overlord-cli 0.2608031719.0 → 0.2608061150.0

package/README.md

@@ -182,7 +182,7 @@ export OVERLORD_BACKEND_URL="https://overlord.example.com"
 export OVERLORD_USER_TOKEN="out_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
 
 # 4. Agent connector — write the local agent connector config (non-interactive).
-ovld agent-setup claude            # one of: claude | codex | cursor | pi | all
+ovld agent-setup claude            # one of: claude | codex | cursor | pi | antigravity | opencode | all
 ```
 
 Then verify the backend is reachable and authenticated:

package/dist/connectors/HARNESS-MATRIX.md

@@ -15,7 +15,7 @@ Legend: ✅ supported (fixture-proven) · ⛔ unsupported (harness cannot) ·
 | Adapter | Harness | Verified version | Shape | Tier | Binding | Decision hold |
 | --- | --- | --- | --- | --- | --- | --- |
 | [`antigravity`](adapters/antigravity/CAPABILITIES.md) | Antigravity CLI | — | `callback` | 0 (Unsupported) | ❓ unverified | ❓ unverified |
-| [`claude`](adapters/claude/CAPABILITIES.md) | Claude Code | `2.1.220` | `callback` | 3 (Conversational) | ✅ supported | ✅ supported |
+| [`claude`](adapters/claude/CAPABILITIES.md) | Claude Code | `2.1.221` | `callback` | 3 (Conversational) | ✅ supported | ✅ supported |
 | [`codex`](adapters/codex/CAPABILITIES.md) | Codex CLI | `0.146.0` | `callback` | 3 (Conversational) | ✅ supported | ✅ supported |
 | [`cursor`](adapters/cursor/CAPABILITIES.md) | Cursor Agent CLI | `2026.07.23-e383d2b` | `callback` | 0 (Unsupported) | ❓ unverified | ✅ supported |
 | [`opencode`](adapters/opencode/CAPABILITIES.md) | OpenCode | — | `controlPlane` | 3 (Conversational) | ✅ supported | ✅ supported |
@@ -25,10 +25,10 @@ Legend: ✅ supported (fixture-proven) · ⛔ unsupported (harness cannot) ·
 
 | Capability | `antigravity` | `claude` | `codex` | `cursor` | `opencode` | `pi` |
 | --- | --- | --- | --- | --- | --- | --- |
-| `observe.prompt` | ❓ unverified | ✅ supported | ✅ supported | 🚧 not-implemented | 🚧 not-implemented | ✅ supported |
-| `observe.toolCall` | ❓ unverified | 🚧 not-implemented | ✅ supported | 🚧 not-implemented | 🚧 not-implemented | ✅ supported |
-| `observe.toolResult` | ❓ unverified | ✅ supported | ✅ supported | 🚧 not-implemented | ✅ supported | 🚧 not-implemented |
-| `observe.fileEdit` | ❓ unverified | ✅ supported | ✅ supported | 🚧 not-implemented | ✅ supported | 🚧 not-implemented |
+| `observe.prompt` | ❓ unverified | ✅ supported | ✅ supported | ✅ supported | 🚧 not-implemented | ✅ supported |
+| `observe.toolCall` | ❓ unverified | 🚧 not-implemented | ✅ supported | ✅ supported | 🚧 not-implemented | ✅ supported |
+| `observe.toolResult` | ❓ unverified | ✅ supported | ✅ supported | ✅ supported | ✅ supported | 🚧 not-implemented |
+| `observe.fileEdit` | ❓ unverified | ✅ supported | ✅ supported | ✅ supported | ✅ supported | 🚧 not-implemented |
 | `observe.sessionLifecycle` | ❓ unverified | ✅ supported | ✅ supported | 🚧 not-implemented | ✅ supported | ✅ supported |
 | `decide.shell` | ❓ unverified | ✅ supported | ✅ supported | ✅ supported | ✅ supported | ✅ supported |
 | `decide.mcp` | ❓ unverified | ✅ supported | ✅ supported | ✅ supported | ✅ supported | ✅ supported |
@@ -52,6 +52,9 @@ Legend: ✅ supported (fixture-proven) · ⛔ unsupported (harness cannot) ·
 | `claude` | `shipped-stop-hook-inert` | medium | verified | required | `agent-session-phase-3` |
 | `claude` | `unbound-session-side-effects` | medium | verified | required | `agent-session-phase-4` |
 | `claude` | `fork-and-subagent-identity-unknown` | medium | unverified | required | `taxonomy-7.6` |
+| `claude` | `subagent-stop-unregistered` | medium | verified | required | `coo:585` |
+| `claude` | `subagent-commits-escape-delivery-delta` | high | verified | required | `coo:585` |
+| `codex` | `prompt-and-agent-hook-handlers-inert` | low | verified | accepted | — |
 | `codex` | `hooks-version-and-platform-gate` | medium | verified | required | `agent-session-phase-4` |
 | `cursor` | `reads-claude-hook-config` | high | unverified | required | `taxonomy-7.1` |
 | `cursor` | `allowlist-precedence` | medium | unverified | required | `taxonomy-7.8` |

package/dist/connectors/README.md

@@ -24,7 +24,7 @@ OpenCode, Antigravity, and others). A connector is what lets an agent speak the
 Install or refresh a connector with:
 
 ```bash
-ovld agent-setup <agent>    # claude | codex | cursor | pi | all
+ovld agent-setup <agent>    # claude | codex | cursor | pi | antigravity | opencode | all
 ovld doctor                 # verify managed files and permissions
 ```
 
@@ -38,6 +38,8 @@ connector contract version changes.
 - [Codex](adapters/codex/README.md): Codex plugin with hooks, MCP bridge, and permission warmup.
 - [Cursor](adapters/cursor/README.md): Cursor plugin with slash commands, hooks, rules, and MCP bridge.
 - [PI](adapters/pi/README.md): PI Agent skill and extension with follow-up capture and native-session resume.
+- [Antigravity](adapters/antigravity/README.md): Antigravity plugin exposing the local mission workflow to Antigravity CLI/IDE sessions.
+- [OpenCode](adapters/opencode/README.md): control-plane connector (Shape C) driven by `ovld agent-session sidecar` — no hook scripts.
 
 ### Extension point
 

package/dist/connectors/VERSION

@@ -1 +1 @@
-0.3.17
+0.3.18

package/dist/connectors/adapters/antigravity/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://antigravity.google/schemas/v1/plugin.json",
   "name": "overlord",
-  "version": "0.3.17",
+  "version": "0.3.18",
   "description": "Chat-driven access to Overlord mission protocol workflows with hook-driven activity capture.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord",
-  "version": "0.3.17",
+  "version": "0.3.18",
   "description": "Overlord mission protocol workflow for Claude Code — attach/update/ask/deliver, slash commands, and hook-driven activity capture.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/claude/CAPABILITIES.md

@@ -4,9 +4,9 @@
 
 **Adapter** `claude` · **Codec** `claude` · **Integration shape** `callback` · **Capability tier** 3 (Conversational)
 
-**Harness version verified** `2.1.220` · **range** `>=2.1.0` · **scheme** `semver`
+**Harness version verified** `2.1.221` · **range** `>=2.1.0` · **scheme** `semver`
 
-**Descriptor digest** `58131e0daccf7382cada7d456bfb6ca38e6da8adefe065e4c053028f0c3d8aec`
+**Descriptor digest** `a90745bb59252df29006cf632a030108e68fde84f956910e02cc842833e6f8d6`
 
 > The tier is derived from passing fixtures, never authored. `unsupported` means the harness
 > cannot do it — do not attempt it. `not-implemented` means it is buildable and unbuilt: that is
@@ -83,14 +83,20 @@ Per-command `timeout` in seconds with no documented ceiling. Omitting `decision`
 | `shipped-stop-hook-inert` | medium | verified | required | `agent-session-phase-3` |
 | `unbound-session-side-effects` | medium | verified | required | `agent-session-phase-4` |
 | `fork-and-subagent-identity-unknown` | medium | unverified | required | `taxonomy-7.6` |
+| `subagent-stop-unregistered` | medium | verified | required | `coo:585` |
+| `subagent-commits-escape-delivery-delta` | high | verified | required | `coo:585` |
 
 **`shipped-permission-hook-inert`** — The installed PermissionRequest hook calls a `ovld protocol permission-request` subcommand that does not exist, backgrounds the call with `) & disown`, and is gated on a MISSION_ID environment variable launched sessions do not always set. It records nothing and, being backgrounded with stdout discarded, is structurally incapable of returning a decision. The shipped conformance `permissionHook` flag therefore overstates what happens today.
 
-**`shipped-stop-hook-inert`** — The installed Stop hook calls `ovld protocol hook-event --hook-type Stop`, which the CLI rejects, and then parses a `deliveryStatus` field nothing produces. Its mission-link footer still works.
+**`shipped-stop-hook-inert`** — The installed Stop hook calls `ovld protocol hook-event --hook-type Stop`, which the CLI rejects, and then parses a `deliveryStatus` field nothing produces. Its mission-link footer still works. Confirmed again at 2.1.221 from a live agent-pod session: every entry in ~/.ovld/logs/stop-hook.log takes the `no launch mission id` branch and returns before the delivery check, because the hook gates on a `MISSION_ID` environment variable the pod does not set. The PostToolUse hook works in the same session because it resolves the mission from the per-cwd active-session manifest instead; the Stop hook should resolve it the same way.
 
 **`unbound-session-side-effects`** — NARROWED, NOT CLOSED. The new agent-session registrations gate in bash on OVERLORD_SESSION_CHANNEL_ID before spawning anything, so they are completely silent in an unbound session (proved by fixtures/agent-session-hook-unbound.json). The LEGACY PostToolUse hook still spawns `ovld protocol record-touched` and appends to ~/.ovld/logs in every session on the machine, because its scope gate lives inside the CLI rather than before the spawn (proved by fixtures/unbound-session.json). It stays installed on purpose: it is what feeds touched-file change attribution at deliver time, and removing it before the normalized path has demonstrated equivalent attribution would trade a privacy nit for a data-loss bug. Closing this means retiring the legacy hook, which is a migration, not a patch.
 
-**`fork-and-subagent-identity-unknown`** — Whether an in-process fork mints a new native session id, and whether subagent tool calls carry the parent's id, are both unverified. Guessing either routes a session's requests to the wrong mission.
+**`fork-and-subagent-identity-unknown`** — Whether an in-process fork mints a new native session id, and whether subagent tool calls carry the parent's id, are both unverified. Guessing either routes a session's requests to the wrong mission. Partially narrowed at 2.1.221: the binary carries distinct `SubagentStart` and `SubagentStop` hook events, converts an agent-frontmatter `Stop` registration into `SubagentStop` ("subagents trigger SubagentStop"), and records `parent_session_id` and `agent_type` as separate fields from `session_id`. That the harness distinguishes the two identities is now established; which value lands in a subagent hook payload's `session_id` is still not, and that is the part binding depends on. Read it from a real subagent payload before changing any binding code.
+
+**`subagent-stop-unregistered`** — The adapter registers `Stop` and no subagent-lifecycle event. Claude Code 2.1.221 fires `SubagentStop` — not `Stop` — when a subagent finishes, and subagents now run in the background past the parent's turn boundary, so the shipped Stop registration is guaranteed not to run for work a subagent completes after the parent stopped. Nothing is lost today because that registration is already inert (see `shipped-stop-hook-inert`), which is exactly why the fix is to repair the Stop path first and only then decide whether the repaired body should also ride `SubagentStop`. Registering the current inert script on a second event would add a spawn per subagent completion and buy nothing.
+
+**`subagent-commits-escape-delivery-delta`** — Delivery change attribution is computed from `git status --porcelain` against the attach baseline (cli/src/vcs.ts `readChangedFiles` / `filterRunAttributableChanges`); nothing in that path consults HEAD or the commit graph. A background subagent that commits, merges, or opens a PR for its own work therefore removes those files from the worktree delta, and they vanish from the delivery report entirely — not flagged, not skipped, silently absent. The PostToolUse touched-files log is unaffected (its key is `sha256(abspath(cwd) + "\0" + MISSION_ID)`, so a subagent sharing the cwd writes to the same log), which means the evidence that the edit happened survives while the delta that decides coverage does not. Closing this means teaching the delta about commits made since the baseline, which is a CLI change with branch and worktree semantics to settle, not a hook edit.
 
 ## Native decision shape
 

package/dist/connectors/adapters/claude/conformance-manifest.yaml

@@ -15,7 +15,7 @@ connector:
   harnessCapabilities:
     path: connectors/adapters/claude/harness-capabilities.yaml
     schemaVersion: 1
-    digest: "58131e0daccf7382cada7d456bfb6ca38e6da8adefe065e4c053028f0c3d8aec"
+    digest: "a90745bb59252df29006cf632a030108e68fde84f956910e02cc842833e6f8d6"
   capabilities:
     - followUpHook
     - permissionHook

package/dist/connectors/adapters/claude/harness-capabilities.yaml

@@ -14,7 +14,7 @@ decisionCodecSpec: codec/claude.decision-codec.yaml
 
 harness:
   name: Claude Code
-  verifiedVersion: '2.1.220'
+  verifiedVersion: '2.1.221'
   versionRange: '>=2.1.0'
   versionScheme: semver
 
@@ -184,7 +184,12 @@ hazards:
     summary: >-
       The installed Stop hook calls `ovld protocol hook-event --hook-type Stop`, which the CLI
       rejects, and then parses a `deliveryStatus` field nothing produces. Its mission-link
-      footer still works.
+      footer still works. Confirmed again at 2.1.221 from a live agent-pod session: every entry
+      in ~/.ovld/logs/stop-hook.log takes the `no launch mission id` branch and returns before
+      the delivery check, because the hook gates on a `MISSION_ID` environment variable the pod
+      does not set. The PostToolUse hook works in the same session because it resolves the
+      mission from the per-cwd active-session manifest instead; the Stop hook should resolve it
+      the same way.
     verification: verified
     mitigation: required
     trackedAs: agent-session-phase-3
@@ -210,10 +215,48 @@ hazards:
     summary: >-
       Whether an in-process fork mints a new native session id, and whether subagent tool
       calls carry the parent's id, are both unverified. Guessing either routes a session's
-      requests to the wrong mission.
+      requests to the wrong mission. Partially narrowed at 2.1.221: the binary carries
+      distinct `SubagentStart` and `SubagentStop` hook events, converts an agent-frontmatter
+      `Stop` registration into `SubagentStop` ("subagents trigger SubagentStop"), and records
+      `parent_session_id` and `agent_type` as separate fields from `session_id`. That the
+      harness distinguishes the two identities is now established; which value lands in a
+      subagent hook payload's `session_id` is still not, and that is the part binding depends
+      on. Read it from a real subagent payload before changing any binding code.
     verification: unverified
     mitigation: required
     trackedAs: taxonomy-7.6
+  - id: subagent-stop-unregistered
+    severity: medium
+    summary: >-
+      The adapter registers `Stop` and no subagent-lifecycle event. Claude Code 2.1.221 fires
+      `SubagentStop` — not `Stop` — when a subagent finishes, and subagents now run in the
+      background past the parent's turn boundary, so the shipped Stop registration is
+      guaranteed not to run for work a subagent completes after the parent stopped. Nothing is
+      lost today because that registration is already inert (see `shipped-stop-hook-inert`),
+      which is exactly why the fix is to repair the Stop path first and only then decide
+      whether the repaired body should also ride `SubagentStop`. Registering the current
+      inert script on a second event would add a spawn per subagent completion and buy
+      nothing.
+    verification: verified
+    mitigation: required
+    trackedAs: coo:585
+  - id: subagent-commits-escape-delivery-delta
+    severity: high
+    summary: >-
+      Delivery change attribution is computed from `git status --porcelain` against the attach
+      baseline (cli/src/vcs.ts `readChangedFiles` / `filterRunAttributableChanges`); nothing in
+      that path consults HEAD or the commit graph. A background subagent that commits, merges,
+      or opens a PR for its own work therefore removes those files from the worktree delta, and
+      they vanish from the delivery report entirely — not flagged, not skipped, silently
+      absent. The PostToolUse touched-files log is unaffected (its key is
+      `sha256(abspath(cwd) + "\0" + MISSION_ID)`, so a subagent sharing the cwd writes to the
+      same log), which means the evidence that the edit happened survives while the delta that
+      decides coverage does not. Closing this means teaching the delta about commits made since
+      the baseline, which is a CLI change with branch and worktree semantics to settle, not a
+      hook edit.
+    verification: verified
+    mitigation: required
+    trackedAs: coo:585
 
 decisionShape:
   codec: claude

package/dist/connectors/adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord",
-  "version": "0.3.17",
+  "version": "0.3.18",
   "description": "Chat-driven access to Overlord mission protocol workflows with hook-driven activity capture.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/codex/CAPABILITIES.md

@@ -6,7 +6,7 @@
 
 **Harness version verified** `0.146.0` · **range** `>=0.124.0` · **scheme** `semver`
 
-**Descriptor digest** `c8cb9aabe2beac3777c5f565241079f068a4672509e427c760813e2341a0ed78`
+**Descriptor digest** `ad12a2a5006966b0d00f074290a6d8d2396c23343305fb8504d6d489313dacc7`
 
 > The tier is derived from passing fixtures, never authored. `unsupported` means the harness
 > cannot do it — do not attempt it. `not-implemented` means it is buildable and unbuilt: that is
@@ -64,6 +64,8 @@ Per-hook timeouts in seconds; the documentation gives a 600-second default. The
 
 ### Capability notes
 
+- **`observe.toolCall`** — PreToolUse fires for MCP tool calls, not only shell and patch tools. Re-verified against the installed 0.146.0 binary and the matching upstream tag: the upstream suite `hooks_mcp.rs` (under codex-rs/core/tests/suite) proves a PreToolUse hook can both deny and rewrite an MCP call before it executes, and the binary carries a distinct "Tool call blocked by PreToolUse hook: {}. Tool: {}" message alongside the shell-only one. `tool_name` is the full MCP identifier (`mcp__<server>__<tool>`) and the matcher matches that string, so a matcher written for a bare tool name will silently never fire.
+- **`observe.toolResult`** — Also covers MCP tool results, on the same 0.146.0 evidence as `observe.toolCall`. What PostToolUse cannot do is rewrite one: the binary rejects a returned `updatedMCPToolOutput` as unsupported. Observation of an MCP result is therefore reliable; mutation of it is not.
 - **`decide.universal`** — Codex PermissionRequest covers Bash, apply_patch/Edit/Write, and MCP tool names. The codec emits only documented allow/deny behavior and deliberately never emits reserved `updatedInput`, `updatedPermissions`, or `interrupt` fields.
 - **`answer.structuredQuestion`** — `codex app-server` exposes ToolRequestUserInput with per-option label/description and an autoResolutionMs — an ACP-shaped structured question in everything but name. It is unreachable until the single-subscriber question is settled.
 - **`inject.midTurn`** — ThreadInjectItems/TurnSteer exist on the experimental app-server surface only. The binary carries "expected exactly one client subscribed to the thread, found {}", so if the TUI is that one client Overlord cannot also subscribe and this path is closed.
@@ -74,12 +76,15 @@ Per-hook timeouts in seconds; the documentation gives a 600-second default. The
 | --- | --- | --- | --- | --- |
 | `two-integration-surfaces-could-disagree` | high | verified | implemented | fixture `fixtures/agent-session-hooks.json` |
 | `shipped-permission-hook-inert` | high | verified | implemented | fixture `fixtures/agent-session-hooks.json` |
+| `prompt-and-agent-hook-handlers-inert` | low | verified | accepted | — |
 | `hooks-version-and-platform-gate` | medium | verified | required | `agent-session-phase-4` |
 
 **`two-integration-surfaces-could-disagree`** — Hooks and `codex app-server` can both answer a permission. A session driven by both would race in a way no revision CAS can settle, so exactly one surface must be chosen and documented before either is built.
 
 **`shipped-permission-hook-inert`** — The former PermissionRequest hook called a nonexistent protocol command in the background. The managed registration now invokes the fixed request runtime directly.
 
+**`prompt-and-agent-hook-handlers-inert`** — Codex 0.146.0 accepts three hook handler types — `command`, `prompt`, and `agent` — but only `command` runs. Hook discovery parses `prompt` and `agent` and then skips them with a "not supported yet" warning, so a manifest that used either would install cleanly, list in `hooks`, and never execute. The connector must keep emitting `command` handlers only, and must not read the presence of these variants in the schema as availability. `command` is a shell command line run through `$SHELL -lc` (`/bin/sh` when SHELL is unset) — it is not restricted to Bash and not restricted to shell scripting, since the command may invoke any interpreter.
+
 **`hooks-version-and-platform-gate`** — Hooks were experimental behind `features.codex_hooks` before v0.124. The connector requires Codex >=0.124; installations outside that range must be treated as unavailable.
 
 ## Native decision shape
@@ -90,7 +95,7 @@ Per-hook timeouts in seconds; the documentation gives a 600-second default. The
 - **Deny fixture** `fixtures/decision-codec.json`
 - **Defer fixture** `fixtures/decision-codec.json`
 
-PermissionRequest accepts the documented hookSpecificOutput decision.behavior allow/deny shape. `ask` remains a deliberate no-output defer so Codex shows its own approval prompt. The adapter never emits updatedInput, updatedPermissions, or interrupt.
+PermissionRequest accepts the documented hookSpecificOutput decision.behavior allow/deny shape. `ask` remains a deliberate no-output defer so Codex shows its own approval prompt. The adapter never emits updatedInput, updatedPermissions, or interrupt. The reserved list is not symmetric across events at 0.146.0: PermissionRequest rejects `updatedInput` as unsupported, while PreToolUse accepts it together with `permissionDecision: "allow"` and will rewrite the call. Keeping `updatedInput` on `neverSend` stays a deliberate policy choice — silently editing a tool call a user approved is not a decision Overlord should make — and not an inference about what the harness can do.
 
 ## Unbound-session negative test
 

package/dist/connectors/adapters/codex/conformance-manifest.yaml

@@ -15,7 +15,7 @@ connector:
   harnessCapabilities:
     path: connectors/adapters/codex/harness-capabilities.yaml
     schemaVersion: 1
-    digest: "c8cb9aabe2beac3777c5f565241079f068a4672509e427c760813e2341a0ed78"
+    digest: "ad12a2a5006966b0d00f074290a6d8d2396c23343305fb8504d6d489313dacc7"
   capabilities:
     - followUpHook
     - permissionHook

package/dist/connectors/adapters/codex/harness-capabilities.yaml

@@ -52,10 +52,23 @@ capabilities:
     status: supported
     native: PreToolUse
     fixtures: [fixtures/normalize-pre-tool-use.json]
+    notes: >-
+      PreToolUse fires for MCP tool calls, not only shell and patch tools. Re-verified against
+      the installed 0.146.0 binary and the matching upstream tag: the upstream suite
+      `hooks_mcp.rs` (under codex-rs/core/tests/suite) proves a PreToolUse hook can both deny
+      and rewrite an MCP call before it executes, and the binary carries a distinct
+      "Tool call blocked by PreToolUse hook: {}.
+      Tool: {}" message alongside the shell-only one. `tool_name` is the full MCP identifier
+      (`mcp__<server>__<tool>`) and the matcher matches that string, so a matcher written for a
+      bare tool name will silently never fire.
   observe.toolResult:
     status: supported
     native: PostToolUse
     fixtures: [fixtures/normalize-post-tool-use.json]
+    notes: >-
+      Also covers MCP tool results, on the same 0.146.0 evidence as `observe.toolCall`. What
+      PostToolUse cannot do is rewrite one: the binary rejects a returned `updatedMCPToolOutput`
+      as unsupported. Observation of an MCP result is therefore reliable; mutation of it is not.
   observe.fileEdit:
     status: supported
     native: PostToolUse
@@ -144,6 +157,19 @@ hazards:
     verification: verified
     mitigation: implemented
     fixture: fixtures/agent-session-hooks.json
+  - id: prompt-and-agent-hook-handlers-inert
+    severity: low
+    summary: >-
+      Codex 0.146.0 accepts three hook handler types — `command`, `prompt`, and `agent` — but
+      only `command` runs. Hook discovery parses `prompt` and `agent` and then skips them with
+      a "not supported yet" warning, so a manifest that used either would install cleanly,
+      list in `hooks`, and never execute. The connector must keep emitting `command` handlers
+      only, and must not read the presence of these variants in the schema as availability.
+      `command` is a shell command line run through `$SHELL -lc` (`/bin/sh` when SHELL is
+      unset) — it is not restricted to Bash and not restricted to shell scripting, since the
+      command may invoke any interpreter.
+    verification: verified
+    mitigation: accepted
   - id: hooks-version-and-platform-gate
     severity: medium
     summary: >-
@@ -162,7 +188,12 @@ decisionShape:
   notes: >-
     PermissionRequest accepts the documented hookSpecificOutput decision.behavior allow/deny
     shape. `ask` remains a deliberate no-output defer so Codex shows its own approval prompt.
-    The adapter never emits updatedInput, updatedPermissions, or interrupt.
+    The adapter never emits updatedInput, updatedPermissions, or interrupt. The reserved list
+    is not symmetric across events at 0.146.0: PermissionRequest rejects `updatedInput` as
+    unsupported, while PreToolUse accepts it together with `permissionDecision: "allow"` and
+    will rewrite the call. Keeping `updatedInput` on `neverSend` stays a deliberate policy
+    choice — silently editing a tool call a user approved is not a decision Overlord should
+    make — and not an inference about what the harness can do.
 
 unboundSessionFixture: fixtures/unbound-session.json
 

package/dist/connectors/adapters/cursor/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord",
-  "version": "0.3.17",
+  "version": "0.3.18",
   "description": "Overlord mission protocol workflow for Cursor — attach/update/ask/deliver, slash commands, MCP bridge, and follow-up capture.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/cursor/CAPABILITIES.md

@@ -6,7 +6,7 @@
 
 **Harness version verified** `2026.07.23-e383d2b` · **range** `>=2026.07.01` · **scheme** `calendar`
 
-**Descriptor digest** `5241e4ab23c78af568a9cb06faa78486722bb21b34c96fa8589da02653e1a390`
+**Descriptor digest** `4f6c4bb7a8c3637a6fc3ddd31e0ea98c8fd354badbb61117c3263561ec17ff74`
 
 > The tier is derived from passing fixtures, never authored. `unsupported` means the harness
 > cannot do it — do not attempt it. `not-implemented` means it is buildable and unbuilt: that is
@@ -24,6 +24,7 @@
 | Evidence | tracked as `agent-session-verify-cursor-binding` |
 
 Hook input carries `conversation_id` and an optional `session_id`. Which of the two is stable across a resumed conversation, and whether either appears in the environment of a tool subprocess, were not established. Binding on the wrong one silently misattributes a session, so this must be settled by fixture before the adapter binds on it.
+This is now the *only* thing holding Cursor at tier 0. Four `observe.*` capabilities and three `decide.*` capabilities are fixture-proven, and `inject.turnBoundary` with them — enough for tier 3 on every axis the tier derivation reads except this one. Recording a real Cursor hook payload across a resume, and flipping this node, is therefore a single-session piece of work with a three-tier payoff, not an incremental improvement. Note that the shipped prompt hook and `codec/cursor.codec.yaml` both already treat `conversation_id` as the primary identity; if the recorded evidence says `session_id` is the stable one, both must change together or one session splits into two.
 
 The native session id is a **correlation alias only**. Authorization and mission scope come
 from the verified channel/session credential; neither the working directory nor an unverified
@@ -45,10 +46,10 @@ The 60-second per-script default is an order of magnitude below any window sized
 
 | Capability | Status | Native | Evidence |
 | --- | --- | --- | --- |
-| `observe.prompt` | 🚧 not-implemented | `beforeSubmitPrompt` | tracked as `agent-session-phase-1` |
-| `observe.toolCall` | 🚧 not-implemented | `preToolUse` | tracked as `agent-session-phase-1` |
-| `observe.toolResult` | 🚧 not-implemented | `postToolUse` | tracked as `agent-session-phase-1` |
-| `observe.fileEdit` | 🚧 not-implemented | `afterFileEdit` | tracked as `agent-session-phase-1` |
+| `observe.prompt` | ✅ supported | `beforeSubmitPrompt` | fixtures: `fixtures/normalize-before-submit-prompt.json` |
+| `observe.toolCall` | ✅ supported | `preToolUse` | fixtures: `fixtures/normalize-pre-tool-use-shell.json` |
+| `observe.toolResult` | ✅ supported | `postToolUse` | fixtures: `fixtures/normalize-post-tool-use-write.json` |
+| `observe.fileEdit` | ✅ supported | `postToolUse` | fixtures: `fixtures/normalize-post-tool-use-write.json` |
 | `observe.sessionLifecycle` | 🚧 not-implemented | `sessionStart` | tracked as `agent-session-phase-1` |
 | `decide.shell` | ✅ supported | `beforeShellExecution` | fixtures: `fixtures/permission-request.json`, `fixtures/decision-codec.json` |
 | `decide.mcp` | ✅ supported | `beforeMCPExecution` | fixtures: `fixtures/permission-request.json`, `fixtures/decision-codec.json` |
@@ -65,6 +66,9 @@ The 60-second per-script default is an order of magnitude below any window sized
 
 ### Capability notes
 
+- **`observe.toolCall`** — preToolUse carries both an observational and a decision registration, rendered as two different action scripts (`event` and `request`). The observational one cannot allow, deny, or delay a call — the action is fixed at install time, so neither registration can become the other.
+- **`observe.fileEdit`** — Carried on postToolUse rather than on Cursor's dedicated `afterFileEdit`, for the same reason Claude carries it on PostToolUse: one registration then covers every mutation, including the ones a shell command makes, and the split into `file.edited` happens where the normalized tool name is already known. `afterFileEdit` remains available if a future need appears for edit-level granularity the tool-level event cannot express.
+- **`observe.sessionLifecycle`** — Cursor fires the event, but no shipped code in this repo has ever read one of its payloads, so the field carrying the equivalent of Claude's `source` is unknown. A codec rule on a guessed path would not fail loudly — an unresolved path yields a card with no detail — so this stays unbuilt until a real payload is recorded, rather than being claimed on an assumed field name.
 - **`inject.turnBoundary`** — `stop` returns `followup_message`, a first-class continuation channel. It can only ever report Queued(turn-boundary), never Delivered, and the UI must say so.
 - **`inject.nextTurn`** — Cursor's followup_message is scheduled for the next turn; the same path covers turn-boundary and next-turn naming.
 - **`terminal.statusSurface`** — Whether Cursor exposes an in-TUI status surface equivalent to Claude's statusMessage was not established.

package/dist/connectors/adapters/cursor/README.md

@@ -29,7 +29,7 @@ From an OpenOverlord checkout:
 ovld agent-setup cursor
 ```
 
-This copies managed plugin files to `~/.cursor/plugins/local/overlord`, merges Overlord's prompt, permission, tool-result, and stop hooks into `~/.cursor/hooks.json`, and adds a `Shell(ovld protocol:*)` permission allow rule to `~/.cursor/settings.json` when missing. Existing hooks and settings are preserved.
+This copies managed plugin files to `~/.cursor/plugins/local/overlord`, merges Overlord's prompt, permission, tool-call, tool-result, agent-session observation, and stop hooks into `~/.cursor/hooks.json`, and adds a `Shell(ovld protocol:*)` permission allow rule to `~/.cursor/settings.json` when missing. Existing hooks and settings are preserved.
 
 Re-run safely any time the connector contract version changes:
 
@@ -82,6 +82,7 @@ This connector is intentionally reviewable against the four connector layers in
   Cursor keeps its native authority.
 - `hooks/overlord-post-tool-use.sh` — records `postToolUse` file edits and shell-mediated changes for exact per-session delivery attribution.
 - `hooks/overlord-stop.sh` — checks pending delivery through `ovld protocol hook-event`; when needed, it asks Cursor to continue once so the agent can finish delivery.
+- `scripts/agent-session-event.sh` — **generated**, like the MCP shim: rendered from `connectors/core/scripts/agent-session-hook.sh` with the adapter key and the fixed `event` action substituted at setup time. Registered on `beforeSubmitPrompt`, `preToolUse`, and `postToolUse`, it publishes normalized activity events on the session channel through `codec/cursor.codec.yaml`. It is a separate registration from the protocol hooks above rather than a line added to them, because those speak the older `ovld protocol` surface, and because the scope gate that makes an unbound session cost nothing has to be the script's own first line. `sessionStart` is deliberately unregistered: no recorded Cursor payload establishes its field names, and a codec rule on a guessed path degrades silently rather than failing.
 - `rules/overlord-local.mdc` — always-on workflow rules for Cursor sessions.
 - `mcp.json` + `scripts/overlord-mcp.mjs` — MCP bridge to common `ovld protocol` operations. The shim is **generated**: it is rendered from `connectors/core/scripts/overlord-mcp.mjs` at setup time with the adapter key substituted, and there is no copy in this directory to edit.
 - `conformance-manifest.yaml` — connector conformance declaration for the Overlord contract.
@@ -96,4 +97,4 @@ The shared Connector Core source lives at `connectors/core/overlord-mission`. `o
 
 See the [adapter capability matrix](../../README.md#adapter-capability-matrix) for how this compares across adapters.
 
-Cursor's generic `preToolUse` hook is intentionally not used for permission capture. Cursor currently documents that `ask` is not enforced for `preToolUse`; the narrower shell and MCP hooks expose the native permission-decision schema without changing the user's policy. Cursor also documents hook execution as fail-open by default, so Overlord telemetry failures do not strand the agent.
+Cursor's generic `preToolUse` hook is intentionally not used for *permission capture* — it is registered for observation only, which is a different action script and cannot allow, deny, or delay a call. Cursor currently documents that `ask` is not enforced for `preToolUse`; the narrower shell and MCP hooks expose the native permission-decision schema without changing the user's policy. Cursor also documents hook execution as fail-open by default, so Overlord telemetry failures do not strand the agent.

package/dist/connectors/adapters/cursor/codec/cursor.codec.yaml

@@ -0,0 +1,71 @@
+# Cursor Agent CLI — agent-session event codec.
+#
+# Cursor already had a *decision* codec (`cursor.decision-codec.yaml`) and no event codec, which
+# is the whole reason every `observe.*` capability read `not-implemented`: the adapter could hold
+# and answer a permission request, but nothing it saw ever reached the activity feed.
+#
+# Field names here are not guessed. Each one is already load-bearing somewhere in the shipped
+# adapter, which is the only evidence standard that survives not being able to run the harness:
+#
+#   `hook_event_name` / `event`  — both declared in cursor.decision-codec.yaml
+#   `cwd`                        — same
+#   `tool_name`, `tool_input`    — same (preToolUse), and `tool_input.file_path` is what the
+#                                  shipped postToolUse hook feeds to `ovld protocol record-touched`
+#   `prompt` (then `message`)    — read by hooks/overlord-user-prompt-submit.sh
+#   `conversation_id`            — read by the same hook, and persisted as the native session alias
+#
+# `sessionStart` is deliberately absent. Cursor has the event, but no shipped code in this repo
+# has ever read one of its payloads, so its `source`-equivalent field name is unknown. Declaring
+# a rule on a guessed field would not fail loudly — an unresolved path just produces a card with
+# no detail — so `observe.sessionLifecycle` stays `not-implemented` until a real payload is read.
+codecVersion: 1
+adapter: cursor
+
+# Cursor is the adapter that forced the plural form: `hook_event_name` is its Claude-compatible
+# name and `event` its own. Order matters only in that the first non-empty one wins; both are
+# treated as the same authority.
+eventNamePaths:
+  - hook_event_name
+  - event
+
+# Correlation only. `conversation_id` is the id the shipped prompt hook already persists as this
+# session's external alias, so using anything else here would split one conversation across two
+# identities. Neither value authorizes anything — the channel credential does.
+nativeSessionPaths:
+  - conversation_id
+  - session_id
+
+# Used solely to relativize file paths, so a card can say `src/app.ts` rather than disclose
+# someone's home directory layout.
+projectRootPaths:
+  - cwd
+
+events:
+  # Cursor's composer prompt. Same deliberate exception as every other adapter: prompt text is
+  # the one raw user content that flows, because showing follow-up prompts is what the activity
+  # feed is for. Secret redaction still runs over it.
+  - native: beforeSubmitPrompt
+    kind: prompt.submitted
+    origin: user
+    promptPath: prompt
+
+  # Fires before the call runs. This rule is observational only — the decision path for the same
+  # event lives in cursor.decision-codec.yaml and is reached through a different action script,
+  # so nothing here can allow, deny, or delay a tool call.
+  - native: preToolUse
+    kind: tool.called
+    origin: agent
+    toolPath: tool_name
+    inputPath: tool_input
+    callIdPath: call_id
+
+  # Fires after the tool has already run, which makes it observational by construction. A
+  # file-mutating tool becomes `file.edited` instead, so the feed can render a change timeline
+  # without the reader having to know which Cursor tool names mutate files.
+  - native: postToolUse
+    kind: tool.completed
+    origin: agent
+    toolPath: tool_name
+    inputPath: tool_input
+    callIdPath: call_id
+    fileEditKind: file.edited

package/dist/connectors/adapters/cursor/conformance-manifest.yaml

@@ -15,7 +15,7 @@ connector:
   harnessCapabilities:
     path: connectors/adapters/cursor/harness-capabilities.yaml
     schemaVersion: 1
-    digest: "5241e4ab23c78af568a9cb06faa78486722bb21b34c96fa8589da02653e1a390"
+    digest: "4f6c4bb7a8c3637a6fc3ddd31e0ea98c8fd354badbb61117c3263561ec17ff74"
   capabilities:
     - followUpHook
     - stopHook
@@ -47,6 +47,7 @@ connector:
     - "hooks/overlord-permission-request.sh"
     - "hooks/overlord-post-tool-use.sh"
     - "hooks/overlord-stop.sh"
+    - "scripts/agent-session-event.sh"
     - "mcp.json"
     - "prompt-wrapper.md"
     - "rules/overlord-local.mdc"

package/dist/connectors/adapters/cursor/fixtures/normalize-before-submit-prompt.json

@@ -0,0 +1,31 @@
+{
+  "fixtureVersion": 1,
+  "kind": "normalized-event",
+  "description": "A Cursor beforeSubmitPrompt body. Proves observe.prompt: the composer prompt becomes prompt.submitted correlated to conversation_id, and the credential pasted into the prompt is redacted before the text is persisted. It also pins the `hook_event_name` spelling of the event name.",
+  "codec": "codec/cursor.codec.yaml",
+  "occurredAt": "2026-01-01T00:00:00.000Z",
+  "payload": {
+    "conversation_id": "conv_7f3a91c2",
+    "hook_event_name": "beforeSubmitPrompt",
+    "cwd": "/repo",
+    "prompt": "Re-run the migration against staging, my token is out_live_9f3ab21c7d"
+  },
+  "expect": {
+    "eventId": "ev_735b2ab46b295c9b6fbde04faa4ce9cf",
+    "producerSequence": null,
+    "occurredAt": "2026-01-01T00:00:00.000Z",
+    "kind": "prompt.submitted",
+    "severity": "info",
+    "nativeEvent": "beforeSubmitPrompt",
+    "nativeTurnId": null,
+    "nativeCallId": null,
+    "subagentId": null,
+    "correlationId": "conv_7f3a91c2",
+    "origin": "user",
+    "summary": "Re-run the migration against staging, my token is [redacted]",
+    "payload": {
+      "promptText": "Re-run the migration against staging, my token is [redacted]"
+    }
+  },
+  "mustNotContain": ["out_live_9f3ab21c7d"]
+}

package/dist/connectors/adapters/cursor/fixtures/normalize-post-tool-use-write.json

@@ -0,0 +1,41 @@
+{
+  "fixtureVersion": 1,
+  "kind": "normalized-event",
+  "description": "A Cursor postToolUse body for a Write call. Proves observe.toolResult and observe.fileEdit: the event becomes file.edited with a repo-relative path, and the file contents — deliberately carrying credentials — appear nowhere in the envelope. It is also the fixture that pins the `event` spelling of the event name, which is why the codec declares eventNamePaths rather than a single path.",
+  "codec": "codec/cursor.codec.yaml",
+  "occurredAt": "2026-01-01T00:00:00.000Z",
+  "payload": {
+    "conversation_id": "conv_7f3a91c2",
+    "event": "postToolUse",
+    "cwd": "/repo",
+    "tool_name": "Write",
+    "call_id": "call_2b81",
+    "tool_input": {
+      "file_path": "/repo/config/secrets.ts",
+      "content": "export const AWS_KEY = 'AKIAIOSFODNN7EXAMPLE';\nexport const DB = 'postgres://user:hunter2@db/app';\n"
+    }
+  },
+  "expect": {
+    "eventId": "ev_005e149f289472f0bb9c94aea6c5cfa0",
+    "producerSequence": null,
+    "occurredAt": "2026-01-01T00:00:00.000Z",
+    "kind": "file.edited",
+    "severity": "info",
+    "nativeEvent": "postToolUse",
+    "nativeTurnId": null,
+    "nativeCallId": "call_2b81",
+    "subagentId": null,
+    "correlationId": "conv_7f3a91c2",
+    "origin": "agent",
+    "summary": "Write a file: config/secrets.ts: 99 bytes",
+    "payload": {
+      "tool": "write",
+      "action": "Write a file",
+      "subject": "config/secrets.ts",
+      "detail": "99 bytes",
+      "paths": ["config/secrets.ts"],
+      "formatterVersion": 1
+    }
+  },
+  "mustNotContain": ["AKIAIOSFODNN7EXAMPLE", "hunter2", "postgres://", "/repo/config"]
+}

package/dist/connectors/adapters/cursor/fixtures/normalize-pre-tool-use-shell.json

@@ -0,0 +1,40 @@
+{
+  "fixtureVersion": 1,
+  "kind": "normalized-event",
+  "description": "A Cursor preToolUse body for a Shell call. Proves observe.toolCall: the event becomes tool.called with the destructive risk marker derived on the machine, and the raw command survives only as a bounded detail. This is the observational path for preToolUse; the decision path for the same native event is proven separately by fixtures/decision-codec.json and reached through a different action script.",
+  "codec": "codec/cursor.codec.yaml",
+  "occurredAt": "2026-01-01T00:00:00.000Z",
+  "payload": {
+    "conversation_id": "conv_7f3a91c2",
+    "hook_event_name": "preToolUse",
+    "cwd": "/repo",
+    "tool_name": "Shell",
+    "call_id": "call_44c0",
+    "tool_input": {
+      "command": "rm -rf ./build && yarn build"
+    }
+  },
+  "expect": {
+    "eventId": "ev_ad3ad02aaa00e3b1da140996b421f7cb",
+    "producerSequence": null,
+    "occurredAt": "2026-01-01T00:00:00.000Z",
+    "kind": "tool.called",
+    "severity": "info",
+    "nativeEvent": "preToolUse",
+    "nativeTurnId": null,
+    "nativeCallId": "call_44c0",
+    "subagentId": null,
+    "correlationId": "conv_7f3a91c2",
+    "origin": "agent",
+    "summary": "Run a shell command: rm -rf ./build && yarn build [destructive]",
+    "payload": {
+      "tool": "shell",
+      "action": "Run a shell command",
+      "subject": "rm",
+      "detail": "rm -rf ./build && yarn build",
+      "riskMarkers": ["destructive"],
+      "formatterVersion": 1
+    }
+  },
+  "mustNotContain": ["/repo/build"]
+}