qualia-framework 6.9.0 → 6.14.0

package/tests/hooks.test.sh

@@ -96,29 +96,78 @@ TMP=$(setup_guard_repo main OWNER)
 assert_exit "OWNER on main → allowed" 0 $?
 rm -rf "$TMP"
 
-# EMPLOYEE on main → blocked (exit 2)
+# EMPLOYEE on main → ALLOWED + counted + notice (v6.10 policy: accountability, not block)
 TMP=$(setup_guard_repo main EMPLOYEE)
 OUT=$(cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" 2>&1)
 RC=$?
-if [ "$RC" -eq 2 ] && echo "$OUT" | grep -q "BLOCKED" && echo "$OUT" | grep -q "main"; then
-  echo "  ✓ EMPLOYEE on main → blocked (BLOCKED in stdout)"
+if [ "$RC" -eq 0 ] \
+   && echo "$OUT" | grep -q "NOTICE" \
+   && grep -q "employee_main_push" "$TMP/.claude/.main-push-events.json" 2>/dev/null \
+   && grep -q '"total": 1' "$TMP/.claude/.main-push-events.json" 2>/dev/null; then
+  echo "  ✓ EMPLOYEE on main → allowed + recorded + notice"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ EMPLOYEE on main → allowed+recorded (exit=$RC out=$OUT)"
+  FAIL=$((FAIL + 1))
+fi
+rm -rf "$TMP"
+
+# EMPLOYEE repeated main push → per-employee count increments (framework counts)
+TMP=$(setup_guard_repo main EMPLOYEE)
+(cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" >/dev/null 2>&1)
+(cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" >/dev/null 2>&1)
+if grep -q '"total": 2' "$TMP/.claude/.main-push-events.json" 2>/dev/null; then
+  echo "  ✓ EMPLOYEE repeated main push → count increments to 2"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ EMPLOYEE repeated main push → count increments"
+  FAIL=$((FAIL + 1))
+fi
+rm -rf "$TMP"
+
+# EMPLOYEE refspec push to main from a feature branch → recorded
+TMP=$(setup_guard_repo feature/xyz EMPLOYEE)
+OUT=$(cd "$TMP/proj" && printf '%s' '{"tool_input":{"command":"git push origin feature/xyz:main"}}' | HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" 2>&1)
+RC=$?
+if [ "$RC" -eq 0 ] && grep -q "employee_main_push" "$TMP/.claude/.main-push-events.json" 2>/dev/null; then
+  echo "  ✓ EMPLOYEE refspec push to :main → allowed + recorded"
   PASS=$((PASS + 1))
 else
-  echo "  ✗ EMPLOYEE on main → blocked (exit=$RC)"
+  echo "  ✗ EMPLOYEE refspec push to :main → recorded (exit=$RC)"
   FAIL=$((FAIL + 1))
 fi
 rm -rf "$TMP"
 
-# EMPLOYEE on master → blocked
+# EMPLOYEE on master → allowed + recorded
 TMP=$(setup_guard_repo master EMPLOYEE)
 (cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" >/dev/null 2>&1)
-assert_exit "EMPLOYEE on master → blocked" 2 $?
+assert_exit "EMPLOYEE on master → allowed (recorded)" 0 $?
 rm -rf "$TMP"
 
-# EMPLOYEE on feature branch → allowed
+# EMPLOYEE on feature branch → allowed, NOT recorded
 TMP=$(setup_guard_repo feature/xyz EMPLOYEE)
 (cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" >/dev/null 2>&1)
-assert_exit "EMPLOYEE on feature/xyz → allowed" 0 $?
+RC=$?
+if [ "$RC" -eq 0 ] && [ ! -f "$TMP/.claude/.main-push-events.json" ]; then
+  echo "  ✓ EMPLOYEE on feature/xyz → allowed, not recorded"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ EMPLOYEE on feature/xyz → allowed/not-recorded (exit=$RC)"
+  FAIL=$((FAIL + 1))
+fi
+rm -rf "$TMP"
+
+# OWNER on main → allowed, NOT recorded (OWNER pushes are unremarkable)
+TMP=$(setup_guard_repo main OWNER)
+(cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" >/dev/null 2>&1)
+RC=$?
+if [ "$RC" -eq 0 ] && [ ! -f "$TMP/.claude/.main-push-events.json" ]; then
+  echo "  ✓ OWNER on main → allowed, not recorded"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ OWNER on main → allowed/not-recorded (exit=$RC)"
+  FAIL=$((FAIL + 1))
+fi
 rm -rf "$TMP"
 
 # OWNER on feature branch → allowed
@@ -127,31 +176,38 @@ TMP=$(setup_guard_repo feature/xyz OWNER)
 assert_exit "OWNER on feature/xyz → allowed" 0 $?
 rm -rf "$TMP"
 
-# Missing config → fails closed (block, exit 2)
+# Missing config → allowed (the hook never blocks now)
 TMP=$(mktemp -d)
 mkdir -p "$TMP/proj"
-(cd "$TMP/proj" && git init -q && git checkout -b feature/x -q 2>/dev/null)
+(cd "$TMP/proj" && git init -q && git checkout -b main -q 2>/dev/null)
 # NO .claude/.qualia-config.json
 (cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" >/dev/null 2>&1)
-assert_exit "missing config → blocked (fails closed)" 2 $?
+assert_exit "missing config → allowed (never blocks)" 0 $?
 rm -rf "$TMP"
 
-# Malformed config JSON → fails closed
+# Malformed config JSON → allowed
 TMP=$(mktemp -d)
 mkdir -p "$TMP/proj" "$TMP/.claude"
-(cd "$TMP/proj" && git init -q && git checkout -b feature/x -q 2>/dev/null)
+(cd "$TMP/proj" && git init -q && git checkout -b main -q 2>/dev/null)
 echo 'not json{' > "$TMP/.claude/.qualia-config.json"
 (cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" >/dev/null 2>&1)
-assert_exit "malformed config JSON → blocked" 2 $?
+assert_exit "malformed config JSON → allowed" 0 $?
 rm -rf "$TMP"
 
-# Empty role field → fails closed
+# Empty role field → allowed, not recorded (not a known EMPLOYEE)
 TMP=$(mktemp -d)
 mkdir -p "$TMP/proj" "$TMP/.claude"
-(cd "$TMP/proj" && git init -q && git checkout -b feature/x -q 2>/dev/null)
+(cd "$TMP/proj" && git init -q && git checkout -b main -q 2>/dev/null)
 echo '{"role":""}' > "$TMP/.claude/.qualia-config.json"
 (cd "$TMP/proj" && HOME="$TMP" $NODE "$HOOKS_DIR/branch-guard.js" >/dev/null 2>&1)
-assert_exit "empty role field → blocked" 2 $?
+RC=$?
+if [ "$RC" -eq 0 ] && [ ! -f "$TMP/.claude/.main-push-events.json" ]; then
+  echo "  ✓ empty role → allowed, not recorded"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ empty role → allowed/not-recorded (exit=$RC)"
+  FAIL=$((FAIL + 1))
+fi
 rm -rf "$TMP"
 
 # --- fawzi-approval-guard.js ---
@@ -382,6 +438,72 @@ RC=$?
 assert_exit "regular page.tsx with service_role → blocked (exit 2)" 2 $RC
 rm -rf "$TMP"
 
+# --- pre-deploy-gate: anti-slop gate (slop-detect.mjs wired into ship) ---
+# Build a tmp QUALIA_HOME carrying bin/slop-detect.mjs so the gate can find it.
+SLOP_SRC="$(cd "$(dirname "$0")/../bin" && pwd)/slop-detect.mjs"
+
+# Purple-blue gradient (CRITICAL design tell) → blocked with anti-slop diagnostic
+TMP=$(mktemp -d)
+QH=$(mktemp -d)
+mkdir -p "$QH/bin" "$TMP/app"
+cp "$SLOP_SRC" "$QH/bin/slop-detect.mjs"
+echo 'export default function P(){return <div className="bg-gradient-to-r from-blue-500 to-purple-600">hi</div>;}' > "$TMP/app/page.tsx"
+OUT=$( (cd "$TMP" && QUALIA_HOME="$QH" $NODE "$HOOKS_DIR/pre-deploy-gate.js") 2>&1 )
+RC=$?
+if [ "$RC" -eq 2 ] && echo "$OUT" | grep -qi "anti-slop"; then
+  echo "  ✓ purple-blue gradient → blocked by anti-slop gate (exit 2)"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ purple-blue gradient → anti-slop block (exit=$RC out=$OUT)"
+  FAIL=$((FAIL + 1))
+fi
+rm -rf "$TMP" "$QH"
+
+# Clean frontend file → anti-slop passes → exit 0 with "Anti-slop" check shown
+TMP=$(mktemp -d)
+QH=$(mktemp -d)
+mkdir -p "$QH/bin" "$TMP/app"
+cp "$SLOP_SRC" "$QH/bin/slop-detect.mjs"
+echo 'export default function P(){return <div className="bg-stone-50 text-ink">hi</div>;}' > "$TMP/app/page.tsx"
+OUT=$( (cd "$TMP" && QUALIA_HOME="$QH" $NODE "$HOOKS_DIR/pre-deploy-gate.js") 2>&1 )
+RC=$?
+if [ "$RC" -eq 0 ] && echo "$OUT" | grep -q "Anti-slop"; then
+  echo "  ✓ clean frontend → anti-slop passes (exit 0)"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ clean frontend → anti-slop passes (exit=$RC out=$OUT)"
+  FAIL=$((FAIL + 1))
+fi
+rm -rf "$TMP" "$QH"
+
+# QUALIA_SKIP_SLOP=1 by non-OWNER → blocked (OWNER-only escape)
+TMP=$(mktemp -d)
+QH=$(mktemp -d)
+mkdir -p "$QH/bin" "$TMP/app"
+cp "$SLOP_SRC" "$QH/bin/slop-detect.mjs"
+echo '{"role":"EMPLOYEE"}' > "$QH/.qualia-config.json"
+echo 'export default function P(){return <div className="bg-gradient-to-r from-blue-500 to-purple-600">x</div>;}' > "$TMP/app/page.tsx"
+OUT=$( (cd "$TMP" && QUALIA_SKIP_SLOP=1 QUALIA_HOME="$QH" $NODE "$HOOKS_DIR/pre-deploy-gate.js") 2>&1 )
+RC=$?
+if [ "$RC" -eq 2 ] && echo "$OUT" | grep -q "OWNER-only"; then
+  echo "  ✓ QUALIA_SKIP_SLOP by non-OWNER → blocked (OWNER-only)"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ QUALIA_SKIP_SLOP non-OWNER block (exit=$RC out=$OUT)"
+  FAIL=$((FAIL + 1))
+fi
+rm -rf "$TMP" "$QH"
+
+# Scanner absent (older install) → gate skips silently → exit 0
+TMP=$(mktemp -d)
+QH=$(mktemp -d)
+mkdir -p "$TMP/app"
+echo 'export default function P(){return <div className="bg-gradient-to-r from-blue-500 to-purple-600">x</div>;}' > "$TMP/app/page.tsx"
+OUT=$( (cd "$TMP" && QUALIA_HOME="$QH" $NODE "$HOOKS_DIR/pre-deploy-gate.js") 2>&1 )
+RC=$?
+assert_exit "anti-slop gate skips when scanner absent (exit 0)" 0 $RC
+rm -rf "$TMP" "$QH"
+
 # --- session-start.js — must exit 0 always ---
 echo ""
 echo "session-start:"
@@ -420,6 +542,38 @@ else
 fi
 rm -rf "$TMP"
 
+# --- session-start.js — stale update banner self-clears (regression: v6.9.1) ---
+# A notif file whose advertised `latest` is already installed must NOT render a
+# false "update available" banner; it must be deleted. A genuinely-newer notif
+# must be preserved.
+QH=$(mktemp -d)
+mkdir -p "$QH/bin"
+echo 'process.exit(0)' > "$QH/bin/qualia-ui.js"   # dummy UI so render path is reachable
+echo '{"code":"QS-FAWZI-11","version":"6.9.0"}' > "$QH/.qualia-config.json"
+
+# Case 1: installed (6.9.0) >= notif.latest (6.9.0) → stale, must self-clear
+echo '{"current":"6.8.1","latest":"6.9.0","detected_at":"t"}' > "$QH/.qualia-update-available.json"
+(cd "$QH" && QUALIA_HOME="$QH" $NODE "$HOOKS_DIR/session-start.js" >/dev/null 2>&1)
+if [ ! -f "$QH/.qualia-update-available.json" ]; then
+  echo "  ✓ stale update notice self-clears when version caught up"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ stale update notice was NOT cleared"
+  FAIL=$((FAIL + 1))
+fi
+
+# Case 2: installed (6.9.0) < notif.latest (9.9.9) → genuine, must persist
+echo '{"current":"6.9.0","latest":"9.9.9","detected_at":"t"}' > "$QH/.qualia-update-available.json"
+(cd "$QH" && QUALIA_HOME="$QH" $NODE "$HOOKS_DIR/session-start.js" >/dev/null 2>&1)
+if [ -f "$QH/.qualia-update-available.json" ]; then
+  echo "  ✓ genuine update notice is preserved"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ genuine update notice was wrongly cleared"
+  FAIL=$((FAIL + 1))
+fi
+rm -rf "$QH"
+
 # pre-compact.js removed in v6.2.0 — state.js journal provides crash safety.
 
 # --- auto-update.js ---
@@ -563,6 +717,85 @@ else
 fi
 rm -rf "$TMP"
 
+# --- task-write-guard.js (R1 — runtime plan-contract file-scope guard) ---
+echo ""
+echo "task-write-guard:"
+
+AS_BIN="$(cd "$(dirname "$0")/../bin" && pwd)/agent-status.js"
+
+# setup_twg_project → tmp dir with a phase-1 contract (T1 declares src/a.ts +
+# src/b.ts) and an active RUNNING status for T1. Prints the dir; caller rm -rf.
+setup_twg_project() {
+  local tmp
+  tmp=$(mktemp -d)
+  mkdir -p "$tmp/.planning"
+  cat > "$tmp/.planning/phase-1-contract.json" <<'EOF'
+{
+  "version": 1,
+  "phase": 1,
+  "tasks": [
+    { "id": "T1", "wave": 1, "files_modify": ["src/a.ts"], "files_create": ["src/b.ts"] }
+  ]
+}
+EOF
+  echo "$tmp"
+}
+twg() { echo "{\"tool_input\":{\"file_path\":\"$2\"}}" | (cd "$1" && $NODE "$HOOKS_DIR/task-write-guard.js" >/dev/null 2>&1); }
+
+# No active build → guard is a no-op even on an undeclared file
+TMP=$(setup_twg_project)
+twg "$TMP" "src/evil.ts"
+assert_exit "no active build → allowed (no-op)" 0 $?
+rm -rf "$TMP"
+
+# Active build (T1 RUNNING) + write to a DECLARED file → allowed
+TMP=$(setup_twg_project)
+$NODE "$AS_BIN" write T1 RUNNING --phase 1 --wave 1 --cwd "$TMP" >/dev/null 2>&1
+twg "$TMP" "src/a.ts"
+assert_exit "active build + declared file → allowed" 0 $?
+
+# Active build + write to an UNDECLARED file → blocked (exit 2)
+OUT=$(echo '{"tool_input":{"file_path":"src/evil.ts"}}' | (cd "$TMP" && $NODE "$HOOKS_DIR/task-write-guard.js" 2>&1))
+RC=$?
+if [ "$RC" -eq 2 ] && echo "$OUT" | grep -q "task-write-guard" && echo "$OUT" | grep -q "evil.ts"; then
+  echo "  ✓ active build + undeclared file → blocked with diagnostic"
+  PASS=$((PASS + 1))
+else
+  echo "  ✗ active build + undeclared file → blocked (exit=$RC out=$OUT)"
+  FAIL=$((FAIL + 1))
+fi
+
+# files_create entries count as declared
+twg "$TMP" "src/b.ts"
+assert_exit "active build + declared files_create → allowed" 0 $?
+
+# .planning/ and .agent-status/ paths are always writable during a build
+twg "$TMP" ".planning/phase-1-verification.md"
+assert_exit "active build + .planning path → allowed" 0 $?
+twg "$TMP" ".agent-status/T1.json"
+assert_exit "active build + .agent-status path → allowed" 0 $?
+
+# OWNER escape hatch overrides the block
+echo '{"tool_input":{"file_path":"src/evil.ts"}}' | (cd "$TMP" && QUALIA_ALLOW_OUTSIDE_CONTRACT=1 $NODE "$HOOKS_DIR/task-write-guard.js" >/dev/null 2>&1)
+assert_exit "QUALIA_ALLOW_OUTSIDE_CONTRACT=1 → allowed despite undeclared" 0 $?
+
+# Absolute path to an undeclared file still blocks
+echo "{\"tool_input\":{\"file_path\":\"$TMP/src/evil.ts\"}}" | (cd "$TMP" && $NODE "$HOOKS_DIR/task-write-guard.js" >/dev/null 2>&1)
+assert_exit "active build + absolute undeclared path → blocked" 2 $?
+
+# Once T1 flips to DONE (no RUNNING), the guard goes quiet again
+$NODE "$AS_BIN" write T1 DONE --commit abc --cwd "$TMP" >/dev/null 2>&1
+twg "$TMP" "src/evil.ts"
+assert_exit "build finished (no RUNNING) → allowed" 0 $?
+rm -rf "$TMP"
+
+# Active build but no contract present → fail open (allowed)
+TMP=$(mktemp -d)
+$NODE "$AS_BIN" write T1 RUNNING --phase 1 --cwd "$TMP" >/dev/null 2>&1
+twg "$TMP" "src/anything.ts"
+assert_exit "active build + no contract → allowed (fail open)" 0 $?
+rm -rf "$TMP"
+
 echo ""
 echo "=== Results: $PASS passed, $FAIL failed ==="
 [ "$FAIL" -eq 0 ] && exit 0 || exit 1

package/tests/install-smoke.test.sh

@@ -124,10 +124,12 @@ else
 fi
 
 if [ -d "$HOME_DIR/.claude/hooks" ] \
-  && [ "$(find "$HOME_DIR/.claude/hooks" -maxdepth 1 -name '*.js' | wc -l | tr -d ' ')" = "13" ] \
+  && [ "$(find "$HOME_DIR/.claude/hooks" -maxdepth 1 -name '*.js' | wc -l | tr -d ' ')" = "15" ] \
   && [ -f "$HOME_DIR/.claude/hooks/fawzi-approval-guard.js" ] \
-  && [ -f "$HOME_DIR/.claude/hooks/pre-compact.js" ]; then
-  pass "packaged install has 13 hooks including pre-compact (v6.3.2 sidecar snapshot)"
+  && [ -f "$HOME_DIR/.claude/hooks/pre-compact.js" ] \
+  && [ -f "$HOME_DIR/.claude/hooks/usage-capture.js" ] \
+  && [ -f "$HOME_DIR/.claude/hooks/task-write-guard.js" ]; then
+  pass "packaged install has 15 hooks including task-write-guard (v6.13)"
 else
   fail_case "packaged hook set mismatch"
 fi

package/tests/lib.test.sh

@@ -507,7 +507,7 @@ TMP=$(mktmp)
 mkdir -p "$TMP/home/.claude/bin" "$TMP/home/.claude/hooks" "$TMP/home/.claude/knowledge/daily-log" "$TMP/home/.claude/qualia-design" "$TMP/home/.claude/agents" "$TMP/home/.claude/qualia-templates" "$TMP/project"
 echo '{"installed_by":"Test","role":"OWNER","version":"6.3.0","erp":{"enabled":false}}' > "$TMP/home/.claude/.qualia-config.json"
 touch "$TMP/home/.claude/CLAUDE.md" "$TMP/home/.claude/settings.json"
-for f in runtime-manifest.js command-surface.js host-adapters.js state.js qualia-ui.js statusline.js knowledge.js knowledge-flush.js state-ledger.js plan-contract.js contract-runner.js harness-eval.js trust-score.js agent-runs.js slop-detect.mjs erp-retry.js work-packet.js report-payload.js project-snapshot.js codex-goal.js planning-hygiene.js prune-deprecated.js learning-candidates.js status-snapshot.js security-scan.js auto-report.js; do
+for f in runtime-manifest.js command-surface.js host-adapters.js state.js qualia-ui.js statusline.js knowledge.js knowledge-flush.js state-ledger.js plan-contract.js contract-runner.js agent-status.js analyze-gate.js harness-eval.js trust-score.js agent-runs.js slop-detect.mjs erp-retry.js work-packet.js report-payload.js project-snapshot.js codex-goal.js planning-hygiene.js prune-deprecated.js learning-candidates.js status-snapshot.js security-scan.js auto-report.js; do
   touch "$TMP/home/.claude/bin/$f"
 done
 for h in session-start.js auto-update.js branch-guard.js pre-push.js pre-deploy-gate.js migration-guard.js git-guardrails.js stop-session-log.js fawzi-approval-guard.js vercel-account-guard.js env-empty-guard.js supabase-destructive-guard.js; do
@@ -622,7 +622,7 @@ TMP=$(mktmp)
 mkdir -p "$TMP/.claude/bin" "$TMP/.claude/hooks" "$TMP/.claude/knowledge/daily-log" "$TMP/.claude/qualia-design" "$TMP/.claude/agents" "$TMP/.claude/qualia-templates" "$TMP/project/.planning"
 echo '{"installed_by":"Test","role":"OWNER","erp":{"enabled":false}}' > "$TMP/.claude/.qualia-config.json"
 touch "$TMP/.claude/CLAUDE.md" "$TMP/.claude/settings.json"
-for f in runtime-manifest.js command-surface.js host-adapters.js state.js qualia-ui.js statusline.js knowledge.js knowledge-flush.js state-ledger.js plan-contract.js contract-runner.js harness-eval.js trust-score.js agent-runs.js slop-detect.mjs erp-retry.js work-packet.js report-payload.js project-snapshot.js codex-goal.js planning-hygiene.js prune-deprecated.js learning-candidates.js status-snapshot.js security-scan.js auto-report.js; do
+for f in runtime-manifest.js command-surface.js host-adapters.js state.js qualia-ui.js statusline.js knowledge.js knowledge-flush.js state-ledger.js plan-contract.js contract-runner.js agent-status.js analyze-gate.js harness-eval.js trust-score.js agent-runs.js slop-detect.mjs erp-retry.js work-packet.js report-payload.js project-snapshot.js codex-goal.js planning-hygiene.js prune-deprecated.js learning-candidates.js status-snapshot.js security-scan.js auto-report.js; do
   touch "$TMP/.claude/bin/$f"
 done
 for h in session-start.js auto-update.js branch-guard.js pre-push.js pre-deploy-gate.js migration-guard.js git-guardrails.js stop-session-log.js fawzi-approval-guard.js vercel-account-guard.js env-empty-guard.js supabase-destructive-guard.js; do

package/tests/run-all.sh

@@ -18,6 +18,8 @@ SUITES=(
   "refs"
   "install-smoke"
   "slop-detect"
+  "agent-status"
+  "analyze-gate"
 )
 
 FAILED=()

package/tests/runner.js

@@ -2578,14 +2578,15 @@ describe("install.js", () => {
     }
   });
 
-  it("13 hooks installed (v6.3.2: pre-compact reintroduced with sidecar-snapshot mechanism)", () => {
+  it("15 hooks installed (v6.13: task-write-guard added — R1 plan-contract file-scope guard)", () => {
     const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "qualia-install-"));
     try {
       runInstall("QS-FAWZI-11", tmpHome);
       const hooks = fs.readdirSync(path.join(tmpHome, ".claude", "hooks")).filter(f => f.endsWith(".js"));
-      assert.equal(hooks.length, 13, `expected 13 hooks, got ${hooks.length}: ${hooks.join(", ")}`);
+      assert.equal(hooks.length, 15, `expected 15 hooks, got ${hooks.length}: ${hooks.join(", ")}`);
       assert.ok(hooks.includes("fawzi-approval-guard.js"), "fawzi-approval-guard.js must be installed");
       assert.ok(hooks.includes("pre-compact.js"), "pre-compact.js must be installed (v6.3.2 sidecar-snapshot mechanism)");
+      assert.ok(hooks.includes("task-write-guard.js"), "task-write-guard.js must be installed (v6.13 R1 guard)");
     } finally {
       fs.rmSync(tmpHome, { recursive: true, force: true });
     }

package/tests/state.test.sh

@@ -104,6 +104,12 @@ Goal: Test goal
 ## Success Criteria
 - [ ] Test passes
 PLAN
+  # v7 kernel: `planned` now requires a machine contract and `verified(pass)`
+  # requires passing machine evidence. Emit both so happy-path setups satisfy the
+  # preconditions; the few cases that exercise their ABSENCE delete them explicitly.
+  make_valid_contract "$dir" "$phase"
+  mkdir -p "$dir/.planning/evidence"
+  printf '{"ok":true,"checks":[]}\n' > "$dir/.planning/evidence/phase-${phase}-contract-run.json"
 }
 
 make_valid_contract() {
@@ -289,6 +295,9 @@ fi
 TMP=$(make_project)
 make_valid_plan "$TMP" 1
 make_valid_contract "$TMP" 1
+# This case asserts the missing-evidence guard, so strip the evidence that
+# make_valid_plan now writes by default.
+rm -f "$TMP/.planning/evidence/phase-1-contract-run.json"
 (cd "$TMP" && $NODE "$STATE_JS" transition --to planned >/dev/null 2>&1)
 (cd "$TMP" && $NODE "$STATE_JS" transition --to built --tasks-done 1 --tasks-total 1 >/dev/null 2>&1)
 echo "result: PASS" > "$TMP/.planning/phase-1-verification.md"
@@ -735,6 +744,9 @@ else
   fail_case "validate well-formed plan" "exit=$EXIT out=$OUT"
 fi
 
+# This case asserts the missing-contract path, so strip the contract that
+# make_valid_plan now writes by default.
+rm -f "$TMP/.planning/phase-1-contract.json"
 OUT=$(cd "$TMP" && $NODE "$STATE_JS" validate-plan --phase 1 --require-contract 2>&1)
 EXIT=$?
 if [ "$EXIT" -eq 1 ] \
@@ -1417,6 +1429,89 @@ else
   fail_case "id traversal guard" "out=$TRAV"
 fi
 
+# ─── v7 lifecycle (build → operate) ──────────────────────
+echo ""
+echo "lifecycle (build/operate):"
+
+# Helper: drive a fresh single-phase project to verified(pass).
+make_verified() {
+  local dir="$1"
+  make_valid_plan "$dir" 1
+  (cd "$dir" && $NODE "$STATE_JS" transition --to planned >/dev/null 2>&1)
+  (cd "$dir" && $NODE "$STATE_JS" transition --to built --tasks-done 1 --tasks-total 1 >/dev/null 2>&1)
+  echo "result: PASS" > "$dir/.planning/phase-1-verification.md"
+}
+
+# 1. A new project defaults to lifecycle=build
+TMP=$(_mktemp_native); TMP_DIRS+=("$TMP")
+(cd "$TMP" && git init -q 2>/dev/null; $NODE "$STATE_JS" init --project acme --total-phases 1 --phases '[{"name":"Core","goal":"x"}]' --force >/dev/null 2>&1)
+OUT=$(cd "$TMP" && $NODE "$STATE_JS" check 2>&1)
+if echo "$OUT" | grep -q '"lifecycle": "build"'; then
+  pass "init defaults to lifecycle=build"
+else
+  fail_case "init lifecycle default" "out=$OUT"
+fi
+
+# 2. launch flips to operate, stamps launched_at + source, routes to /qualia-update
+OUT=$(cd "$TMP" && $NODE "$STATE_JS" launch --deployed-url https://acme.app --source erp 2>&1)
+if echo "$OUT" | grep -q '"lifecycle": "operate"' \
+   && echo "$OUT" | grep -q '"launch_source": "erp"' \
+   && echo "$OUT" | grep -q '"next_command": "/qualia-update"' \
+   && echo "$OUT" | grep -q '"launched_at"'; then
+  pass "launch → operate (stamped, routes to /qualia-update)"
+else
+  fail_case "launch to operate" "out=$OUT"
+fi
+
+# 3. launch is idempotent
+OUT=$(cd "$TMP" && $NODE "$STATE_JS" launch 2>&1)
+if echo "$OUT" | grep -q '"already_launched": true'; then
+  pass "launch is idempotent (already_launched)"
+else
+  fail_case "launch idempotent" "out=$OUT"
+fi
+
+# 4. operate: verified(pass) on the last phase routes to /qualia-update + bumps updates_completed
+TMP=$(_mktemp_native); TMP_DIRS+=("$TMP")
+(cd "$TMP" && git init -q 2>/dev/null; $NODE "$STATE_JS" init --project beta --total-phases 1 --phases '[{"name":"Core","goal":"x"}]' --force >/dev/null 2>&1)
+(cd "$TMP" && $NODE "$STATE_JS" launch >/dev/null 2>&1)
+make_verified "$TMP"
+OUT=$(cd "$TMP" && $NODE "$STATE_JS" transition --to verified --verification pass 2>&1)
+if echo "$OUT" | grep -q '"next_command": "/qualia-update"'; then
+  pass "operate verified(pass) → /qualia-update"
+else
+  fail_case "operate verified routing" "out=$OUT"
+fi
+OUT=$(cd "$TMP" && $NODE "$STATE_JS" check 2>&1)
+if echo "$OUT" | grep -q '"updates_completed": 1'; then
+  pass "operate verified(pass) bumps lifetime.updates_completed"
+else
+  fail_case "updates_completed bump" "out=$OUT"
+fi
+
+# 5. BUILD mode still REQUIRES HANDOFF.md (regression: forced handoff intact in build)
+TMP=$(_mktemp_native); TMP_DIRS+=("$TMP")
+(cd "$TMP" && git init -q 2>/dev/null; $NODE "$STATE_JS" init --project gamma --total-phases 1 --phases '[{"name":"Core","goal":"x"}]' --force >/dev/null 2>&1)
+make_verified "$TMP"
+(cd "$TMP" && $NODE "$STATE_JS" transition --to verified --verification pass >/dev/null 2>&1)
+(cd "$TMP" && $NODE "$STATE_JS" transition --to polished >/dev/null 2>&1)
+(cd "$TMP" && $NODE "$STATE_JS" transition --to shipped --deployed-url https://x.app >/dev/null 2>&1)
+OUT=$(cd "$TMP" && $NODE "$STATE_JS" transition --to handed_off 2>&1)
+if echo "$OUT" | grep -q '"error": "MISSING_FILE"'; then
+  pass "build mode → handed_off still requires HANDOFF.md"
+else
+  fail_case "build handoff still gated" "out=$OUT"
+fi
+
+# 6. OPERATE mode: handed_off allowed WITHOUT HANDOFF.md (forced handoff removed)
+(cd "$TMP" && $NODE "$STATE_JS" launch >/dev/null 2>&1)   # same project → flip to operate
+OUT=$(cd "$TMP" && $NODE "$STATE_JS" transition --to handed_off 2>&1)
+if echo "$OUT" | grep -q '"status": "handed_off"' && echo "$OUT" | grep -q '"ok": true'; then
+  pass "operate mode → handed_off allowed without HANDOFF.md"
+else
+  fail_case "operate handoff ungated" "out=$OUT"
+fi
+
 # ─── Summary ─────────────────────────────────────────────
 echo ""
 echo "=== Results: $PASS passed, $FAIL failed ==="