overlord-cli 0.2608110806.0 → 0.2608120914.0

package/dist/connectors/HARNESS-MATRIX.md

@@ -14,10 +14,10 @@ Legend: ✅ supported (fixture-proven) · ⛔ unsupported (harness cannot) ·
 
 | Adapter | Harness | Verified version | Shape | Tier | Binding | Decision hold |
 | --- | --- | --- | --- | --- | --- | --- |
-| [`antigravity`](adapters/antigravity/CAPABILITIES.md) | Antigravity CLI | — | `callback` | 0 (Unsupported) | ❓ unverified | ❓ unverified |
-| [`claude`](adapters/claude/CAPABILITIES.md) | Claude Code | `2.1.221` | `callback` | 3 (Conversational) | ✅ supported | ✅ supported |
-| [`codex`](adapters/codex/CAPABILITIES.md) | Codex CLI | `0.146.0` | `callback` | 3 (Conversational) | ✅ supported | ✅ supported |
-| [`cursor`](adapters/cursor/CAPABILITIES.md) | Cursor Agent CLI | `2026.07.23-e383d2b` | `callback` | 0 (Unsupported) | ❓ unverified | ✅ supported |
+| [`antigravity`](adapters/antigravity/CAPABILITIES.md) | Antigravity CLI | `docs: Antigravity CLI v1.1.11 / Antigravity 2.0 v2.6.0` | `callback` | 0 (Unsupported) | ✅ supported | ❓ unverified |
+| [`claude`](adapters/claude/CAPABILITIES.md) | Claude Code | `2.1.227` | `callback` | 3 (Conversational) | ✅ supported | ✅ supported |
+| [`codex`](adapters/codex/CAPABILITIES.md) | Codex CLI | `0.147.0` | `callback` | 3 (Conversational) | ✅ supported | ✅ supported |
+| [`cursor`](adapters/cursor/CAPABILITIES.md) | Cursor Agent CLI | `2026.08.04-aaa8809` | `callback` | 3 (Conversational) | ✅ supported | ✅ supported |
 | [`opencode`](adapters/opencode/CAPABILITIES.md) | OpenCode | — | `controlPlane` | 3 (Conversational) | ✅ supported | ✅ supported |
 | [`pi`](adapters/pi/CAPABILITIES.md) | Pi Coding Agent | `0.83.0` | `extension` | 3 (Conversational) | ✅ supported | ✅ supported |
 
@@ -25,21 +25,21 @@ Legend: ✅ supported (fixture-proven) · ⛔ unsupported (harness cannot) ·
 
 | Capability | `antigravity` | `claude` | `codex` | `cursor` | `opencode` | `pi` |
 | --- | --- | --- | --- | --- | --- | --- |
-| `observe.prompt` | ❓ unverified | ✅ supported | ✅ supported | ✅ supported | 🚧 not-implemented | ✅ supported |
-| `observe.toolCall` | ❓ unverified | 🚧 not-implemented | ✅ supported | ✅ supported | 🚧 not-implemented | ✅ supported |
-| `observe.toolResult` | ❓ unverified | ✅ supported | ✅ supported | ✅ supported | ✅ supported | 🚧 not-implemented |
-| `observe.fileEdit` | ❓ unverified | ✅ supported | ✅ supported | ✅ supported | ✅ supported | 🚧 not-implemented |
-| `observe.sessionLifecycle` | ❓ unverified | ✅ supported | ✅ supported | 🚧 not-implemented | ✅ supported | ✅ supported |
-| `decide.shell` | ❓ unverified | ✅ supported | ✅ supported | ✅ supported | ✅ supported | ✅ supported |
+| `observe.prompt` | ⛔ unsupported | ✅ supported | ✅ supported | ✅ supported | 🚧 not-implemented | ✅ supported |
+| `observe.toolCall` | 🚧 not-implemented | 🚧 not-implemented | ✅ supported | ✅ supported | 🚧 not-implemented | ✅ supported |
+| `observe.toolResult` | 🚧 not-implemented | ✅ supported | ✅ supported | ✅ supported | ✅ supported | 🚧 not-implemented |
+| `observe.fileEdit` | 🚧 not-implemented | ✅ supported | ✅ supported | ✅ supported | ✅ supported | 🚧 not-implemented |
+| `observe.sessionLifecycle` | 🚧 not-implemented | ✅ supported | ✅ supported | 🚧 not-implemented | ✅ supported | ✅ supported |
+| `decide.shell` | 🚧 not-implemented | ✅ supported | ✅ supported | ✅ supported | ✅ supported | ✅ supported |
 | `decide.mcp` | ❓ unverified | ✅ supported | ✅ supported | ✅ supported | ✅ supported | ✅ supported |
-| `decide.fileWrite` | ❓ unverified | ✅ supported | ✅ supported | 🚧 not-implemented | 🚧 not-implemented | ✅ supported |
-| `decide.anyTool` | ❓ unverified | 🚧 not-implemented | 🚧 not-implemented | ✅ supported | ✅ supported | ✅ supported |
+| `decide.fileWrite` | 🚧 not-implemented | ✅ supported | ✅ supported | 🚧 not-implemented | 🚧 not-implemented | ✅ supported |
+| `decide.anyTool` | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | ✅ supported | ✅ supported | ✅ supported |
 | `decide.universal` | ❓ unverified | ✅ supported | ✅ supported | ⛔ unsupported | 🚧 not-implemented | ✅ supported |
 | `answer.structuredQuestion` | ❓ unverified | ❓ unverified | ❓ unverified | ⛔ unsupported | 🚧 not-implemented | 🚧 not-implemented |
-| `answer.persistentAllow` | ❓ unverified | 🚧 not-implemented | ❓ unverified | ⛔ unsupported | 🚧 not-implemented | ⛔ unsupported |
-| `inject.midTurn` | ❓ unverified | ✅ supported | ❓ unverified | ⛔ unsupported | ✅ supported | ✅ supported |
-| `inject.turnBoundary` | ❓ unverified | ✅ supported | ✅ supported | ✅ supported | ✅ supported | ✅ supported |
-| `inject.nextTurn` | ❓ unverified | 🚧 not-implemented | 🚧 not-implemented | ✅ supported | ✅ supported | 🚧 not-implemented |
+| `answer.persistentAllow` | 🚧 not-implemented | 🚧 not-implemented | ❓ unverified | ⛔ unsupported | 🚧 not-implemented | ⛔ unsupported |
+| `inject.midTurn` | ⛔ unsupported | ✅ supported | ❓ unverified | ⛔ unsupported | ✅ supported | ✅ supported |
+| `inject.turnBoundary` | 🚧 not-implemented | ✅ supported | ✅ supported | ✅ supported | ✅ supported | ✅ supported |
+| `inject.nextTurn` | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | ✅ supported | ✅ supported | 🚧 not-implemented |
 | `terminal.concurrentAnswer` | ❓ unverified | ⛔ unsupported | ⛔ unsupported | ⛔ unsupported | ✅ supported | ⛔ unsupported |
 | `terminal.statusSurface` | ❓ unverified | 🚧 not-implemented | ❓ unverified | ❓ unverified | 🚧 not-implemented | 🚧 not-implemented |
 
@@ -48,7 +48,6 @@ Legend: ✅ supported (fixture-proven) · ⛔ unsupported (harness cannot) ·
 | Adapter | Hazard | Severity | Verification | Mitigation | Tracked as |
 | --- | --- | --- | --- | --- | --- |
 | `antigravity` | `outside-verification-survey` | medium | unverified | required | `agent-session-verify-antigravity` |
-| `antigravity` | `pre-tool-use-always-allows` | medium | verified | required | `agent-session-verify-antigravity` |
 | `claude` | `shipped-stop-hook-inert` | medium | verified | required | `agent-session-phase-3` |
 | `claude` | `unbound-session-side-effects` | medium | verified | required | `agent-session-phase-4` |
 | `claude` | `fork-and-subagent-identity-unknown` | medium | unverified | required | `taxonomy-7.6` |

package/dist/connectors/VERSION

@@ -1 +1 @@
-0.3.20
+0.3.22

package/dist/connectors/adapters/antigravity/CAPABILITIES.md

@@ -4,9 +4,9 @@
 
 **Adapter** `antigravity` · **Codec** `antigravity` · **Integration shape** `callback` · **Capability tier** 0 (Unsupported)
 
-**Harness version verified** _not verified_ · **scheme** `opaque`
+**Harness version verified** `docs: Antigravity CLI v1.1.11 / Antigravity 2.0 v2.6.0` · **scheme** `opaque`
 
-**Descriptor digest** `c021926c384a72bdaa62ac5f0eab57e80822c5d2996db75ea3c30c6bf5d09ce8`
+**Descriptor digest** `e7313b23f98b6ed15a1a32849291a2a391523d4c06403bf395ecbcadfa3b11ac`
 
 > The tier is derived from passing fixtures, never authored. `unsupported` means the harness
 > cannot do it — do not attempt it. `not-implemented` means it is buildable and unbuilt: that is
@@ -17,11 +17,12 @@
 
 | Field | Value |
 | --- | --- |
-| Status | ❓ unverified |
+| Status | ✅ supported |
 | Source | `payload` |
-| Evidence | tracked as `agent-session-verify-antigravity` |
+| Field | `conversationId` |
+| Evidence | fixtures: `fixtures/official-pre-tool-use.json` |
 
-No native session identifier has been established for Antigravity hook payloads. Until one is, this connector cannot bind, and therefore cannot reach any interaction tier.
+The first-party hook contract defines `conversationId` as the unique UUID of the active agent conversation and includes it in every hook payload. It remains a correlation alias; the verified channel credential is the authorization and mission scope. The local `agy` binary was unavailable for an empirical resume test, so no interaction capability is promoted solely from this binding proof.
 
 The native session id is a **correlation alias only**. Authorization and mission scope come
 from the verified channel/session credential; neither the working directory nor an unverified
@@ -35,27 +36,27 @@ native id is a binding authority.
 | Harness ceiling | none documented |
 | Evidence | tracked as `agent-session-verify-antigravity` |
 
-The shipped hooks declare a 10-second timeout, but whether a held PreToolUse response actually gates execution — and what the harness does when the hook exceeds that timeout — was not verified.
+The first-party docs define command-hook timeouts (30 seconds by default) and a synchronous PreToolUse `decision` response, but do not define timeout, crash, non-zero-exit, or malformed JSON fallback behavior. Keep the remote decision hold unverified until an installed binary exercises those failure paths.
 
 ## Capabilities
 
 | Capability | Status | Native | Evidence |
 | --- | --- | --- | --- |
-| `observe.prompt` | ❓ unverified | `PreInvocation` | tracked as `agent-session-verify-antigravity` |
-| `observe.toolCall` | ❓ unverified | `PreToolUse` | tracked as `agent-session-verify-antigravity` |
-| `observe.toolResult` | ❓ unverified | — | tracked as `agent-session-verify-antigravity` |
-| `observe.fileEdit` | ❓ unverified | — | tracked as `agent-session-verify-antigravity` |
-| `observe.sessionLifecycle` | ❓ unverified | — | tracked as `agent-session-verify-antigravity` |
-| `decide.shell` | ❓ unverified | `PreToolUse` | tracked as `agent-session-verify-antigravity` |
+| `observe.prompt` | ⛔ unsupported | `PreInvocation` | PreInvocation exposes invocation counters and common metadata but no submitted prompt. Reading transcriptPath to reconstruct one would violate the raw-transcript privacy boundary. (evidence: `https://antigravity.google/docs/hooks#preinvocation`) |
+| `observe.toolCall` | 🚧 not-implemented | `PreToolUse` | tracked as `agent-session-verify-antigravity` |
+| `observe.toolResult` | 🚧 not-implemented | `PostToolUse` | tracked as `agent-session-verify-antigravity` |
+| `observe.fileEdit` | 🚧 not-implemented | `PostToolUse` | tracked as `agent-session-verify-antigravity` |
+| `observe.sessionLifecycle` | 🚧 not-implemented | `Stop` | tracked as `agent-session-verify-antigravity` |
+| `decide.shell` | 🚧 not-implemented | `PreToolUse` | tracked as `agent-session-verify-antigravity` |
 | `decide.mcp` | ❓ unverified | — | tracked as `agent-session-verify-antigravity` |
-| `decide.fileWrite` | ❓ unverified | — | tracked as `agent-session-verify-antigravity` |
-| `decide.anyTool` | ❓ unverified | `PreToolUse` | tracked as `agent-session-verify-antigravity` |
+| `decide.fileWrite` | 🚧 not-implemented | `PreToolUse` | tracked as `agent-session-verify-antigravity` |
+| `decide.anyTool` | 🚧 not-implemented | `PreToolUse` | tracked as `agent-session-verify-antigravity` |
 | `decide.universal` | ❓ unverified | — | tracked as `agent-session-verify-antigravity` |
 | `answer.structuredQuestion` | ❓ unverified | — | tracked as `agent-session-verify-antigravity` |
-| `answer.persistentAllow` | ❓ unverified | — | tracked as `agent-session-verify-antigravity` |
-| `inject.midTurn` | ❓ unverified | — | tracked as `agent-session-verify-antigravity` |
-| `inject.turnBoundary` | ❓ unverified | — | tracked as `agent-session-verify-antigravity` |
-| `inject.nextTurn` | ❓ unverified | — | tracked as `agent-session-verify-antigravity` |
+| `answer.persistentAllow` | 🚧 not-implemented | `PreToolUse.permissionOverrides` | tracked as `agent-session-verify-antigravity` |
+| `inject.midTurn` | ⛔ unsupported | — | PreInvocation and PostInvocation can inject only at model-invocation boundaries; the hook surface has no path to deliver input while a model or tool call is actively running. (evidence: `https://antigravity.google/docs/hooks#preinvocation`) |
+| `inject.turnBoundary` | 🚧 not-implemented | `Stop` | tracked as `agent-session-verify-antigravity` |
+| `inject.nextTurn` | 🚧 not-implemented | `PreInvocation.injectSteps.userMessage` | tracked as `agent-session-verify-antigravity` |
 | `terminal.concurrentAnswer` | ❓ unverified | — | tracked as `agent-session-verify-antigravity` |
 | `terminal.statusSurface` | ❓ unverified | — | tracked as `agent-session-verify-antigravity` |
 
@@ -64,18 +65,21 @@ The shipped hooks declare a 10-second timeout, but whether a held PreToolUse res
 | Hazard | Severity | Verification | Mitigation | Tracked as |
 | --- | --- | --- | --- | --- |
 | `outside-verification-survey` | medium | unverified | required | `agent-session-verify-antigravity` |
-| `pre-tool-use-always-allows` | medium | verified | required | `agent-session-verify-antigravity` |
+| `pre-tool-use-always-allows` | medium | verified | implemented | fixture `fixtures/unbound-session.json` |
+| `pre-invocation-has-no-prompt` | high | verified | implemented | fixture `fixtures/unbound-session.json` |
+
+**`outside-verification-survey`** — Antigravity was not part of the original harness verification survey. The current first-party docs now establish hook names, payload fields, and response shapes, but the `agy` binary was unavailable for empirical timeout, failure, resume, and headless tests. The connector must stay at its fixture-proven tier until those paths are exercised.
 
-**`outside-verification-survey`** — Antigravity was not part of the harness verification survey. Every row above is unverified rather than inferred, and this connector must stay at its fixture-proven tier until a dedicated verification objective upgrades it.
+**`pre-tool-use-always-allows`** — The former PreToolUse hook answered `{"allow_tool":true}` even though the first-party response contract requires `decision`, and called a nonexistent detached protocol command. It neither gated nor recorded reliably; changing it to native `decision: allow` would have silently bypassed the harness permission system, so the registration was removed.
 
-**`pre-tool-use-always-allows`** — The shipped PreToolUse hook always answers `{"allow_tool":true}` and records the request through a detached `ovld protocol permission-request` call to a subcommand that does not exist. It therefore neither gates nor records anything, while its conformance manifest declared the permissionHook capability.
+**`pre-invocation-has-no-prompt`** — The former follow-up hook guessed prompt/message/text/input fields on PreInvocation, but the first-party schema contains none of them. It could never capture a normal follow-up; reconstructing one from transcriptPath would violate the raw-transcript privacy boundary. The false followUpHook projection and the registration were removed.
 
 ## Native decision shape
 
 - **Codec** `antigravity`
-- **Never send** `hookSpecificOutput`, `permissionDecision`, `permission`
+- **Never send** `allow_tool`, `hookSpecificOutput`, `permissionDecision`, `permission`
 
-The observed response shape is a flat `{"allow_tool": boolean}`. No deny or defer shape has been verified, so no decision codec may be written for this adapter yet.
+The first-party response is `{ decision, reason?, permissionOverrides? }`, with decision values allow, deny, ask, force_ask, and deny_unless_prior_grant. No decision codec ships until an installed binary verifies failure fallback and exact emitted bytes; in particular, no failure path may manufacture `decision: allow`.
 
 ## Unbound-session negative test
 

package/dist/connectors/adapters/antigravity/README.md

@@ -72,9 +72,9 @@ This connector is intentionally reviewable against the four connector layers in
 - `plugin.json` — Antigravity plugin manifest (name, description, metadata).
 - `skills/overlord-mission/SKILL.md` — Antigravity adapter template with a `<!-- @connector-core -->` marker; setup interpolates shared core content at install time.
 - `skills/attach.md`, `skills/connect.md`, `skills/load.md`, `skills/create.md`, `skills/prompt.md`, `skills/discuss-objective.md`, `skills/add-objectives.md`, `skills/record-work.md`, `skills/spawn.md` — one skill per protocol operation; Antigravity auto-registers each as a `/<name>` slash command.
-- `hooks.json` + `scripts/pre-invocation-hook.sh` + `scripts/pre-tool-use-hook.sh` — legacy
-  follow-up and pre-tool compatibility hooks (see the limitations below). These are not a
-  fixture-proven agent-session decision path.
+- `hooks.json` — intentionally empty until a fixture-proven agent-session callback is installed.
+  The former compatibility hooks were removed because the documented native payloads cannot
+  support their claimed behavior safely.
 - `mcp_config.json` + `scripts/overlord-mcp.mjs` — MCP bridge to common `ovld protocol` operations. The shim is **generated**: it is rendered from `connectors/core/scripts/overlord-mcp.mjs` at setup time with the adapter key substituted, and there is no copy in this directory to edit.
 - `conformance-manifest.yaml` — connector conformance declaration for the Overlord contract.
 - `prompt-wrapper.md` — Antigravity launch guidance.
@@ -93,13 +93,17 @@ See the [adapter capability matrix](../../README.md#adapter-capability-matrix) f
 
 Antigravity's native hook events are `PreToolUse`, `PostToolUse`, `PreInvocation`, `PostInvocation`, and `Stop` — it has no event literally named `UserPromptSubmit` or `PermissionRequest` the way Claude Code and Codex do. This adapter maps Antigravity's native events onto Overlord's canonical hook-type vocabulary the same way the Cursor adapter maps `beforeSubmitPrompt` onto `UserPromptSubmit`:
 
-- `PreInvocation` (fires before each agent turn) → recorded as the canonical `UserPromptSubmit` follow-up-capture hook.
-- `PreToolUse` (fires before each tool call) → the legacy script always responds
-  `{"allow_tool":true}`. Its detached `ovld protocol permission-request` target is not a current
-  protocol command, so it neither gates nor reliably records the request. The generated
-  capability descriptor keeps Antigravity at tier 0 until a native fixture-backed path replaces
-  this compatibility hook.
-
-Both hook scripts are defensive: they no-op on any missing `MISSION_ID`, missing `ovld` binary, or unexpected payload shape, and they always return a well-formed allow response so a hook failure never blocks the Antigravity session. Antigravity's public docs do not yet pin an exact `PreInvocation` payload shape the way they do for `PreToolUse` (`toolCall.args`), so `pre-invocation-hook.sh` probes a few plausible field names (`prompt`, `message`, `text`, `input`) for the human turn text; adjust this once the official schema is confirmed.
+- `PreInvocation` receives invocation counters and common metadata, including `conversationId`,
+  but no submitted prompt. It therefore cannot implement canonical `UserPromptSubmit` capture
+  without reading the raw transcript, which the connector privacy contract forbids.
+- `PreToolUse` receives `toolCall`, `stepIdx`, and `conversationId`, and requires a `decision`
+  response (`allow`, `deny`, `ask`, `force_ask`, or `deny_unless_prior_grant`). The former
+  compatibility hook emitted the unrelated `allow_tool` field and called a nonexistent protocol
+  command. It has been removed rather than replaced with an unconditional native `allow`, which
+  would bypass Antigravity's own permission prompt.
+
+The descriptor records the first-party schema and keeps the decision capabilities unimplemented
+until a real installed `agy` binary can exercise the exact failure and timeout behavior through
+the channel-scoped agent-session runtime.
 
 No `Stop` hook or permission-rule file ships yet — Antigravity's pending-delivery check and any declarative auto-approval mechanism should be added once their concrete formats are confirmed, matching the "can be implemented after local MVP" note in `connectors/docs/05-connectors-and-agent-plugins.md`.

package/dist/connectors/adapters/antigravity/conformance-manifest.yaml

@@ -15,13 +15,10 @@ connector:
   harnessCapabilities:
     path: connectors/adapters/antigravity/harness-capabilities.yaml
     schemaVersion: 1
-    digest: "c021926c384a72bdaa62ac5f0eab57e80822c5d2996db75ea3c30c6bf5d09ce8"
+    digest: "e7313b23f98b6ed15a1a32849291a2a391523d4c06403bf395ecbcadfa3b11ac"
   capabilities:
-    - followUpHook
     - contextFilePrompt
     - slashCommands
-  hookTypes:
-    - UserPromptSubmit
   # ── END GENERATED ────────────────────────────────────────────────────────────
   installPath: "~/.gemini/antigravity-cli/plugins/overlord"
   managedFiles:
@@ -33,8 +30,6 @@ connector:
     - "README.md"
     - "prompt-wrapper.md"
     - "scripts/overlord-mcp.mjs"
-    - "scripts/pre-invocation-hook.sh"
-    - "scripts/pre-tool-use-hook.sh"
     - "skills/attach.md"
     - "skills/connect.md"
     - "skills/create.md"

package/dist/connectors/adapters/antigravity/fixtures/official-pre-tool-use.json

@@ -0,0 +1,36 @@
+{
+  "fixtureVersion": 1,
+  "kind": "native-payload",
+  "description": "First-party Antigravity PreToolUse example proving the documented conversationId binding field and camelCase tool payload shape. The local agy binary was unavailable, so this fixture proves only the published payload contract, not runtime failure behavior.",
+  "payload": {
+    "toolCall": {
+      "name": "run_command",
+      "args": {
+        "CommandLine": "npm test",
+        "Cwd": "/workspace/project",
+        "WaitMsBeforeAsync": 5000
+      }
+    },
+    "stepIdx": 19,
+    "conversationId": "ec33ebf9-0cba-4100-8142-c61503f6c587",
+    "workspacePaths": ["/workspace/project"],
+    "transcriptPath": "~/.gemini/antigravity/brain/ec33ebf9-0cba-4100-8142-c61503f6c587/.system_generated/logs/transcript.jsonl",
+    "artifactDirectoryPath": "~/.gemini/antigravity/brain/ec33ebf9-0cba-4100-8142-c61503f6c587",
+    "modelName": "gemini-3.6-flash-medium"
+  },
+  "assert": {
+    "requiredPaths": [
+      "toolCall.name",
+      "toolCall.args",
+      "conversationId",
+      "workspacePaths",
+      "transcriptPath",
+      "artifactDirectoryPath",
+      "modelName"
+    ],
+    "bindingField": "conversationId",
+    "equals": {
+      "toolCall.name": "run_command"
+    }
+  }
+}

package/dist/connectors/adapters/antigravity/fixtures/unbound-session.json

@@ -1,24 +1,14 @@
 {
   "fixtureVersion": 1,
-  "kind": "script-io",
-  "description": "Mandatory negative test: Antigravity's PreToolUse hook in a session with no Overlord binding, in an unrelated directory. It must make no write, no CLI invocation, and no delay. Its stdout is the harness's required allow response, which is the correct fail-toward-the-harness behavior for an unbound session.",
-  "script": "connectors/adapters/antigravity/scripts/pre-tool-use-hook.sh",
-  "stdin": {
-    "hook_event_name": "PreToolUse",
-    "tool_name": "run_command",
-    "tool_input": { "command": "rm -rf ./build" }
-  },
-  "env": {
-    "MISSION_ID": null,
-    "SESSION_KEY": null,
-    "OVERLORD_SESSION_CHANNEL_ID": null,
-    "OVERLORD_SESSION_CHANNEL_TOKEN": null
-  },
-  "expect": {
-    "exitCode": 0,
-    "stdout": "{\"allow_tool\":true}",
-    "stderr": "",
-    "cliInvocations": [],
-    "sandboxWrites": []
+  "kind": "source-guard",
+  "description": "Mandatory negative test: the Antigravity adapter registers no callback in an unbound session while its native decision and prompt-capture paths remain unimplemented.",
+  "path": "connectors/adapters/antigravity/hooks.json",
+  "assert": {
+    "mustNotContain": [
+      "PreInvocation",
+      "PreToolUse",
+      "pre-invocation-hook.sh",
+      "pre-tool-use-hook.sh"
+    ]
   }
 }

package/dist/connectors/adapters/antigravity/harness-capabilities.yaml

@@ -14,56 +14,69 @@ codec: antigravity
 
 harness:
   name: Antigravity CLI
+  verifiedVersion: 'docs: Antigravity CLI v1.1.11 / Antigravity 2.0 v2.6.0'
   versionScheme: opaque
 
 integrationShape: callback
 
 binding:
   source: payload
-  status: unverified
-  trackedAs: agent-session-verify-antigravity
+  field: conversationId
+  status: supported
+  fixture: fixtures/official-pre-tool-use.json
   notes: >-
-    No native session identifier has been established for Antigravity hook payloads. Until
-    one is, this connector cannot bind, and therefore cannot reach any interaction tier.
+    The first-party hook contract defines `conversationId` as the unique UUID of the active
+    agent conversation and includes it in every hook payload. It remains a correlation alias;
+    the verified channel credential is the authorization and mission scope. The local `agy`
+    binary was unavailable for an empirical resume test, so no interaction capability is
+    promoted solely from this binding proof.
 
 decisionHold:
   status: unverified
   trackedAs: agent-session-verify-antigravity
   notes: >-
-    The shipped hooks declare a 10-second timeout, but whether a held PreToolUse response
-    actually gates execution — and what the harness does when the hook exceeds that timeout —
-    was not verified.
+    The first-party docs define command-hook timeouts (30 seconds by default) and a synchronous
+    PreToolUse `decision` response, but do not define timeout, crash, non-zero-exit, or malformed
+    JSON fallback behavior. Keep the remote decision hold unverified until an installed binary
+    exercises those failure paths.
 
 capabilities:
   observe.prompt:
-    status: unverified
+    status: unsupported
     native: PreInvocation
-    trackedAs: agent-session-verify-antigravity
+    reason: >-
+      PreInvocation exposes invocation counters and common metadata but no submitted prompt.
+      Reading transcriptPath to reconstruct one would violate the raw-transcript privacy boundary.
+    evidenceRef: https://antigravity.google/docs/hooks#preinvocation
   observe.toolCall:
-    status: unverified
+    status: not-implemented
     native: PreToolUse
     trackedAs: agent-session-verify-antigravity
   observe.toolResult:
-    status: unverified
+    status: not-implemented
+    native: PostToolUse
     trackedAs: agent-session-verify-antigravity
   observe.fileEdit:
-    status: unverified
+    status: not-implemented
+    native: PostToolUse
     trackedAs: agent-session-verify-antigravity
   observe.sessionLifecycle:
-    status: unverified
+    status: not-implemented
+    native: Stop
     trackedAs: agent-session-verify-antigravity
   decide.shell:
-    status: unverified
+    status: not-implemented
     native: PreToolUse
     trackedAs: agent-session-verify-antigravity
   decide.mcp:
     status: unverified
     trackedAs: agent-session-verify-antigravity
   decide.fileWrite:
-    status: unverified
+    status: not-implemented
+    native: PreToolUse
     trackedAs: agent-session-verify-antigravity
   decide.anyTool:
-    status: unverified
+    status: not-implemented
     native: PreToolUse
     trackedAs: agent-session-verify-antigravity
   decide.universal:
@@ -73,16 +86,22 @@ capabilities:
     status: unverified
     trackedAs: agent-session-verify-antigravity
   answer.persistentAllow:
-    status: unverified
+    status: not-implemented
+    native: PreToolUse.permissionOverrides
     trackedAs: agent-session-verify-antigravity
   inject.midTurn:
-    status: unverified
-    trackedAs: agent-session-verify-antigravity
+    status: unsupported
+    reason: >-
+      PreInvocation and PostInvocation can inject only at model-invocation boundaries; the hook
+      surface has no path to deliver input while a model or tool call is actively running.
+    evidenceRef: https://antigravity.google/docs/hooks#preinvocation
   inject.turnBoundary:
-    status: unverified
+    status: not-implemented
+    native: Stop
     trackedAs: agent-session-verify-antigravity
   inject.nextTurn:
-    status: unverified
+    status: not-implemented
+    native: PreInvocation.injectSteps.userMessage
     trackedAs: agent-session-verify-antigravity
   terminal.concurrentAnswer:
     status: unverified
@@ -95,36 +114,47 @@ hazards:
   - id: outside-verification-survey
     severity: medium
     summary: >-
-      Antigravity was not part of the harness verification survey. Every row above is
-      unverified rather than inferred, and this connector must stay at its fixture-proven
-      tier until a dedicated verification objective upgrades it.
+      Antigravity was not part of the original harness verification survey. The current
+      first-party docs now establish hook names, payload fields, and response shapes, but the
+      `agy` binary was unavailable for empirical timeout, failure, resume, and headless tests.
+      The connector must stay at its fixture-proven tier until those paths are exercised.
     verification: unverified
     mitigation: required
     trackedAs: agent-session-verify-antigravity
   - id: pre-tool-use-always-allows
     severity: medium
     summary: >-
-      The shipped PreToolUse hook always answers `{"allow_tool":true}` and records the request
-      through a detached `ovld protocol permission-request` call to a subcommand that does not
-      exist. It therefore neither gates nor records anything, while its conformance manifest
-      declared the permissionHook capability.
+      The former PreToolUse hook answered `{"allow_tool":true}` even though the first-party
+      response contract requires `decision`, and called a nonexistent detached protocol command.
+      It neither gated nor recorded reliably; changing it to native `decision: allow` would have
+      silently bypassed the harness permission system, so the registration was removed.
     verification: verified
-    mitigation: required
-    trackedAs: agent-session-verify-antigravity
+    mitigation: implemented
+    fixture: fixtures/unbound-session.json
+  - id: pre-invocation-has-no-prompt
+    severity: high
+    summary: >-
+      The former follow-up hook guessed prompt/message/text/input fields on PreInvocation, but
+      the first-party schema contains none of them. It could never capture a normal follow-up;
+      reconstructing one from transcriptPath would violate the raw-transcript privacy boundary.
+      The false followUpHook projection and the registration were removed.
+    verification: verified
+    mitigation: implemented
+    fixture: fixtures/unbound-session.json
 
 decisionShape:
   codec: antigravity
-  neverSend: [hookSpecificOutput, permissionDecision, permission]
+  neverSend: [allow_tool, hookSpecificOutput, permissionDecision, permission]
   notes: >-
-    The observed response shape is a flat `{"allow_tool": boolean}`. No deny or defer shape
-    has been verified, so no decision codec may be written for this adapter yet.
+    The first-party response is `{ decision, reason?, permissionOverrides? }`, with decision
+    values allow, deny, ask, force_ask, and deny_unless_prior_grant. No decision codec ships
+    until an installed binary verifies failure fallback and exact emitted bytes; in particular,
+    no failure path may manufacture `decision: allow`.
 
 unboundSessionFixture: fixtures/unbound-session.json
 
 legacy:
   capabilities:
-    - followUpHook
     - contextFilePrompt
     - slashCommands
-  hookTypes:
-    - UserPromptSubmit
+  hookTypes: []

package/dist/connectors/adapters/antigravity/hooks.json

@@ -1,30 +1 @@
-{
-  "overlord-follow-up-capture": {
-    "PreInvocation": [
-      {
-        "matcher": "*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "${ANTIGRAVITY_PLUGIN_ROOT}/scripts/pre-invocation-hook.sh",
-            "timeout": 10
-          }
-        ]
-      }
-    ]
-  },
-  "overlord-permission-capture": {
-    "PreToolUse": [
-      {
-        "matcher": "*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "${ANTIGRAVITY_PLUGIN_ROOT}/scripts/pre-tool-use-hook.sh",
-            "timeout": 10
-          }
-        ]
-      }
-    ]
-  }
-}
+{}

package/dist/connectors/adapters/antigravity/plugin.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://antigravity.google/schemas/v1/plugin.json",
   "name": "overlord",
-  "version": "0.3.20",
-  "description": "Chat-driven access to Overlord mission protocol workflows with hook-driven activity capture.",
+  "version": "0.3.22",
+  "description": "Chat-driven access to Overlord mission protocol workflows through skills and MCP.",
   "author": {
     "name": "Cooperativ",
     "url": "https://github.com/cooperativ-labs"

package/dist/connectors/adapters/antigravity/skills/overlord-mission/SKILL.md

@@ -8,8 +8,8 @@ description: Antigravity adapter for the shared Overlord mission workflow.
 ## Antigravity Adapter Notes
 
 - Agent identifier: `antigravity` for `ovld protocol create` and `ovld protocol prompt`.
-- Follow-up capture: the installed `PreInvocation` hook (Antigravity's closest analog to the canonical `UserPromptSubmit` hook) records ordinary post-delivery user turns. Do not manually publish `user_follow_up` unless the hook is unavailable.
-- Permission capture: the installed `PreToolUse` hook (Antigravity's closest analog to the canonical `PermissionRequest` hook) publishes permission activity through `ovld protocol` and always allows the underlying tool call — it only records, it never gates.
+- Follow-up capture: Antigravity's documented hooks do not expose the submitted prompt, so this adapter does not claim automatic `user_follow_up` capture. Publish follow-up activity through the normal mission workflow when needed.
+- Permission capture: no decision hook is registered until Antigravity's documented `PreToolUse` response dialect is implemented through the channel-scoped agent-session runtime. Never manufacture an `allow` response as a failure fallback.
 - Model selection: do not pass `--model` or an effort/thinking flag. Antigravity manages model selection internally; the launch prompt only carries mission/objective context.
 - MCP bridge: the installed `overlord` MCP server exposes the hosted-compatible `overlord_*` mission tool catalog backed by `ovld protocol`.
 - Slash commands: each file under `skills/` (this skill plus `attach`, `connect`, `load`, `create`, `prompt`, `discuss-objective`, `add-objectives`, `record-work`, `spawn`) is auto-registered by Antigravity as a `/<name>` command.

package/dist/connectors/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord",
-  "version": "0.3.20",
+  "version": "0.3.22",
   "description": "Overlord mission protocol workflow for Claude Code — attach/update/ask/deliver, slash commands, and hook-driven activity capture.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/claude/CAPABILITIES.md

@@ -4,9 +4,9 @@
 
 **Adapter** `claude` · **Codec** `claude` · **Integration shape** `callback` · **Capability tier** 3 (Conversational)
 
-**Harness version verified** `2.1.221` · **range** `>=2.1.0` · **scheme** `semver`
+**Harness version verified** `2.1.227` · **range** `>=2.1.0` · **scheme** `semver`
 
-**Descriptor digest** `bdeb8c46cb12d692aced13597c6c2120312c303f3aaeb597b891d83e054db365`
+**Descriptor digest** `5c25dafa68e2f4d0862be4378f4b7a2506ace3a4fe6b806a0e392188604f20d8`
 
 > The tier is derived from passing fixtures, never authored. `unsupported` means the harness
 > cannot do it — do not attempt it. `not-implemented` means it is buildable and unbuilt: that is
@@ -94,9 +94,9 @@ Per-command `timeout` in seconds with no documented ceiling. Omitting `decision`
 
 **`fork-and-subagent-identity-unknown`** — Whether an in-process fork mints a new native session id, and whether subagent tool calls carry the parent's id, are both unverified. Guessing either routes a session's requests to the wrong mission. Partially narrowed at 2.1.221: the binary carries distinct `SubagentStart` and `SubagentStop` hook events, converts an agent-frontmatter `Stop` registration into `SubagentStop` ("subagents trigger SubagentStop"), and records `parent_session_id` and `agent_type` as separate fields from `session_id`. That the harness distinguishes the two identities is now established; which value lands in a subagent hook payload's `session_id` is still not, and that is the part binding depends on. Read it from a real subagent payload before changing any binding code.
 
-**`subagent-stop-unregistered`** — The adapter registers `Stop` and no subagent-lifecycle event. Claude Code 2.1.221 fires `SubagentStop` — not `Stop` — when a subagent finishes, and subagents now run in the background past the parent's turn boundary, so the shipped Stop registration is guaranteed not to run for work a subagent completes after the parent stopped. Nothing is lost today because that registration is already inert (see `shipped-stop-hook-inert`), which is exactly why the fix is to repair the Stop path first and only then decide whether the repaired body should also ride `SubagentStop`. Registering the current inert script on a second event would add a spawn per subagent completion and buy nothing.
+**`subagent-stop-unregistered`** — The adapter registers `Stop` and no subagent-lifecycle event. Claude Code 2.1.221 fires `SubagentStop` — not `Stop` — when a subagent finishes, and subagents now run in the background past the parent's turn boundary. Version 2.1.224 also removed the 200-subagent-per-session spawn cap, increasing the frequency of this gap, so the shipped Stop registration is guaranteed not to run for work a subagent completes after the parent stopped. Nothing is lost today because that registration is already inert (see `shipped-stop-hook-inert`), which is exactly why the fix is to repair the Stop path first and only then decide whether the repaired body should also ride `SubagentStop`. Registering the current inert script on a second event would add a spawn per subagent completion and buy nothing.
 
-**`subagent-commits-escape-delivery-delta`** — Delivery change attribution is computed from `git status --porcelain` against the attach baseline (cli/src/vcs.ts `readChangedFiles` / `filterRunAttributableChanges`); nothing in that path consults HEAD or the commit graph. A background subagent that commits, merges, or opens a PR for its own work therefore removes those files from the worktree delta, and they vanish from the delivery report entirely — not flagged, not skipped, silently absent. The PostToolUse touched-files log is unaffected (its key is `sha256(abspath(cwd) + "\0" + MISSION_ID)`, so a subagent sharing the cwd writes to the same log), which means the evidence that the edit happened survives while the delta that decides coverage does not. Closing this means teaching the delta about commits made since the baseline, which is a CLI change with branch and worktree semantics to settle, not a hook edit.
+**`subagent-commits-escape-delivery-delta`** — Delivery change attribution is computed from `git status --porcelain` against the attach baseline (cli/src/vcs.ts `readChangedFiles` / `filterRunAttributableChanges`); nothing in that path consults HEAD or the commit graph. Claude Code 2.1.221 made background-session commit-and-push behavior an explicit work-preservation default. A background subagent that commits, merges, or opens a PR for its own work therefore removes those files from the worktree delta, and they vanish from the delivery report entirely — not flagged, not skipped, silently absent. The PostToolUse touched-files log is unaffected (its key is `sha256(abspath(cwd) + "\0" + MISSION_ID)`, so a subagent sharing the cwd writes to the same log), which means the evidence that the edit happened survives while the delta that decides coverage does not. Closing this means teaching the delta about commits made since the baseline, which is a CLI change with branch and worktree semantics to settle, not a hook edit.
 
 ## Native decision shape
 

package/dist/connectors/adapters/claude/conformance-manifest.yaml

@@ -15,7 +15,7 @@ connector:
   harnessCapabilities:
     path: connectors/adapters/claude/harness-capabilities.yaml
     schemaVersion: 1
-    digest: "bdeb8c46cb12d692aced13597c6c2120312c303f3aaeb597b891d83e054db365"
+    digest: "5c25dafa68e2f4d0862be4378f4b7a2506ace3a4fe6b806a0e392188604f20d8"
   capabilities:
     - followUpHook
     - permissionHook