navori 0.4.0 → 0.4.2

package/dist/assets/core/core-assets/agents/commit-pr-pilot.md

@@ -40,24 +40,42 @@ gh auth status                                        # gh authenticated
 
 If the harness is active, identify THIS feature's review: `.claude/progress/review_<feature>.md`, with `<feature>` the id you received in your brief. A broad glob (`review_*.md`) over all reviews is not valid — it's not enough that some review with `APPROVED` exists in the directory, it has to be this feature's.
 
-Open that specific file and confirm its verdict is `APPROVED` and that its scope/feature section names the same feature you're about to commit. If the review lists the files it reviewed, compare them against `git diff --name-only`: if there are touched files that do NOT appear in that list, the review doesn't cover the full change → it does NOT count as approved. Abort, don't create the PR, and send it back to the reviewer to cover the missing files. It's not enough to mention the difference and carry on.
+Open that specific file and confirm its verdict is `APPROVED` and that its scope/feature section names the same feature you're about to commit. The verdict only counts if the review **covers the whole shipping diff**: the reviewer's content receipt (below) is the authoritative list of the files it actually reviewed, so every file in `git diff --name-only` must appear there. A touched file the review never saw → the `APPROVED` doesn't cover the full change → it does NOT count as approved. Abort, don't create the PR, and send it back to the reviewer to cover the missing files. It's not enough to mention the difference and carry on. The coverage check is mechanical — see the receipt block.
 
 <!-- This file-coverage rule lives here only; `skills/pr-create.md` is a pointer to this agent (single owner of the PR flow). -->
 
 
 An absent file, ambiguous (more than one candidate), or with a verdict/scope that doesn't match the current feature → does NOT count as approved: abort, tell the user the review is missing, and never assume a generic `APPROVED`.
 
-**Content receipt (R2+): the diff must still match what was approved.** The APPROVED verdict is bound to the reviewed bytes via `.claude/progress/receipt.txt` (written by the `reviewer`). Before committing, confirm no approved file drifted since the review (rebase, human tweak, follow-up edit):
+**Content receipt (R2+): the diff must still match what was approved.** The APPROVED verdict is bound to the reviewed bytes via `.claude/progress/receipt.txt` (written by the `reviewer`, one `<blob-sha>  <path>` line per reviewed file, or `deleted  <path>` for a removed one). Before committing, the approval has to cover the diff in **both** directions — coverage (every shipping file was reviewed) and no drift (no reviewed file changed its bytes):
 
 ```bash
+# 1) COVERAGE: shipping files the receipt never listed → reviewer never saw them.
+#    EXACT same diff set the reviewer captured — tracked-vs-target + untracked,
+#    minus the harness's own progress/ files (same grep the receipt applies) — so
+#    the sets line up 1:1 with no spurious mismatches. A git-persisted progress/
+#    update never counts as "uncovered"; deletions DO stay in the set (the receipt
+#    records them as `deleted <path>`) so a removed file can't ship unreviewed.
+comm -23 \
+  <({ git diff --name-only "origin/{{prTarget}}"; git ls-files --others --exclude-standard; } \
+       | sort -u | grep -vE '^(\.claude/progress/|progress/)') \
+  <(grep -v '^#' .claude/progress/receipt.txt | sed 's/^[^ ]*  //' | sort -u)
+
+# 2) DRIFT: a reviewed file whose bytes changed since the review. A `deleted`
+#    marker means the reviewer signed off on the removal → drift only if the file
+#    came back.
 while IFS= read -r line; do
   case "$line" in ''|'#'*) continue ;; esac
   blob=${line%%  *}; path=${line#*  }
-  [ "$(git hash-object "$path" 2>/dev/null)" = "$blob" ] || echo "DRIFT: $path"
+  if [ "$blob" = deleted ]; then
+    [ -e "$path" ] && echo "DRIFT: $path (reappeared since review)"
+  else
+    [ "$(git hash-object "$path" 2>/dev/null)" = "$blob" ] || echo "DRIFT: $path"
+  fi
 done < .claude/progress/receipt.txt
 ```
 
-Any `DRIFT` line — or a missing `receipt.txt` for a reviewed (R2+) change — means the approval no longer covers the current diff. Abort, don't commit, and send it back to the `reviewer` to re-approve over the current bytes. (The pre-commit hook re-checks the staged set mechanically as a backstop; catching it here is earlier and clearer.)
+Any file printed by (1) is uncovered; any `DRIFT` line from (2) is stale — either one, or a missing `receipt.txt` for a reviewed (R2+) change, means the approval no longer covers the current diff. Abort, don't commit, and send it back to the `reviewer` to cover/re-approve over the current bytes. It's not enough to mention the gap and carry on. (The pre-commit hook re-checks the staged set for drift mechanically as a backstop; catching both here is earlier and clearer.)
 
 **R1 exception (trivial diff, no reviewer):** a genuine R1 change (1–3 files, mechanical or a bugfix with a clear cause, done inline without a reviewer per `## Role: orchestrator`) has no `review_<feature>.md` and none is required. In that case you do NOT abort for a missing review — instead you MUST run `{{qualityGate.full}}` green yourself before the PR (see Gate below). This waiver is ONLY for a real R1 diff; anything R2+ (4+ files, or 2+ non-trivial files) still requires the APPROVED review.
 

package/dist/assets/core/core-assets/agents/explorer.md

@@ -1,7 +1,7 @@
 ---
 name: explorer
 description: Broad map of an area or module of the repo. Returns structure, dependencies, and entry points. Does not modify code.
-tools: Read, Glob, Grep, Bash
+tools: Read, Glob, Grep, Bash, Write
 model: {{models.explorer}}
 effort: {{effort.explorer}}
 ---
@@ -25,7 +25,7 @@ If the question is specific ("where is X?"), it's not you — it's `researcher`.
 
 1. Read `CLAUDE.md` to understand the repo's conventions.
 2. Define the scope: a folder, a logical module, a file pattern. The orchestrator should hand it to you precisely; if it arrives ambiguous, return `blocked` naming the options (folder X / module Y / pattern Z) so it re-sends it scoped — don't guess.
-3. Walk from the entry points (routes, module root exports, `index.ts`) toward the leaves. For each level, list files and their brief role. Apply `.claude/skills/structural-search.md` to locate shapes and entry points without reading whole files.
+3. Walk from the entry points (routes, module root exports, `index.ts`) toward the leaves. For each level, list files and their brief role. Apply `.claude/skills/structural-search/SKILL.md` to locate shapes and entry points without reading whole files.
 4. Identify reverse dependencies: which external modules consume this module? That indicates the "blast radius" of changing something here.
 5. Write `.claude/progress/explore_<area>.md`:
 

package/dist/assets/core/core-assets/agents/implementer.md

@@ -26,7 +26,7 @@ You execute **a single** task from start to verification. You don't orchestrate,
      ```
 
    - `Expected files: <list>`
-3. **Implement** following the repo's flow (the leader's "Project rules" define the concrete pattern: layers, libs, paths, naming). To locate the code to touch, apply `.claude/skills/structural-search.md`: open only the confirmed span, don't read whole files by reflex.
+3. **Implement** following the repo's flow (the leader's "Project rules" define the concrete pattern: layers, libs, paths, naming). To locate the code to touch, apply `.claude/skills/structural-search/SKILL.md`: open only the confirmed span, don't read whole files by reflex.
 4. **Quality gate** (mandatory before returning):
 
    ```bash
@@ -70,7 +70,7 @@ No speculative abstractions: no interface / layer / flag with a single "just in
 
 ## Evidence-based completion (gate before the report)
 
-Before returning `done -> .claude/progress/impl_<feature>.md`, apply `.claude/skills/verify-before-done.md`. Summary of the Iron Law:
+Before returning `done -> .claude/progress/impl_<feature>.md`, apply `.claude/skills/verify-before-done/SKILL.md`. Summary of the Iron Law:
 
 | Claim you're going to make | Required output | Not sufficient |
 |---|---|---|

package/dist/assets/core/core-assets/agents/leader.md

@@ -93,10 +93,12 @@ Expected files:
 
 - `.claude/progress/audit_ticket_<TICKET-ID>.md` — deep analysis of one ticket (`ticket-audit`)
 - `.claude/progress/audit_deep_<scope>.md` — deep read-only audit of a module/area/repo with no ticket (`auditor`)
+- `.claude/progress/plan_<scope>.md` — the `auditor`'s prioritized plan that accompanies a deep audit
 - `.claude/progress/explore_<topic>.md` — broad map (`explorer`)
 - `.claude/progress/research_<question>.md` — scoped question (`researcher`)
 - `.claude/progress/impl_<feature>.md` — the `implementer`'s report (includes its `Status: DONE | BLOCKED`)
 - `.claude/progress/review_<feature>.md` — the `reviewer`'s verdict
+- `.claude/progress/receipt.txt` — the `reviewer`'s content receipt on `APPROVED` (binds the diff to the reviewed bytes; consumed by `commit-pr-pilot`)
 
 **Path separation (don't mix):** `.claude/progress/` is ONLY for these ephemeral handoffs between agents. The **session state** (current task, plan, blockers) lives in `progress/current.md` (repo root, persists in git) and you consolidate it **YOU, only**: subagents never write it. When an `implementer` reports `blocked` in its `impl_<feature>.md`, you record the blocker in `progress/current.md` along with the next step.
 
@@ -105,7 +107,7 @@ Expected files:
 When `.claude/progress/review_<feature>.md` contains `APPROVED`:
 
 1. Invoke `commit-pr-pilot` to draft the title + body following the repo's format and open the PR.
-2. Pre-flight on you before invoking: clean working tree, you're not on `{{branchBase}}`, `{{qualityGate.fast}}` green this turn, `gh auth status` ok.
+2. Pre-flight on you before invoking: you're not on `{{branchBase}}`, `{{qualityGate.fast}}` green this turn, `gh auth status` ok. (Do NOT require a clean working tree — the pilot's trigger IS an uncommitted diff ready to commit, and the pilot, not you, owns that commit.)
 3. Return to the user only the PR URL + title.
 
 If the review returned `CHANGES_REQUESTED`, do NOT invoke `commit-pr-pilot`: launch another `implementer` with the list of changes and restart the cycle.

package/dist/assets/core/core-assets/agents/researcher.md

@@ -1,7 +1,7 @@
 ---
 name: researcher
 description: Read-only investigation of a scoped question. Reads the repo, writes findings to a file. Does not modify code.
-tools: Read, Glob, Grep, Bash
+tools: Read, Glob, Grep, Bash, Write
 model: {{models.researcher}}
 effort: {{effort.researcher}}
 ---
@@ -28,7 +28,7 @@ If the question is broad ("map the whole module X for me"), it's not you — it'
 3. Run the search:
    - Primary method: the native `Grep` (content) and `Glob` (files by name/pattern) tools. They're read-only, fast (ripgrep), and don't ask for permission.
    - Fallback only for what the tools don't cover (git history with `git grep`, FS metadata with `find`): shell commands. Chained with pipes/redirects they ask for confirmation, so reserve the shell for when `Grep`/`Glob` fall short.
-   - For semantic questions (not just string match), apply `.claude/skills/structural-search.md`: locate the right region and open only the confirmed span; don't read whole files by reflex.
+   - For semantic questions (not just string match), apply `.claude/skills/structural-search/SKILL.md`: locate the right region and open only the confirmed span; don't read whole files by reflex.
 4. Validate each finding: open the file, confirm the match means what it seems (sometimes a `grep` matches comments or strings unrelated to the concept).
 5. Write `.claude/progress/research_<question-slug>.md`:
 

package/dist/assets/core/core-assets/agents/reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: reviewer
 description: Strict reviewer. Approves or rejects the implementer's work against CLAUDE.md. Does not edit code.
-tools: Read, Glob, Grep, Bash
+tools: Read, Glob, Grep, Bash, Write
 model: {{models.reviewer}}
 effort: {{effort.reviewer}}
 ---
@@ -26,11 +26,16 @@ You are a strict reviewer. Your only function is to **approve or reject**. You d
    git status --short
    git fetch origin {{prTarget}} --quiet
    git diff --stat
-   git diff origin/{{prTarget}}...HEAD
+   # two-dot: the FULL working tree vs the target (committed AND uncommitted),
+   # the exact set the receipt fingerprints below. Three-dot (`...HEAD`) would show
+   # only committed changes, but in the harness the diff is still uncommitted — so
+   # the review command would read empty while the receipt signs the working tree.
+   git diff "origin/{{prTarget}}"
+   git ls-files --others --exclude-standard   # untracked files (new, not yet staged)
    ```
 
 3. **Re-review** (if there's already a `.claude/progress/review_<feature>.md` from a previous cycle): focus the *reading* on (a) that the issues listed there are resolved and (b) the files the `implementer` reports having touched in this cycle (`impl_<feature>.md`). Don't re-review from scratch the already-approved code that didn't change; the full quality gate is still run anyway — a change can break something outside the delta.
-4. Apply `.claude/skills/verify-before-done.md` to every `[x]` that depends on evidence. The quality gate is run **this turn, in Pass 2** (not before: a `SPEC_MISS` in Pass 1 doesn't need it — don't spend the gate on a diff you're going to reject on spec). Don't assume from the implementer's cached report.
+4. Apply `.claude/skills/verify-before-done/SKILL.md` to every `[x]` that depends on evidence. The quality gate is run **this turn, in Pass 2** (not before: a `SPEC_MISS` in Pass 1 doesn't need it — don't spend the gate on a diff you're going to reject on spec). Don't assume from the implementer's cached report.
 
 ### Pass 1 — Spec compliance
 
@@ -52,7 +57,7 @@ Does the diff do EXACTLY what was asked? You don't review style yet.
 
 Does the code match the repo's conventions? Here you do review style/naming/types.
 
-Apply `.claude/skills/review-diff.md` — the full checklist by dimensions, with severities. Its CRITICAL/HIGH map to the ≥80 issues below; MEDIUM to the informational observations. Summary of the minimum to validate against `CLAUDE.md` and the leader's "Project rules":
+Apply `.claude/skills/review-diff/SKILL.md` — the full checklist by dimensions, with severities. Its CRITICAL/HIGH map to the ≥80 issues below; MEDIUM to the informational observations. Summary of the minimum to validate against `CLAUDE.md` and the leader's "Project rules":
 
 - **Conventions**: naming, path aliases, folder structure.
 - **Centralized types**: no inline `type`/`interface` where the convention says "outside".
@@ -87,12 +92,18 @@ printf '# navori-receipt v1 feature=<feature>\n' > .claude/progress/receipt.txt
   | sort -u \
   | grep -vE '^(\.claude/progress/|progress/)' \
   | while IFS= read -r f; do
-      [ -f "$f" ] && printf '%s  %s\n' "$(git hash-object "$f")" "$f"
+      if [ -f "$f" ]; then
+        printf '%s  %s\n' "$(git hash-object "$f")" "$f"   # live file → blob sha
+      else
+        printf 'deleted  %s\n' "$f"                        # removed file → deletion marker
+      fi
     done >> .claude/progress/receipt.txt
 ```
 
 It captures the working-tree bytes under review (committed **and** uncommitted). The `grep -v` drops the harness's own ephemeral progress files (the receipt, `impl_*`, `review_*`) — they never get committed, so fingerprinting them would be self-referential noise. Skip the whole step for `CHANGES_REQUESTED` — a rejected diff has nothing to bind.
 
+A **removed** file has no bytes to hash, so it's recorded as `deleted  <path>` instead of a blob sha. Keeping the deletion **in** the receipt is what closes the RDD cycle: the `commit-pr-pilot` coverage check is path-based, so it still sees the path (a deletion can't ship unreviewed), and both its drift check and the pre-commit hook read the `deleted` marker as "must stay absent" — flagging drift only if the file reappears. The shipping set the pilot compares against is then byte-for-byte the set you signed here (same `grep -vE`, deletions included), so a git-persisted `progress/` update or a removed file never shows up as "uncovered" and livelocks the close.
+
 ### Confidence scoring per finding (Pass 2)
 
 Each issue is scored 0-100. Only issues ≥80 block APPROVED. Issues 50-79 are listed as "informational observations" (they don't block). <50 = don't report.
@@ -164,7 +175,7 @@ CHANGES_REQUESTED -> .claude/progress/review_<feature>.md
 
 - ❌ Never skip Pass 1 (spec compliance). If the code is pretty but doesn't do what was asked, it's `CHANGES_REQUESTED`.
 - ❌ Never include as a blocker (in "Issues ≥80") a finding with confidence <80.
-- ✅ Apply `.claude/skills/verify-before-done.md` before marking APPROVED: each `[x]` must be backed by evidence run this turn (not from the implementer's cached report).
+- ✅ Apply `.claude/skills/verify-before-done/SKILL.md` before marking APPROVED: each `[x]` must be backed by evidence run this turn (not from the implementer's cached report).
 - ❌ Never approve with `{{qualityGate.full}}` red.
 - ❌ Never approve if the new code **adds new errors or warnings** vs baseline.
 - ❌ Never approve new code with explicit or implicit `any` without a valid `// any justified: <reason>`.

package/dist/assets/core/core-assets/agents/ticket-audit.md

@@ -1,7 +1,7 @@
 ---
 name: ticket-audit
 description: Deep analysis of a complex ticket before implementing. Produces audit_ticket_<ID>.md with root cause, affected areas, and a decomposition plan.
-tools: Read, Glob, Grep, Bash
+tools: Read, Glob, Grep, Bash, Write
 model: {{models.ticketAudit}}
 effort: {{effort.ticketAudit}}
 ---

package/dist/assets/core/core-assets/hooks/_partials/extract-cmd.sh

@@ -0,0 +1,21 @@
+# Shared hook boilerplate — inlined into each hook at render time (see the
+# include directive in the source scripts + lib/hook-includes.ts). Single source
+# of truth for the sibling gate scripts; DO NOT copy this body back into a hook
+# by hand (that is the drift #225/#261 removed).
+#
+# PreToolUse(Bash) passes the tool input on stdin. Extract .tool_input.command
+# WITHOUT hard-depending on jq (NOT preinstalled on macOS): try jq, then node
+# (Claude Code's own runtime), then a best-effort sed unwrap. No command
+# extracted → empty $cmd, and each caller decides what that means (the gate
+# scripts scan defensively; guard-destructive waves the command through).
+payload=$(cat)
+extract_cmd() {
+  if command -v jq >/dev/null 2>&1; then
+    printf '%s' "$payload" | jq -r '.tool_input.command // empty' 2>/dev/null && return 0
+  fi
+  if command -v node >/dev/null 2>&1; then
+    printf '%s' "$payload" | node -e 'let s="";process.stdin.on("data",c=>s+=c).on("end",()=>{try{process.stdout.write(String(JSON.parse(s)?.tool_input?.command??""))}catch{}})' 2>/dev/null && return 0
+  fi
+  printf '%s' "$payload" | sed -n 's/.*"command"[[:space:]]*:[[:space:]]*"\(.*\)".*/\1/p'
+}
+cmd=$(extract_cmd)

package/dist/assets/core/core-assets/hooks/_partials/gate-trigger.sh

@@ -0,0 +1,59 @@
+# Shared gate detector — inlined into each hook at render time (see the include
+# directive in the source scripts + lib/hook-includes.ts). The caller MUST set
+# $TRIGGER_RE (an ERE) before the include; it decides which git ops this hook
+# gates. Single source of truth for the FIX B/C wrapper-peeling logic; DO NOT
+# copy this body into a hook by hand.
+#
+# Detect whether $1 (a possibly-compound command) invokes a gated operation.
+# Splits $1 on the shell separators && || ; | and newlines, strips leading
+# whitespace plus wrapper words (`(`, `\`, `command `) and `VAR=value` env
+# prefixes from each segment, and returns 0 if ANY segment STARTS with a gated
+# `git …` invocation on a word boundary (matched by $TRIGGER_RE). Replaces
+# literal-prefix `case` matching, which silently skipped the gate for
+# `cd x && git commit`, `echo y; git push`, or a leading space (#88: NEVER skip
+# the gate silently). Matching a segment START means a quoted `echo "git commit"`
+# does NOT trigger it. Known limitation: it cannot see through `sh -c`, `eval`,
+# or obfuscation — a seatbelt, not a sandbox.
+is_scan_trigger() {
+  local input="$1" segment
+  # FIX B: join `\<newline>` continuations into a space FIRST, so a command
+  # split across lines with a trailing backslash stays ONE logical segment
+  # (otherwise the subcommand/flag lands in a segment not starting with git).
+  input="${input//\\$'\n'/ }"
+  input="${input//&&/$'\n'}"
+  input="${input//||/$'\n'}"
+  input="${input//;/$'\n'}"
+  input="${input//|/$'\n'}"
+  # `<<<` feeds the already-expanded value as data — no re-evaluation — so a
+  # command that contains backticks/$() is inspected, never executed.
+  while IFS= read -r segment; do
+    segment="${segment#"${segment%%[![:space:]]*}"}"        # strip leading ws
+    # FIX C: peel wrappers so `(git …`, `\git`, `command git …` and
+    # `VAR=val git …` all reduce to a plain `git …` before matching.
+    while [[ "$segment" == \(* ]]; do                       # strip leading ( runs
+      segment="${segment#\(}"
+      segment="${segment#"${segment%%[![:space:]]*}"}"
+    done
+    segment="${segment#\\}"                                 # strip a leading backslash (\git)
+    while [[ "$segment" =~ ^[A-Za-z_][A-Za-z0-9_]*= ]]; do  # strip VAR=val prefixes
+      case "$segment" in
+        *[[:space:]]*)
+          segment="${segment#*[[:space:]]}"
+          segment="${segment#"${segment%%[![:space:]]*}"}"
+          ;;
+        *) segment=""; break ;;
+      esac
+    done
+    if [[ "$segment" == command\ * ]]; then                 # strip a leading `command ` word
+      segment="${segment#command }"
+      segment="${segment#"${segment%%[![:space:]]*}"}"
+    fi
+    # FIX C: allow git global options between `git` and the subcommand
+    # (`git -c k=v commit`, `git -C /repo push`). $TRIGGER_RE's trailing boundary
+    # keeps `git commitgraph` / `git config …` from matching.
+    if printf '%s' "$segment" | grep -qE "$TRIGGER_RE"; then
+      return 0
+    fi
+  done <<< "$input"
+  return 1
+}

package/dist/assets/core/core-assets/hooks/guard-destructive.sh

@@ -21,27 +21,16 @@
 # bottom — `$cmd` is already parsed and in scope there.
 set -euo pipefail
 
-# Extract .tool_input.command from the PreToolUse payload WITHOUT hard-depending
-# on jq (NOT preinstalled on macOS — a missing jq used to make this guard wave
-# every command through). Try jq, then node (Claude Code's own runtime), and if
-# no JSON parser is on PATH fall back to a best-effort sed unwrap so the guard
-# still inspects the command instead of failing open.
-payload=$(cat)
-extract_cmd() {
-  if command -v jq >/dev/null 2>&1; then
-    printf '%s' "$payload" | jq -r '.tool_input.command // empty' 2>/dev/null && return 0
-  fi
-  if command -v node >/dev/null 2>&1; then
-    printf '%s' "$payload" | node -e 'let s="";process.stdin.on("data",c=>s+=c).on("end",()=>{try{process.stdout.write(String(JSON.parse(s)?.tool_input?.command??""))}catch{}})' 2>/dev/null && return 0
-  fi
-  # No JSON parser on PATH: pull the "command" string out with sed. Best-effort
-  # (won't handle a literal embedded quote), but far better than failing open.
-  printf '%s' "$payload" | sed -n 's/.*"command"[[:space:]]*:[[:space:]]*"\(.*\)".*/\1/p'
-}
-cmd=$(extract_cmd)
+# Command extraction (payload → $cmd). Shared body, single source of truth.
+# A missing JSON parser used to make this guard wave every command through; the
+# shared extractor falls back to sed so it still inspects the command.
+# navori:include extract-cmd
 [ -z "$cmd" ] && exit 0
 
-base="{{branchBase}}"
+# branchBase is shell-quoted at render time via the shq: marker (#197): a
+# hostile branchBase in navori.config.json lands here as an inert literal,
+# never executable.
+base={{shq:branchBase}}
 
 block() {
   echo "[navori] BLOQUEADO por guard-destructive: $1" >&2

package/dist/assets/core/core-assets/hooks/precompact-session-summary.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+#
+# PreCompact lifecycle hook — session-summary reminder.
+# Fires just before Claude Code compacts the conversation (manual `/compact` or
+# automatic). Compaction summarizes and drops turn-by-turn detail, so anything
+# not persisted durably (decisions, root-caused bugs, conventions) is at risk of
+# being lost. This hook injects a reminder to persist a session summary before
+# that detail is gone.
+#
+# DESIGN — advisory, never blocking. A shell hook can't itself run the model's
+# memory tool — that's the model's action — so this hook is honest about its
+# limit: it INJECTS a reminder via `hookSpecificOutput.additionalContext` (the
+# same channel session-start uses) and lets the model act on it. It never returns
+# `decision: block`, so it never stalls compaction. The reminder points at the
+# engram session-summary tool when available, and falls back to a plain "jot key
+# decisions into progress/current.md" so it's still useful in a repo without
+# engram. It deliberately does NOT spell out engram's exact tool token verbatim —
+# that token is a doctor invariant the engram plugin owns; naming it here would
+# let a hook mask a gutted guidance block from `doctor`.
+#
+# The managed block is regenerated by `navori render`; do NOT edit by hand.
+set -euo pipefail
+
+cat >/dev/null 2>&1 || true   # drain the PreCompact JSON on stdin (unused)
+
+ctx="A punto de compactar el contexto: el detalle turno-a-turno se resumirá. Antes de perderlo, persiste un resumen de sesión con tu herramienta de memoria (engram: guarda el resumen de sesión) y/o anota las decisiones y los bugs con causa raíz de esta sesión en progress/current.md."
+
+# Emit additionalContext safely: node (best escaping) → jq → give up (exit 0).
+if command -v node >/dev/null 2>&1; then
+  CTX="$ctx" node -e 'process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreCompact",additionalContext:process.env.CTX}}))'
+elif command -v jq >/dev/null 2>&1; then
+  jq -n --arg ctx "$ctx" '{hookSpecificOutput:{hookEventName:"PreCompact",additionalContext:$ctx}}'
+fi
+exit 0

package/dist/assets/core/core-assets/hooks/quality-gate-pre-commit.sh

@@ -9,20 +9,8 @@
 # bottom — they keep `cmd` and the original exit codes in scope.
 set -euo pipefail
 
-# Extract .tool_input.command WITHOUT hard-depending on jq (not preinstalled on
-# macOS). Try jq, then node (Claude Code's own runtime), then a best-effort sed
-# unwrap. If nothing extracts a command $cmd stays empty and the gate skips.
-payload=$(cat)
-extract_cmd() {
-  if command -v jq >/dev/null 2>&1; then
-    printf '%s' "$payload" | jq -r '.tool_input.command // empty' 2>/dev/null && return 0
-  fi
-  if command -v node >/dev/null 2>&1; then
-    printf '%s' "$payload" | node -e 'let s="";process.stdin.on("data",c=>s+=c).on("end",()=>{try{process.stdout.write(String(JSON.parse(s)?.tool_input?.command??""))}catch{}})' 2>/dev/null && return 0
-  fi
-  printf '%s' "$payload" | sed -n 's/.*"command"[[:space:]]*:[[:space:]]*"\(.*\)".*/\1/p'
-}
-cmd=$(extract_cmd)
+# Command extraction (payload → $cmd). Shared body, single source of truth.
+# navori:include extract-cmd
 
 # Detect the project's REAL package manager from lockfiles / package.json, so a
 # gate command hardcoded to one PM (e.g. `pnpm run ...`) can still run in a repo
@@ -59,7 +47,8 @@ run_gate() {
 # --- content receipt (RDD) --------------------------------------------------
 # Backstop that binds the commit to the exact bytes the reviewer approved. The
 # reviewer writes a receipt (`<blob-sha>  <path>` lines, one per approved file,
-# via `git hash-object`) when it marks APPROVED; the commit-pr-pilot recomputes
+# via `git hash-object`, plus `deleted  <path>` for a file it approved removing)
+# when it marks APPROVED; the commit-pr-pilot recomputes
 # it before committing and consumes it after. THIS is the mechanical net for a
 # direct `git commit` that skips the pilot: if an approved file's content
 # drifted since the review (rebase, human tweak, follow-up edit), block. It
@@ -99,6 +88,10 @@ check_content_receipt() {
     path=${line#*  }                                   # path = the rest (may contain spaces)
     [ -n "$blob" ] && [ "$blob" != "$path" ] || continue
     printf '%s\n' "$commit_set" | grep -qxF "$path" || continue   # not in this commit → ignore
+    if [ "$blob" = deleted ]; then                     # reviewer approved the removal
+      [ -e "$path" ] && drift="${drift}  - ${path} (reappeared)"$'\n'   # drift only if it came back
+      continue
+    fi
     now=$(git hash-object "$path" 2>/dev/null || true)
     if [ "$now" != "$blob" ]; then
       drift="${drift}  - ${path}"$'\n'
@@ -108,75 +101,26 @@ check_content_receipt() {
   if [ -n "$drift" ]; then
     echo "[navori] APPROVED content changed since review (receipt mismatch). Commit BLOCKED." >&2
     printf '%s' "$drift" >&2
-    echo "[navori] Re-run the reviewer over the current diff, or override with 'git commit --no-verify'." >&2
+    echo "[navori] Re-run the reviewer over the current diff. To bypass, run the commit yourself outside the agent." >&2
     echo "[navori] To clear a stale receipt: rm $receipt" >&2
     exit 2
   fi
 }
 
-# --- shared gate detection (keep IN SYNC across sibling hooks) --------------
-# Detect a `git commit` invocation anywhere in a (possibly
-# compound) command. Splits $1 on the shell separators && || ; | and newlines,
-# strips leading whitespace plus simple `VAR=value` env prefixes from each
-# segment, and returns 0 if ANY segment STARTS with `git commit` on
-# a word boundary. Replaces literal-prefix `case` matching, which silently
-# skipped the gate for `cd x && git commit`, `echo y; git commit`, or a leading
-# space (#88: NEVER skip the gate silently). Because it matches a segment START,
-# a quoted `echo "git commit"` does NOT trigger it. Known limitation: it cannot
-# see through `sh -c`, `eval`, or obfuscation — a seatbelt, not a sandbox.
-# The IDENTICAL function body lives in the sibling gate scripts (they render
-# standalone, so there is no shared lib to import):
-#   plugins/jscpd/scripts/check-jscpd.sh
-#   plugins/semgrep/scripts/check-semgrep.sh
-is_git_commit() {
-  local input="$1" segment
-  # FIX B: join `\<newline>` continuations into a space FIRST, so a command
-  # split across lines with a trailing backslash stays ONE logical segment
-  # (otherwise the subcommand/flag lands in a segment not starting with git).
-  input="${input//\\$'\n'/ }"
-  input="${input//&&/$'\n'}"
-  input="${input//||/$'\n'}"
-  input="${input//;/$'\n'}"
-  input="${input//|/$'\n'}"
-  # `<<<` feeds the already-expanded value as data — no re-evaluation — so a
-  # command that contains backticks/$() is inspected, never executed.
-  while IFS= read -r segment; do
-    segment="${segment#"${segment%%[![:space:]]*}"}"        # strip leading ws
-    # FIX C: peel wrappers so `(git …`, `\git`, `command git …` and
-    # `VAR=val git …` all reduce to a plain `git …` before matching.
-    while [[ "$segment" == \(* ]]; do                       # strip leading ( runs
-      segment="${segment#\(}"
-      segment="${segment#"${segment%%[![:space:]]*}"}"
-    done
-    segment="${segment#\\}"                                 # strip a leading backslash (\git)
-    while [[ "$segment" =~ ^[A-Za-z_][A-Za-z0-9_]*= ]]; do  # strip VAR=val prefixes
-      case "$segment" in
-        *[[:space:]]*)
-          segment="${segment#*[[:space:]]}"
-          segment="${segment#"${segment%%[![:space:]]*}"}"
-          ;;
-        *) segment=""; break ;;
-      esac
-    done
-    if [[ "$segment" == command\ * ]]; then                 # strip a leading `command ` word
-      segment="${segment#command }"
-      segment="${segment#"${segment%%[![:space:]]*}"}"
-    fi
-    # FIX C: allow git global options between `git` and the subcommand
-    # (`git -c k=v commit`, `git -C /repo push`). Trailing boundary keeps
-    # `git commitgraph` / `git config …` from matching as commit.
-    if printf '%s' "$segment" | grep -qE '^git([[:space:]]+-[a-zA-Z-]+(=[^[:space:]]+)?([[:space:]]+[^-][^[:space:]]*)?)*[[:space:]]+commit([[:space:]]|$)'; then
-      return 0
-    fi
-  done <<< "$input"
-  return 1
-}
+# Gate to `git commit` only. $TRIGGER_RE is consumed by the shared detector
+# inlined below.
+TRIGGER_RE='^git([[:space:]]+-[a-zA-Z-]+(=[^[:space:]]+)?([[:space:]]+[^-][^[:space:]]*)?)*[[:space:]]+commit([[:space:]]|$)'
+# navori:include gate-trigger
 
-if is_git_commit "$cmd"; then
+if is_scan_trigger "$cmd"; then
   # Content-bind first: refuse to commit bytes that drifted from the approval
   # before spending the fast gate on them.
   check_content_receipt
-  gate="{{qualityGate.fast}}"
+  # qualityGate.fast is shell-quoted at render time via the shq: marker (#197).
+  # The gate string is still `eval`'d by run_gate below (running the gate is the
+  # feature), but quoting it here means a hostile qualityGate.fast survives as one
+  # literal token instead of injecting commands at variable-assignment time.
+  gate={{shq:qualityGate.fast}}
   gate_bin="${gate%% *}"
   if command -v "$gate_bin" >/dev/null 2>&1; then
     run_gate "$gate"
@@ -192,7 +136,7 @@ if is_git_commit "$cmd"; then
       run_gate "$detected_pm ${gate#* }"
     else
       echo "[navori] quality-gate NO ejecutado: '$gate_bin' no está en PATH y no hay un package manager alternativo detectado que pueda correrlo." >&2
-      echo "[navori] Commit BLOQUEADO para no saltarnos el gate en silencio. Instala '$gate_bin' o usa 'git commit --no-verify' si de verdad quieres saltártelo." >&2
+      echo "[navori] Commit BLOQUEADO para no saltarnos el gate en silencio. Instala '$gate_bin', o si de verdad quieres saltártelo corre el commit tú mismo fuera del agente." >&2
       exit 2
     fi
   fi

package/dist/assets/core/core-assets/hooks/session-start-context.sh

@@ -29,7 +29,9 @@ add() { ctx="${ctx}${1}"$'\n'; }
 
 if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
   branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo '?')
-  base="{{branchBase}}"
+  # branchBase is shell-quoted at render time via the shq: marker (#197) so an
+  # untrusted branchBase can't inject a command here.
+  base={{shq:branchBase}}
   if [ "$branch" = "$base" ]; then
     add "Branch: ${branch}  ⚠️ on the base branch — create a working branch before committing."
   else
@@ -59,6 +61,20 @@ if [ -n "$current" ]; then
   fi
 fi
 
+# Workspace Dominio: canonical cross-repo knowledge for the workspace this repo
+# belongs to (e.g. "coachee = user-profile.kind"), so agents don't relearn it
+# wrong in every repo. The CLI owns the resolution (which workspace is cwd in +
+# read the index); the hook stays dumb. Cheap pre-check first so the common
+# no-workspace case never spawns the binary, and `|| true` so a missing/broken
+# `navori` never blocks session startup. (spec 0011 §6.1)
+if [ -d "$HOME/.navori/workspaces" ] && command -v navori >/dev/null 2>&1; then
+  dominio=$(navori dominio inject 2>/dev/null || true)
+  if [ -n "$dominio" ]; then
+    add ""
+    add "$dominio"
+  fi
+fi
+
 [ -n "$ctx" ] || exit 0
 
 # Emit the JSON safely: node (best escaping) → jq → give up (exit 0, no context).

package/dist/assets/core/core-assets/hooks/stop-verify-reminder.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+#
+# Stop lifecycle hook — verify-before-done reminder (P4).
+# Fires when the main agent finishes a turn. Its job is to nudge — NOT block —
+# when the session is winding down with uncommitted work, so "I'm done" isn't
+# claimed before the quality gate ran and the change is committed.
+#
+# DESIGN — advisory, never blocking. It emits a user-facing `systemMessage`
+# only; it NEVER returns `decision: block`, so it can't trap the model in a
+# "keep working" loop or force a turn the user didn't ask for. A hard,
+# deterministic "did the model actually run verify-before-done?" gate is not
+# reliably knowable from a shell hook (the model's intent isn't in the payload),
+# so we intentionally downgrade to a reminder — see the PR for the rationale.
+#
+# OPT-IN. This hook is only wired into settings.json when
+# `hooks.verifyOnStop` is true in navori.config.json (mirrors how
+# `qualityGate.fast` gates the quality-gate hook). It stays OFF by default
+# because a per-turn reminder can be noisy during active development; a repo
+# that wants the nudge turns it on explicitly.
+#
+# The managed block is regenerated by `navori render`; do NOT edit by hand.
+set -euo pipefail
+
+cat >/dev/null 2>&1 || true   # drain the Stop JSON on stdin (unused)
+
+# Only meaningful inside a git repo.
+git rev-parse --is-inside-work-tree >/dev/null 2>&1 || exit 0
+
+# Hard evidence that work is unfinished: tracked files changed but not committed
+# (staged or unstaged). Untracked files alone don't count — scratch/output files
+# are common and shouldn't trigger the nudge.
+if git diff --quiet --ignore-submodules HEAD 2>/dev/null; then
+  exit 0   # working tree clean vs HEAD → nothing to remind about
+fi
+
+msg="navori: cambios sin commitear en el árbol. Antes de dar la tarea por terminada, corre el quality gate (evidencia fresca este turno) y haz commit — verify-before-done (P4)."
+
+# Emit the advisory as a user-facing systemMessage. node (Claude Code's own
+# runtime) → jq → give up silently. systemMessage is non-blocking by contract.
+if command -v node >/dev/null 2>&1; then
+  MSG="$msg" node -e 'process.stdout.write(JSON.stringify({systemMessage:process.env.MSG}))'
+elif command -v jq >/dev/null 2>&1; then
+  jq -n --arg m "$msg" '{systemMessage:$m}'
+fi
+exit 0