phasegate 0.335.0 → 0.341.0

package/scripts/harness/biome-ast-engine/infrastructure/adapters/biome-cli-executor-adapter.ts

@@ -4,6 +4,8 @@
  */
 
 import { spawnSync } from 'node:child_process';
+import { accessSync, constants, statSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
 import type { FilePath } from '../../domain/value-objects/file-path.js';
 import type { BiomeExecutorPort } from '../../domain/ports/biome-executor-port.js';
 
@@ -34,7 +36,25 @@ export class BiomeCliExecutorAdapter implements BiomeExecutorPort {
 
   constructor(deps: BiomeCliExecutorAdapterDeps) {
     this.cwd = deps.cwd;
-    this.biomeBin = deps.biomeBin ?? 'npx';
+    this.biomeBin = deps.biomeBin ?? this.findLocalBin(deps.cwd) ?? 'npx';
+  }
+
+  private findLocalBin(cwd: string): string | undefined {
+    // .cmd execution has different quoting/shell requirements; retain its old route.
+    if (process.platform === 'win32') return undefined;
+    let directory = resolve(cwd);
+    while (true) {
+      const candidate = join(directory, 'node_modules', '.bin', 'biome');
+      try {
+        accessSync(candidate, constants.X_OK);
+        if (statSync(candidate).isFile()) return candidate;
+      } catch {
+        // Match local npm-bin lookup from the working directory toward the root.
+      }
+      const parent = dirname(directory);
+      if (parent === directory) return undefined;
+      directory = parent;
+    }
   }
 
   async executeCheck(files: readonly FilePath[]): Promise<void> {

package/scripts/harness/biome-ast-engine/infrastructure/adapters/typescript-source-module-analyzer-adapter.ts

@@ -2,6 +2,7 @@
  * @layer infrastructure
  * @unit biome-ast-engine
  * @work-item-id WI-109
+ * @work-item-id WI-220
  */
 
 import * as ts from 'typescript';
@@ -74,6 +75,10 @@ export class TypeScriptSourceModuleAnalyzerAdapter implements SourceModuleAnalyz
       moduleResolution: ts.ModuleResolutionKind.Node16,
       allowJs: false,
       noEmit: true,
+      // Snapshots use syntax only. The workspace scanner already supplies every
+      // graph node; libraries and transitive imports are not snapshot inputs.
+      noLib: true,
+      noResolve: true,
     });
 
     const snapshots: SourceModuleSnapshot[] = [];

package/scripts/harness/ci-governance/domain/value-objects/integrity-target.ts

@@ -1,5 +1,6 @@
 // @unit ci-governance
 // @layer domain
+// @work-item-id WI-384
 
 export interface IntegrityTargetProps {
   readonly include: readonly string[];
@@ -31,6 +32,7 @@ export class IntegrityTarget {
         "skills/*/SKILL.md",
         ".claude/settings.json",
         ".claude/scripts/*.sh",
+        ".codex/hooks.json",
         ".husky/*",
         "docs/templates/agent-context/**",
       ],

package/scripts/harness/config-foundation/infrastructure/schemas/harness-config-v3.schema.json

@@ -685,6 +685,21 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "preToolUse": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "dependencyReflection": { "type": "string", "enum": ["advisory", "enforce"] }
+          }
+        },
+        "postToolUse": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "enabled": { "type": "boolean" }
+          }
+        },
         "stopHook": {
           "type": "object",
           "additionalProperties": false,

package/scripts/harness/config-foundation/infrastructure/validators/ajv-config-schema-validator.ts

@@ -109,13 +109,16 @@ function toHarnessError(error: ErrorObject): HarnessErrorWithPath {
   });
 }
 
-const validateSchemaV2 = createValidateFunction(SCHEMA_V2_PATH);
-const validateSchemaV3 = createValidateFunction(SCHEMA_V3_PATH);
+// Compile only the selected schema, once per module. Failed compilation is not cached.
+let validateSchemaV2: ValidateFunction | undefined;
+let validateSchemaV3: ValidateFunction | undefined;
 
 export class AjvConfigSchemaValidator implements ConfigSchemaValidatorPort {
   validate(document: unknown): readonly HarnessError[] {
     const schemaVersion = detectSchemaVersion(document);
-    const validateSchema = schemaVersion === 'v3' ? validateSchemaV3 : validateSchemaV2;
+    const validateSchema = schemaVersion === 'v3'
+      ? (validateSchemaV3 ??= createValidateFunction(SCHEMA_V3_PATH))
+      : (validateSchemaV2 ??= createValidateFunction(SCHEMA_V2_PATH));
     const valid = validateSchema(document);
 
     if (valid) {

package/scripts/harness/harness-api/domain/ports/biome-lint-port.ts

@@ -1,10 +1,11 @@
+// @unit harness-api
 // @layer domain
 // biome-lint-port.ts
 
 import type { HarnessError } from '../value-objects/harness-api-response.js';
 
 export interface BiomeLintPort {
-  runLint(): Promise<{
+  runLint(reportTargets?: readonly string[]): Promise<{
     passed: boolean;
     errors: HarnessError[];
     warnings: HarnessError[];

package/scripts/harness/harness-api/domain/services/command-dispatch-service.ts

@@ -312,7 +312,18 @@ export class CommandDispatchService {
       }
 
       case "phasegate:lint": {
-        const lintResult = await this.ports.biomeLintPort.runLint();
+        const target = typeof _flags.target === 'string' && _flags.target.length > 0 ? _flags.target : undefined;
+        let reportTargets: readonly string[] | undefined = target === undefined ? undefined : [target];
+        if (args.reportTargets !== undefined) {
+          const parsed: unknown = JSON.parse(args.reportTargets);
+          if (!Array.isArray(parsed) || !parsed.every((item): item is string => typeof item === 'string' && item.length > 0)) {
+            throw new Error('lint reportTargets must be an array of non-empty paths');
+          }
+          reportTargets = parsed;
+        }
+        const lintResult = reportTargets === undefined
+          ? await this.ports.biomeLintPort.runLint()
+          : await this.ports.biomeLintPort.runLint(reportTargets);
         if (lintResult.passed) {
           const r = HarnessApiResponse.pass({ ...summary, passed: 1 });
           return { status: "pass", errors: [], summary: r.summary, data: undefined, exitCode: 0 };

package/scripts/harness/harness-api/infrastructure/adapters/biome-ast-engine-lint-adapter.ts

@@ -1,3 +1,4 @@
+// @unit harness-api
 // @layer infrastructure
 // biome-ast-engine-lint-adapter.ts — BiomeAstEngineLintAdapter
 // Wave 2完了後にリアル実装へ差し替え（旧: @stub: wave2-pending）
@@ -5,6 +6,7 @@
 
 import type { BiomeLintPort } from '../../domain/ports/biome-lint-port.js';
 import type { HarnessError } from '../../domain/value-objects/harness-api-response.js';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
 
 interface RuleViolation {
   filePath: string;
@@ -37,7 +39,7 @@ function violationToHarnessError(v: RuleViolation): HarnessError {
 export class BiomeAstEngineLintAdapter implements BiomeLintPort {
   private readonly stub: IBiomeAstEngineStub;
 
-  constructor(stub?: IBiomeAstEngineStub, rootDir = process.cwd()) {
+  constructor(stub?: IBiomeAstEngineStub, private readonly rootDir = process.cwd()) {
     this.stub = stub ?? BiomeAstEngineLintAdapter.createRealImpl(rootDir);
   }
 
@@ -62,12 +64,18 @@ export class BiomeAstEngineLintAdapter implements BiomeLintPort {
     };
   }
 
-  async runLint(): Promise<{ passed: boolean; errors: HarnessError[]; warnings: HarnessError[] }> {
+  async runLint(reportTargets?: readonly string[]): Promise<{ passed: boolean; errors: HarnessError[]; warnings: HarnessError[] }> {
+    // Always analyze the complete graph; targets restrict reporting, never analysis.
     const result = await this.stub.runLint();
+    const targets = reportTargets?.map((target) => resolve(this.rootDir, target)) ?? [];
     const errors: HarnessError[] = [];
     const warnings: HarnessError[] = [];
 
     for (const v of result.violations) {
+      if (v.filePath && targets.length > 0 && !targets.some((target) => {
+        const rel = relative(target, resolve(this.rootDir, v.filePath));
+        return rel === '' || (rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+      })) continue;
       const harnessError = violationToHarnessError(v);
       if (v.severity === 'warning') {
         warnings.push(harnessError);

package/scripts/harness/installation/application/bundled-skill-selection.ts

@@ -1,8 +1,10 @@
 // @unit installation
 // @layer application
 // @work-item-id WI-216
+// @work-item-id WI-223
 
-export type SkillSet = "core" | "all";
+export type SkillSet = "core" | "all" | "consumer";
+export type SkillCategory = "core" | "aidlc" | "utility" | "guidance";
 
 const CORE_SKILLS = [
   "cascade-updater",
@@ -37,7 +39,31 @@ const AIDLC_SKILLS = [
 const UTILITY_SKILLS = ["codex-delegator", "skill-creator"] as const;
 const GUIDANCE_SKILLS = ["phasegate-toolkit-guide", "phasegate-config-doctor", "release-publisher"] as const;
 
+export const SKILL_CATEGORIES: Record<SkillCategory, readonly string[]> = {
+  core: CORE_SKILLS,
+  aidlc: AIDLC_SKILLS,
+  utility: UTILITY_SKILLS,
+  guidance: GUIDANCE_SKILLS,
+};
+
+export function isSkillSet(value: unknown): value is SkillSet {
+  return value === "core" || value === "all" || value === "consumer";
+}
+
+export function resolveInstalledSkillSet(metadata: string | null): SkillSet {
+  try {
+    const value: unknown = JSON.parse(metadata ?? "null");
+    if (typeof value === "object" && value !== null && "skillSet" in value && isSkillSet(value.skillSet)) {
+      return value.skillSet;
+    }
+  } catch { /* Legacy installations without readable metadata retain the all set. */ }
+  return "all";
+}
+
 export function getBundledSkillsForSet(skillSet: SkillSet): string[] {
   if (skillSet === "core") return [...CORE_SKILLS];
-  return [...CORE_SKILLS, ...AIDLC_SKILLS, ...UTILITY_SKILLS, ...GUIDANCE_SKILLS];
+  const all = [...CORE_SKILLS, ...AIDLC_SKILLS, ...UTILITY_SKILLS, ...GUIDANCE_SKILLS];
+  return skillSet === "consumer"
+    ? all.filter(name => name !== "release-publisher" && name !== "skill-creator")
+    : all;
 }

package/scripts/harness/installation/application/checks/antigravity-hook-missing-check.ts

@@ -0,0 +1,79 @@
+// @unit installation
+// @layer application
+// @work-item-id WI-385
+
+import type { DiagnosticFinding } from "../../domain/diagnostic-finding.js";
+import type { HeuristicCheck } from "../../domain/ports/heuristic-check.js";
+import type { FileInspectorPort } from "../ports/file-inspector-port.js";
+import { createFinding, projectPath } from "./check-utils.js";
+
+const REQUIRED_TOOLS = ["write_to_file", "replace_file_content", "multi_replace_file_content", "run_command"] as const;
+const REPAIR_HINT =
+  "Run npx phasegate reconcile --apply. Antigravity hard blocking is supported for the agy CLI surface; IDE/desktop must rely on the L2 pre-commit backstop.";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function matches(matcher: unknown, tool: string): boolean {
+  if (typeof matcher !== "string") return false;
+  try {
+    return new RegExp(matcher).test(tool);
+  } catch {
+    return false;
+  }
+}
+
+function phasegateCommands(entry: Record<string, unknown>): Record<string, unknown>[] {
+  if (!Array.isArray(entry.hooks)) return [];
+  return entry.hooks.filter(
+    (hook): hook is Record<string, unknown> =>
+      isRecord(hook) && typeof hook.command === "string" && hook.command.includes("phasegate hook pre-tool-use"),
+  );
+}
+
+export class AntigravityHookMissingCheck implements HeuristicCheck {
+  readonly checkId = "antigravity-hook-missing" as const;
+  private readonly target = ".agents/hooks.json";
+
+  async run(projectRoot: string, inspector: FileInspectorPort): Promise<DiagnosticFinding | null> {
+    const absolutePath = projectPath(projectRoot, this.target);
+    if (!(await inspector.exists(absolutePath))) return this.finding("named definition missing", "mechanical");
+    const json = await inspector.readJson(absolutePath);
+    if (json === null) return this.finding("JSON parse failed", "manual");
+    const named = isRecord(json) && isRecord(json["phasegate-gate"]) ? json["phasegate-gate"] : undefined;
+    const entries = named !== undefined && Array.isArray(named.PreToolUse) ? named.PreToolUse : [];
+    const phasegateEntries = entries.filter(
+      (entry): entry is Record<string, unknown> => isRecord(entry) && phasegateCommands(entry).length > 0,
+    );
+    const missing = REQUIRED_TOOLS.filter(
+      (tool) => !phasegateEntries.some((entry) => matches(entry.matcher, tool)),
+    );
+    const invalidType = phasegateEntries.some((entry) =>
+      phasegateCommands(entry).some((hook) => hook.type !== "command"),
+    );
+    const invalidTimeout = phasegateEntries.some((entry) =>
+      phasegateCommands(entry).some((hook) => hook.timeout !== 30),
+    );
+    if (missing.length === 0 && phasegateEntries.length > 0 && !invalidType && !invalidTimeout) return null;
+    const details = [
+      ...missing.map((tool) => `matcher:${tool}`),
+      ...(phasegateEntries.length === 0 ? ["command"] : []),
+      ...(invalidType ? ["type=command"] : []),
+      ...(invalidTimeout ? ["timeout=30"] : []),
+    ];
+    const hasUserDefinitions = isRecord(json) && Object.keys(json).some((key) => key !== "phasegate-gate");
+    return this.finding(details.join(", "), hasUserDefinitions ? "ai-assisted" : "mechanical");
+  }
+
+  private finding(detail: string, repairMode: "mechanical" | "manual" | "ai-assisted"): DiagnosticFinding {
+    return createFinding({
+      checkId: this.checkId,
+      severity: "red",
+      target: this.target,
+      message: `.agents/hooks.json の Antigravity hook wiring が古いか不足しています: ${detail}`,
+      repairMode,
+      repairHint: REPAIR_HINT,
+    });
+  }
+}

package/scripts/harness/installation/application/checks/check-utils.ts

@@ -6,7 +6,7 @@
 // @work-item-id WI-216
 
 import { join } from "node:path";
-import { getBundledSkillsForSet, type SkillSet } from "../bundled-skill-selection.js";
+import { getBundledSkillsForSet, resolveInstalledSkillSet } from "../bundled-skill-selection.js";
 import type { CheckId } from "../../domain/check-id.js";
 import { DiagnosticFinding, type DiagnosticSeverity } from "../../domain/diagnostic-finding.js";
 import type { RepairMode } from "../../domain/repair-mode.js";
@@ -73,7 +73,7 @@ export function skillDirectoryLooksValid(files: readonly string[]): boolean {
 }
 
 export function phasegateSkillDirectoryLooksComplete(files: readonly string[], metadata: string | null): boolean {
-  const skillSet: SkillSet = metadata?.includes('"skillSet": "core"') ? "core" : "all";
+  const skillSet = resolveInstalledSkillSet(metadata);
   const expectedSkills = getBundledSkillsForSet(skillSet);
   return expectedSkills.every((skill) => files.some((file) => {
     const normalized = file.replaceAll("\\", "/");

package/scripts/harness/installation/application/checks/codex-hook-missing-check.ts

@@ -1,11 +1,60 @@
 // @unit installation
 // @layer application
 // @work-item-id WI-145
+// @work-item-id WI-384
 
-import type { FileInspectorPort } from "../ports/file-inspector-port.js";
-import type { HeuristicCheck } from "../../domain/ports/heuristic-check.js";
 import type { DiagnosticFinding } from "../../domain/diagnostic-finding.js";
-import { containsPhasegateHook, createFinding, hasUserCustomization, projectPath } from "./check-utils.js";
+import type { HeuristicCheck } from "../../domain/ports/heuristic-check.js";
+import type { FileInspectorPort } from "../ports/file-inspector-port.js";
+import { containsPhasegateHook, createFinding, projectPath } from "./check-utils.js";
+
+const REQUIRED_MATCHER_TOKENS = ["Bash", "apply_patch"] as const;
+const REPAIR_HINT =
+  "Run npx phasegate reconcile --apply, then open Codex /hooks and trust the updated hook definition hash (Codex CLI >= 0.124.0).";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function phasegateCommandFor(entry: unknown, command: "pre-tool-use" | "post-tool-use"): boolean {
+  if (!isRecord(entry) || !Array.isArray(entry.hooks)) return false;
+  return entry.hooks.some((hook) => {
+    if (!isRecord(hook) || typeof hook.command !== "string") return false;
+    return hook.command.includes(`phasegate hook ${command}`);
+  });
+}
+
+function matcherTokens(entry: unknown): ReadonlySet<string> {
+  if (!isRecord(entry) || typeof entry.matcher !== "string") return new Set();
+  return new Set(entry.matcher.match(/[A-Za-z_][A-Za-z0-9_]*/g) ?? []);
+}
+
+function missingForEvent(
+  hooks: Record<string, unknown>,
+  event: "PreToolUse" | "PostToolUse",
+  command: "pre-tool-use" | "post-tool-use",
+): string[] {
+  const entries = Array.isArray(hooks[event]) ? hooks[event] : [];
+  const phasegateEntries = entries.filter((entry) => phasegateCommandFor(entry, command));
+  if (phasegateEntries.length === 0) return [`${event}:phasegate-command`];
+  const missing: string[] = [];
+  for (const token of REQUIRED_MATCHER_TOKENS) {
+    if (!phasegateEntries.some((entry) => matcherTokens(entry).has(token))) {
+      missing.push(`${event}:${token}`);
+    }
+  }
+  return missing;
+}
+
+function hasUserHookEntry(json: Record<string, unknown>): boolean {
+  if (Array.isArray(json.hooks)) {
+    return json.hooks.some((entry) => !containsPhasegateHook(entry));
+  }
+  if (!isRecord(json.hooks)) return false;
+  return Object.values(json.hooks).some(
+    (entries) => Array.isArray(entries) && entries.some((entry) => !containsPhasegateHook(entry)),
+  );
+}
 
 export class CodexHookMissingCheck implements HeuristicCheck {
   readonly checkId = "codex-hook-missing" as const;
@@ -32,13 +81,28 @@ export class CodexHookMissingCheck implements HeuristicCheck {
         repairMode: "manual",
       });
     }
-    if (containsPhasegateHook(json)) return null;
+    if (!isRecord(json) || !isRecord(json.hooks)) {
+      return createFinding({
+        checkId: this.checkId,
+        severity: "red",
+        target: this.target,
+        message: ".codex/hooks.json に phasegate hook が登録されていません",
+        repairMode: isRecord(json) && hasUserHookEntry(json) ? "ai-assisted" : "mechanical",
+        repairHint: REPAIR_HINT,
+      });
+    }
+    const missing = [
+      ...missingForEvent(json.hooks, "PreToolUse", "pre-tool-use"),
+      ...missingForEvent(json.hooks, "PostToolUse", "post-tool-use"),
+    ];
+    if (missing.length === 0) return null;
     return createFinding({
       checkId: this.checkId,
       severity: "red",
       target: this.target,
-      message: ".codex/hooks.json に phasegate hook が登録されていません",
-      repairMode: hasUserCustomization(json) ? "ai-assisted" : "mechanical",
+      message: `.codex/hooks.json の Codex hook wiring が古いか不足しています: ${missing.join(", ")}`,
+      repairMode: hasUserHookEntry(json) ? "ai-assisted" : "mechanical",
+      repairHint: REPAIR_HINT,
     });
   }
 }

package/scripts/harness/installation/application/checks/grok-hook-missing-check.ts

@@ -0,0 +1,79 @@
+// @unit installation
+// @layer application
+// @work-item-id WI-385
+
+import type { DiagnosticFinding } from "../../domain/diagnostic-finding.js";
+import type { HeuristicCheck } from "../../domain/ports/heuristic-check.js";
+import type { FileInspectorPort } from "../ports/file-inspector-port.js";
+import { containsPhasegateHook, createFinding, projectPath } from "./check-utils.js";
+
+const REQUIRED_TOOLS = ["Bash", "Write", "Edit", "apply_patch"] as const;
+const REPAIR_HINT =
+  "Run npx phasegate reconcile --apply, confirm every phasegate PreToolUse command has timeout 30, then use grok inspect and /hooks to verify trust (--trust or /hooks-trust).";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function matcherMatches(entry: Record<string, unknown>, tool: string): boolean {
+  if (typeof entry.matcher !== "string") return false;
+  try {
+    return new RegExp(`^(?:${entry.matcher})$`).test(tool);
+  } catch {
+    return false;
+  }
+}
+
+function phasegateCommands(entry: Record<string, unknown>): Record<string, unknown>[] {
+  if (!Array.isArray(entry.hooks)) return [];
+  return entry.hooks.filter(
+    (hook): hook is Record<string, unknown> =>
+      isRecord(hook) && typeof hook.command === "string" && hook.command.includes("phasegate hook pre-tool-use"),
+  );
+}
+
+function hasUserHook(entries: readonly unknown[]): boolean {
+  return entries.some((entry) => !containsPhasegateHook(entry));
+}
+
+export class GrokHookMissingCheck implements HeuristicCheck {
+  readonly checkId = "grok-hook-missing" as const;
+  private readonly target = ".claude/settings.json";
+
+  async run(projectRoot: string, inspector: FileInspectorPort): Promise<DiagnosticFinding | null> {
+    const absolutePath = projectPath(projectRoot, this.target);
+    if (!(await inspector.exists(absolutePath))) return this.finding("compatible settings missing", "mechanical");
+    const json = await inspector.readJson(absolutePath);
+    if (json === null) return this.finding("JSON parse failed", "manual");
+    const hooks = isRecord(json) && isRecord(json.hooks) ? json.hooks : undefined;
+    const entries = hooks !== undefined && Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : [];
+    const phasegateEntries = entries.filter(
+      (entry): entry is Record<string, unknown> => isRecord(entry) && phasegateCommands(entry).length > 0,
+    );
+    const missing = REQUIRED_TOOLS.filter((tool) => !phasegateEntries.some((entry) => matcherMatches(entry, tool)));
+    const invalidType = phasegateEntries.some((entry) =>
+      phasegateCommands(entry).some((hook) => hook.type !== "command"),
+    );
+    const invalidTimeout = phasegateEntries.some((entry) =>
+      phasegateCommands(entry).some((hook) => hook.timeout !== 30),
+    );
+    if (missing.length === 0 && !invalidType && !invalidTimeout) return null;
+    const details = [
+      ...missing.map((tool) => `matcher:${tool}`),
+      ...(invalidType ? ["type=command"] : []),
+      ...(invalidTimeout ? ["timeout=30"] : []),
+    ];
+    return this.finding(details.join(", "), hasUserHook(entries) ? "ai-assisted" : "mechanical");
+  }
+
+  private finding(detail: string, repairMode: "mechanical" | "manual" | "ai-assisted"): DiagnosticFinding {
+    return createFinding({
+      checkId: this.checkId,
+      severity: "red",
+      target: this.target,
+      message: `.claude/settings.json の Grok-compatible hook wiring が古いか不足しています: ${detail}`,
+      repairMode,
+      repairHint: REPAIR_HINT,
+    });
+  }
+}

package/scripts/harness/installation/application/checks/husky-runtime-inactive-check.ts

@@ -0,0 +1,33 @@
+// @unit installation
+// @layer application
+// @work-item-id WI-390
+
+import type { DiagnosticFinding } from '../../domain/diagnostic-finding.js';
+import type { GitHooksRuntimeProbe } from '../../domain/ports/git-hooks-runtime-probe.js';
+import type { FileInspector } from '../../domain/ports/file-inspector.js';
+import type { HeuristicCheck } from '../../domain/ports/heuristic-check.js';
+import { createFinding } from './check-utils.js';
+
+export class HuskyRuntimeInactiveCheck implements HeuristicCheck {
+  readonly checkId = 'husky-runtime-inactive' as const;
+
+  constructor(private readonly runtimeProbe: GitHooksRuntimeProbe) {}
+
+  async run(projectRoot: string, _inspector: FileInspector): Promise<DiagnosticFinding | null> {
+    const state = await this.runtimeProbe.probe(projectRoot);
+    if (state.isActive()) return null;
+
+    const detail =
+      state.kind === 'unavailable'
+        ? `Git hooks runtime を確認できませんでした: ${state.detail ?? 'unknown error'}`
+        : `Husky runtime が無効です: reason=${state.reason}, core.hooksPath=${state.hooksPath ?? 'unset'}`;
+    return createFinding({
+      checkId: this.checkId,
+      severity: 'red',
+      target: 'core.hooksPath',
+      message: detail,
+      repairMode: 'mechanical',
+      repairHint: 'npx phasegate setup:agent --apply --with-husky',
+    });
+  }
+}

package/scripts/harness/installation/application/named-hook-json.ts

@@ -0,0 +1,17 @@
+// @unit installation
+// @layer application
+// @work-item-id WI-385
+
+export const PHASEGATE_NAMED_HOOK = "phasegate-gate";
+
+export function mergeNamedHookJson(
+  existing: Readonly<Record<string, unknown>>,
+  incoming: Readonly<Record<string, unknown>>,
+): Record<string, unknown> {
+  const owned = incoming[PHASEGATE_NAMED_HOOK];
+  return owned === undefined ? { ...existing } : { ...existing, [PHASEGATE_NAMED_HOOK]: owned };
+}
+
+export function removeNamedHookJson(existing: Readonly<Record<string, unknown>>): Record<string, unknown> {
+  return Object.fromEntries(Object.entries(existing).filter(([key]) => key !== PHASEGATE_NAMED_HOOK));
+}

package/scripts/harness/installation/application/operator-notice.ts

@@ -0,0 +1,42 @@
+// @unit installation
+// @layer application
+// @work-item-id WI-384
+// @work-item-id WI-385
+
+export interface OperatorNotice {
+  readonly code:
+    | "CODEX_HOOK_TRUST_REQUIRED"
+    | "CODEX_HOOK_TRUST_UNVERIFIABLE"
+    | "GROK_HOOK_TRUST_UNVERIFIABLE"
+    | "ANTIGRAVITY_CLI_ONLY";
+  readonly level: "info";
+  readonly message: string;
+}
+
+export const CODEX_HOOK_TRUST_REQUIRED_NOTICE: OperatorNotice = Object.freeze({
+  code: "CODEX_HOOK_TRUST_REQUIRED",
+  level: "info",
+  message:
+    "Codex CLI >= 0.124.0 is required for native apply_patch hooks. The hook definition hash changed; open /hooks and trust the updated definition before relying on the edit-time gate.",
+});
+
+export const CODEX_HOOK_TRUST_UNVERIFIABLE_NOTICE: OperatorNotice = Object.freeze({
+  code: "CODEX_HOOK_TRUST_UNVERIFIABLE",
+  level: "info",
+  message:
+    "Codex CLI >= 0.124.0 is required for native apply_patch hooks. Phasegate cannot verify the external trust store; open /hooks and confirm the current hook definition is trusted.",
+});
+
+export const GROK_HOOK_TRUST_UNVERIFIABLE_NOTICE: OperatorNotice = Object.freeze({
+  code: "GROK_HOOK_TRUST_UNVERIFIABLE",
+  level: "info",
+  message:
+    "Phasegate cannot verify Grok's project-hook trust state. Run grok inspect, open /hooks, and approve with --trust or /hooks-trust before relying on the edit-time gate; keep the L2 pre-commit backstop enabled.",
+});
+
+export const ANTIGRAVITY_CLI_ONLY_NOTICE: OperatorNotice = Object.freeze({
+  code: "ANTIGRAVITY_CLI_ONLY",
+  level: "info",
+  message:
+    "Antigravity hard blocking is supported for the agy CLI surface only. IDE/desktop hook execution is not guaranteed; the L2 pre-commit gate remains the primary backstop there.",
+});