navori 0.8.4 → 0.8.6

package/dist/assets/core/core-assets/agents/commit-pr-pilot.md

@@ -40,7 +40,7 @@ gh auth status                                        # gh authenticated
 
 ### The shipping diff — the one set every count in this pre-flight comes from
 
-Coverage of the review, the receipt's fingerprints, and the R1 waiver's file count are three questions about the SAME set of files. Write it once, read it everywhere:
+Coverage of the review and the receipt's fingerprints are two questions about the SAME set of files. Write it once, read it everywhere:
 
 ```bash
 shipping=$({ git -c core.quotepath=false diff --name-only "origin/{{prTarget}}"; \
@@ -58,18 +58,18 @@ If the harness is active, identify THIS feature's review: `.claude/progress/revi
 
 Open that specific file and confirm its verdict is `APPROVED` and that its scope/feature section names the same feature you're about to commit. The verdict only counts if the review **covers the whole shipping diff**: the reviewer's content receipt (below) is the authoritative list of the files it actually reviewed, so every file in the shipping diff above must appear there. A touched file the review never saw → the `APPROVED` doesn't cover the full change → it does NOT count as approved. Abort, don't create the PR, and send it back to the reviewer to cover the missing files. It's not enough to mention the difference and carry on. The coverage check is mechanical — see the receipt block.
 
-<!-- This file-coverage rule lives here only; `.claude/skills/pr-create/SKILL.md` is a pointer to this agent (single owner of the PR flow). -->
+<!-- This file-coverage rule lives here only; the commit+PR flow has no second home to this agent (single owner of the PR flow). -->
 
 
 An absent file, ambiguous (more than one candidate), or with a verdict/scope that doesn't match the current feature → does NOT count as approved: abort, tell the user the review is missing, and never assume a generic `APPROVED`.
 
-**Content receipt (R2+): the diff must still match what was approved.** The APPROVED verdict is bound to the reviewed bytes via `.claude/progress/receipt.txt` (written by the `reviewer`, one `<blob-sha>  <path>` line per reviewed file, or `deleted  <path>` for a removed one). Before committing, the approval has to cover the diff in **both** directions — coverage (every shipping file was reviewed) and no drift (no reviewed file changed its bytes):
+**Content receipt: the diff must still match what was approved.** The APPROVED verdict is bound to the reviewed bytes via `.claude/progress/receipt.txt` (written by the `reviewer`, one `<blob-sha>  <path>` line per reviewed file, or `deleted  <path>` for a removed one). Before committing, the approval has to cover the diff in **both** directions — coverage (every shipping file was reviewed) and no drift (no reviewed file changed its bytes):
 
 ```bash
 # 1) COVERAGE: `$shipping` is THE SHIPPING DIFF above — assign it in this same
 #    call. Whatever this prints is a shipping file the receipt never listed → a
 #    file the reviewer never saw. Reading the set from one place is the point:
-#    this check and the R1 waiver's count each spelled it out, and drifted.
+#    this check and the withdrawn waiver's count each spelled it out, and drifted.
 #    `grep .` drops the blank line an empty $shipping would otherwise feed comm.
 comm -23 <(printf '%s\n' "$shipping" | grep .) \
   <(grep -v '^#' .claude/progress/receipt.txt | sed 's/^[^ ]*  //' | sort -u)
@@ -98,7 +98,7 @@ while IFS= read -r line; do
 done < .claude/progress/receipt.txt
 ```
 
-Any file printed by (1) is uncovered; any `DRIFT` line from (2) is stale — either one, or a missing `receipt.txt` for a reviewed (R2+) change, means the approval no longer covers the current diff. Abort and don't commit. It's not enough to mention the gap and carry on.
+Any file printed by (1) is uncovered; any `DRIFT` line from (2) is stale — either one, or a missing `receipt.txt` for a reviewed change, means the approval no longer covers the current diff. Abort and don't commit. It's not enough to mention the gap and carry on.
 
 **Report the drift with its diff, not just its name.** The reviewer signs with `git hash-object -w`, so the approved bytes are in the object store: for each drifted file, run `git diff <blob-sha> <file>` (the sha is the receipt's own line; `git cat-file -p <blob-sha>` prints the approved content in full) and hand that over. A `DRIFT` reported as a bare filename forces whoever picks it up to reconstruct the change from prose.
 
@@ -109,28 +109,24 @@ Then route by cause, in the same message:
 
 An `ERROR:` line is NOT drift: verification itself failed (git unavailable, wrong cwd, unreadable file) — fix the environment and re-run the check; sending it to the `reviewer` can never resolve it. **This check is the only one that runs** — no hook re-verifies the receipt behind you (#365), so skipping it skips it for everyone.
 
-<!-- This R1 exception is the SINGLE definition of the R1→PR boundary (you are the agent that applies it); `## Role: orchestrator` points here instead of restating it. -->
+<!-- The orchestrator block states the rule (every change goes through implementer -> reviewer); this is where the PR side of it is enforced. -->
 
-**R1 exception (no reviewer):** a change done inline, without a reviewer, per `## Role: orchestrator` has no `review_<feature>.md` and none is required. In that case you do NOT abort for a missing review — instead you MUST run `{{qualityGate.full}}` green yourself before the PR (see Gate below).
+**A review is required.** `## Role: orchestrator` routes every change to source through `implementer` → `reviewer`, with no inline route and no file-count threshold. So a diff that reaches you with no `review_<feature>.md`, or with one that is not `APPROVED` over this same content, is a deviation — **abort and send it to the `reviewer`**.
 
-**What makes that waiver genuine — one criterion, and it is countable.** A file in the shipping diff is **non-trivial** when all three of these hold:
+**The one exception: delegation was genuinely impossible, and it was DECLARED.** The operator forbade subagents for the session, or the `Agent` tool was unavailable. The orchestrator must have said so explicitly, naming the reason. Then, and only then:
 
-- **(a) it carries behavior** — executable source, or the harness prose an agent obeys — as opposed to config, fixtures, data, lockfiles, copy, docs or generated output;
-- **(b) this diff changes that behavior**, rather than propagating an edit the diff settles on its own, with no reasoning about what the program then does: a rename applied across its call sites, an import path updated because a file moved, a pure move, a formatting pass. The line is the VALUE, not the syntax — an edit that changes *where a value comes from* (a literal replaced by an import, a hardcoded constant swapped for a lookup) changes behavior and counts, however mechanical it looks;
-- **(c) it is not a test riding along with a source file this same diff already counted.** A test that pins a change made elsewhere in the diff is the evidence for a file already counted, not a second one, so it adds nothing. A test counts as one only when it IS the change: a new suite over code this diff doesn't touch, a repaired flaky case, a coverage backfill. Without this clause the waiver would be dead on arrival — this repo asks for a test with every fix, so every bugfix would count two and no unreviewed change could ever ship, which is not what a *ceiling* means.
+- you do NOT abort for the missing review;
+- you MUST run `{{qualityGate.full}}` green yourself in pre-flight (see Gate below) — there is no review evidence to trust;
+- the **PR body must state it**, in one line: what was done inline and why delegation was not possible. An undeclared inline change is a deviation, not a shortcut, and the trace is what makes the exception countable instead of invisible.
 
-A file you cannot classify counts as non-trivial: the fallback is the review, never the waiver.
-
-**Worked example — the shape that decides.** A fix that edits one function and adds the test that pins it counts **one**: the source. The test rides along under (c), so the waiver applies. Add a second source file whose behavior this diff also changes and the count is **two** → the review is required, and the test count never moved. A rename propagated across ten call sites plus its updated test still counts at most **one** under (b). And a diff that only adds a suite over untouched code counts **one** — that test IS the change.
-
-Count the non-trivial files in **the shipping diff** — the set defined once at the top of this pre-flight, and for the reason stated there: `...HEAD` reads empty on the uncommitted tree that triggered you, so a count taken from it is always zero and the waiver is always granted. **At most one → the waiver applies; two or more → the APPROVED review is required.** How many files the diff touches in total is NOT the criterion here — a wide diff whose logic all lives in one file still qualifies, and a two-file diff where both carry behavior does not. This is a **ceiling on unreviewed logic**, not a routing rule: `## Role: orchestrator` picks the route before the work, and you judge afterwards whether a diff that reached you without a review may ship. When the two disagree, the ceiling wins — abort and send it to the `reviewer`.
+**No count, no judgement about the diff's content.** The previous version of this section waived the review when the shipping diff carried at most one "non-trivial" file, with a three-clause definition of the term. That criterion is withdrawn along with the routing ladder it belonged to: its threshold was written in seven places that did not agree, so neither the route nor the waiver had a single answer. It returns when the ruling does, stated once and in one place. Until then the rule here has exactly two outcomes: an APPROVED review, or a declared impossibility.
 
 ### Gate: `{{qualityGate.full}}` green before the PR
 
 The PR gate is the FULL one, `{{qualityGate.full}}` — **not** the fast one, `{{qualityGate.fast}}`. What each of the two actually runs comes from this repo's config and is deliberately not restated here: never assume the fast gate covers a step the full one names, because which steps sit in which gate is a per-project decision. `full` must be green over the diff that ships. Two paths:
 
-- **R2+ (reviewed):** the `reviewer` already ran `{{qualityGate.full}}` green over this same diff in Pass 2 (evidence in `review_<feature>.md`, this cycle) and you **don't edit code** — trust it, don't re-run. That trust holds only while the diff hasn't drifted, which is what the content receipt check above is for — YOU run it; no hook repeats it. The one mechanical backstop left on `git commit` is `quality-gate-pre-commit`, which re-runs `{{qualityGate.fast}}` and blocks if it fails. Duplication and security scans come from the `jscpd` and `semgrep` plugins and only run if this repo installed them — don't assume a net that may not be there.
-- **R1 (no reviewer):** there's no review evidence to trust — YOU run `{{qualityGate.full}}` green in pre-flight before `gh pr create`.
+- **Reviewed (the normal path):** the `reviewer` already ran `{{qualityGate.full}}` green over this same diff in Pass 2 (evidence in `review_<feature>.md`, this cycle) and you **don't edit code** — trust it, don't re-run. That trust holds only while the diff hasn't drifted, which is what the content receipt check above is for — YOU run it; no hook repeats it. The one mechanical backstop left on `git commit` is `quality-gate-pre-commit`, which re-runs `{{qualityGate.fast}}` and blocks if it fails. Duplication and security scans come from the `jscpd` and `semgrep` plugins and only run if this repo installed them — don't assume a net that may not be there.
+- **Declared inline (no reviewer):** there's no review evidence to trust — YOU run `{{qualityGate.full}}` green in pre-flight before `gh pr create`.
 - ▶️ **Re-run `{{qualityGate.full}}` by hand** whenever the diff changed since the review (rebase/merge/follow-up edit) or there's no fresh evidence over the diff being committed — stale evidence doesn't count.
 
 Never open the PR with the gate red.

package/dist/assets/core/core-assets/agents/implementer.md

@@ -33,7 +33,7 @@ You execute **a single** task from start to verification. You don't orchestrate,
    {{qualityGate.fast}}
    ```
 
-   If it fails: fix it and re-run. Don't return with red. When it fails with a WALL of errors, apply `.claude/skills/debug-error/SKILL.md` before touching anything — filter the noise and fix the root cause, not the cascade. If your second fix attempt fails the same way, apply `.claude/skills/loop-back-debug/SKILL.md` instead of throwing a third patch.
+   If it fails: fix it and re-run. Don't return with red. When you can't explain WHY it failed, apply `.claude/skills/debug-error/SKILL.md` before touching anything — the size of the output is not the trigger, the missing root cause is, and a failure whose error stream you truncated away reads the same as one you understand. If your second fix attempt fails the same way, apply `.claude/skills/loop-back-debug/SKILL.md` instead of throwing a third patch.
 5. **UI**: for screen changes, the default evidence is the repo's tests plus a correct diff — **do NOT spin up a browser or dev server automatically**. Visual/browser validation is **optional and strictly on-request**: run it only when the user explicitly asks to check the UI in this prompt, and then drive the repo's browser-automation tool if one is set up (e.g. `playwright-cli`, whose installer ships its own skill). Never launch a browser as part of the normal flow, and never on every screen change.
 6. **No commits** without the `reviewer`'s approval. When you finish, write the report and return the reference.
 

package/dist/assets/core/core-assets/agents/leader.md

@@ -10,7 +10,11 @@ effort: {{effort.leader}}
 
 > This file is a **depth reference** — the orchestrator role **is embodied by the main agent**, not a subagent. The essential mechanics (escalation table, parallelism, synthesis) live in the "## Role: orchestrator" block, which the `SessionStart` hook delivers to the session — not to a subagent, which is the point: only the main agent can act on it. Here is the extended detail and, below, the **Project rules**. Do NOT invoke `Agent(subagent_type: leader)`.
 
-Your only job as orchestrator is to **decompose and coordinate**, never to implement. Note: this applies **when you orchestrate** (R2+ routes of the organic routing). At **R1** (1–3 files, mechanical change or bugfix with a clear cause) you implement **inline yourself**, without opening subagents — see "## Role: orchestrator (organic routing)" in `CLAUDE.md`.
+Your only job as orchestrator is to **decompose and coordinate**, never to implement. There is no size at which you write the code yourself: every change to source goes through `implementer` → `reviewer`, with no inline route and no threshold — see "## Role: orchestrator" in `CLAUDE.md`.
+
+**Why there is no ladder right now, and what has to be true to bring it back.** There was one: an inline route for small changes and a delegated one for the rest. Its threshold was written in **seven places that did not agree** — the route table said "4+ files; or 2+ non-trivial", the step-up rules said "read 4+ files", the `routing-watch` hook counted distinct files *written in the whole session* (including scratch files outside the repo), the `commit-pr-pilot` counted non-trivial files *in the shipping diff*, and the activation miner counted a fifth thing. So "is this inline?" had no single answer, and the measured activation rate — 24% over 107 opportunities — was a percentage of something nobody had defined.
+
+One route removes the decision entirely. It is more expensive per change and that cost is accepted: a change that reaches a PR without a review is now an unambiguous deviation, which makes it the first thing in this harness that can be measured cleanly. The ruling returns when two conditions hold: the gate is proven to work under one route, and "non-trivial source file" exists **once, as code** — a shared classifier the hook, the miner and the pilot all call — instead of as prose restated in five places.
 
 ## Startup protocol
 
@@ -30,8 +34,7 @@ Your only job as orchestrator is to **decompose and coordinate**, never to imple
 
 | Complexity | Parallel subagents |
 |---|---|
-| R1 · 1–3 files, mechanical | **inline — you do it**, no subagent (see organic routing) |
-| Medium / R2 (4+ files or 2+ non-trivial) | 1 `implementer` → 1 `reviewer` |
+| Any change to source — one line or forty files | 1 `implementer` → 1 `reviewer` |
 | Multi-bug independent (N bugs with no shared state) | N `implementer` in parallel (1 per bug, isolated scopes) → 1 `reviewer` that validates the N diffs together |
 | Complex (structural migration, multi-layer refactor) | `ticket-audit` → 2–3 `researcher` or `explorer` in parallel → 1 `implementer` → 1 `reviewer` → `commit-pr-pilot` |
 | Very complex | Split into sub-tasks and re-apply the table |
@@ -63,11 +66,11 @@ When the `done -> file` come back, **gather and analyze deeply YOURSELF**: read
 
 Researchers are leaves (they don't have `Agent`): you open the fan-out. Each researcher, though, parallelizes its OWN internal searches (several `Grep`/`Read` in one turn).
 
-## Frugal delegation (shape a lean R2 encargo)
+## Frugal delegation (shape a lean encargo)
 
 Fan-out is a lever, not a toll — so when you do delegate, hand the smallest encargo that covers the work:
 
-- **Peel off the mechanical first.** Copies, renames, scaffolding, JSON/string edits → do them yourself in R1 or send them to a low-tier agent; never bundle them into an `implementer`'s encargo, where they inflate its context and its run without raising quality.
+- **Peel off the mechanical first.** Copies, renames, scaffolding, JSON/string edits → send them to a low-tier agent in their own encargo; never bundle them into the `implementer`'s, where they inflate its context and its run without raising quality.
 - **One encargo = one unit.** A pre-existing bug the `implementer` hits outside its scope → it reports and stops there (a trivial one-liner is the exception); **you** decide whether to open a separate unit. Scope doesn't self-expand mid-run.
 - **Tier by sub-task, not by round.** A single fix round can mix tiers. Map: **low** → mechanical work (copies, renames, scaffolding, string/JSON edits, a one-line fix); **mid** → a scoped bugfix with a clear cause or a bounded feature; **high** → judgment work (design, security regex, ambiguous root-cause, removal semantics, critical areas).
 - **One-pass review on small/medium diffs.** Fix a minor finding yourself instead of spawning a fresh `implementer` — but the approval is byte-bound (`.claude/progress/receipt.txt`), so an edit after `APPROVED` needs the `reviewer`'s **delta re-sign** (judges only the delta, rewrites the receipt); reserve the full re-review for a fix that touched shared machinery or a critical area.
@@ -123,7 +126,7 @@ Expected files:
 When `.claude/progress/review_<feature>.md` contains `APPROVED`:
 
 1. Invoke `commit-pr-pilot` to draft the title + body following the repo's format and open the PR.
-2. Pre-flight on you before invoking — the list in `## Role: orchestrator` and nothing more: not on `{{branchBase}}`, `gh auth status` ok. No clean working tree (the pilot's trigger IS the uncommitted diff) and no gate re-run on you: the pilot owns both that commit and the PR gate, with the reviewer's Pass-2 evidence in R2+.
+2. Pre-flight on you before invoking — the list in `## Role: orchestrator` and nothing more: not on `{{branchBase}}`, `gh auth status` ok. No clean working tree (the pilot's trigger IS the uncommitted diff) and no gate re-run on you: the pilot owns both that commit and the PR gate, with the reviewer's Pass-2 evidence behind it.
 3. Return to the user only the PR URL + title.
 
 If the review returned `CHANGES_REQUESTED`, do NOT invoke `commit-pr-pilot`: launch a **fresh** `implementer` scoped to just the findings — not a resume of the hot one (dragging a large transcript re-feeds its whole history every turn and rarely pays for a bounded fix round), and not the pilot.
@@ -152,7 +155,7 @@ If the repo has no test suite, the `implementer` still can't claim "done" withou
 
 ## What you do NOT do
 
-- ❌ Edit project code **when you orchestrate (R2+)** — that's the `implementer`'s. (At **R1**, 1–3 mechanical files, you do edit inline yourself; see organic routing.)
+- ❌ Edit project code — that's the `implementer`'s, always. The only exception is a delegation the orchestrator declared impossible (operator forbade subagents, or the tool is unavailable), and it is declared out loud, not assumed.
 - ❌ Make commits (that's `commit-pr-pilot` after the `reviewer`'s approval).
 - ❌ Accept subagent results in chat without a file reference.
 - ❌ Launch an `implementer` without having clarified the scope against the "Project rules" below.

package/dist/assets/core/core-assets/hooks/_partials/audit-log.sh

@@ -95,15 +95,44 @@ navori_audit_log() {
   # ONE jq for every field, not one per field: this runs on each hook of each
   # Bash call, and a fork is the most expensive thing in it. Newline-separated,
   # read back positionally.
-  navori_audit_fields=$(printf '%s' "${payload:-}" | jq -r '[.session_id // "", .cwd // "", .agent_id // .subagent_id // ""] | .[]' 2>/dev/null) || return 0
+  # The third field is the OWNER, and it is never empty: inside a subagent the
+  # host sends a real `agent_id`; on the main thread it sends none and the
+  # literal below names the orchestrator explicitly.
+  #
+  # It used to be `// ""`, and the empty case did not stay empty — it came out
+  # as the `cwd`. Command substitution strips trailing newlines, so an empty
+  # third field left `$navori_audit_fields` with only two lines; then
+  # `${rest#*<NL>}` found no newline in `"cwd"` and POSIX says a `#` pattern
+  # that does not match returns the string UNCHANGED. 41,581 of the park's
+  # 52,460 recorded owners (79%) were a filesystem path for that reason.
+  #
+  # The consumer's behaviour does not change — `ownerOf` looks the value up
+  # among the session's agents and sends anything that names nobody to the
+  # orchestrator, which is where a path already went — but the record stops
+  # claiming the repo directory is an agent. Old logs keep working through the
+  # same "names nobody" branch.
+  #
+  # The trailing "." is a sentinel, not data: with it the third field is always
+  # followed by a newline, so the `%%` below cannot fall into the same trap if
+  # a future field is ever empty.
+  #
+  # The owner is picked with an explicit "first non-empty string", NOT with
+  # `.agent_id // .subagent_id // "orchestrator"`. In jq only `null` and `false`
+  # are falsy, so a host that sends the key with an EMPTY string satisfies `//`
+  # and the chain yields `""` — the field then disappears from the record and
+  # `ownerOf` falls back to the time window, which is the guess this field
+  # exists to avoid. Caught by a test, not by review.
+  navori_audit_fields=$(printf '%s' "${payload:-}" | jq -r '[.session_id // "", .cwd // "", ([.agent_id, .subagent_id] | map(select(type == "string" and . != "")) | first) // "orchestrator", "."] | .[]' 2>/dev/null) || return 0
   navori_audit_session=${navori_audit_fields%%
 *}
   navori_audit_rest=${navori_audit_fields#*
 }
   navori_audit_cwd=${navori_audit_rest%%
 *}
-  navori_audit_agent=${navori_audit_rest#*
+  navori_audit_rest=${navori_audit_rest#*
 }
+  navori_audit_agent=${navori_audit_rest%%
+*}
   [ -n "$navori_audit_session" ] || return 0
   # Same character class the CLI enforces (#503): the id composes a path, so
   # anything path-shaped means the payload is not what we think it is.
@@ -144,7 +173,29 @@ navori_audit_log() {
   navori_audit_ms=$(( navori_audit_end - ${navori_audit_t0:-$navori_audit_end} ))
   [ "$navori_audit_ms" -ge 0 ] 2>/dev/null || navori_audit_ms=0
 
-  navori_audit_ts=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null) || navori_audit_ts=""
+  # `tsMs` is the instant at the resolution the log actually needs (#685): the
+  # `ts` below truncates to the second, and 84% of a measured session's events
+  # share their second with another one. This value is already computed — the
+  # duration above is derived from it — so recording it costs nothing.
+  #
+  # Validated with the same `-ge 0` idiom as `ms`, and for the same reason: it
+  # is passed as `--argjson`, so a non-numeric value would make the whole `jq`
+  # fail and the event would vanish instead of merely losing a field.
+  [ "$navori_audit_end" -ge 0 ] 2>/dev/null || navori_audit_end=0
+
+  # `ts` is NOT stamped here, and that is the whole point of #696: it was a
+  # `date` fork per event — 46,850 of them across this store — for a string
+  # fully derivable from the `tsMs` above, which `$EPOCHREALTIME` already
+  # produced without spawning anything. The file's own cost doctrine (see
+  # `navori_audit_now`) says spend a process only when there is no other way;
+  # keeping this one made the comment lie four lines under the value that
+  # refutes it.
+  #
+  # Nothing downstream lost a field: `parse.ts` derives the ISO from `tsMs`
+  # when the record carries none, and logs written before this still have
+  # theirs. The lifecycle records — `start`, `stop`, `session-end` — keep a real
+  # `ts`, so a human reading the raw `.log` still has dated anchors; those are
+  # ~3 per session, not one per hook.
   # `navori_audit_agent` came out of the same single jq above. It is what lets
   # the report attribute a hook to a subagent WITHOUT guessing: with agents
   # running in parallel their time windows overlap, so attribution by timestamp
@@ -160,7 +211,6 @@ navori_audit_log() {
   # (`ownerOf` in `lib/audit/parse.ts` is where that rule lives).
 
   printf '%s\n' "$(jq -cn \
-    --arg ts "$navori_audit_ts" \
     --arg name "${navori_audit_name:-unknown}" \
     --arg phase "${navori_audit_phase:-unknown}" \
     --arg verdict "${1:-unknown}" \
@@ -169,7 +219,8 @@ navori_audit_log() {
     --arg src "${navori_audit_source:-core}" \
     --arg agent "${navori_audit_agent:-}" \
     --argjson ms "$navori_audit_ms" \
-    '{ts:$ts,event:"hook",name:$name,phase:$phase,verdict:$verdict,ms:$ms,source:$src}
+    --argjson tsMs "$navori_audit_end" \
+    '{tsMs:$tsMs,event:"hook",name:$name,phase:$phase,verdict:$verdict,ms:$ms,source:$src}
      + (if $tool   == "" then {} else {tool:$tool}       end)
      + (if $reason == "" then {} else {reason:$reason}   end)
      + (if $agent  == "" then {} else {agentId:$agent}   end)' 2>/dev/null)" \

package/dist/assets/core/core-assets/hooks/_partials/classify-source.sh

@@ -0,0 +1,52 @@
+# GENERATED by `pnpm gen:schemas` from packages/cli/src/lib/source-classify.ts.
+# Do not edit: edit the module. A drift test fails if this falls behind.
+#
+# navori_is_source <repo-relative-path> — exit 0 when the path carries behavior
+# (clause (a) of "non-trivial source file"), 1 otherwise.
+#
+# Clause (c) — a test riding along does not count twice — is NOT decided here:
+# it needs the whole set of paths in one change, and a caller that has only one
+# path at a time cannot apply it. Callers that count per file are computing a
+# ceiling, exactly like the TypeScript side says.
+navori_is_source() {
+  [ -n "${1:-}" ] || return 1
+  local _p
+  # ephemeral: agent handoffs and reclaimed worktrees: never versioned, never in a diff
+  _p='(^|/)\.claude/(progress|worktrees)/'; [[ $1 =~ $_p ]] && return 1
+  # ephemeral: throwaway scaffolding; 13.4% of the miner's old 'source' writes were this
+  _p='(^|/)(scratchpad|\.scratch)/'; [[ $1 =~ $_p ]] && return 1
+  # dependency: a vendored dependency is not ours to change, and a write there is an accident
+  _p='(^|/)node_modules/'; [[ $1 =~ $_p ]] && return 1
+  # dependency: build output: regenerated from the source this same change may edit
+  _p='(^|/)(dist|build|out|coverage|\.next|\.astro)/'; [[ $1 =~ $_p ]] && return 1
+  # generated: the rendered harness mirror — the change lives in the source asset, not here
+  _p='(^|/)\.claude/'; [[ $1 =~ $_p ]] && return 1
+  # generated: rendered from managed blocks; editing it directly is what the drift guard blocks
+  _p='(^|/)(CLAUDE|AGENTS)\.md$'; [[ $1 =~ $_p ]] && return 1
+  # generated: rendered from the plugin manifests; editing it here is overwritten next render
+  _p='(^|/)\.mcp\.json$'; [[ $1 =~ $_p ]] && return 1
+  # generated: regenerated from the tree it pins; never hand-authored
+  _p='(^|/)__golden__/|\.snap$'; [[ $1 =~ $_p ]] && return 1
+  # lockfile: resolved by a tool, reviewed as a diff of intent elsewhere
+  _p='(^|/)(pnpm-lock\.yaml|package-lock\.json|yarn\.lock|bun\.lockb?|Cargo\.lock|poetry\.lock|Gemfile\.lock|go\.sum)$'; [[ $1 =~ $_p ]] && return 1
+  # fixture: data the tests read, not behavior the program runs
+  _p='(^|/)(__fixtures__|__mocks__|fixtures)/'; [[ $1 =~ $_p ]] && return 1
+  # test: clause (c): a test pinning a change counted elsewhere is evidence, not a second file
+  _p='\.(test|spec)\.[mc]?[jt]sx?$'; [[ $1 =~ $_p ]] && return 1
+  # test: same clause, for repos that group tests by directory instead of by suffix
+  _p='(^|/)(__tests__|tests?)/'; [[ $1 =~ $_p ]] && return 1
+  # test: same clause, Python and Go naming
+  _p='(^|/)(test|tests)_[^/]+\.py$|(^|/)[^/]+_test\.(py|go)$'; [[ $1 =~ $_p ]] && return 1
+  # config: clause (a) excludes config explicitly
+  _p='(^|/)(package\.json|tsconfig[^/]*\.json|jsconfig\.json|biome\.jsonc?|\.eslintrc[^/]*|\.prettierrc[^/]*|\.editorconfig|\.gitignore|\.npmrc|\.nvmrc)$'; [[ $1 =~ $_p ]] && return 1
+  # config: declares what the harness renders; the behavior it changes is navori's, not the repo's
+  _p='(^|/)navori\.config\.json$'; [[ $1 =~ $_p ]] && return 1
+  # docs: read by humans; no agent obeys it as instruction
+  _p='(^|/)(docs|specs)/|(^|/)(README|CONTRIBUTING|CHANGELOG|LICENSE)[^/]*$'; [[ $1 =~ $_p ]] && return 1
+  # docs: the session log, versioned but not behavior
+  _p='(^|/)progress/'; [[ $1 =~ $_p ]] && return 1
+  # Harness prose an agent obeys is behavior even though it is .md.
+  _p='(^|/)(core-assets|plugins)/(.*/)?(agents|skills|managed)/[^/]+\.md$'; [[ $1 =~ $_p ]] && return 0
+  _p='\.(ts|tsx|mts|cts|js|jsx|mjs|cjs|py|go|rs|java|kt|rb|php|cs|swift|sh|bash|zsh|sql|vue|svelte|astro|ipynb)$'; [[ $1 =~ $_p ]] && return 0
+  return 1
+}

package/dist/assets/core/core-assets/hooks/_partials/gate-trigger.sh

@@ -14,6 +14,36 @@
 # the gate silently). Matching a segment START means a quoted `echo "git commit"`
 # does NOT trigger it. Known limitation: it cannot see through `sh -c`, `eval`,
 # or obfuscation — a seatbelt, not a sandbox.
+# The fast path on its own, so a caller can apply it EARLIER than the segment
+# scan — before it has even paid to extract the command from the payload.
+#
+# Returns 0 when $1 may contain a gated operation, 1 when it provably cannot.
+# The argument is the one the block below spells out: no $TRIGGER_RE can match
+# without one of the caller's literal TOKENS appearing in the segment it
+# matches, and every segment is a substring of the input. So the absence of
+# every token is proof that no segment can match — and the same proof holds one
+# level up, over the raw PAYLOAD the command was extracted from: JSON escaping
+# touches `"`, `\` and control characters, never the letters of a token.
+#
+# Disarms when $TRIGGER_TOKENS is unset: with no tokens declared there is
+# nothing to prove absent, so it answers "maybe" and the caller does the work.
+# Fail-open to the SLOW path, never to a skip.
+has_trigger_token() {
+  [ -n "${TRIGGER_TOKENS:-}" ] || return 0
+  # Token iteration goes through newline-split + `read`, NOT `for _tok in
+  # $TRIGGER_TOKENS`: zsh does not word-split an unquoted expansion, so the
+  # `for` form iterated ONCE with the whole list as a single token there — and
+  # a token that can never match is a gate that never fires. Caught by the
+  # bash×zsh differential suite.
+  local _input="$1" _tok _nl=$'\n'
+  local _toks="${TRIGGER_TOKENS// /$_nl}"
+  while IFS= read -r _tok; do
+    [ -n "$_tok" ] || continue
+    case "$_input" in *"$_tok"*) return 0 ;; esac
+  done <<< "$_toks"
+  return 1
+}
+
 is_scan_trigger() {
   # Pre-expanded newline: zsh does NOT expand $'\n' in the REPLACEMENT of
   # ${var//pat/repl} (it inserts the literal characters), so an inline $'\n'
@@ -44,18 +74,7 @@ is_scan_trigger() {
   # `for` form iterated ONCE with the whole list as a single token there — and
   # a token that can never match is a gate that never fires. Caught by the
   # bash×zsh differential suite; same class as the $'\n' pitfall above.
-  if [ -n "${TRIGGER_TOKENS:-}" ]; then
-    local _tok _hit="" _toks="${TRIGGER_TOKENS// /$nl}"
-    while IFS= read -r _tok; do
-      [ -n "$_tok" ] || continue
-      case "$input" in *"$_tok"*)
-        _hit=1
-        break
-        ;;
-      esac
-    done <<< "$_toks"
-    [ -n "$_hit" ] || return 1
-  fi
+  has_trigger_token "$input" || return 1
   # FIX B: join `\<newline>` continuations into a space FIRST, so a command
   # split across lines with a trailing backslash stays ONE logical segment
   # (otherwise the subcommand/flag lands in a segment not starting with git).

package/dist/assets/core/core-assets/hooks/audit-mode-trigger.sh

@@ -75,6 +75,30 @@ if navori_audit_consume_armed "$session_id" "$cwd" "$audits_root"; then
   printf 'navori: audit-mode ACTIVE from this message on (armed via navori audit --arm; the hook ran --start %s).\n' "$session_id"
 fi
 
+# ─── audit.mode = always (cobertura sin acordarse) ───────────────────────────
+# `opt-in` keeps the historical behaviour: nothing is recorded until someone runs
+# `navori audit --start|--arm`. `always` starts the recorder on this session's
+# first prompt instead.
+#
+# It exists because opt-in coverage was measured and it is thin: of 187 real
+# sessions only 54 carried a log, so the instrument saw 39% of the work — and the
+# two arms of a controlled A/B sat at 0%, which is the one place the measurement
+# was supposed to decide something. Same failure mode as the release tag that got
+# skipped twice: a step that waits on a human remembering it.
+#
+# The `! -f` guard is what makes this idempotent AND free: once the log exists
+# the branch is never taken again, and in `opt-in` repos the string compare costs
+# nothing. Failure to start is silent and leaves the session unrecorded, exactly
+# as if the mode were off — a recorder may never be the reason a prompt fails.
+audit_mode={{shq:audit.mode}}
+if [ ! -f "$log_file" ] && [ "$audit_mode" = "always" ] && command -v navori >/dev/null 2>&1; then
+  if navori audit --start "$session_id" --cwd "$cwd" >/dev/null 2>&1; then
+    # Same reasoning as the armed branch: a UserPromptSubmit hook's stdout is
+    # injected as context, so the model learns it is being recorded as it starts.
+    printf 'navori: audit-mode ACTIVE from this message on (audit.mode=always; no --arm needed).\n'
+  fi
+fi
+
 # Not marked → not recording. This is also what makes the hook free outside
 # audit-mode: one stat and out.
 [ -f "$log_file" ] || exit 0

package/dist/assets/core/core-assets/hooks/pr-pilot-confirm.sh

@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+#
+# PreToolUse(Bash): a `gh pr create` that did NOT come from the
+# `commit-pr-pilot` is raised to a user confirmation.
+#
+# WHY (#705): the pilot is the single owner of commit+PR, and it is invoked on
+# 15% of the PRs this harness opens. The rate is not uniform — one park repo
+# runs at 48%, and the repo that PUBLISHES the pilot sat at 0 of 101. The
+# confound was checked and does not hold: in the sessions where subagents were
+# demonstrably available and used, the pilot was still never called. The pilot
+# is not skipped; its antechamber is never entered, because `gh pr create` falls
+# out of whatever the main agent was already doing and nothing interrupts it.
+#
+# So this hook interrupts, and does no more than that. It does NOT block: a
+# session where the operator forbids subagents has no way to reach the pilot,
+# and a hook that made PRs impossible there would be worse than the deviation it
+# corrects. `ask` keeps the decision with the human while removing the one thing
+# measured to fail — a layer that only suggests.
+set -euo pipefail
+
+# Command extraction (payload → $cmd). Shared body, single source of truth.
+# navori:include extract-cmd
+
+# Gate to `gh pr create` only. $TRIGGER_RE is consumed by the shared detector
+# inlined below, which splits compound commands on && || ; | and matches at a
+# segment START — so `git push … && gh pr create …` is caught and an
+# `echo "gh pr create"` is not.
+TRIGGER_RE='^gh[[:space:]]+pr[[:space:]]+create([[:space:]]|$)'
+# Literal substring every branch of $TRIGGER_RE needs, read by the fast path in
+# the shared detector (spec 0016). `create` rather than `gh`: both are necessary
+# conditions, and the rarer one skips the fork on more commands. Keep NEXT to
+# the regex — a branch added there without its token here loses the shortcut.
+TRIGGER_TOKENS='create'
+# navori:include gate-trigger
+
+# THE CHEAP GATE, and it comes before everything that costs a process.
+#
+# This hook fires on EVERY Bash call and does real work on almost none of them,
+# and until this line it paid for that privilege twice: `extract_cmd` forks jq
+# (or node) to read the command, and the `skip` record forks jq again to write
+# "I ran and it was not a PR". Measured on a `git status` payload: 24.8 ms per
+# Bash call, half of the ~48 ms that already forced `audit-log.sh` to be
+# redesigned.
+#
+# `has_trigger_token` answers from the payload navori already has in memory,
+# with no fork at all, and its answer is a proof rather than a guess: the
+# command is a substring of the payload, and JSON escaping cannot break a token
+# apart. No token in the payload → no segment can match → nothing here concerns
+# this hook.
+#
+# WHAT IS GIVEN UP: the `skip` record for those calls. It says "the hook ran and
+# the command was not a PR" — 99.9% of its firings — and it cost two forks to
+# produce. Every record that carries information (`ask`, `allow`) is still
+# written below. Same trade as #696, for the same reason.
+has_trigger_token "${payload:-}" || exit 0
+
+cmd=$(extract_cmd)
+
+navori_audit_name="pr-pilot-confirm"
+navori_audit_phase="PreToolUse"
+navori_audit_tool="Bash"
+# Fail-open no-ops, overwritten by the real definitions the include brings in.
+# Same contract as the sibling gates: a recorder may never kill what it observes.
+navori_audit_begin() { :; }
+navori_audit_log() { :; }
+# navori:include audit-log
+navori_audit_begin
+
+# The verdict is derived once, in a trap, rather than by a call per branch —
+# this fires on EVERY Bash call and does real work on almost none of them.
+navori_audit_verdict="skip"
+navori_audit_reason="el comando no abre un PR"
+navori_audit_on_exit() {
+  navori_audit_log "$navori_audit_verdict" "$navori_audit_reason" || true
+  return 0
+}
+trap navori_audit_on_exit EXIT
+
+# An EMPTY $cmd means nothing could be read from the tool input, not "some
+# command that isn't a PR". Unlike the quality gate, the fail-open direction
+# here is to stay quiet: this hook's worst case is a false confirmation prompt
+# on every Bash call, which would train the user to dismiss it unread — and a
+# prompt nobody reads is worth less than no prompt at all.
+[ -n "$cmd" ] || exit 0
+is_scan_trigger "$cmd" || exit 0
+
+# Who is running it. Inside a subagent the host sends a real `agent_id` on the
+# tool phases; the main thread sends none. Measured over the park's audit logs:
+# 10,879 events carried a real id and every one of them resolved to a subagent.
+#
+# Read HERE, not at the top: `payload_field` may spawn a process, and by this
+# line we already know the command is the rare one that needs the answer.
+#
+# It names SOME subagent, not specifically the pilot — a `researcher` opening a
+# PR would pass. That is deliberate: this is a routing nudge, not a security
+# boundary, and the detector cannot see through `sh -c` either.
+navori_pr_agent=$(payload_field agent_id)
+[ -n "$navori_pr_agent" ] || navori_pr_agent=$(payload_field subagent_id)
+if [ -n "$navori_pr_agent" ]; then
+  navori_audit_verdict="allow"
+  navori_audit_reason="el PR viene de un subagente"
+  exit 0
+fi
+
+navori_audit_verdict="ask"
+navori_audit_reason="PR abierto fuera del commit-pr-pilot"
+
+# `ask` routes the call to the user instead of resolving it. The reason is what
+# they read, so it says what the pilot adds and how to get it — a prompt that
+# only says "are you sure" is a tax, not a routing signal.
+#
+# jq builds it: the reason travels inside JSON and a hand-rolled string would
+# break on the first quote. No jq (not preinstalled on macOS) → stay silent
+# rather than emit malformed JSON, which the host rejects with a wall of schema
+# text that teaches the user to ignore this hook.
+command -v jq >/dev/null 2>&1 || exit 0
+
+# The message lands in its own assignment rather than inline in the jq call.
+# A heredoc nested inside `"$( ... )"` is parsed by the shell BEFORE the quoted
+# delimiter takes effect for the outer context, so the apostrophe in "repo's"
+# and the backticks around `gh pr create` opened quotes that were never closed
+# and the file failed `bash -n` outright. Caught by the syntax check; it would
+# have shipped a hook that cannot run to every repo in the park.
+navori_pr_reason=$(cat <<'MSG'
+[navori] this `gh pr create` does not come from the commit-pr-pilot.
+
+The pilot is the single owner of commit+PR: it applies the title/body format
+this repo uses and runs the git/gh pre-flight before opening anything.
+
+Delegate it with the Agent tool (subagent_type: commit-pr-pilot), or confirm to
+open this PR by hand — a rollout PR, a revert, or a session where subagents are
+unavailable are all legitimate reasons to do so.
+MSG
+)
+
+jq -cn --arg reason "$navori_pr_reason" '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"ask",permissionDecisionReason:$reason}}'
+exit 0