navori 0.4.1 → 0.4.2

package/dist/assets/core/core-assets/agents/commit-pr-pilot.md

@@ -47,21 +47,31 @@ Open that specific file and confirm its verdict is `APPROVED` and that its scope
 
 An absent file, ambiguous (more than one candidate), or with a verdict/scope that doesn't match the current feature → does NOT count as approved: abort, tell the user the review is missing, and never assume a generic `APPROVED`.
 
-**Content receipt (R2+): the diff must still match what was approved.** The APPROVED verdict is bound to the reviewed bytes via `.claude/progress/receipt.txt` (written by the `reviewer`, one `<blob-sha>  <path>` line per reviewed file). Before committing, the approval has to cover the diff in **both** directions — coverage (every shipping file was reviewed) and no drift (no reviewed file changed its bytes):
+**Content receipt (R2+): the diff must still match what was approved.** The APPROVED verdict is bound to the reviewed bytes via `.claude/progress/receipt.txt` (written by the `reviewer`, one `<blob-sha>  <path>` line per reviewed file, or `deleted  <path>` for a removed one). Before committing, the approval has to cover the diff in **both** directions — coverage (every shipping file was reviewed) and no drift (no reviewed file changed its bytes):
 
 ```bash
 # 1) COVERAGE: shipping files the receipt never listed → reviewer never saw them.
-#    Same diff set the reviewer captured (tracked vs target + untracked), so the
-#    sets line up 1:1 with no spurious mismatches.
+#    EXACT same diff set the reviewer captured — tracked-vs-target + untracked,
+#    minus the harness's own progress/ files (same grep the receipt applies) — so
+#    the sets line up 1:1 with no spurious mismatches. A git-persisted progress/
+#    update never counts as "uncovered"; deletions DO stay in the set (the receipt
+#    records them as `deleted <path>`) so a removed file can't ship unreviewed.
 comm -23 \
-  <({ git diff --name-only "origin/{{prTarget}}"; git ls-files --others --exclude-standard; } | sort -u) \
+  <({ git diff --name-only "origin/{{prTarget}}"; git ls-files --others --exclude-standard; } \
+       | sort -u | grep -vE '^(\.claude/progress/|progress/)') \
   <(grep -v '^#' .claude/progress/receipt.txt | sed 's/^[^ ]*  //' | sort -u)
 
-# 2) DRIFT: a reviewed file whose bytes changed since the review.
+# 2) DRIFT: a reviewed file whose bytes changed since the review. A `deleted`
+#    marker means the reviewer signed off on the removal → drift only if the file
+#    came back.
 while IFS= read -r line; do
   case "$line" in ''|'#'*) continue ;; esac
   blob=${line%%  *}; path=${line#*  }
-  [ "$(git hash-object "$path" 2>/dev/null)" = "$blob" ] || echo "DRIFT: $path"
+  if [ "$blob" = deleted ]; then
+    [ -e "$path" ] && echo "DRIFT: $path (reappeared since review)"
+  else
+    [ "$(git hash-object "$path" 2>/dev/null)" = "$blob" ] || echo "DRIFT: $path"
+  fi
 done < .claude/progress/receipt.txt
 ```
 

package/dist/assets/core/core-assets/agents/explorer.md

@@ -1,7 +1,7 @@
 ---
 name: explorer
 description: Broad map of an area or module of the repo. Returns structure, dependencies, and entry points. Does not modify code.
-tools: Read, Glob, Grep, Bash
+tools: Read, Glob, Grep, Bash, Write
 model: {{models.explorer}}
 effort: {{effort.explorer}}
 ---
@@ -25,7 +25,7 @@ If the question is specific ("where is X?"), it's not you — it's `researcher`.
 
 1. Read `CLAUDE.md` to understand the repo's conventions.
 2. Define the scope: a folder, a logical module, a file pattern. The orchestrator should hand it to you precisely; if it arrives ambiguous, return `blocked` naming the options (folder X / module Y / pattern Z) so it re-sends it scoped — don't guess.
-3. Walk from the entry points (routes, module root exports, `index.ts`) toward the leaves. For each level, list files and their brief role. Apply `.claude/skills/structural-search.md` to locate shapes and entry points without reading whole files.
+3. Walk from the entry points (routes, module root exports, `index.ts`) toward the leaves. For each level, list files and their brief role. Apply `.claude/skills/structural-search/SKILL.md` to locate shapes and entry points without reading whole files.
 4. Identify reverse dependencies: which external modules consume this module? That indicates the "blast radius" of changing something here.
 5. Write `.claude/progress/explore_<area>.md`:
 

package/dist/assets/core/core-assets/agents/implementer.md

@@ -26,7 +26,7 @@ You execute **a single** task from start to verification. You don't orchestrate,
      ```
 
    - `Expected files: <list>`
-3. **Implement** following the repo's flow (the leader's "Project rules" define the concrete pattern: layers, libs, paths, naming). To locate the code to touch, apply `.claude/skills/structural-search.md`: open only the confirmed span, don't read whole files by reflex.
+3. **Implement** following the repo's flow (the leader's "Project rules" define the concrete pattern: layers, libs, paths, naming). To locate the code to touch, apply `.claude/skills/structural-search/SKILL.md`: open only the confirmed span, don't read whole files by reflex.
 4. **Quality gate** (mandatory before returning):
 
    ```bash
@@ -70,7 +70,7 @@ No speculative abstractions: no interface / layer / flag with a single "just in
 
 ## Evidence-based completion (gate before the report)
 
-Before returning `done -> .claude/progress/impl_<feature>.md`, apply `.claude/skills/verify-before-done.md`. Summary of the Iron Law:
+Before returning `done -> .claude/progress/impl_<feature>.md`, apply `.claude/skills/verify-before-done/SKILL.md`. Summary of the Iron Law:
 
 | Claim you're going to make | Required output | Not sufficient |
 |---|---|---|

package/dist/assets/core/core-assets/agents/leader.md

@@ -93,10 +93,12 @@ Expected files:
 
 - `.claude/progress/audit_ticket_<TICKET-ID>.md` — deep analysis of one ticket (`ticket-audit`)
 - `.claude/progress/audit_deep_<scope>.md` — deep read-only audit of a module/area/repo with no ticket (`auditor`)
+- `.claude/progress/plan_<scope>.md` — the `auditor`'s prioritized plan that accompanies a deep audit
 - `.claude/progress/explore_<topic>.md` — broad map (`explorer`)
 - `.claude/progress/research_<question>.md` — scoped question (`researcher`)
 - `.claude/progress/impl_<feature>.md` — the `implementer`'s report (includes its `Status: DONE | BLOCKED`)
 - `.claude/progress/review_<feature>.md` — the `reviewer`'s verdict
+- `.claude/progress/receipt.txt` — the `reviewer`'s content receipt on `APPROVED` (binds the diff to the reviewed bytes; consumed by `commit-pr-pilot`)
 
 **Path separation (don't mix):** `.claude/progress/` is ONLY for these ephemeral handoffs between agents. The **session state** (current task, plan, blockers) lives in `progress/current.md` (repo root, persists in git) and you consolidate it **YOU, only**: subagents never write it. When an `implementer` reports `blocked` in its `impl_<feature>.md`, you record the blocker in `progress/current.md` along with the next step.
 
@@ -105,7 +107,7 @@ Expected files:
 When `.claude/progress/review_<feature>.md` contains `APPROVED`:
 
 1. Invoke `commit-pr-pilot` to draft the title + body following the repo's format and open the PR.
-2. Pre-flight on you before invoking: clean working tree, you're not on `{{branchBase}}`, `{{qualityGate.fast}}` green this turn, `gh auth status` ok.
+2. Pre-flight on you before invoking: you're not on `{{branchBase}}`, `{{qualityGate.fast}}` green this turn, `gh auth status` ok. (Do NOT require a clean working tree — the pilot's trigger IS an uncommitted diff ready to commit, and the pilot, not you, owns that commit.)
 3. Return to the user only the PR URL + title.
 
 If the review returned `CHANGES_REQUESTED`, do NOT invoke `commit-pr-pilot`: launch another `implementer` with the list of changes and restart the cycle.

package/dist/assets/core/core-assets/agents/researcher.md

@@ -1,7 +1,7 @@
 ---
 name: researcher
 description: Read-only investigation of a scoped question. Reads the repo, writes findings to a file. Does not modify code.
-tools: Read, Glob, Grep, Bash
+tools: Read, Glob, Grep, Bash, Write
 model: {{models.researcher}}
 effort: {{effort.researcher}}
 ---
@@ -28,7 +28,7 @@ If the question is broad ("map the whole module X for me"), it's not you — it'
 3. Run the search:
    - Primary method: the native `Grep` (content) and `Glob` (files by name/pattern) tools. They're read-only, fast (ripgrep), and don't ask for permission.
    - Fallback only for what the tools don't cover (git history with `git grep`, FS metadata with `find`): shell commands. Chained with pipes/redirects they ask for confirmation, so reserve the shell for when `Grep`/`Glob` fall short.
-   - For semantic questions (not just string match), apply `.claude/skills/structural-search.md`: locate the right region and open only the confirmed span; don't read whole files by reflex.
+   - For semantic questions (not just string match), apply `.claude/skills/structural-search/SKILL.md`: locate the right region and open only the confirmed span; don't read whole files by reflex.
 4. Validate each finding: open the file, confirm the match means what it seems (sometimes a `grep` matches comments or strings unrelated to the concept).
 5. Write `.claude/progress/research_<question-slug>.md`:
 

package/dist/assets/core/core-assets/agents/reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: reviewer
 description: Strict reviewer. Approves or rejects the implementer's work against CLAUDE.md. Does not edit code.
-tools: Read, Glob, Grep, Bash
+tools: Read, Glob, Grep, Bash, Write
 model: {{models.reviewer}}
 effort: {{effort.reviewer}}
 ---
@@ -26,11 +26,16 @@ You are a strict reviewer. Your only function is to **approve or reject**. You d
    git status --short
    git fetch origin {{prTarget}} --quiet
    git diff --stat
-   git diff origin/{{prTarget}}...HEAD
+   # two-dot: the FULL working tree vs the target (committed AND uncommitted),
+   # the exact set the receipt fingerprints below. Three-dot (`...HEAD`) would show
+   # only committed changes, but in the harness the diff is still uncommitted — so
+   # the review command would read empty while the receipt signs the working tree.
+   git diff "origin/{{prTarget}}"
+   git ls-files --others --exclude-standard   # untracked files (new, not yet staged)
    ```
 
 3. **Re-review** (if there's already a `.claude/progress/review_<feature>.md` from a previous cycle): focus the *reading* on (a) that the issues listed there are resolved and (b) the files the `implementer` reports having touched in this cycle (`impl_<feature>.md`). Don't re-review from scratch the already-approved code that didn't change; the full quality gate is still run anyway — a change can break something outside the delta.
-4. Apply `.claude/skills/verify-before-done.md` to every `[x]` that depends on evidence. The quality gate is run **this turn, in Pass 2** (not before: a `SPEC_MISS` in Pass 1 doesn't need it — don't spend the gate on a diff you're going to reject on spec). Don't assume from the implementer's cached report.
+4. Apply `.claude/skills/verify-before-done/SKILL.md` to every `[x]` that depends on evidence. The quality gate is run **this turn, in Pass 2** (not before: a `SPEC_MISS` in Pass 1 doesn't need it — don't spend the gate on a diff you're going to reject on spec). Don't assume from the implementer's cached report.
 
 ### Pass 1 — Spec compliance
 
@@ -52,7 +57,7 @@ Does the diff do EXACTLY what was asked? You don't review style yet.
 
 Does the code match the repo's conventions? Here you do review style/naming/types.
 
-Apply `.claude/skills/review-diff.md` — the full checklist by dimensions, with severities. Its CRITICAL/HIGH map to the ≥80 issues below; MEDIUM to the informational observations. Summary of the minimum to validate against `CLAUDE.md` and the leader's "Project rules":
+Apply `.claude/skills/review-diff/SKILL.md` — the full checklist by dimensions, with severities. Its CRITICAL/HIGH map to the ≥80 issues below; MEDIUM to the informational observations. Summary of the minimum to validate against `CLAUDE.md` and the leader's "Project rules":
 
 - **Conventions**: naming, path aliases, folder structure.
 - **Centralized types**: no inline `type`/`interface` where the convention says "outside".
@@ -87,12 +92,18 @@ printf '# navori-receipt v1 feature=<feature>\n' > .claude/progress/receipt.txt
   | sort -u \
   | grep -vE '^(\.claude/progress/|progress/)' \
   | while IFS= read -r f; do
-      [ -f "$f" ] && printf '%s  %s\n' "$(git hash-object "$f")" "$f"
+      if [ -f "$f" ]; then
+        printf '%s  %s\n' "$(git hash-object "$f")" "$f"   # live file → blob sha
+      else
+        printf 'deleted  %s\n' "$f"                        # removed file → deletion marker
+      fi
     done >> .claude/progress/receipt.txt
 ```
 
 It captures the working-tree bytes under review (committed **and** uncommitted). The `grep -v` drops the harness's own ephemeral progress files (the receipt, `impl_*`, `review_*`) — they never get committed, so fingerprinting them would be self-referential noise. Skip the whole step for `CHANGES_REQUESTED` — a rejected diff has nothing to bind.
 
+A **removed** file has no bytes to hash, so it's recorded as `deleted  <path>` instead of a blob sha. Keeping the deletion **in** the receipt is what closes the RDD cycle: the `commit-pr-pilot` coverage check is path-based, so it still sees the path (a deletion can't ship unreviewed), and both its drift check and the pre-commit hook read the `deleted` marker as "must stay absent" — flagging drift only if the file reappears. The shipping set the pilot compares against is then byte-for-byte the set you signed here (same `grep -vE`, deletions included), so a git-persisted `progress/` update or a removed file never shows up as "uncovered" and livelocks the close.
+
 ### Confidence scoring per finding (Pass 2)
 
 Each issue is scored 0-100. Only issues ≥80 block APPROVED. Issues 50-79 are listed as "informational observations" (they don't block). <50 = don't report.
@@ -164,7 +175,7 @@ CHANGES_REQUESTED -> .claude/progress/review_<feature>.md
 
 - ❌ Never skip Pass 1 (spec compliance). If the code is pretty but doesn't do what was asked, it's `CHANGES_REQUESTED`.
 - ❌ Never include as a blocker (in "Issues ≥80") a finding with confidence <80.
-- ✅ Apply `.claude/skills/verify-before-done.md` before marking APPROVED: each `[x]` must be backed by evidence run this turn (not from the implementer's cached report).
+- ✅ Apply `.claude/skills/verify-before-done/SKILL.md` before marking APPROVED: each `[x]` must be backed by evidence run this turn (not from the implementer's cached report).
 - ❌ Never approve with `{{qualityGate.full}}` red.
 - ❌ Never approve if the new code **adds new errors or warnings** vs baseline.
 - ❌ Never approve new code with explicit or implicit `any` without a valid `// any justified: <reason>`.

package/dist/assets/core/core-assets/agents/ticket-audit.md

@@ -1,7 +1,7 @@
 ---
 name: ticket-audit
 description: Deep analysis of a complex ticket before implementing. Produces audit_ticket_<ID>.md with root cause, affected areas, and a decomposition plan.
-tools: Read, Glob, Grep, Bash
+tools: Read, Glob, Grep, Bash, Write
 model: {{models.ticketAudit}}
 effort: {{effort.ticketAudit}}
 ---

package/dist/assets/core/core-assets/hooks/_partials/extract-cmd.sh

@@ -0,0 +1,21 @@
+# Shared hook boilerplate — inlined into each hook at render time (see the
+# include directive in the source scripts + lib/hook-includes.ts). Single source
+# of truth for the sibling gate scripts; DO NOT copy this body back into a hook
+# by hand (that is the drift #225/#261 removed).
+#
+# PreToolUse(Bash) passes the tool input on stdin. Extract .tool_input.command
+# WITHOUT hard-depending on jq (NOT preinstalled on macOS): try jq, then node
+# (Claude Code's own runtime), then a best-effort sed unwrap. No command
+# extracted → empty $cmd, and each caller decides what that means (the gate
+# scripts scan defensively; guard-destructive waves the command through).
+payload=$(cat)
+extract_cmd() {
+  if command -v jq >/dev/null 2>&1; then
+    printf '%s' "$payload" | jq -r '.tool_input.command // empty' 2>/dev/null && return 0
+  fi
+  if command -v node >/dev/null 2>&1; then
+    printf '%s' "$payload" | node -e 'let s="";process.stdin.on("data",c=>s+=c).on("end",()=>{try{process.stdout.write(String(JSON.parse(s)?.tool_input?.command??""))}catch{}})' 2>/dev/null && return 0
+  fi
+  printf '%s' "$payload" | sed -n 's/.*"command"[[:space:]]*:[[:space:]]*"\(.*\)".*/\1/p'
+}
+cmd=$(extract_cmd)

package/dist/assets/core/core-assets/hooks/_partials/gate-trigger.sh

@@ -0,0 +1,59 @@
+# Shared gate detector — inlined into each hook at render time (see the include
+# directive in the source scripts + lib/hook-includes.ts). The caller MUST set
+# $TRIGGER_RE (an ERE) before the include; it decides which git ops this hook
+# gates. Single source of truth for the FIX B/C wrapper-peeling logic; DO NOT
+# copy this body into a hook by hand.
+#
+# Detect whether $1 (a possibly-compound command) invokes a gated operation.
+# Splits $1 on the shell separators && || ; | and newlines, strips leading
+# whitespace plus wrapper words (`(`, `\`, `command `) and `VAR=value` env
+# prefixes from each segment, and returns 0 if ANY segment STARTS with a gated
+# `git …` invocation on a word boundary (matched by $TRIGGER_RE). Replaces
+# literal-prefix `case` matching, which silently skipped the gate for
+# `cd x && git commit`, `echo y; git push`, or a leading space (#88: NEVER skip
+# the gate silently). Matching a segment START means a quoted `echo "git commit"`
+# does NOT trigger it. Known limitation: it cannot see through `sh -c`, `eval`,
+# or obfuscation — a seatbelt, not a sandbox.
+is_scan_trigger() {
+  local input="$1" segment
+  # FIX B: join `\<newline>` continuations into a space FIRST, so a command
+  # split across lines with a trailing backslash stays ONE logical segment
+  # (otherwise the subcommand/flag lands in a segment not starting with git).
+  input="${input//\\$'\n'/ }"
+  input="${input//&&/$'\n'}"
+  input="${input//||/$'\n'}"
+  input="${input//;/$'\n'}"
+  input="${input//|/$'\n'}"
+  # `<<<` feeds the already-expanded value as data — no re-evaluation — so a
+  # command that contains backticks/$() is inspected, never executed.
+  while IFS= read -r segment; do
+    segment="${segment#"${segment%%[![:space:]]*}"}"        # strip leading ws
+    # FIX C: peel wrappers so `(git …`, `\git`, `command git …` and
+    # `VAR=val git …` all reduce to a plain `git …` before matching.
+    while [[ "$segment" == \(* ]]; do                       # strip leading ( runs
+      segment="${segment#\(}"
+      segment="${segment#"${segment%%[![:space:]]*}"}"
+    done
+    segment="${segment#\\}"                                 # strip a leading backslash (\git)
+    while [[ "$segment" =~ ^[A-Za-z_][A-Za-z0-9_]*= ]]; do  # strip VAR=val prefixes
+      case "$segment" in
+        *[[:space:]]*)
+          segment="${segment#*[[:space:]]}"
+          segment="${segment#"${segment%%[![:space:]]*}"}"
+          ;;
+        *) segment=""; break ;;
+      esac
+    done
+    if [[ "$segment" == command\ * ]]; then                 # strip a leading `command ` word
+      segment="${segment#command }"
+      segment="${segment#"${segment%%[![:space:]]*}"}"
+    fi
+    # FIX C: allow git global options between `git` and the subcommand
+    # (`git -c k=v commit`, `git -C /repo push`). $TRIGGER_RE's trailing boundary
+    # keeps `git commitgraph` / `git config …` from matching.
+    if printf '%s' "$segment" | grep -qE "$TRIGGER_RE"; then
+      return 0
+    fi
+  done <<< "$input"
+  return 1
+}

package/dist/assets/core/core-assets/hooks/guard-destructive.sh

@@ -21,27 +21,16 @@
 # bottom — `$cmd` is already parsed and in scope there.
 set -euo pipefail
 
-# Extract .tool_input.command from the PreToolUse payload WITHOUT hard-depending
-# on jq (NOT preinstalled on macOS — a missing jq used to make this guard wave
-# every command through). Try jq, then node (Claude Code's own runtime), and if
-# no JSON parser is on PATH fall back to a best-effort sed unwrap so the guard
-# still inspects the command instead of failing open.
-payload=$(cat)
-extract_cmd() {
-  if command -v jq >/dev/null 2>&1; then
-    printf '%s' "$payload" | jq -r '.tool_input.command // empty' 2>/dev/null && return 0
-  fi
-  if command -v node >/dev/null 2>&1; then
-    printf '%s' "$payload" | node -e 'let s="";process.stdin.on("data",c=>s+=c).on("end",()=>{try{process.stdout.write(String(JSON.parse(s)?.tool_input?.command??""))}catch{}})' 2>/dev/null && return 0
-  fi
-  # No JSON parser on PATH: pull the "command" string out with sed. Best-effort
-  # (won't handle a literal embedded quote), but far better than failing open.
-  printf '%s' "$payload" | sed -n 's/.*"command"[[:space:]]*:[[:space:]]*"\(.*\)".*/\1/p'
-}
-cmd=$(extract_cmd)
+# Command extraction (payload → $cmd). Shared body, single source of truth.
+# A missing JSON parser used to make this guard wave every command through; the
+# shared extractor falls back to sed so it still inspects the command.
+# navori:include extract-cmd
 [ -z "$cmd" ] && exit 0
 
-base="{{branchBase}}"
+# branchBase is shell-quoted at render time via the shq: marker (#197): a
+# hostile branchBase in navori.config.json lands here as an inert literal,
+# never executable.
+base={{shq:branchBase}}
 
 block() {
   echo "[navori] BLOQUEADO por guard-destructive: $1" >&2

package/dist/assets/core/core-assets/hooks/quality-gate-pre-commit.sh

@@ -9,20 +9,8 @@
 # bottom — they keep `cmd` and the original exit codes in scope.
 set -euo pipefail
 
-# Extract .tool_input.command WITHOUT hard-depending on jq (not preinstalled on
-# macOS). Try jq, then node (Claude Code's own runtime), then a best-effort sed
-# unwrap. If nothing extracts a command $cmd stays empty and the gate skips.
-payload=$(cat)
-extract_cmd() {
-  if command -v jq >/dev/null 2>&1; then
-    printf '%s' "$payload" | jq -r '.tool_input.command // empty' 2>/dev/null && return 0
-  fi
-  if command -v node >/dev/null 2>&1; then
-    printf '%s' "$payload" | node -e 'let s="";process.stdin.on("data",c=>s+=c).on("end",()=>{try{process.stdout.write(String(JSON.parse(s)?.tool_input?.command??""))}catch{}})' 2>/dev/null && return 0
-  fi
-  printf '%s' "$payload" | sed -n 's/.*"command"[[:space:]]*:[[:space:]]*"\(.*\)".*/\1/p'
-}
-cmd=$(extract_cmd)
+# Command extraction (payload → $cmd). Shared body, single source of truth.
+# navori:include extract-cmd
 
 # Detect the project's REAL package manager from lockfiles / package.json, so a
 # gate command hardcoded to one PM (e.g. `pnpm run ...`) can still run in a repo
@@ -59,7 +47,8 @@ run_gate() {
 # --- content receipt (RDD) --------------------------------------------------
 # Backstop that binds the commit to the exact bytes the reviewer approved. The
 # reviewer writes a receipt (`<blob-sha>  <path>` lines, one per approved file,
-# via `git hash-object`) when it marks APPROVED; the commit-pr-pilot recomputes
+# via `git hash-object`, plus `deleted  <path>` for a file it approved removing)
+# when it marks APPROVED; the commit-pr-pilot recomputes
 # it before committing and consumes it after. THIS is the mechanical net for a
 # direct `git commit` that skips the pilot: if an approved file's content
 # drifted since the review (rebase, human tweak, follow-up edit), block. It
@@ -99,6 +88,10 @@ check_content_receipt() {
     path=${line#*  }                                   # path = the rest (may contain spaces)
     [ -n "$blob" ] && [ "$blob" != "$path" ] || continue
     printf '%s\n' "$commit_set" | grep -qxF "$path" || continue   # not in this commit → ignore
+    if [ "$blob" = deleted ]; then                     # reviewer approved the removal
+      [ -e "$path" ] && drift="${drift}  - ${path} (reappeared)"$'\n'   # drift only if it came back
+      continue
+    fi
     now=$(git hash-object "$path" 2>/dev/null || true)
     if [ "$now" != "$blob" ]; then
       drift="${drift}  - ${path}"$'\n'
@@ -108,75 +101,26 @@ check_content_receipt() {
   if [ -n "$drift" ]; then
     echo "[navori] APPROVED content changed since review (receipt mismatch). Commit BLOCKED." >&2
     printf '%s' "$drift" >&2
-    echo "[navori] Re-run the reviewer over the current diff, or override with 'git commit --no-verify'." >&2
+    echo "[navori] Re-run the reviewer over the current diff. To bypass, run the commit yourself outside the agent." >&2
     echo "[navori] To clear a stale receipt: rm $receipt" >&2
     exit 2
   fi
 }
 
-# --- shared gate detection (keep IN SYNC across sibling hooks) --------------
-# Detect a `git commit` invocation anywhere in a (possibly
-# compound) command. Splits $1 on the shell separators && || ; | and newlines,
-# strips leading whitespace plus simple `VAR=value` env prefixes from each
-# segment, and returns 0 if ANY segment STARTS with `git commit` on
-# a word boundary. Replaces literal-prefix `case` matching, which silently
-# skipped the gate for `cd x && git commit`, `echo y; git commit`, or a leading
-# space (#88: NEVER skip the gate silently). Because it matches a segment START,
-# a quoted `echo "git commit"` does NOT trigger it. Known limitation: it cannot
-# see through `sh -c`, `eval`, or obfuscation — a seatbelt, not a sandbox.
-# The IDENTICAL function body lives in the sibling gate scripts (they render
-# standalone, so there is no shared lib to import):
-#   plugins/jscpd/scripts/check-jscpd.sh
-#   plugins/semgrep/scripts/check-semgrep.sh
-is_git_commit() {
-  local input="$1" segment
-  # FIX B: join `\<newline>` continuations into a space FIRST, so a command
-  # split across lines with a trailing backslash stays ONE logical segment
-  # (otherwise the subcommand/flag lands in a segment not starting with git).
-  input="${input//\\$'\n'/ }"
-  input="${input//&&/$'\n'}"
-  input="${input//||/$'\n'}"
-  input="${input//;/$'\n'}"
-  input="${input//|/$'\n'}"
-  # `<<<` feeds the already-expanded value as data — no re-evaluation — so a
-  # command that contains backticks/$() is inspected, never executed.
-  while IFS= read -r segment; do
-    segment="${segment#"${segment%%[![:space:]]*}"}"        # strip leading ws
-    # FIX C: peel wrappers so `(git …`, `\git`, `command git …` and
-    # `VAR=val git …` all reduce to a plain `git …` before matching.
-    while [[ "$segment" == \(* ]]; do                       # strip leading ( runs
-      segment="${segment#\(}"
-      segment="${segment#"${segment%%[![:space:]]*}"}"
-    done
-    segment="${segment#\\}"                                 # strip a leading backslash (\git)
-    while [[ "$segment" =~ ^[A-Za-z_][A-Za-z0-9_]*= ]]; do  # strip VAR=val prefixes
-      case "$segment" in
-        *[[:space:]]*)
-          segment="${segment#*[[:space:]]}"
-          segment="${segment#"${segment%%[![:space:]]*}"}"
-          ;;
-        *) segment=""; break ;;
-      esac
-    done
-    if [[ "$segment" == command\ * ]]; then                 # strip a leading `command ` word
-      segment="${segment#command }"
-      segment="${segment#"${segment%%[![:space:]]*}"}"
-    fi
-    # FIX C: allow git global options between `git` and the subcommand
-    # (`git -c k=v commit`, `git -C /repo push`). Trailing boundary keeps
-    # `git commitgraph` / `git config …` from matching as commit.
-    if printf '%s' "$segment" | grep -qE '^git([[:space:]]+-[a-zA-Z-]+(=[^[:space:]]+)?([[:space:]]+[^-][^[:space:]]*)?)*[[:space:]]+commit([[:space:]]|$)'; then
-      return 0
-    fi
-  done <<< "$input"
-  return 1
-}
+# Gate to `git commit` only. $TRIGGER_RE is consumed by the shared detector
+# inlined below.
+TRIGGER_RE='^git([[:space:]]+-[a-zA-Z-]+(=[^[:space:]]+)?([[:space:]]+[^-][^[:space:]]*)?)*[[:space:]]+commit([[:space:]]|$)'
+# navori:include gate-trigger
 
-if is_git_commit "$cmd"; then
+if is_scan_trigger "$cmd"; then
   # Content-bind first: refuse to commit bytes that drifted from the approval
   # before spending the fast gate on them.
   check_content_receipt
-  gate="{{qualityGate.fast}}"
+  # qualityGate.fast is shell-quoted at render time via the shq: marker (#197).
+  # The gate string is still `eval`'d by run_gate below (running the gate is the
+  # feature), but quoting it here means a hostile qualityGate.fast survives as one
+  # literal token instead of injecting commands at variable-assignment time.
+  gate={{shq:qualityGate.fast}}
   gate_bin="${gate%% *}"
   if command -v "$gate_bin" >/dev/null 2>&1; then
     run_gate "$gate"
@@ -192,7 +136,7 @@ if is_git_commit "$cmd"; then
       run_gate "$detected_pm ${gate#* }"
     else
       echo "[navori] quality-gate NO ejecutado: '$gate_bin' no está en PATH y no hay un package manager alternativo detectado que pueda correrlo." >&2
-      echo "[navori] Commit BLOQUEADO para no saltarnos el gate en silencio. Instala '$gate_bin' o usa 'git commit --no-verify' si de verdad quieres saltártelo." >&2
+      echo "[navori] Commit BLOQUEADO para no saltarnos el gate en silencio. Instala '$gate_bin', o si de verdad quieres saltártelo corre el commit tú mismo fuera del agente." >&2
       exit 2
     fi
   fi

package/dist/assets/core/core-assets/hooks/session-start-context.sh

@@ -29,7 +29,9 @@ add() { ctx="${ctx}${1}"$'\n'; }
 
 if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
   branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo '?')
-  base="{{branchBase}}"
+  # branchBase is shell-quoted at render time via the shq: marker (#197) so an
+  # untrusted branchBase can't inject a command here.
+  base={{shq:branchBase}}
   if [ "$branch" = "$base" ]; then
     add "Branch: ${branch}  ⚠️ on the base branch — create a working branch before committing."
   else
@@ -59,6 +61,20 @@ if [ -n "$current" ]; then
   fi
 fi
 
+# Workspace Dominio: canonical cross-repo knowledge for the workspace this repo
+# belongs to (e.g. "coachee = user-profile.kind"), so agents don't relearn it
+# wrong in every repo. The CLI owns the resolution (which workspace is cwd in +
+# read the index); the hook stays dumb. Cheap pre-check first so the common
+# no-workspace case never spawns the binary, and `|| true` so a missing/broken
+# `navori` never blocks session startup. (spec 0011 §6.1)
+if [ -d "$HOME/.navori/workspaces" ] && command -v navori >/dev/null 2>&1; then
+  dominio=$(navori dominio inject 2>/dev/null || true)
+  if [ -n "$dominio" ]; then
+    add ""
+    add "$dominio"
+  fi
+fi
+
 [ -n "$ctx" ] || exit 0
 
 # Emit the JSON safely: node (best escaping) → jq → give up (exit 0, no context).

package/dist/assets/core/core-assets/hooks/subagent-stop-handoff.sh

@@ -47,7 +47,7 @@ shopt -s nullglob
 for f in "$dir"/impl_*.md; do
   if is_blank "$f"; then
     note "$(basename "$f") vacío"
-  elif ! grep -qi '^status:' "$f" 2>/dev/null; then
+  elif ! grep -qiE '^\*{0,2}status:?\*{0,2}' "$f" 2>/dev/null; then
     note "$(basename "$f") sin línea 'Status:'"
   fi
 done

package/dist/assets/core/core-assets/managed/cierre-sesion.md

@@ -6,4 +6,4 @@ Before closing the session:
 2. **History**: add an entry in `progress/history.md` with `## YYYY-MM-DD HH:MM <agent> — <summary>` + changes + gate status.
 3. **Clear current**: leave `progress/current.md` at `idle` or with the explicit next step.
 4. **No temporaries**: delete scratch files; don't leave `console.log`, `debugger`, or commented-out code.
-5. **Conventional commit**: `feat|fix|chore|docs(scope): message`, Spanish MX, atomic. Never commit `.claude/` or `CLAUDE.md`.
+5. **Conventional commit**: `feat|fix|chore|docs(scope): message`, atomic, in the language defined by the config's `commits`. Never commit `.claude/` or `CLAUDE.md`.

package/dist/assets/core/core-assets/managed/codex-cross-review.md

@@ -0,0 +1,14 @@
+## Cross-model review (Codex second opinion)
+
+This repo renders the `codex` engine, so a second opinion from a **different provider** is one command away. After your `reviewer` approves a non-trivial diff — or on any change touching a critical area — you MAY have Codex review the SAME diff against this repo's own standards (already rendered in `AGENTS.md` + `.codex/agents/reviewer.toml`):
+
+```bash
+CODEX_HOME=$(pwd)/.codex codex exec --sandbox read-only "revisa el diff origin/{{prTarget}}...HEAD según los estándares del repo"
+```
+
+- **Read-only:** Codex inspects, never edits or commits, and needs no approvals.
+- The verdict lands on **stdout**; progress noise goes to stderr.
+- Auth via `CODEX_API_KEY` or a prior `codex login`. Don't pass `--model` — Codex's default is correct.
+- **Advisory, not a gate:** a second lens on the diff. Weigh its findings against your `reviewer`'s and decide; it doesn't block the PR on its own.
+
+Reach for it in `criticalAreas`, on high-blast-radius changes, or when the user asks for a cross-check — not on every trivial diff.

package/dist/assets/core/core-assets/managed/orquestacion.md

@@ -37,7 +37,7 @@ Fan-out is a lever, not a toll — so when you do delegate, hand the smallest en
 
 - **Peel off the mechanical first.** Copies, renames, scaffolding, JSON/string edits → do them yourself in R1 or send them to a low-tier agent; never bundle them into an `implementer`'s encargo, where they inflate its context and its run without raising quality.
 - **One encargo = one unit.** A pre-existing bug the `implementer` hits outside its scope → it reports and stops there (a trivial one-liner is the exception); **you** decide whether to open a separate unit. Scope doesn't self-expand mid-run.
-- **Tier by sub-task, not by round.** Mechanical work → low tier; judgment (design, security regex, removal semantics) → high tier; a single fix round can mix both. See `docs/recipes/model-tiering.md`.
+- **Tier by sub-task, not by round.** A single fix round can mix tiers. Map: **low** → mechanical work (copies, renames, scaffolding, string/JSON edits, a one-line fix); **mid** → a scoped bugfix with a clear cause or a bounded feature; **high** → judgment work (design, security regex, ambiguous root-cause, removal semantics, critical areas).
 - **One-pass review on small/medium diffs.** Fix minor review findings yourself instead of spending a re-verification round; reserve a re-review for a risky fix that touched shared machinery.
 
 ### Continuous execution (don't pause between tasks)
@@ -46,4 +46,6 @@ Once the plan/scope is approved (R2+), execute ALL sub-tasks without confirming
 
 ### Synthesis without broken telephone
 
-Instruct subagents to **write to `.claude/progress/<file>.md`**; you receive only `done -> file`. That folder is ONLY for ephemeral agent handoffs (`audit_*`, `explore_*`, `research_*`, `impl_*`, `review_*`); **session state** (task, plan, blockers) lives in `progress/current.md` (root, git-persisted) and you consolidate it, never the subagents — each `implementer` reports its state (including `blocked`) in its own `impl_<feature>.md`. Verify the diff/evidence yourself; don't trust the report blindly. To close the cycle, invoke `commit-pr-pilot` — when `review_<feature>.md` says `APPROVED` (R2+), or directly for a trivial R1 diff that never went through a `reviewer`. The pilot gates the PR on `{{qualityGate.full}}` (green over the shipping diff — the reviewer's Pass-2 evidence in R2+, or the pilot's own run in R1). Pre-flight: clean working tree, not on `{{branchBase}}`, `gh auth status` ok. If `CHANGES_REQUESTED`, launch a **fresh** `implementer` scoped to just the findings — not a resume of the hot one (dragging a large transcript re-feeds its whole history every turn and rarely pays for a bounded fix round), and not the pilot.
+Instruct subagents to **write to `.claude/progress/<file>.md`**; you receive only `done -> file`. That folder is ONLY for ephemeral agent handoffs (`audit_*`, `plan_*`, `explore_*`, `research_*`, `impl_*`, `review_*`, `receipt.txt`); **session state** (task, plan, blockers) lives in `progress/current.md` (root, git-persisted) and you consolidate it, never the subagents — each `implementer` reports its state (including `blocked`) in its own `impl_<feature>.md`. Verify the diff/evidence yourself; don't trust the report blindly. To close the cycle, invoke `commit-pr-pilot` — when `review_<feature>.md` says `APPROVED` (R2+), or directly for a trivial R1 diff that never went through a `reviewer`. The pilot gates the PR on `{{qualityGate.full}}` (green over the shipping diff — the reviewer's Pass-2 evidence in R2+, or the pilot's own run in R1). Pre-flight: not on `{{branchBase}}`, `gh auth status` ok (no clean-working-tree check — the pilot's trigger IS the uncommitted diff, and the pilot owns that commit). If `CHANGES_REQUESTED`, launch a **fresh** `implementer` scoped to just the findings — not a resume of the hot one (dragging a large transcript re-feeds its whole history every turn and rarely pays for a bounded fix round), and not the pilot.
+
+**Second opinion (post-`APPROVED`).** On a non-trivial diff — or any change touching a critical area — if this repo also renders the `codex` engine, a review from a **different provider** is one command away: see the **Cross-model review** sub-block in `.claude/agents/leader.md`.

package/dist/assets/core/core-assets/skills/dominio.md

@@ -0,0 +1,67 @@
+---
+name: dominio
+description: Use when you discover — or need — a durable fact that spans multiple repos of a workspace (data model, business rule, migration, cross-service contract, shared gotcha). The Dominio is the workspace's canonical knowledge base; read it before assuming a model, and promote such facts into it instead of only saving to session memory.
+type: reference
+---
+
+# dominio — the workspace knowledge base
+
+Canonical, cross-repo facts for a workspace live as markdown under
+`~/.navori/workspaces/<name>/dominio/`: one file per entry (`<id>.md`) plus a
+derived index (`DOMINIO.md`) that is injected at session start. This is where a
+fact like *"`coach`/`coachee` no longer exist — it's `user-profile.kind`"* lives
+once for every repo, so it isn't relearned wrong in each one.
+
+## Read first
+
+The Dominio index is injected at the top of each session for repos that belong to
+a workspace. **Before assuming a data model, business rule or cross-service
+contract, check it.** Open the full entry (`navori dominio show <id>`, or read
+`workspace://<name>/dominio/<id>.md`) when you need the detail behind an index
+line.
+
+## When to promote a fact (all THREE must hold)
+
+1. **Durable** — it won't change next sprint; a structural fact, not a transient state.
+2. **Transversal** — it applies to **≥2 repos** of the workspace. Test: *"would an agent in ANOTHER repo get this wrong without it?"*
+3. **Canonical** — it's a fact/rule, not a task, a log, or an opinion.
+
+If it passes, write it to the Dominio (below). If not, it belongs elsewhere.
+
+### Do NOT put in the Dominio
+
+Ticket status / progress / TODOs → `progress/`. Session scratch → engram.
+Single-repo detail → that repo's `CLAUDE.md`. Personal preferences → engram.
+Volatile values (versions, counts). **Secrets — never.**
+
+## How to write an entry
+
+Create `~/.navori/workspaces/<name>/dominio/<slug>.md` (`<slug>` is a stable
+kebab-case id = the filename). Keep it to **one fact, short**:
+
+```markdown
+---
+id: user-profile-model
+title: Modelo user-profile
+type: migration          # architecture | business-rule | migration | gotcha | glossary
+applies-to: [nexus, webapp, dashboard, mobile]   # repos, or "all"
+status: canonical        # canonical | deprecated | superseded
+supersedes: []           # ids this entry replaces
+updated: 2026-07-30
+updated_by: <you>
+---
+
+<the fact>. **Por qué:** <reason>. **Cómo aplica:** <what to do differently>.
+```
+
+Then run `navori dominio reindex` to refresh the index.
+
+## Curate — update, don't pile up
+
+- **Update > duplicate.** Search existing entries first (`navori dominio list`);
+  edit the matching one and bump `updated`, don't add a second.
+- **Retire, don't delete.** When a fact is replaced, set the old entry
+  `status: superseded` and point the new one's `supersedes:` at it — the history
+  keeps an agent from rediscovering the old model.
+- **`navori dominio doctor`** validates coherence (all warnings). Reindex after
+  any change.