opensquid 0.5.395

package/packs/builtin/coding-flow/skills/pause-prevention/skill.yaml

@@ -0,0 +1,73 @@
+# pause-prevention (AF.6) — the tool_call + prompt_submit pause-gates. Two rules, each
+# naturally event-gated (the AskUserQuestion rule no-ops without a tool; the language rule
+# no-ops without priorAssistantText), so one skill on both triggers is safe. Both fire only
+# during an ACTIVE run — derived: FSM != idle AND (open tasks remain OR FSM != phases_complete).
+# Run-active turns ON at scope-start and OFF when the backlog is depleted (user ruling).
+name: pause-prevention
+load: preload
+when_to_load: []
+triggers:
+  - kind: tool_call
+  - kind: prompt_submit
+rules:
+  # AskUserQuestion past SCOPE → drift. Questions belong to the interactive SCOPE phase
+  # (idle/scoping/researching/researched); past it the run is automated.
+  - id: no-question-after-scope
+    process:
+      - call: tool_name
+        as: tool
+      - call: read_fsm_state
+        as: st
+      # GF.6 (F8): HARD-BLOCK the question — it's a real-time pause ACTION, so exit-2 deny
+      # actually prevents it (the agent must answer from the principles, not stall).
+      - call: verdict
+        if: '(tool == "AskUserQuestion") && st != "idle" && st != "scoping" && st != "researching" && st != "researched"'
+        args:
+          level: block
+          message: >-
+            DRIFT: AskUserQuestion past SCOPE. Questions belong to the interactive SCOPE
+            phase — fill every gap there. Past scope the run is automated; do not pause for a
+            question that should have been asked during scoping (if a real gap surfaced, the
+            SCOPE was incomplete — re-scope it, do not stall the run).
+  # Pause / permission LANGUAGE in the just-settled prior turn during an active run → drift.
+  # text_pattern_match on priorAssistantText (like honesty-ledger), gated on run-active.
+  # GF.6: stays WARN (not block) — it's a RETROSPECTIVE detector of an already-emitted
+  # pause, not the pause action itself; blocking the next (possibly unrelated) tool would
+  # not undo the pause and risks locking the session. The real-time action gates
+  # (no-stop-mid-run, no-question-after-scope) are the hard blocks.
+  - id: no-pause-language
+    process:
+      - call: text_pattern_match
+        args:
+          text_field: priorAssistantText
+          patterns:
+            - "\\b(?:should\\s+i\\s+(?:continue|proceed)|want\\s+me\\s+to|ready\\s+to\\s+(?:continue|proceed)|shall\\s+i|is\\s+(?:this|the\\s+plan)\\s+(?:ok|good|right))\\b"
+            - "\\b(?:i'?ll\\s+pause|let\\s+me\\s+(?:check|pause|confirm)\\s+(?:with\\s+you|before)|pausing\\s+(?:here|now)|checkpoint\\s+here)\\b"
+            - '\b(?:context\s+(?:window\s+)?limit|at\s+(?:the\s+)?(?:practical\s+)?limit|running\s+(?:low|out)\s+of\s+context)\b'
+            # G-b (T-FLOW-REARM-GATE-HOLES / RH.2): the decision-DEFERRAL class — handing the
+            # proceed/choice decision back to the user ("your call", "unless you redirect",
+            # "let me know which", "none of these"). The 2026-06-04-flagged leak. ONE coherent
+            # class, not ad-hoc phrases. This stays a retrospective best-effort WARN — the HARD
+            # guarantee is the Stop/Question blocks (re-armed by RH.1's structural re-arm). A
+            # false positive is a harmless non-blocking nudge, so recall is favoured over
+            # precision (same asymmetry as the no-verify over-block).
+            - "\\b(?:your\\s+call|up\\s+to\\s+you|your\\s+(?:decision|choice)|unless\\s+you(?:'?d|\\s+would)?\\s+(?:rather|prefer|redirect|want|like)|if\\s+you'?d\\s+(?:rather|prefer|like)|whichever\\s+you\\s+(?:prefer|want|'?d\\s+like)|let\\s+me\\s+know\\s+(?:if|which|whether|what)|say\\s+the\\s+word|would\\s+you\\s+like\\s+me\\s+to|do\\s+you\\s+want\\s+me\\s+to|which\\s+(?:one|of\\s+these)|(?:any|none)\\s+of\\s+these)\\b"
+        as: paused
+      - call: read_fsm_state
+        as: st
+      - call: open_task_count
+        as: open
+      - call: verdict
+        if: 'len(paused.matched) > 0 && st != "idle" && (open.count > 0 || st != "phases_complete")'
+        args:
+          level: warn
+          message: >-
+            DRIFT: pause/permission language during an active run. Scope is complete — the run
+            is automated until the backlog is depleted. No "should I continue / is this ok /
+            at a context limit / let me pause": continue straight to the next task. The only
+            valid interrupt is a genuine user-question during SCOPE — and you are past it.
+prose: |
+  Two pause-gates that fire ONLY during an active run (FSM != idle AND backlog not depleted):
+  an AskUserQuestion past SCOPE (GF.6: HARD-BLOCK — the real-time pause action), and
+  pause/permission LANGUAGE in the settled prior turn (priorAssistantText, kept WARN — a
+  retrospective detector). The automated phases take no pauses; questions live in SCOPE.

package/packs/builtin/coding-flow/skills/pause-stop-guard/skill.yaml

@@ -0,0 +1,67 @@
+# pause-stop-guard (AF.6) — the Stop-region pause-gate. Stopping DURING a run's AUTHOR or
+# EXECUTE region (FSM past `researched`, before idle/phases_complete) is drift: the
+# automated phases take no pauses until the backlog is depleted. A SCOPE stop (to await a
+# genuine user answer) is fine and is NOT flagged here (FSM in idle/scoping/researching/
+# researched). Own trigger so the FSM-only condition can't cross-fire on tool/prompt events.
+name: pause-stop-guard
+load: preload
+when_to_load: []
+triggers:
+  - kind: stop
+rules:
+  - id: no-stop-mid-run
+    process:
+      - call: read_fsm_state
+        as: st
+      - call: open_task_count
+        as: open
+      # GF.6 (F8): HARD-BLOCK the stop, and WIDEN coverage — also fire at `researched`
+      # (SCOPE done, AUTHOR owed) and at `phases_complete` WHILE the backlog is non-empty
+      # (open tasks remain). The depletion auto-OFF is preserved: `idle` and
+      # `phases_complete` with ZERO open tasks are NOT flagged, so a finished run stops
+      # freely. (open_task_count on the `stop` event has no event.openTasks → it reads the
+      # harness store, returning the real count.)
+      - call: verdict
+        if: 'st == "researched" || st == "spec_authored" || st == "spec_complete" || st == "tasks_loaded" || st == "phases_in_flight" || (st == "phases_complete" && open.count > 0)'
+        args:
+          level: block
+          message: >-
+            DRIFT: you stopped mid-run (AUTHOR/EXECUTE, or with the backlog non-empty). The
+            run is NOT complete — everything after SCOPE is automated. Do not pause: continue
+            to the next phase/task and keep going until the whole backlog is depleted. (A
+            SCOPE stop to await a genuine user answer is the only allowed pause, and you are
+            past SCOPE.)
+  # SDG.1 (wg-66307bc8af35) — the SCOPE-stop exception was unconditional, so a
+  # decision-DEFERRAL pause ("your call", "say the word") slipped through at
+  # scoping between slices. The precise allow-signal: a SCOPE stop is
+  # legitimate iff a fork is ACTUALLY awaiting the user — AskUserQuestion ran
+  # this turn (the tool ledger is written at PreToolUse, immune to the stop
+  # text's off-by-one that killed the text-match design; see the
+  # pre-research). A prose question gets blocked once and re-posed through
+  # the tool — the structured-fork upgrade is intended.
+  - id: scope-stop-needs-a-question
+    process:
+      - call: read_fsm_state
+        as: st
+      - call: session_tool_history
+        args:
+          scope: current_turn
+          filter_names: [AskUserQuestion]
+        as: asked
+      - call: verdict
+        if: '(st == "scoping" || st == "researching") && asked.count == 0'
+        args:
+          level: block
+          message: >-
+            DRIFT: a SCOPE stop without a pending question. A stop during SCOPE
+            is for awaiting a genuine user answer — pose the fork via
+            AskUserQuestion (state the options, ask it), or continue the
+            research. A deferral ("your call", "say the word") is not a pause
+            ticket.
+prose: |
+  Stopping during AUTHOR or EXECUTE — or at phases_complete with open tasks remaining — is
+  drift, and is now HARD-BLOCKED (GF.6). The only legitimate pause is a genuine
+  user-question during the interactive SCOPE phase — and SDG.1 makes that literal: a stop at
+  scoping/researching is allowed only when AskUserQuestion ran this turn (a fork is actually
+  awaiting the user); a deferral is not a pause ticket. Everything downstream runs to
+  depletion. A depleted run (idle, or phases_complete with zero open tasks) stops freely.

package/packs/builtin/coding-flow/skills/phase-advance/skill.yaml

@@ -0,0 +1,28 @@
+# phase-advance — the EXECUTE-region advance. A log_phase call (post_tool_call,
+# after the MCP handler appended the phase) advances the FSM into / through the
+# phase-running states. The EXECUTE-region advance-on-phase-log.
+name: phase-advance
+load: preload
+when_to_load: []
+triggers:
+  - kind: post_tool_call
+rules:
+  - id: advance-phases
+    process:
+      - call: tool_name
+        as: tool
+      - call: workflow_phases_complete
+        as: phases
+      - call: advance_fsm
+        if: 'tool == "mcp__opensquid__log_phase" && phases.complete == true'
+        args:
+          event: phases_done
+      - call: advance_fsm
+        if: 'tool == "mcp__opensquid__log_phase" && phases.complete == false'
+        args:
+          event: phase_started
+prose: |
+  The phase signal. A log_phase that leaves the 7-phase set incomplete advances →
+  phases_in_flight; the one that completes it advances → phases_complete. (The EXECUTE
+  loop driver — report + next task — is the prompt_submit handoff in entry-and-handoffs,
+  since directives only surface at prompt_submit.)

package/packs/builtin/coding-flow/skills/phase-audit/skill.yaml

@@ -0,0 +1,68 @@
+# phase-audit — the EXECUTE-region's content gate ON THE PHASE LOG ITSELF (FU.10).
+# log_phase is otherwise a bare marker: the execute-gate checks the 7 phases are
+# LOGGED, not DONE, so an agent could log them without doing the work. This guards
+# the mechanically-verifiable phases against tool-ledger evidence (this turn):
+#   - code / fix → require a Write/Edit/NotebookEdit this turn
+#   - test       → require a Bash this turn (the test run)
+# The judgment phases (learn / audit / post_research) have no mechanical proxy and
+# are accepted as agent-attested — the recursion bottoms out there (you cannot gate
+# intuition). pre_research already has its own evidence gate (scope-architect's
+# DPC.5 research-activity check). Fires on the log_phase tool_call, BEFORE the phase
+# is recorded. Spec: docs/tasks/T-fsm-unify.md FU.10.
+name: phase-audit
+load: preload
+when_to_load: []
+triggers:
+  - kind: tool_call
+rules:
+  # code / fix → must have written code this turn.
+  - id: code-phase-needs-writes
+    process:
+      - call: tool_name
+        as: tool
+      - call: tool_args
+        as: targs
+      - call: session_tool_history
+        if: 'tool == "mcp__opensquid__log_phase" && (targs.phase == "code" || targs.phase == "fix")'
+        args:
+          scope: current_turn
+          filter_names:
+            - Write
+            - Edit
+            - NotebookEdit
+        as: writes
+      - call: verdict
+        if: 'tool == "mcp__opensquid__log_phase" && (targs.phase == "code" || targs.phase == "fix") && writes.count == 0'
+        args:
+          level: block
+          message: >-
+            BLOCKED: cannot log the "{{targs.phase}}" phase — no Write/Edit this turn.
+            The phase log is a record of work DONE, not a checkbox. Actually write the
+            code (or apply the fix), then log the phase.
+  # test → must have run something this turn.
+  - id: test-phase-needs-a-run
+    process:
+      - call: tool_name
+        as: tool
+      - call: tool_args
+        as: targs
+      - call: session_tool_history
+        if: 'tool == "mcp__opensquid__log_phase" && targs.phase == "test"'
+        args:
+          scope: current_turn
+          filter_names:
+            - Bash
+        as: runs
+      - call: verdict
+        if: 'tool == "mcp__opensquid__log_phase" && targs.phase == "test" && runs.count == 0'
+        args:
+          level: block
+          message: >-
+            BLOCKED: cannot log the "test" phase — no Bash (test run) this turn. Run the
+            tests and observe the result before logging the phase.
+prose: |
+  The phase-audit closes the gap the user surfaced ("does that need to be a gate
+  itself?"): the execute-gate verifies phases are logged, not done. This verifies the
+  mechanically-checkable phases (code/fix → file writes; test → a run) against the
+  per-turn tool ledger, and honestly accepts the judgment phases (learn/audit/
+  post_research) as agent-attested — where evidence-gating bottoms out.

package/packs/builtin/coding-flow/skills/scope-lifecycle/skill.yaml

@@ -0,0 +1,362 @@
+# scope-lifecycle — the tool_call lifecycle: advances the unified FSM on milestone
+# writes, runs each region's CONTENT audit immediately AFTER its advance (same skill,
+# ordered — so the audit sees the just-advanced state), and
+# enforces the region gates that read the state. Rule order is load-bearing:
+#   advance-on-research → guess-audit → advance-on-spec → spec-audit → scope-before-code → taskcreate-spec-required
+# Merges the SCOPE lifecycle + the AUTHOR/EXECUTE advance-on-writes, and folds
+# in the two content audits (guess-audit, spec-audit). State-driven, never
+# file-existence. Both audits run synchronously, are timeout-bounded (EWG.1.1), and
+# fail CLOSED (no clear pass verdict ⇒ no advance).
+name: scope-lifecycle
+load: preload
+when_to_load: []
+triggers:
+  - kind: tool_call
+rules:
+  # ── AUTONOMOUS re-arm (T-FLOW-AUTONOMOUS-REARM). A pre-research WRITE is the structural
+  #    start of a new track's SCOPE. The other re-arms (entry-and-handoffs' enter-scoping /
+  #    rearm-on-depletion, task-start's task_unscoped) fire on prompt_submit / an unscoped
+  #    TaskUpdate — neither occurs BETWEEN slices in an autonomous run, so the FSM stayed
+  #    parked at phases_complete and the agent had to hand-drive scope_start. Re-arm HERE on
+  #    the tool_call. scope_start is a no-op from every mid-run state (fsm.yaml: edges only
+  #    from idle/phases_complete), so this ONLY takes effect at the terminal/initial boundary;
+  #    the track reset is state-gated so it can't clobber an in-flight fix/doc track. Placed
+  #    FIRST so the re-arm lands (advance_fsm persists) before scope-advance fires research_done.
+  - id: rearm-on-pre-research-write
+    process:
+      - call: tool_name
+        as: tool
+      - call: tool_args
+        as: targs
+      - call: read_fsm_state
+        as: st
+      - call: advance_fsm
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/research/") && contains(targs.file_path, "-pre-research-") && (st == "phases_complete" || st == "idle")'
+        args:
+          event: scope_start
+      - call: write_state
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/research/") && contains(targs.file_path, "-pre-research-") && (st == "phases_complete" || st == "idle")'
+        args:
+          key: coding-flow-track
+          value: feature
+  # ── SCOPE: the GATING advance (AF.1). The content audit + depth + open-question
+  #    checks run BEFORE the advance, and research_done is COUPLED to them — no
+  #    advisory pass. The advance fires ONLY when SCOPE content is complete:
+  #    GUESS_FREE (every claim cited-or-flagged + the BEST/simplest solution justified)
+  #    AND zero unresolved OPEN QUESTION markers AND research depth >= 3 this turn.
+  - id: scope-advance
+    process:
+      - call: tool_name
+        as: tool
+      - call: tool_args
+        as: targs
+      # T-FLOW-AUDIT-ARTIFACT: the EFFECTIVE post-write content (Write→content,
+      # Edit→current file with old_string→new_string applied) so the audit +
+      # design-capture see the REAL resulting artifact, not the Edit-empty
+      # `targs.content` (which broke iterative refinement via Edit).
+      - call: effective_content
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/research/") && contains(targs.file_path, "-pre-research-")'
+        as: effective
+      # Capture the pre-research path (the AUTHOR coverage gate reads it as the design).
+      - call: write_state
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/research/") && contains(targs.file_path, "-pre-research-")'
+        args:
+          key: coding-flow-pre-research-path
+          value: '{{targs.file_path}}'
+      # AF.2: persist the design CONTENT so the AUTHOR coverage audit can check the
+      # task spec covers 100% of it (the subagent can't read files; state carries it).
+      - call: write_state
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/research/") && contains(targs.file_path, "-pre-research-")'
+        args:
+          key: coding-flow-design
+          value: '{{effective}}'
+      # Research DEPTH (folded DPC.5): recall + Read + Grep + read-only Bash this turn.
+      - call: session_tool_history
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/research/") && contains(targs.file_path, "-pre-research-")'
+        args:
+          scope: current_turn
+          filter_names: [mcp__opensquid__recall, Read, Grep, 'Bash:read-only']
+        as: depth
+      # The content audit: NEVER-GUESS + BEST-SOLUTION, one combined verdict.
+      # on_error: continue — a spawn failure binds the err message to `audit`
+      # and proceeds to the trichotomy below (the AUDIT-UNAVAILABLE branch),
+      # instead of aborting the process and freezing the FSM (F0c).
+      # cached_audit (T-FIX-AUDIT-SPAWN): memoizes the verdict by prompt-hash in
+      # cross-turn session state — a re-fire on UNCHANGED content reuses the
+      # verdict with NO `claude -p` spawn (kills the F0c re-fire storm). A
+      # timeout/error is NOT cached → on_error routes it to AUDIT-UNAVAILABLE and
+      # the next turn retries. cache_key is per-audit (guess vs spec).
+      # timeout_ms (T-AUDIT-SPAWN-FIX): 340s, sized to MEASURED reasoning-call
+      # latency (268s worst observed under subscription contention, 2026-06-10)
+      # and 20s under the 360s outer hook cap the setup wizard writes — the
+      # inner timer must die first so the gate fails with a readable error.
+      - call: cached_audit
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/research/") && contains(targs.file_path, "-pre-research-")'
+        on_error: continue
+        args:
+          cache_key: coding-flow-guess-audit-cache
+          model: reasoning
+          timeout_ms: 340000
+          prompt: >-
+            You are an adversarial reviewer enforcing the lexicon's Research/Audit flow
+            principles (docs/lexicon.md — never-guess, best-solution, full-fix-over-patch, teach-back depth) on a
+            pre-research / scope artifact. (1) NEVER-GUESS: a claim is acceptable ONLY if DERIVED from cited
+            evidence (a file:line, a memory, or the user's own words) OR explicitly flagged
+            as an OPEN QUESTION to ask the user. (2) BEST-SOLUTION: the artifact must show
+            the best solution was found — alternatives weighed against the criteria and the
+            SIMPLEST correct one chosen per docs/lexicon.md (no proliferating special-cases).
+            (3) FULL-FIX: the chosen solution must be the FULL fix — when the existing shape
+            is the cause, it is re-architected, NOT a local patch that bolts on a special-case
+            to dodge the rework (that patch is itself the proliferating-special-case
+            overcomplication the Full-fix-over-patch guideline forbids).
+            Begin your response with EXACTLY one line — `VERDICT: GUESS_FREE` ONLY if every
+            claim is cited-or-flagged-open AND the simplest-correct solution is justified
+            against alternatives AND is a full fix, not a patch around a design that should be
+            re-architected; otherwise `VERDICT: UNRESOLVED` + one bullet per unresolved
+            guess OR un-weighed alternative OR un-rearchitected patch. ARTIFACT:\n\n{{effective}}
+        as: audit
+      # ── PRECONDITIONS (evaluated FIRST, terminal blocks; key on the artifact,
+      #    not the audit). They partition the precondition-FAILED subspace so the
+      #    audit-string trichotomy below is a clean partition over its own subspace.
+      # BLOCK: unresolved open questions — answer them in SCOPE (this is the interactive phase).
+      - call: verdict
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/research/") && contains(targs.file_path, "-pre-research-") && contains(effective, "OPEN QUESTION")'
+        args:
+          level: block
+          message: >-
+            SCOPE incomplete: the pre-research still has unresolved OPEN QUESTION(s).
+            SCOPE is the interactive phase — ASK the user (AskUserQuestion), record + cite
+            the answer, and remove the marker BEFORE authoring. Everything after scope is
+            automated; a question must not survive into it.
+      # BLOCK: shallow research (folded DPC.5 depth). Ordered after open-question; its
+      # !OPEN QUESTION guard keeps the two preconditions mutually exclusive.
+      - call: verdict
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/research/") && contains(targs.file_path, "-pre-research-") && !contains(effective, "OPEN QUESTION") && depth.count < 3'
+        args:
+          level: block
+          message: >-
+            SCOPE shallow: do real research (recall + Read + Grep, >=3 this turn) before the
+            pre-research write — map the decision surface to teach-back depth.
+      # ── AUDIT-STRING TRICHOTOMY (reached ONLY when depth>=3 && no open question).
+      #    {GUESS_FREE, UNRESOLVED, no-VERDICT} is a total partition of the audit string.
+      # PASS → advance.
+      - call: advance_fsm
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/research/") && contains(targs.file_path, "-pre-research-") && depth.count >= 3 && !contains(effective, "OPEN QUESTION") && contains(audit, "VERDICT: GUESS_FREE")'
+        args:
+          event: research_done
+      # CONTENT-FAIL → loop-back + warn (keyed POSITIVELY on UNRESOLVED, not !GUESS_FREE — so an
+      # audit that could not run no longer masquerades as "guesses found").
+      - call: advance_fsm
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/research/") && contains(targs.file_path, "-pre-research-") && depth.count >= 3 && !contains(effective, "OPEN QUESTION") && contains(audit, "VERDICT: UNRESOLVED")'
+        args:
+          event: guess_found
+      - call: verdict
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/research/") && contains(targs.file_path, "-pre-research-") && depth.count >= 3 && !contains(effective, "OPEN QUESTION") && contains(audit, "VERDICT: UNRESOLVED")'
+        args:
+          level: warn
+          message: >-
+            SCOPE not complete — unresolved guesses OR the best/simplest solution is not
+            justified against alternatives. Resolve each (cite evidence or flag as an open
+            question; weigh the alternatives + choose the simplest correct per the lexicon),
+            then re-write. Audit:\n\n{{audit}}
+      # AUDIT-UNAVAILABLE → terminal BLOCK, NO advance (stays scoping, re-armable). F0c fix:
+      # the audit subagent could not spawn (a no-VERDICT response, incl. the bound err message).
+      - call: verdict
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/research/") && contains(targs.file_path, "-pre-research-") && depth.count >= 3 && !contains(effective, "OPEN QUESTION") && !contains(audit, "VERDICT:")'
+        args:
+          level: block
+          message: >-
+            SCOPE audit could not run (the reviewer subagent was unavailable — typically a
+            per-session spawn cap after many cycles). This is NOT a content failure. Re-write the
+            pre-research artifact to re-trigger the audit; if it persists, a FRESH session clears
+            the spawn exhaustion. Do NOT --no-verify or gate-off. Audit error:\n\n{{audit}}
+  # ── AUTHOR: advance on the track-spec write (+ capture its path) ─────────────
+  - id: advance-on-spec
+    process:
+      - call: tool_name
+        as: tool
+      - call: tool_args
+        as: targs
+      - call: advance_fsm
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/tasks/T-") && endsWith(targs.file_path, ".md")'
+        args:
+          event: spec_drafted
+      - call: write_state
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/tasks/T-") && endsWith(targs.file_path, ".md")'
+        args:
+          key: coding-flow-spec-path
+          value: '{{targs.file_path}}'
+  # ── AUTHOR content gate: spec-audit (the restored twin of guess-audit) ───────
+  - id: spec-audit
+    process:
+      - call: tool_name
+        as: tool
+      - call: tool_args
+        as: targs
+      # AF.2: the SCOPE design content (persisted at the research write). The spec must
+      # cover 100% of it — the audit compares spec-vs-design (no tool_call enumeration).
+      - call: read_state
+        args:
+          key: coding-flow-design
+        as: design
+      # T-FLOW-AUDIT-ARTIFACT: effective post-write spec content (Edit-safe).
+      - call: effective_content
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/tasks/T-") && endsWith(targs.file_path, ".md")'
+        as: effective
+      # on_error: continue — F0c: a spawn failure binds the err to `spec_audit`
+      # and proceeds to the trichotomy (AUDIT-UNAVAILABLE branch) instead of
+      # aborting the process and freezing the FSM at spec_authored.
+      # cached_audit (T-FIX-AUDIT-SPAWN): same content-hash memoization as the
+      # SCOPE audit — a re-fire on an UNCHANGED spec reuses the verdict, no spawn.
+      # timeout_ms (T-AUDIT-SPAWN-FIX): 340s, same measured sizing as the SCOPE
+      # audit above (268s worst observed; 20s under the 360s outer hook cap).
+      - call: cached_audit
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/tasks/T-") && endsWith(targs.file_path, ".md")'
+        on_error: continue
+        args:
+          cache_key: coding-flow-spec-audit-cache
+          model: reasoning
+          timeout_ms: 340000
+          prompt: >-
+            You are an adversarial reviewer enforcing THREE author-completeness rules.
+            (1) 11-FIELD CONTRACT: EVERY "### Task" block has all 11 fields (Required
+            skills, Deliverable, Depends on, Files affected, Key code shapes, Test
+            fixtures, Acceptance criteria, Risk callouts, References, Verification
+            commands, 7-phase steps), every Key-code-shapes block is REAL code (not
+            pseudocode), every 7-phase step names concrete files/decisions. (2) 100%
+            DESIGN COVERAGE: the task set covers EVERY element of the SCOPE design below —
+            no design item is left without a task. (3) SIMPLICITY (per docs/lexicon.md):
+            the design is the SIMPLEST correct solution — no proliferating special-cases
+            (that signals a missed decomposition), every lifecycle an explicit
+            total-transition FSM, every transform a pure function, no implicit state.
+            Begin your response with EXACTLY one line — `VERDICT: SPEC_COMPLETE` ONLY if
+            ALL THREE hold; otherwise `VERDICT: INCOMPLETE` + one bullet per offending
+            block, uncovered design element, OR over-complected smell. Never say
+            SPEC_COMPLETE if any task block falls short, any design element is uncovered,
+            OR the design smells over-complected.
+            DESIGN:\n\n{{design}}\n\nSPEC:\n\n{{effective}}
+        as: spec_audit
+      # ── spec-audit trichotomy (clean partition over the audit string; no depth/
+      #    open-question preconditions — those are SCOPE-only).
+      # PASS → advance.
+      - call: advance_fsm
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/tasks/T-") && endsWith(targs.file_path, ".md") && contains(spec_audit, "VERDICT: SPEC_COMPLETE")'
+        args:
+          event: spec_verified
+      # CONTENT-FAIL → warn (keyed POSITIVELY on INCOMPLETE, not !SPEC_COMPLETE — so an audit
+      # that could not run no longer masquerades as an incomplete spec).
+      - call: verdict
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/tasks/T-") && endsWith(targs.file_path, ".md") && contains(spec_audit, "VERDICT: INCOMPLETE")'
+        args:
+          level: warn
+          message: >-
+            Task spec incomplete — it stays at spec_authored (TaskCreate stays
+            BLOCKED) until every task block carries all 11 fields with real code (no
+            pseudocode). The AUTHOR content gate: finish task authoring before coding.
+            Audit:\n\n{{spec_audit}}
+      # AUDIT-UNAVAILABLE → BLOCK, no advance (stays spec_authored, re-armable). F0c fix.
+      - call: verdict
+        if: '(tool == "Write" || tool == "Edit") && contains(targs.file_path, "docs/tasks/T-") && endsWith(targs.file_path, ".md") && !contains(spec_audit, "VERDICT:")'
+        args:
+          level: block
+          message: >-
+            AUTHOR audit could not run (the reviewer subagent was unavailable — typically a
+            per-session spawn cap). This is NOT a content failure. Re-write the spec to re-trigger
+            the audit; if it persists, a FRESH session clears the spawn exhaustion. Do NOT
+            --no-verify or gate-off. Audit error:\n\n{{spec_audit}}
+  # ── SCOPE nudge: code-before-scope is a best-effort WARN (GF.3) ──────────────
+  # GF.3 (F4): demoted from a hard block to a best-effort NUDGE. The completeness
+  # burden moved to the OWNED BOUNDARY: GF.2's git pre-commit/pre-push hooks read the
+  # REAL staged diff and FAIL CLOSED — that is the guarantee. This in-session check is
+  # just fast early feedback before a Write/Edit; its path predicate (the src/∪packs/∪
+  # test/ substrings) stays best-effort by design (it does NOT need git-tracked-ness
+  # precision — GF.2 catches what it misses, incl. Bash-mediated writes [F3, an accepted
+  # limitation here: Bash writes are caught at the commit boundary, not by this nudge]).
+  - id: scope-before-code
+    process:
+      - call: tool_name
+        as: tool
+      - call: tool_args
+        as: targs
+      - call: read_fsm_state
+        as: st
+      - call: has_generated_spec
+        # GDC.1: this src/∪packs/∪test/ boundary is ALSO encoded in gate.ts
+        # PROTECTED_PREFIXES (the precise git-layer form) — a gate.test.ts drift
+        # pin keeps the two lists identical; change them together.
+        if: '(tool == "Write" || tool == "Edit") && (contains(targs.file_path, "src/") || contains(targs.file_path, "packs/") || contains(targs.file_path, "test/"))'
+        as: spec
+      # Same condition as before (incl. the GF.4 F7 spec_complete allow set), but WARN.
+      - call: verdict
+        if: '(tool == "Write" || tool == "Edit") && (contains(targs.file_path, "src/") || contains(targs.file_path, "packs/") || contains(targs.file_path, "test/")) && (spec.generated == false || (st != "spec_complete" && st != "tasks_loaded" && st != "phases_in_flight" && st != "phases_complete"))'
+        args:
+          level: warn
+          message: >-
+            NUDGE: scope before code. The SCOPE region looks incomplete (still pre-research,
+            or the active task has no spec-audited spec). Complete the pre-research artifact
+            AND activate a spec-audited task before coding. (This is a best-effort early
+            warning — the hard guarantee is the git pre-commit/pre-push gate, which blocks a
+            code commit/push that has not completed the flow.)
+  # ── verify-skip detector: the ONE closed opt-out token (GF.3) ────────────────
+  # The git gate (GF.2) is bypassable only by passing the verify-skipping flag to `git
+  # commit/push` (or `git commit -n`) — a single explicit opt-out (not a denylist over an
+  # open set), so it is a hard BLOCK. `git push -n` is --dry-run, NOT a verify-skip, so -n
+  # is matched for `commit` only. KNOWN LIMITATION (matching a shell string is imperfect):
+  # the flag literal appearing inside a `-m "…"` commit MESSAGE also matches → over-block.
+  # That direction is INTENTIONAL and safe for a bypass-detector: a false positive (an
+  # annoying block on a message that mentions the flag) beats a false negative (letting a
+  # real bypass through). Do NOT "fix" this by anchoring to flag position — that
+  # reintroduces a false negative on `git commit -m msg <flag>`.
+  - id: no-verify-block
+    process:
+      - call: tool_name
+        as: tool
+      - call: match_command
+        args:
+          pattern: '(?:\bgit\s+commit\b.*(?:--no-verify|\s-n\b))|(?:\bgit\s+push\b.*--no-verify)'
+          target: tool_args.command
+        as: skipping
+      - call: verdict
+        if: '(tool == "Bash") && skipping'
+        args:
+          level: block
+          message: >-
+            BLOCKED: --no-verify bypasses the opensquid git gate (pre-commit/pre-push). Do
+            not skip the flow gate. Complete the SCOPE→AUTHOR→7-phase flow, then commit/push
+            normally. Use --no-verify only with explicit user authorization.
+  # ── AUTHOR gate: no TaskCreate until the spec passed the audit (spec_complete) ─
+  - id: taskcreate-spec-required
+    process:
+      - call: tool_name
+        as: tool
+      - call: tool_args
+        as: targs
+      - call: read_fsm_state
+        as: st
+      # FU.3: the AUTHOR gate is profile-dependent. Read the track-type; a fix/doc/
+      # trivial track skips task-authoring it doesn't need. read_state(absent)→null,
+      # and null != "fix" is true (strict !==), so feature/unset/stale still FIRES —
+      # strictest default. SCOPE (scope-before-code) + EXECUTE (commit) stay universal.
+      - call: read_state
+        args:
+          key: coding-flow-track
+        as: track
+      - call: verdict
+        if: '(tool == "TaskCreate") && track != "fix" && track != "doc" && track != "trivial" && st != "spec_complete" && st != "tasks_loaded" && st != "phases_in_flight" && st != "phases_complete"'
+        args:
+          level: block
+          message: >-
+            BLOCKED: task authoring incomplete. The task spec must pass the 11-field +
+            real-code spec-audit (the AUTHOR content gate) before tasks are created —
+            a thin or pseudocode spec is not enough. Finish the spec, then create tasks.
+      - call: advance_fsm
+        if: '(tool == "TaskCreate" || tool == "TaskUpdate") && len(targs.metadata.taskId) > 0'
+        args:
+          event: tasks_loaded
+prose: |
+  The full tool_call lifecycle in one ordered skill: each region's advance is
+  immediately followed by its content audit (guess-audit after the research advance,
+  spec-audit after the spec advance) so the audit sees the just-advanced state — the
+  ordering the lifecycle relied on. Then the two region GATES (scope-before-code,
+  taskcreate-spec-required) read the resulting state. "Coding" is the gate profile
+  (src/∪packs/∪test/); the FSM is domain-general.

package/packs/builtin/coding-flow/skills/task-start/skill.yaml

@@ -0,0 +1,42 @@
+# task-start — the per-task flow-enforcement hook (FU.11). The coding-flow FSM is
+# session-level, so after one task reaches phases_complete the next task's code write
+# sees a post-researched state and scope-before-code waves it through. This re-arms
+# the flow at the work boundary: when a task is ACTIVATED (TaskUpdate in_progress)
+# with NO generated spec on disk, reset the FSM to scoping + nudge "scope first".
+# A scoped task is a no-op (the per-task phase ledger handles EXECUTE). The "start of
+# enforcement" the user asked for — keyed to the actual task, not always-on guesswork.
+# Spec: docs/tasks/T-fsm-unify.md FU.11; pre-research:
+# docs/research/T-task-start-enforcement-pre-research-2026-06-03.md.
+name: task-start
+load: preload
+when_to_load: []
+triggers:
+  - kind: tool_call
+rules:
+  - id: unscoped-task-rescopes
+    process:
+      - call: tool_name
+        as: tool
+      - call: tool_args
+        as: targs
+      - call: has_generated_spec
+        if: '(tool == "TaskUpdate") && targs.status == "in_progress"'
+        as: spec
+      # Reset to scoping: an active task with no generated spec = unscoped work.
+      # GF.1 (F9): the "scope first" NUDGE is NOT emitted here — a directive on a
+      # tool_call event is dropped by the dispatcher (only prompt_submit surfaces
+      # directives). The nudge now lives in entry-and-handoffs/handoff-rescope-nudge,
+      # which fires on the next prompt_submit while the FSM is in `scoping` (the state
+      # this reset lands in). This rule keeps ONLY the FSM reset.
+      - call: advance_fsm
+        if: '(tool == "TaskUpdate") && targs.status == "in_progress" && spec.present == true && spec.generated == false'
+        args:
+          event: task_unscoped
+prose: |
+  The task-start hook. Enforcement is STARTED at the work boundary (TaskUpdate
+  in_progress), keyed to whether the task is actually scoped (has_generated_spec) —
+  not assumed from whatever state the prior task left the session FSM in. An unscoped
+  task resets to scoping; the scope nudge then surfaces via entry-and-handoffs on the
+  next prompt_submit (a tool_call directive would be dropped). A scoped task proceeds
+  (its 7-phase ledger is fresh). This is the per-task reset that closes the "nothing
+  stops you when you start a task" hole.