile_exit=2
+  fi
+  case "$profile_exit" in
+    0) navori_profile_verdict="allow" ;;
+    3) navori_profile_verdict="skip" ;;
+    *) navori_profile_verdict="block" ;;
+  esac
+  exit 0
+fi
+
 # `Stop` fires for the main agent, but a session started with `--agent` carries
 # `agent_type`, and any payload with `agent_id` belongs to a subagent: neither
 # can advise, so their `node` spawn is pure waste. Discard it here with a