navori 0.6.4 → 0.6.5

package/dist/assets/core/core-assets/hooks/_partials/audit-log.sh

@@ -0,0 +1,170 @@
+# Shared audit-mode event recorder — inlined into each managed hook at render
+# time (see the include directive in the source scripts + lib/hook-includes.ts).
+#
+# WHY (spec 0013): a hook is only visible to the transcript when it BLOCKS or
+# INJECTS context. Every hook that runs and lets the action through is invisible,
+# so `navori audit` could never answer "did the gate run, and what did it cost?".
+# The transcript cannot be fixed — it is the host's format — so the harness
+# records its own execution instead, and the session log becomes the source of
+# truth for what the harness did.
+#
+# Expects `$payload` (the raw hook payload on stdin) to be in scope, and reads
+# `$navori_audit_t0` for the start instant. Both are set by `navori_audit_begin`.
+#
+# Every variable read here carries a `:-` default ON PURPOSE: most managed hooks
+# run under `set -euo pipefail`, where an unset variable ABORTS the hook. A
+# recorder that can abort the thing it observes is worse than no recorder, so the
+# partial must be safe to inline into `set -u` and `set +e` alike.
+#
+# FAIL-OPEN ABSOLUTE, and this matters more here than anywhere else: this code is
+# inlined into hooks whose own contract is to never break a session. Observation
+# must never become the reason an action fails, so every path returns 0 and
+# nothing is ever written to stdout — a stray byte there would be interpreted by
+# the host as hook output (context injection, or a block reason).
+
+# Start the clock — but only after establishing that anything will be recorded.
+#
+# THE COST OF BEING OFF is the number that matters here: this code is inlined
+# into hooks that fire on EVERY Bash call, and audit-mode is off for virtually
+# every session of every user. An earlier version ran `perl` plus two `jq`
+# invocations before it ever checked whether a log existed — three processes per
+# hook, four hooks per command, ~48 ms on every single shell call for a feature
+# nobody had turned on.
+#
+# So the gate is a pure-builtin one first: the per-repo audit directory only
+# exists once audit-mode has been activated in this repo at least once. No
+# subprocess, no parsing. Everything expensive lives behind it.
+navori_audit_begin() {
+  navori_audit_on=0
+
+  navori_audit_root=${NAVORI_AUDITS_ROOT:-}
+  if [ -z "$navori_audit_root" ]; then
+    [ -n "${HOME:-}" ] || return 0
+    navori_audit_root=$HOME/.navori/audits
+  fi
+
+  # The gate tests the audit ROOT, not the per-repo directory.
+  #
+  # Deriving the repo cheaply would mean `${CLAUDE_PROJECT_DIR##*/}` — and that
+  # is WRONG: the authoritative repo comes from the payload's `cwd`, and the two
+  # differ whenever a hook fires inside an agent worktree, since the hook process
+  # starts in the main repo (#454). A gate built on the wrong name would silently
+  # record nothing exactly where the harness runs its parallel work.
+  #
+  # The root alone is enough for what this gate is for: a user who has never
+  # activated audit-mode anywhere has no `~/.navori/audits`, so the common case
+  # costs one stat and zero processes. Someone who does use audit-mode pays the
+  # parsing — which is the cost of the feature they turned on.
+  [ -d "$navori_audit_root" ] || return 0
+
+  navori_audit_on=1
+  navori_audit_t0=$(navori_audit_now)
+}
+
+# Milliseconds since epoch, spending a process only when it has to.
+#
+# `$EPOCHREALTIME` is a BUILTIN in bash 5 and in zsh (with zsh/datetime, which
+# the harness's zsh path already has): no fork at all. Only a shell without it
+# pays for `perl`, and only a machine without perl degrades to whole seconds —
+# `date` has no portable millisecond format (GNU has %s%3N, BSD does not).
+navori_audit_now() {
+  if [ -n "${EPOCHREALTIME:-}" ]; then
+    # `1756... .123456` → milliseconds, with pure parameter expansion.
+    navori_audit_epoch=${EPOCHREALTIME/,/.}
+    printf '%s%s' "${navori_audit_epoch%%.*}" "$(printf '%.3s' "${navori_audit_epoch#*.}")"
+    return 0
+  fi
+  perl -MTime::HiRes=time -e 'printf "%.0f", time*1000' 2>/dev/null \
+    || printf '%s' $(( $(date +%s 2>/dev/null || echo 0) * 1000 ))
+}
+
+# navori_audit_log <verdict> [reason]
+#
+# `name`, `phase`, `tool` and `source` come from the caller's own variables,
+# which the render sets per hook — the partial never guesses which hook it is
+# inlined into.
+navori_audit_log() {
+  # The builtin-only gate from `navori_audit_begin`: when audit-mode was never
+  # activated in this repo, nothing below runs and no process is spawned.
+  [ "${navori_audit_on:-0}" = "1" ] || return 0
+  # No payload, no jq, no clock → nothing to record. Each of these is a normal
+  # state for a hook that bailed early, not an error worth surfacing.
+  [ -n "${payload:-}" ] || return 0
+  command -v jq >/dev/null 2>&1 || return 0
+
+  # ONE jq for every field, not one per field: this runs on each hook of each
+  # Bash call, and a fork is the most expensive thing in it. Newline-separated,
+  # read back positionally.
+  navori_audit_fields=$(printf '%s' "${payload:-}" | jq -r '[.session_id // "", .cwd // "", .agent_id // .subagent_id // ""] | .[]' 2>/dev/null) || return 0
+  navori_audit_session=${navori_audit_fields%%
+*}
+  navori_audit_rest=${navori_audit_fields#*
+}
+  navori_audit_cwd=${navori_audit_rest%%
+*}
+  navori_audit_agent=${navori_audit_rest#*
+}
+  [ -n "$navori_audit_session" ] || return 0
+  # Same character class the CLI enforces (#503): the id composes a path, so
+  # anything path-shaped means the payload is not what we think it is.
+  case "$navori_audit_session" in
+    *[!A-Za-z0-9_-]*) return 0 ;;
+  esac
+
+  [ -n "$navori_audit_cwd" ] || navori_audit_cwd=$PWD
+  navori_audit_repo=$(basename "$navori_audit_cwd" 2>/dev/null) || return 0
+  [ -n "$navori_audit_repo" ] || return 0
+
+  navori_audit_file=$navori_audit_root/$navori_audit_repo/session-$navori_audit_session.log
+
+  # The session may not be the marked one even in a repo that has been audited
+  # before. Also the writability check — a log that cannot be appended to is not
+  # an error, it is simply not recording.
+  [ -f "$navori_audit_file" ] || return 0
+  [ -w "$navori_audit_file" ] || return 0
+
+  # Volume valve, OFF by default.
+  #
+  # `PreToolUse(Bash)` chains four hooks, so every shell command leaves four
+  # lines and most are `skip` — a long session runs to thousands. Set
+  # NAVORI_AUDIT_SKIP_NOOPS=1 to drop the ones that did nothing.
+  #
+  # Default off on purpose: a `skip` is the ONLY evidence that a hook ran and
+  # decided it had no business acting, which is exactly what distinguishes it
+  # from a hook that never executed — the question that motivated recording
+  # hooks at all. The valve trades that away knowingly; it must not be the
+  # silent default.
+  if [ "${NAVORI_AUDIT_SKIP_NOOPS:-0}" = "1" ]; then
+    case "$1" in
+      skip|noop) return 0 ;;
+    esac
+  fi
+
+  navori_audit_end=$(navori_audit_now)
+  navori_audit_ms=$(( navori_audit_end - ${navori_audit_t0:-$navori_audit_end} ))
+  [ "$navori_audit_ms" -ge 0 ] 2>/dev/null || navori_audit_ms=0
+
+  navori_audit_ts=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null) || navori_audit_ts=""
+  # `navori_audit_agent` came out of the same single jq above. It is what lets
+  # the report attribute a hook to a subagent WITHOUT guessing: with agents
+  # running in parallel their time windows overlap, so attribution by timestamp
+  # is the fallback, not the primary route.
+
+  printf '%s\n' "$(jq -cn \
+    --arg ts "$navori_audit_ts" \
+    --arg name "${navori_audit_name:-unknown}" \
+    --arg phase "${navori_audit_phase:-unknown}" \
+    --arg verdict "${1:-unknown}" \
+    --arg reason "${2:-}" \
+    --arg tool "${navori_audit_tool:-}" \
+    --arg src "${navori_audit_source:-core}" \
+    --arg agent "${navori_audit_agent:-}" \
+    --argjson ms "$navori_audit_ms" \
+    '{ts:$ts,event:"hook",name:$name,phase:$phase,verdict:$verdict,ms:$ms,source:$src}
+     + (if $tool   == "" then {} else {tool:$tool}       end)
+     + (if $reason == "" then {} else {reason:$reason}   end)
+     + (if $agent  == "" then {} else {agentId:$agent}   end)' 2>/dev/null)" \
+    >> "$navori_audit_file" 2>/dev/null
+
+  return 0
+}

package/dist/assets/core/core-assets/hooks/audit-mode-trigger.sh

@@ -1,15 +1,20 @@
 #!/usr/bin/env bash
-# navori — audit-mode trigger (UserPromptSubmit)
+# navori — audit-mode prompt recorder (UserPromptSubmit)
 #
-# Detects an audit-mode invocation in the user's prompt and asks Claude to
-# CONFIRM with the user before anything is recorded. It never activates the
-# mode by itself: a false positive must die in the question, leaving no state
-# on disk.
+# While audit-mode is active, appends the typed prompt to the session's
+# append-only log. That is its ONLY job.
 #
-# While the mode is active it appends the typed prompt to the session's
-# append-only log. Writes are O_APPEND only; the log is never re-read to be
-# rewritten, so parallel subagents cannot corrupt it and a crashed session
-# still leaves a valid (merely shorter) file.
+# It used to also detect an audit-mode invocation in the prompt text and ask
+# Claude to confirm activation. That was removed (spec 0013, R3): matching
+# `audit mode` as a substring cannot separate INVOKING the mode from TALKING
+# ABOUT it, and talking about it is what you do all day while working on the
+# feature. The asymmetry made it worse — turning it ON matched loosely, while
+# turning it OFF required the literal phrase, so sessions stayed open forever.
+# Activation is now exclusively `navori audit --start <id>`.
+#
+# Writes are O_APPEND only; the log is never re-read to be rewritten, so
+# parallel subagents cannot corrupt it and a crashed session still leaves a
+# valid (merely shorter) file.
 #
 # FAIL-OPEN ABSOLUTE: this hook runs on every prompt. Any error, any missing
 # dependency, any odd path exits 0 silently. It must never be the reason a
@@ -17,34 +22,6 @@
 
 set +e
 
-emit_and_exit() { printf '%s\n' "$1"; exit 0; }
-
-# Is `audit` actually available in the CLI on PATH?
-#
-# The hook orders the agent to run `navori audit --start`, and that resolves the
-# PUBLISHED binary, never a working tree's build. When the installed version
-# predates the subcommand, citty prints the help and exits 0 — so an agent that
-# checks the exit code reads a silent no-op as success and reports a recording
-# that never started. Match the subcommand inside the CLI's own USAGE line
-# instead of trusting the status.
-#
-# Returns 1 when the subcommand is absent AND when the check itself cannot run
-# (no binary on PATH, no USAGE line). Both collapse into "could not confirm",
-# which is what the caller's message must say: claiming "your version is old"
-# would be wrong for a machine with no navori installed at all.
-audit_subcommand_available() {
-  command -v navori >/dev/null 2>&1 || return 1
-  usage=$(navori --help 2>/dev/null | grep -m1 '^USAGE' 2>/dev/null) || return 1
-  [ -n "$usage" ] || return 1
-  # Normalize separators so the token matches at any position: `USAGE navori
-  # init|add|audit` -> `|USAGE|navori|init|add|audit|`.
-  tokens=$(printf '%s' "$usage" | tr ' ' '|' 2>/dev/null) || return 1
-  case "|$tokens|" in
-    *"|audit|"*) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
 payload=$(cat 2>/dev/null) || exit 0
 [ -n "$payload" ] || exit 0
 command -v jq >/dev/null 2>&1 || exit 0
@@ -84,49 +61,20 @@ else
 fi
 log_file=$audits_root/$repo/session-$session_id.log
 
-lower=$(printf '%s' "$prompt" | tr '[:upper:]' '[:lower:]' 2>/dev/null) || exit 0
-
-# Deliberately tolerant: a spurious match costs one question, while a missed
-# one costs the whole recording.
-case "$lower" in
-  *"audit mode"*|*"audit-mode"*|*"modo audit"*|*"modo auditoría"*|*"modo auditoria"*) matched=1 ;;
-  *) matched=0 ;;
-esac
-
-case "$lower" in
-  *apaga*|*apagar*|*desactiva*|*"salir de"*|*detén*|*deten*|*stop*|*"turn off"*|*disable*) off_intent=1 ;;
-  *) off_intent=0 ;;
-esac
-
-if [ -f "$log_file" ]; then
-  # Active: record the human's own words — they entered the model's context,
-  # so they cost tokens and belong in the audit.
-  #
-  # `transcript_path` rides along because the payload is the ONLY place it is
-  # stated. Without it the reader has to guess the transcript's location by
-  # re-deriving Claude Code's undocumented directory encoding (see paths.ts),
-  # and a guess that misses costs the whole report.
-  ts=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null) || ts=""
-  transcript=$(printf '%s' "$payload" | jq -r '.transcript_path // ""' 2>/dev/null) || transcript=""
-  printf '%s\n' "$(jq -cn --arg ts "$ts" --arg ev "prompt" --arg p "$prompt" --arg tr "$transcript" \
-    '{ts:$ts,event:$ev,prompt:$p} + (if $tr == "" then {} else {transcript:$tr} end)' 2>/dev/null)" >> "$log_file" 2>/dev/null
+# Not marked → not recording. This is also what makes the hook free outside
+# audit-mode: one stat and out.
+[ -f "$log_file" ] || exit 0
 
-  if [ "$matched" = "1" ] && [ "$off_intent" = "1" ]; then
-    if audit_subcommand_available; then
-      emit_and_exit "[navori audit-mode] The user asked to turn audit-mode OFF. Before doing anything, ask them explicitly: \"audit mode will be turned off, continue?\". Only if they confirm, run: navori audit --stop $session_id (that seals the log and generates the report). Then check the output: it must name the report it wrote. If it prints the command list (USAGE) instead, the installed CLI has no such subcommand — tell the user and do NOT assume the session was closed. If they decline, leave the mode active and carry on with the task."
-    else
-      emit_and_exit "[navori audit-mode] The user asked to turn audit-mode OFF, but the available 'navori' could not be confirmed to ship the 'audit' subcommand: it may not be installed at all, or it may predate that command. Do NOT run 'navori audit --stop' blindly: if the binary exists but is old, it prints its help and exits 0, which looks like success without being one. Tell the user what happened and that the session log stays intact on disk, so the report can still be generated once the CLI is up to date. Then carry on with the task."
-    fi
-  fi
-  exit 0
-fi
-
-if [ "$matched" = "1" ] && [ "$off_intent" = "0" ]; then
-  if audit_subcommand_available; then
-    emit_and_exit "[navori audit-mode] An audit-mode invocation was detected in the prompt. Before activating anything, ask the user explicitly: \"an audit mode invocation was detected, continue?\". Only if they confirm, run: navori audit --start $session_id (that creates the session log). Then check the output: it must name the log file it created. If it prints the command list (USAGE) instead, the installed CLI has no such subcommand — tell the user and do NOT assume the mode is active. If they decline, run nothing and carry on with the task."
-  else
-    emit_and_exit "[navori audit-mode] An audit-mode invocation was detected, but the available 'navori' could not be confirmed to ship the 'audit' subcommand: it may not be installed at all, or it may predate that command. Do NOT run 'navori audit --start' blindly: if the binary exists but is old, it prints its help and exits 0, which looks like success without being one. Tell the user that nothing was activated, and why. Then carry on with the task."
-  fi
-fi
+# Record the human's own words — they entered the model's context, so they cost
+# tokens and belong in the audit.
+#
+# `transcript_path` rides along because the payload is the ONLY place it is
+# stated. Without it the reader has to guess the transcript's location by
+# re-deriving Claude Code's undocumented directory encoding (see paths.ts),
+# and a guess that misses costs the whole report.
+ts=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null) || ts=""
+transcript=$(printf '%s' "$payload" | jq -r '.transcript_path // ""' 2>/dev/null) || transcript=""
+printf '%s\n' "$(jq -cn --arg ts "$ts" --arg ev "prompt" --arg p "$prompt" --arg tr "$transcript" \
+  '{ts:$ts,event:$ev,prompt:$p} + (if $tr == "" then {} else {transcript:$tr} end)' 2>/dev/null)" >> "$log_file" 2>/dev/null
 
 exit 0

package/dist/assets/core/core-assets/hooks/guard-destructive.sh

@@ -30,7 +30,43 @@ set -euo pipefail
 # A missing JSON parser used to make this guard wave every command through; the
 # shared extractor falls back to sed so it still inspects the command.
 # navori:include extract-cmd
-[ -z "$cmd" ] && exit 0
+
+navori_audit_name="guard-destructive"
+navori_audit_phase="PreToolUse"
+navori_audit_tool="Bash"
+# Fallback no-ops, overwritten by the real definitions the include brings in.
+# They exist because this hook is FAIL-OPEN: if the file ever runs WITHOUT its
+# includes expanded — a raw copy of the asset, a render that half-finished — an
+# undefined function would be exit 127, and under `set -e` that KILLS the hook.
+# A recorder that can kill the thing it observes is the one bug this partial may
+# never have.
+navori_audit_begin() { :; }
+navori_audit_log() { :; }
+# navori:include audit-log
+navori_audit_begin
+
+# The verdict is resolved in a trap, NOT by a call at the end of the file.
+#
+# This hook's managed block ends before its `navori:user-section`, and the render
+# only syncs what is INSIDE the block — so a call placed after it lives in the
+# user's own territory and never reaches the mirror. That is exactly how the most
+# critical hook in the harness ended up being the only one not recording.
+#
+# The trap also covers the extra guards a user writes in that section: whatever
+# they add, the exit code still tells the truth about what happened.
+navori_audit_verdict="allow"
+navori_audit_reason=""
+navori_audit_on_exit() {
+  navori_audit_log "$navori_audit_verdict" "$navori_audit_reason" || true
+  return 0
+}
+trap navori_audit_on_exit EXIT
+
+if [ -z "$cmd" ]; then
+  navori_audit_verdict="skip"
+  navori_audit_reason="sin comando que inspeccionar"
+  exit 0
+fi
 
 # branchBase is shell-quoted at render time via the shq: marker (#197): a
 # hostile branchBase in navori.config.json lands here as an inert literal,
@@ -43,6 +79,11 @@ block() {
   # should carry, and the reason line already says which rule fired.
   echo "[navori] command: ${cmd:0:2000}" >&2
   echo "[navori] if intentional, run the command yourself outside the agent." >&2
+  # Only ASSIGNMENTS here: this is the one place the guard says no, and nothing
+  # may come between the decision and `exit 2`. The recording happens in the
+  # trap, after the exit is already committed.
+  navori_audit_verdict="block"
+  navori_audit_reason="$1"
   exit 2
 }
 

package/dist/assets/core/core-assets/hooks/managed-drift-watch.sh

@@ -40,6 +40,46 @@
 # in a normal session is none and in a bad one is one.
 set -uo pipefail
 
+# PostToolUse delivers its payload on stdin; this hook never needed it and the
+# audit recorder does (session_id/cwd), so it is captured rather than ignored.
+payload=$(cat 2>/dev/null) || payload=""
+
+navori_audit_name="managed-drift-watch"
+navori_audit_phase="PostToolUse"
+navori_audit_tool="Bash"
+# Fallback no-ops, overwritten by the real definitions the include brings in.
+# They exist because this hook is FAIL-OPEN: if the file ever runs WITHOUT its
+# includes expanded — a raw copy of the asset, a render that half-finished — an
+# undefined function would be exit 127, and under `set -e` that KILLS the hook.
+# A recorder that can kill the thing it observes is the one bug this partial may
+# never have.
+navori_audit_begin() { :; }
+navori_audit_log() { :; }
+# navori:include audit-log
+navori_audit_begin
+
+# This hook has SEVEN early exits (no sha, no roots, no changes, …). Wiring a
+# call into each is how the set drifts the next time one is added, so the verdict
+# is derived once, from the exit code, in a trap.
+#
+# `navori_audit_reached_check` is what separates "ran and found nothing" from
+# "bailed before checking anything" — the distinction the whole exercise exists
+# for. Without it every early exit would report `clean`, i.e. would claim a
+# verification that never happened.
+navori_audit_reached_check=0
+navori_audit_on_exit() {
+  navori_audit_code=$?
+  if [ "$navori_audit_code" -eq 2 ]; then
+    navori_audit_log "dirty" "bloque managed con hash desalineado"
+  elif [ "$navori_audit_reached_check" -eq 1 ]; then
+    navori_audit_log "clean"
+  else
+    navori_audit_log "skip" "sin nada que verificar"
+  fi
+  return 0
+}
+trap navori_audit_on_exit EXIT
+
 cd "${CLAUDE_PROJECT_DIR:-.}" 2>/dev/null || exit 0
 
 stamp=".claude/.managed-drift-stamp"
@@ -121,6 +161,7 @@ done <<EOF
 $changed
 EOF
 
+navori_audit_reached_check=1
 [ -z "$drift" ] && exit 0
 
 # Exit 2 so the text reaches the model rather than scrolling past in a log: the

package/dist/assets/core/core-assets/hooks/precompact-session-summary.sh

@@ -21,14 +21,53 @@
 # The managed block is regenerated by `navori render`; do NOT edit by hand.
 set -euo pipefail
 
-cat >/dev/null 2>&1 || true   # drain the PreCompact JSON on stdin (unused)
+# The PreCompact JSON was drained and discarded here; it is kept now because the
+# audit recorder reads `session_id`/`cwd` out of it. Draining is still the point:
+# an undrained stdin can leave the host writing into a closed pipe.
+payload=$(cat 2>/dev/null) || payload=""
+
+navori_audit_name="precompact-session-summary"
+navori_audit_phase="PreCompact"
+# Fallback no-ops, overwritten by the real definitions the include brings in.
+# They exist because this hook is FAIL-OPEN: if the file ever runs WITHOUT its
+# includes expanded — a raw copy of the asset, a render that half-finished — an
+# undefined function would be exit 127, and under `set -e` that KILLS the hook.
+# A recorder that can kill the thing it observes is the one bug this partial may
+# never have.
+navori_audit_begin() { :; }
+navori_audit_log() { :; }
+# navori:include audit-log
+navori_audit_begin
+
+# The verdict is a VARIABLE resolved in a trap, not a call per branch. These
+# hooks have several early exits each (no git, no worktrees, nothing to inject),
+# and wiring a call into every one is how the set drifts the next time somebody
+# adds an exit. Defaulting to `skip` makes a new early exit semantically correct
+# for free: it means "ran, decided it had nothing to do", which is exactly what
+# an unhandled early return is.
+navori_audit_verdict="skip"
+navori_audit_reason=""
+navori_audit_on_exit() {
+  navori_audit_log "$navori_audit_verdict" "$navori_audit_reason" || true
+  return 0
+}
+trap navori_audit_on_exit EXIT
+
 
 ctx="A punto de compactar el contexto: el detalle turno-a-turno se resumirá. Antes de perderlo, persiste un resumen de sesión con tu herramienta de memoria (engram: guarda el resumen de sesión) y/o anota las decisiones y los bugs con causa raíz de esta sesión en progress/current.md."
 
 # Emit additionalContext safely: node (best escaping) → jq → give up (exit 0).
 if command -v node >/dev/null 2>&1; then
   CTX="$ctx" node -e 'process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreCompact",additionalContext:process.env.CTX}}))'
+  navori_audit_verdict="inject"
 elif command -v jq >/dev/null 2>&1; then
   jq -n --arg ctx "$ctx" '{hookSpecificOutput:{hookEventName:"PreCompact",additionalContext:$ctx}}'
+  navori_audit_verdict="inject"
+else
+  # Neither serializer available: the reminder never reached the model. Recorded
+  # as `noop` rather than `inject`, because the audit must not claim a context
+  # injection that did not happen.
+  navori_audit_verdict="noop"
+  navori_audit_reason="sin node ni jq: el recordatorio no se emitio"
 fi
 exit 0

package/dist/assets/core/core-assets/hooks/quality-gate-pre-commit.sh

@@ -20,6 +20,42 @@ set -euo pipefail
 # Command extraction (payload → $cmd). Shared body, single source of truth.
 # navori:include extract-cmd
 
+navori_audit_name="quality-gate-pre-commit"
+navori_audit_phase="PreToolUse"
+navori_audit_tool="Bash"
+# Fallback no-ops, overwritten by the real definitions the include brings in.
+# They exist because this hook is FAIL-OPEN: if the file ever runs WITHOUT its
+# includes expanded — a raw copy of the asset, a render that half-finished — an
+# undefined function would be exit 127, and under `set -e` that KILLS the hook.
+# A recorder that can kill the thing it observes is the one bug this partial may
+# never have.
+navori_audit_begin() { :; }
+navori_audit_log() { :; }
+# navori:include audit-log
+navori_audit_begin
+
+# This hook fires on EVERY Bash call and does real work on almost none of them,
+# so its verdict is derived from the exit code in a trap rather than from a call
+# per branch — the branch set here is the one most likely to grow.
+#
+# `navori_audit_ran_gate` is the distinction that matters: the recorded `ms` of a
+# run that actually executed the gate (tens of seconds) means something very
+# different from that of a run that looked at the command and moved on (single
+# digits). Collapsing both into `allow` would make the timing unreadable.
+navori_audit_ran_gate=0
+navori_audit_on_exit() {
+  navori_audit_code=$?
+  if [ "$navori_audit_code" -ne 0 ]; then
+    navori_audit_log "block" "el quality gate no paso o no pudo correr" || true
+  elif [ "$navori_audit_ran_gate" -eq 1 ]; then
+    navori_audit_log "allow" "gate ejecutado y verde" || true
+  else
+    navori_audit_log "skip" "el comando no es un commit" || true
+  fi
+  return 0
+}
+trap navori_audit_on_exit EXIT
+
 # Detect the project's REAL package manager from lockfiles / package.json, so a
 # gate command hardcoded to one PM (e.g. `pnpm run ...`) can still run in a repo
 # that actually uses another (e.g. bun). Mirrors lib/detect.ts precedence:
@@ -45,6 +81,7 @@ is_pm() {
 }
 
 run_gate() {
+  navori_audit_ran_gate=1
   echo "[navori] running quality-gate fast: $1" >&2
   eval "$1" || {
     echo "[navori] quality-gate fast failed. Commit aborted." >&2

package/dist/assets/core/core-assets/hooks/session-start-context.sh

@@ -22,7 +22,38 @@
 # The `{{...}}` placeholders are filled by `navori render`; do NOT edit by hand.
 set -euo pipefail
 
-cat >/dev/null 2>&1 || true   # drain the SessionStart JSON on stdin (unused)
+# The payload was drained and discarded here; it is kept now because the audit
+# recorder reads `session_id`/`cwd` out of it. Draining is still the point: an
+# undrained stdin can leave the host writing into a closed pipe.
+payload=$(cat 2>/dev/null) || payload=""
+
+navori_audit_name="session-start-context"
+navori_audit_phase="SessionStart"
+# Fallback no-ops, overwritten by the real definitions the include brings in.
+# They exist because this hook is FAIL-OPEN: if the file ever runs WITHOUT its
+# includes expanded — a raw copy of the asset, a render that half-finished — an
+# undefined function would be exit 127, and under `set -e` that KILLS the hook.
+# A recorder that can kill the thing it observes is the one bug this partial may
+# never have.
+navori_audit_begin() { :; }
+navori_audit_log() { :; }
+# navori:include audit-log
+navori_audit_begin
+
+# The verdict is a VARIABLE resolved in a trap, not a call per branch. These
+# hooks have several early exits each (no git, no worktrees, nothing to inject),
+# and wiring a call into every one is how the set drifts the next time somebody
+# adds an exit. Defaulting to `skip` makes a new early exit semantically correct
+# for free: it means "ran, decided it had nothing to do", which is exactly what
+# an unhandled early return is.
+navori_audit_verdict="skip"
+navori_audit_reason=""
+navori_audit_on_exit() {
+  navori_audit_log "$navori_audit_verdict" "$navori_audit_reason" || true
+  return 0
+}
+trap navori_audit_on_exit EXIT
+
 
 ctx=""
 add() { ctx="${ctx}${1}"$'\n'; }
@@ -103,12 +134,25 @@ if [ -d "$HOME/.navori/workspaces" ] && command -v navori >/dev/null 2>&1; then
   fi
 fi
 
-[ -n "$ctx" ] || exit 0
+if [ -z "$ctx" ]; then
+  navori_audit_verdict="noop"
+  navori_audit_reason="no habia contexto que inyectar"
+  exit 0
+fi
 
 # Emit the JSON safely: node (best escaping) → jq → give up (exit 0, no context).
 if command -v node >/dev/null 2>&1; then
   CTX="$ctx" node -e 'process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"SessionStart",additionalContext:process.env.CTX}}))'
+  # `bytes` is what makes this measurable: session startup is the single largest
+  # context cost of a session, and this hook is one of its inputs.
+  navori_audit_verdict="inject"
+  navori_audit_reason="${#ctx} bytes"
 elif command -v jq >/dev/null 2>&1; then
   jq -n --arg ctx "$ctx" '{hookSpecificOutput:{hookEventName:"SessionStart",additionalContext:$ctx}}'
+  navori_audit_verdict="inject"
+  navori_audit_reason="${#ctx} bytes"
+else
+  navori_audit_verdict="noop"
+  navori_audit_reason="sin node ni jq: el contexto no se emitio"
 fi
 exit 0

package/dist/assets/core/core-assets/hooks/stop-verify-reminder.sh

@@ -21,7 +21,38 @@
 # The managed block is regenerated by `navori render`; do NOT edit by hand.
 set -euo pipefail
 
-cat >/dev/null 2>&1 || true   # drain the Stop JSON on stdin (unused)
+# The payload was drained and discarded here; it is kept now because the audit
+# recorder reads `session_id`/`cwd` out of it. Draining is still the point: an
+# undrained stdin can leave the host writing into a closed pipe.
+payload=$(cat 2>/dev/null) || payload=""
+
+navori_audit_name="stop-verify-reminder"
+navori_audit_phase="Stop"
+# Fallback no-ops, overwritten by the real definitions the include brings in.
+# They exist because this hook is FAIL-OPEN: if the file ever runs WITHOUT its
+# includes expanded — a raw copy of the asset, a render that half-finished — an
+# undefined function would be exit 127, and under `set -e` that KILLS the hook.
+# A recorder that can kill the thing it observes is the one bug this partial may
+# never have.
+navori_audit_begin() { :; }
+navori_audit_log() { :; }
+# navori:include audit-log
+navori_audit_begin
+
+# The verdict is a VARIABLE resolved in a trap, not a call per branch. These
+# hooks have several early exits each (no git, no worktrees, nothing to inject),
+# and wiring a call into every one is how the set drifts the next time somebody
+# adds an exit. Defaulting to `skip` makes a new early exit semantically correct
+# for free: it means "ran, decided it had nothing to do", which is exactly what
+# an unhandled early return is.
+navori_audit_verdict="skip"
+navori_audit_reason=""
+navori_audit_on_exit() {
+  navori_audit_log "$navori_audit_verdict" "$navori_audit_reason" || true
+  return 0
+}
+trap navori_audit_on_exit EXIT
+
 
 # Only meaningful inside a git repo.
 git rev-parse --is-inside-work-tree >/dev/null 2>&1 || exit 0
@@ -30,7 +61,9 @@ git rev-parse --is-inside-work-tree >/dev/null 2>&1 || exit 0
 # (staged or unstaged). Untracked files alone don't count — scratch/output files
 # are common and shouldn't trigger the nudge.
 if git diff --quiet --ignore-submodules HEAD 2>/dev/null; then
-  exit 0   # working tree clean vs HEAD → nothing to remind about
+  navori_audit_verdict="noop"
+  navori_audit_reason="arbol limpio: nada que recordar"
+  exit 0
 fi
 
 msg="navori: cambios sin commitear en el árbol. Antes de dar la tarea por terminada, corre el quality gate (evidencia fresca este turno) y haz commit — verify-before-done (P4)."
@@ -42,4 +75,6 @@ if command -v node >/dev/null 2>&1; then
 elif command -v jq >/dev/null 2>&1; then
   jq -n --arg m "$msg" '{systemMessage:$m}'
 fi
+navori_audit_verdict="inject"
+navori_audit_reason="cambios sin commitear"
 exit 0