overlord-cli 0.2608121927.0 → 0.2608131824.0

package/dist/connectors/AGENTS.md

@@ -80,6 +80,12 @@ stale. `yarn connectors:check` runs it alongside the connector version check.
 
 ### The rendered agent-session hook
 
+Mechanical observe / decide / inject is **not a live Overlord connector path**. Latch owns
+turns, tools, `awaiting_input`, and PTY answers via `latch events` and `latch send`. New
+adapters must not register `ovld agent-session` hooks. Channel 1 stays on `ovld protocol`
+(follow-up capture, touched-file attribution, Stop delivery reminder). The rest of this
+section documents leftover CLI runtime and historical fixtures.
+
 Do not write a per-adapter shell script for agent-session traffic. One core script,
 `connectors/core/scripts/agent-session-hook.sh`, is rendered per adapter at `ovld agent-setup`
 time — declare the managed file as `scripts/agent-session-<action>.sh` in the manifest, and the

package/dist/connectors/HARNESS-MATRIX.md

@@ -15,30 +15,30 @@ Legend: ✅ supported (fixture-proven) · ⛔ unsupported (harness cannot) ·
 | Adapter | Harness | Verified version | Shape | Tier | Binding | Decision hold |
 | --- | --- | --- | --- | --- | --- | --- |
 | [`antigravity`](adapters/antigravity/CAPABILITIES.md) | Antigravity CLI | `docs: Antigravity CLI v1.1.11 / Antigravity 2.0 v2.6.0` | `callback` | 0 (Unsupported) | ✅ supported | ❓ unverified |
-| [`claude`](adapters/claude/CAPABILITIES.md) | Claude Code | `2.1.227` | `callback` | 3 (Conversational) | ✅ supported | ✅ supported |
-| [`codex`](adapters/codex/CAPABILITIES.md) | Codex CLI | `0.147.0` | `callback` | 3 (Conversational) | ✅ supported | ✅ supported |
-| [`cursor`](adapters/cursor/CAPABILITIES.md) | Cursor Agent CLI | `2026.08.04-aaa8809` | `callback` | 3 (Conversational) | ✅ supported | ✅ supported |
+| [`claude`](adapters/claude/CAPABILITIES.md) | Claude Code | `2.1.227` | `callback` | 1 (Observational) | ✅ supported | ✅ supported |
+| [`codex`](adapters/codex/CAPABILITIES.md) | Codex CLI | `0.147.0` | `callback` | 1 (Observational) | ✅ supported | ✅ supported |
+| [`cursor`](adapters/cursor/CAPABILITIES.md) | Cursor Agent CLI | `2026.08.04-aaa8809` | `callback` | 1 (Observational) | ✅ supported | ✅ supported |
 | [`opencode`](adapters/opencode/CAPABILITIES.md) | OpenCode | — | `controlPlane` | 3 (Conversational) | ✅ supported | ✅ supported |
-| [`pi`](adapters/pi/CAPABILITIES.md) | Pi Coding Agent | `0.83.0` | `extension` | 3 (Conversational) | ✅ supported | ✅ supported |
+| [`pi`](adapters/pi/CAPABILITIES.md) | Pi Coding Agent | `0.83.0` | `extension` | 1 (Observational) | ✅ supported | 🚧 not-implemented |
 
 ## Capabilities
 
 | Capability | `antigravity` | `claude` | `codex` | `cursor` | `opencode` | `pi` |
 | --- | --- | --- | --- | --- | --- | --- |
 | `observe.prompt` | ⛔ unsupported | ✅ supported | ✅ supported | ✅ supported | 🚧 not-implemented | ✅ supported |
-| `observe.toolCall` | 🚧 not-implemented | 🚧 not-implemented | ✅ supported | ✅ supported | 🚧 not-implemented | ✅ supported |
-| `observe.toolResult` | 🚧 not-implemented | ✅ supported | ✅ supported | ✅ supported | ✅ supported | 🚧 not-implemented |
-| `observe.fileEdit` | 🚧 not-implemented | ✅ supported | ✅ supported | ✅ supported | ✅ supported | 🚧 not-implemented |
-| `observe.sessionLifecycle` | 🚧 not-implemented | ✅ supported | ✅ supported | 🚧 not-implemented | ✅ supported | ✅ supported |
-| `decide.shell` | 🚧 not-implemented | ✅ supported | ✅ supported | ✅ supported | ✅ supported | ✅ supported |
-| `decide.mcp` | ❓ unverified | ✅ supported | ✅ supported | ✅ supported | ✅ supported | ✅ supported |
-| `decide.fileWrite` | 🚧 not-implemented | ✅ supported | ✅ supported | 🚧 not-implemented | 🚧 not-implemented | ✅ supported |
-| `decide.anyTool` | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | ✅ supported | ✅ supported | ✅ supported |
-| `decide.universal` | ❓ unverified | ✅ supported | ✅ supported | ⛔ unsupported | 🚧 not-implemented | ✅ supported |
+| `observe.toolCall` | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented |
+| `observe.toolResult` | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | ✅ supported | ✅ supported | 🚧 not-implemented |
+| `observe.fileEdit` | 🚧 not-implemented | ✅ supported | 🚧 not-implemented | ✅ supported | ✅ supported | 🚧 not-implemented |
+| `observe.sessionLifecycle` | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | ✅ supported | 🚧 not-implemented |
+| `decide.shell` | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | ✅ supported | 🚧 not-implemented |
+| `decide.mcp` | ❓ unverified | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | ✅ supported | 🚧 not-implemented |
+| `decide.fileWrite` | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented |
+| `decide.anyTool` | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | ✅ supported | 🚧 not-implemented |
+| `decide.universal` | ❓ unverified | 🚧 not-implemented | 🚧 not-implemented | ⛔ unsupported | 🚧 not-implemented | 🚧 not-implemented |
 | `answer.structuredQuestion` | ❓ unverified | ❓ unverified | ❓ unverified | ⛔ unsupported | 🚧 not-implemented | 🚧 not-implemented |
 | `answer.persistentAllow` | 🚧 not-implemented | 🚧 not-implemented | ❓ unverified | ⛔ unsupported | 🚧 not-implemented | ⛔ unsupported |
-| `inject.midTurn` | ⛔ unsupported | ✅ supported | ❓ unverified | ⛔ unsupported | ✅ supported | ✅ supported |
-| `inject.turnBoundary` | 🚧 not-implemented | ✅ supported | ✅ supported | ✅ supported | ✅ supported | ✅ supported |
+| `inject.midTurn` | ⛔ unsupported | 🚧 not-implemented | ❓ unverified | ⛔ unsupported | ✅ supported | 🚧 not-implemented |
+| `inject.turnBoundary` | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | ✅ supported | ✅ supported | 🚧 not-implemented |
 | `inject.nextTurn` | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | ✅ supported | ✅ supported | 🚧 not-implemented |
 | `terminal.concurrentAnswer` | ❓ unverified | ⛔ unsupported | ⛔ unsupported | ⛔ unsupported | ✅ supported | ⛔ unsupported |
 | `terminal.statusSurface` | ❓ unverified | 🚧 not-implemented | ❓ unverified | ❓ unverified | 🚧 not-implemented | 🚧 not-implemented |
@@ -58,6 +58,8 @@ Legend: ✅ supported (fixture-proven) · ⛔ unsupported (harness cannot) ·
 | `cursor` | `reads-claude-hook-config` | high | unverified | required | `taxonomy-7.1` |
 | `cursor` | `allowlist-precedence` | medium | unverified | required | `taxonomy-7.8` |
 | `opencode` | `harness-version-unverified` | medium | unverified | required | `agent-session-verify-opencode-frames` |
+| `pi` | `no-native-floor-fails-open` | high | verified | accepted | — |
+| `pi` | `block-is-visible-to-the-model` | medium | verified | accepted | — |
 | `pi` | `typed-api-version-coupling` | medium | unverified | required | `taxonomy-7.10` |
 
 ## Reading this table

package/dist/connectors/VERSION

@@ -1 +1 @@
-0.3.22
+0.3.25

package/dist/connectors/adapters/antigravity/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://antigravity.google/schemas/v1/plugin.json",
   "name": "overlord",
-  "version": "0.3.22",
+  "version": "0.3.25",
   "description": "Chat-driven access to Overlord mission protocol workflows through skills and MCP.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord",
-  "version": "0.3.22",
+  "version": "0.3.25",
   "description": "Overlord mission protocol workflow for Claude Code — attach/update/ask/deliver, slash commands, and hook-driven activity capture.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/claude/CAPABILITIES.md

@@ -2,11 +2,11 @@
 
 # Claude Code — Overlord agent-session capabilities
 
-**Adapter** `claude` · **Codec** `claude` · **Integration shape** `callback` · **Capability tier** 3 (Conversational)
+**Adapter** `claude` · **Codec** `claude` · **Integration shape** `callback` · **Capability tier** 1 (Observational)
 
 **Harness version verified** `2.1.227` · **range** `>=2.1.0` · **scheme** `semver`
 
-**Descriptor digest** `5c25dafa68e2f4d0862be4378f4b7a2506ace3a4fe6b806a0e392188604f20d8`
+**Descriptor digest** `833a35cecb73aa9b34b40036eb6d3088dd729ca6be465d1ee228dae2c5a8269d`
 
 > The tier is derived from passing fixtures, never authored. `unsupported` means the harness
 > cannot do it — do not attempt it. `not-implemented` means it is buildable and unbuilt: that is
@@ -45,33 +45,34 @@ Per-command `timeout` in seconds with no documented ceiling. Omitting `decision`
 | --- | --- | --- | --- |
 | `observe.prompt` | ✅ supported | `UserPromptSubmit` | fixtures: `fixtures/normalize-user-prompt-submit.json` |
 | `observe.toolCall` | 🚧 not-implemented | `PreToolUse` | tracked as `agent-session-phase-2` |
-| `observe.toolResult` | ✅ supported | `PostToolUse` | fixtures: `fixtures/normalize-post-tool-use-shell.json`, `fixtures/agent-session-hook-unbound.json` |
+| `observe.toolResult` | 🚧 not-implemented | `PostToolUse` | tracked as `latch-engine` |
 | `observe.fileEdit` | ✅ supported | `PostToolUse` | fixtures: `fixtures/normalize-post-tool-use-write.json`, `fixtures/post-tool-use-parity.json` |
-| `observe.sessionLifecycle` | ✅ supported | `SessionStart` | fixtures: `fixtures/normalize-session-start.json` |
-| `decide.shell` | ✅ supported | `PermissionRequest` | fixtures: `fixtures/permission-request.json`, `fixtures/decision-codec.json` |
-| `decide.mcp` | ✅ supported | `PermissionRequest` | fixtures: `fixtures/permission-request.json`, `fixtures/decision-codec.json` |
-| `decide.fileWrite` | ✅ supported | `PermissionRequest` | fixtures: `fixtures/permission-request.json`, `fixtures/decision-codec.json` |
-| `decide.anyTool` | 🚧 not-implemented | `PreToolUse` | tracked as `agent-session-phase-2` |
-| `decide.universal` | ✅ supported | `PermissionRequest` | fixtures: `fixtures/permission-request.json`, `fixtures/decision-codec.json` |
+| `observe.sessionLifecycle` | 🚧 not-implemented | `SessionStart` | tracked as `latch-engine` |
+| `decide.shell` | 🚧 not-implemented | `PermissionRequest` | tracked as `latch-engine` |
+| `decide.mcp` | 🚧 not-implemented | `PermissionRequest` | tracked as `latch-engine` |
+| `decide.fileWrite` | 🚧 not-implemented | `PermissionRequest` | tracked as `latch-engine` |
+| `decide.anyTool` | 🚧 not-implemented | `PreToolUse` | tracked as `latch-engine` |
+| `decide.universal` | 🚧 not-implemented | `PermissionRequest` | tracked as `latch-engine` |
 | `answer.structuredQuestion` | ❓ unverified | `Elicitation` | tracked as `agent-session-verify-claude-elicitation` |
 | `answer.persistentAllow` | 🚧 not-implemented | `PermissionRequest.decision.updatedPermissions` | tracked as `agent-session-standing-permissions` |
-| `inject.midTurn` | ✅ supported | `asyncRewake` | fixtures: `fixtures/inject-async-rewake.json`, `fixtures/agent-session-inbox-unbound.json` |
-| `inject.turnBoundary` | ✅ supported | `Stop` | fixtures: `fixtures/inject-stop-block.json`, `fixtures/agent-session-inbox-unbound.json` |
+| `inject.midTurn` | 🚧 not-implemented | `asyncRewake` | tracked as `latch-engine` |
+| `inject.turnBoundary` | 🚧 not-implemented | `Stop` | tracked as `latch-engine` |
 | `inject.nextTurn` | 🚧 not-implemented | `Stop` | tracked as `agent-session-phase-4` |
 | `terminal.concurrentAnswer` | ⛔ unsupported | — | The native permission prompt is drawn only after the hook returns, so nobody can answer in the terminal while Overlord holds the decision. Holding is simultaneously the only way to answer remotely and the reason the terminal cannot participate. (evidence: `connector-harness-taxonomy.md#12-the-axis-that-actually-matters`) |
 | `terminal.statusSurface` | 🚧 not-implemented | `statusMessage` | tracked as `agent-session-phase-2` |
 
 ### Capability notes
 
-- **`observe.prompt`** — Two registrations now ride UserPromptSubmit: the legacy hook that posts `user_follow_up` mission events through the Connector → Protocol surface, and the normalized agent-session event this capability grades. Both stay installed until the normalized path has proven equivalent follow-up attribution; replacing a working capture with an unproven one is how a migration loses data quietly.
+- **`observe.prompt`** — Two registrations used to ride UserPromptSubmit. Mechanical agent-session observation moved to Latch `events`. This capability grades the protocol follow-up hook that posts `user_follow_up` mission events; that Channel 1 path stays installed.
 - **`observe.toolCall`** — Deliberately unregistered in Phase 1. PreToolUse is decision-capable: registering it for observation alone would put a script in front of every tool call for no benefit a PostToolUse registration does not already provide, while inheriting the blast radius of the decision path. It lands with the codecs that can actually use it.
-- **`observe.fileEdit`** — The shipped PostToolUse hook that records touched files into the per-session log used by `deliver` for change attribution is untouched and still registered. The normalized event is additive: `fixtures/post-tool-use-parity.json` guards both registrations being present, because the migration must not repair observation by regressing change attribution.
-- **`observe.sessionLifecycle`** — SessionStart only. There is no matching stop-class registration: continuing or observing a session a user believed had finished is a larger surprise than a missing row, and the Stop event is decision-capable in a way SessionStart is not.
-- **`decide.universal`** — Unlike Cursor, Claude has one event that covers every approval, so a single registration can reach every decision rather than a per-tool-class slice.
+- **`observe.toolResult`** — Mechanical tool-result observation moved to Latch `events`. The protocol PostToolUse hook still records touched files for delivery attribution.
+- **`observe.fileEdit`** — The shipped PostToolUse hook that records touched files into the per-session log used by `deliver` for change attribution remains registered. Mechanical agent-session observation is no longer a live Overlord path.
+- **`observe.sessionLifecycle`** — SessionStart observation moved to Latch `events`. There is no matching Overlord registration.
+- **`decide.universal`** — Remote permission decisions moved to Latch `awaiting_input` / `latch send --resolve`. The native Claude prompt owns approvals when Latch is absent.
 - **`answer.structuredQuestion`** — Elicitation/ElicitationResult hook events exist in the binary but their request and response shapes were not read. Write the fixture before relying on them.
 - **`answer.persistentAllow`** — Structurally available, deliberately unbuilt. A standing permission grant needs its own design, confirmation, audit language, and RBAC review before any remote surface offers it.
-- **`inject.midTurn`** — SessionStart and PostToolUse register `agent-session-inbox.sh` with `asyncRewake: true`. Exit code 2 wakes the model with stderr as a system reminder — that is Delivered.
-- **`inject.turnBoundary`** — Stop returns `decision: "block"` with the instruction as `reason`, which continues the turn with that text. The model receives it, so this path also reports Delivered.
+- **`inject.midTurn`** — Session-input injection moved off Overlord connectors. Latch PTY write is Phase 3.
+- **`inject.turnBoundary`** — Turn-boundary injection moved off Overlord connectors. The protocol Stop hook still reminds the agent to deliver when needed.
 - **`inject.nextTurn`** — No distinct next-turn-only path yet; turn-boundary Stop covers the portable fallback.
 - **`terminal.statusSurface`** — `statusMessage` is static install-time configuration with no per-request interpolation and no session-binding predicate, so it renders in unbound sessions too. It must be worded as an option, never as an instruction.
 

package/dist/connectors/adapters/claude/README.md

@@ -19,7 +19,7 @@ Claude Code plugin that exposes the Overlord local mission workflow to any Claud
 ### Requirements
 
 - Overlord CLI (`ovld`) on `PATH`. See the Overlord docs / Settings → Agents & MCP.
-- `MISSION_ID` is exported automatically when a Claude session is launched from Overlord; outside that launch, set it manually before calling the permission hook.
+- `MISSION_ID` is exported automatically when a Claude session is launched from Overlord.
 
 ### Install (recommended)
 
@@ -85,9 +85,9 @@ This connector is intentionally reviewable against the four connector layers in
 
 - `skills/overlord-mission/SKILL.md` — Claude adapter template with a `<!-- @connector-core -->` marker; setup interpolates shared core content at install time.
 - `commands/*.md` — slash commands for session routing, objective discussion, mission creation, and work recording.
-- `hooks/hooks.json` + `scripts/*.sh` — mission follow-up and touched-file capture plus the
-  scoped `ovld agent-session` observe, decision, and injection paths. Decision failures emit no
-  native response, so Claude retains its normal permission behavior.
+- `hooks/hooks.json` + `scripts/*.sh` — Channel 1 mission follow-up (`UserPromptSubmit`),
+  touched-file capture (`PostToolUse`), and Stop delivery reminder. Mechanical harness
+  observation, permission, and injection are Latch's (`latch events` / PTY).
 - `userConfig` for `overlord_url` and `user_token`; the hook scripts use the `ovld protocol` CLI and pass the plugin's USER_TOKEN to that CLI as `Overlord_USER_TOKEN`.
 - `conformance-manifest.yaml` — connector conformance declaration for the Overlord contract.
 - `prompt-wrapper.md` — Claude launch context-file guidance.

package/dist/connectors/adapters/claude/conformance-manifest.yaml

@@ -11,11 +11,11 @@ connector:
   # `capabilities` and `hookTypes` are the DEPRECATED hook-named projection, retained for
   # one release. `harnessCapabilities` is the authoritative source.
   integrationShape: callback
-  capabilityTier: 3
+  capabilityTier: 1
   harnessCapabilities:
     path: connectors/adapters/claude/harness-capabilities.yaml
     schemaVersion: 1
-    digest: "5c25dafa68e2f4d0862be4378f4b7a2506ace3a4fe6b806a0e392188604f20d8"
+    digest: "833a35cecb73aa9b34b40036eb6d3088dd729ca6be465d1ee228dae2c5a8269d"
   capabilities:
     - followUpHook
     - permissionHook
@@ -48,9 +48,6 @@ connector:
     - "commands/record-work.md"
     - "commands/spawn.md"
     - "hooks/hooks.json"
-    - "scripts/agent-session-event.sh"
-    - "scripts/agent-session-request.sh"
-    - "scripts/agent-session-inbox.sh"
     - "scripts/permission-hook.sh"
     - "scripts/post-tool-use-hook.sh"
     - "scripts/stop-hook.sh"

package/dist/connectors/adapters/claude/fixtures/post-tool-use-parity.json

@@ -1,13 +1,17 @@
 {
   "fixtureVersion": 1,
   "kind": "source-guard",
-  "description": "Migration parity guard. The normalized agent-session event registration is ADDITIVE: the legacy PostToolUse hook that feeds touched-file change attribution, and the legacy UserPromptSubmit hook that posts follow-up mission events, must both remain registered alongside it. Deleting either to 'clean up' would silently break delivery attribution or follow-up capture, and neither failure is visible until someone tries to deliver.",
+  "description": "Channel 1 protocol hooks remain registered. Mechanical agent-session observe/decide/inject is no longer a live Overlord path.",
   "path": "connectors/adapters/claude/hooks/hooks.json",
   "assert": {
     "mustContain": [
       "scripts/post-tool-use-hook.sh",
-      "scripts/user-prompt-submit-hook.sh",
-      "scripts/agent-session-event.sh"
+      "scripts/user-prompt-submit-hook.sh"
+    ],
+    "mustNotContain": [
+      "scripts/agent-session-event.sh",
+      "scripts/agent-session-request.sh",
+      "scripts/agent-session-inbox.sh"
     ]
   }
 }

package/dist/connectors/adapters/claude/harness-capabilities.yaml

@@ -50,11 +50,9 @@ capabilities:
     native: UserPromptSubmit
     fixtures: [fixtures/normalize-user-prompt-submit.json]
     notes: >-
-      Two registrations now ride UserPromptSubmit: the legacy hook that posts `user_follow_up`
-      mission events through the Connector → Protocol surface, and the normalized agent-session
-      event this capability grades. Both stay installed until the normalized path has proven
-      equivalent follow-up attribution; replacing a working capture with an unproven one is how
-      a migration loses data quietly.
+      Two registrations used to ride UserPromptSubmit. Mechanical agent-session observation
+      moved to Latch `events`. This capability grades the protocol follow-up hook that posts
+      `user_follow_up` mission events; that Channel 1 path stays installed.
   observe.toolCall:
     status: not-implemented
     native: PreToolUse
@@ -65,11 +63,12 @@ capabilities:
       PostToolUse registration does not already provide, while inheriting the blast radius of
       the decision path. It lands with the codecs that can actually use it.
   observe.toolResult:
-    status: supported
+    status: not-implemented
     native: PostToolUse
-    fixtures:
-      - fixtures/normalize-post-tool-use-shell.json
-      - fixtures/agent-session-hook-unbound.json
+    trackedAs: latch-engine
+    notes: >-
+      Mechanical tool-result observation moved to Latch `events`. The protocol PostToolUse
+      hook still records touched files for delivery attribution.
   observe.fileEdit:
     status: supported
     native: PostToolUse
@@ -78,40 +77,38 @@ capabilities:
       - fixtures/post-tool-use-parity.json
     notes: >-
       The shipped PostToolUse hook that records touched files into the per-session log used by
-      `deliver` for change attribution is untouched and still registered. The normalized event
-      is additive: `fixtures/post-tool-use-parity.json` guards both registrations being present,
-      because the migration must not repair observation by regressing change attribution.
+      `deliver` for change attribution remains registered. Mechanical agent-session observation
+      is no longer a live Overlord path.
   observe.sessionLifecycle:
-    status: supported
+    status: not-implemented
     native: SessionStart
-    fixtures: [fixtures/normalize-session-start.json]
+    trackedAs: latch-engine
     notes: >-
-      SessionStart only. There is no matching stop-class registration: continuing or observing a
-      session a user believed had finished is a larger surprise than a missing row, and the Stop
-      event is decision-capable in a way SessionStart is not.
+      SessionStart observation moved to Latch `events`. There is no matching Overlord
+      registration.
   decide.shell:
-    status: supported
+    status: not-implemented
     native: PermissionRequest
-    fixtures: [fixtures/permission-request.json, fixtures/decision-codec.json]
+    trackedAs: latch-engine
   decide.mcp:
-    status: supported
+    status: not-implemented
     native: PermissionRequest
-    fixtures: [fixtures/permission-request.json, fixtures/decision-codec.json]
+    trackedAs: latch-engine
   decide.fileWrite:
-    status: supported
+    status: not-implemented
     native: PermissionRequest
-    fixtures: [fixtures/permission-request.json, fixtures/decision-codec.json]
+    trackedAs: latch-engine
   decide.anyTool:
     status: not-implemented
     native: PreToolUse
-    trackedAs: agent-session-phase-2
+    trackedAs: latch-engine
   decide.universal:
-    status: supported
+    status: not-implemented
     native: PermissionRequest
-    fixtures: [fixtures/permission-request.json, fixtures/decision-codec.json]
+    trackedAs: latch-engine
     notes: >-
-      Unlike Cursor, Claude has one event that covers every approval, so a single
-      registration can reach every decision rather than a per-tool-class slice.
+      Remote permission decisions moved to Latch `awaiting_input` / `latch send --resolve`.
+      The native Claude prompt owns approvals when Latch is absent.
   answer.structuredQuestion:
     status: unverified
     native: Elicitation
@@ -127,23 +124,18 @@ capabilities:
       Structurally available, deliberately unbuilt. A standing permission grant needs its own
       design, confirmation, audit language, and RBAC review before any remote surface offers it.
   inject.midTurn:
-    status: supported
+    status: not-implemented
     native: asyncRewake
-    fixtures:
-      - fixtures/inject-async-rewake.json
-      - fixtures/agent-session-inbox-unbound.json
+    trackedAs: latch-engine
     notes: >-
-      SessionStart and PostToolUse register `agent-session-inbox.sh` with `asyncRewake: true`.
-      Exit code 2 wakes the model with stderr as a system reminder — that is Delivered.
+      Session-input injection moved off Overlord connectors. Latch PTY write is Phase 3.
   inject.turnBoundary:
-    status: supported
+    status: not-implemented
     native: Stop
-    fixtures:
-      - fixtures/inject-stop-block.json
-      - fixtures/agent-session-inbox-unbound.json
+    trackedAs: latch-engine
     notes: >-
-      Stop returns `decision: "block"` with the instruction as `reason`, which continues the
-      turn with that text. The model receives it, so this path also reports Delivered.
+      Turn-boundary injection moved off Overlord connectors. The protocol Stop hook still
+      reminds the agent to deliver when needed.
   inject.nextTurn:
     status: not-implemented
     native: Stop

package/dist/connectors/adapters/claude/hooks/hooks.json

@@ -1,16 +1,5 @@
 {
   "hooks": {
-    "PermissionRequest": [
-      {
-        "matcher": ".*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "${CLAUDE_PLUGIN_ROOT}/scripts/agent-session-request.sh"
-          }
-        ]
-      }
-    ],
     "UserPromptSubmit": [
       {
         "matcher": ".*",
@@ -20,15 +9,6 @@
             "command": "${CLAUDE_PLUGIN_ROOT}/scripts/user-prompt-submit-hook.sh"
           }
         ]
-      },
-      {
-        "matcher": ".*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "${CLAUDE_PLUGIN_ROOT}/scripts/agent-session-event.sh"
-          }
-        ]
       }
     ],
     "PostToolUse": [
@@ -40,25 +20,6 @@
             "command": "${CLAUDE_PLUGIN_ROOT}/scripts/post-tool-use-hook.sh"
           }
         ]
-      },
-      {
-        "matcher": ".*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "${CLAUDE_PLUGIN_ROOT}/scripts/agent-session-event.sh"
-          }
-        ]
-      },
-      {
-        "matcher": ".*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "${CLAUDE_PLUGIN_ROOT}/scripts/agent-session-inbox.sh",
-            "asyncRewake": true
-          }
-        ]
       }
     ],
     "Stop": [
@@ -70,36 +31,6 @@
             "command": "${CLAUDE_PLUGIN_ROOT}/scripts/stop-hook.sh"
           }
         ]
-      },
-      {
-        "matcher": ".*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "${CLAUDE_PLUGIN_ROOT}/scripts/agent-session-inbox.sh"
-          }
-        ]
-      }
-    ],
-    "SessionStart": [
-      {
-        "matcher": ".*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "${CLAUDE_PLUGIN_ROOT}/scripts/agent-session-event.sh"
-          }
-        ]
-      },
-      {
-        "matcher": ".*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "${CLAUDE_PLUGIN_ROOT}/scripts/agent-session-inbox.sh",
-            "asyncRewake": true
-          }
-        ]
       }
     ]
   }

package/dist/connectors/adapters/codex/.codex-plugin/hooks.json

@@ -1,17 +1,5 @@
 {
   "hooks": {
-    "PermissionRequest": [
-      {
-        "matcher": ".*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "/bin/sh -c 'exec \"${CODEX_PLUGIN_ROOT:-$HOME/.codex/plugins/overlord}/scripts/agent-session-request.sh\"'",
-            "timeout": 35
-          }
-        ]
-      }
-    ],
     "UserPromptSubmit": [
       {
         "matcher": ".*",
@@ -21,59 +9,6 @@
             "command": "/bin/sh -c 'exec \"${CODEX_PLUGIN_ROOT:-$HOME/.codex/plugins/overlord}/scripts/user-prompt-submit-hook.sh\"'"
           }
         ]
-      },
-      {
-        "matcher": ".*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "/bin/sh -c 'exec \"${CODEX_PLUGIN_ROOT:-$HOME/.codex/plugins/overlord}/scripts/agent-session-event.sh\"'"
-          }
-        ]
-      }
-    ],
-    "PreToolUse": [
-      {
-        "matcher": ".*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "/bin/sh -c 'exec \"${CODEX_PLUGIN_ROOT:-$HOME/.codex/plugins/overlord}/scripts/agent-session-event.sh\"'"
-          }
-        ]
-      }
-    ],
-    "PostToolUse": [
-      {
-        "matcher": ".*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "/bin/sh -c 'exec \"${CODEX_PLUGIN_ROOT:-$HOME/.codex/plugins/overlord}/scripts/agent-session-event.sh\"'"
-          }
-        ]
-      }
-    ],
-    "SessionStart": [
-      {
-        "matcher": ".*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "/bin/sh -c 'exec \"${CODEX_PLUGIN_ROOT:-$HOME/.codex/plugins/overlord}/scripts/agent-session-event.sh\"'"
-          }
-        ]
-      }
-    ],
-    "Stop": [
-      {
-        "matcher": ".*",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "/bin/sh -c 'exec \"${CODEX_PLUGIN_ROOT:-$HOME/.codex/plugins/overlord}/scripts/agent-session-inbox.sh\"'"
-          }
-        ]
       }
     ]
   }

package/dist/connectors/adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord",
-  "version": "0.3.22",
+  "version": "0.3.25",
   "description": "Chat-driven access to Overlord mission protocol workflows with hook-driven activity capture.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/codex/CAPABILITIES.md

@@ -2,11 +2,11 @@
 
 # Codex CLI — Overlord agent-session capabilities
 
-**Adapter** `codex` · **Codec** `codex` · **Integration shape** `callback` · **Capability tier** 3 (Conversational)
+**Adapter** `codex` · **Codec** `codex` · **Integration shape** `callback` · **Capability tier** 1 (Observational)
 
 **Harness version verified** `0.147.0` · **range** `>=0.124.0` · **scheme** `semver`
 
-**Descriptor digest** `4b318751579af39c81ea0c1ea7be718d66cda313622f1c5edb1cff5e3dfe8659`
+**Descriptor digest** `e0d536667a5616d1a662c7225fc8ef439b5d7cdce1d6703e577190c9e5c6d9c5`
 
 > The tier is derived from passing fixtures, never authored. `unsupported` means the harness
 > cannot do it — do not attempt it. `not-implemented` means it is buildable and unbuilt: that is
@@ -45,28 +45,27 @@ Per-hook timeouts in seconds; the documentation gives a 600-second default. The
 | Capability | Status | Native | Evidence |
 | --- | --- | --- | --- |
 | `observe.prompt` | ✅ supported | `UserPromptSubmit` | fixtures: `fixtures/normalize-user-prompt.json` |
-| `observe.toolCall` | ✅ supported | `PreToolUse` | fixtures: `fixtures/normalize-pre-tool-use.json` |
-| `observe.toolResult` | ✅ supported | `PostToolUse` | fixtures: `fixtures/normalize-post-tool-use.json` |
-| `observe.fileEdit` | ✅ supported | `PostToolUse` | fixtures: `fixtures/normalize-post-tool-use.json` |
-| `observe.sessionLifecycle` | ✅ supported | `SessionStart` | fixtures: `fixtures/normalize-session-start.json` |
-| `decide.shell` | ✅ supported | `PermissionRequest` | fixtures: `fixtures/permission-request.json`, `fixtures/decision-codec.json` |
-| `decide.mcp` | ✅ supported | `PermissionRequest` | fixtures: `fixtures/permission-request.json`, `fixtures/decision-codec.json` |
-| `decide.fileWrite` | ✅ supported | `PermissionRequest` | fixtures: `fixtures/permission-request.json`, `fixtures/decision-codec.json` |
+| `observe.toolCall` | 🚧 not-implemented | `PreToolUse` | tracked as `latch-engine` |
+| `observe.toolResult` | 🚧 not-implemented | `PostToolUse` | tracked as `latch-engine` |
+| `observe.fileEdit` | 🚧 not-implemented | `PostToolUse` | tracked as `latch-engine` |
+| `observe.sessionLifecycle` | 🚧 not-implemented | `SessionStart` | tracked as `latch-engine` |
+| `decide.shell` | 🚧 not-implemented | `PermissionRequest` | tracked as `latch-engine` |
+| `decide.mcp` | 🚧 not-implemented | `PermissionRequest` | tracked as `latch-engine` |
+| `decide.fileWrite` | 🚧 not-implemented | `PermissionRequest` | tracked as `latch-engine` |
 | `decide.anyTool` | 🚧 not-implemented | `PreToolUse` | tracked as `agent-session-phase-4` |
-| `decide.universal` | ✅ supported | `PermissionRequest` | fixtures: `fixtures/permission-request.json`, `fixtures/decision-codec.json` |
+| `decide.universal` | 🚧 not-implemented | `PermissionRequest` | tracked as `latch-engine` |
 | `answer.structuredQuestion` | ❓ unverified | `ToolRequestUserInput` | tracked as `taxonomy-7.2` |
 | `answer.persistentAllow` | ❓ unverified | — | tracked as `taxonomy-7.4` |
 | `inject.midTurn` | ❓ unverified | `ThreadInjectItems` | tracked as `taxonomy-7.2` |
-| `inject.turnBoundary` | ✅ supported | `Stop` | fixtures: `fixtures/agent-session-hooks.json` |
+| `inject.turnBoundary` | 🚧 not-implemented | `Stop` | tracked as `latch-engine` |
 | `inject.nextTurn` | 🚧 not-implemented | `Stop` | tracked as `agent-session-phase-4` |
 | `terminal.concurrentAnswer` | ⛔ unsupported | — | On the hook path the native prompt is drawn only after the callback returns, so the terminal cannot answer while Overlord holds the decision. (A future app-server integration could change this; it would be a different integrationShape.) (evidence: `connector-harness-taxonomy.md#12-the-axis-that-actually-matters`) |
 | `terminal.statusSurface` | ❓ unverified | — | tracked as `taxonomy-7.9` |
 
 ### Capability notes
 
-- **`observe.toolCall`** — PreToolUse fires for MCP tool calls, not only shell and patch tools. Re-verified against the installed 0.146.0 binary and the matching upstream tag: the upstream suite `hooks_mcp.rs` (under codex-rs/core/tests/suite) proves a PreToolUse hook can both deny and rewrite an MCP call before it executes, and the binary carries a distinct "Tool call blocked by PreToolUse hook: {}. Tool: {}" message alongside the shell-only one. `tool_name` is the full MCP identifier (`mcp__<server>__<tool>`) and the matcher matches that string, so a matcher written for a bare tool name will silently never fire.
-- **`observe.toolResult`** — Also covers MCP tool results, on the same 0.146.0 evidence as `observe.toolCall`. What PostToolUse cannot do is rewrite one: the binary rejects a returned `updatedMCPToolOutput` as unsupported. Observation of an MCP result is therefore reliable; mutation of it is not.
-- **`decide.universal`** — Codex PermissionRequest covers Bash, apply_patch/Edit/Write, and MCP tool names. The codec emits only documented allow/deny behavior and deliberately never emits reserved `updatedInput`, `updatedPermissions`, or `interrupt` fields.
+- **`observe.toolCall`** — Mechanical PreToolUse observation moved to Latch `events`.
+- **`decide.universal`** — Remote permission decisions moved to Latch `awaiting_input` / `latch send --resolve`.
 - **`answer.structuredQuestion`** — `codex app-server` exposes ToolRequestUserInput with per-option label/description and an autoResolutionMs — an ACP-shaped structured question in everything but name. It is unreachable until the single-subscriber question is settled.
 - **`inject.midTurn`** — ThreadInjectItems/TurnSteer exist on the experimental app-server surface only. The binary carries "expected exactly one client subscribed to the thread, found {}", so if the TUI is that one client Overlord cannot also subscribe and this path is closed.
 
@@ -81,7 +80,7 @@ Per-hook timeouts in seconds; the documentation gives a 600-second default. The
 
 **`two-integration-surfaces-could-disagree`** — Hooks and `codex app-server` can both answer a permission. A session driven by both would race in a way no revision CAS can settle, so exactly one surface must be chosen and documented before either is built.
 
-**`shipped-permission-hook-inert`** — The former PermissionRequest hook called a nonexistent protocol command in the background. The managed registration now invokes the fixed request runtime directly.
+**`shipped-permission-hook-inert`** — The former PermissionRequest hook called a nonexistent protocol command in the background. The connector no longer registers a PermissionRequest hook; the native prompt owns approvals when Latch is absent.
 
 **`prompt-and-agent-hook-handlers-inert`** — Codex 0.146.0 accepts three hook handler types — `command`, `prompt`, and `agent` — but only `command` runs. Hook discovery parses `prompt` and `agent` and then skips them with a "not supported yet" warning, so a manifest that used either would install cleanly, list in `hooks`, and never execute. The connector must keep emitting `command` handlers only, and must not read the presence of these variants in the schema as availability. `command` is a shell command line run through `$SHELL -lc` (`/bin/sh` when SHELL is unset) — it is not restricted to Bash and not restricted to shell scripting, since the command may invoke any interpreter.