navori 0.6.4 → 0.7.0

package/README.md

@@ -216,6 +216,52 @@ navori registry prune                       # quitar los que ya no existen
 Es ortogonal a los workspaces: el registro es "qué repos existen"; el workspace
 es el perfil de policy (branchBase/prTarget) que cada repo hereda.
 
+## Harness global por máquina (opt-in)
+
+Todo lo de arriba es por repo. Cuando abres una sesión **fuera** de un repo con navori (un scratch,
+un repo ajeno, tu `~`), no hay harness: ni doctrina de orquestación, ni skills, ni agentes. La capa
+global cubre ese hueco. No la confundas con `render --all` de la sección anterior: aquélla empuja tu
+harness a los repos que **ya** tienen navori; ésta cubre las sesiones que no están en ninguno.
+
+Es **opt-in de huella cero**: si nunca corres `navori global init`, no existe `~/.navori/global.json`
+y navori no escribió un solo byte en tu máquina.
+
+```bash
+navori global init                        # wizard: bloques del baseline + permisos personales.
+                                          # Preview: sin --apply no escribe un solo byte
+navori global init --apply                # escribe lo que el preview mostró
+navori global init --recommended --apply  # headless (CI): sin preguntas, selección recomendada
+navori global doctor                      # audita: drift del hook, gate, plugin, permisos y versión
+navori global render --apply              # re-renderiza tras un bump del CLI (preview sin --apply)
+navori global uninstall                   # la retira por completo
+```
+
+El `init` pregunta dos cosas: **qué bloques** componen el baseline (los que declaran `globalSafe`)
+y **qué permisos personales** quieres en `~/.claude/settings.json` — ése es el único camino de UI
+para `permissions`. Re-inicializar **preserva** lo que ya habías elegido: no te resetea a los
+defaults. Sin TTY (CI, pipe) cae solo al camino de `--recommended`, y `--lang es|en` fija el idioma
+del baseline y de los prompts.
+
+Qué escribe el `init --apply`, y nada más:
+
+- `~/.navori/global.json` — el manifest: idioma, bloques del baseline y tus permisos globales.
+- `~/.claude/skills/navori/` — el plugin `navori@skills-dir` con los 8 agentes, las 12 skills y el
+  hook del baseline. Claude Code lo carga sin marketplace ni paso de instalación; las skills globales
+  se invocan `/navori:<nombre>` (tras un render, `/reload-plugins` o sesión nueva).
+- `~/.claude/settings.json` — **solo** la clave `permissions`, y solo si declaraste permisos globales
+  en el manifest. Con la config por default ni siquiera lo crea.
+
+Respeta `CLAUDE_CONFIG_DIR`: si lo tienes seteado, el plugin va ahí en vez de a `~/.claude`.
+
+**El baseline se hace a un lado solo.** El hook corre en `SessionStart` y busca un `navori.config.json`
+hacia arriba desde el directorio de la sesión: si lo encuentra, no emite nada — manda el harness del
+repo, que es más específico. Por eso el baseline viaja dentro de un hook y no como bloque estático en
+`~/.claude/CLAUDE.md`: ese archivo se carga siempre y no podría cederle el paso a nadie.
+
+`navori global uninstall` retira **solo lo que navori escribió**: el plugin, el manifest y los permisos
+que quedaron registrados como suyos. Un permiso que ya tenías en tu `settings.json` nunca se vuelve de
+navori, así que el uninstall no se lo lleva.
+
 ## Managed blocks con versionado
 
 Cada bloque que `navori` inyecta en tu `CLAUDE.md` lleva metadata:

package/dist/assets/core/core-assets/agents/commit-pr-pilot.md

@@ -205,6 +205,14 @@ Never open the PR with the gate red.
 
 7. **Checks — read them ONCE, never wait**: `gh pr checks <N> --json name,bucket,state,link,workflow`. `bucket: pending` (the normal case right after creating the PR) → say so in **one extra line** and stop, no retry. `bucket: fail` → name the check in that line and point to `babysit-prs` for the diagnosis. Informative only: you never hold or revert a PR over a red check.
 
+8. **Confirm the close actually linked** — only when the body declares one. The body is not evidence of anything; `closingIssuesReferences` is what GitHub parsed out of it:
+
+   ```bash
+   gh pr view <N> --json closingIssuesReferences --jq '[.closingIssuesReferences[].number]'
+   ```
+
+   An empty list next to a `Closes #<N>` in the body means GitHub linked nothing — the keyword was translated, or the number is not an issue of this repo. Report it in **one extra line**, naming the issue that did not link, and stop: rewriting the body of a PR that is already open, and closing the issue by hand, are both the human's call. Informative only, exactly like the checks above.
+
 ## Body template (generic default)
 
 ```markdown
@@ -220,9 +228,23 @@ Never open the PR with the gate red.
 - [ ] `{{qualityGate.full}}` green
 
 ## References
-- Closes <TICKET-ID> (if applicable, otherwise omit this line)
+- Closes #<N> (an issue of THIS repo; omit the line if there is none)
+- <TICKET-ID> on <tracker> (Jira, Linear, ...; informative, omit if there is none)
 ```
 
+**`Closes` is syntax, not prose.** GitHub links and auto-closes an issue only
+when the body carries `Closes` / `Fixes` / `Resolves` followed by `#<N>`, **in
+English**, pointing at an issue of this same repo. The rest of the body follows
+the config's `commits` language and this keyword does NOT: translated (`Cierra
+#<N>`) it is an ordinary sentence, GitHub links nothing, the issue stays open
+and no error says so. That silence is the whole defect — navori's own repo
+shipped 8 PRs that way and closed all 8 issues by hand before anyone noticed
+(#563). Leave the keyword in English even when you translate everything around
+it, and never "fix" it in a later consistency pass.
+
+A tracker id (`BT-1427`) is NOT an issue number: GitHub cannot link it, so it
+goes on its own line and never takes a keyword.
+
 If the repo defines its own template (`.github/pull_request_template.md`), read it and match its structure instead of the default.
 
 ### Always-on delta — a number in the body, never a gate
@@ -244,7 +266,7 @@ wc -c CLAUDE.md                                  # after
 - ❌ Never skip hooks (`--no-verify`) unless the user explicitly asks.
 - ❌ Never ask for a merge / approve the PR yourself. Your job ends with the URL.
 - ❌ Never `gh pr checks --watch`: it takes no timeout and would hang the turn before the URL reaches the user.
-- ✅ Commit and PR message in the language defined by the config's `commits` (`conventional-es` = Spanish MX, `conventional` = English).
+- ✅ Commit and PR message in the language defined by the config's `commits` (`conventional-es` = Spanish MX, `conventional` = English) — except the `Closes #<N>` keyword, which GitHub parses and which stays in English in any language (see the body template).
 - ✅ If you introduce a new pattern or non-obvious decision that wasn't already in `impl_<feature>.md`, leave a note in the PR body ("Decisions" section).
 
 ## Anti-patterns

package/dist/assets/core/core-assets/agents/leader.md

@@ -1,6 +1,6 @@
 ---
 name: leader
-description: Do NOT invoke as a subagent. Orchestration playbook that the main agent EMBODIES (see "## Role: orchestrator" in CLAUDE.md). Delegating it to a subagent serializes the work and kills parallelism.
+description: Do NOT invoke as a subagent. Orchestration playbook that the main agent EMBODIES (the "## Role: orchestrator" block, delivered to the session by the SessionStart hook). Delegating it to a subagent serializes the work and kills parallelism.
 tools: Read, Glob, Grep, Bash, Agent
 model: {{models.leader}}
 effort: {{effort.leader}}
@@ -8,7 +8,7 @@ effort: {{effort.leader}}
 
 # Orchestrator Playbook (embodied by the main agent)
 
-> This file is a **depth reference** — the orchestrator role **is embodied by the main agent**, not a subagent. The essential mechanics (escalation table, parallelism, synthesis) live inline in the "## Role: orchestrator" block of `CLAUDE.md`, which auto-loads. Here is the extended detail and, below, the **Project rules**. Do NOT invoke `Agent(subagent_type: leader)`.
+> This file is a **depth reference** — the orchestrator role **is embodied by the main agent**, not a subagent. The essential mechanics (escalation table, parallelism, synthesis) live in the "## Role: orchestrator" block, which the `SessionStart` hook delivers to the session — not to a subagent, which is the point: only the main agent can act on it. Here is the extended detail and, below, the **Project rules**. Do NOT invoke `Agent(subagent_type: leader)`.
 
 Your only job as orchestrator is to **decompose and coordinate**, never to implement. Note: this applies **when you orchestrate** (R2+ routes of the organic routing). At **R1** (1–3 files, mechanical change or bugfix with a clear cause) you implement **inline yourself**, without opening subagents — see "## Role: orchestrator (organic routing)" in `CLAUDE.md`.
 

package/dist/assets/core/core-assets/hooks/_partials/audit-log.sh

@@ -0,0 +1,179 @@
+# Shared audit-mode event recorder — inlined into each managed hook at render
+# time (see the include directive in the source scripts + lib/hook-includes.ts).
+#
+# WHY (spec 0013): a hook is only visible to the transcript when it BLOCKS or
+# INJECTS context. Every hook that runs and lets the action through is invisible,
+# so `navori audit` could never answer "did the gate run, and what did it cost?".
+# The transcript cannot be fixed — it is the host's format — so the harness
+# records its own execution instead, and the session log becomes the source of
+# truth for what the harness did.
+#
+# Expects `$payload` (the raw hook payload on stdin) to be in scope, and reads
+# `$navori_audit_t0` for the start instant. Both are set by `navori_audit_begin`.
+#
+# Every variable read here carries a `:-` default ON PURPOSE: most managed hooks
+# run under `set -euo pipefail`, where an unset variable ABORTS the hook. A
+# recorder that can abort the thing it observes is worse than no recorder, so the
+# partial must be safe to inline into `set -u` and `set +e` alike.
+#
+# FAIL-OPEN ABSOLUTE, and this matters more here than anywhere else: this code is
+# inlined into hooks whose own contract is to never break a session. Observation
+# must never become the reason an action fails, so every path returns 0 and
+# nothing is ever written to stdout — a stray byte there would be interpreted by
+# the host as hook output (context injection, or a block reason).
+
+# Start the clock — but only after establishing that anything will be recorded.
+#
+# THE COST OF BEING OFF is the number that matters here: this code is inlined
+# into hooks that fire on EVERY Bash call, and audit-mode is off for virtually
+# every session of every user. An earlier version ran `perl` plus two `jq`
+# invocations before it ever checked whether a log existed — three processes per
+# hook, four hooks per command, ~48 ms on every single shell call for a feature
+# nobody had turned on.
+#
+# So the gate is a pure-builtin one first: the per-repo audit directory only
+# exists once audit-mode has been activated in this repo at least once. No
+# subprocess, no parsing. Everything expensive lives behind it.
+navori_audit_begin() {
+  navori_audit_on=0
+
+  navori_audit_root=${NAVORI_AUDITS_ROOT:-}
+  if [ -z "$navori_audit_root" ]; then
+    [ -n "${HOME:-}" ] || return 0
+    navori_audit_root=$HOME/.navori/audits
+  fi
+
+  # The gate tests the audit ROOT, not the per-repo directory.
+  #
+  # Deriving the repo cheaply would mean `${CLAUDE_PROJECT_DIR##*/}` — and that
+  # is WRONG: the authoritative repo comes from the payload's `cwd`, and the two
+  # differ whenever a hook fires inside an agent worktree, since the hook process
+  # starts in the main repo (#454). A gate built on the wrong name would silently
+  # record nothing exactly where the harness runs its parallel work.
+  #
+  # The root alone is enough for what this gate is for: a user who has never
+  # activated audit-mode anywhere has no `~/.navori/audits`, so the common case
+  # costs one stat and zero processes. Someone who does use audit-mode pays the
+  # parsing — which is the cost of the feature they turned on.
+  [ -d "$navori_audit_root" ] || return 0
+
+  navori_audit_on=1
+  navori_audit_t0=$(navori_audit_now)
+}
+
+# Milliseconds since epoch, spending a process only when it has to.
+#
+# `$EPOCHREALTIME` is a BUILTIN in bash 5 and in zsh (with zsh/datetime, which
+# the harness's zsh path already has): no fork at all. Only a shell without it
+# pays for `perl`, and only a machine without perl degrades to whole seconds —
+# `date` has no portable millisecond format (GNU has %s%3N, BSD does not).
+navori_audit_now() {
+  if [ -n "${EPOCHREALTIME:-}" ]; then
+    # `1756... .123456` → milliseconds, with pure parameter expansion.
+    navori_audit_epoch=${EPOCHREALTIME/,/.}
+    printf '%s%s' "${navori_audit_epoch%%.*}" "$(printf '%.3s' "${navori_audit_epoch#*.}")"
+    return 0
+  fi
+  perl -MTime::HiRes=time -e 'printf "%.0f", time*1000' 2>/dev/null \
+    || printf '%s' $(( $(date +%s 2>/dev/null || echo 0) * 1000 ))
+}
+
+# navori_audit_log <verdict> [reason]
+#
+# `name`, `phase`, `tool` and `source` come from the caller's own variables,
+# which the render sets per hook — the partial never guesses which hook it is
+# inlined into.
+navori_audit_log() {
+  # The builtin-only gate from `navori_audit_begin`: when audit-mode was never
+  # activated in this repo, nothing below runs and no process is spawned.
+  [ "${navori_audit_on:-0}" = "1" ] || return 0
+  # No payload, no jq, no clock → nothing to record. Each of these is a normal
+  # state for a hook that bailed early, not an error worth surfacing.
+  [ -n "${payload:-}" ] || return 0
+  command -v jq >/dev/null 2>&1 || return 0
+
+  # ONE jq for every field, not one per field: this runs on each hook of each
+  # Bash call, and a fork is the most expensive thing in it. Newline-separated,
+  # read back positionally.
+  navori_audit_fields=$(printf '%s' "${payload:-}" | jq -r '[.session_id // "", .cwd // "", .agent_id // .subagent_id // ""] | .[]' 2>/dev/null) || return 0
+  navori_audit_session=${navori_audit_fields%%
+*}
+  navori_audit_rest=${navori_audit_fields#*
+}
+  navori_audit_cwd=${navori_audit_rest%%
+*}
+  navori_audit_agent=${navori_audit_rest#*
+}
+  [ -n "$navori_audit_session" ] || return 0
+  # Same character class the CLI enforces (#503): the id composes a path, so
+  # anything path-shaped means the payload is not what we think it is.
+  case "$navori_audit_session" in
+    *[!A-Za-z0-9_-]*) return 0 ;;
+  esac
+
+  [ -n "$navori_audit_cwd" ] || navori_audit_cwd=$PWD
+  navori_audit_repo=$(basename "$navori_audit_cwd" 2>/dev/null) || return 0
+  [ -n "$navori_audit_repo" ] || return 0
+
+  navori_audit_file=$navori_audit_root/$navori_audit_repo/session-$navori_audit_session.log
+
+  # The session may not be the marked one even in a repo that has been audited
+  # before. Also the writability check — a log that cannot be appended to is not
+  # an error, it is simply not recording.
+  [ -f "$navori_audit_file" ] || return 0
+  [ -w "$navori_audit_file" ] || return 0
+
+  # Volume valve, OFF by default.
+  #
+  # `PreToolUse(Bash)` chains four hooks, so every shell command leaves four
+  # lines and most are `skip` — a long session runs to thousands. Set
+  # NAVORI_AUDIT_SKIP_NOOPS=1 to drop the ones that did nothing.
+  #
+  # Default off on purpose: a `skip` is the ONLY evidence that a hook ran and
+  # decided it had no business acting, which is exactly what distinguishes it
+  # from a hook that never executed — the question that motivated recording
+  # hooks at all. The valve trades that away knowingly; it must not be the
+  # silent default.
+  if [ "${NAVORI_AUDIT_SKIP_NOOPS:-0}" = "1" ]; then
+    case "$1" in
+      skip|noop) return 0 ;;
+    esac
+  fi
+
+  navori_audit_end=$(navori_audit_now)
+  navori_audit_ms=$(( navori_audit_end - ${navori_audit_t0:-$navori_audit_end} ))
+  [ "$navori_audit_ms" -ge 0 ] 2>/dev/null || navori_audit_ms=0
+
+  navori_audit_ts=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null) || navori_audit_ts=""
+  # `navori_audit_agent` came out of the same single jq above. It is what lets
+  # the report attribute a hook to a subagent WITHOUT guessing: with agents
+  # running in parallel their time windows overlap, so attribution by timestamp
+  # is the fallback, not the primary route.
+  #
+  # It is recorded, never trusted as an agent identity by itself (#560). What
+  # `.agent_id` means depends on the PHASE: on the tool phases it is stable —
+  # 485 events of one measured session carried 11 distinct ids, and the
+  # subagents' resolved to real transcripts — but on `SubagentStop` the host
+  # sends a fresh id per firing: 112 distinct ids for 117 firings, 102 of them
+  # matching nothing under `~/.claude`. So a consumer that resolves this field
+  # must treat "names nobody" as invalid data rather than as a different agent
+  # (`ownerOf` in `lib/audit/parse.ts` is where that rule lives).
+
+  printf '%s\n' "$(jq -cn \
+    --arg ts "$navori_audit_ts" \
+    --arg name "${navori_audit_name:-unknown}" \
+    --arg phase "${navori_audit_phase:-unknown}" \
+    --arg verdict "${1:-unknown}" \
+    --arg reason "${2:-}" \
+    --arg tool "${navori_audit_tool:-}" \
+    --arg src "${navori_audit_source:-core}" \
+    --arg agent "${navori_audit_agent:-}" \
+    --argjson ms "$navori_audit_ms" \
+    '{ts:$ts,event:"hook",name:$name,phase:$phase,verdict:$verdict,ms:$ms,source:$src}
+     + (if $tool   == "" then {} else {tool:$tool}       end)
+     + (if $reason == "" then {} else {reason:$reason}   end)
+     + (if $agent  == "" then {} else {agentId:$agent}   end)' 2>/dev/null)" \
+    >> "$navori_audit_file" 2>/dev/null
+
+  return 0
+}

package/dist/assets/core/core-assets/hooks/audit-mode-trigger.sh

@@ -1,15 +1,20 @@
 #!/usr/bin/env bash
-# navori — audit-mode trigger (UserPromptSubmit)
+# navori — audit-mode prompt recorder (UserPromptSubmit)
 #
-# Detects an audit-mode invocation in the user's prompt and asks Claude to
-# CONFIRM with the user before anything is recorded. It never activates the
-# mode by itself: a false positive must die in the question, leaving no state
-# on disk.
+# While audit-mode is active, appends the typed prompt to the session's
+# append-only log. That is its ONLY job.
 #
-# While the mode is active it appends the typed prompt to the session's
-# append-only log. Writes are O_APPEND only; the log is never re-read to be
-# rewritten, so parallel subagents cannot corrupt it and a crashed session
-# still leaves a valid (merely shorter) file.
+# It used to also detect an audit-mode invocation in the prompt text and ask
+# Claude to confirm activation. That was removed (spec 0013, R3): matching
+# `audit mode` as a substring cannot separate INVOKING the mode from TALKING
+# ABOUT it, and talking about it is what you do all day while working on the
+# feature. The asymmetry made it worse — turning it ON matched loosely, while
+# turning it OFF required the literal phrase, so sessions stayed open forever.
+# Activation is now exclusively `navori audit --start <id>`.
+#
+# Writes are O_APPEND only; the log is never re-read to be rewritten, so
+# parallel subagents cannot corrupt it and a crashed session still leaves a
+# valid (merely shorter) file.
 #
 # FAIL-OPEN ABSOLUTE: this hook runs on every prompt. Any error, any missing
 # dependency, any odd path exits 0 silently. It must never be the reason a
@@ -17,34 +22,6 @@
 
 set +e
 
-emit_and_exit() { printf '%s\n' "$1"; exit 0; }
-
-# Is `audit` actually available in the CLI on PATH?
-#
-# The hook orders the agent to run `navori audit --start`, and that resolves the
-# PUBLISHED binary, never a working tree's build. When the installed version
-# predates the subcommand, citty prints the help and exits 0 — so an agent that
-# checks the exit code reads a silent no-op as success and reports a recording
-# that never started. Match the subcommand inside the CLI's own USAGE line
-# instead of trusting the status.
-#
-# Returns 1 when the subcommand is absent AND when the check itself cannot run
-# (no binary on PATH, no USAGE line). Both collapse into "could not confirm",
-# which is what the caller's message must say: claiming "your version is old"
-# would be wrong for a machine with no navori installed at all.
-audit_subcommand_available() {
-  command -v navori >/dev/null 2>&1 || return 1
-  usage=$(navori --help 2>/dev/null | grep -m1 '^USAGE' 2>/dev/null) || return 1
-  [ -n "$usage" ] || return 1
-  # Normalize separators so the token matches at any position: `USAGE navori
-  # init|add|audit` -> `|USAGE|navori|init|add|audit|`.
-  tokens=$(printf '%s' "$usage" | tr ' ' '|' 2>/dev/null) || return 1
-  case "|$tokens|" in
-    *"|audit|"*) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
 payload=$(cat 2>/dev/null) || exit 0
 [ -n "$payload" ] || exit 0
 command -v jq >/dev/null 2>&1 || exit 0
@@ -84,49 +61,20 @@ else
 fi
 log_file=$audits_root/$repo/session-$session_id.log
 
-lower=$(printf '%s' "$prompt" | tr '[:upper:]' '[:lower:]' 2>/dev/null) || exit 0
-
-# Deliberately tolerant: a spurious match costs one question, while a missed
-# one costs the whole recording.
-case "$lower" in
-  *"audit mode"*|*"audit-mode"*|*"modo audit"*|*"modo auditoría"*|*"modo auditoria"*) matched=1 ;;
-  *) matched=0 ;;
-esac
-
-case "$lower" in
-  *apaga*|*apagar*|*desactiva*|*"salir de"*|*detén*|*deten*|*stop*|*"turn off"*|*disable*) off_intent=1 ;;
-  *) off_intent=0 ;;
-esac
-
-if [ -f "$log_file" ]; then
-  # Active: record the human's own words — they entered the model's context,
-  # so they cost tokens and belong in the audit.
-  #
-  # `transcript_path` rides along because the payload is the ONLY place it is
-  # stated. Without it the reader has to guess the transcript's location by
-  # re-deriving Claude Code's undocumented directory encoding (see paths.ts),
-  # and a guess that misses costs the whole report.
-  ts=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null) || ts=""
-  transcript=$(printf '%s' "$payload" | jq -r '.transcript_path // ""' 2>/dev/null) || transcript=""
-  printf '%s\n' "$(jq -cn --arg ts "$ts" --arg ev "prompt" --arg p "$prompt" --arg tr "$transcript" \
-    '{ts:$ts,event:$ev,prompt:$p} + (if $tr == "" then {} else {transcript:$tr} end)' 2>/dev/null)" >> "$log_file" 2>/dev/null
+# Not marked → not recording. This is also what makes the hook free outside
+# audit-mode: one stat and out.
+[ -f "$log_file" ] || exit 0
 
-  if [ "$matched" = "1" ] && [ "$off_intent" = "1" ]; then
-    if audit_subcommand_available; then
-      emit_and_exit "[navori audit-mode] The user asked to turn audit-mode OFF. Before doing anything, ask them explicitly: \"audit mode will be turned off, continue?\". Only if they confirm, run: navori audit --stop $session_id (that seals the log and generates the report). Then check the output: it must name the report it wrote. If it prints the command list (USAGE) instead, the installed CLI has no such subcommand — tell the user and do NOT assume the session was closed. If they decline, leave the mode active and carry on with the task."
-    else
-      emit_and_exit "[navori audit-mode] The user asked to turn audit-mode OFF, but the available 'navori' could not be confirmed to ship the 'audit' subcommand: it may not be installed at all, or it may predate that command. Do NOT run 'navori audit --stop' blindly: if the binary exists but is old, it prints its help and exits 0, which looks like success without being one. Tell the user what happened and that the session log stays intact on disk, so the report can still be generated once the CLI is up to date. Then carry on with the task."
-    fi
-  fi
-  exit 0
-fi
-
-if [ "$matched" = "1" ] && [ "$off_intent" = "0" ]; then
-  if audit_subcommand_available; then
-    emit_and_exit "[navori audit-mode] An audit-mode invocation was detected in the prompt. Before activating anything, ask the user explicitly: \"an audit mode invocation was detected, continue?\". Only if they confirm, run: navori audit --start $session_id (that creates the session log). Then check the output: it must name the log file it created. If it prints the command list (USAGE) instead, the installed CLI has no such subcommand — tell the user and do NOT assume the mode is active. If they decline, run nothing and carry on with the task."
-  else
-    emit_and_exit "[navori audit-mode] An audit-mode invocation was detected, but the available 'navori' could not be confirmed to ship the 'audit' subcommand: it may not be installed at all, or it may predate that command. Do NOT run 'navori audit --start' blindly: if the binary exists but is old, it prints its help and exits 0, which looks like success without being one. Tell the user that nothing was activated, and why. Then carry on with the task."
-  fi
-fi
+# Record the human's own words — they entered the model's context, so they cost
+# tokens and belong in the audit.
+#
+# `transcript_path` rides along because the payload is the ONLY place it is
+# stated. Without it the reader has to guess the transcript's location by
+# re-deriving Claude Code's undocumented directory encoding (see paths.ts),
+# and a guess that misses costs the whole report.
+ts=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null) || ts=""
+transcript=$(printf '%s' "$payload" | jq -r '.transcript_path // ""' 2>/dev/null) || transcript=""
+printf '%s\n' "$(jq -cn --arg ts "$ts" --arg ev "prompt" --arg p "$prompt" --arg tr "$transcript" \
+  '{ts:$ts,event:$ev,prompt:$p} + (if $tr == "" then {} else {transcript:$tr} end)' 2>/dev/null)" >> "$log_file" 2>/dev/null
 
 exit 0

package/dist/assets/core/core-assets/hooks/guard-destructive.sh

@@ -30,7 +30,43 @@ set -euo pipefail
 # A missing JSON parser used to make this guard wave every command through; the
 # shared extractor falls back to sed so it still inspects the command.
 # navori:include extract-cmd
-[ -z "$cmd" ] && exit 0
+
+navori_audit_name="guard-destructive"
+navori_audit_phase="PreToolUse"
+navori_audit_tool="Bash"
+# Fallback no-ops, overwritten by the real definitions the include brings in.
+# They exist because this hook is FAIL-OPEN: if the file ever runs WITHOUT its
+# includes expanded — a raw copy of the asset, a render that half-finished — an
+# undefined function would be exit 127, and under `set -e` that KILLS the hook.
+# A recorder that can kill the thing it observes is the one bug this partial may
+# never have.
+navori_audit_begin() { :; }
+navori_audit_log() { :; }
+# navori:include audit-log
+navori_audit_begin
+
+# The verdict is resolved in a trap, NOT by a call at the end of the file.
+#
+# This hook's managed block ends before its `navori:user-section`, and the render
+# only syncs what is INSIDE the block — so a call placed after it lives in the
+# user's own territory and never reaches the mirror. That is exactly how the most
+# critical hook in the harness ended up being the only one not recording.
+#
+# The trap also covers the extra guards a user writes in that section: whatever
+# they add, the exit code still tells the truth about what happened.
+navori_audit_verdict="allow"
+navori_audit_reason=""
+navori_audit_on_exit() {
+  navori_audit_log "$navori_audit_verdict" "$navori_audit_reason" || true
+  return 0
+}
+trap navori_audit_on_exit EXIT
+
+if [ -z "$cmd" ]; then
+  navori_audit_verdict="skip"
+  navori_audit_reason="sin comando que inspeccionar"
+  exit 0
+fi
 
 # branchBase is shell-quoted at render time via the shq: marker (#197): a
 # hostile branchBase in navori.config.json lands here as an inert literal,
@@ -43,6 +79,11 @@ block() {
   # should carry, and the reason line already says which rule fired.
   echo "[navori] command: ${cmd:0:2000}" >&2
   echo "[navori] if intentional, run the command yourself outside the agent." >&2
+  # Only ASSIGNMENTS here: this is the one place the guard says no, and nothing
+  # may come between the decision and `exit 2`. The recording happens in the
+  # trap, after the exit is already committed.
+  navori_audit_verdict="block"
+  navori_audit_reason="$1"
   exit 2
 }
 

package/dist/assets/core/core-assets/hooks/managed-drift-watch.sh

@@ -40,6 +40,46 @@
 # in a normal session is none and in a bad one is one.
 set -uo pipefail
 
+# PostToolUse delivers its payload on stdin; this hook never needed it and the
+# audit recorder does (session_id/cwd), so it is captured rather than ignored.
+payload=$(cat 2>/dev/null) || payload=""
+
+navori_audit_name="managed-drift-watch"
+navori_audit_phase="PostToolUse"
+navori_audit_tool="Bash"
+# Fallback no-ops, overwritten by the real definitions the include brings in.
+# They exist because this hook is FAIL-OPEN: if the file ever runs WITHOUT its
+# includes expanded — a raw copy of the asset, a render that half-finished — an
+# undefined function would be exit 127, and under `set -e` that KILLS the hook.
+# A recorder that can kill the thing it observes is the one bug this partial may
+# never have.
+navori_audit_begin() { :; }
+navori_audit_log() { :; }
+# navori:include audit-log
+navori_audit_begin
+
+# This hook has SEVEN early exits (no sha, no roots, no changes, …). Wiring a
+# call into each is how the set drifts the next time one is added, so the verdict
+# is derived once, from the exit code, in a trap.
+#
+# `navori_audit_reached_check` is what separates "ran and found nothing" from
+# "bailed before checking anything" — the distinction the whole exercise exists
+# for. Without it every early exit would report `clean`, i.e. would claim a
+# verification that never happened.
+navori_audit_reached_check=0
+navori_audit_on_exit() {
+  navori_audit_code=$?
+  if [ "$navori_audit_code" -eq 2 ]; then
+    navori_audit_log "dirty" "bloque managed con hash desalineado"
+  elif [ "$navori_audit_reached_check" -eq 1 ]; then
+    navori_audit_log "clean"
+  else
+    navori_audit_log "skip" "sin nada que verificar"
+  fi
+  return 0
+}
+trap navori_audit_on_exit EXIT
+
 cd "${CLAUDE_PROJECT_DIR:-.}" 2>/dev/null || exit 0
 
 stamp=".claude/.managed-drift-stamp"
@@ -121,6 +161,7 @@ done <<EOF
 $changed
 EOF
 
+navori_audit_reached_check=1
 [ -z "$drift" ] && exit 0
 
 # Exit 2 so the text reaches the model rather than scrolling past in a log: the

package/dist/assets/core/core-assets/hooks/precompact-session-summary.sh

@@ -21,14 +21,53 @@
 # The managed block is regenerated by `navori render`; do NOT edit by hand.
 set -euo pipefail
 
-cat >/dev/null 2>&1 || true   # drain the PreCompact JSON on stdin (unused)
+# The PreCompact JSON was drained and discarded here; it is kept now because the
+# audit recorder reads `session_id`/`cwd` out of it. Draining is still the point:
+# an undrained stdin can leave the host writing into a closed pipe.
+payload=$(cat 2>/dev/null) || payload=""
+
+navori_audit_name="precompact-session-summary"
+navori_audit_phase="PreCompact"
+# Fallback no-ops, overwritten by the real definitions the include brings in.
+# They exist because this hook is FAIL-OPEN: if the file ever runs WITHOUT its
+# includes expanded — a raw copy of the asset, a render that half-finished — an
+# undefined function would be exit 127, and under `set -e` that KILLS the hook.
+# A recorder that can kill the thing it observes is the one bug this partial may
+# never have.
+navori_audit_begin() { :; }
+navori_audit_log() { :; }
+# navori:include audit-log
+navori_audit_begin
+
+# The verdict is a VARIABLE resolved in a trap, not a call per branch. These
+# hooks have several early exits each (no git, no worktrees, nothing to inject),
+# and wiring a call into every one is how the set drifts the next time somebody
+# adds an exit. Defaulting to `skip` makes a new early exit semantically correct
+# for free: it means "ran, decided it had nothing to do", which is exactly what
+# an unhandled early return is.
+navori_audit_verdict="skip"
+navori_audit_reason=""
+navori_audit_on_exit() {
+  navori_audit_log "$navori_audit_verdict" "$navori_audit_reason" || true
+  return 0
+}
+trap navori_audit_on_exit EXIT
+
 
 ctx="A punto de compactar el contexto: el detalle turno-a-turno se resumirá. Antes de perderlo, persiste un resumen de sesión con tu herramienta de memoria (engram: guarda el resumen de sesión) y/o anota las decisiones y los bugs con causa raíz de esta sesión en progress/current.md."
 
 # Emit additionalContext safely: node (best escaping) → jq → give up (exit 0).
 if command -v node >/dev/null 2>&1; then
   CTX="$ctx" node -e 'process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreCompact",additionalContext:process.env.CTX}}))'
+  navori_audit_verdict="inject"
 elif command -v jq >/dev/null 2>&1; then
   jq -n --arg ctx "$ctx" '{hookSpecificOutput:{hookEventName:"PreCompact",additionalContext:$ctx}}'
+  navori_audit_verdict="inject"
+else
+  # Neither serializer available: the reminder never reached the model. Recorded
+  # as `noop` rather than `inject`, because the audit must not claim a context
+  # injection that did not happen.
+  navori_audit_verdict="noop"
+  navori_audit_reason="sin node ni jq: el recordatorio no se emitio"
 fi
 exit 0

package/dist/assets/core/core-assets/hooks/quality-gate-pre-commit.sh

@@ -20,6 +20,42 @@ set -euo pipefail
 # Command extraction (payload → $cmd). Shared body, single source of truth.
 # navori:include extract-cmd
 
+navori_audit_name="quality-gate-pre-commit"
+navori_audit_phase="PreToolUse"
+navori_audit_tool="Bash"
+# Fallback no-ops, overwritten by the real definitions the include brings in.
+# They exist because this hook is FAIL-OPEN: if the file ever runs WITHOUT its
+# includes expanded — a raw copy of the asset, a render that half-finished — an
+# undefined function would be exit 127, and under `set -e` that KILLS the hook.
+# A recorder that can kill the thing it observes is the one bug this partial may
+# never have.
+navori_audit_begin() { :; }
+navori_audit_log() { :; }
+# navori:include audit-log
+navori_audit_begin
+
+# This hook fires on EVERY Bash call and does real work on almost none of them,
+# so its verdict is derived from the exit code in a trap rather than from a call
+# per branch — the branch set here is the one most likely to grow.
+#
+# `navori_audit_ran_gate` is the distinction that matters: the recorded `ms` of a
+# run that actually executed the gate (tens of seconds) means something very
+# different from that of a run that looked at the command and moved on (single
+# digits). Collapsing both into `allow` would make the timing unreadable.
+navori_audit_ran_gate=0
+navori_audit_on_exit() {
+  navori_audit_code=$?
+  if [ "$navori_audit_code" -ne 0 ]; then
+    navori_audit_log "block" "el quality gate no paso o no pudo correr" || true
+  elif [ "$navori_audit_ran_gate" -eq 1 ]; then
+    navori_audit_log "allow" "gate ejecutado y verde" || true
+  else
+    navori_audit_log "skip" "el comando no es un commit" || true
+  fi
+  return 0
+}
+trap navori_audit_on_exit EXIT
+
 # Detect the project's REAL package manager from lockfiles / package.json, so a
 # gate command hardcoded to one PM (e.g. `pnpm run ...`) can still run in a repo
 # that actually uses another (e.g. bun). Mirrors lib/detect.ts precedence:
@@ -45,6 +81,7 @@ is_pm() {
 }
 
 run_gate() {
+  navori_audit_ran_gate=1
   echo "[navori] running quality-gate fast: $1" >&2
   eval "$1" || {
     echo "[navori] quality-gate fast failed. Commit aborted." >&2