overlord-cli 0.2608211706.0 → 0.2608231148.0

package/README.md

@@ -97,7 +97,7 @@ backend is reachable.
 
 Environment overrides (useful in scripts and CI):
 
-- `OVLD_HOME` — relocate the entire global `~/.ovld` data directory (SQLite, object storage, VCS baselines, native-session caches)
+- `OVLD_HOME` — relocate the entire global `~/.ovld` data directory (SQLite, object storage, objective ledgers, and native-session caches)
 - `OVERLORD_BACKEND_URL` — production/global backend target; an *explicit* runtime value (shell export, container/launcher injection) takes precedence over the resolved `overlord.toml` `backend_url`
 - `OVERLORD_BACKEND_URL_DEV` — **development-only** backend target, read solely by the in-repo source build and the dev/test tooling that runs it (`yarn dev`, the test harness). An installed/published `ovld` never reads it, and nothing aliases it into the production `OVERLORD_BACKEND_URL`
 - `OVERLORD_WEB_PORT` — port the local backend binds when launched
@@ -249,7 +249,7 @@ colocation convention):
 - [03 — Agent Protocol](https://github.com/cooperativ-labs/OpenOverlord/blob/main/cli/docs/03-agent-protocol.md): `ovld protocol` lifecycle, context assembly, updates, delivery, attachments.
 - [04 — Runner and Launch Execution](https://github.com/cooperativ-labs/OpenOverlord/blob/main/cli/docs/04-runner-and-launch-execution.md): execution requests, local runner, launch command generation, auto-advance.
 - [06 — Core Domain and Lifecycle](https://github.com/cooperativ-labs/OpenOverlord/blob/main/cli/docs/06-core-domain-and-lifecycle.md): projects, missions, objectives, sessions, events, statuses, state transitions.
-- [11 — Review, Artifacts, and Change Tracking](https://github.com/cooperativ-labs/OpenOverlord/blob/main/cli/docs/11-review-artifacts-and-change-tracking.md): delivery review records, artifacts, rationale coverage, local diff support.
+- [11 — Review, Artifacts, and Change Tracking](https://github.com/cooperativ-labs/OpenOverlord/blob/main/cli/docs/11-review-artifacts-and-change-tracking.md): delivery review records, artifacts, objective-ledger evidence, and optional rationale annotations.
 - [Test Plan](https://github.com/cooperativ-labs/OpenOverlord/blob/main/cli/docs/testing.md): test plan for the `cli`, `protocol`, and `runner` components — management commands, protocol lifecycle/attach-shape/validation conformance, runner queue atomicity, and surface smoke tests. Part of the root [TEST_PLAN.md](https://github.com/cooperativ-labs/OpenOverlord/blob/main/TEST_PLAN.md).
 
 ### Code & Tests

package/dist/connectors/AGENTS.md

@@ -11,9 +11,9 @@ A connector lets an AI coding harness (Claude Code, Codex, Cursor, etc.) speak t
 | Extension type        | Example user request                                  |
 | --------------------- | ----------------------------------------------------- |
 | New agent connector   | "Add a connector for OpenCode / Windsurf / Zed"       |
-| New hook type         | "Add a Stop hook for pending-delivery checks"         |
+| New harness event path | "Capture a newly exposed native mutation event"       |
 | Extend connector core | "Add a new canonical instruction to all connectors"   |
-| New capability flag   | "Connectors can now declare `supports-multi-session`" |
+| New capability id     | "Grade a new agent-session behavior"                  |
 
 Each type has a different procedure below.
 
@@ -24,7 +24,7 @@ Each type has a different procedure below.
 1. Read `CONTRACT.md` — Connector Layer section (stable id: `connector`).
 2. Read [`connectors/docs/05-connectors-and-agent-plugins.md`](docs/05-connectors-and-agent-plugins.md) for the four-layer model: connector core, plugins, adapters, and prompt wrappers.
 3. Read [`connectors/docs/agent-harness-configuration-architecture.md`](docs/agent-harness-configuration-architecture.md) for ownership boundaries.
-4. Check `contract/extension-points.yaml` for approved capability flags and hook types before adding new ones.
+4. Check the `agentSession` vocabularies in `contract/extension-points.yaml` and the descriptor schema before adding a normalized capability, integration shape, or fixture kind.
 5. After connector edits, follow the [connector-versions skill](../.claude/skills/connector-versions/SKILL.md) and run `yarn connectors:version:bump`.
 
 ---
@@ -57,7 +57,7 @@ The descriptor is the **only hand-authored capability source**. Everything below
 | `connectors/adapters/<agent>/CAPABILITIES.md`                                                                                                               | Per-adapter page with a do-not-edit banner                             |
 | `connectors/HARNESS-MATRIX.md`                                                                                                                              | Cross-adapter matrix                                                   |
 | `cli/src/agent-session/catalog.generated.ts`                                                                                                                | Compiled catalog the CLI runtime reads                                 |
-| The `connector:` block's `capabilities`, `hookTypes`, `integrationShape`, `capabilityTier`, and `harnessCapabilities` fields in `conformance-manifest.yaml` | The deprecated hook-named legacy projection plus the descriptor digest |
+| The `connector:` block's `integrationShape`, `capabilityTier`, and `harnessCapabilities` fields in `conformance-manifest.yaml` | The descriptor-derived integration shape, tier, and digest |
 
 `yarn connectors:capabilities:check` is the CI drift check: it validates every descriptor,
 executes every referenced fixture, re-derives each tier, and fails if any generated artifact is
@@ -68,58 +68,32 @@ stale. `yarn connectors:check` runs it alongside the connector version check.
 1. **A capability is proven by fixture, not by inspection.** CI runs the fixture. Checking only
    that a named file exists would let an empty fixture claim a capability into existence.
 2. **The tier is derived, never authored.** `capabilityTier` comes from what the fixtures prove.
-   Claimed-but-unproven is worse than absent, because the UI renders controls that do nothing.
+   Asserted-but-unproven is worse than absent, because the UI renders controls that do nothing.
 3. **Every adapter ships the unbound-session negative fixture.** An unbound session in an
    unrelated directory must be untouched and unblocked by every registered integration. A side
-   effect the fixture records must be declared as a hazard with a tracker — recording the truth
-   is required; claiming silence you do not have is not.
+   effect, CLI invocation, or output makes the fixture fail; a hazard declaration cannot waive
+   this boundary.
 4. **A native session id binds nothing on its own.** It is a correlation alias. The verified
    channel/session credential is the authorization and mission scope, and the working directory
    is never a binding authority.
-5. **Adapters make no network call.** Translate, hand off to `ovld agent-session`, return.
-
-### The rendered agent-session hook
-
-Mechanical observe / decide / inject is **not a live Overlord connector path**. Latch v2
-removed the CLI event and send surface that previously backed it, and Overlord does not
-emulate that protocol. New adapters must not register `ovld agent-session` hooks. Channel 1
-stays on `ovld protocol` (follow-up capture, touched-file attribution, Stop delivery reminder).
-A future conversation surface must be a native Latch v2 Conversation Hub client. The rest of
-this section documents leftover CLI runtime and historical fixtures.
-
-Do not write a per-adapter shell script for agent-session traffic. One core script,
-`connectors/core/scripts/agent-session-hook.sh`, is rendered per adapter at `ovld agent-setup`
-time — declare the managed file as `scripts/agent-session-<action>.sh` in the manifest, and the
-installer substitutes both your adapter key and that **fixed action**:
-
-```bash
-[ -n "${OVERLORD_SESSION_CHANNEL_ID:-}" ] || exit 0
-command -v ovld >/dev/null 2>&1 || exit 0
-exec ovld agent-session event --agent claude --payload-file -
-```
-
-The first line is the scope gate, and it is in bash rather than in the CLI on purpose. An
-unbound session — someone's own agent in an unrelated directory on a machine that happens to
-have Overlord installed — must cost no process, no log line, and no measurable delay. A gate
-inside the CLI cannot deliver that, because reaching it already cost a process launch. The CLI
-applies the same gate again, since a check that can be skipped by invoking `ovld` directly is
-not a gate.
-
-The action being fixed at install time is the point, not a simplification. A single script that
-dispatched on `$1` would let whatever wrote the hook registration choose which CLI operation
-runs, and hook registrations are the least-reviewed configuration on a developer's machine. A
-`PostToolUse` registration renders an `event` script; a permission registration renders a
-`request` script; an inject registration renders an `inbox` script; none can become another.
-`event`, `request`, and `inbox` are the only three actions a managed path may name.
-
-The payload streams on stdin — not through a shell variable, which caps size and mangles NUL
-bytes, and not through argv, which is world-readable. For `request` and `inbox`, stdout and exit
-status pass through unchanged so the native decision or injection reaches the harness in its
-exact expected shape.
-
-Silence is the failure mode. A missing `ovld` exits `0` with no output, which for a decision
-hook means _no decision_ and therefore the harness's own prompt. No failure path may ever
-manufacture an approval.
+5. **Adapters make no network call.** Translate, hand off to the documented local `ovld`
+   command, and return.
+
+### Local mutation capture hooks
+
+A connector may invoke `ovld protocol capture-change` from a native post-mutation hook when
+`OVERLORD_OBJECTIVE_ID` is explicit in the launch environment. Mission scope is recovered from
+that objective's exact active-session binding; cwd never selects it. The hook must remain silent
+and perform no write when the objective id or `ovld` is unavailable. A directly named native edit
+path records objective-bound, non-exclusive `declared_edit`/`direct` evidence only after the
+connector-owned codec normalizes it as `file.edited`. The hook must pass its connector key through
+`--agent`; generic payload path parsing is forbidden. Codec-normalized read, search, and fetch
+callbacks are silent no-ops. Mutation-capable callbacks without a normalized edit path, plus shell,
+generic, unknown, and unmapped callbacks, record unavailable evidence health. Every hook
+registration must be backed by a `script-io` fixture, and every mutation window claim must be
+backed by a `mutation-window` fixture. Claude, Codex, and Cursor render this callback from
+`connectors/core/scripts/capture-change-hook.sh`; their adapter directories own only the native
+managed path and registration, not copies of the implementation.
 
 ### The event codec
 
@@ -144,6 +118,7 @@ events:
     toolPath: tool_name
     inputPath: tool_input
     fileEditKind: file.edited # a file-mutating tool becomes this kind instead
+    filePathPaths: [file_path] # bounded paths inside tool_input; no generic key fallback
 ```
 
 A codec can only say **where** native values live. It cannot name a destination the core
@@ -161,6 +136,9 @@ What each field feeds:
 - `inputPath` is never transmitted. It is reduced on the machine into an action, a subject, a
   bounded detail, and machine-derived risk markers. A tool with no formatter emits its name and
   the top-level **key names** of its input and nothing else.
+- `filePathPaths` is a bounded, ordered list of dotted paths relative to `inputPath`. It is
+  required with the literal `fileEditKind: file.edited`; only exact strings resolved through
+  those connector-owned paths may become mutation evidence. Core never guesses common path keys.
 - `promptPath` is the single deliberate exception: prompt text is persisted in full for bound
   sessions, because the activity feed exists to show it. Secret redaction still runs over it.
 
@@ -208,8 +186,9 @@ grants nothing on its own.
 | `native-payload`   | Asserts the shape of a recorded native harness payload (pure; no process started)                                                                                                                                                                                                                                |
 | `script-io`        | Runs a shipped adapter script in an isolated sandbox — own `HOME`, `TMPDIR`, cwd, and a `PATH` whose only `ovld` is a recording spy — and asserts exit status, stdout, stderr, every sandbox write, and every CLI invocation attempted                                                                           |
 | `source-guard`     | Asserts a repo file does or does not contain declared markers (how "this dangerous harness flag must stay unset" is enforced)                                                                                                                                                                                    |
-| `normalized-event` | Runs the shipped codec and the real core interpreter against a recorded native payload, asserts the exact normalized envelope, and asserts that named raw content (file bodies, transcript paths, credentials) appears nowhere in it. This is how an `observe.*` capability becomes provable rather than claimed |
+| `normalized-event` | Runs the shipped codec and the real core interpreter against a recorded native payload, asserts the exact normalized envelope, and asserts that named raw content (file bodies, transcript paths, credentials) appears nowhere in it. This is how an `observe.*` capability becomes provable rather than merely asserted |
 | `decision-codec`   | Runs the connector-owned request/decision declaration through the real pure interpreter, asserts the bounded redacted request card, and pins exact allow/deny/defer bytes. Required for supported callback/extension `decide.*` capabilities                                                                     |
+| `mutation-window`  | Executes recorded pre/post evidence semantics and derives whether the connector has a strict paired window, post-only evidence, or no post evidence. Declared classifications must match the derived result.                                                                                                  |
 
 Fixtures never reach the network.
 
@@ -217,7 +196,7 @@ Fixtures never reach the network.
 
 ## Adding a New Agent Connector
 
-A new connector is the primary sanctioned extension point for this module. It requires a conformance manifest but does not require a contract version bump unless it introduces new capability flags or hook types.
+A new connector is the primary sanctioned extension point for this module. It requires a conformance manifest but does not require a contract version bump unless it introduces a new closed capability id, integration shape, fixture kind, or protocol surface.
 
 **Steps:**
 
@@ -229,8 +208,8 @@ A new connector is the primary sanctioned extension point for this module. It re
    - Post meaningful progress updates
    - Use heartbeat during long work with no meaningful update
    - Ask exactly one blocking question and stop when blocked
-   - Deliver last with summary, artifacts, and change rationales
-   - Record all meaningful file changes as structured rationales
+   - Deliver last with a concise summary
+   - Keep objective-ledger capture local and independent of delivery
    - Use stdin/file flags for shell-special content
    - Do not continue after delivery unless explicitly asked
    - Run local repair before asking the user to fix setup
@@ -259,13 +238,15 @@ wrong and that is worth raising rather than working around.
 6. **Create `connectors/adapters/<agent-name>/conformance-manifest.yaml`** declaring:
 
    ```yaml
-   contractVersion: '0'
+   contractVersion: '116'
    componentType: connector
    componentKey: <agent-name>
-   capabilities:
-     - <only approved flags from contract/extension-points.yaml>
-   hookTypes:
-     - <only approved types from contract/extension-points.yaml>
+   label: <human-readable label>
+   connector:
+     agentIdentifier: <agent-name>
+     # integrationShape, capabilityTier, and harnessCapabilities are generated.
+     installPath: <default install root>
+     managedFiles: []
    ```
 
 7. **Validate**: run `ovld contract check connectors/adapters/<agent-name>/conformance-manifest.yaml`.
@@ -274,18 +255,18 @@ wrong and that is worth raising rather than working around.
 
 ---
 
-## Adding a New Hook Type
+## Adding a New Harness Event Path
 
-Hook types (`UserPromptSubmit`, `PermissionRequest`, `Stop`) are **stable interfaces** listed in `contract/extension-points.yaml`. Adding a new type requires a contract update first.
+Native hook names belong to the adapter. Contract changes are required only when the path adds a
+new normalized capability id, fixture kind, integration shape, or protocol surface.
 
 **Steps:**
 
-1. **Update `contract/extension-points.yaml`**: add the new hook name to `approvedHookTypes`.
-2. **Update `CONTRACT.md`** Connector Layer section with the new hook's event contract.
-3. **Increment the contract version** in `contract/components.yaml` and add a changelog entry to `CONTRACT.md`.
-4. **Implement the hook script** in `connectors/adapters/<agent-name>/hooks/` (or the connector-specific hook location).
-5. **Hook scripts must not write to the database directly** — use `ovld protocol hook-event` or `ovld protocol update` only.
-6. **Update affected conformance manifests** to declare the new hook type.
+1. **Record the native event** in an adapter fixture and map it to an existing normalized capability.
+2. **Implement the hook script** in the adapter's native hook location.
+3. **Keep it local and protocol-only** — use the documented `ovld protocol` command and never write to the database directly.
+4. **Prove behavior** with a `script-io` fixture and, for mutation evidence, a `mutation-window` fixture.
+5. **Update the descriptor** and run `yarn connectors:capabilities`.
 
 ---
 
@@ -302,16 +283,17 @@ The connector core is the set of canonical Markdown workflow instructions every
 
 ---
 
-## Adding a New Capability Flag
+## Adding a New Capability Id
 
-Capability flags (e.g. `sessionEventStream`, `nativeSessionBinding`) are listed in `contract/extension-points.yaml` under `approvedConnectorCapabilities`. New flags require a contract update.
+Normalized capability ids are closed values listed under `agentSession.capabilityIds` in
+`contract/extension-points.yaml` and in `contract/harness-capabilities.schema.yaml`.
 
 **Steps:**
 
-1. **Add the flag** to `approvedConnectorCapabilities` in `contract/extension-points.yaml`.
-2. **Add a description** of what the flag means in `CONTRACT.md` Connector Layer section.
-3. **Increment contract version** if the flag represents a breaking stable-interface change.
-4. **Declare the flag** in the conformance manifests of connectors that support it.
+1. **Add the id** to the contract vocabulary and descriptor schema in the same change.
+2. **Define its evidence semantics** and fixture requirements in the Connector Layer contract.
+3. **Increment the contract version** for the closed-vocabulary change.
+4. **Declare the id and evidence** in every descriptor, then regenerate manifests and catalogs.
 
 ---
 
@@ -341,7 +323,7 @@ No adapter implementations have landed yet. When they do, the Claude and Codex a
 ## Cross-Module Checklist
 
 - [ ] Read `CONTRACT.md` Connector Layer section
-- [ ] New hook type or capability flag → update `contract/extension-points.yaml` first
+- [ ] New capability id, integration shape, or fixture kind → update the contract vocabulary and descriptor schema first
 - [ ] Hook scripts → use `ovld protocol` commands only, no direct DB writes
 - [ ] Conformance manifest created and validated for every new connector
 - [ ] `ovld agent-setup <agent>` and `ovld doctor` behavior documented

package/dist/connectors/HARNESS-MATRIX.md

@@ -2,24 +2,23 @@
 
 # Harness capability matrix
 
-Generated from each adapter's `harness-capabilities.yaml`. This file replaces the
-hand-written capability table that used to live in `connectors/README.md`: prose maintained
-by hand alongside code drifts, and a matrix that is 60% accurate is worse than none because
-it is trusted.
+Generated from each adapter's fixture-backed `harness-capabilities.yaml` descriptor.
+The descriptor is the single authored capability source; the tier and every table cell are
+derived.
 
 Legend: ✅ supported (fixture-proven) · ⛔ unsupported (harness cannot) · 🚧 not-implemented
 (buildable, unbuilt) · ❓ unverified (find out first).
 
 ## Adapters
 
-| Adapter | Harness | Verified version | Shape | Tier | Binding | Decision hold |
-| --- | --- | --- | --- | --- | --- | --- |
-| [`antigravity`](adapters/antigravity/CAPABILITIES.md) | Antigravity CLI | `docs: Antigravity CLI v1.1.11 / Antigravity 2.0 v2.6.0` | `callback` | 0 (Unsupported) | ✅ supported | ❓ unverified |
-| [`claude`](adapters/claude/CAPABILITIES.md) | Claude Code | `2.1.227` | `callback` | 1 (Observational) | ✅ supported | ✅ supported |
-| [`codex`](adapters/codex/CAPABILITIES.md) | Codex CLI | `0.147.0` | `callback` | 1 (Observational) | ✅ supported | ✅ supported |
-| [`cursor`](adapters/cursor/CAPABILITIES.md) | Cursor Agent CLI | `2026.08.04-aaa8809` | `callback` | 1 (Observational) | ✅ supported | ✅ supported |
-| [`opencode`](adapters/opencode/CAPABILITIES.md) | OpenCode | — | `controlPlane` | 3 (Conversational) | ✅ supported | ✅ supported |
-| [`pi`](adapters/pi/CAPABILITIES.md) | Pi Coding Agent | `0.83.0` | `extension` | 1 (Observational) | ✅ supported | 🚧 not-implemented |
+| Adapter | Harness | Verified version | Shape | Tier | Mutation evidence | Binding | Decision hold |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| [`antigravity`](adapters/antigravity/CAPABILITIES.md) | Antigravity CLI | `docs: Antigravity CLI v1.1.11 / Antigravity 2.0 v2.6.0` | `callback` | 0 (Unsupported) | `unsupported` | ✅ supported | ❓ unverified |
+| [`claude`](adapters/claude/CAPABILITIES.md) | Claude Code | `2.1.227` | `callback` | 1 (Observational) | `post-only` | ✅ supported | ✅ supported |
+| [`codex`](adapters/codex/CAPABILITIES.md) | Codex CLI | `0.147.0` | `callback` | 1 (Observational) | `post-only` | ✅ supported | ✅ supported |
+| [`cursor`](adapters/cursor/CAPABILITIES.md) | Cursor Agent CLI | `2026.08.04-aaa8809` | `callback` | 1 (Observational) | `post-only` | ✅ supported | ✅ supported |
+| [`opencode`](adapters/opencode/CAPABILITIES.md) | OpenCode | — | `controlPlane` | 3 (Conversational) | `post-only` | ✅ supported | ✅ supported |
+| [`pi`](adapters/pi/CAPABILITIES.md) | Pi Coding Agent | `0.83.0` | `extension` | 1 (Observational) | `unsupported` | ✅ supported | 🚧 not-implemented |
 
 ## Capabilities
 
@@ -28,7 +27,7 @@ Legend: ✅ supported (fixture-proven) · ⛔ unsupported (harness cannot) ·
 | `observe.prompt` | ⛔ unsupported | ✅ supported | ✅ supported | ✅ supported | 🚧 not-implemented | ✅ supported |
 | `observe.toolCall` | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented |
 | `observe.toolResult` | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | ✅ supported | ✅ supported | 🚧 not-implemented |
-| `observe.fileEdit` | 🚧 not-implemented | ✅ supported | ✅ supported | ✅ supported | ✅ supported | 🚧 not-implemented |
+| `observe.fileEdit` | 🚧 not-implemented | ✅ supported | ✅ supported | ✅ supported | 🚧 not-implemented | 🚧 not-implemented |
 | `observe.sessionLifecycle` | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | ✅ supported | 🚧 not-implemented |
 | `decide.shell` | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | ✅ supported | 🚧 not-implemented |
 | `decide.mcp` | ❓ unverified | 🚧 not-implemented | 🚧 not-implemented | 🚧 not-implemented | ✅ supported | 🚧 not-implemented |
@@ -49,10 +48,8 @@ Legend: ✅ supported (fixture-proven) · ⛔ unsupported (harness cannot) ·
 | --- | --- | --- | --- | --- | --- |
 | `antigravity` | `outside-verification-survey` | medium | unverified | required | `agent-session-verify-antigravity` |
 | `claude` | `shipped-stop-hook-inert` | medium | verified | required | `agent-session-phase-3` |
-| `claude` | `unbound-session-side-effects` | medium | verified | required | `agent-session-phase-4` |
 | `claude` | `fork-and-subagent-identity-unknown` | medium | unverified | required | `taxonomy-7.6` |
 | `claude` | `subagent-stop-unregistered` | medium | verified | required | `coo:585` |
-| `claude` | `subagent-commits-escape-delivery-delta` | high | verified | required | `coo:585` |
 | `codex` | `prompt-and-agent-hook-handlers-inert` | low | verified | accepted | — |
 | `codex` | `hooks-version-and-platform-gate` | medium | verified | required | `agent-session-phase-4` |
 | `cursor` | `reads-claude-hook-config` | high | unverified | required | `taxonomy-7.1` |

package/dist/connectors/README.md

@@ -116,17 +116,22 @@ work as its own mission rather than folding it into a docs change:
 
 - `codex` ships no `commands/` while `claude` and `cursor` do, and `antigravity`
   achieves the same surface through `skills/*.md`. No harness constraint is recorded.
-- `codex` and `antigravity` register no `PostToolUse` or `Stop` hooks; whether their
-  harnesses expose the equivalent events is not documented here.
+- `antigravity` registers no post-tool mutation or Stop hook; whether its harness exposes
+  equivalent events is not documented here.
 
 ### Generated files
 
-The local MCP shim (`scripts/overlord-mcp.mjs`) is **generated**, not committed per
-adapter. One source — [`core/scripts/overlord-mcp.mjs`](core/scripts/overlord-mcp.mjs) —
-is rendered per adapter at `ovld agent-setup` time, substituting the adapter key into
-`DEFAULT_AGENT` and `serverInfo.name`. Edit the core file; there is no adapter copy to
-edit. The rendered artifact stays a standalone runnable `.mjs`, since harnesses start it
-directly from the install path.
+The local MCP shim and post-tool capture callback are **generated**, not committed per
+adapter. `ovld agent-setup` renders their core sources with the adapter key substituted:
+
+- [`core/scripts/overlord-mcp.mjs`](core/scripts/overlord-mcp.mjs) becomes the local MCP
+  shim for Codex, Cursor, and Antigravity.
+- [`core/scripts/capture-change-hook.sh`](core/scripts/capture-change-hook.sh) becomes
+  Claude's and Codex's `scripts/post-tool-use-hook.sh` and Cursor's
+  `hooks/overlord-post-tool-use.sh`.
+
+Edit the core source; there are no adapter copies. Installed paths and native hook
+registrations remain harness-specific.
 
 ### Documentation
 

package/dist/connectors/VERSION

@@ -1 +1 @@
-0.3.33
+0.3.36

package/dist/connectors/adapters/antigravity/CAPABILITIES.md

@@ -6,7 +6,7 @@
 
 **Harness version verified** `docs: Antigravity CLI v1.1.11 / Antigravity 2.0 v2.6.0` · **scheme** `opaque`
 
-**Descriptor digest** `e7313b23f98b6ed15a1a32849291a2a391523d4c06403bf395ecbcadfa3b11ac`
+**Descriptor digest** `c5686f1ab4c02e6bb90adeef83c6acd61703f3238be12618fed1e2b833636b2a`
 
 > The tier is derived from passing fixtures, never authored. `unsupported` means the harness
 > cannot do it — do not attempt it. `not-implemented` means it is buildable and unbuilt: that is
@@ -38,6 +38,18 @@ native id is a binding authority.
 
 The first-party docs define command-hook timeouts (30 seconds by default) and a synchronous PreToolUse `decision` response, but do not define timeout, crash, non-zero-exit, or malformed JSON fallback behavior. Keep the remote decision hold unverified until an installed binary exercises those failure paths.
 
+## Mutation-window evidence
+
+| Field | Value |
+| --- | --- |
+| Classification | `unsupported` |
+| Executable fixture | `fixtures/mutation-window-evidence.json` |
+
+No recorded PostToolUse payload or empirical agy hook execution proves a pair.
+
+File attribution may not be synthesized for this adapter. Missing mutation evidence is
+reported as unavailable health, never recovered from a worktree-wide delta.
+
 ## Capabilities
 
 | Capability | Status | Native | Evidence |
@@ -65,15 +77,9 @@ The first-party docs define command-hook timeouts (30 seconds by default) and a
 | Hazard | Severity | Verification | Mitigation | Tracked as |
 | --- | --- | --- | --- | --- |
 | `outside-verification-survey` | medium | unverified | required | `agent-session-verify-antigravity` |
-| `pre-tool-use-always-allows` | medium | verified | implemented | fixture `fixtures/unbound-session.json` |
-| `pre-invocation-has-no-prompt` | high | verified | implemented | fixture `fixtures/unbound-session.json` |
 
 **`outside-verification-survey`** — Antigravity was not part of the original harness verification survey. The current first-party docs now establish hook names, payload fields, and response shapes, but the `agy` binary was unavailable for empirical timeout, failure, resume, and headless tests. The connector must stay at its fixture-proven tier until those paths are exercised.
 
-**`pre-tool-use-always-allows`** — The former PreToolUse hook answered `{"allow_tool":true}` even though the first-party response contract requires `decision`, and called a nonexistent detached protocol command. It neither gated nor recorded reliably; changing it to native `decision: allow` would have silently bypassed the harness permission system, so the registration was removed.
-
-**`pre-invocation-has-no-prompt`** — The former follow-up hook guessed prompt/message/text/input fields on PreInvocation, but the first-party schema contains none of them. It could never capture a normal follow-up; reconstructing one from transcriptPath would violate the raw-transcript privacy boundary. The false followUpHook projection and the registration were removed.
-
 ## Native decision shape
 
 - **Codec** `antigravity`

package/dist/connectors/adapters/antigravity/README.md

@@ -51,7 +51,7 @@ ovld protocol help
 
 Inside Antigravity the plugin surfaces as:
 
-- skills → `overlord-mission`, `attach`, `connect`, `load`, `create`, `prompt`, `discuss-objective`, `add-objectives`, `record-work`, `spawn` (each markdown skill also auto-registers as a `/<name>` slash command)
+- skills → `overlord-mission`, `attach`, `connect`, `load`, `create`, `prompt`, `discuss-objective`, `add-objectives`, `record-work` (each markdown skill also auto-registers as a `/<name>` slash command)
 - MCP server → `overlord`
 
 Prompts generated by the runner should reference these names in bundle instruction mode.
@@ -71,10 +71,8 @@ This connector is intentionally reviewable against the four connector layers in
 
 - `plugin.json` — Antigravity plugin manifest (name, description, metadata).
 - `skills/overlord-mission/SKILL.md` — Antigravity adapter template with a `<!-- @connector-core -->` marker; setup interpolates shared core content at install time.
-- `skills/attach.md`, `skills/connect.md`, `skills/load.md`, `skills/create.md`, `skills/prompt.md`, `skills/discuss-objective.md`, `skills/add-objectives.md`, `skills/record-work.md`, `skills/spawn.md` — one skill per protocol operation; Antigravity auto-registers each as a `/<name>` slash command.
+- `skills/attach.md`, `skills/connect.md`, `skills/load.md`, `skills/create.md`, `skills/prompt.md`, `skills/discuss-objective.md`, `skills/add-objectives.md`, `skills/record-work.md` — one skill per protocol operation; Antigravity auto-registers each as a `/<name>` slash command.
 - `hooks.json` — intentionally empty until a fixture-proven agent-session callback is installed.
-  The former compatibility hooks were removed because the documented native payloads cannot
-  support their claimed behavior safely.
 - `mcp_config.json` + `scripts/overlord-mcp.mjs` — MCP bridge to common `ovld protocol` operations. The shim is **generated**: it is rendered from `connectors/core/scripts/overlord-mcp.mjs` at setup time with the adapter key substituted, and there is no copy in this directory to edit.
 - `conformance-manifest.yaml` — connector conformance declaration for the Overlord contract.
 - `prompt-wrapper.md` — Antigravity launch guidance.
@@ -89,21 +87,11 @@ The shared Connector Core source lives at `connectors/core/overlord-mission`. `o
 
 See the [adapter capability matrix](../../README.md#adapter-capability-matrix) for how this compares across adapters.
 
-### Notes on the Antigravity hook mapping
+### Native evidence status
 
-Antigravity's native hook events are `PreToolUse`, `PostToolUse`, `PreInvocation`, `PostInvocation`, and `Stop` — it has no event literally named `UserPromptSubmit` or `PermissionRequest` the way Claude Code and Codex do. This adapter maps Antigravity's native events onto Overlord's canonical hook-type vocabulary the same way the Cursor adapter maps `beforeSubmitPrompt` onto `UserPromptSubmit`:
-
-- `PreInvocation` receives invocation counters and common metadata, including `conversationId`,
-  but no submitted prompt. It therefore cannot implement canonical `UserPromptSubmit` capture
-  without reading the raw transcript, which the connector privacy contract forbids.
-- `PreToolUse` receives `toolCall`, `stepIdx`, and `conversationId`, and requires a `decision`
-  response (`allow`, `deny`, `ask`, `force_ask`, or `deny_unless_prior_grant`). The former
-  compatibility hook emitted the unrelated `allow_tool` field and called a nonexistent protocol
-  command. It has been removed rather than replaced with an unconditional native `allow`, which
-  would bypass Antigravity's own permission prompt.
-
-The descriptor records the first-party schema and keeps the decision capabilities unimplemented
-until a real installed `agy` binary can exercise the exact failure and timeout behavior through
-the channel-scoped agent-session runtime.
+The descriptor records Antigravity's first-party event schema and keeps decision capabilities
+unimplemented until a real installed `agy` binary can exercise exact decision and timeout
+behavior through the channel-scoped agent-session runtime. No mutation attribution is recorded:
+the adapter has no fixture-proven completion hook.
 
 No `Stop` hook or permission-rule file ships yet — Antigravity's pending-delivery check and any declarative auto-approval mechanism should be added once their concrete formats are confirmed, matching the "can be implemented after local MVP" note in `connectors/docs/05-connectors-and-agent-plugins.md`.

package/dist/connectors/adapters/antigravity/conformance-manifest.yaml

@@ -1,4 +1,4 @@
-contractVersion: "52"
+contractVersion: "117"
 componentType: connector
 componentKey: antigravity
 label: "Antigravity Connector"
@@ -8,17 +8,13 @@ connector:
   agentIdentifier: antigravity
   # ── GENERATED: do not edit by hand ───────────────────────────────────────────
   # Projected from connectors/adapters/antigravity/harness-capabilities.yaml by `yarn connectors:capabilities`.
-  # `capabilities` and `hookTypes` are the DEPRECATED hook-named projection, retained for
-  # one release. `harnessCapabilities` is the authoritative source.
+  # The harness descriptor and its executable fixtures are the only capability source.
   integrationShape: callback
   capabilityTier: 0
   harnessCapabilities:
     path: connectors/adapters/antigravity/harness-capabilities.yaml
     schemaVersion: 1
-    digest: "e7313b23f98b6ed15a1a32849291a2a391523d4c06403bf395ecbcadfa3b11ac"
-  capabilities:
-    - contextFilePrompt
-    - slashCommands
+    digest: "c5686f1ab4c02e6bb90adeef83c6acd61703f3238be12618fed1e2b833636b2a"
   # ── END GENERATED ────────────────────────────────────────────────────────────
   installPath: "~/.gemini/antigravity-cli/plugins/overlord"
   managedFiles:
@@ -38,7 +34,6 @@ connector:
     - "skills/add-objectives.md"
     - "skills/load.md"
     - "skills/record-work.md"
-    - "skills/spawn.md"
     - "skills/overlord-mission/SKILL.md"
     - "skills/overlord-mission/reference/cli.md"
     - "skills/overlord-mission/reference/record-work.md"

package/dist/connectors/adapters/antigravity/fixtures/mutation-window-evidence.json

@@ -0,0 +1,15 @@
+{
+  "fixtureVersion": 1,
+  "kind": "mutation-window",
+  "description": "Antigravity has a first-party PreToolUse example but no recorded completion payload or runtime evidence.",
+  "classification": "unsupported",
+  "reason": "No recorded PostToolUse payload or empirical agy hook execution proves completion-side or paired evidence.",
+  "preFixture": "fixtures/official-pre-tool-use.json",
+  "proof": {
+    "pre": {
+      "session": "conversationId",
+      "workspace": "workspacePaths.0",
+      "tool": "toolCall.name"
+    }
+  }
+}

package/dist/connectors/adapters/antigravity/harness-capabilities.yaml

@@ -7,7 +7,7 @@
 # capabilities begin conservatively as `unverified` rather than inherited from a harness that
 # looks similar. Omitting a shipped connector from the generated matrix would make it less
 # truthful than the hand-written table it replaces; guessing its capabilities would be worse.
-# No UI control may be inferred from the agent name — only from a proven capability.
+# No UI control may be derived from the agent name — only from a proven capability.
 schemaVersion: 1
 adapter: antigravity
 codec: antigravity
@@ -40,6 +40,11 @@ decisionHold:
     JSON fallback behavior. Keep the remote decision hold unverified until an installed binary
     exercises those failure paths.
 
+mutationHooks:
+  classification: unsupported
+  fixture: fixtures/mutation-window-evidence.json
+  reason: No recorded PostToolUse payload or empirical agy hook execution proves a pair.
+
 capabilities:
   observe.prompt:
     status: unsupported
@@ -121,27 +126,6 @@ hazards:
     verification: unverified
     mitigation: required
     trackedAs: agent-session-verify-antigravity
-  - id: pre-tool-use-always-allows
-    severity: medium
-    summary: >-
-      The former PreToolUse hook answered `{"allow_tool":true}` even though the first-party
-      response contract requires `decision`, and called a nonexistent detached protocol command.
-      It neither gated nor recorded reliably; changing it to native `decision: allow` would have
-      silently bypassed the harness permission system, so the registration was removed.
-    verification: verified
-    mitigation: implemented
-    fixture: fixtures/unbound-session.json
-  - id: pre-invocation-has-no-prompt
-    severity: high
-    summary: >-
-      The former follow-up hook guessed prompt/message/text/input fields on PreInvocation, but
-      the first-party schema contains none of them. It could never capture a normal follow-up;
-      reconstructing one from transcriptPath would violate the raw-transcript privacy boundary.
-      The false followUpHook projection and the registration were removed.
-    verification: verified
-    mitigation: implemented
-    fixture: fixtures/unbound-session.json
-
 decisionShape:
   codec: antigravity
   neverSend: [allow_tool, hookSpecificOutput, permissionDecision, permission]
@@ -152,9 +136,3 @@ decisionShape:
     no failure path may manufacture `decision: allow`.
 
 unboundSessionFixture: fixtures/unbound-session.json
-
-legacy:
-  capabilities:
-    - contextFilePrompt
-    - slashCommands
-  hookTypes: []

package/dist/connectors/adapters/antigravity/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://antigravity.google/schemas/v1/plugin.json",
   "name": "overlord",
-  "version": "0.3.33",
+  "version": "0.3.36",
   "description": "Chat-driven access to Overlord mission protocol workflows through skills and MCP.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/antigravity/skills/record-work.md

@@ -4,13 +4,13 @@ description: Record completed-from-chat work as a mission in review, with a feed
 
 Immediately record the work you just completed in this chat as a new Overlord mission via `ovld protocol record-work`. No agent session is opened — the work is already done.
 
-This creates a mission with one completed objective, records the file changes with rationales, lands it in the review column, and runs the standard Gemini delivery summary.
+This creates a mission with one completed objective, lands it in the review column, and runs the standard Gemini delivery summary.
 
 Synthesize from the current conversation:
 - `objective`: what was asked / what was done (1-3 sentences).
 - `summary`: reviewer-friendly narrative of what changed and why.
-- `changeRationales`: one entry per meaningful git-tracked file change (`file_path`, `label`, `summary`, `why`, `impact`, optional `hunks`). Use `git status` and `git diff` to enumerate changed files. Every listed file shows as "covered" in review.
-- `changedFiles` (optional): touched files without a full rationale (`filePath`, optional `vcsStatus`).
+- `changeRationales` (optional): reviewer annotations for changes whose reason is not obvious (`filePath`, `label`, `summary`, `why`, `impact`, optional `hunks`).
+- `changedFiles` (optional, `record-work` only): files known from this completed chat work that have no rationale. Each entry is an object with canonical repository-relative `filePath` and optional `vcsStatus`; never infer ownership from a shared-worktree-wide status or diff.
 - `title` (optional): mission title; defaults to a title derived from the objective.
 - `artifacts` (optional): `next_steps`, `test_results`, `decision`, `note`, `url`.
 
@@ -19,7 +19,7 @@ If a command argument is present, treat it as additional context to weave into t
 Run:
 `ovld protocol record-work --agent antigravity --payload-file -`
 
-and stream a JSON object `{ "objective": "...", "summary": "...", "artifacts": [...], "changeRationales": [...] }` on stdin via a single-quoted heredoc (`<<'EOF'`).
+and stream a JSON object `{ "objective": "...", "summary": "...", "artifacts": [...], "changeRationales": [...], "changedFiles": [...] }` on stdin via a single-quoted heredoc (`<<'EOF'`).
 
 After the command succeeds, report the new `MISSION_ID`.
 

package/dist/connectors/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord",
-  "version": "0.3.33",
+  "version": "0.3.36",
   "description": "Overlord mission protocol workflow for Claude Code — attach/update/ask/deliver, slash commands, and hook-driven activity capture.",
   "author": {
     "name": "Cooperativ",